1 LAW OFF ICES S HERMAN & HO WARD L. L. C. 201 EAST W ASHINGTON STREET, SUITE 800 PHOENI X, ARIZONA 85004-2327 2 TELEPHONE: (602) 240-3000 FAX: (602) 240-6600 (AZ BAR FIRM NO. 00441000) 3 Gregory W. Falls (AZ Bar No. 011206) (GFalls@ShermanHoward.com) Craig A. Morgan (AZ Bar No. 023373) (CMorgan@ShermanHoward.com) Lindsay H.S. Hesketh (AZ Bar No. 031233) (LHesketh@ShermanHoward.com) Co-Counsel for Defendants Arizona Department of Health Services and Dr. Cara Christ 4 5 6 7 IN THE SUPERIOR COURT OF THE STATE OF ARIZONA 8 IN AND FOR THE COUNTY OF MARICOPA 9 10 11 12 13 Phoenix Newspapers, Inc., Scripps Media Inc., KPNX-TV Channel 12, a Division of Multimedia Holdings Corporation, and Meredith Corporation, Plaintiffs, DEFENDANTS’ OBJECTION TO PLAINTIFFS’ APPLICATION FOR ORDER TO SHOW CAUSE v. (Assigned to Hon. Christopher Coury) 15 Arizona Department of Health Services and Dr. Cara Christ, in her official capacity as the Director of the Arizona Department of Health Services, 16 Defendants. 14 Case No. CV2020-005385 Oral Argument Requested The Arizona Department of Health Services and its Director Dr. Cara Christ 17 18 (collectively, the “Department”) are tasked with protecting the health and wellness of all 19 Arizonans. That charge includes honoring legislative mandates protecting from disclosure 20 certain personal and communicable disease-related information. The Department takes that 21 mandate seriously. For doing so, Plaintiffs chide the Department through a false narrative 22 that following the law does not protect the public. But the Department does not have the 23 luxury of ignoring the law so as to avoid ire from the press, and the law is clear: these 24 records are not subject to disclosure. 25 26 I. INTRODUCTION Plaintiffs seek “an array of public records related to the incidence of COVID-19 in the 27 long-term facilities that house Arizonans’ elderly family members.” Application for Order 28 to Show Cause (“App.”) at 2:17-19. Specifically, Plaintiffs seek: (1) “[t]he names and Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 locations of long-term care facilities that have known COVID-19 cases;” (2) “[t]he number 2 of COVID-19 cases and the number of COVID-19 deaths broken down by long-term care 3 facility names and locations;” (3) “[t]he dates those cases were reported and/or learned by 4 the State of Arizona;” (4) “[a]ll weekly reports submitted to the state by nursing homes that 5 detail the number of COVID-19 positive residents, the number of transfers to and from 6 hospitals, the number and type of PPE and the estimated use of each type of PPE per week;” 7 and (5) “data or reports related to the number of confirmed positive tests at skilled nursing 8 facilities statewide, including the name of the nursing facility.” Complaint, ¶ 39. The 9 Department cannot disclose this information for several reasons. 10 First, Plaintiffs seek communicable disease-related information, which is generally 11 confidential. See A.R.S. §§ 36-136(I)(11) (the Department’s Director shall “[p]rescribe 12 reasonably necessary measures to keep confidential information relating to diagnostic 13 findings and treatment of patients, as well as information relating to contacts, suspects and 14 associates of communicable disease patients. In no event shall confidential information be 15 made available for political or commercial purposes.”); 36-664(A) (“A person who obtains 16 communicable disease related information in the course of providing a health service or 17 obtains that information from a health care provider pursuant to an authorization shall not 18 disclose or be compelled to disclose that information except as authorized by … law….”). 19 Moreover, as for the disclosure of such information, the Legislature empowered the 20 Department with the discretion to decide if--and the extent to which--communicable 21 disease-related information is disclosed, and even then only in specific circumstances (none 22 of which apply here). See A.R.S. § 36-664(C). In fact, communicable disease-related 23 information is so guarded that this action is subject to very specific requirements designed 24 to prohibit the general disclosure of the communicable disease-related information sought. 25 For example: (1) to even get the information, Plaintiffs must prove a compelling need or 26 clear and imminent danger necessitating disclosure; (2) even if disclosure is allowed, the 27 Court must order Plaintiffs not to publicly disclose the data; and (3) this proceeding should 28 be sealed and measures taken to ensure the data remains as private as possible. See A.R.S. 2 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 § 36-665. 2 communicable disease-related information is subject to criminal prosecution and fines of 3 up to $5,000. See A.R.S. §§ 36-666(A)(2); 36-667(A)(2). Indeed, one who knowingly discloses or compels another to disclose 4 Second, “[a]ny medical information or other information from which a person might 5 be identified that is received by the department … in the course of an enhanced surveillance 6 advisory is confidential and is not available to the public.” A.R.S. § 36-784(C); see also 7 A.R.S. § 36-404(A)(2) (prohibiting the Department from disclosing “[p]ersonally 8 identifiable medical information or any information from which a patient or the patient’s 9 family might be identified.”). Information related to “[a]ll weekly reports submitted to the 10 state by nursing homes that detail … the number and type of PPE and the estimated use of 11 each type of PPE per week” falls squarely within A.R.S. § 36-784(C), because that 12 information was secured pursuant to an enhanced surveillance advisory and will reveal a 13 patient’s residential address, which might in turn reveal the patient’s identity or condition. 14 Third, the Department cannot disclose (1) the “names or any other information of any 15 applicant … or employer … for any political, commercial, or unofficial purpose”, A.R.S. 16 § 36-107, or (2) “information likely to cause substantial harm to the person’s or business’ 17 competitive position.” A.R.S. § 36-783(E)(2). Disclosure of the records at issue will both 18 reveal the names and other information of applicants or employers for no legitimate reason 19 and likely cause substantial harm to them. 20 21 Fourth, significant privacy, economic, state, and other public policy interests outweigh any presumption of disclosure that may exist under Arizona’s public records law. 1 22 In the end, the Department is not interested in withholding information or obfuscating 23 journalistic endeavors. The law requires the Department to tread lightly, and cautiously, in 24 these relatively uncharted waters. And the delicate balance between public disclosure and 25 1 26 27 28 Plaintiffs’ claimed reason for filing this action--so this information is made available to those who truly need to know--is moot. The Governor has issued an Executive Order permitting the disclosure of certain communicable disease-related information to residents in congregate settings, prospective residents, and their next of kin and guardians. See Executive Order 2020-35. This Order balances the myriad of privacy and State interests at play with public access--making certain those in the public who truly need this information receive it while minimizing any adverse implications to the greatest extent possible. 