OHSU v. Oregonian Publishing Co., LLC

68 October 19, 2017 No. 56

IN THE SUPREME COURT OF THE

STATE OF OREGON

OREGON HEALTH AND SCIENCE UNIVERSITY,

a public corporation,

Respondent on Review,

v.

OREGONIAN PUBLISHING COMPANY, LLC,

a domestic limited liability company,

Petitioner on Review.

(CC 111216443; CA A152961 SC S064249)

On review from the Court of Appeals.*

Argued and submitted March 3, 2017.

Duane A. Bosworth, Davis Wright Tremaine LLP,

Portland, argued the cause and filed the briefs for petitioner

on review. Also on the briefs was Derek D. Green.

Roy Pulvers, Holland & Knight LLP, Portland, argued

the cause and filed the brief for respondent on review. Also

on the brief was Nellie Q. Barnard.

Inge D. Wells, Assistant Attorney General, Salem, filed

the brief on behalf of amicus curiae State of Oregon. Also on

the brief were Ellen F. Rosenblum, Attorney General, and

Benjamin Gutman, Solicitor General.

Hillary A. Taylor, Keating Jones Hughes, PC, Portland,

filed the brief on behalf of amicus curiae Oregon Medical

Association.

Before Balmer, Chief Justice, and Kistler, Walters,

Landau, Nakamoto, and Flynn, Justices, and Brewer, Senior

Justice pro tempore.**

______________

**  Appeal from Multnomah County Circuit Court, Richard Maizels, Judge.

278 Or App 189, 373 P3d 1233 (2016).

**  Baldwin, J., retired March 31, 2017, and did not participate in the decision

of this case. Duncan, J., did not participate in the consideration or decision of this

case.

Cite as 362 Or 68 (2017) 69

BREWER, S. J.

The decision of the Court of Appeals is reversed in part

and affirmed in part. The judgment of the circuit court and

the supplemental judgment awarding attorney fees and costs

to The Oregonian are reversed, and the case is remanded to

the circuit court for further proceedings.

Case Summary: Defendant newspaper filed a public records request under

ORS 192.490(1) with plaintiff, a public corporation that provides patient health

care, seeking a list of the claimant names, attorney names, dates of alleged

torts, and other information for tort claim notices received by plaintiff. Plaintiff

responded that some of the requested information was exempt from disclosure

pursuant to various state and federal laws. Defendant petitioned the district

attorney, pursuant to ORS 192.450 and ORS 192.460, for an order directing

plaintiff to disclose the requested record, which the district attorney granted,

and plaintiff filed an action in circuit court, seeking a declaratory judgment

that the information in the requested record that it had declined to disclose was

exempt from disclosure. On the parties’ cross-motions for summary judgment,

the circuit court determined that the exemptions that plaintiff relied on were not

available and entered a judgment requiring plaintiff to disclose the requested

record. Plaintiff appealed, and the Court of Appeals reversed in part, directing

the circuit court to examine the tort claim notices in question to determine if

they are exempt from disclosure under ORS 192.496(1) because they contain

information about the physical or mental health or psychiatric care or treatment

of an individual patient. Held: For tort claim notices involving patients, (1) the

requested information at issue—the claimant names, attorney names, and dates

of the alleged torts—is “protected health information” that is confidential pursu-

ant to ORS 192.553; (2) the protected health information at issue is exempt from

disclosure under ORS 192.502(9)(a); and disclosure of the requested record is not

required by ORS 192.420(1).

The decision of the Court of Appeals is reversed in part and affirmed in part.

The judgment of the circuit court and the supplemental judgment awarding

attorney fees and costs to The Oregonian are reversed, and the case is remanded

to the circuit court for further proceedings.

70 OHSU v. Oregonian Publishing Co., LLC

BREWER, S. J.

This case concerns a public records request made

by defendant Oregonian Publishing Company, LLC (The

Oregonian), a newspaper, to plaintiff Oregon Health and

Sciences University (OHSU), a public health and research

university that provides patient care at its hospital, con-

ducts research, and educates health care professionals

and scientists. The circuit court ordered OHSU to disclose

the requested record, and OHSU appealed. The Court of

Appeals reversed and remanded to the circuit court to

examine the public records at issue and then determine

whether state and federal exemptions permitted OHSU to

withhold some of the requested information. On review, the

issues have narrowed to whether the requested record con-

tains “protected health information” and student “education

records” under federal and Oregon law and, if so, whether

that information nonetheless must be disclosed pursuant to

ORS 192.420(1), a provision of the Oregon Public Records

Law (OPRL).1

For the reasons explained below, we conclude that

the requested record contains protected health information

and that ORS 192.420(1) does not require the disclosure of

that information. In the absence of adequately developed

arguments, we decline to consider whether the part of the

requested record consisting of tort claim notices filed by stu-

dents contains “education records,” and, if so, whether those

records are exempt from disclosure. We therefore leave

undisturbed the Court of Appeals’ disposition of that issue,

which was to remand to the circuit court for examination of

the tort claim notices.

