State v. Daniels

The Cincinnati Health Department (CHD) refused a request from a reporter from the Cincinnati Enquirer (the Enquirer) for “copies of the 343 lead citations and any others that were issued between 1994 and the present.” The lead citations were lead-contamination notices issued to owners of units reported to be the residences of children whose blood tests indicated elevated lead levels. Provisions of the Privacy Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) were cited by CHD as the reason for the refusal, due to the specific prohibition on disclosure of protected health information.[1]

The Enquirer filed a mandamus action seeking to compel CHD to make the requested information available for inspection in accordance with the Ohio Public Records Act 2004, and pursuant to the “required by law” exception for disclosure of “protected health information” under HIPPA § 164.512(a)(1).

Following mediation, CHD released 170 of the lead citations but maintained its inability, under HIPPA, to provide access to unredacted copies of the remaining 173 lead citations to owners of single-family residential property.

The Court first examined whether the requested information contained “protected health information” as defined by HIPPA, and thus was it properly undisclosed. The court held that nothing contained in the reports identified “by name, age, birth date, social security number, telephone number, family information, photograph or other identifier any specific individual or detail[ed] any specific medical examination, assessment, diagnosis, or treatment of any medical condition.” Rather, there was “a mere nondescript reference to “a child” with “an elevated lead level.” The court held that the information was therefore outside the scope of HIPPA § 160.103, which defines “health information” to include information “created by a public health authority that relates to the past, present, or future physical condition of an individual.” Thus there was no prohibition against disclosure of the information under HIPAA section 164.502(a).

The Court then examined whether the disclosure of the requested health information “required by law” under HIPPA was made pursuant to the Ohio Public Records Act. The court held that even if the requested lead citations and lead-risk-assessment reports did contain "protected health information” and even if CDH operated as a "covered entity" pursuant to HIPAA, the health information would still have been subject to release under the "required by law" exception to the HIPAA privacy rule. It held that the Ohio Public Records Act required disclosure of the reports, and that HIPAA did not supersede state disclosure requirements.

“The prohibition against disclosure contained in the HIPAA privacy rule refers to the release of otherwise protected health information. It provides: ‘A covered entity may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.’ Section 164.502(a), Title 45, C.F.R. After careful review of the record, we have concluded that the lead-risk-assessment reports and the lead citations do not contain protected health information and therefore are subject to release, as they are not protected by the HIPAA privacy rule.”108 Ohio St.3d, pp. 522 – 523.

“Our research reveals that at the time of implementing these regulations, the Department of Health and Human Services, Office of the Secretary, promulgated Standards for Privacy of Individually Identifiable Health Information (2000), 65 F.R. 82462, 82667-82668, stating, ‘[W]e intend [160.512(a) ] to preserve access to information considered important enough by state or federal authorities to require its disclosure by law’; ‘we do not believe that Congress intended to preempt each such law’; and ‘[t]he rule's approach is simply intended to avoid any obstruction to the health plan or covered health care provider's ability to comply with its existing legal obligations.’” 108 Ohio St.3d, p. 524.