3 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 legislatively mandated confidentiality has been the Department’s guiding compass during 2 this fraught journey. The Department takes these issues seriously and cannot ignore the 3 law. More importantly, neither can Plaintiffs or this Court. Accordingly, for the following 4 reasons, the Court should deny Plaintiffs the relief they seek. 5 6 II. THE FACTS A. THE PUBLIC RECORDS REQUESTS 7 In early April, Plaintiffs began submitting broad requests for confidential information 8 related to COVID-19. The Department acknowledged receiving each of those requests the 9 same day they were received, and provided final responses on May 5. Declaration of Colby 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 Bower (“Bower Dec.”), ¶¶10-11, 17, 23-24. Specifically: • On April 7, 2020, The Arizona Republic and azcentral.com requested, on the rolling basis, nursing homes’ weekly reports to the Department that contain “the number of COVID-19 positive residents, the number of transfers to and from an acute hospital, the number and type of PPE, and the estimated use of each type of PPE per week.” Bower Dec., ¶¶7-14. • On April 7, 2020, 12 News requested, among other things, “[a]ny data or reports related to the number of confirmed positive tests at skilled nursing facilities statewide.” Id., ¶¶21-29. • Later that same day, 12 News clarified that while its request included information collected pursuant to an Executive Order, the request encompassed “additional records … that should be released as well.” Id., ¶25. • Approximately two weeks later, 12 News expanded its request to include the names of nursing facilities with confirmed positive COVID-19 tests. Id., ¶26; • On April 13, 2020, ABC15 requested the Department’s records concerning “outbreaks in businesses, long-term care facilities, or congregate setting in the zip codes with confirmed cases” together with “any/all businesses that the state has worked with, or individual counties,” “a list by name of businesses -- number of positive cases,” “a list of any congregate setting that the state has tracked with positive cases,” and “all long-term facilities with the number of positive cases.” Id., ¶¶15-20. Plaintiffs’ pre-lawsuit requests were never narrowed to exclude the disclosure of all potentially personally identifying information. Id., ¶¶14, 20, 29. B. THE RECORDS AT ISSUE 26 Each of Plaintiffs’ requests seeks reports from various congregate settings to the 27 Department concerning COVID-19, no matter why provided. Id., ¶¶30-47. Those reports 28 contain highly sensitive information about each individual residing in that congregate 4 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 setting. For example, for each individual with a confirmed or suspect case of COVID-19, 2 nursing care institutions must report to the Department the person’s name, residential and 3 mailing addresses, telephone number, email address, date of birth, race and ethnicity, 4 gender, and similar personal information. Id., ¶¶30-33. These reports must also contain 5 the name of the disease, date of onset of symptoms, date of diagnosis, specimens collected, 6 lab tests completed, and other similar information. Id., ¶33. Plaintiffs seek that information 7 coupled with the numbers of COVID-19 positive residents sorted by facility, along with 8 the weekly PPE usage of each facility. Id., ¶¶34-38. This means that even if the Department 9 redacted residents’ names, Plaintiffs’ requests still seek the residential addresses, individual 10 demographics, and individual treatment information for each resident with a confirmed or 11 suspected case of COVID-19--all organized by nursing care institution. Thus, individual 12 residents’ identities and medical conditions will be easily identifiable by the public if 13 Plaintiffs were to publish this information. Declaration of Kenneth Komatsu (“Komatsu 14 Dec.”), ¶¶15-21; Declaration of Robert Bailey (“Bailey Dec.”), ¶¶10-30. More globally, 15 the records requested consist of communicable disease-related information, and with regard 16 to PPE data, information obtained through enhanced surveillance measures. See Komatsu 17 Dec., ¶9, 13; Bower Dec., ¶¶34-40, 46. 18 C. THE DEPARTMENT’S POLICIES AND CONCERNS REGARDING THE RECORDS 19 Releasing the records Plaintiffs request conflicts with several of the Department’s 20 21 22 23 24 25 26 27 28 policies and raises several concerns. For example: • Disclosure conflicts with the Department’s policy of promoting trust with its community partners and protecting the privacy of individuals’ personal medical information. Komatsu Dec. at ¶¶36-37; • Disclosure conflicts with the Department’s policy of keeping individual medical information confidential and otherwise protected. Id. at ¶¶36-37; • Disclosure may result in a fear of reporting personal information by those potentially infected or exposed, diminish trust and cooperation by the Department’s community and business partners, limit or have a chilling effect on the voluntary disclosure of communicable disease related information, and hamper the ability of the Department and county public health authorities to gather information and identify and control outbreaks of communicable disease. Id. at ¶¶38-39; 5 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 • Disclosure of records related to “[a]ll weekly reports submitted to the state by nursing homes that detail the number of COVID-19 positive residents” and “data or reports related to the number of confirmed positive tests at skilled nursing facilities statewide” will necessarily require the disclosure of personally identifiable and other private information (like with a facility address). Komatsu Dec., ¶¶15-18, 38-39; Bower Dec., ¶¶38-43; Bailey Dec., ¶¶10-30; 1 2 3 4 • Publicly disclosing the name or address of a congregate setting with COVID19 residents may lead to stigmatization and discrimination against those facilities, their employees and residents, and their families, based on actual or perceived disabilities. Komatsu Dec., ¶¶24-30; Bower Dec., ¶50; 5 6 7 • Relatedly, that type of stigmatization could also negatively affect the level and quality of care provided by nursing care institution. Komatsu Dec., ¶27; 8 • Disclosure may be detrimental to the financial security of the disclosing facilities. Komatsu Dec., ¶¶26-27, 30; Bower Dec., ¶¶55, 61-70; 9 10 • Disclosure could have lasting deleterious effects on community members’ trust in the Department and its ability to trace and respond to communicable diseases. Komatsu Dec. at ¶¶36-39, and 11 12 • Disclosure of the information Plaintiffs seek, even if de-identified, will lead to the cross-referencing of de-identified data with other data sources, which will lead to re-identification exposing private patient information, because inclusion of facility and physician identifiers greatly increased the risk of reidentification. Bailey Dec., ¶¶10-30. 13 14 15 All of these concerns, in light of the law, informed the Department’s decision that the 16 17 records Plaintiffs seek cannot be disclosed. Bower Dec., ¶47. III. 18 LEGAL ARGUMENT 19 A. COMMUNICABLE DISEASE-RELATED INFORMATION IS CONFIDENTIAL 20 “‘Communicable disease related information’ means information regarding a 21 communicable disease in the possession of a person who provides health services or who 22 obtains the information pursuant to the release of communicable disease related 23 information.” A.R.S. § 36-661(4) (emphasis added) 2 “‘Health service’ means public or 24 private care, treatment, clinical laboratory tests, counseling or educational service for adults 25 2 26 27 28 The Legislature’s desire to make all communicable disease-related information confidential is evident from the fact sheet for the 2014 amendments to ARS 36-661, where at paragraph 36 the legislature removed “confidential” from the definition of “communicable disease information” to “clarify that statute does not suggest that some types of communicable disease related information is not confidential.” Appendix B (AZ S. F. Sheet, 2004 Reg. Sess. H.B. 2397). In other words, the Legislature has determined that all such information is confidential. 