Accordingly, we reverse in part and affirm in part

the decision of the Court of Appeals, we reverse the judg-

ment of the circuit court and its supplemental judgment

awarding attorney fees and costs to The Oregonian, and we

remand to the circuit court for further proceedings.

1

The OPRL is codified at ORS 192.410 to 192.505. Under ORS 192.420(1),

“[e]very person has a right to inspect any public record of a public body in this

state, except as otherwise expressly provided by ORS 192.501 to 192.505.”

Cite as 362 Or 68 (2017) 71

I.  FACTS AND PROCEDURAL BACKGROUND

The Oregonian, through a reporter, made a pub-

lic records request to OHSU, based on ORS 192.420(1), in

which it sought information contained in tort claim notices

received by OHSU.2 In particular, The Oregonian’s request

sought:

“[A] list of tort claims filed against [OHSU] and its affil-

iated entities, preferably in spreadsheet form, with infor-

mation dating back [five years] and including only the fol-

lowing types of information or data fields: claim number,

claimant full name, attorney full name, date of alleged

tort, date of tort claim notice, and whether it is closed or

open. If you need to fully redact from the printout other

data fields or information not fitting the above description,

please do so.”

The Oregonian stated that it was “not requesting the text

of actual tort claim notices.” The Oregonian asserted that

it did not seek “any information generated in the course of

medical treatment,” nor was it requesting “health informa-

tion of any kind.” From The Oregonian’s previous communi-

cations with OHSU, The Oregonian understood that provid-

ing such a list from OHSU’s record database would not pose

a logistical problem.

OHSU created a record tailored to The Oregonian’s

request (the “requested record”). The requested record is

a list in which each row represents a discrete tort claim

notice and each column represents a category of infor-

mation requested by The Oregonian for each tort claim

notice. OHSU did not provide the requested record to The

Oregonian, but, instead, responded by stating that it would

comply with the public records request in part and object to

it in part, as described below.

In response, The Oregonian petitioned the

Multnomah County District Attorney, pursuant to ORS

2

As a public corporation under ORS 353.020, OHSU’s tort liability and the

limits on it are set out in the Oregon Tort Claims Act, ORS 30.260 - 30.300.

Moreover, the Oregon Tort Claims Act regulates the manner in which claims

against public bodies are prosecuted. As part of that regulation, a tort claim

notice must be given to the public body prior to the commencement of litigation,

stating the name and address of the claimant, as well as a “description of the

time, place and circumstances giving rise to the claim.” ORS 30.275.

72 OHSU v. Oregonian Publishing Co., LLC

192.450 and ORS 192.460,3 for an order directing OHSU to

disclose the requested record. OHSU responded that parts

of the requested record were exempt from disclosure. As a

visual explanation, OHSU’s response included a table that

contained rows that illustrated the types of tort claims that

OHSU had received during the specified period—including

professional liability claims, employment liability claims,

general liability claims concerning students, general liabil-

ity claims concerning patients, and other general liability

claims—and columns that contained the information spec-

ified in The Oregonian’s request. For each type of claim

and each type of information requested, OHSU indicated

in the table whether it was willing to provide that informa-

tion or not. If OHSU indicated that it would not provide the

information in the table due to a claimed exemption from

disclosure, OHSU also cited the source of that claimed

exemption.

In all, OHSU initially claimed six exemptions that,

it asserted, prohibited disclosure of parts of the requested

information, including, among others, the Health Insurance

Portability and Accountability Act (HIPAA) of 1996, 42 USC

§ 1320d to 1320d-9, and its implementing regulations known

as the Privacy Rule, 45 CFR Parts 160 and 164; several

exemptions under Oregon law; and exemptions pertaining

to education records under the Family Educational Rights

and Privacy Act (FERPA), 20 USC § 1232g.

