April 28, 2015
FROM: Camille Jobin-Davis, Assistant Director
CC: Chief Records Access Officer
The staff of the Committee on Open Government is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the facts presented in your correspondence.
Dear Mr. Kane:
This is in response to your request for an advisory opinion regarding application of the Freedom of Information Law to records requested from the Fulton County Board of Supervisors.
In response to your initial request for “a record of a current supervisor that owed or had money forgiven that was owed to the Fulton County Residential Health Care Facility”, you were informed by the Administrative Officer as follows: “I have reviewed the outstanding Accounts Receivable List for the former Fulton County Residential Health Care Facility. There is no listing for any of the person(s) you referenced.” In response to your request that the agency certify that it does not have possession of the requested records, or that such records could not be found after diligent search, the Administrative Officer indicated that if any such records existed, they would be confidential pursuant to the federal Health Insurance Portability and Accountability Act (HIPAA). On appeal, the agency indicated that HIPAA prohibits the release of these types of records, and that again, if they exist, they would be exempted from disclosure.
In its later two responses, the agency has essentially adopted what is known under the federal Freedom of Information Act as a Glomar response. In other words, the agency has indicated that it will neither confirm nor deny the existence of the requested records, in this case due to the prohibition against disclosure under HIPAA. This is a type of response that has been engrafted onto the federal Freedom of Information Act and confirmed by federal courts. It is our understanding that such response is typically used involving issues of national security or when an indication of the existence of a law enforcement record would have a stigmatizing effect. While we can confirm our understanding that HIPAA would prohibit a provider of health care services such as the Fulton County Facility from disclosing medical records, including billing records, as far as we are able to determine, there is no authority for a state or local government agency in New York to adopt the position that it can neither confirm nor deny the existence of such records.
On many occasions, this office has advised that FOIL, which pertains to records maintained by state and local government agencies in New York, permits an agency to respond in only one of three ways to a request for records. Under FOIL, an agency can grant access to a record in whole or in part, deny access to a record in whole or in part, or indicate that no such record exists. FOIL is based in large part on the federal Freedom of Information Act (FOIA); however, as recently held by a New York court, there is no basis in law for an agency subject to FOIL to adopt a Glomar response. See, Grabell v. New York City Police Department, Supreme Court, New York County, December 9, 2014 and Hashmi v. New York City Police Department, Supreme Court, New York County, November 17, 2014.
Accordingly, it is our opinion that in order to comply with the requirements of HIPAA and FOIL, an agency must either deny access to the record, or as requested, provide a certification that no such record exists. In this case, due to the nature of the request, it is our opinion that the agency should respond to both requests, for records showing money owed, and for records showing money forgiven.
We hope that this is helpful.