For a Judgment Pursuant to Article 78 of the Civil Practice Law and Rules Decision Order and Judgment Petition to compel the respondent to produce injury reports from sporting and athletic events and competitions held at Mt. Van Hoevenberg pursuant to the Freedom of Information Law (FOIL) (Public Officers Law art. 6). This proceeding was commenced by the electronic filing of a notice of petition and petition, with exhibits A through H, and a memorandum of law on March 15, 2021. ORDA filed an answer and return on April 16, 2021 which included duplicate copies of some of the exhibits attached to the petition, a 35-page HIPAA guidance document from the U.S. Department of Health & Human Services, an affidavits from Rebecca Dayton sworn to April 14, 2021, an affidavit from Eugene Byrne, M.D., sworn to March 30, 2021 with exhibit A thereto, an affidavit of Mellissa Furnia sworn to March 31, 2021, a letter memorandum of law dated April 16, 2021, and unredacted copies of the reports for in camera review. The petitioner submitted a reply memorandum of law on April 29, 2021, and a supplemental letter memorandum of law on September 9, 2021. This Court has considered all of the foregoing pleadings and papers. In addition, by letter dated April 20, 2021 this Court requested that ORDA’s public information officer appear at oral argument to answer questions which this Court determined were raised in the papers. ORDA not only objected to that request but requested that the matter be decided on the record already submitted.1 The petitioner Getting the Word Out, Inc. (GWO) is a New York not-for-profit corporation publishing a bi-monthly magazine known as the Adirondack Explorer as well as digital content in the form of weekly and daily newsletters, a digital edition of the magazine, and an annual outings guide. The respondent New York State Regional Development Authority (ORDA) is a public authority created by the Legislature for the purposes of, among other things, operating certain sports venues, and conducting athletic training and competition events thereat, within and outside of the Adirondack Park, including an Olympic-class bobsled, luge and cross-country skiing facility known as Mt. Van Hoevenberg (MVH) in the town of North Elba, Essex County. The facts underlying this proceeding are mostly uncontroverted. James M. Odato (Odato), an investigative reporter working for GWO, submitted via electronic mail a FOIL request on July 17, 2020 to ORDA’s records access officer, Elise Ruocco (Ruocco), for “copies of injury reports from January 2015 through July 4, 2020 and from calendar year 2004 from sporting and athletic events and competitions at Mt. Van Hoevenberg”.2 On July 21, 2020, ORDA’s assistant counsel, Adam P. Powers (Powers), emailed Odato, stating that a response would be forthcoming within both twenty and forty-five business days3, which Powers corrected three days later to just the forty-five business-day time period.4 Powers again extended ORDA’s response time for another thirty business days on September 22, 2020.5 In early November 2020 Powers provided 200± accident or incident reports6 which were almost completely blacked out and redacted except for the event venue, general incident location, date, time, the name and signature of the person completing the report, and the date the report was completed. Copies of those reports without redaction were furnished to this Court for in camera review and comparison. Most of the reports are on a form labeled “Olympic Regional Development Authority Medical Incident Report”, while others are on a form utilized by the International Bobsleigh and Skeleton Federation (IBSF) and there is one ORDA General Incident Report. Powers justified the blackouts and redactions by relying upon the exemption for unwarranted invasion of personal privacy (Public Officers Law §87[2][a]) and specifically referencing the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. §1320d-§1320d-9; 45 C.F.R. §§160.101 et seq.). Odato appealed from ORDA’s decision to heavily redact the reports by letter dated November 13, 2020, citing and enclosing a June 24, 2019 advisory opinion issued to ORDA by the New York State Committee on Open Government (COOG). In that opinion, the