Sigmund D. Schutz
sschutz@preti.com
207.791.3247

July 25, 2016
VIA E-MAIL & FIRST CLASS MAIL
Bridget Bagley
Department of Health and Human Services
Maine Center for Disease Control and Prevention
11 State House Station
Augusta, ME 04333-0011
RE:

Comments on Data Release Rule, 10-144 CMR, Ch. 175 by the
Portland Press Herald / Maine Sunday Telegram

Dear Ms. Bagley:
The Portland Press Herald / Maine Sunday Telegram respectfully urges the
Department not to proceed with the proposed Data Release Rule. As the Fact Sheet
accompanying the rule makes clear, it would make certain public health data secret
by “expand[ing] definitions to address privacy protections.”
The Press Herald opposes the proposed Data Release Rule for two primary
reasons. First, public health data should be made public to the maximum extent
possible, so long as no specific individual is identified. Second, the proposed rule is
in conflict with state law, which requires that the Department provide public access
to data that does not identify any individual. Under the proposed rule, information
that does not identify any individual would become secret. If changes are to be
made to the public’s right of access to Department records and information, the
appropriate body to do so is the Maine Legislature.
The Press Herald published a story on the proposed Data Release Rule under
the headline “Maine CDC Wants to Limit What You can Know About Disease
Outbreaks,” attached as Exhibit A. The public comments on the story show that the
general public does not support the proposed rule. The Press Herald also published
an editorial, “Maine CDC Should Share not Squelch, Disease Data,” attached as
Exhibit B.
I.

About the Portland Press Herald / Maine Sunday Telegram

The Press Herald, part of Maine’s largest newsgathering organization,
regularly covers Mainers’ public health, including the incidence and location of

10772178.2

 PRETI FLAHERTY
Bridget Bagley
July 25, 2016
Page 2
infectious disease outbreaks, vaccination rates, public health policy and legislation.
Last year, the Press Herald published a series of news stories on Maine’s relatively
low rate of vaccination against infectious diseases. It has also covered infectious
disease outbreaks in Maine and investigated the linkage between these outbreaks
and vaccination rates. All of this reporting relied upon access to public health data
obtained from the Department.
II.

Prior Litigation Regarding Access to Locations of Disease Outbreaks

The Press Herald filed an appeal in Cumberland County Superior Court last
year from the Department’s denial of a request for information concerning recent
infectious disease outbreaks in Maine schools. Portland Press Herald v. Maine
Dept. of Health and Human Svcs., Docket No. CV-2015-323. That appeal was
settled in October 2015 by the Department’s release of the names of the schools that
had suffered outbreaks (Exhibit C, attached). The proposed rule would make secret
the same information the Press Herald requested and received last year, but
without any corresponding change in state statutes.
III.

State Law on Access to Medical and Epidemiologic Information

The statute governing public access to Department records distinguishes
between “records that contain personally identifying medical information,” which
are confidential under 22 M.R.S. § 42(5), and records that contain “medical and
epidemiologic information in such a manner that an individual can not [sic] be
identified,” which are not confidential. Id. Because records containing nonidentifying medical and epidemiologic information are not made confidential by
statute, those records are “public records” for purposes of the Freedom of Access Act,
1 M.R.S. §§ 401 et seq. They must be made available for public inspection and
copying as required by the Act. 1 M.R.S. § 408-A.
The Freedom of Access Act provides that public records cannot be made
confidential by rule. 1 M.R.S. § 402(3)(A). The Act excludes from the definition of
“public records” those “[r]ecords that have been designated confidential by
statute[.]” Id. A rule is not a statute; the Act contains no language authorizing
state agencies to make public records confidential by rule. To the extent the Data
Release Rule extends confidentiality beyond the scope of the relevant statute, which
the Press Herald believes it does, the rule is unlawful.
IV.

Section-by-Section Comments on Proposed Data Release Rule

The Press Herald offers the following section-by-section comments on the
proposed Data Release Rule:

10772178.2

 PRETI FLAHERTY
Bridget Bagley
July 25, 2016
Page 3
Introduction – Section 1. The statement of intent in the introduction to the
rule is slanted in favor of too much secrecy.
The introduction is borrowed from portions of the Model State Public Health
Privacy Act. But the Model Act makes clear that confidentiality should be limited
only to personally identifiable health-related information, i.e., information which
describes a particular individual’s personal medical or health information.
According to the Model Act, “Individual interests in the privacy of health-related
information are significantly reduced when the information is acquired, used,
disclosed, or stored in non-identifiable forms.” In contrast to the proposed rule,
which focuses on privacy, the Model Act is meant to “[e]ncourage wide use and
disclosure of non-identifiable health information because this information does not
implicate privacy and security concerns at the individual level and may greatly
facilitate the accomplishment of legitimate public health purposes[.]”
The Maine CDC’s Privacy Policy (Aug. 9, 2012), which would be superseded
by the proposed rule, also recognizes of the importance of public disclosure of nonidentifiable health related data. According to the policy:
Despite risks associated with inappropriate data release, Maine CDC
data are vitally important to maintaining the health of all people, and
have wide and varied uses both within State government and in the
larger public health community. Therefore, Maine CDC programs
must make data available and accessible to the broadest possible
constituency, while at the same time maintaining strict standards to
protect individual privacy.
In a public statement issued last year the Maine CDC also emphasized “the
importance of sharing information when it benefits public health,” noting that it has
a “long history of providing information when members of the public can take action
to improve their health or prevent harm.”
Definitions – Section 2. The definition of “Indirect identification” makes
confidential a great deal more information than is necessary to avoid identifying
particular individuals. The portion of the proposed rule addressing “geographic
areas or organizations within the State” is not readily understandable and should
be clarified, but appears to mean that:

