State Ex Rel. Adams County Historical Society v. Kinyoun , 277 Neb. 749 ( 2009 )

765 N.W.2d 212 (2009) 277 Neb. 749

STATE of Nebraska ex rel. ADAMS COUNTY HISTORICAL SOCIETY, Appellant and Cross-Appellee,
v.
Nancy KINYOUN, Appellee and Cross-Appellant.

No. S-08-339.

Supreme Court of Nebraska.

May 15, 2009.

Thomas R. Burke, of Davis Wright Tremaine, LLP, San Francisco, CA, and Shawn D. Renner, of Cline, Williams, Wright, Johnson & Oldfather, L.L.P., Lincoln, for appellant.

Paul M. Kaufmann, Special Assistant Attorney General, for appellee.

Sarah Stilwill, of Peters Law Firm, P.C., and Lucy A. Dalglish, Corinna J. Zarek, and Hannah Bergman, of Reporters Committee for Freedom of the Press, for amici curiae Reporters Committee for Freedom of the Press et al.

Shane E. Perkins, of Whelan & Scherr, Hastings, for amici curiae Lee Wigert et al.

HEAVICAN, C.J., CONNOLLY, GERRARD, STEPHAN, and McCORMACK, JJ.

HEAVICAN, C.J.

INTRODUCTION

The Adams County Historical Society (ACHS) brings this writ of mandamus to compel Nancy Kinyoun, custodian of records at the Hastings Regional Center (HRC), to release the names of 957 people buried in the adjoining cemetery. ACHS claims that the information is a public record as defined by Neb.Rev.Stat. § 84-712.01 (Reissue 2008) and that Kinyoun did not have sufficient reason to deny access to that information. Kinyoun and the Department of Health and Human Services (DHHS) claim the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA)^[1] and Nebraska's public records statutes prevent the release of this information. Kinyoun and DHHS claim this issue is inappropriate for a writ of mandamus.

We find that this action is appropriate for a writ of mandamus and that the information sought is a public record as defined by § 84-712.01. We therefore grant the request of ACHS and order Kinyoun to release the requested information in conformity with our opinion below.

FACTS

The facts of this case are relatively straightforward. HRC was created in 1887 as an "asylum for the incurable insane."^[2] Currently, HRC is a state-run institution operated by DHHS. HRC burial records date back to 1909 and indicate that the last burial occurred there in 1959. Graves are marked only by patient numbers, and the burial records consist of handwritten journals listing patient name, date of death, and medical record number. The records also contain maps with the graves and patient numbers which can be compared to the records in the journals.

ACHS is a nonprofit organization dedicated to collecting and preserving the history of Adams County, Nebraska, and the surrounding area. ACHS requested information from Kinyoun consistent with its mission to collect and preserve historical data. Kinyoun denied the request, citing state and federal privacy laws. ACHS requested that the Nebraska Attorney General's office review the matter pursuant to Neb.Rev.Stat. § 84-712.03 (Reissue 2008) and recommend that Kinyoun and DHHS reverse their position. The Attorney General, however, agreed with the position taken by Kinyoun and DHHS.^[3] In response, ACHS filed a mandamus action pursuant to § 84-712.03. A hearing was held in Adams County District Court, and Kinyoun's decision not to release the records was upheld. We moved the case to our docket to determine whether the information sought is a public record as defined by § 84-712.01.

ASSIGNMENTS OF ERROR

ACHS assigns that the district court erred when it (1) excluded certain pieces of evidence, based on relevancy, hearsay, and foundational grounds, and (2) upheld Kinyoun's decision to deny access to the records. Kinyoun has cross-appealed, alleging that mandamus is not an appropriate remedy in this case.

STANDARD OF REVIEW

[1] Statutory interpretation is a matter of law in connection with which an appellate court has an obligation to reach an independent, correct conclusion irrespective of the determination made by the trial court.^[4]

ANALYSIS

Resolution of this case revolves around the interpretation of Nebraska's public records statutes in conjunction with HIPAA and our state's privacy provisions. In essence, the question is whether the records sought by ACHS can be classified as public records under § 84-712.01, and whether HIPAA and/or our state's privacy provisions bar release. Because the issue is one of statutory interpretation, we review the matter de novo and need not reach ACHS' claims that evidence was improperly ruled inadmissible. However, we first address Kinyoun's claim that this action is not appropriate for a writ of mandamus.

CAN ACHS REQUEST WRIT OF MANDAMUS IN THIS MATTER?