COOG suggested that except for “clearly identifying details” from which the identity of the person involved or injured in the incident could be discerned — such as “a victim’s name, address, phone number and similar items unique to that person…”7 disclosure of other information was not exempt. COOG further opined that “it would be difficult to demonstrate how disclosure of a person’s occupation, his or her height and weight, a victim’s description of his or her injury, the nature of treatment, or the destination to which the victim was transported would serve as information that could reasonably be used to identify an individual.”8 By letter dated December 1, 2020, ORDA’s general counsel, Michelle A. Crew (Crew), denied the appeal on the grounds that the redacted information “constitutes medical history information under POL §89(2)(b)(i)”9 exempt from disclosure because it would result in an unwarranted invasion of personal privacy, and cited case authorities, including Matter of Hanig v. State Dept. of Motor Vehicles, 79 N.Y.2d 106, 109, 580 N.Y.S.2d 715, 717, 588 N.E.2d 750, 752 (1992), and portions of HIPAA regulations. Specifically, Crew stated that the subject records were prepared by “medical responders” such as doctors, physicians assistants, emergency medical technicians, and/or ski patrol personnel, and contained information collected from an injured party, the medical responder’s assessment of that person, and whether the person was transported to a hospital or other location. In addition to pedigree information — name, date of birth, address, phone number, etc. — the records include comment on person’s physical condition, diagnosis of injury or injuries, vital signs, relevant medical history, and medical treatment provided and recommended. Some of the records contain a consent to release of the information signed by the injured person, but most do not. Crew noted that ORDA was and is a “covered entity” under HIPAA and release of the records would require authorization from the injured party to release the information. Crew also ruled that the redacted information in the records “fits squarely into the personal privacy exemption of POL §87(2)(b). Finally, Crew noted that identification of the injured persons in the subject records would be more easily accomplished because most of those persons were elite athletes engaged in training or competitions at the ORDA venues. Judicial review of a determination by an administrative agency under CPLR Article 78 is limited to whether the challenged decision “was made in violation of lawful procedure, was affected by an error of law or was arbitrary and capricious or an abuse of discretion” (CPLR §7803[3]). “An action is arbitrary and capricious when it is taken without sound basis in reason or regard to the facts (see Matter of Pell v. Board of Educ. of Union Free School Dist. No. 1 of Towns of Scarsdale & Mamaroneck, Westchester County, 34 N.Y.2d 222, 231, 356 N.Y.S.2d 833, 313 N.E.2d 321 [1974]).” (Matter of Peckham v. Calogero, 12 N.Y.3d 424, 431, 883 N.Y.S.2d 751, 754, 911 N.E.2d 813, 816 [2009]). Here, GTWO contends that ORDA’s redaction of the records, and the denial of its appeal, were arbitrary and capricious and were affected by an error of law. “FOIL imposes a broad duty of disclosure on government agencies (see, Public Officers Law §84; Matter of Fink v. Lefkowitz, 47 N.Y.2d 567, 419 N.Y.S.2d 467, 393 N.E.2d 463). All agency records are presumptively available for public inspection and copying, unless they fall within 1 of 10 categories of exemptions, which permit agencies to withhold certain records (Public Officers Law §87[2]; Matter of Farbman & Sons v. New York City Health & Hosps. Corp., 62 N.Y.2d 75, 79-80, 476 N.Y.S.2d 69, 464 N.E.2d 437). Those exemptions are to be narrowly construed, with the burden resting on the agency to demonstrate that the requested material indeed qualifies for exemption (Public Officers Law §89[4][b]).” (Matter of Hanig v. State Dept. of Motor Vehicles, 79 N.Y.2d 106, 109, 580 N.Y.S.2d 715, 717, 588 N.E.2d 750, 752 [1992]). “As this Court has stated, ‘[o]nly where the material requested falls squarely within the ambit of one of these statutory exemptions may disclosure be withheld’ (Matter of Fink v. Lefkowitz, 47 N.Y.2d 567, 571, 419 N.Y.S.2d 467, 393 N.E.2d 463).” (Matter of Gould v. New York City Police Dept., 89 N.Y.2d 267, 274-275, 653 N.Y.S.2d 54, 57, 675 N.E.2d 808, 811 [1996]). Moreover, “[e]ven where records fall within an exemption, an agency in its discretion may disclose them in whole or in part (Matter of Capital Newspapers v. Burns, 67 N.Y.2d 562, 567, 505 N.Y.S.2d 576, 496 N.E.2d 665).” (Matter of Hanig v. State Dept. of Motor Vehicles, supra at 109, 580 N.Y.S.2d at 718, 588 N.E.2d at 752-53) What comprises a record which, if disclosed, would constitute an unwarranted invasion of personal privacy under FOIL is not well defined. Among other things, Public Officers Law §87, subdivision 2, authorizes agencies to “deny access to records or portions thereof that: (a) are specifically exempted from disclosure by state or federal statute; [or] (b) if disclosed would constitute an unwarranted invasion of personal privacy under the provisions of subdivision two of section eighty-nine of this article”. Subdivision 2 of Public Officers Law §89 empowers the committee on public access to records to “promulgate guidelines regarding deletion of identifying details or withholding of records otherwise available under this article to prevent unwarranted invasions of personal privacy” and, in the absence of such guidelines, permits an agency to “delete identifying details when it makes records available.” Review of the regulations reveals that no such guidance has been developed. This statutory provision goes on to list eight non-exclusive categories of records indicative of an unwarranted invasion of personal privacy, including but not “limited to: i. disclosure of…medical…histories…of applicants for employment; [and] ii. disclosure of items involving the medical…records of a client or patient in a medical facility” (Public Officers Law §89[2][i]-[ii]). ORDA’s records here fall within neither category as no claim is made or proof submitted that any of the persons were applicants for employment with ORDA and ORDA is not a medical facility. °° Additionally, “disclosure shall not be construed to constitute an unwarranted invasion of personal privacy pursuant to paragraphs (a) and (b) of this subdivision * * * when identifying details are deleted” (Public Officers Law §89[2][c][i]). Thus, when identifying details are removed from medical records there is no unwarranted invasion of personal privacy and records are not exempt. The term, “identifying details”, is not defined under FOIL.10 The information’ [to] mean[] any information concerning a data subject which, because of name, number, symbol, mark or other identifier, can be used to identify that data subject.” (Public Officers Law §92[7]). No state law provision has been found defining “identifying details” in the context of accident reports or medical records. Fortunately, HIPAA provides guidance. “The [HIPAA] Privacy Rule prohibits disclosure of an identifiable patient’s health information without the patient’s authorization, subject to certain exceptions (45 CFR 164.508[a][1]). HIPAA §264(c)(2) (see Historical and Statutory Notes following 42 USCA §1320d-2) and the Privacy Rule (45 CFR 160.203 [b]) say that contrary state laws are preempted unless they offer privacy protections that are “more stringent” than those of the federal law” (Matter of Miguel M. v. Barron, 17 N.Y.3d 37, 42, 926 N.Y.S.2d 371, 374, 950 N.E.2d 107, 110 [2011]). The provisions of New York’s Freedom of Information Act (Public Officers Law §84-§90) are not more stringent. Under HIPAA, “The term ‘individually identifiable health information’ means any information, including demographic information collected from an individual, that — (A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and — (i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.” (42 U.S.C. §1320d [6]). 