6 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 or children and acute, chronic, custodial, residential, outpatient, home or other health care 2 or activities related to the detection, reporting, prevention and control of communicable or 3 preventable diseases.” 4 information must be protected is a person who has been diagnosed with a communicable 5 disease. A.R.S. § 36-661(21). “A person who obtains communicable disease related 6 information in the course of providing a health service or obtains that information from a 7 health care provider pursuant to an authorization shall not disclose or be compelled to 8 disclose that information except as authorized by state or federal law ….” A.R.S. § 36- 9 664(A). The law further provides that “[a] state, county or local health department or 10 officer may”--not shall--“disclose communicable disease related information” under certain 11 enumerated circumstances not applicable here. A.R.S. § 36-664(C) (emphasis added). 12 Otherwise, “[a] person who knowingly … [d]iscloses, compels another person to disclose 13 or procures the disclosure of communicable disease related information” is guilty of a 14 misdemeanor and subject to “a civil penalty of not more than five thousand dollars….” 15 A.R.S. §§ 36-666(A)(2), 36-667(A)(2). A.R.S. § 36-661(14). A “protected person” whose private 16 To protect communicable disease-related information from disclosure, the 17 Department is required to “[p]rescribe reasonably necessary measures to keep confidential 18 information relating to diagnostic findings and treatment of patients, as well as information 19 relating to contacts, suspects and associates of communicable disease patients.” A.R.S. § 20 36-136(I)(11). Relatedly, the Arizona Administrative Code states that “[t]he Department 21 shall ensure that public health records disclosed pursuant to a public records request are de- 22 identified.” A.A.C. § R9-1-303(D). 3 “De-identified” means certain information listed in 23 45 CFR 164.514(b)(2)(i) for an individual and her relatives, employers, or household 24 members has been removed from the record before disclosure. A.A.C. § R9-1-301(7). 4 25 3 26 27 28 “[A]dministrative rules and regulations … are given the force and effect of law if they are consistent with the statutory scheme.” Santorii v. MartinezRusso, LLC, 240 Ariz. 454, 457, ¶18 (App. 2016) 4 The information listed in 45 C.F.R. § 164.514(b)(2)(i) is extensive and includes street addresses. See https://www.law.cornell.edu/cfr/text/45/164.514 (last accessed May 13, 2020). 7 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 “Public health records means information created, obtained, or maintained by the 2 Department for: a. Public health surveillance, public health investigation, or public health 3 intervention; b. A system of public health statistics; c. A system of vital records; or d. Health 4 oversight activities.” A.A.C. § R9-1-301(47). 5 Proceedings seeking the disclosure of communicable disease-related information--like 6 this special action--must be tailored to ensure confidentiality and the requesting party has 7 the burden of proof compelling disclosure. Specifically: (1) this Court cannot issue an 8 order disclosing communicable disease-related information except as permitted by A.R.S. 9 § 36-665; (2) Plaintiffs must establish a “clear and imminent danger” or “compelling need” 10 requiring disclosure; (3) this Court must “enter an order directing that the file be sealed 11 and not made available to any person, except to the extent necessary to conduct a 12 proceeding in connection with the determination of whether to grant or deny the 13 application, including an appeal” and conduct subsequent proceedings in camera if 14 appropriate to protect the information sought; (4) this Court must “provide written findings 15 of fact, including scientific or medical findings, citing specific evidence in the record which 16 supports each finding, and shall weigh the need for disclosure against the privacy interest 17 of the protected person and the public interest which may be disserved by disclosure which 18 deters future testing or treatment or which may lead to discrimination;” and (5) any order 19 requiring disclosure must nonetheless limit disclosure to only those who need the 20 information (like here, those to whom the Governor has already permitted disclosure 21 pursuant to Executive Order 2020-35) and prohibit redisclosure. 22 (emphasis added). A.R.S. § 36-665 23 Given the foregoing law, the Department’s decision to withhold the records sought is 24 appropriate for several reasons. First, Plaintiffs seek the release of communicable disease- 25 related information. Thus, they have the burden of proving a compelling need for, or a 26 clear and imminent danger justifying, disclosure. See A.R.S. § 36-665(B). Plaintiffs have 27 not even tried to meet that burden, opting instead to cast this as a simple public records 28 case. It is anything but, and the Court must look to the substance of the pleadings filed-8 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 and not titles or mislabels--to determine the relief requested. See Rodriquez v. Williams, 2 104 Ariz. 280, 283 (1969). 3 communicable disease-related information subject to A.R.S. § 36-665, and thus Plaintiffs 4 must meet (but cannot meet) their burden to compel disclosure. 5 It is clear that this special action seeks the release of 5 Second, the Department has discretion to decide whether to disclose communicable 6 disease-related information in any event. See A.R.S. § 36-664(C). Arizona’s public 7 records statutes, which are of general application, do not nullify the Department’s specific 8 statutory discretion. See Mercy Healthcare Ariz., Inc. v. AHCCCS, 181 Ariz. 95, 100 (App. 9 1994) (“A basic principle of statutory interpretation instructs that specific statutes control 10 over general statutes,” and “when a general and a specific statute conflict, we treat the 11 specific statute as an exception to the general, and the specific statute controls”). 12 Indeed, it is axiomatic that the Legislature means what it says. See Padilla v. Indus. 13 Comm’n, 113 Ariz. 104, 106 (1976) (“fundamental is the presumption that what the 14 Legislature means, it will say”). And had it meant to make disclosure of communicable 15 disease-related information always mandatory, the Legislature could and would have done 16 so by using the word “shall.” Instead, the Legislature used the “plainly permissive” term 17 “may”. Crum v. Maricopa Cty., 190 Ariz. 512, 514 (App. 1997) (recognizing the “plainly 18 permissive language of the statute, which says ‘may recover,’ not ‘shall recover’” when 19 construing A.R.S. § 23-355); see also In re Maricopa Cty. Sup. Ct. No. MH2003–000240, 20 206 Ariz. 367, 369, ¶7 (App. 2003) (“Courts ordinarily interpret ‘shall’ to mean the 21 provision is mandatory; a ‘may’ provision normally is interpreted as permissive.”). 22 The Department has permissive discretion to determine whether to disclose 23 communicable disease-related information, and Plaintiffs proffer no legal reason why this 24 Court should second guess the Department’s decision to protect that information or the 25 Legislature’s decision to empower the Department with the discretion to do so. See Marco 26 5 27 28 Plaintiffs may try to meet their burden in their Reply, but those would be new arguments that Plaintiffs never made in their opening brief, which cannot be made for the first time in a reply. See Westin Tucson Hotel Co. v. State Dept. of Revenue, 188 Ariz. 360, 364 (App. 1997) (“a claim raised for the first time in a reply is waived”). 