(2005) , 90 Op. Att'y Gen. 45 ( 2005 )

Dear Jay L. Liner, County Attorney

You have asked for our opinion about the extent to which an "event report" created by the Baltimore County Fire Department to record the dispatch of an ambulance is disclosable in response to a request under the Public Information Act. You are primarily concerned with medical information and "patient identifiers" that may appear in that record. In addition, you ask whether the privacy rights of a minor transported by ambulance may be waived by the child's mother, if the mother's parental rights have been terminated by a court.

Consistent with our guidelines for opinion requests from local governments, you provided your own well researched opinion on these questions. In that opinion, you concluded the Maryland Confidentiality of Medical Records Law ("Medical Records Law") bars the release of medical information, as well as patient identifiers, in an event report when the record is associated with the dispatch of an ambulance to a particular address. You argued that, when a dispatch record is associated with a particular address, medical information that appears in the record could readily be linked to the individual transported by the ambulance. You reasoned that it would therefore be a "medical record" subject to the restrictions on disclosure set forth in the Medical Records Law. You also concluded that, when a mother's parental rights have been terminated with respect to a child, she is no longer a "person in interest" for purposes of the Medical Records Law, and therefore may not waive privacy rights of the child under that law.

We agree that medical information about an individual that appears in an event report should not be publicly disclosed except to a person in interest, although we reach that conclusion by a slightly different route. We do not believe that an event report fits the definition of "medical record" in the Medical Records Law; however, medical information about an individual that appears in an event report must be withheld from disclosure under an exception in the Public Information Act. The identity of the person who was transported by ambulance may be disclosed if it appears in the record.

We also agree with your conclusion that a mother whose parental rights have been terminated is not a person in interest for purposes of the Medical Records Law. Nor would she ordinarily be a person in interest under the Public Information Act.

I Background A. Ambulance Dispatch Records

Your inquiry concerns disclosure of a type of record entitled "Baltimore County Fire Department Events Report," which is also often referred to as an ambulance or fire "dispatch record." These forms, which exist in both electronic and paper formats, are used to record basic information about every incident to which the County Fire Department responds — e.g., fires, rescue calls, medical emergencies.

For example, when a 911 call requires the dispatch of emergency medical personnel, the event report will include basic information about the 911 call, identify the units that were dispatched in response to the call, and record the times of various events involved in the response (e.g., dispatch, arrival at the scene, arrival at a hospital, return to station, and similar events). The dispatch record may contain medical information about an individual in need of assistance, including the symptoms or condition of an ill or injured individual. It may also include information on the person's medical history or disease status. This information will be used to determine the appropriate personnel and equipment to send in response to the call.

Event reports are maintained electronically by the 911 call center, and in paper form by various units of the Fire Department, for up to six months. A copy printed out by a responding emergency medical services unit is destroyed immediately after the incident. Aggregate data from the reports are submitted to the State and federal governments as part of the National Fire Incident Reporting System program. See www.nfirs.fema.gov see also44 CFR §§ 152.4, 152.7. We understand that individual event reports are not otherwise disseminated.

The emergency medical services personnel assigned to an ambulance also create an "ambulance run sheet" for each transport conducted by the ambulance. The Maryland Institute for Emergency Medical Services Systems ("MIEMSS") has approved a form known as the MAIS ("Maryland Ambulance Information System") form for this purpose. See User's Manual for Maryland Ambulance Information System, www.miemss.org/mais2003.pdf. The run sheet, or MAIS form, contains detailed information concerning the itinerary of the ambulance during a particular call, vital signs and other medical information about the person transported, and the treatment provided to the patient. Id. at p. 2. One copy of the form is sent to MIEMSS, and another copy is left with the receiving hospital for inclusion in its records. Id. at p. 18; COMAR 30.03.04.04.¹

B. Request for Dispatch Record

We understand that the Fire Department received a request from a newspaper reporter for "any and all information" in its possession concerning a 911 call for emergency ambulance service at a particular address on a specified date during the past year. The Fire Department provided a copy of the dispatch record for that incident, but redacted portions of the record, including the part that described information provided by the caller to the 911 operator as well as a "patient identifier." The newspaper questioned whether the material should have been redacted. This raised the issue of what information on the dispatch record related to that call is available for public inspection and what information, if any, must be withheld.

II Disclosure of Dispatch Records A. General Rule of Disclosure

The Public Information Act ("PIA") governs the disclosure of records in the custody of a government entity such as a county fire department. Annotated Code of Maryland, State Government Article ("SG"), § 10-611 et seq. There is no question that a dispatch record falls within the PIA's broad definition of "public record." It is "documentary material ... made by [the fire department] ... in connection with the transaction of public business." SG § 10-611(g).

