68 October 19, 2017 No. 56
IN THE SUPREME COURT OF THE
STATE OF OREGON
OREGON HEALTH AND SCIENCE UNIVERSITY,
a public corporation,
Respondent on Review,
v.
OREGONIAN PUBLISHING COMPANY, LLC,
a domestic limited liability company,
Petitioner on Review.
(CC 111216443; CA A152961 SC S064249)
On review from the Court of Appeals.*
Argued and submitted March 3, 2017.
Duane A. Bosworth, Davis Wright Tremaine LLP,
Portland, argued the cause and filed the briefs for petitioner
on review. Also on the briefs was Derek D. Green.
Roy Pulvers, Holland & Knight LLP, Portland, argued
the cause and filed the brief for respondent on review. Also
on the brief was Nellie Q. Barnard.
Inge D. Wells, Assistant Attorney General, Salem, filed
the brief on behalf of amicus curiae State of Oregon. Also on
the brief were Ellen F. Rosenblum, Attorney General, and
Benjamin Gutman, Solicitor General.
Hillary A. Taylor, Keating Jones Hughes, PC, Portland,
filed the brief on behalf of amicus curiae Oregon Medical
Association. Also on the brief was Lindsey H. Hughes.
Before Balmer, Chief Justice, and Kistler, Walters,
Landau, Nakamoto, and Flynn, Justices, and Brewer, Senior
Justice pro tempore.**
______________
** Appeal from Multnomah County Circuit Court, Richard Maizels, Judge.
278 Or App 189, 373 P3d 1233 (2016).
** Baldwin, J., retired March 31, 2017, and did not participate in the decision
of this case. Duncan, J., did not participate in the consideration or decision of this
case.
Cite as 362 Or 68 (2017) 69
BREWER, S. J. pro tempore
The decision of the Court of Appeals is reversed in part
and affirmed in part. The judgment of the circuit court and
the supplemental judgment awarding attorney fees and costs
to The Oregonian are reversed, and the case is remanded to
the circuit court for further proceedings.
Case Summary: Defendant newspaper filed a public records request under
ORS 192.490(1) with plaintiff, a public corporation that provides patient health
care, seeking a list of the claimant names, attorney names, dates of alleged
torts, and other information for tort claim notices received by plaintiff. Plaintiff
responded that some of the requested information was exempt from disclosure
pursuant to various state and federal laws. Defendant petitioned the district
attorney, pursuant to ORS 192.450 and ORS 192.460, for an order directing
plaintiff to disclose the requested record, which the district attorney granted,
and plaintiff filed an action in circuit court, seeking a declaratory judgment
that the information in the requested record that it had declined to disclose was
exempt from disclosure. On the parties’ cross-motions for summary judgment,
the circuit court determined that the exemptions that plaintiff relied on were not
available and entered a judgment requiring plaintiff to disclose the requested
record. Plaintiff appealed, and the Court of Appeals reversed in part, directing
the circuit court to examine the tort claim notices in question to determine if
they are exempt from disclosure under ORS 192.496(1) because they contain
information about the physical or mental health or psychiatric care or treatment
of an individual patient. Held: For tort claim notices involving patients, (1) the
requested information at issue—the claimant names, attorney names, and dates
of the alleged torts—is “protected health information” that is confidential pursu-
ant to ORS 192.553; (2) the protected health information at issue is exempt from
disclosure under ORS 192.502(9)(a); and disclosure of the requested record is not
required by ORS 192.420(1).
The decision of the Court of Appeals is reversed in part and affirmed in part.
The judgment of the circuit court and the supplemental judgment awarding
attorney fees and costs to The Oregonian are reversed, and the case is remanded
to the circuit court for further proceedings.
70 OHSU v. Oregonian Publishing Co., LLC
BREWER, S. J. pro tempore
This case concerns a public records request made
by defendant Oregonian Publishing Company, LLC (The
Oregonian), a newspaper, to plaintiff Oregon Health and
Sciences University (OHSU), a public health and research
university that provides patient care at its hospital, con-
ducts research, and educates health care professionals
and scientists. The circuit court ordered OHSU to disclose
the requested record, and OHSU appealed. The Court of
Appeals reversed and remanded to the circuit court to
examine the public records at issue and then determine
whether state and federal exemptions permitted OHSU to
withhold some of the requested information. On review, the
issues have narrowed to whether the requested record con-
tains “protected health information” and student “education
records” under federal and Oregon law and, if so, whether
that information nonetheless must be disclosed pursuant to
ORS 192.420(1), a provision of the Oregon Public Records
Law (OPRL).1
For the reasons explained below, we conclude that
the requested record contains protected health information
and that ORS 192.420(1) does not require the disclosure of
that information. In the absence of adequately developed
arguments, we decline to consider whether the part of the
requested record consisting of tort claim notices filed by stu-
dents contains “education records,” and, if so, whether those
records are exempt from disclosure. We therefore leave
undisturbed the Court of Appeals’ disposition of that issue,
which was to remand to the circuit court for examination of
the tort claim notices.
Accordingly, we reverse in part and affirm in part
the decision of the Court of Appeals, we reverse the judg-
ment of the circuit court and its supplemental judgment
awarding attorney fees and costs to The Oregonian, and we
remand to the circuit court for further proceedings.
1
The OPRL is codified at ORS 192.410 to 192.505. Under ORS 192.420(1),
“[e]very person has a right to inspect any public record of a public body in this
state, except as otherwise expressly provided by ORS 192.501 to 192.505.”
Cite as 362 Or 68 (2017) 71
I. FACTS AND PROCEDURAL BACKGROUND
The Oregonian, through a reporter, made a pub-
lic records request to OHSU, based on ORS 192.420(1), in
which it sought information contained in tort claim notices
received by OHSU.2 In particular, The Oregonian’s request
sought:
“[A] list of tort claims filed against [OHSU] and its affil-
iated entities, preferably in spreadsheet form, with infor-
mation dating back [five years] and including only the fol-
lowing types of information or data fields: claim number,
claimant full name, attorney full name, date of alleged
tort, date of tort claim notice, and whether it is closed or
open. If you need to fully redact from the printout other
data fields or information not fitting the above description,
please do so.”
The Oregonian stated that it was “not requesting the text
of actual tort claim notices.” The Oregonian asserted that
it did not seek “any information generated in the course of
medical treatment,” nor was it requesting “health informa-
tion of any kind.” From The Oregonian’s previous communi-
cations with OHSU, The Oregonian understood that provid-
ing such a list from OHSU’s record database would not pose
a logistical problem.