9 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 C. v. Sean C., 218 Ariz. 216, 219, ¶9 (App. 2008) (“we do not second-guess the legislature’s 2 policy decision.”); Ariz. Water Co. v. Ariz. Dept. Water Resources, 208 Ariz. 147, 154, ¶30 3 (2004) (“‘considerable weight should be accorded to an executive department’s 4 construction of a statutory scheme it is entrusted to administer.’ In such cases, ‘a court may 5 not substitute its own construction of a statutory provision for a reasonable interpretation 6 made by the administrator of an agency.’”); Ariz. Cannabis Nurses Ass’n v. Ariz. Dept. of 7 Health Servs., 242 Ariz. 62, 65-66, ¶8 (App. 2017) (holding that “[a]lthough this court 8 determines whether DHS has properly interpreted the relevant law, DHS’ interpretation of 9 applicable statutes and regulations ‘is entitled to great weight’”). 10 Third, even if the Court sides with Plaintiffs, the Court still must (1) seal the file, and 11 hold these proceedings in camera as appropriate, (2) provide written findings of fact 12 supporting disclosure, citing specific evidence supporting each finding, (3) “weigh the need 13 for disclosure against the privacy interest of the protected person[s] and the public interest 14 which may be disserved by disclosure which deters future testing or treatment or which 15 may lead to discrimination”, (4) enter an order limiting the disclosure of the information 16 sought to “the persons whose need for the information is the basis of the order”, and (5) 17 “specifically prohibit redisclosure to any other persons, whether or not they are parties to 18 the action.” A.R.S. § 36-665(C), (G), (H). Thus, even if Plaintiffs prevail, they cannot 19 publish or distribute the records to others, which belies the purpose of this special action: 20 to report this communicable disease-related information to the general public. Complaint, 21 ¶43; App. at 3:6-16. 22 B. ENHANCED SURVEILLANCE ADVISORY INFORMATION IS CONFIDENTIAL 23 “Any medical information or other information from which a person might be 24 identified that is received by the department … in the course of an enhanced surveillance 25 advisory is confidential and is not available to the public.” A.R.S. § 36-784(C). The 26 Department received PPE-related information in the course of an enhanced surveillance 27 advisory. Plaintiffs seek disclosure of that PPE-related information together with address- 28 related information for congregate facilities. 10 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 Complaint, ¶39. Disclosure of that 1 information will reveal “other information” (a residential address, or medical condition-- 2 COVID-19) “from which a person” (a resident at the congregate facility) “might be 3 identified.” 6 Id.; see also Bailey Dec. at ¶¶10-30, Komatsu Dec., ¶¶9; 18-19, Bower Dec., 4 ¶¶ 38-43. 5 surveillance related to COVID-19 and otherwise to fulfill the purposes of performing 6 “health services” under ARS 36-661(14) (“activities related to the detection, reporting, 7 prevention and control of communicable or preventable diseases”). Moreover, PPE information was reported in connection with conducting 8 C. PERSONALLY IDENTIFIABLE MEDICAL INFORMATION IS CONFIDENTIAL 9 Similarly, the Department cannot disclose “[p]ersonally identifiable medical 10 information or any information from which a patient or the patient’s family might be 11 identified.” A.R.S. § 36-404(A)(2). The records at issue--even including facility specific 12 PPE-related information--will (not just might) identify a “person” associated with that 13 information by disclosing the institution at which an infected person resides. Bailey Dec., 14 ¶¶10-30; Komatsu Dec., ¶¶18-22; Bower Dec., ¶¶38-43. And, with minimal deduction, 15 that information may enable one to discover the identity of infected patients, their families, 16 and those who bravely treat the infected. Bailey Dec., ¶¶38-43; Komatsu Dec., ¶¶18-22; 17 Bower Dec., ¶¶42-43. 18 D. A.R.S. §§ 36-107 AND -783(E)(3) PRECLUDE DISCLOSURE 19 “No names or other information of any applicant, claimant, recipient or employer shall 20 be made available for any political, commercial or other unofficial purpose.” A.R.S. § 36- 21 107. Further, the Department “shall maintain as confidential … information likely to cause 22 substantial harm to the person’s or business’ competitive position.” A.R.S. § 36-783(E)(2). 23 The names of the congregate settings at issue cannot be disclosed because (1) many 24 are applicants and employers licensed by the Department, and (2) disclosure is “likely to 25 cause substantial harm” to these businesses and possibly even their residents. For example, 26 public disclosure of the name or address of a congregate setting could lead to 27 6 28 For example, PPE information includes ventilators. Those are used on patients battling COVID-19. This information might make it easier to ascertain who in the congregate setting has COVID-19, and “might” is enough to preclude disclosure. A.R.S. § 36-784(C). 11 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 discrimination, stigmatization, retaliation, societal exclusion, and safety threats against all 2 concerned. Bower Dec., ¶¶49-60. People associated with a setting may have a more 3 difficult time obtaining goods or services. Id. Disclosure could also negatively affect our 4 local healthcare systems and hospitals’ ability to partner with stepdown and long-term care 5 facilities and otherwise provide quality care. 7 Id. 6 These concerns are not hypothetical, but are based on past experience. For example, 7 one Department employee reported that he received death threats after returning from 8 performing public health work in Sierra Leone when it became known within his 9 community that he was experiencing certain symptoms indicative of an Ebola infection. 10 Komatsu Dec., ¶25. The reality was that the Department employee at issue did not have 11 Ebola or another communicable disease, but because of the disclosure of merely his work 12 abroad and experience of certain symptoms, he was threatened and stigmatized because the 13 information about his symptoms was misinterpreted or misunderstood. Id., ¶29. This 14 precluded his wife and children, who were staying with his in-laws while he was out of 15 country, from returning home for several weeks. Id. 16 In another example, Hacienda HealthCare (“Hacienda”) endured several setbacks as 17 a result of the publicity surrounding events at the facility in late 2018 and into 2019--events 18 that did not implicate the communicable disease-related information Arizona law closely 19 guards, or the stigma associated with combating a pandemic. Id., ¶¶61-70. Because of 20 publicity (albeit in connection with information not protected from disclosure like the 21 information in this case), multiple directors of nursing resigned, and Hacienda experienced 22 significant turnover among middle and upper management. Id. Hacienda had trouble 23 meeting its core staffing needs, which is critical, because congregate settings rely on 24 7 25 26 27 28 Hospitals and acute care providers rely on congregate settings in order to safely and timely discharge patients. Some congregate settings are accepting transferred patients with COVID-19 from other congregate settings to help facilitate the separation of those patients from other populations. Operation of a healthcare system depends on this partnership and cooperation. If the names of congregate settings with COVID-19 cases are publicly disclosed, it could lead to unwanted disincentives and a fear of accepting transfers of patients who have or may have COVID-19. This could hamper hospitals’ ability to safely and timely discharge patients, which could diminish bed capacity and hamper the treatment of new patients or a potential surge in COVID-19 cases. Bower Dec., ¶¶51, 53-58. 