Attorney General Opinion No.

Linden G. Appel Chief Legal Counsel Kansas Department of Corrections Landon State Office Building 900 SW Jackson, 4^th Floor Topeka, Kansas 66612

Dear Mr. Appel:

As Chief Legal Counsel for the Kansas Department of Corrections (DOC), you ask whether federal law or other statutes conflict with and preempt the disclosure of a releasee's address when that address is also the location where a releasee is receiving mental health or substance abuse counseling. *Page 2

You inform us that since 1997, pursuant to the Kansas Open Records Act (KORA), ¹ DOC has provided location information for persons considered to be in the custody of DOC.² Most persons are housed in correctional facilities. However, individuals that are no longer in correctional facilities may also remain within the custody of the Secretary of Corrections. Someone who is no longer incarcerated but is still in custody could be classified as on parole, conditional release supervision, or postrelease supervision.³

A potential conflict arises when a person in custody may be located in a treatment facility for drug or alcohol abuse evaluation or treatment. The person may be in the facility voluntarily or placed there as a condition of parole, postrelease supervision or by a court.⁴ Personal privacy for those undergoing treatment for alcohol or drug abuse evaluation or treatment is protected by federal law.⁵

A brief review of each of the relevant statutes and their requirements may provide direction to DOC about how to remain in compliance.

THE KORA REQUIREMENTS

We begin with the public policy that "public records shall be open for inspection by any person unless otherwise provided. . . ."⁶ In this case, the KORA language addressing conflicts with other laws states that if a record is "specifically prohibited or restricted by federal law, state statute or rule of the Kansas Supreme Court . . ." it shall not be disclosed.⁷

KORA specifically addresses the availability of records concerning information about persons within the custody of DOC.⁸ Although other information is available, our analysis concerns only location. Before 1997, the location of persons within the custody of DOC was limited to inmates. Effective July 1, 1997, the statute was expanded to include the location of persons considered still in custody, but no longer housed in DOC facilities.⁹ The new language specifically required DOC to provide the "location of facility where incarcerated or location of the parole office maintaining supervision and address of a releasee whosecrime was committed after the effective date of this act. . . ."¹⁰

You point out that in the same statute other available information includes "conditions of supervision, excluding requirements pertaining tomental health or substance abuse counseling. . . ."¹¹ This effectively limits the information that may be accessed concerning a person in custody who voluntarily or involuntarily obtains counseling as *Page 3 part of a substance abuse treatment program. Although it is recognition of the sensitive nature of information about mental health or substance abuse treatment, it only applies to conditions of supervision and not to location.

THE FEDERAL PART 2-CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENTRECORDS REQUIREMENTS¹²

The federal statutes concerning patient records for those who seek alcohol and drug abuse treatment "carry a strong presumption against disclosing records of this kind."¹³ Before addressing the type of patient information that is subject to confidentiality, it is important to point out that the federal regulations preempt state law by stating that "no State law may either authorize or compel any disclosure prohibited by these regulations."¹⁴

The federal statute requires confidentiality of patient records that would reveal identity, diagnosis, prognosis or treatment unless the patient gives consent or release is authorized within the regulations.¹⁵ For our analysis, the critical component is patient identity. The definition portion of the regulations state "patient identifying information means the . . . address . . . or similar information by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publically available information."¹⁶

Under the federal regulations, "disclose or disclosure means a communication of patient identifying information, the affirmative verification of another person's communication of patient identifying information, or the communication of any information from the record of a patient who has been identified."¹⁷

You ask if it would be permissible to exclude the name of the relevant treatment facility in order to comply with the statutory requirements of KORA of providing location information of persons within the custody of DOC, but housed at such a treatment facility. We believe the federal regulations prohibit such an act because the treatment facility could be identified by its location and falls within the prohibition "by reference to other publically available information."¹⁸ In other words, the address of the facility could lead a reasonable person to determine that the named individual is a patient. Therefore, the identified information, including the address of an individual who is in the custody of DOC and is housed at a treatment facility may not be disclosed. *Page 4

We acknowledge that there are exceptions to the non-disclosure requirement, but none of the permitted exceptions are relevant for this inquiry.¹⁹

THE PRIVACY RULE AS ENACTED AS PART OF THE HEALTH INSURANCE PORTABILITYAND ACCOUNTABILITY ACT OF 1996 (HIPAA)²⁰

You inquire whether the DOC as a covered entity in HIPPA federal regulations²¹ is bound by the preemption of state law concerning release of health information.²² As with the restrictions concerning those receiving alcohol or substance abuse treatment, HIPAA prohibits the disclosure of any health information.

In HIPPA, "disclosure" is defined as "the release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information."²³ "Health information means any information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider . . . and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual. . ."²⁴ "Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and . . . (2)(ii) there is a reasonable basis to believe the information can be used to identify the individual."²⁵

In this case the KORA requirements of providing the address of an individual in custody in a treatment facility are preempted by HIPPA as that record would be considered demographic information²⁶ and "relates to the privacy of individually identifiable health information . . . in a direct, clear, and substantial way."²⁷ *Page 5

CONCLUSION

Persons who remain in the custody of DOC and reside at a facility for the purpose of alcohol or substance abuse evaluation or treatment may not have their address distributed as required by KORA because of the federal preemption of Kansas statutes concerning individually identifiable health records or patient identity. The restriction may be waived by the consent of the individual.

Sincerely,

DEREK SCHMIDT Attorney General of Kansas

Michael J. Smith Assistant Attorney General

MJS:ke

¹ K.S.A. 45-215 et seq.

² K.S.A. 2010 Supp. 45-221(a)(29)(A).

³ See K.S.A. 21-4703(p) for the definition of "postrelease supervision."

⁴ K.S.A. 22-3712.

⁵ Public Health Service Act, 42 U.S.C. § 290dd-2 (2010).

⁶ K.S.A. 45-216(a).

⁷ K.S.A. 2010 Supp. 45-221(a)(1).

⁸ K.S.A. 2010 Supp. 45-221(a)(29).

⁹ L. 1997, ch 181, § 15.

¹⁰ K.S.A. 2010 Supp. 45-221(a)(29) (emphasis added).

¹¹ Id. (emphasis added).

¹² The federal rules are applicable to treatment facilities that are in any way touched by federal funding or regulation. This opinion applies to persons within DOC custody seeking treatment at those facilities only. See 42 C.F.R. Ch. 1 § 2.12 (2000).

¹³ Mosier v. American Home Patient, Inc., 170 F.Supp2d 1211, 1213 (N.D. FL 2001).

¹⁴ 42 C.F.R. Ch. 1 § 2.20 (2000).

¹⁵ 42 U.S.C. 290dd-2.

¹⁶ 42 C.F.R. Ch. 1 § 2.11 (2000) (emphasis added).

¹⁷ Id.

¹⁸ Id.

¹⁹ 42 C.F.R. Part 2, Subparts C, D and E.

²⁰ 42 U.S.C. § 1320d et seq.

²¹ 45 C.F.R. § 160.103 and § 164.501.

²² 45 C.F.R. § 160.103.

²³ Id.

²⁴ Id.

²⁵ Id.

²⁶ Id.

²⁷ 45 C.F.R. § 160.202. *Page 1