OHSU created a record tailored to The Oregonian’s
request (the “requested record”). The requested record is
a list in which each row represents a discrete tort claim
notice and each column represents a category of infor-
mation requested by The Oregonian for each tort claim
notice. OHSU did not provide the requested record to The
Oregonian, but, instead, responded by stating that it would
comply with the public records request in part and object to
it in part, as described below.
In response, The Oregonian petitioned the
Multnomah County District Attorney, pursuant to ORS
2
As a public corporation under ORS 353.020, OHSU’s tort liability and the
limits on it are set out in the Oregon Tort Claims Act, ORS 30.260 to 30.300.
Moreover, the Oregon Tort Claims Act regulates the manner in which claims
against public bodies are prosecuted. As part of that regulation, a tort claim
notice must be given to the public body prior to the commencement of litigation,
stating the name and address of the claimant, as well as a “description of the
time, place and circumstances giving rise to the claim.” ORS 30.275.
72 OHSU v. Oregonian Publishing Co., LLC
192.450 and ORS 192.460,3 for an order directing OHSU to
disclose the requested record. OHSU responded that parts
of the requested record were exempt from disclosure. As a
visual explanation, OHSU’s response included a table that
contained rows that illustrated the types of tort claims that
OHSU had received during the specified period—including
professional liability claims, employment liability claims,
general liability claims concerning students, general liabil-
ity claims concerning patients, and other general liability
claims—and columns that contained the information spec-
ified in The Oregonian’s request. For each type of claim
and each type of information requested, OHSU indicated
in the table whether it was willing to provide that informa-
tion or not. If OHSU indicated that it would not provide the
information in the table due to a claimed exemption from
disclosure, OHSU also cited the source of that claimed
exemption.
In all, OHSU initially claimed six exemptions that,
it asserted, prohibited disclosure of parts of the requested
information, including, among others, the Health Insurance
Portability and Accountability Act (HIPAA) of 1996, 42 USC
§ 1320d to 1320d-9, and its implementing regulations known
as the Privacy Rule, 45 CFR Parts 160 and 164; several
exemptions under Oregon law; and exemptions pertaining
to education records under the Family Educational Rights
and Privacy Act (FERPA), 20 USC § 1232g.
Based on those claimed exemptions, OHSU argued
that it was precluded from disclosing claimant names,
attorney names, and dates of the alleged torts for tort claim
notices related to patients. Specifically with regard to attor-
ney names, OHSU argued that patients could be identified if
attorney names were disclosed and court filings that listed
OHSU as a defendant were searched for those attorney
names. For claims filed by students related to their educa-
tion, OHSU asserted that it could not disclose the student
3
ORS 192.450 and ORS 192.460 authorize a person who has been denied the
right to inspect or receive a copy of a public record to petition the local district
attorney or the attorney general—depending on the type of public body involved
in the public records request—to initially determine, subject to judicial review,
whether the requested public record may be withheld from disclosure.
Cite as 362 Or 68 (2017) 73
names. OHSU agreed to provide the requested information
pertaining to other liability claims.4
The district attorney ruled that the claimant
names, attorney names, and dates of the alleged torts for
all claims were not exempt from disclosure, and it directed
OHSU to disclose the entire requested record. OHSU there-
after gave notice to the district attorney of OHSU’s intent to
initiate a circuit court action. OHSU then filed this action,
seeking a declaratory judgment that the information in the
requested record that it had declined to disclose was exempt
from disclosure. The Oregonian asserted counterclaims in
which it sought injunctive relief requiring disclosure of the
entire requested record and a statutory award of attorney
fees and costs.
Before the circuit court, the parties filed cross-
motions for summary judgment. In OHSU’s motion, it
asserted, pursuant to various state and federal exemp-
tions, that it was entitled to withhold from disclosure all
the information that it had declined to disclose or, in the
alternative, some of that information.5 In support of its
motion, OHSU submitted an affidavit from its Director of
Risk Management. The director stated that she had per-
sonally examined hundreds of tort claim notices, including
many requested by The Oregonian. Based on her review
of those tort claim notices, the director averred that “tort
claim notices submitted to OHSU by patients or others and
maintained by OHSU relating to patient care always iden-
tify one or more patients.” She further stated that tort claim
notices for patient claims “includ[e] the fact that the individ-
ual received care at OHSU” and “include specific informa-
tion about the physical or mental health or psychiatric care
4
OHSU also initially declined to disclose claimant names for employment
liability claims; however, OHSU later agreed to disclose that information.
Accordingly, the issue whether claimant names pertaining to employment liabil-
ity claims are exempt from disclosure is not before us. In addition, OHSU initially
argued that all the information requested in the tort claim notices was exempt
from disclosure under ORS 192.502(21), the sensitive business records exemp-
tion. OHSU no longer makes that argument, and we therefore do not consider it.
5
In its motion for summary judgment, OHSU stated that, if the court exer-
cised its authority pursuant to ORS 192.490(1) to review the requested record
in camera, OHSU would provide the requested record for the court’s review. The
circuit court, however, did not engage in an in camera review.
74 OHSU v. Oregonian Publishing Co., LLC
or treatment of the patient.” The director continued, “Many
tort claim notices provide specific and detailed information
about the circumstances giving rise to the potential claim.”
She also stated that all tort claim notices received by OHSU
are kept in OHSU’s risk management office.
OHSU also submitted an affidavit from its Executive
Vice Provost, who stated that OHSU receives funds under
programs administered by the United States Department
of Education. He described tort claim notices received by
OHSU from students:
“Tort claim notices submitted to OHSU by OHSU students
always contain information identifying the student, such
as the student’s name, and information directly related to
the student, such as a description of the time, place and
circumstances giving rise to the claim. * * * OHSU treats
tort claim notices directly related to students as ‘education
records’ to which FERPA applies.”
In turn, The Oregonian’s motion for summary judg-
ment sought a judgment enjoining OHSU from withholding
the requested record and ordering its disclosure.
The circuit court issued a letter opinion and order
denying OHSU’s motion and granting The Oregonian’s
motion. The court ruled that the exemptions that OHSU
relied on with respect to patient claims did not apply
because disclosure of the requested record could lead to
the discovery of confidential information only if a listed
claimant was contacted and chose to divulge confidential
information. Further, the court determined that the other
exemptions that OHSU relied on were not available. The
circuit court then entered a general judgment requiring
OHSU to disclose the requested record; pursuant to ORS
192.490(3), the court also entered a supplemental judgment
for attorney fees, costs, and disbursements in favor of The
Oregonian.