12 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 staffing agencies to provide emergency staffing coverage, and staffing agencies would not 2 work with Hacienda. 3 harassment, and safety threats. Id. There was even a shooting in Hacienda’s parking lot. 4 Id. Id. Hacienda’s employees experienced significant hostility, 5 As a result of these and other safety threats, Hacienda removed building and vehicle 6 signage, hired off-duty police officers to provide security, and installed a security card 7 system to limit entry into the facility. Id. These issues threatened the facility’s viability, 8 caused significant problems obtaining adequate insurance, and eventually forced Hacienda 9 to close the skilled nursing portion of its operation due to financial problems. Id. The 10 closure of the skilled nursing portion of the facility in turn disrupted continuity of care and 11 required long-term patients to be transferred to other facilities. Id. This is significant, 12 because research demonstrates that transfers of long-term patients will result in bad 13 outcomes (which may result in death) among approximately 10% of the patients--known as 14 “transfer trauma.” Id. Indeed, transfer trauma occurred in approximately 10% of the long- 15 term patients transferred from Hacienda. Id. 16 If these outcomes befell and adversely affected Hacienda and its patients (and their 17 families) in connection with the disclosure of information unrelated to communicable 18 disease-related information collected to combat a pandemic, then the Department’s concern 19 that releasing the records at issue here will adversely impact the facilities treating COVID- 20 19 victims is more than merely hypothetical. The Department (and this Court) cannot 21 ignore the reality that disclosure of the records at issue is “likely to cause substantial harm” 22 to these businesses and their residents. 23 24 E. PEOPLE IDENTIFIED BY THESE RECORDS--FROM PATIENTS TO HEALTH CARE HEROES WHO CARE FOR THOSE PATIENTS--HAVE A RIGHT TO PRIVACY, AND THAT RIGHT MATTERS 25 Arizonans have a right to peace and privacy. See Ariz. Const., Art. 2, § 8 (“No person 26 shall be disturbed in his private affairs … without authority of law.”); Restatement (Second) 27 of Torts § 652D (recognizing right to privacy); In re Estate of Reynolds, 235 Ariz. 80, 82, 28 ¶7 (App. 2014) (“Arizona long has recognized a common-law right of privacy.”). When it 13 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 comes to the production of public records, confidentiality, privacy, or other “best interests 2 of the state” can outweigh the public’s right to otherwise inspect public records. Scottsdale 3 Unified Sch. Dist. No. 48 v. KPNX Broad. Co., 191 Ariz. 297, 300, ¶9 (1998). 4 The cases this Court identified during its May 6, 2020 return hearing are in accord. In 5 Scottsdale Unified School District No. 48, 191 Ariz. at 301, ¶14, the Arizona Supreme 6 Court not only recognized that privacy or other interests can outweigh disclosure, but it 7 clarified what in fact constitutes “privacy”: 10 We again look for guidance to federal cases construing the FOIA. Although we have never defined the meaning of privacy under the Public Records Law, the Supreme Court, interpreting the FOIA, has stated that information is “private if it is intended for or restricted to the use of a particular person or group or class of persons: not freely available to the public.” 11 More recently, in Food Marketing Institute v. Argus Leader Media, 139 S.Ct. 2356 (2019), 12 the Supreme Court of the United States analyzed the interplay between public disclosure 13 under FOIA and the harm disclosure may cause government and private interests. 14 Rejecting an invitation to narrowly construe FOIA exemptions, the Supreme Court held: 8 9 18 … we normally “have no license to give [statutory] exemption[s] anything but a fair reading.” Nor do we discern a reason to depart from that rule here: FOIA expressly recognizes that “important interests [are] served by [its] exemptions,” and “[t]hose exemptions are as much a part of [FOIA’s] purpose[s and policies] as the [statute’s disclosure] requirement”. So, just as we cannot properly expand Exemption 4 beyond what its terms permit, we cannot arbitrarily constrict it either by adding limitations found nowhere in its terms. 19 Food Mktg. Inst., 139 S.Ct. at 2366 (internal citations omitted, brackets in original). In 20 addition, A.H. Belo Corporation v. Mesa Police Department, 202 Ariz. 184 (App. 2002), 21 is instructive. There, the media sought--and the trial court ordered--disclosure of a 911 22 recording. The appellate court, “consider[ing] the privacy of the injured child and family 23 dispositive,” reversed despite a transcript of the recording having already been produced. 24 A.H. Belo Corp., 202 Ariz. at 187, ¶11. In doing so, the appellate court noted that “privacy 25 interests can overcome the presumption” favoring disclosure of public records, which is a 26 “case by case” analysis. Id. at 187-188, ¶14 (emphasis in original). The court also 27 recognized that while “personal data or information” often trigger privacy concerns, “[t]he 28 range of privacy concerns is considerably broader” and “implicate concerns of the most 15 16 17 14 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 fundamental sort to the individual, concerns that implicate autonomy with respect to the 2 most personal of life choices and the intimate aspects of identity”--such as “residential 3 privacy” and “the quiet enjoyment of the home” (or perhaps like here, the decision or need 4 to reside in a congregate setting, or the unwilling acquisition of a communicable disease). 5 Id. at 188, ¶¶15-16 (internal quotations omitted). 6 The records Plaintiffs seek implicate significant privacy, economic, and other state 7 and public interests that outweigh disclosure. First, there is explicit assurance of privacy 8 with regard to the personal information, communicable disease-related information, and 9 enhanced surveillance-related information at issue, because as described above, that 10 information is statutorily confidential. In other words, the Legislature made clear that those 11 who provide such information, or who are identified by such information, will be protected 12 from any public invasion of privacy. Those statutory exemptions, without doubt, serve 13 “important interests” and “are as much a part of” Arizona’s public records law’s “purposes 14 and policies as the statute’s disclosure requirement.” Food Mktg. Inst., 139 S.Ct. at 2366 15 (brackets omitted). Indeed, if the names, addresses, and phone numbers of those with ties 16 to 9/11 terrorists who voluntarily speak with the government are free from involuntary 17 disclosure, then innocent people who contracted a communicable disease and never 18 assented to the disclosure of anything, and their care givers treating those victims during a 19 pandemic, should be treated no differently. See Broward Bulldog, Inc. v. U.S. Dept. of 20 Justice, 939 F.3d 1164 (11 Cir. 2019). 