In Part 1 regarding Doe v. Rutgers, an OPRA opinion published by the Appellate Division on January 12, 2021, we discussed how the Court held that students, their parents and guardians have the right under OPRA to access their own student records. This holding is important because students, parents and guardians can enforce denials of access to student records in Superior Court. (We represented Doe before the trial court and on appeal).
However, Doe did carve out a new exception to the circumstances under which OPRA can be utilized. Among other records, the plaintiff in Doe requested copies of their own medical records. Although Rutgers denied access to these records under OPRA, Rutgers did not rely upon the Health Insurance Portability and Accountability Act (“HIPAA”), which, under the Privacy Rule promulgated under HIPAA, makes health care information held by medical providers confidential. Nonetheless, the Court raised the issue because “the release of health care is of significant public interest for [the Court] to consider.” The Court held that Doe could not use OPRA to access their own medical records because access to medical records is governed by HIPAA, not OPRA. Through this holding, the public has been deprived of the right to enforce denials of access by a public agency to an individual’s own health records through OPRA.
Although Doe involved medical records in the possession of an institute of higher education, the opinion contains no language that would limit this holding to just colleges and universities. On its face, this holding is applicable to all public agencies that are subject to OPRA. Because a “school or university” is one of the entities that are covered by HIPAA’s Privacy Rule, 45 C.F.R. § 160.103, Rutgers is an entity that must safeguard medical information. Whether a public agency that is not an entity that is covered by HIPAA’s Privacy Rule must provide medical records remains an OPRA request is an open, albeit narrow, question.
Anyone who has been denied access to records or has questions about access to public records should contact Cohn Lifland to discuss their options. The statute of limitations to file a denial of access complaint in Superior Court is 45 days after the date of the denial, so it is important to act quickly.