OHSU appealed, arguing that the claimant names,
attorney names, and dates of the alleged torts that related
to patients were exempt from disclosure. In support of its
argument, OHSU relied on the HIPAA Privacy Rule, which
generally prohibits the disclosure of “protected health
information”; ORS 192.502(8), which exempts disclosures
Cite as 362 Or 68 (2017) 75
prohibited by federal law; ORS 192.558(1), which prohib-
its the unauthorized disclosure of protected health infor-
mation; ORS 192.502(9)(a), which exempts from disclosure
public records that are confidential; ORS 192.496(1), which
exempts certain records that contain information about the
physical or mental health or psychiatric care or treatment
of a living person if public disclosure would constitute an
unreasonable invasion of privacy; and ORS 192.502(2),
which exempts personal information if public disclosure
would constitute an unreasonable invasion of privacy. For
claims related to students, OHSU argued that the students’
names were protected under FERPA and therefore were
exempt from disclosure under ORS 192.502(8). OHSU also
argued that, if the Court of Appeals modified the judgment
ordering disclosure, an award of attorney fees would be
discretionary under ORS 192.490(3), and the supplement
judgment awarding fees should be remanded to determine
whether attorney fees should be awarded, and, if so, in what
amount.
In response, The Oregonian reiterated its position
that it was not seeking “protected health information” or edu-
cation records that are exempt from disclosure. According
to The Oregonian, if OHSU complied with its request, The
Oregonian would not receive any information regarding the
status of any claimant—including whether the claimant
was a patient or a student—or the nature or description of
any claim.
In its opinion, the Court of Appeals first noted that,
by its terms, the OPRL does not require a public body to
create new public records in response to a public records
request. OHSU v. Oregonian Publishing Co., LLC, 278 Or
App 189, 194 n 3, 373 P3d 1233 (2016). The court further
stated:
“The parties assume, as do we, that the question presented
in this case is whether the requested information (name of
claimant, date of the alleged tort, name of claimant’s attor-
ney) can be redacted from the tort claim public records that
could otherwise be provided to The Oregonian pursuant
to its demand and whether OHSU may disclose any of the
information in some of the tort claim notices. For purposes
76 OHSU v. Oregonian Publishing Co., LLC
of this case, the compilation of that information into a dif-
ferent public record does not change the issues that must
be resolved.”
Id.
In considering the application of HIPAA’s Privacy
Rule to patient claims, the Court of Appeals assumed for
the sake of its decision that the patients’ names, names of
the patients’ attorneys, and the dates of the alleged torts
in the tort claim notices constituted “protected health
information.” Id. at 201. The court noted, though, that the
Privacy Rule allows disclosure of protected health infor-
mation when disclosure is “required by law.” Id. (citing 45
CFR § 164.512(a)(1)). The court then concluded that, if the
requested record was not exempt from disclosure under
the OPRL, its disclosure would be “required by” the OPRL
and, therefore, allowed by the Privacy Rule. Id. at 202.
The court further reasoned that, if disclosure of protected
health information is allowed by the Privacy Rule because
it is otherwise “required by” the OPRL, then disclosure
is not “prohibited by federal law” under ORS 192.502(8).
Id. Because it concluded that the Privacy Rule and ORS
192.502(8) did not prohibit disclosure of the protected
health information in the tort claim notices, the Court of
Appeals opined that whether disclosure was prohibited
depended on whether an exemption from disclosure existed
under the OPRL for information about the physical or
mental health or psychiatric care or treatment of a living
individual, ORS 192.496(1), or personal information, ORS
192.502(2). Id.
Turning to the exemption in ORS 192.496(1),
the Court of Appeals explained that the determination
whether the requested record contained information about
the physical or mental health or psychiatric care or treat-
ment of a living individual and, if so, whether its disclo-
sure would constitute an unreasonable invasion of patient
privacy, necessarily would require examination of the
information contained in the tort claim notices. Id. at 206.
The court concluded that the circuit court had failed to
apply ORS 192.496(1) correctly; instead, the circuit court
had applied ORS 192.505—directing redacted disclosure
Cite as 362 Or 68 (2017) 77
in certain circumstances6 —and it had ordered OHSU to
disclose the nonexempt material. Id. at 204. In the Court
of Appeals’ view, ORS 192.505 does not apply to a claimed
exemption under ORS 192.496(1) because, on its face, ORS
192.505 applies only to records that contain both exempt
and nonexempt material under ORS 192.501 and 192.502,
and the record created by OHSU contains only nonexempt
material.7 Id. The Court of Appeals concluded that ORS
192.505 does not apply to exemptions that classify an
entire record as exempt from disclosure; rather, it applies
only to public record exemptions that classify information
in a record as exempt from disclosure. Id. at 205 (emphasis
in original). Because the circuit court had applied ORS
192.505 without reviewing the requested record to deter-
mine whether it was exempt from disclosure under ORS
192.496(1), the Court of Appeals concluded that the circuit
court had erred in granting The Oregonian’s motion for
summary judgment.8 Id. at 206. Accordingly, the Court of
Appeals reversed and remanded with regard to the patient
claims.
Similarly, the Court of Appeals concluded that, to
determine whether FERPA and ORS 192.502(8) prohib-
ited the disclosure of claimants’ names for student-related
claims, the circuit court was required to examine the tort
claim notices involving students to determine whether they
described and directly related to activities of a student or
the educational status of a student. Id. at 210-11. Because
the circuit court had not reviewed the tort claim notices, the
6
ORS 192.505 provides:
“If any public record contains material which is not exempt under ORS
192.501 and 192.502, as well as material which is exempt from disclosure,
the public body shall separate the exempt and nonexempt material and make
the nonexempt material available for examination.”
7
ORS 192.501 provides that certain public records, including trade secrets,
investigatory information compiled for criminal law purposes, and a personnel
discipline action and associated materials, as well as others, are exempt from dis-
closure unless the public interest requires disclosure in the particular instance.
ORS 192.502 exempts from disclosure public records made confidential under
Oregon law, the addresses of certain state employees and retirees, and other enu-
merated records.
8
In light of its resolution of the claimed exemption under ORS 192.496(1),
the Court of Appeals did not consider the personal information exemption under
ORS 192.502(2). OHSU, 278 Or App at 206.