21 Second, the constitutional and common law right to privacy protects the information 22 at issue. Indeed, the right to privacy is especially pronounced in the context of illness or 23 disease. See Robert C. Ozer, P.C. v. Borquez, 940 P.2d 371, 377-79 (Colo. 1997) (“facts 24 related to … ‘unpleasant or disgraceful’ illnesses, are considered private in nature and the 25 disclosure of such facts constitutes an invasion of the individual’s right of privacy”). And 26 again, disclosure of the names and addresses of congregate settings will result in the 27 identification of those who live at those facilities and their medical condition. Bower Dec., 28 ¶¶38-43; Komatsu Dec., ¶¶18-22, 38; Bailey Dec., ¶¶10-30. The Department’s concern in 15 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 this regard is hardly novel, because several other states have also decided to withhold 2 similar information based on privacy concerns. See Appendix A (gathering states who 3 have made similar decisions and why). 8 4 It is well documented that the very information Plaintiffs seek will render all efforts 5 at de-identifying personal data moot, because enterprising individuals who wish to identify 6 those suffering from COVID-19 will be able to do so with minimal work. Bailey Dec., 7 ¶¶7-30. We know this not from unfounded concern, but through empirical research that 8 the Department has successfully replicated. Id. 9 The risk of re-identification increases as the number of possible matches gets smaller. 10 Id. If the criteria of selection are unusual or rare events (like a COVID-19 hot spot in a 11 confined congregate setting), representing small sections of the population based on 12 geography, age, ethnicity, or other demographic characteristics, the combination of these 13 unusual or rare criteria can greatly increase the probability of re-identification. Id. In 2015, 14 the Department discovered a study conducted at the Paris School of Economics in France 15 (the “Paris Study”), using anonymized data from Arizona’s Behavioral Risk Factor 16 Surveillance Survey (the “Survey”). Id. Although the data was anonymized, the Paris 17 Study was able to link that data to US Census data. Id. By cross-referencing publicly 18 available US Census datasets, the Paris Study was able to identify the neighborhoods in 19 which individual survey respondents lived. Id. This substantially elevated the risk that 20 individual respondents could be re-identified by using other demographic descriptors 21 within the data. Id. 22 Also in 2015, the Department discovered a study conducted at Harvard University (the 23 “Harvard Study”) about re-identification of anonymized datasets using publicly available 24 hospital information in Washington State. Id. The Harvard Study was able to successfully 25 8 26 27 28 Ironically, it is media who frequently infringes on patient privacy. For example, health agencies have endured media--like Bloomberg News--exposing patient information and criticizing the health agencies for not having enough protections. Bailey Dec., ¶25. At the same time other media--like Plaintiffs here--are accusing health agencies of being too restrictive with release of the data. Id. The media cannot have it both ways, and regardless, we all must take care to protect legitimate privacy interests. 16 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 re-identify individuals in the anonymized health datasets by cross-referencing them with 2 newspaper articles about hospital visits. Id. Bloomberg News later contacted individuals 3 who had been re-identified, and reported that where states release some combination of 4 identifying markers, it “increas[es] the likelihood that patient privacy can be 5 compromised.” Id. In fact, in 2016 the Department conducted a validation of the Harvard 6 Study by attempting to re-identify individuals in a de-identified database that was the 7 subject of an Arizona Republic article about surgical mistakes and medical malpractice 8 cases. Id. The results were startling. Id. The Department was able to re-identify two of 9 three individuals by cross-referencing the de-identified information in the database with 10 publicly available court records and hospital discharge data. Id. The identity of the third 11 person was narrowed down to two records, one of which was the actual individual’s 12 discharge record. Id. The key to re-identification in these cases was the hospital and 13 physician identifiers, without which re-identification could not have succeeded. Id. In 14 other words, the inclusion of facility and physician identifiers greatly increased the risk of 15 re-identification. Id. 16 In the end, the Department’s concerns that disclosure of the records at issue interferes 17 with peace and privacy or causes more harm than any good disclosure could provide, are 18 not mythical. These concerns are real and supported by empirical experience and data. 19 IV. CONCLUSION 20 For the foregoing reasons, this Court should deny Plaintiffs the relief they seek. 21 DATED: May 15, 2020. 22 SHERMAN & HOWARD L.L.C. 23 24 By /s/ Craig A. Morgan Gregory W. Falls Craig A. Morgan Lindsay H.S. Hesketh 201 East Washington Street, Suite 800, Phoenix, Arizona 85004-2327 Attorneys for Defendants 25 26 27 28 17 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 1 2 ORIGINAL of the foregoing e-filed on May 15, 2020 and a COPY emailed this same date to: 3 4 5 6 7 8 9 10 David J. Bodney Bodneyd@ballardspahr.com Craig Hoffman hoffmanc@ballardspahr.com Ian Bucon buconi@ballardspahr.com Ballard Spahr LLP One East Washington Street, Suite 2300 Phoenix, Arizona 85004-2555 Attorneys for Plaintiffs 15 Brian M. Bergin bbergin@bfsolaw.com Kevin M. Kasarjian kkasarjian@bfsolaw.com Bergin Frakes Smalley & Oberholtzer, PLLC 4343 E. Camelback Road, Suite 210 Phoenix, Arizona 85018 Attorneys for Defendants 16 /s/ Diana J. Hanson 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 18 Ac t i v e / 5 1 7 3 0 9 8 1 . 4 APPENDIX A Appendix A State Alabama Stated Ground(s) for Withholding Names of Nursing Homes and/or Long-Term Care Facilities • State law prohibits medical and statistical information related to cases or suspected cases of notifiable diseases reported by nursing home administrators, among others, to the state public health department from being subject to inspection, subpoena, or admission into evidence, unless compelled by a court in accordance with the law or upon written consent of the patient. AL Code § 22-11A-2. • Idaho State departmental policies preclude the release of similar confidential information received from assisted living facilities. See Brendan Kirby, State denies public records request for nursing home outbreaks, Fox10 News (April 27, 2020), https://www.fox10tv.com/news/coronavirus/state-denies-public-records-requestfor-nursing-home-outbreaks/article_9185db70-88e6-11ea-b375839807eba508.html (last accessed May 5, 2020). • State law provides that records of the department of health and welfare or a public health district that identify a person infected with a reportable disease are exempt from disclosure under the Idaho Public Records Act. I.C. § 74-106(12). • Indiana • Mississippi • Pennsylvania • Active/51696500.1 State departmental policy precludes publishing the residence of an individual who tests positive for COVID-19, which includes the names of long-term care facilities. See Tommy Simmons and Margaret Carmel, Here’s how Idaho decides what information to release about COVID-19 cases, Idaho Press (May 2, 2020), https://www.idahopress.com/coronavirus/heres-how-idaho-decides-whatinformation-to-release-about-covid-19-cases/article_3efdc1cf-2052-5bd4-9437e079fff0f2bb.html (last accessed May 5, 2020). The state is allowing nursing homes to exercise their discretion in deciding whether to release COVID-19 information associated with their facilities. See Daniel Beals, DIGGING DEEPER: Families critical of