[2, 3] Traditionally, "mandamus" was a law action and was defined as an extraordinary remedy, not a writ of right, issued to compel the performance of a purely ministerial act or duty, imposed by law upon an inferior tribunal, corporation, board, or person, where (1) the relator has a clear right to the relief sought, (2) there is a corresponding clear duty existing on the part of the respondent to perform the act, and (3) there is no other plain and adequate remedy available in the ordinary course of law.^[5] Kinyoun claims that under the traditional definition of mandamus, release of the information is not purely ministerial. Kinyoun also claims that ACHS has no clear right to the names requested, that she has no duty to release the names, and that ACHS has other remedies available.

Nebraska's public records statutes outline the procedure to be followed if a request for public records is denied, however, and provide the appropriate relief. Under § 84-712.03, "[a]ny person denied any rights granted" under the public records statutes may either file for a writ of mandamus in the district court with jurisdiction or petition the Attorney General to review the matter. The statute goes on to provide that in any suit filed under the public records statutes, "the court has jurisdiction to enjoin the public body from withholding records, to order the disclosure, and to grant such other equitable relief as may be proper. The court shall determine the matter de novo, and the burden is on the public body to sustain its action."

We note that ACHS attempted to follow both procedures outlined under § 84-712.03, first by requesting the Attorney General to review Kinyoun's decision, then by petitioning the district court for a writ of mandamus after the Attorney General upheld Kinyoun's decision. ACHS has therefore exhausted its statutory remedies. This writ of mandamus is properly before us. We next turn to the question of whether HIPAA and/or our privacy laws preclude release of these records.

HIPAA'S APPLICATION TO HRC'S RECORDS

[4] Kinyoun claims that HIPAA precludes the release of burial records because such records constitute "protected health information."^[6] HIPAA was enacted to safeguard medical information and to "improve the efficiency and effectiveness of the health care system by facilitating the electronic exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearinghouses, and health care providers."^[7] Under 42 U.S.C. § 1320d(6),

[t]he term "individually identifiable health information" means any information, including demographic information collected from an individual, that—

(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—

(i) identifies the individual; or

(ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

Kinyoun claims, and we agree, that HRC is an entity covered by HIPAA and that the burial records constitute the "individually identifiable health information" that HIPAA was designed to protect.^[8] And, under 45 C.F.R. § 164.502(f) (2008), "[a] covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual." Therefore, HIPAA and its attendant regulations do apply to deceased individuals.

Under the Code of Federal Regulations governing HIPAA and the dissemination of private medical information, however, there is an exemption for information required to be released by law, and 45 C.F.R. § 164.512 (2008) defines "[u]ses and disclosures for which an authorization or opportunity to agree or object is not required." Subpart (a)(1) of that section defines the standard for uses and disclosures and states that those disclosures may be made to the extent required by law, if in compliance with and limited to the relevant requirements of such law. "Required by law" is defined under 45 C.F.R. § 164.103 (2008) as "a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law." This provision includes statutes and regulations that require the production of the information, such as Nebraska's public records statutes.^[9]

[5] Nebraska, like the federal government and many other states, has broad public records laws that generally provide open access to governmental records. Under Neb.Rev.Stat. § 84-712(1) (Reissue 2008), citizens of the state have the right to examine and make copies of most public records. "Public records" include "all records and documents, regardless of physical form, of or belonging to this state, any county, city, village, political subdivision, or tax-supported district in this state, or any agency, branch, department, board, bureau, commission, council, subunit, or committee of any of the foregoing."^[10] As a state-supported institution, HRC is subject to the public records statutes. Under Neb.Rev.Stat. § 84-712.05(2) (Reissue 2008), however, "[m]edical records, other than records of births and deaths," may generally be withheld from the public. (Emphasis supplied.) ACHS argues that the records sought in this case are records of deaths as defined by the statute.

Kinyoun counters this argument by claiming that the records ACHS is requesting are part of the deceased patients' medical records. She contends that because all of those patients buried in the HRC cemetery had been patients at HRC when they died, releasing their names is equivalent to releasing medical records. For that reason, Kinyoun claims, the burial information is part of the medical record that HRC is required to keep, and HIPAA prohibits the release of the medical records because they constitute "individually identifiable health information" as a result.^[11]

We do not find Kinyoun's argument persuasive, however, and we find that the records sought are "records of ... deaths."^[12] First, the information sought by ACHS is more limited than the information available on a death certificate. Death certificates are available to the public. Neb.Rev.Stat. § 71-605(2) (Cum. Supp.2008) requires that death certificates include the Social Security number of the deceased, as well as "the cause, disease, or sequence of causes ending in death"; the death certificate entered into the record as an exhibit in this case shows the "Place of Burial or Removal."