78 OHSU v. Oregonian Publishing Co., LLC
Court of Appeals reversed and remanded with respect to the
student claims as well.9
We allowed review primarily to determine whether
the names of the claimants and their attorneys, and the
dates of the alleged torts, are exempt from disclosure as
(1) “protected health information” under HIPAA (and thus
unconditionally exempt from disclosure pursuant to ORS
192.502(8)); (2) protected health information that is con-
fidential under ORS 192.558(1) (and consequently exempt
from disclosure under ORS 192.502(9)(a)); (3) information
about the physical or mental health or psychiatric care or
treatment of a living individual that is exempt from dis-
closure under ORS 192.496(1); or (4) information of a per-
sonal nature that is exempt from disclosure under ORS
192.502(2).10 As noted, The Oregonian does not seek unre-
dacted copies of the tort claim notices themselves or specific
information about claimants’ health conditions, treatments,
or diagnoses.
II. ANALYSIS
A. Standard of Review
On review of cross-motions for summary judgment,
we determine whether there are any disputed issues of mate-
rial fact and whether either party is entitled to judgment as
a matter of law. ORCP 47. We state the facts in the light
90
The Court of Appeals also reversed the supplemental judgment awarding
fees to The Oregonian on the ground that, on remand, The Oregonian may not be
entitled to those fees as a matter of right. Id. at 211 (citing ORS 192.490(3)).
10
After we allowed review, OHSU provided a spreadsheet to The Oregonian
that contained the requested information for which it did not claim an exemp-
tion, but with the information still at issue on review redacted pursuant to ORS
192.505. Specifically, for patient claims, the spreadsheet included the claim num-
ber, date of tort claim notice, and indicated whether the claim is open or closed.
For student claims, OHSU provided all the requested information except the
claimant name. For all other claims, the spreadsheet provided all the requested
information. The Oregonian rejected the spreadsheet on the ground that it did
not comply with the public records request that The Oregonian had made. In its
brief before this court, OHSU argues that, because the spreadsheet contains the
requested information for all claims other than patient claims and student claims,
The Oregonian no longer has any basis to argue that patient names cannot be dif-
ferentiated from other claimant names. At oral argument, The Oregonian argued
that, by submitting the spreadsheet, OHSU had strategically attempted to alter
the record in this case. Because of our disposition of the case, we do not address
that procedural issue.
Cite as 362 Or 68 (2017) 79
most favorable to the party against whom summary judg-
ment was granted—in this case, OHSU. See Double Eagle
Golf, Inc. v. City of Portland, 322 Or 604, 606, 910 P2d 1104
(1996).
B. Overview
As noted, ORS 192.420(1) provides that “[e]very
person has a right to inspect any public record of a public
body in this state, except as otherwise expressly provided by
ORS 192.501 to 192.505.” A public record “includes any writ-
ing that contains information relating to the conduct of the
public’s business * * * prepared, owned, used or retained by
a public body regardless of physical form or characteristics.”
ORS 192.410(4)(a).11 Generally, disclosure of public records
is the presumption, and exemptions from disclosure are
narrowly construed and made on an individualized basis.
Guard Publishing Co. v. Lane County School Dist. No. 4J,
310 Or 32, 37, 791 P2d 854 (1990). The public body or agency
withholding a record has the burden “to sustain its action.”
ORS 192.490(1).
C. Patient Claims
As noted, OHSU asserts that the claimant names,
attorney names, and dates of the alleged torts for patient
claims are “protected health information” that is shielded
from disclosure by both HIPAA and exemptions under
Oregon law. In contrast, The Oregonian has not addressed
any of the exemptions from disclosure under Oregon law
on which OHSU relies. Instead, The Oregonian primarily
has staked its position on the threshold proposition that
the requested record does not contain any protected health
information under HIPAA and, therefore, its disclosure is
required by ORS 192.420(1).12 The Oregonian asserts that
11
The 2017 Legislative Assembly renumbered subsection (4)(a) to subsection
(5)(a), effective January 1, 2018. Or Laws 2017, ch 456.
12
At oral argument, The Oregonian appeared to concede that, if the
requested record indicated that the claimants were patients, HIPPA’s protections
would be invoked. However, although The Oregonian asserts that the disposi-
tive issue is whether the requested record contains protected health information
under HIPAA, it also has generally adopted the Court of Appeals’ conclusion that,
even if the requested record contains protected health information under HIPAA,
its disclosure is not prohibited because of HIPAA’s “required by law” exemption,
45 CFR § 164.512(a)(1).
80 OHSU v. Oregonian Publishing Co., LLC
the Court of Appeals incorrectly determined that the tort
claim notices themselves were the public records at issue
instead of the requested record—a list that The Oregonian
argues is a different public record. The Oregonian argues
that its instructions to OHSU were to make sufficient redac-
tions from the tort claim notices such that the requested
record would not contain protected health information.
According to The Oregonian, providing claimant names,
attorney names, and dates of alleged torts would not iden-
tify any claimant as a patient or disclose any health infor-
mation that could implicate HIPAA’s protections.
As we now explain, we conclude that, in combination,
the requested record contained identifiers—including claim-
ant and attorney names, and dates of the alleged torts—that
constitute protected health information under HIPAA that
cannot be disclosed unless an exemption applies. Although
an exemption exists under HIPAA for disclosures “required
by law,” disclosure of the protected health information at
issue here is not required under ORS 192.420(1), the provi-
sion on which The Oregonian relies, because the unautho-
rized disclosure of protected health information is restricted
by ORS 192.558(1). Therefore, protected health information
is exempt from disclosure under ORS 192.502(9)(a). It fol-
lows that OHSU is not required to disclose claimant names,
attorney names, and dates of the alleged torts for patient
claims.
1. Is the information at issue protected health
information?
We begin our analysis with the question whether
the information at issue constitutes protected health infor-
mation under HIPAA. Congress enacted HIPAA to “improve
the efficiency and effectiveness of the health care system
by facilitating the electronic exchange of information with
respect to financial and administrative transactions car-
ried out by health plans, health care clearinghouses, and
health care providers.” Standards for Privacy of Individually
Identifiable Health Information, 67 Fed Reg 14776-01,
14776 (Mar 27, 2002). In addition, HIPAA protects the pri-
vacy and confidentiality of health information. See 42 USC
§ 1320d-2. To advance those protections, Congress directed
Cite as 362 Or 68 (2017) 81
the Secretary of Health and Human Services to establish
regulations for implementing each of the standards adopted
by HIPAA. 42 USC § 1320d-1(d). The regulations that the
Secretary adopted relating to the electronic exchange of
health information and providing for the security and confi-
dentiality of those exchanges are known as the Privacy Rule.