The PIA provides, as a general rule, that "[a]ll persons are entitled to have access to information about the affairs of government and the official acts of public officials and employees." SG § 10-612(a). The statute is to be construed liberally in favor of permitting inspection of public records "unless an unwarranted invasion of privacy" would result. SG § 10-612(b). A government agency is required by the PIA to permit inspection of any public record at any reasonable time "[e]xcept as otherwise provided by law." SG § 10-613(a)(1). The PIA thus defers to other laws that confer confidentiality on records, or parts of records. In addition, various exceptions in the PIA itself forbid the disclosure of specific types of records, forbid the disclosure of specific information, or give the custodian of a record discretion to withhold certain types of records, or part of a record, if that decision is in the public interest. SG § 10-615 through § 10-618.

Thus, a fire dispatch record in the custody of a county fire department is open to public inspection under the PIA, unless another law or an exception in the PIA provides otherwise. Cf. 71 Opinions of the Attorney General 288 (1986) (recordings of 911 calls themselves are public records available for public inspection, unless an exception to the general rule of disclosure applies). Two provisions of State law may limit the disclosure of medical information in the possession of a county fire department: (1) the Maryland Confidentiality of Medical Records Act, Annotated Code of Maryland, Health-General Article ("HG"), § 4-301 et seq.; and (2) the medical information exception in the PIA, SG § 10-617(b).²

B. Medical Records Law

1. Limitations on Disclosure

The Maryland Confidentiality of Medical Records Act ("Medical Records Law") generally requires health care providers and others to preserve the confidentiality of medical records. HG § 4-302(a). Special restrictions apply to mental health records. HG § 4-307. However, the restrictions do not apply to "information ... not kept in the medical record of a patient ... that is related to the administration of a health care facility...." HG § 4-302(b)(1).

In certain circumstances, the Medical Records Law allows disclosure of medical records with the written authorization or stipulation of the patient or another "person in interest." HG §§ 4-303,4-306(b)(6)(ii). In addition to the patient, the term "person in interest" in the Medical Records Law can include a health care agent, a personal representative of a deceased person, a parent of a minor in some circumstances, and an attorney for an individual who would otherwise qualify as a "person in interest" himself or herself. HG § 4-301(k). There are also some circumstances, set forth in the statute, in which a medical record may be disclosed without the authorization of a person in interest. HG §§ 4-305, 4-306. Even when the Medical Records Law allows disclosure of a medical record it restricts redisclosure of the record by the person receiving it. HG § 4-302(d).

The evident purpose of the statute is "to bolster the privacy rights of patients. The legislature recognized that, because of the personal and sensitive nature of one's medical records, a patient might experience emotional and financial harm if his medical records are improperly used or disclosed. It was further desired that the Act would enable health care providers to retain the full trust and confidence of their patients." Warner v. Lerner,115 Md. App. 428, 431-32, 693 A.2d 394 (1997), rev'd on other grounds,348 Md. 733, 705 A.2d 1169 (1998); see also Chapter 480, Preamble, Laws of Maryland 1990.

The Medical Records Law controls the dissemination of "medical records" in the possession of "health care providers." Thus, the definitions of those key terms determine the application of the statute.

2. Provider

The Medical Records Law defines "health care provider" to mean:

(i) A person who is licensed, certified, or otherwise authorized under the Health Occupations Article or § 13-516 of the Education Article to provide health care in the ordinary course of business or practice of a profession or in an approved education or training program;

(ii) A facility where health care is provided to patients ....

HG § 4-301(h)(1). The term also encompasses the agents and employees of a provider. HG § 4-301(h)(2).

You advise that all 911 operators and fire dispatchers in Baltimore County are trained as emergency medical dispatchers ("EMDs") and licensed by MIEMSS under Annotated Code of Maryland, Education Article ("ED"), § 13-516. In addition, the Fire Department, through its emergency medical technicians, who are also licensed under ED § 13-516, undoubtedly provides health care to those transported by its ambulances. Without delving into the question whether the dispatchers themselves "provide health care," we shall assume that the dispatch records are in the possession of a "provider" for purposes of the Medical Records Law.³

3. Medical Record

For purposes of the Medical Records Law, "medical record" is defined as:

any oral , written, or other transmission in any form or medium of information that:

(1) is entered into the record of a patient ...;

(2) identifies or can readily be associated with the identity of a patient ...; and

(3) relates to the health care of the patient ....

