Wisconsin Attorney General informal opinion I-03-07

STATE OF WISCONSIN
DEPARTMENT OF JUSTICE
J.B. VAN HOLLEN
ATTORNEY GENERAL
RaymondP. Taffora
Deputy Attorney General
114East,StateCapitol
P.O. Box 7857
Madison,WI 53707-7857
September	27,2001 I-03-07
Mr. GeorgeStanley
ManagingEditor
Milwaukee JournalSentinel
333 West StateStreet
Milwaukee,WI 53201-037|
Dear Mr. Stanley:
You have asked for my advice on the applicability of the Federal Health Insurance
Portability and Accountability Act ("HIPAA")' to section I46.50(12)(b) of the Wisconsin
Statutesgiven the following facts:
A reporter for the Milwaukee Journal Sentinel asked the City of Waukesha Fire
Departmentto provide accessto records of an ambulancedispatchedby the WaukeshaFire
Department. The assistantchief of the fire departmentprovided a redacted copy of the
ambulancereport. The redactedreport disclosedthe ambulanceprovider and EMTs involved,
the date of the call, the dispatchand responsetimes of the ambulance,the location to which the
ambulance was dispatched,the ambulance units sent and the other government agencies
respondingto the scene. The record did not identify the name, age and genderof the patient or
the patient's condition and treatment. The fire departmentexplained that it believed the
redactionswere required by HIPAA and sections51.30(4Xa)and 146.82(I) of the Wisconsin
Statutes.The fire departmentalsorelied on the "strong public and legislativepolicy" reflectedin
those privacy laws. The departmentthen concludedthat the public's right of inspectionof the
information was outweighedby the overridingpublic interestin confidentiality.
Approximatelythreeweekslater the fire departmentsupplementedits responsebecauseit
had beenadvisedthat the United StatesDepartmentof Health and Human Services("HHS"), the
federal agencythat administersand enforcesHIPAA, had opined that HIPAA allows the release
of protectedhealth information if that releaseis requiredunder a public recordslaw. The fire
departmentconcludedthat section 146.50(12)was sucha law and provided your newspaperwith
a supplementalresponsethat includedthe name,address,and age of the personto whom medical
serviceswere providedand the locationto which the patientwas transported.
'Pub.L. No. 104-19I,1996U.S.C.C.A.N.(110 Stat.)1936,codifiedin scatteredsectionsof
volumes18,26,42and49,U.S.Code.

Mr. GeorgeStanley
Page2
Although the particularincident giving rise to your inquiry has now beenresolved,I have
concludedthat your questionmerits a full answerbecauseit continuesto recur with regularity.
Consequently,record custodiansand the public alike arein needof guidance.
Section 146.50(I2)(a) requires that all records made by ambulanceservice providers,
emergencymedical techniciansor first respondersadministeringemergencycare proceduresbe
maintainedas confidentialpatient health care records. Section 146.50(I2)(b)provides a limited
exception for certain disclosures,but only by ambulance service providers who also are
"authorities"under the Wisconsinpublic recordslaw:
Notwithstanding par. (a), an ambulance service provider, who is an
authority, as defined in s. 19.32(l), may make available, to any requester,
information contained on a record of an ambulance run which identifies the
ambulanceserviceprovider and emergencymedical techniciansinvolved; date of
the call; dispatchand responsetimes of the ambulance;reasonfor the dispatch;
location to which the ambulancewas dispatched;destination,if any, to which the
patient was transportedby ambulance;and name, age and genderof the patient.
No information disclosedunder this paragraphmay containdetailsof the medical
history, condition or emergencytreatment of any patient.
Under HIPAA, a covered entity may not use or discloseprotectedhealth information
except as permitted by law. See 45 C.F.R. $ 16a.502(a). The definition of o'covered
entity"
includes "[a] health care provider who transmits any health information in electronic form in
connectionwith a transactioncovered by this subchapter." 45 C.F.R. $ 160.103. "Health
information" includes any information created or received by a health care provider and that
relates to past, present, or future physical or mental health or condition of an individual; the
provision of health care to an individual; or the past, present,or future paym.entfor the provision
of health care to an individual. 45 C.F.R. $ 160.103. "Protectedhealth information," with
limited exceptionsnot applicableto the presentanalysis,includesindividually identifiablehealth
information that is transmitted by electronic media or maintained in electronic media or
transmittedor maintained in any other form or medium. 45 C.F.R. $ 160.103. "lndividually
identifiable health information" includes health information that is created or received by a
health care provider and relates to the past, present or future physical or mental health or
condition of an individual; the provision of health care to an individual; or the past, present,or
future payment for the provision of health care to an individual and that identifies the individual.
45 C.F.R. $ 160.103. lnformation is considered to identify the individual if there is a
"reasonablebasisto believethe informationcan be usedto identify the individual." Id.
In its responseto your public records request, the WaukeshaFire Department concluded
that it was a "health care provider" and apparently concludedthat it was a "covered entity''under