See 45 CFR Parts 160 and 164. While HIPAA established
that disclosure of a person’s health information is a federal
offense, 42 USC § 1320d-6, the Privacy Rule described the
specific circumstances under which disclosure is permitted
and prohibited.
The Privacy Rule is animated by three major
purposes:
“(1) To protect and enhance the rights of consumers
by providing them access to their health information and
controlling the inappropriate use of that information;
(2) to improve the quality of health care in the U.S. by
restoring trust in the health care system among con-
sumers, health care professionals, and the multitude of
organizations and individuals committed to the delivery
of care; and (3) to improve the efficiency and effectiveness
of health care delivery by creating a national framework
for health privacy protection that builds on efforts by
states, health systems, and individual organizations and
individuals.”
Standards for Privacy of Individually Identifiable Health
Information, 65 Fed Reg 82462-01, 82463 (Dec 28, 2000).
In recognition that state laws concerning the confidentiality
and privacy of health information are not uniform or con-
sistent, the Privacy Rule established “a set of basic national
privacy standards” to provide “all Americans with a basic
level of protection.” Id. at 82464. The Privacy Rule sets a
ground floor of rules for health care providers, creating “a
framework of protection that can be strengthened by both
the federal government and by states as health information
systems continue to evolve.” Id.
Under HIPAA and the Privacy Rule, “protected
health information” is “individually identifiable health infor-
mation” that is transmitted or maintained in any form or
medium. 45 CFR § 160.103. “Individually identifiable health
82 OHSU v. Oregonian Publishing Co., LLC
information” is health information, including demographic
information, that:
“(1) Is created or received by a health care provider,
health plan, employer, or health care clearinghouse; and
“(2) Relates to the past, present, or future physical or
mental health or condition of an individual; the provision of
health care to an individual; or the past, present, or future
payment for the provision of health care to an individual;
and
“(i) That identifies the individual; or
“(ii) With respect to which there is a reasonable basis
to believe the information can be used to identify the
individual.”
Id. A covered entity may determine that health informa-
tion is not individually identifiable health information if
the name, address, all elements of dates, and certain other
identifiers relating to an individual are removed. 45 CFR
§ 164.514(b)(2)(i).
In light of those provisions, we conclude that the
requested record contains “protected health information”
under HIPAA and the Privacy Rule.13 In the absence of a
patient’s written authorization or a permissible purpose, the
disclosure of a patient’s name or the fact that she received
health services is prohibited under HIPAA and the Privacy
Rule. Breach Notification for Unsecured Protected Health
Information, 74 Fed Reg 42740-01, 42745 (Aug 24, 2009).
For such protected health information to lose HIPAA con-
fidentiality protections, HIPAA provides that 19 separate
identifiers must all be removed, including the very informa-
tion requested by The Oregonian here: patient names, all
elements of dates, and any other information that could be
used alone or in combination with other information to iden-
tify an individual as a patient. 45 CFR § 164.514(b)(2)(i).14
13
As noted, the definition of “individually identifiable health information”
is part of the definition of “protected health information.” For ease of reference,
and because “protected health information” is “individually identifiable health
information” that is transmitted or maintained in any form or medium, we refer
to “protected health information” from this point forward.
14
Indeed, under the Privacy Rule, a hospital must inform patients of the pro-
tected health information that may be included in a patient directory, including
Cite as 362 Or 68 (2017) 83
As noted above, The Oregonian remonstrates that
the requested record is a different public record from the
tort claim notices themselves and that, under its instruc-
tions to OHSU, sufficient information was redacted from the
tort claim notices such that the requested record would not
contain protected health information. The difficulty with
The Oregonian’s position is that, regardless of the form in
which the information that it sought was presented, that
information was not sufficiently redacted in the requested
record to lose its status as protected health information.15
Although The Oregonian instructed OHSU to
redact any unrequested information contained in the tort
claim notices in producing the requested record, it still would
have been a relatively straightforward exercise for it to
discern—from the requested information in combination—
which of the claimants were health care patients, the fact
that they had received treatment, and the dates of their
treatment. In short, the patient identifiers would not be suf-
ficiently obscured as undifferentiated data in the requested
record to satisfy the privacy interests in protected health
information with which HIPAA and the Privacy Rule are
concerned. Nothing in HIPAA or the Privacy Rule indicates
that the creation by redaction of a document that still con-
tains such identifiers can somehow alter their status as pro-
tected health information. Accordingly, we conclude that
the requested record contains protected health information
under HIPAA.16
The question remains whether, despite its status as
protected health information, ORS 192.420(1) nonetheless
the patient’s name, and the persons to whom that information may be disclosed—
only clergy members and persons who specifically ask for the patient by name—
and provide the patient with the opportunity to prohibit or restrict such disclo-
sure. 45 CFR § 164.510(a).
15
The Oregonian has consistently pointed out that it has not sought the tort
claim notices themselves. But, as the Court of Appeals observed, “[f]or purposes
of this case, the compilation of [the information that The Oregonian seeks] into a
different public record does not change the issues that must be resolved.” OHSU,
278 Or App at 194 n 3.
16
Because The Oregonian has not separately analyzed the categories of
information that it requested in terms of whether those categories independently
qualify as protected health information, it is sufficient for us to conclude that,
in combination, the information contained in the requested record constitutes
protected health information.
84 OHSU v. Oregonian Publishing Co., LLC
requires the disclosure of that information. Although we
ultimately conclude that its disclosure is not required under
that statute, we first discuss the parties’ arguments under
HIPAA, which will provide a foundation for our discussion
of Oregon law.
2. Prohibited disclosure under HIPAA and the “required
by law” exception
The Privacy Rule defines “disclosure” as “the
release, transfer, provision of access to, or divulging in
any manner of information outside the entity holding the
information.” 45 CFR § 160.103. A “covered entity” is pro-
hibited from disclosing protected health information unless
an exception applies.17 45 CFR § 164.502(a). Exceptions
include disclosure to the patient, disclosure with the
patient’s authorization, and disclosure when the protected
health information has been “de-identified,” among others.
See, e.g., 45 CFR § 164.502(a)(1)(i); 45 CFR § 164.508; 45
CFR § 164.502(d)(2).
