BOTH THE HIPAA PRIVACY RULE AND THE PUBLIC OFFICERS LAW APPLY TO THE FOIL REQUEST FOR RECORDS DOCUMENTING INJURIES SUFFERED BY ATHLETES USING THE OLYMPIC TRAINING FACILITIES IN THE ADIRONDACK PARK; THE HIPAA DEIDENTIFICATION PROCEDURE SHOULD BE APPLIED TO THE REQUESTED RECORDS (THIRD DEPT).
The Third Department noted that the HIPAA deidentification procedure was applicable to the FOIL request for sports-related injuries at the Olympic facilities in the Adirondack Park. The FOIL request was made to the respondent NYS Olympic Regional Development Authority:
… [T]he health-related information contained in the reports at issue is subject to the protections of both HIPAA and Public Officers Law § 87 (2) (b). Specifically, the HIPAA Privacy Rule, among other things, addresses the use and disclosure of “individually identifiable health information,” which is defined as “any information, including demographic information collected from an individual, that . . . is created or received by a health care provider, . . . relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and . . . identifies the individual . . . or[,] with respect to which[,] there is a reasonable basis to believe that the information can be used to identify the individual” (42 USC § 1320d [6]). Further, as relevant here, Public Officers Law § 89 (2) (b) (i) expressly provides for the protection of medical history, which refers to “information that one would reasonably expect to be included as a relevant and material part of a proper medical history” … . Upon our review, we conclude that the information provided on the subject forms falls within these protections, as it directly pertains to the relevant individual’s present health condition and would reasonably be included as part of his or her medical history. Matter of Getting the Word Out, Inc. v New York State Olympic Regional Dev. Auth., 2023 NY Slip Op 01334, Third Dept 3-16-23
Practice Point: Where a FOIL request involves medical records, the HIPAA Privacy Rule applies and the HIPAA deidentification procedure should be applied to the requested records.