Mr. GeorgeStanley
Page3 .
HIPAA. The facts provide no reasonto questionthat conclusion.2Becausethe WaukeshaFire
Departmentis a covered entity, HIPAA provides that it may use or disclose protectedhealth
information to the extentthat suchuse or disclosureis requiredby law and the use or disclosure
complieswith and is limited to the relevantrequirementsof such law. 45 C.F.R. $ 16a.512(a).
"Required by law" is defined under HIPAA as "a mandatecontainedin law that compels an
entity to make a use or disclosureof protectedhealth information and that is enforceablein a
court of law." 45 C.F.R. $ 164.103. "Required by law" includes statutesor regulationsthat
require production of information. Id.
Recentcourt decisionsfrom Ohio and Texasare helpful in understandingthe intersection
of HIPAA requirementsand statepublic recordslaws.
In Stateex rel. Enquirer v. Daniels,844 N.E.2d 1181(Ohio 2006),the court considered
whether lead-contaminationnotices issuedto property owners could be releasedunder Ohio's
public records law. The court first concludedthat the reports did not contain protectedhealth
information and thereforewere outsideof the purview of HIPAA. The court went on to decide,
however,that even if the recordsdid containprotectedhealth information the recordswould still
be subjectto releaseunder 45 C.F.R. $ 164.512(a),the "required by law" exceptionto HIPAA.
Daniels,844N.E.2dat 1186-87.
The court noted that the Ohio public recordsact requireddisclosureof informationunless
prohibitedby federal law, while federal law allows disclosureof protectedhealth information if
required by state law. Id. at 1187. The court next noted explanatory statements about
section 160.512(a)madeby HHS when the HIPAA Privacy Rule was implemented:
"[W]e intend [160.5Iz(a)l to preserveaccessto information consideredimportant
enoughby stateor federal authorities to require its disclosureby law"; o'wedo not
believe that Congressintended to preempt each such law"; and "[t]he rule's
approachis simply intendedto avoid any obstruction to the health plan or covered
healthcareprovider's ability to comply with its existing legal obligations."
Daniels,844 N.E.2d at 1187(quoting Standardsfor Privacy of Individually IdentifiableHealth
Information,65 Fed. Pteg.82462,82667-68(Dec. 28, 2000)).
The court then relied on HHS' statementsabout the specific interaction between HIPAA
and the federal Freedom of Information Act. HHS had concluded that federal Freedom of
Information Act requests come within the Privacy Rule exception that permits uses or
disclosuresrequiredby law. Daniels,844 N.E.2d at 1187 (quoting 65 Fed. Reg. at 82482), The
2The threshold determination of whether a health care provider is a covered entity is essentialto
application of HIPAA privacy requirementsand, therefore, to the discussion concerning their application
that follows.

Mr. GeorgeStanley
Page4
court concluded, by analogy, that if the Ohio public records act required disclosure under Ohio
law, disclosuredid not violate HIPAA's privacy rule, so long as any disclosuremet the relevant
requirementsof the Ohio public recordslaw. Daniels,844 N.E.2d at IlSl .
The Texas Court of Appeals reached a similar conclusion. Abbott v. TexasDept. of
Mental Health,212 S.W.3d 648 (Tex. App,2006). The requestin Abbotl was for statistical
information regarding allegationsof abuseand investigationsof abusein Texas statefacilities.
The Department of Mental Health and Mental Retardationhad denied the request,relying on the
privacy provisions of HIPAA. The Texas Attorney General disagreedwith the department's
conclusion. The departmentcontestedthe attorney general's opinion in district court. The
district court agreed with the Department of Mental Health and Mental Retardation and the
attorneygeneralappealed.Abbott,2l2 S.W.3dat 651-53.
Like the Ohio court, the Texas appealscourt first concluded that the information sought
was not protectedhealthinformation. Abbott,212 S.W.3dat 655-57. The court alsoconcluded,
however, that even if the information was consideredprotectedhealth information under IIIPAA,
the Texas Public Information Act required that the information be released. The court held that
the Public Information Act was a law that requireddisclosureof the information under45 C.F.R.
$ 164.512(a)(l). The court also held that the general"required by law" provisions of 45 C.F.R.
$ 164.512(a)were not limited by the more specificprovisionsof other subsectionsof 45 C.F.R.
5 164.512.Abbott,212S.W.3dat 660.
The court again noted the HHS commentaryregarding resolution of potential conflicts:
The commentaryspecifiesthat
ifa conflict appearsto exist becausea previous statuteor regulation requires a
specific use or disclosure of protected health information that the [privacy]
rules below appearto prohibit, the use or disclosurepursuant to that statuteor
regulation would not be a violation of the privacy regulation because $
164.5I2(a) permits covered entities to use or disclose protected health
information as required by law.
. . . In addition, in addressing concerns that were raised by the inclusion of
section 164.5I2(a), the commentary provides [with respect to information
required to be disclosedby state or federal law] that it is not appropriatefor HHS
"to reassessthe legitimacy of or the need for each of these mandates.. . ." . . .
Finally, the commentary statesthat, given the variety of laws that might require
disclosure of health information and the context in which they might arise, "we do

