A century ago, a crusading Connecticut newspaper editor helped bring to justice the murderous owner of an old-age home, relying on death certificates that showed boarders at the facility had a suspicious habit of dying from poison.
The story of Amy Archer Gilligan — who died in a state mental hospital in 1962, having been incarcerated 43 years for murder — inspired the (exceedingly) dark comedy play and film, “Arsenic and Old Lace.”
And now, it has inspired something more: A sensible ruling that harmonizes state freedom-of-information law with federal health-care privacy law.
Privacy laws are widely mis-cited to obstruct journalists’ access to public records, and none more flagrantly so than HIPAA, the federal health care privacy statute. Public officials apply HIPAA with the accuracy and precision of a blindfolded drunk swinging at a piñata. They may occasionally hit the mark, but if they do, it’s dumb luck.
HIPAA applies only to two classes of recordkeepers — health care providers and health insurers — and only to records of medical histories or medical treatment. It does not, contrary to what many government officials try to argue, make all information about a person’s health confidential. (For example, it does not entitle law enforcement agencies to withhold police reports describing the injuries of accident victims.)
Connecticut journalist Ron Robillard, working on a book about the Gilligan case, sought disclosure of decades-old medical records that, he hoped, might shed light on whether Gilligan suffered from a mental illness that might help explain her behavior.
But even though Gilligan had been dead for almost 50 years at the time of the request, the state mental-health agency denied the author’s request. The state relied in part on HIPAA, the Health Insurance Portability and Accountability Act of 1996.
In April 2012, Connecticut’s Freedom of Information Commission sided with Robillard, ruling that whatever privacy interests Gilligan may have had in her mental-health records died with her, and noting the high degree of public interest in her case.
Key to the Commission’s ruling is an exemption to HIPAA that allows for the disclosure of even confidential medical records when disclosure is “required by law.” When records are covered by a state open-records act, the Commission decided, then disclosure is “required by law” and the government agency holding the documents may not rely on HIPAA to withhold them.
The state appealed, and on April 30 of this year, a superior-court judge agreed that the records were subject to disclosure.
Judge Henry S. Cohn did not find it necessary to address the Commission’s interpretation of the “required by law” exemption, because another federal exemption — covering records of people dead more than 50 years — came into play. Relying on that easier and more obvious basis, Judge Cohn ordered the records turned over.
Although courts rarely have been asked to interpret the “required by law” exemption to HIPAA, the Connecticut interpretation is not a loner.
In 2008, the Ohio Supreme Court sided with the Cincinnati Enquirer in a dispute over access to state records concerning the health effects of lead poisoning among children in foster-care homes. Just as in the more recent Robillard case, the Ohio court concluded that a state public-records act fit HIPAA’s definition of a law requiring disclosure. Consequently, the state could not withhold the records on the basis of HIPAA confidentiality.
The types of records to which HIPAA was intended to apply, such as medical files held by a patient’s family physician, would never be covered by a state or federal freedom-of-information law in the first place. The subset of records to which HIPAA genuinely applies is quite narrow, and as these rulings indicate, HIPAA almost never will be a legitimate response to a journalist’s demand for public records.