HG § 4-301(g)(1). "Health care" in turn is broadly defined to include "any care, treatment, or procedure by a health care provider ... to diagnose, evaluate, rehabilitate, manage, treat, or maintain the physical or mental condition of a patient ... or that affects the structure or any function of the human body." HG § 4-301(f).

A dispatch record is clearly a "written ... transmission in any form or medium of information." Depending on the precise contents of a particular dispatch record, it may be identified with particular individuals — i.e., the 911 caller and the person in need of assistance.⁴ It may, but does not always, contain information relating to the health care of an individual. In some instances, the caller may relate symptoms or other information about the medical condition of the person in need of assistance. In other instances, the caller may simply report an event — e.g., an automobile accident — from which the need for medical assistance may be inferred.

To our knowledge, the dispatch record is not entered into "the record of a patient." Rather, it is kept in a database of records pertaining to a wide variety of incidents, including 911 calls and other emergency assistance requests, many of which contain no medical information. This database is ultimately used to report aggregate data to a central database under a federal program. At most, the dispatch record falls within a category of records "not kept in the medical record of a patient ... that is related to the administration of a health care facility ...." HG § 4-302(b)(1). This is in contrast to the ambulance run sheet, which contains information that becomes part of the patient's record at the receiving hospital.⁵

In our view, a dispatch record is not a "medical record" under the Medical Records Law.

C. PIA Exception for Medical Information

One of the exceptions to the PIA's general rule of disclosure concerns medical information relating to an individual. The statute provides:

(a) Unless otherwise provided by law ...

(b)(1) Subject to paragraph (2) of this subsection, a custodian shall deny inspection of the part of a public record that contains medical or psychological information about an individual, other than an autopsy report of a medical examiner.

(2) A custodian shall permit the person in interest to inspect the public record to the extent permitted under [HG] § 4-304(a)....

SG § 10-617(a)-(b). Thus, regardless of whether medical information about an individual is contained in a "medical record," a government entity may not disclose that information except to a person in interest. To the extent that the medical information is "reasonably severable" from the record, a custodian must allow inspection of other portions of the record. SG § 10-614(b)(3)(iii).

The purpose underlying the exception for "medical information about an individual" in SG § 10-617(b) is the same as that underlying the Medical Records Law, and other laws that make various health care records confidential — to preserve a zone of privacy for an individual's medical condition and treatment. The exception in SG § 10-617(b) applies that policy in some contexts that are not encompassed by the Medical Records Law.

In our opinion, much of the information in a dispatch record will not fall within the "medical information" exception in SG § 10-617(b). In particular, the identity of the individual who called the 911 operator or of the person in need of assistance would not fall within this exception or, to our knowledge, any other exception in the PIA.⁶ On the other hand, statements about an injured or ill person's symptoms or condition that have been provided to a 911 operator and recorded on the ambulance dispatch record are "medical information" that must be withheld under the PIA. See 71 Opinions of the Attorney General 288, 292 (1986). While the PIA is generally to be construed liberally in favor of disclosure of records, that policy is tempered when disclosure would result in "an unwarranted invasion of privacy of a person in interest." SG § 10-612(b).

Thus, to the extent that there is specific information in the record concerning an individual's medical history or condition, it should be redacted before the record is disclosed.⁷ 71 Opinions of the Attorney General 288, 292 (1986). Of course, the individual who has requested the record must be advised of the fact of redaction and the reason and statutory basis for withholding the information. SG § 10-614(b)(3).

We understand that the newspaper that made the PIA request has suggested that the Fire Department could redact identifying information about the patient and otherwise disclose medical information in the fire dispatch record without running afoul of the PIA. It argues that, because more than one person likely resided at the address to which the ambulance was summoned, the medical information in the dispatch record could not be precisely identified to one individual. However, we do not believe that a record with medical information need name or identify an individual with precision to fit within the exception. Even when a name or other direct identifier is redacted, medical information might still be "about an individual"if the unredacted information sharply narrows the class of individuals to whom the medical information might apply. The PIA request in question sought information concerning an ambulance run to a specific address on a specific date. Even if information that named the person transported were withheld, any medical information in the record would remain "medical information about an individual" and, given the specification of date and address in the request, could likely be matched to a particular individual. The PIA itself recognizes that an address is an item of "personal information" that can identify a person with reasonable certainty. See SG §§ 10-611(f), 10-624(a).⁸ In our opinion, a custodian applying the medical information exception may draw the same inference that the PIA itself does.

In sum, information in the dispatch record about the identity of the person who called 911 and the person who was transported by ambulance should be disclosed. Medical information concerning the individual transported in the ambulance should be redacted pursuant to SG § 10-617(b).