Mr. GeorgeStanley
Page5
not believe that Congress intended to preempt each such law unless HHS
specificallyrecognizedthe law or purposein the regulation.
Abbott,212 S.W.3dat 663 (internalcitationsandboldingomitted).
Therefore,the Texascourt concluded:
fC]overed entities faced with a request for disclosure involving potentially
protectedhealth information must examine the information in light of HIPAA and
the Privacy Rule to determine if the information is protected health information
that is generally not subject to disclosure. If the request does not involve
protected health information, then HIPAA and the Privacy Rule do not prohibit
disclosureof the information. If the requestasksfor information that is protected
health information, then the agency must ascertain if any exception to
non-disclosurein the Privacy Rule applies. If no exception applies,the agency
may releasethe information if potential identifiersare redactedor if a statistician
determines that release of the information cannot be used to identify any
individual. If an exceptionto non-disclosuredoesapply, the agencymust release
the information. For example, if the requestis made under the authority of a
statute that requires disclosure,then the exception found in section 164.5I2(a)
applies,and the agencymust disclosethe information as long as the disclosure
complieswith all relevantrequirementsof the statutecompelling disclosure.. . .
If a request for protected health information is made under the Public
Information Act, then the exception to non-disclosurefound in section 164.512(a)
of the Privacy Rule applies, and the agency must determine whether the Act
compels the disclosure or whether the information is excepted from disclosure
under the Act. For example, if the information is considered confidential by
judicial decision, statute,or the constitution, then the information is not subjectto
disclosure under the "confidential" exception to disclosure found in the Public
Information Act.
Abbott,2l2 S.W.3dat 662 (internalcitationsomitted). The court specificallyrejectedthe
argumentthat the preemptionprovisionsof HIPAA, 45 C.F.R.$$ 160.202-160.203	requireda
differentconclusion.Abbott.212 S.W.2dat 664-65.
The Ohio and Texas decisions are consistentwith the position taken by HHS on its
website addressing frequent questions,
http://www.hhs.gov/HlPAAfaq/permitted/require/506.htnil. In answer to a question concerning
the relation between the HIPAA Privacy Rule and state public records laws, the HHS website
states(as of March 26, 2007): "Thus, where a state public records law mandatesthat a covered
entity disclose protected health information, the covered entity is permitted by the Privacy Rule

