The University of Kentucky properly denied certain requests
from CNN relating to the university’s pediatric cardiothoracic program, but it
erred by not providing the news network with sufficient information about records
that the university claimed did not exist, the attorney general said in an
August 6 opinion.
The opinion,
In re:
CNN/University of Kentucky, concerned requests that CNN Senior Medical
Correspondent Elizabeth Cohen made to the university on February 13 and March
27, 2014.
Cohen requested records relating to UK’s pediatric heart
surgery program.
The university properly made two denials, the attorney
general said.
First, the university was not required to provide “the raw
data consisting of the total volume of surgeries, number of deaths, and number
of survivors related to its pediatric cardiothoracic program, as those numbers
are less than five.”
The university had previously disclosed mortality rates and
feared that disclosing the raw data could allow individual patients to be identified,
and the attorney general found that the releasing of this data was precluded
both by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)
and by KRS 61.878(1)(a).
Both of these laws, the opinion notes, share an aim of
protecting patient privacy, and the disclosure of the raw data sought by CNN
could allow individual patients to be identified.
The university relied on guidelines of the National Center
for Health Statistics in denying the request.
These guidelines, according to the opinion, prohibit (1) the
disclosure of quantity figures that are less than five and (2) the disclosure
of numbers greater than five if such disclosure could result in numbers less
than five being derivable through subtraction or other calculation.
The university argued that the guidelines are “helpful in
determining whether there is a reasonable basis to believe that an individual
patient can be identified,” the opinion stated.
The attorney general agreed and held, using the guideline’s
“less than five” baseline, that “a reasonable basis exists for UK’s
nondisclosure of this raw data.”
Second, the attorney general said the university properly
withheld reports submitted to it by the Society of Thoracic Surgeons “because
the records were compiled and maintained for scientific research.”
The attorney general relied on KRS 61.878(1)(b), which
provides an exception to disclosure for “
[r]ecords confidentially disclosed to an agency and compiled and maintained
for scientific research.”
The attorney general noted that UK had said the research was
disclosed to it “‘with the explicit understanding that the University would not
disclose the information to others.’”
Upon reviewing the reports, the attorney general said that
the introductory pages did contain a number of statements of confidentiality
and restrictions on disclosure by the university without the Society’s
permission. Because of this, the attorney general found that UK did not err by
denying this part of CNN’s request.
The university did err, however, by failing to provide CNN
with sufficient information about certain withheld records to permit CNN the
opportunity to dispute those records’ claimed nonexistence.
According to the opinion, the university “denied CNN’s March
27 request for collated mortality rates, and raw numbers of the total volume of
surgeries, number of deaths, and number of survivors for the program from
January 2006 to December 2010 and categorized by the five ‘STAT’ categories,
nine named procedures commonly treated as quality indicators, and, for the same
period but extending to October 2012, three identified procedures.”
The university denied the request, in part, because it
claimed the records were nonexistent, the opinion stated.
While the university was correct in that it has no
obligation to create a record that does not exist, the university failed to
identify which of the requests it would not honor on that basis, the attorney
general said.
The university’s actions also did not satisfy a standard
concerning open records requests recently explained by the Kentucky Supreme
Court, the opinion stated. In
City of Ft.
Thomas v. Cincinnati Enquirer, the Kentucky Supreme Court said an agency
must be held to its burden of proof by a sufficient factual showing to justify
an exemption.
Here, UK failed to specify which requests would not be
honored on the basis of the claimed records’ nonexistence, according to the
opinion.
“While it cannot produce a nonexistent record, and is not
legally obligated to create one, UK is obligated to provide CNN with sufficient
information about the nature of the record or records to which access was
denied based on it[s] or their nonexistence to permit CNN ‘to dispute the claim
and the court to assess it,’” the attorney general said.