Second, those patients admitted to HRC were admitted for a variety of reasons. The record reflects that patients were admitted to HRC for issues relating to substance abuse, senility and dementia relating to old age, various psychotic disorders, "mental deficiencies," and other undiagnosed mental disorders. The fact that the deceased persons were treated at HRC does not indicate the nature of their diagnoses, or even the causes of death—information routinely released via death certificates. Furthermore, the records sought by ACHS do not include diagnosis or treatment information, but instead are limited to the names of the deceased and the locations of burial.

ACHS cites two cases from other states in which courts have allowed the release of information in spite of HIPAA due to the application of state open records laws.^[13] Kinyoun, in contrast, has not cited any cases which address the intersection of HIPAA with state or federal open records laws. Although the cases ACHS cited are not directly on point, the cases are instructive, because the information sought did not identify individuals. Both cases demonstrate that HIPAA can and does give way to state laws requiring disclosure of certain kinds of information.^[14] Therefore, in this situation, HIPAA does not bar release of the information, and Kinyoun has not met her burden to establish a reason to withhold the burial records.

NEBRASKA STATUTES DO NOT PREVENT RELEASE OF RECORDS

[6] Kinyoun also argues that the burial records should remain private under various Nebraska statutes. Under the Nebraska Mental Health Commitment Act's section on records, Neb.Rev.Stat. § 71-961 (Cum.Supp.2008), all records of any mental health patient are to remain confidential unless otherwise provided by law. Neb. Rev.Stat. § 83-109 (Reissue 2008) states that "[a] record of every patient or resident of every institution shall be kept complete from the date of his or her entrance to the date of his or her discharge or death...." Neb.Rev.Stat. § 27-504(3) (Reissue 2008) states that the physician-patient privilege "may be claimed by the patient or client ... or by the personal representative of a deceased patient or client."

None of these statutes are applicable to the records in this case, however, for the same reasons that HIPAA does not apply. Sections 27-504(3), 71-961, and 83-109 all deal with medical records or patient histories. As already stated, we find that the records requested by ACHS are records of deaths, and § 84-712.05(2) specifically allows release of "records of births and deaths." Because we have found that these records are records of deaths, they are not prohibited from release under § 27-504(3), § 71-961, or § 83-109.

CONCLUSION

Although HIPAA prevents the release of individually identifiable medical information, it also provides for release of information when required by state law. Nebraska's public records statutes require that medical records be kept confidential, but exempt birth and death records from that requirement. Our privacy laws also apply to medical records and patient histories, but not to records of deaths. The records sought by ACHS are records of deaths and therefore are public records. Kinyoun is hereby ordered to release the information under the public records statutes.

WRIT OF MANDAMUS GRANTED.

MILLER-LERMAN, J., participating on briefs.

WRIGHT, J., not participating.

NOTES

[1] 42 U.S.C. § 1320d et seq. (2006).

[2] Gen.Stat. ch. 48, § 1, p. 475 (1887).

[3] Att'y Gen. Op. No. 04018 (Apr. 20, 2004).

[4] Japp v. Papio-Missouri River NRD, 271 Neb. 968, 716 N.W.2d 707 (2006).

[5] State ex rel. Johnson v. Gale, 273 Neb. 889, 734 N.W.2d 290 (2007).

[6] Brief for appellee at 10.

[7] Standards for Privacy of Individually Identifiable Health Information, 67 Fed.Reg. 14776 (Mar. 27, 2002).

[8] Brief for appellee at 9.

[9] See, e.g., Abbott v. Texas Dept. of Mental Health, 212 S.W.3d 648 (Tex.App.2006); State ex rel. Cincinnati Enquirer v. Daniels, 108 Ohio St. 3d 518, 844 N.E.2d 1181 (2006); HIPAA Frequent Questions, Permitted Use and Disclosure, Disclosures Required by Law, http://www.hhs.gov/hipaafaq/permitted/require/506.html (last visited May 12, 2009).

[10] § 84-712.01(1).

[11] See 42 U.S.C. § 1320d(6).

[12] See § 84-712.05(2).

[13] See, e.g., Abbott v. Texas Dept. of Mental Health, supra note 9; State ex rel. Enquirer v. Daniels, supra note 9.

[14] Id.