Date:
05/16/2019
Subject:
Patricia Huseman/University of Iowa - Probable Cause Report and Order
Opinion:
Before The Iowa Public Information Board
|
In the Matter of: Patricia Husemann, Complainant. and Concerning: University of Iowa, Respondent |
Case Number: 18FC:0075 Probable Cause Report
|
SUMMARY: Upon further review and investigation, the undersigned recommends dismissal of the complaint for lack of probable cause.
A. Background Facts
Patricia Husemann has filed two formal complaints with the Iowa Public Information Board (IPIB). She filed her first complaint 18FC:0046 on June 18, 2018. Ms. Husemann alleged that she made two (2) separate public records requests to the University. The first one occurred on April 30, 2018, when she sought various emails. The second records request occurred on May 24, 2018, when she sought additional electronic communication records. After Ms. Husemann filed her first complaint, the University produced some of the requested records on July 11, 2018. Because Ms. Husemann received her records, the IPIB dismissed her first complaint on July 19, 2018.
She alleged that she learned from University officials that on July 16, 2018, they declined to produce many of the emails she originally requested on April 30, 2018, and May 24, 2018.
Ms. Husemann’s original Chapter 22 request dated April 30, 2018, requested emails to certain individuals. The email request included everything sent containing certain key words to and from those individuals between the dates of January 1, 2017, through April 30, 2018.
Ms. Husemann’s second Chapter 22 request dated May 21, 2018, included emails to and from two specific individuals with key words from January 1, 2017 through May 21, 2018.
The University cited various confidentiality exceptions in withholding the records. The university said in an email dated July 16, 2018, that some of withheld records included student records. Identifiable student information which would qualify as confidential under Iowa Code § 22.7 (1) or the Federal Educational Rights Privacy Act (FERPA). The university also said it withheld emails pursuant to Iowa Code § 22.7 (2) (Patient medical records), Iowa Code § 22.7 (11) (confidential personnel records), and Iowa Code § 22.7 (18) (voluntary communications from persons outside the government with useful information).
On September 12, 2018, Ms. Husemann filed this complaint with the Iowa Public Information Board. The second complaint, 18FC:0075 was based on her new knowledge that the University actually withheld some of the emails. Ms. Husemann learned the University withheld emails on July 16, 2018.
Nathan Levin, from the University Legal Department responded to the complaint on October 9, 2018. In addition to the same arguments raised, Mr. Levin cited the Frequently Asked Questions (FAQs) from the IPIB website about public emails on private devices. However, Mr. Levin failed to describe the emails in any sufficient detail for IPIB to evaluate whether the exceptions raised had objective justification.
The Iowa Public Information Board accepted Ms. Husemann’s second complaint against the University of Iowa on October 18, 2018.
Pursuant to Iowa Code § 23.9, the IPIB attempted to achieve an informal resolution. However, those efforts failed.
The undersigned began a probable cause investigation on February 5, 2019.
The undersigned on February 5, 2019, requested that the University provide the disputed emails in question to the IPIB staff. Then under the protection of Iowa Code § 23.6 (6), the IPIB staff evaluated whether the emails constituted confidential information, without making those emails public.
The University of Iowa’s General Counsel, Nathan Levin, provided the confidential emails in question on April 23, 2019.
- Steps Taken in Investigation
In investigating probable cause, the undersigned reviewed both files 18FC:0046 and 18FC:0075, and reviewed Ms. Husemann’s two complaints along with the University’s responses. The undersigned reviewed all the legal cases cited by General Counsel for the University of Iowa, Nathan Levin, and a previous advisory opinion, IPIB AO 2018-19 from November 20, 2018.
The undersigned also reviewed all the emails the University cited as being covered by exceptions in Iowa Code section 22.7 (1)(2)(11) and (18) as well as the Health Insurance Portability and Accountability Act (HIPAA) as interpreted by the Code of Federal Regulations (HIPAA) and the Federal Educational Privacy Rights Act (FERPA).
- Facts Revealed Through Investigation
The undersigned reviewed seventy (70) separate email threads which the University believed constituted records of a student or prospective student under Iowa Code § 22.7 (1). The emails contained discussion of students’ attendance, exam questions, quizzes, class enrollment, visits to office hours, and recommendations.
The undersigned also reviewed emails alleged to constitute confidential employment records under Iowa Code § 22.7 (11). There was only one (1) such email. It contained a draft of resume materials and performance.
The third category of allegedly confidential emails involved emails the University of Iowa believes fall within the confidentiality exception of Iowa Code section 22.7 (18). Those are confidential communications from persons outside the government, not made by law, rule, procedure or contract, made to a government body, if the governmental body could believe those persons would reasonably be discouraged from providing such information if the public had a right to view it.
The University of Iowa provided one hundred twenty six (126) sets of email threads containing that information. Many of those emails contained information related to applications pending. They also contained emails involving professional development through organizations outside of the university.
The University of Iowa also provided an email alleged as confidential under Iowa Code § 22.7 (19). It contained an attachment with a copy of an exam.
In addition, I reviewed twenty one (21) sets of emails allegedly containing confidential information under Iowa Code § 22.7 (2), or patient health information. This information, if protected health information, must also be kept confidential under HIPAA, a federal statute enforced and implemented with administrative regulations. These emails contained patient records and photos, and discussion between employees about the results of procedures. There was one bill. It also contained a brief discussion of a confidential patient matter. The email set also contained information about someone leaving for a new job.