45 C.F.R. §164.514 establishes a methodology to de-identify protected health information from a record so that it no longer contains individually identifiable health information and disclosure thereof will not violate the privacy rule: “(a) Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information. (b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if: * * * * (2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000. (C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and (ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.” In its near blanket redaction of the records here, ORDA broadly construed the exemption for unwarranted invasion of personal privacy in Public Officers Law §87(2)(b) and was overly cautious, actions that were affected by an error of law. Its assertion that elite athletes who were the subject of some reports would be more easily identified is speculative and unsupported by any factual evidence, particularly since many of the reports are years old and the incidents are not in the current public consciousness. ORDA has submitted no facts establishing that it has “actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information” if only the identifiers in 45 C.F.R. §164.514(b)(2)(i)(A)-(R) were redacted from the subject reports. “[T]he agency must bear the burden of demonstrating that the requested material falls squarely within the statutory exemption, which, in deference to disclosure, is narrowly construed (see, id.; Matter of Fink v. Lefkowitz, 47 N.Y.2d 567, 419 N.Y.S.2d 467, 393 N.E.2d 463).” (Matter of Empire Realty Corp. v. New York State Div. of the Lottery, 230 A.D.2d 270, 272, 657 N.Y.S.2d 504, 506, [3d Dept 1997]). “Failure to establish the factual existence of this claimed exemption (see Matter of Capital Newspapers Div. of Hearst Corp. v. Burns, 67 N.Y.2d 562, 566, 505 N.Y.S.2d 576, 496 N.E.2d 665 [1986]) renders this claim for exemption unavailing.” (Matter of New York Ass’n of Homes and Services for the Aging, Inc. v. Novello, 13 A.D.3d 958, 960, 786 N.Y.S.2d 827, 830 [3d Dept 2004]). “It is settled that FOIL is based on the overriding policy consideration that ‘the public is vested with an inherent right to know and that official secrecy is anathematic to our form of government’ (Matter of Fink v. Lefkowitz, 47 N.Y.2d 567, 571, 419 N.Y.S.2d 467, 393 N.E.2d 463). * * * We have held, therefore, that FOIL is to be liberally construed and its exemptions narrowly interpreted so that the public is granted maximum access to the records of government (see, Matter of Washington Post Co. v. New York State Ins. Dept., 61 N.Y.2d 557, 564, 419 N.Y.S.2d 467, 393 N.E.2d 463, citing Matter of Fink v. Lefkowitz, supra, 47 N.Y.2d 567, at p. 571, 419 N.Y.S.2d 467, 393 N.E.2d 463).” (Matter of Capital Newspapers, Div. of Hearst Corp. v. Whalen, 69 N.Y.2d 246, 252, 513 N.Y.S.2d 367, 370-371, 505 N.E.2d 932, 936 [1987]). De-identifying ORDA’s accident/incident reports by redacting the identifiers listed in 45 C.F.R. 164.514(b)(2)(i)(A)-(R) removes “identifying details” such that “disclosure shall not…constitute an unwarranted invasion of personal privacy” (Public Officers Law §89[2][c][1]) and renders any remaining information to “not [be] individually identifiable health information” (45 C.F.R. §164.514[b]) because ORDA “does not have actual knowledge that the [unredacted] information could be used alone or in combination with other information to identify an individual who is a subject of the information” (45 C.F.R. §164.514[b][ii]). Applying the methodology in 45 C.F.R. §164.514(b) to the ORDA records here would both maximize public access to ORDA’s records and minimize, if not eliminate, any reasonable risk that the persons who are the subjects of those reports could or would be identifiable. Therefore, disclosure of those reports after redaction of those identifiers would not constitute an unwarranted invasion of personal privacy sufficient to justify exemption from disclosure under FOIL. This determination is consistent with Matter of Beyah v. Goord, 309 A.D.2d 1049, 766 N.Y.S.2d 222 (3d Dept 2003) and Matter of Canty v. Off. of Counsel, 30 Misc.3d 705, 913 N.Y.S.2d 528 (Sup Ct 2010). The court in Beyah directed disclosure of accident reports “which describe the general nature of the correction officers’ injuries sustained in the incident, if any, do not reveal details of any existing medical condition and, *.*.