Sign up for our email list
Menu
I submitted a FOIL request for dog bite reports in St. Lawrence County, asking for details like the dog owner’s name, the dog’s name, and whether the dog was licensed.
However, my request was denied on the grounds that the reports were deemed “interagency” and protected under HIPAA. The information I requested wasn’t medical but related to the dogs and their owners.
Could the De-Identified Exemption have applied in this case? Would I be entitled to a redacted report containing the specific information I asked for? Does the County simply “deeming” these forms as HIPAA-protected suffice, or is there a need for a written policy stating that blank forms, available online, become HIPAA-protected once completed?
Thank you for your question.
Dog license information, as indicated in the opinion by the NY Committee on Open Government, should be disclosed. You can review that opinion here:
Opinion on Dog License Information
In another opinion, the Committee stated:
Opinion on Dog Bite Victim Information
“While the name, address, telephone number, or other personally identifiable details concerning a dog bite victim could properly be withheld, the location of a dog bite incident, a description of how the bite occurred, and the name of a health professional who provided treatment would be available.”
Regarding injury reports, the Committee also stated:
“Portions of the injury reports may be withheld or redacted insofar as disclosure could identify the injured person.”
With respect to HIPAA, the following was noted in another determination:
“Critical in my view is the assertion in the determination of your appeal that injury report forms are completed by ‘certified medical staff’ who qualify as ‘health care providers’ subject to HIPAA. Because that is so, insofar as the information contained on the forms consists of ‘protected health information’ as defined in federal HIPAA regulations, I believe that a denial of access based on HIPAA is appropriate and consistent with the law. A ‘health care provider’ is a person or entity that provides ‘care, services, or supplies related to the health of an individual,’ and ‘protected health information’ includes material collected from an individual and ‘created or received’ by a health care provider.”
In your case, you could and should receive redacted information. A specific HIPAA policy may not be necessary for the County to claim HIPAA protection, but an argument could be made that a dog control officer is not a health care provider subject to HIPAA.
I suggest filing an appeal and referencing these opinions to strengthen your case for obtaining some of the information you requested.