Finally, in some circumstances, the PIA allows a custodian discretion to grant access to otherwise confidential information for research purposes under circumstances that protect the identities of the individuals to whom the records pertain. SG § 10-624(e).⁹ The legislative history of this section indicates that it was intended to allow access to medical information. See Governor's Information Practices Commission, Final Report 544-46 (1982). However, the event report was not sought under this provision and, given that the PIA request cited in your inquiry was directed to a specific 911 call, the research provision of the PIA would not pertain.

III Person in Interest: Effect of Termination of Parental Rights You advise that the County received a letter from the mother of the child who is the subject of the dispatch record. In that letter, the mother authorized the release of the child's medical records, including the ambulance dispatch record, to two newspaper reporters. However, the County determined that the mother's parental rights with respect to this child had been terminated by court order three years earlier and that the child was in the custody of a local department of social services at the time of the ambulance call.¹⁰

In your letter, you analyzed the validity of the mother's authorization as follows:

The State medical records law requires a health care provider to disclose a medical record "on the authorization of a person in interest." HG § 4-303(a). Thus, the question that must be answered is whether a parent whose rights have been terminated is a "person in interest" under the State medical records law. "Person in interest" is defined as a "parent of a minor, except if the parent's authority to consent to medical treatment for the minor has been specifically limited by a court order" or "a person authorized to consent to health care for the minor consistent with the authority granted." HG § 4-301(k)(5)(i) and (ii).

In our view, since the mother's parental rights concerning the child were terminated in 2001, the mother is not a "person in interest" under the State medical records law. Certainly, the court order terminating the mother's parental rights to the child who is the subject of the fire dispatch record is an order that limited the "parent's authority to consent to medical treatment." HG § 4-301(k)(5)(i). Moreover, it is well established that the termination of parental rights ends all rights that a parent may have concerning a child, including the right of a parent to disclose a child's medical records. See In re Adoption/Guardianship T00032005, 141 Md. App. 570, 582 (2001) (termination of parental rights severs all legal ties between the parent and the child). Thus, since the child was in the custody of the [department of social services] at the time of the ambulance call, it is our conclusion that we could only disclose the redacted portions of the record after authorization from the [department of social services], which would be the "person authorized to consent to health care for the minor consistent with the authority granted." HG § 14-301(k)(5)(ii).

We agree with your analysis and conclusion with respect to the Medical Records Law.¹¹ Cf. 90 Opinions of the Attorney General 3 (2005) (in a determination whether to consent to organ donation, guardian of decedent has priority over parent whose parental rights have been terminated).

The same conclusion pertains with respect to the PIA. Under SG § 10-617(b)(2), the custodian of a record containing medical information is to permit inspection by a person in interest¹² to the extent permitted by the Medical Records Law, i.e., HG § 4-304(a). Given that a mother whose parental rights have been terminated no longer has access to a child's records as a "person in interest" under the Medical Records Law, she is not entitled to access under the PIA.

IV Conclusion In our opinion, when a request for a Fire Department event report is made under the PIA, any medical information about an individual that appears in the report must be redacted, unless the report is being provided to a person in interest. Although a Fire Department event report is not a medical record for purposes of the Medical Records Law, the PIA exception for "medical information about an individual" applies when the report is associated with an ambulance run to a specific address. The identity of the individual transported is disclosable. Finally, a mother is not a person in interest with respect to a child if her parental rights with respect to that child have been terminated by a court order.

J. Joseph Curran, Jr. Attorney General

Robert N. McDonald Chief Counsel Opinions Advice

¹ This use of run sheets is typical of ambulance services. See, e.g., United States v. Freitag, 230 F.3d 1019, 1021 n. 4 (7th Cir. 2000); see also Ohio Op. Atty. Gen. 2001-041, 2001 WL 1246071 at *3 (ambulance run sheets typically are incorporated in receiving hospital's chart for patient to ensure, for example, that medications are not duplicated).

² A federal law also could potentially govern disclosure of records related to ambulance runs. However, that law apparently does not apply to the Fire Department.

Regulations issued under the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), established national standards for the protection of health information in the custody of "covered entities." See 88 Opinions of the Attorney General ___ (2003) [Opinion No. 03-022 (December 18, 2003)]. A "covered entity" includes a health care provider that transmits health information in electronic form in connection with a transaction. 45 CFR § 160.103. A "transaction" is defined as the "transmission of information between two parties to carry out financial or administrative activities related to health care." Id.