As discussed, in concluding that disclosure of
the disputed information could be required, the Court of
Appeals relied on a HIPAA exception that allows a covered
entity to “use or disclose protected health information to
the extent that such use or disclosure is required by law
and the use or disclosure complies with and is limited to the
relevant requirements of such law.” 45 CFR § 164.512(a)(1).
“Required by law” refers to “a mandate contained in law
that compels an entity to make a use or disclosure of pro-
tected health information and that is enforceable in a court
of law” and includes “statutes or regulations that require
the production of information.” 45 CFR § 164.103.
The question then is whether the OPRL—in par-
ticular, ORS 192.420(1), the sole provision on which The
Oregonian relies—“requires” disclosure of the protected
health information at issue here. As amplified below, we
conclude that ORS 192.420(1) does not require disclosure
of the protected health information; to the contrary, we con-
clude that, in the absence of a law requiring its disclosure,
such disclosure is prohibited under Oregon law. To ground
17
The parties agree that OHSU is a covered entity.
Cite as 362 Or 68 (2017) 85
our discussion, we briefly explain HIPAA’s relationship to
state laws such as ORS 192.420(1) that generally require
the inspection of public records.
Where a conflict between HIPAA and state law
exists, HIPAA’s provisions “shall supersede any contrary
provision of State law.” 42 USC § 1320d-7(a). State laws that
provide “more stringent” privacy protections than HIPAA
affords are not superseded by HIPAA. 45 CFR § 160.203(b).
A state law is “contrary” to HIPAA and, thus, superseded by
HIPAA, if:
“(1) A covered entity or business associate would find
it impossible to comply with both the State and Federal
requirements; or
“(2) The provision of State law stands as an obstacle to
the accomplishment and execution of the full purposes and
objectives of [HIPAA].”
45 CFR § 160.202.
As noted, the Privacy Rule permits disclosure
of protected health information where such disclosure is
required by law. 45 CFR § 164.512(a)(1). The commentary
to the Privacy Rule states that many apparent conflicts
between HIPAA and other laws will not be true conflicts
because of the “required by law” exception. Standards for
Privacy of Individually Identifiable Health Information,
65 Fed Reg at 82481-82. As an example of the interaction
between HIPAA and other laws requiring disclosure of pro-
tected health information, the commentary states that the
Freedom of Information Act (FOIA), 5 USC § 552, provides
for public disclosure—upon the request of any person—of
many types of information possessed by the federal govern-
ment, subject to certain exceptions and exemptions. The
Privacy Rule commentary states that uses and disclosures
of protected health information required by FOIA fall within
the “required by law” exception. Standards for Privacy of
Individually Identifiable Health Information, 65 Fed Reg at
82482. The commentary further states that, in responding
to a FOIA request that includes protected health informa-
tion, a federal agency, when appropriate, must apply FOIA’s
Exemption 6, which “permits federal agencies to withhold
86 OHSU v. Oregonian Publishing Co., LLC
‘* * * medical files and similar files the disclosure of which
would constitute a clearly unwarranted invasion of personal
privacy.’ ” Id. (quoting 5 USC § 522(b)(6)). The commentary
ultimately observes: “We believe that generally a disclo-
sure of protected health information, when requested under
FOIA, would come within FOIA Exemption 6.” Id.
Following the guidance provided in the Privacy
Rule commentary, a covered entity responding to a public
records request often could comply with both HIPAA and
a law requiring disclosure of public records. In particu-
lar, under HIPAA’s “required by law” exception, a covered
entity might be required by a law such as ORS 192.420(1)
to disclose protected health information, thus complying
with both laws. However, if an exemption or exception to a
law such as ORS 192.420(1) exists, the covered entity must
consider that exemption or exception as part of its deter-
mination whether disclosure is required by law. See U.S.
Dep’t of Health & Human Services, FAQ (Aug 2004), avail-
able at https://www.hhs.gov/hipaa/for-professionals/faq/506/
how-does-the-hipaa-rule-relate-to-freedom-of-information-
laws/index.html (accessed Oct 10, 2017) (“For example, if a
state public records law includes an exemption that affords
a state agency discretion not to disclose medical or other
information where such disclosure would constitute a clearly
unwarranted invasion of personal privacy, the disclosure of
such records is not required by the public records law, and
therefore is not permissible under § 164.512(a).”).
In short, although particular circumstances could
require a different outcome, it generally is possible for a cov-
ered entity to comply both with HIPAA and a state law such
as ORS 192.420(1), after considering any applicable exemp-
tions or exceptions from disclosure under such a law. See
generally Abbott v. Texas Dept. of Mental Health & Mental
Retardation, 212 SW3d 648, 665 (Tex Ct App 2006) (state
public records law not superseded, because state agency
could comply with both state public records law and Privacy
Rule, as Privacy Rule allows disclosure of information at
issue under “required by law” exception). Accordingly, we
must determine whether Oregon law exempts the protected
health information at issue from disclosure under ORS
192.420(1).
Cite as 362 Or 68 (2017) 87
3. Exemption from disclosure of protected health infor-
mation under Oregon law
As noted, a right to inspect public records is the rule
in Oregon, unless an exemption applies. See ORS 192.420(1)
(“Every person has a right to inspect any public record of
a public body in this state, except as otherwise expressly
provided by ORS 192.501 to 192.505.”). As we now explain,
we conclude that the protected health information at issue
is exempt from disclosure under ORS 192.502(9)(a) and that
its disclosure therefore is not “required” by ORS 192.420(1).
ORS 192.502(9)(a) exempts from disclosure under
ORS 192.410 to 192.505 “[p]ublic records or information
the disclosure of which is prohibited or restricted or other-
wise made confidential or privileged under Oregon law.”
ORS 192.553 to 192.581 does just that. It makes “protected
health information” confidential. ORS 192.553 provides, in
part:
“(1) It is the policy of the State of Oregon that an indi-
vidual has:
“(a) The right to have protected health informa-
tion of the individual safeguarded from unlawful use or
disclosure[.]”
“Protected health information” is defined by ORS 192.556
(11)(a) to mean:
“[I]ndividually identifiable health information that
is maintained or transmitted in any form of electronic or
other medium by a covered entity.”
ORS 192.556(8) defines “Individually identifiable health
information” as:
“any oral or written health information in any form or
medium that is:
“(a) Created or received by a covered entity * * *; and
“(b) Identifiable to an individual, including demo-
graphic information that identifies the individual, or for
which there is a reasonable basis to believe the information
can be used to identify an individual, and that relates to:
“(A) The past, present or future physical or mental
health or condition of an individual; [or]
88 OHSU v. Oregonian Publishing Co., LLC
“(B) The provision of health care to an individual[.]”