nursing home, health depts. for handling abc21 WPTA (April 23, 2020), of COVID-19 info, https://wpta21.com/2020/04/23/digging-deeper-families-critical-of-nursing-homehealth-depts-for-handling-of-covid-19-info/ (last accessed May 5, 2020). The state has withheld the names of specific facilities with reported cases of COVID-19, citing to concerns related to stigmatizing residents in the facilities and the facilities themselves, especially in the setting of employee shortages. See Luke Ramseth and Giacomo Bologna, Will Mississippi release names of nursing homes with COVID-19 cases? Other states are, Clarion Ledger (April 28, 2020), https://www.clarionledger.com/story/news/2020/04/28/ms-name-nursing-homescoronavirus-cases-like-other-states/3033435001/ (last accessed May 5, 2020). State law prohibits state and local health authorities from disclosing reports of diseases, including communicable diseases, and other related records to any person who is not a member of the state department of health or of a local board of department of health, except where necessary to carry out the purposes of the Disease Prevention and Control Law of 1955. See 35 P.S. § 521.15; Sarah Cassi, Texas • Virginia • Wisconsin • calls to uncover secret COVID-19 numbers at some Pa. nursing homes grow louder, lehighvalleylive.com (Updated May 4, 2020), https://www.lehighvalleylive.com/coronavirus/2020/05/calls-to-uncover-secretcovid-19-numbers-at-some-pa-nursing-homes-grow-louder.html (last accessed May 5, 2020). State law exempts from open records laws confidential medical information. See Tex. Gov’t Code Ann. § 552.101; Tex. Health & Safety Code § 181.006; Lomi Kriel and Vianna Davila, Texas still Won’t Say Which Nursing Homes Have COVID-19 Cases. Families Are Demanding Answers., ProPublica (April 30, 2020), https://www.propublica.org/article/texas-still-wont-say-which-nursing-homeshave-covid-19-cases-families-are-demanding-answers (last accessed May 5, 2020). State law requires the state health commissioner to preserve the anonymity of patients and practitioners whose records are examined as part of a disease investigation and provides that disease reports, including the name of the person making the report, submitted to the state department of health are confidential. See Va. Code Ann. §§ 32.1-36, 32.1-38, 32.1-41; Karina Bolster, VDH: No requirement for health care facilities to release COVID-19 data, WHSV3 (April 17, 2020), https://www.whsv.com/content/news/VDH-No-requirement-for-health-carefacilities-to-release-COVID-19-data-569744661.html (last accessed May 5, 2020). The state is withholding the names of specific facilities to protect patient privacy and the identification of patient’s residences (i.e., nursing homes). See Emily Files, Wisconsin DHS Identifies 187 Facility-Based COVID-19 Outbreaks, WUWM 89.7 FM – Milwaukee’s NPR (April 29, 2020), https://www.wuwm.com/post/wisconsindhs-identifies-187-facility-based-covid-19-outbreaks#stream/0 2 Active/51696500.1 APPENDIX Arizona Senate Fact Sheet, 2004 Reg. Sess. H.B. 2397, Arizona Senate Fact Sheet,... AZ S. F. Sheet, 2004 Reg. Sess. H.B. 2397 Arizona Fact Sheet, 2004 Regular Session, House Bill 2397 April 1, 2004 Arizona Senate Forty-sixth Legislature, Second Regular Session, 2004 AMENDED FACT SHEET FOR H.B. 2397 medical records; HIPAA Purpose Makes numerous changes to Arizona medical records statutes to clarify confidentiality and proper disclosure of records and to conform to the federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Standards. Background The HIPAA Privacy Standards (45 C.F.R. Parts 160 and 164, subsection E) establishes, for the first time, a set of national standards for the protection of patients' medical records and other health information provided to health plans, doctors, hospitals, pharmacies and other health care providers. The U.S. Department of Health and Human Services issued the Privacy Standards in April 2003 as part of HIPAA. HIPAA included provisions designed to encourage electronic transactions and required new safeguards to protect the security and confidentiality of health information. The HIPAA Privacy Standards address the use and disclosure of individuals' health information, as well as standards for individuals' privacy rights to understand and control how their health information is used. The major goal of the standards is to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being. The HIPAA Privacy Standards preempt (supersede) state health information laws and regulations when the laws are contrary to the federal regulations, unless the state laws are more stringent in their privacy protections. The Arizona Hospital and Healthcare Association found various inconsistencies between the state statutes governing medical records and the HIPAA Privacy Standards. H.B. 2397 removes or amends statutes that are preempted by the HIPAA Privacy Standards, so that Arizona health care providers will not violate the federal regulations by following the state laws. In addition, H.B. 2397 clarifies the state medical records statutes, so that the public and the health care provider community will more easily be able to understand and follow these laws. There is no anticipated fiscal impact to the state General Fund associated with this measure. Provisions Medical Records Definitions 1. Amends the definition of “health care decision maker” by referring to the statute governing mental health care powers of attorney and the statute governing placement of children in foster care. 2. Amends the definition of “medical records” by including all communications maintained for patient diagnosis and treatment and by removing the specific list of items that must be included in the medical record. 3. Defines “payment records” and “source data.” © 2020 Thomson Reuters. No claim to original U.S. Government Works. 1 Arizona Senate Fact Sheet, 2004 Reg. Sess. H.B. 2397, Arizona Senate Fact Sheet,... 4. Conforms Arizona law to the HIPAA Privacy Standards by specifying that records related to payment for health care are confidential records. Release of Medical Records to Patients and Health Care Decision Makers 5. Clarifies that the same standards apply to both patients and the patient's health care decision maker with regards to release of medical records. 6. Conforms Arizona law to the HIPAA Privacy Standards by removing the requirement that the health care provider give records to a “person designated in writing” by the patient or the health care decision maker. 7. Conforms Arizona law to the HIPAA Privacy Standards by removing the requirement that a patient or the patient's health care decision maker must specifically identify nonwritten forms of medical records. 8. Combines the circumstances in which a health care provider may deny access to patient's records to the patient or the patient's health care decision maker. Conforms Arizona law to the HIPAA Privacy Standards by allowing a health care provider to deny access to these records if it would result in danger to the patient or another person. Release of Medical Records to Third Parties 9. Codifies current practice of releasing medical and payment records by a health care provider to a third party as ordered by a court or tribunal of competent jurisdiction. 10. Codifies current practice of releasing medical and payment records by health care providers pursuant to written authorization. 11. Authorizes the release of medical and payment records to third parties pursuant to HIPAA Privacy Standards. 12. Conforms Arizona law to the HIPAA Privacy Standards by requiring health care providers to have a confidentiality agreement in place with an accreditation agency before releasing patient information to the agency. 