Mr. GeorgeStanley
Page6
to make the disclosure,provided the disclosurecomplies with and is limited to the relevant
requirementsof the public records law." The Texas appealscourt noted and relied upon this
advice.Abbotr.2l2 s.w.3d at 664.
Similarly, a federal district court considering the relationship of the 45 C.F.R.
$ i64.512(a)(a)"required by law" disclosureauthorization to anotherprovision of federal law
also found persuasivethe HHS commentary published with the Privacy Rule and advice
provided on the HHS website. Protection & Advocacy System, Inc. v. Freudenthal,
412F. Supp.2d l2Il, 1216-17(D. Wyo. 2006). That court had to determinewhetherprovisions
of several federal laws authoizing patient record accessby agencies-like the plaintiff-
providing protection and advocacy services to persons with developmentaldisabilities and
mental illness constituted disclosures "required by law" for purposes of 45 C.F.R.
$ 164.512(aX1).Protection& AdvocacySystem,412F. Supp.2d at 1212-16.
The court observed that the drafters of the HIPAA Privacy Rule clearly considered
potential conflict with other laws, and addressedthat potential conflict in the preamble to the
regulations. The federalagency'sinterpretationof its own regulationswas entitledto substantial
deference,the court explained,and was controlling unlessplainly effoneousor inconsistentwith
the regulations. Protection & Advocacy System, 4I2 F. Supp. 2d at 1216. Discussing the
sectionrca5n@)(l) "required by law" exception, the court then noted that the Privacy Rule
was not intendedto createor chanse substantivelaw. Id.
Like the Texas court in Abbott, the federal court also noted approving advice on the HHS
website regarding 45 C.F.R. $ 164.512(a)(1)"required by law" disclosuresto protection and
advocacyagenciessuch as the plaintiff. HHS had designatedits Office of Civil Rights ("OCR")
to enforce the Privacy Rule, the court explained, and OCR actually operated the website
providing the Privacy Rule advice approving disclosure to protection and advocacy agencies.
Protection and AdvocacySystem,4I2F. Supp.2d at 1218. That is the sameHHS websitenoted
above and referred to in Abbott.
The Wisconsin disclosure statute central to your inquiry is not the state public records
law, sections19.31-19.37,butrather the ambulanceserviceprovider recordsdisclosurestatute,
section 146.50(12Xb). Although this opinion therefore analyzesthe interactionof HIPAA and
section 146.50(12),the samet1,peof analysiswould apply to issuesarising from the interaction
from HIPAA, other patient health care record confidentiality requirementsof Wisconsinlaw, see
generally sections146.81-146.84and 19.31-37.Resolutionof thoseissues,however,are beyond
the scopeof this opinion.
Section 146.50(12)(b) of the Wisconsin Statutes mandates that an ambulance provider
that is an "authority" for purposes of the public records law "may make available, to any
requester,"certain specified information from ambulanceseryice provider records that otherwise
would be confidentialpursuantto section A6.50(12)(a). This office previously has concluded

Mr. GeorgeStanley
Page7
that despitethe fact that section 146.50(I2)(b) usesthe term "may," the statuteis not permissive.
78 Op. Att'y Gen. 71 (1989). Disclosureof the informationspecifiedin section146.50(12Xb)
instead is subject to the public records law and that custodiansdo not have total personal
discretionto grant or deny access.The "may" in section I46.50(12)(b)thereforemandatesthat a
custodianof ambulanceserviceprovider recordsapply the case-by-caseanalysisof the common
law balancingtestrequiredby the public recordslaw. 78 Op. Att'y Gen.7I,76 (1989).
Although the balancingtest often is explainedas an exerciseof "discretion" by a record
custodian, e.9., Hempel v. City of Baraboo, 2005 WI 120, fl 62, 284 Wis. 2d 162,
699 N.W.2d 551, it does not allow the records custodianunfettereddiscretion so as to make
balancing test disclosuressomething other than "required by law." The Wisconsin public
recordslaw is very clear that disclosureis mandatedexcept in those exceptionalcircumstances
when a custodian,in the exerciseof his or her judgment, determinesthat public policy interests
favoring non-disclosureoutweigh the presumptionof disclosure. Hempel, 284 Wis. 2d 162,
fl 63.
Under Wisconsin's public records law, and therefore under section 146.50(12), the
records specified in section 146.50(12)(b)must be releasedunless the public's interest in
nondisclosureoutweighs the strong presumption of disclosure recognized in section 19.31.
Becausesection146.50(12)(b)is a statelaw that mandatesdisclosure,45 C.F.R. $ 164.512(a),as
interpreted by the agency charged with interpreting and enforcing the federal law, allows
disclosure of the information specified in section 146.50(12)(b)-when so determined by the
records custodian using the balancing test analysis-despite the more restrictive general
provisions of the HIPAA privacy rule. As noted, this conclusion is also consistentwith the
reasoningand conclusionsof the Ohio and Texas courts.
This conclusionis also consistentwith section 19.36(1),which provides: "Any record
which is specifically exempted from disclosure by state or federal law or authorized to be
exemptedfrom disclosureby statelaw is exempt from disclosureunder s. 19.35(1),exceptthat
any portion of that record which contains public information is open to public inspection as
provided in sub. (6)." The HHS commentary teaches that records like those identified in
section 146.50(12(b),disclosureof which is required by the Wisconsin public records law, are

Mr. George Stanley
Page 8
not records which are specifically exempted from disclosure by federal law. They are not,
therefore,exempt from disclosureunder section 19.36(1).
Sincerely,
J.B.Van Hollen
Attorney General
JBVH:AL:cla
cc: Miles W.B. Eastman
AssistantCityAttomey
City of Waukesha