Those definitions are substantively comparable to the defi-
nitions of “protected health information” and “individu-
ally identifiable health information” under HIPAA and the
Privacy Rule, and The Oregonian does not contend other-
wise.18 Based on our analysis under HIPAA, we therefore
conclude that the information at issue here also is “protected
health information” for purposes of ORS 192.556(11)(a).
ORS 192.558(1) generally permits the disclosure of
a person’s protected health information only “in a manner
that is consistent with an authorization provided by the indi-
vidual or a personal representative of the individual.”19 The
OPRL reinforces the prohibition against unauthorized dis-
closure of protected health information in ORS 192.558(1)
by providing an unconditional exemption for information
protected by state law. In particular, ORS 192.502(9)(a)
provides that “[p]ublic records or information the disclosure
of which is prohibited or restricted or otherwise made con-
fidential or privileged under Oregon law,” are exempt from
disclosure under the OPRL.
The legislative history of ORS 192.553 to ORS
192.558 is consistent with the foregoing analysis.20 Before
those provisions were enacted in 2003, Oregon law provided:
“[I]t is the policy of the State of Oregon to protect both
the rights of an individual to have the medical history of
the individual protected from disclosure to persons other
18
In symmetry with HIPAA, ORS 192.553(2) provides that,
“[i]n addition to the rights and obligations expressed in ORS 192.553 to
192.581, [HIPAA] establish[es] additional rights and obligations regarding
the use and disclosure of protected health information and the rights of indi-
viduals regarding the protected health information of the individual.”
(Emphases added.)
19
ORS 192.558(2)(a) and (3) contain specific exceptions to the prohibition
in ORS 192.558(1) against unauthorized disclosures of protected health infor-
mation. Specifically, ORS 192.558(2)(a) allows disclosure “[f]or the provider’s
or plan’s own treatment, payment or health care operations.” In addition, ORS
192.558(2)(b) allows disclosure “[a]s otherwise permitted or required by state or
federal law or by order of the court.” The Oregonian does not assert that any of
those exceptions apply in this instance and therefore we need not address them.
20
ORS 192.553 to 192.558 were enacted by Oregon Laws 2003, chapter 86,
sections 1 to 3, and codified as former ORS 192.518 to 192.520 (2003). The stat-
utes were renumbered in 2011.
Cite as 362 Or 68 (2017) 89
than the health care provider and insurer of the individual
who needs such information * * *. It is recognized that both
rights may be limited, but only to benefit the patient. These
rights of confidentiality and full access must be protected
by private and public institutions providing health care
services * * *. The State of Oregon commits itself to fulfill-
ing the objectives of this public policy for public providers
of health care.”
Former ORS 192.525(1) (2001), repealed by Or Laws 2003,
ch 86, § 8. The proponents of the 2003 legislation were
members of an interim legislative committee that had been
tasked with reviewing (and revising as appropriate) Oregon
privacy laws to ensure their consistency with federal law
before the effective date of HIPAA in 2003. The commit-
tee members emphasized that the intent of the legislation
was to maintain the existing policy of protecting the confi-
dentiality of patient medical records set out in former ORS
192.525 (2001), while harmonizing Oregon’s statutory pol-
icy and terminology with HIPAA. As Representative Max
Williams explained on the House floor:
“The HIPAA privacy regulations provide new protection
for the use and disclosure of patient health information by
health care providers and insurers. They also enact addi-
tional patient rights regarding access to information about
their health care and their health information. HIPAA
regulations are extensive and complex. And they preempt
Oregon law to the extent that Oregon law is contrary to the
federal law. It is this preemption issue that brings HB 2305
before you today. HB 2305 is the product of the advisory
committee on privacy of medical information and records.
A committee that was created by the 2001 Legislative
Assembly * * *.
“It was the goal of the committee to change only those
Oregon statutes that must be changed in light of HIPAA
and to preserve existing Oregon public policy as much as
possible. * * * HB 2305 repeals ORS 192.525 and replaces
it with new provisions that reflect existing Oregon policy
and the new HIPAA privacy regulations. ORS 192.525 is
the core confidentiality statute in Oregon for health care
providers. It governs what disclosure providers can make of
health information. Unfortunately, HIPAA contradicts the
current ORS 192.525. The Oregon law uses terms that do
not make sense after the enactment of HIPAA and contains
90 OHSU v. Oregonian Publishing Co., LLC
an authorization form that does not comply with specific
HIPAA authorization requirements. Because of these prob-
lems, the committee concluded that ORS 192.525 should be
repealed. However, to avoid a vacuum in Oregon medical
confidentiality law, the committee recommended replace-
ment of 192.525 with a new provision intended to serve
much the same purpose as the original statute but in con-
formity with HIPAA. The new statute draws on an existing
policy and the HIPAA privacy regulations to create a new
core patient confidentiality law in Oregon.”
Audio Recording, House Chamber, HB 2305, Mar 17,
2003, at 27:42 (statement of Rep Max Williams), https://
www.oregonlegislature.gov/citizen_engagement /Pages/
Legislative-Video.aspx (accessed Oct 10, 2017).
Other statements made by interim committee mem-
bers reinforced Representative Williams’ comments, includ-
ing those of former Senator Neil Bryant:
“The [interim committee] focused on the privacy aspects
of HIPAA. As many of you know, Oregon has a long his-
tory of protecting privacy and personal information, but we
wanted to ensure that Oregon law would not conflict or be
preempted by federal law and the HIPAA rules.”
Testimony, House Judiciary Committee, HB 2305, Feb 18,
2003, Ex A (statement of former Sen Neil Bryant).21
21
Gwen Dayton, an interim committee member, similarly commented:
“Essentially when we looked for HIPAA preemption, we looked for Oregon
laws that implicated the release of protected health information in a way that
was * * * contrary to HIPAA, meaning that providers and other entities cov-
ered by HIPAA would not be able to comply with both state law and federal
law or state law posed a substantial barrier or obstacle to effective implemen-
tation of HIPAA. * * *
“The guts of ORS 192.525 is really sub-one, which is a policy statement
about confidentiality of medical records in Oregon. And that section is not
completely preempted, but rather it uses terms that are inconsistent with
HIPAA, that are confusing after implementation of HIPAA, that simply just
don’t make a lot of sense. And there are certain provisions that are flat out
contrary to HIPAA. As you go through the rest of 192.525, you have similar
problems. Confusing use of terminology. The model authorization form that
is contained in the existing statute simply does not comply with HIPAA. * * *
There are other sub-sections of the statute that are preempted because they
refer to this inappropriate authorization form. Others have problems simply
because of the continuing confusing use of terms that just don’t make a lot of
sense.
