OHSU v. Oregonian Publishing Co., LLC

HIPAA protects the privacy and confidentiality of “individually identifiable health information” created or received by a health care provider that relates to an individual’s health condition and identifies the individual. 45 CFR § 160.103. The HIPAA Privacy Rule, however, permits disclosure of protected health information where such disclosure is required by state law. 45 CFR § 164.512(a)(1). While Oregon Public Records Law gives every person the right to inspect public records, it exempts individually identifiable health information from disclosure. ORS 192.420(1); ORS 192.502(9)(a); 192.553; ORS 192.556 (11)(a).

The Oregon Supreme Court granted review of a Court of Appeals judgment reversing and remanding an order from the circuit court ordering plaintiff Oregon Health and Sciences University (“OHSU”) to disclose a list of tort claims filed against OHSU and related information, including claimant names, attorney names, and dates of the alleged torts, to defendant newspaper (Oregonian Publishing Co., LLC) (“The Oregonian”) pursuant to a public records request. On review, OHSU argued the requested information was protected health information shielded from disclosure by both HIPAA and exemptions under Oregon law. The Oregonian contended the requested records did not contain protected health information under HIPAA, and therefore, Oregon Public Records Law required disclosure. HIPAA protects the privacy and confidentiality of “individually identifiable health information” created or received by a health care provider that relates to an individual’s health condition and identifies the individual. 45 CFR § 160.103. The HIPAA Privacy Rule, however, permits disclosure of protected health information where such disclosure is required by state law. 45 CFR § 164.512(a)(1). While Oregon Public Records Law gives every person the right to inspect public records, it exempts individually identifiable health information from disclosure. ORS 192.420(1); ORS 192.502(9)(a); 192.553; ORS 192.556 (11)(a). The Oregon Supreme Court concluded the information was protected health information under HIPAA and Oregon Law because the information requested by The Oregonian would reveal individual OHSU patient names and information about health services received by those patients. The Court ultimately held OHSU was exempt from disclosure under Oregon Public Records Law, and thereby not required by the HIPAA Privacy Rule to disclose the requested information to The Oregonian. The decision of the Court of Appeals is reversed in part and affirmed in part. The judgment of the circuit court and the supplemental judgment awarding attorney fees and costs to The Oregonian are reversed, and the case is remanded to the circuit court for further proceedings.