13. Codifies current practice of releasing medical and payment records by a health care provider to health profession regulatory boards. 14. Conforms Arizona law to the HIPAA Privacy Standards by removing the requirement that a third party payor obtain authorization for a provider to disclose information to the payor. 15. Codifies current practice of releasing medical and payment records by a health care provider to the Industrial Commission or parties to a claim. 16. Clarifies the circumstances in which a health care provider may disclose a deceased patient's medical records. 17. Conforms Arizona law to the HIPAA Privacy Standards by removing the requirement that certain third parties submit a request in writing for records and the prohibition on health care providers from releasing nonwritten records, unless those records specifically are identified in a written request. 18. Recodifies the obligations of contractors regarding disclosure of medical records. Release of Medical Records to Third Parties Pursuant to Subpoena 19. Recodifies and reorganizes existing requirements for disclosing medical records to a third party who requests the records via subpoena. 20. Conforms Arizona law to the HIPAA Privacy Standards by clarifying the circumstances when a health care provider must release medical records pursuant to a subpoena. 21. Removes the existing exemption for notice and proof of service if the party seeking the records cannot determine the last known address of the patient. 22. Provides that, if the subpoena does not meet the requirements for mandatory release pursuant to the subpoena, the health care provider is not required to produce the records to the subpoena, but may choose to deliver the records to the court under seal or may object. Charges 23. Prohibits a health care provider or contractor from charging the Board of Osteopathic Examiners in Medicine and Surgery for the production of requested records. Retention of Records © 2020 Thomson Reuters. No claim to original U.S. Government Works. 2 Arizona Senate Fact Sheet, 2004 Reg. Sess. H.B. 2397, Arizona Senate Fact Sheet,... 24. Conforms Arizona law to the HIPAA Privacy Standards by setting the retention period for all records, including behavioral health records, at six years after the date the patient last received services from the provider or a longer period if the patient is a child. 25. Provides a retention period of six years for source data from the date of collection. Genetic Testing Information 26. Replaces “authorized representative” with “health care decision maker” for consistency with other medical records statutes. 27. Directs health care providers to object to producing genetic testing information pursuant to a subpoena and sets the standard for a court to order its production. Mental Health Information 28. Defines “health care provider” as mental health providers or health care institutions that are licensed as behavioral health providers by DHS. 29. Defines “contraindicated” to assist providers in determining when they may deny access to mental and behavioral health records consistent with HIPAA Privacy Standards. 30. Defines “health care decision maker” for consistency with other medical records statutes. 31. Defines “health care entity” so that the confidentiality provisions apply to DHS, the Arizona Health Care Cost Containment System and the Regional Behavioral Health Authorities. 32. Defines “records” for consistency with other medical records statutes. 33. Conforms Arizona law to the HIPAA Privacy Standards by removing the permitted disclosure of records to legal representatives (attorneys) of the patient, to the Department of Education and school districts. 34. Expands the list of permitted disclosures of records to include: a) Any person, not just family members, actively participating in the patient's care, treatment or supervision. Conforms Arizona law to the HIPAA Privacy Standards by allowing the patient to object to sharing information with family members unless the disclosure is otherwise permitted by federal or state law. b) The patient or the patient's health care decision maker. c) Third party payors so that the provider may obtain payment for their services. d) Accreditation agencies. Requires health care providers to have a confidentiality agreement in place before releasing the patient information to the agency. Communicable Disease Information 35. Defines “health care decision maker” for consistency with other medical records statutes. 36. Removes references to “confidential” communicable disease related information to clarify that statute does not suggest that some types of communicable disease related information is not confidential. 37. Preserves the permitted disclosures to accreditation agencies with whom the health care provider has a confidentiality agreement and for quality and peer review activities, but removes the requirement that information disclosed for these purposes may not include information identifying the protected person. 38. Allows health care providers to release communicable disease information to third party payors or its contractors. 39. Conforms Arizona law to the HIPAA Privacy Standards by requiring, rather than allowing, health care providers to release communicable disease information to the Department of Economic Security in connection with foster care, adoption or courtordered placement. 40. Conforms Arizona law to the HIPAA Privacy Standards by removing the requirement that a record of disclosures be made pursuant to a patient's release. 41. Allows communicable disease information to be included in records that accompany a body to a funeral director. Telemedicine Information © 2020 Thomson Reuters. No claim to original U.S. Government Works. 3 Arizona Senate Fact Sheet, 2004 Reg. Sess. H.B. 2397, Arizona Senate Fact Sheet,... 42. Defines “health care decision maker” for consistency with other medical records statutes. 43. Include behavioral health professionals in the definition of “health care provider.” 44. Clarifies the definition of “telemedicine” to specify that audio or video communications sent to a health care provider for diagnostic or treatment consultation is not telemedicine if it does not occur in the presence of the patient. 45. Clarifies that informed consent to deliver health care through telemedicine may be from the patient's health care decision maker. 46. Clarifies that telemedicine information may be used for research and educational purposes without patient consent as authorized by state or federal law. Miscellaneous 47. Makes technical, conforming and clarifying changes. 48. Provides for a general effective date. Amendments Adopted by Committee 1. Clarifies records related to payment for health care are confidential records. 2. Allows health care providers to release patient information to a person or entity specified in written authorization, to health profession regulatory boards and to the Industrial Commission. 3. Requires health care providers to have a confidentiality agreement in place with an accreditation agency before releasing patient information to the agency. 4. Clarifies the process for health care providers to respond to subpoenas. 5. Defines and modifies terms. 6. Makes technical and conforming changes. House Action Senate Action HEALTH 2/26/04 3 rd Read 3/15/04 DPA 10-0-0-2 HEALTH 4/1/04 DPA 9-0-0-0 58-1-1-0 Prepared by Senate Staff April 1, 2004 AZ S. F. Sheet, 2004 Reg. Sess. H.B. 2397 End of Document © 2020 Thomson Reuters. No claim to original U.S. Government Works. © 2020 Thomson Reuters. No claim to original U.S. Government Works. 4