“So those of us who looked at this statute felt that there was enough
of it that could not be saved that a more effective way of dealing with it
Cite as 362 Or 68 (2017) 91
Considering that ORS 192.502(9) exempted infor-
mation protected as confidential under state law from dis-
closure under the OPRL before the enactment of the 2003
legislation, it is likely that HB 2305—with its stated intent
to maintain the confidentiality of protected health informa-
tion with the additional protections of HIPAA—retained the
confidentiality protections for such information that exempt
it from the disclosure requirement set out in ORS 192.420(1).
In sum, we conclude that ORS 192.556(11)(a) des-
ignates the information at issue here as protected health
information, and, subject to certain exceptions that do not
apply here, ORS 192.558(1) prohibits its disclosure with-
out a patient’s written authorization. ORS 192.502(9)(a),
in turn, exempts that information from disclosure under
ORS 192.420(1) because its disclosure is restricted by ORS
192.558(1).22
D. Student Claims
We briefly turn to the claims filed by students. As
noted, OHSU declined to disclose the names of student
claimants in tort claim notices related to their education,
would be to simply repeal it and rewrite it. We want to maintain the effect
of 192.525. We don’t want to leave a vacuum in Oregon law, but we want to
replace it with something that does what 192.525 did but also implements
HIPAA at the same time. * * * [W]e considered many options in replacing
192.525. Some states have actually rewritten HIPAA into state law—hook,
line, and sinker. We considered that and decided against it because we were
concerned that if we didn’t get every comma correct—every word correct—
there would be an implied difference and we would be setting ourselves up
for endless litigation about what we were trying to do in Oregon versus what
the feds were doing.”
Audio Recording, House Judiciary Committee, HB 2305, Feb 18, 2003, at
17:12 (statement of Gwen Dayton), https://www.oregonlegislature.gov/citizen_
engagement/Pages/Legislative-Video.aspx (accessed Oct 10, 2017).
22
In so concluding, we need not consider whether, in different circumstances,
a provision of law other than ORS 192.420(1) could require the disclosure of
protected health information. Further, in light of our resolution of the patient
records issue, we also need not consider the additional arguments of the parties—
and amicus curiae, the State of Oregon, through the attorney general’s—
regarding the patient claims, including whether the information at issue is
exempt from disclosure under ORS 192.502(2) or ORS 192.496(1), and whether
the Court of Appeals erred by holding that ORS 192.505 does not apply to ORS
192.496(1); that ORS 192.505 applies only to exemptions that classify informa-
tion within a record as exempt, rather than to exemptions that classify an entire
record as exempt; and that ORS 192.496(1) is an exemption to the disclosure
requirements of the OPRL.
92 OHSU v. Oregonian Publishing Co., LLC
asserting that disclosure of that information was prohib-
ited under FERPA and state law. The Oregonian, however,
argues that the requested record would not identify any
claimant as a student or disclose any student education
records that would implicate FERPA. The Oregonian also
asserts, albeit with scant citation to authority, that a tort
claim notice is not an “education record” and that its dis-
closure is not prohibited in this case because the requested
information is not maintained or located in a place that is a
repository of education records. Accordingly, The Oregonian
argues that the exemption under ORS 192.502(8) for disclo-
sure prohibited by federal law does not apply.
OHSU counters that disclosure of a student’s name,
particularly in the context of a tort claim notice, would con-
vey significant information about the student: namely, that
the student has claimed a compensable injury related to their
education. That information, OHSU argues, is protected
by FERPA’s prohibition against disclosing private records
directly related to a student. Moreover, OHSU asserts,
FERPA does not prescribe any specific location within an
institution where a record must be maintained for it to be
deemed an “education record.”
Although, on the surface, the parties’ arguments
would appear to present significant issues under FERPA,
we conclude that those arguments are not sufficiently devel-
oped for this court to make an informed decision. In par-
ticular, although The Oregonian asserts that disclosure of
education records is not prohibited by FERPA, it has not
analyzed the issue in any detail.23 Nor has The Oregonian
meaningfully addressed FERPA’s definition of “education
records.” Overall, both parties’ arguments about the stu-
dent records are cursory, consisting of a combined total of
only six paragraphs in more than 80 pages of briefing. In
short, in the absence of adequately developed arguments,
we decline to consider whether the tort claim notices filed
by students are “education records” under FERPA and pro-
hibited from disclosure. We therefore leave undisturbed the
23
A brief review discloses that “state and federal courts are sharply divided
on this issue.” See Caledonian-Record Publ’g Co. v. Vt. State Coll., 175 Vt 438,
441-42, 833 A2d 1273, 1275-76 (2003) (citing cases). The parties have failed to
discuss those authorities.
Cite as 362 Or 68 (2017) 93
Court of Appeals’ disposition of that issue which, to reiter-
ate, was to remand it to the circuit court to examine the tort
claim notices involving students to determine whether they
described and directly related to activities of a student or
the educational status of a student. OHSU, 278 Or App at
210-11.
III. CONCLUSION
To summarize: The Oregonian’s public records
request sought information derived from tort claim notices
received by OHSU. For patient claims, the requested record
contained identifiers—including claimant and attorney
names, and dates of the alleged torts—that, in combination,
constitute protected health information under HIPAA that
cannot be disclosed unless an exemption applies. An exemp-
tion exists under HIPAA for disclosures “required by law.”
However, disclosure of the protected health information at
issue in this case is not required under ORS 192.420(1),
the provision on which The Oregonian relies, because ORS
192.558(1) restricts its unauthorized disclosure. Therefore,
it is exempt under ORS 192.502(9)(a) from disclosure pursu-
ant to ORS 192.420(1). It follows that OHSU is not required
to disclose claimant names, attorney names, and dates of
the alleged torts for patient claims.
With respect to the student claims, the parties
have not adequately developed their arguments concern-
ing whether the tort claim notices are “education records”
under FERPA, and, if they are, whether FERPA prohibits
disclosure of the claimants’ names. Accordingly, we decline
to address that issue.
The decision of the Court of Appeals is reversed in
part and affirmed in part. The judgment of the circuit court
and the supplemental judgment awarding attorney fees
and costs to The Oregonian are reversed, and the case is
remanded to the circuit court for further proceedings.