You have explained that, while the Fire Department provides health care to individuals in connection with emergency services, it does not bill for those services or transmit health information in electronic form in connection with those services. Accordingly, we agree with your conclusion that the HIPAA regulations do not apply in this context. Compare Tex. Atty. Gen. Op. ORD 681, 2004 WL 292160 (municipal EMS provider that transmits health information electronically is "covered entity" under HIPAA).

³ The Medical Records Law does not apply to medical records held by the County Fire Department other than in its capacity as a "provider" of medical care. See 71 Opinions of the Attorney General 297, 301 n. 6 (1986).

⁴ We understand that only the name of the 911 caller appears in the dispatch record that is the subject of your request, although some descriptive information about the individual in need of assistance also appears in the record.

⁵ An ambulance run sheet may fit the definition of a "medical record," particularly if it records information concerning the patient's vital signs and any treatment administered by ambulance personnel and if it is intended to be included in the receiving hospital's chart. See 2001 Ohio Op. Atty. Gen. No. 041, 2001 WL 1246071 (ambulance run sheet may be a medical record exempt from disclosure under Ohio public records law).

⁶ Compare 22 Kan. Op. Atty. Gen. 37, 1988 WL 429767 (identities of persons transported by an emergency medical services vehicle are subject to disclosure under Kansas open records law); with Neb. Atty. Gen. Op. 116, 1985 WL 168601 (name and treatment afforded patient in county-run ambulance should be redacted from response to public records request).

⁷ In the situation that prompted your request, we have not had access to the redacted information — and properly so, if it is indeed medical information about an individual. Therefore, we do not assess the merits of the claimed exemption in this particular case. If the matter were litigated, a court could review the redacted information in camera to determine the merits of the asserted exemption.

⁸ Although the federal HIPAA regulations on medical record privacy are not directly applicable here, see footnote 2 above, they would lead to the same conclusion. Those regulations anticipate that medical information concerning a patient could be disclosed in certain circumstances when the information is adequately "de-identified" — i.e., the medical information is sufficiently removed from any patient-identifying information that it becomes impossible to associate the medical information with a particular patient. See45 CFR § 164.514(a)-(b). Under those regulations, a record including a street address would not be adequately de-identified.45 CFR § 164.514(b)(2)(i)(B). Similarly, federal regulations governing the confidentiality of patient records related to drug and alcohol abuse programs define "patient-identifying information" to include an address.42 CFR § 2.11.

⁹ That provision reads:

The official custodian may permit inspection of personal records for which inspection otherwise is not authorized by a person who is engaged in a research project if:

(1) the researcher submits to the official custodian a written request that:

(i) describes the purpose of the research project;

(ii) describes the intent, if any, to publish the findings;

(iii) describes the nature of the requested personal records;

(iv) describes the safeguards that the researcher would take to protect the identity of the persons in interest; and

(v) states that persons in interest will not be contacted unless the official custodian approves and monitors the contact;

(2) the official custodian is satisfied that the proposed safeguards will prevent the disclosure of the identity of the persons in interest; and

(3) the researcher makes an agreement with the unit or instrumentality that:

(i) defines the scope of the research project;

(ii) sets out the safeguards for protecting the identity of the persons in interest; and

(iii) states that a breach of any condition of the agreement is a breach of contract.

SG § 10-624(e). For these purposes, "personal record" is defined as a record that names an individual or, "with reasonable certainty," identifies the individual by an address, description, finger or voice print, number, or picture. SG § 10-624(a).

¹⁰ You indicated that the child who was the subject of the record is now deceased.

¹¹ We make two additional observations concerning the Medical Records Law. First, the definition of "person in interest" in the Medical Records Law also includes a "duly appointed personal representative of a deceased person." HG § 4-301(k)(3). If a mother whose parental rights had been terminated somehow gained appointment as the personal representative of a deceased child, she would be a person in interest in that capacity.

Second, apart from the authority granted to a person in interest, the Medical Records Law also allows for disclosure of medical records to the immediate family of a patient, unless the patient has instructed to the contrary, if the disclosure is "made in accordance with good medical or other professional practice." HG § 4-305(b)(7). However, even if a mother whose parental rights had been terminated could still have access to a child's medical records as an "immediate family member" under this provision, rather than as a "person in interest," she would be prohibited from redisclosing the records to others, except in very limited circumstances. HG § 4-302(d).

¹² The definition of "person in interest" in the PIA differs slightly from the definition in the Medical Records Law. The PIA provides, in pertinent part:

"Person in interest" means:

(1) a person or governmental unit that is the subject of public record or a designee of the person or governmental unit;

(2) if the person has a legal disability, the parent or legal representative of the person....

SG § 10-611(e). However, we do not believe that this difference enlarges the category of persons who would have access to a medical record or medical information.