*. [redacted] each correction officer’s home address, home and other phone numbers, Social Security number and date of birth…” In Canty, accident reports of corrections officers injured in a riot were ordered to be disclosed after redaction of certain information protected from disclosure by the then version of Civil Rights Law §50-a and the exemption in Public Officers Law §89(2)(b)(ii) for “medical or personal records of a client or patient in a medical facility”. ORDA is not a medical facility and the subject records here do not fall squarely within the exemption applied in Canty. The cases cited by ORDA do not require or suggest a different result. In Matter of Hanig v. State Dept. of Motor Vehicles, supra, disclosure under FOIL was sought by a third-party of the unredacted driver’s license application of a named individual which contained confidential responses to a question about whether the applicant had, or was then receiving treatment for, any disabilities as well as an “ensuing list specif[ying] convulsive disorder, epilepsy, fainting or dizzy spells, heart ailment, mental disability, hearing impairment, lost use of leg, arm, foot, hand or eye, and other”(id., at 108, 580 N.Y.S.2d at 716, 588 N.E.2d at 751). A criminal defendant’s FOIL request for, among other things, the autopsy and medical reports of the alleged victim was denied in Huston v. Turkel, 236 A.D.2d 283, 283-284, 653 N.Y.S.2d 584, 585 [1st Dept 1997]) because the defendant’s attorney was already in possession of the autopsy report, autopsy reports were exempt from disclosure under law, and “Public Officers Law §87(2)(b) and 89(2)(b)(ii) specifically exempt access to medical records as an unwarranted invasion of privacy”. Huston involved the medical records of a named individual and no redaction of the HIPAA identifiers would lessen or remove the risk of identification of the patient named in those records. Neither Matter of Dobranski v. Houper, 154 A.D.2d 736, 546 N.Y.S.2d 180 (3d Dept 1989) (identikit papers and notations, inmate personal reference cards) nor Matter of Ruberti, Girvin & Ferlazzo P.C. v. New York State Div. of State Police, 218 A.D.2d 494, 494, 641 N.Y.S.2d 411 (3d Dept 1996) (state police promotional exam scores and personnel or discrimination complaints) involved the disclosure of accident or incident reports under FOIL. Finally, ORDA’s claim that most of the reports involve elite athletes involved in unique activities such that release of the records “could enable identification of the injured victim”.11 Persons who participate in public events and become injured voluntarily expose themselves to greater public notoriety and are not entitled to greater protection from disclosure of accident reports than someone injured in a non-public setting. The incident report of an injury to a skier injured while jumping into an airbag attraction at Whiteface, or of a luger injured during a competition or training event, at which spectators are present, is no less disclosable under FOIL because more people may have witnessed or been told about the incident. For the foregoing reasons, ORDA’s severely limited disclosure and the denial of GTWO’s appeal were affected by an error of law. The petition is granted to the extent that within thirty (30) days hereof ORDA is directed to disclose the subject records redacting only the identifiers listed in 45 C.F.R.§164.514(b)(2)(i)(A)-(R). No award of attorneys fees is made due to the unique nature of the ORDA records and because it cannot be said that ORDA lacked “a reasonable basis for denying access to the requested records (see Matter of Madeiros v. New York State Educ. Dept. 30 N.Y.3d 67, 78-79, 64 N.Y.S.3d 635, 86 N.E.3d 527 [2017]). ‘A pertinent consideration in determining whether an agency had a reasonable basis for denying a FOIL request is whether the agency reasonably claimed the records were exempt from disclosure under Public Officers Law §87(2), although the denial may still have been reasonable even if the records are ultimately deemed not to be exempt’ (Matter of New York State Defenders Assn. v. New York State Police, 87 A.D.3d 193, 195, 927 N.Y.S.2d 423 [2011] [citations omitted]; accord Matter of Competitive Enter. Inst. v. Attorney Gen. of N.Y., 161 A.D.3d 1283, 1285, 76 N.Y.S.3d 640 [2018]).” (Vertucci v. New York State Dept. of Transportation, 195 A.D.3d 1209, 150 N.Y.S.3d 786, 788 [3d Dept 2021]). It is so ordered and adjudged.