10772178.2

 PRETI FLAHERTY
Bridget Bagley
July 25, 2016
Page 4
a) if the entire population in a school, town, or organization is less than
2,000, and the number of infected individuals is less than 6 people or
all of the population of the school, town, etc. have a disease except less
than 6 people; or
b) the entire population of the school, town, or organization is less than
50, regardless of how many people are reported to be infected or have
the disease,
then the data are confidential. The rule makes data confidential under
circumstances where an individual cannot be identified. For example, if 5 people
out of a population of 1,000 have a disease, that would merely disclose that 0.5% of
a population have the disease, which does not disclose anyone’s identity. But under
the proposed rule, this information would be secret. The definition of “indirect
identification” goes too far, particularly in a small state like Maine.
In Maine, towns, schools, and organizations typically have fewer than 2,000
people, so the rule would effectively defeat the public’s right to know about many
disease outbreaks. No high school in Maine has more than 2,000 students – the
largest school (Lewiston High School) has about 1,500 students – and most Maine
schools are much smaller. Under the proposed rule, disease outbreaks at Maine
schools would be kept secret from the public, including most of the information the
Department disclosed to the Press Herald last summer.
The definition of “indirect identification” is also contrary to 22 M.R.S. § 42(5).
As mentioned above, that statute provides public access to records containing
medical and epidemiologic information in such a manner that an individual cannot
be identified. Because “indirect identification” is defined in the Data Release Rule
very broadly to include data that does not and cannot identify any individual, it
creates far more secrecy than is allowed by statute.
Data Release – Section 3. The proposed rule states at Section 3(A) that the
Department will not be obligated “to provide the data in the form requested.” This
limitation on access to records conflicts with the Freedom of Access Act. The Act
requires that an agency or official having custody of any electronically stored public
record must make the record available as a printed document or “in the medium in
which the record is stored, at the requester’s option.” 1 M.R.S. § 408-A(7). The
Department cannot lawfully exempt itself from the requirement, applicable to all
other custodians of public records, that records be made available in the format
specified by the requester.

10772178.2

 PRETI FLAHERTY
Bridget Bagley
July 25, 2016
Page 5
V.

Public Access to Public Health Data Serves the Common Good.

The Press Herald has interviewed many experts in the field who all say that
state policy should provide as much health data as possible. “Public health officials
should strive to release as much information as possible, within the limits of the
law. Withhold information only when there is a clearly justified reason to keep it
confidential,” according to the joint statement by the National Association of County
and City Health Officials, the Association of State and Territorial Health Officials,
and the Association of Health Care Journalists. The Data Release Rule is not good
policy, because non-identifying public health information services important public
interests.
Public health information allows the public to protect itself from harm.
Members of the public can avoid locations where disease outbreaks have occurred
only if those locations are known. Such information is particularly important for
immune-compromised individuals or others who are at special risk if they come into
contact with an infected population. If an outbreak is known, members of the public
also can be on guard to identify new cases, which can lead to prompt treatment and
stop the spread of disease.
Public health data fosters an informed and educated public on questions of
public health policy. Among its functions, the Department assesses public health
problems, takes steps to protect public health, and seeks funding for its public
health related programs and initiatives. Public health data allows the public to
assess the efficacy of public health policy and the performance of health agencies
and officials. Without public health data, the public cannot know if the population
is healthy, whether policies are working effectively, and what changes – including
changes in levels of funding – may be warranted. As noted above, the Press Herald
has repeatedly relied on public health data from the Department to inform the
public on important public health issues, including disease outbreaks and
vaccinations.
Public health data are used by health care providers and researchers in ways
that serve the common good. Epidemiologic investigators and researchers rely on
public health data to study and help solve public health problems. Health care
providers need information to prepare for and respond to outbreaks.
Informing the public about infectious disease outbreaks is a recognized best
practice for public health agencies. According to the American Public Health
Association:1
1

Communicable Diseases Manual (20th ed. 2015) at A9 - A10.

10772178.2

 PRETI FLAHERTY
Bridget Bagley
July 25, 2016
Page 6
Regular communications about the outbreak and risk of infection is
one of the most important parts of an outbreak response and serves to
reassure the population that a response is underway, avoid undue
panic or concern, create an environment where additional cases can be
identified, and help individuals and communities understand how
transmission can be stopped. Time spent explaining the evidence and
control measures with responsible journalists – whether they are from
newspaper, radio, television, or other outlets – will facilitate the
outbreak response by creating an environment of understanding.
Regular simple information (outbreak facts such as case numbers, case
definition, studies underway, and suspected incubation period) should
be provided at intervals.
The proposed rule would stymie such communications or make them subject
to ad hoc determinations by the agency.
Finally, individual privacy interests, such as a specific person’s health
or medical condition, are not threatened by the disclosure of non-identifiable
data. Identifiable information such as names, social security numbers, dates
of birth or the like can be maintained as confidential in order to protect
reasonable individual privacy interests. On the other hand, aggregate
statistical data on a population does not reasonably implicate personal
privacy interests.
VI.

Conclusion

The Press Herald appreciates the opportunity to comment on the proposed
Data Release Rule and urges the Department to change course and ensure
maximum possible public access to non-identifiable public health data.
Very truly yours,
/s/ Sigmund D. Schutz
Sigmund D. Schutz
SDS:jac
Enclosures
cc:
Cliff Schectman, Executive Editor (via email)
Steve Greenlee, Managing Editor (via email)
Joe Lawlor, Staff Writer (via email)
Kevin Wells, Maine DHHS – General Counsel (via email)

10772178.2