- Laws Involved
Under Iowa Code Chapter 22, a potential public record could involve any electronic or paper information which a government body possesses. However, Iowa Code § 22.7 allows an enumerated list of seventy three (73) categories of information a government body may withhold.
Those exceptions relevant to this matter include Iowa Code §§ 22.7 (1) [student records], 22.7 (2) [medical records], 22.7 (11) [confidential employee information], and 22.7 (18) [useful incoming communications].
Furthermore, a federal law, the Federal Educational Privacy Rights Act, 20 U.S.C. § 1232 (g), 34 C.F.R. Part 99 (FERPA), imposes financial penalties on educational institutions who fail to maintain student privacy. Iowa Code § 22.9 also allows government bodies to withhold records that could result in the denial of federal funds. In Press Citizen Company, Inc. v. University of Iowa, the Iowa Supreme Court held that confidential educational records under FERPA containing identifiable student information may be withheld under Iowa Code Chapter 22. 817 N.W. 2d 480 (2012).
The federal Health Insurance Portability and Accountability Act (HIPAA) codified in 45 C.F.R. sections 160, 162, and 164 does not allow health organizations to release private patient records without consent.
In City of Sioux City v. Greater Sioux City Press Club, 421 N.W. 2d 895 (Iowa 1988), the Iowa Supreme Court held that Iowa Code § 22.7 (18) covers job applications to a government agency.
C. Legal Analysis
The above emails clearly fall within the parameters of Iowa Code §§ 22.7 (1), 22.7 (2), 22.7 (11), and 22.7 (18).
Regarding personally identifiable student records, Iowa Code § 22.7 (1), and Iowa Supreme Court case law Press Citizen Inc. v. University of Iowa, 817 N.W. 2d 480 (2012) allow educational institutions to withhold personally identifiable records containing students’ names. The information in the materials the university believes constituted student records indeed did discuss purely student business about specific identifiable persons.
Iowa Code § 22.7 (2) allows public health facilities to withhold patients’ medical records, which is also consistent with severe potential penalties for violating confidentiality under HIPAA, 45 C.F.R. 160, 162, and 164. The emails allegedly concerning patient health records do contain specifically identifiable patient information and private discussion and names of patient situations.
There is only one email concerning an employee’s personnel records under Iowa Code § 22.7 (11). Ms. Husemann and the general public does have a right to certain information such as the employee’s past positions, dates of employment, rate of pay, and educational institutions attended under § 22.7 (11), but her request does not contain this information. The records request seeks email communications to and from this employee. Therefore, the undersigned does not think the email is a public record.
All of the materials withheld under Iowa Code section 22.7 (18) constituted job applications, discussion of job references or recommendations of applicants who reasonably might be discouraged from applying if their resumes or references became information to which the public has a general right of access. The remainder of the alleged Iowa Code section 22.7 (18) materials contained information about private professional organizations whose involvement with the school might be limited for charitable and educational purposes if the information were available for general public use.
IPIB Action
The IPIB has several options upon receipt of a probable cause report. According to Iowa Administrative Rule 497-2.2(4):
“Board Action. Upon receipt and review of the staff investigative report, and any recommendations, the board may:
- Redirect the matter for further investigation;
- Dismiss the matter for lack of probable cause to believe a violation has occurred;
- Make a determination that probable cause exists to believe a violation has occurred, but as an exercise of administrative discretion, dismiss the matter;
- Make a determination that probable cause exists to believe a violation has occurred, designate a prosecutor and direct the issuance of a statement of charges to initiate a contested case proceeding; or
- Direct administrative resolution of the matter under sub rule 2.1(6) without making a determination as to whether a violation occurred.”
Sub rule (e) above references sub rule 2.1 (6), which states:
“2.1 (6) Administrative Resolution. To assist with resolving complaints in an informal and expeditious manner, the board may, at any time during the complaint process, order administrative resolution of a matter by directing that a person take specified remedial action. A board order directing remedial action shall constitute a final agency action for purposes of judicial review under Iowa Code Chapter 17A.”
D. Conclusion/Recommendation
The undersigned recommends that the IPIB make a finding that there exists lack of Probable Cause to believe a violation occurred.
Respectfully submitted this ___________day of May, 2019.
______________________________
Amanda T. Adams
CERTIFICATE OF SERVICE
This document was sent via electronic or regular mail on this ______ day of May, 2019 to the following parties:
Nathan Levin, Counsel for University of Iowa/Respondent, email
Patricia Husemann, Complainant, email
The Iowa Public Information Board
|
In the Matter of: Patricia Husemann, Complainant. and Concerning: University of Iowa, Respondent |
Case Number: 18FC:0075 Probable Cause Order
|
This matter comes before the Iowa Public Information Board (IPIB) on this 16th day of May, 2019, to consider a Probable Cause report.
The probable cause report recommends that the IPIB determine that probable cause does not exist to believe that the University of Iowa violated Iowa Code Chapter 22.
The IPIB finds that there is not Probable Cause to believe that the University of Iowa violated Iowa Code Chapter 22.
Pursuant to Iowa Administrative Rule 497-2.2 (4) (b), the IPIB enters a finding of no probable cause and dismisses the complaint.
So ordered this 16th day of May, 2019.
____________________________
IPIB Chair
CERTIFICATE OF SERVICE
This document was sent by electronic mail on the _______ day of May, 2019, to:
Patricia Husemann (Complainant) email
Nathan Levin (Respondent’s Counsel) email