Based on those claimed exemptions, OHSU argued

that it was precluded from disclosing claimant names,

attorney names, and dates of the alleged torts for tort claim

notices related to patients. Specifically with regard to attor-

ney names, OHSU argued that patients could be identified if

attorney names were disclosed and court filings that listed

OHSU as a defendant were searched for those attorney

names. For claims filed by students related to their educa-

tion, OHSU asserted that it could not disclose the student

3

ORS 192.450 and ORS 192.460 authorize a person who has been denied the

right to inspect or receive a copy of a public record to petition the local district

attorney or the attorney general—depending on the type of public body involved

in the public records request—to initially determine, subject to judicial review,

whether the requested public record may be withheld from disclosure.

Cite as 362 Or 68 (2017) 73

names. OHSU agreed to provide the requested information

pertaining to other liability claims.4

The district attorney ruled that the claimant

names, attorney names, and dates of the alleged torts for

all claims were not exempt from disclosure, and it directed

OHSU to disclose the entire requested record. OHSU there-

after gave notice to the district attorney of OHSU’s intent to

initiate a circuit court action. OHSU then filed this action,

seeking a declaratory judgment that the information in the

requested record that it had declined to disclose was exempt

from disclosure. The Oregonian asserted counterclaims in

which it sought injunctive relief requiring disclosure of the

entire requested record and a statutory award of attorney

fees and costs.

Before the circuit court, the parties filed cross-

motions for summary judgment. In OHSU’s motion, it

asserted, pursuant to various state and federal exemp-

tions, that it was entitled to withhold from disclosure all

the information that it had declined to disclose or, in the

alternative, some of that information.5 In support of its

motion, OHSU submitted an affidavit from its Director of

Risk Management. The director stated that she had per-

sonally examined hundreds of tort claim notices, including

many requested by The Oregonian. Based on her review

of those tort claim notices, the director averred that “tort

claim notices submitted to OHSU by patients or others and

maintained by OHSU relating to patient care always iden-

tify one or more patients.” She further stated that tort claim

notices for patient claims “includ[e] the fact that the individ-

ual received care at OHSU” and “include specific informa-

tion about the physical or mental health or psychiatric care

4

OHSU also initially declined to disclose claimant names for employment

liability claims; however, OHSU later agreed to disclose that information.

Accordingly, the issue whether claimant names pertaining to employment liabil-

ity claims are exempt from disclosure is not before us. In addition, OHSU initially

argued that all the information requested in the tort claim notices was exempt

from disclosure under ORS 192.502(21), the sensitive business records exemp-

tion. OHSU no longer makes that argument, and we therefore do not consider it.

5

In its motion for summary judgment, OHSU stated that, if the court exer-

cised its authority pursuant to ORS 192.490(1) to review the requested record

in camera, OHSU would provide the requested record for the court’s review. The

circuit court, however, did not engage in an in camera review.

74 OHSU v. Oregonian Publishing Co., LLC

or treatment of the patient.” The director continued, “Many

tort claim notices provide specific and detailed information

about the circumstances giving rise to the potential claim.”

She also stated that all tort claim notices received by OHSU

are kept in OHSU’s risk management office.

OHSU also submitted an affidavit from its Executive

Vice Provost, who stated that OHSU receives funds under

programs administered by the United States Department

of Education. He described tort claim notices received by

OHSU from students:

“Tort claim notices submitted to OHSU by OHSU students

always contain information identifying the student, such

as the student’s name, and information directly related to

the student, such as a description of the time, place and

circumstances giving rise to the claim. * * * OHSU treats

tort claim notices directly related to students as ‘education

records’ to which FERPA applies.”

In turn, The Oregonian’s motion for summary judg-

ment sought a judgment enjoining OHSU from withholding

the requested record and ordering its disclosure.

The circuit court issued a letter opinion and order

denying OHSU’s motion and granting The Oregonian’s

motion. The court ruled that the exemptions that OHSU

relied on with respect to patient claims did not apply

because disclosure of the requested record could lead to

the discovery of confidential information only if a listed

claimant was contacted and chose to divulge confidential

information. Further, the court determined that the other

exemptions that OHSU relied on were not available. The

circuit court then entered a general judgment requiring

OHSU to disclose the requested record; pursuant to ORS

192.490(3), the court also entered a supplemental judgment

for attorney fees, costs, and disbursements in favor of The

Oregonian.

OHSU appealed, arguing that the claimant names,

attorney names, and dates of the alleged torts that related

to patients were exempt from disclosure. In support of its

argument, OHSU relied on the HIPAA Privacy Rule, which

generally prohibits the disclosure of “protected health

information”; ORS 192.502(8), which exempts disclosures

Cite as 362 Or 68 (2017) 75

prohibited by federal law; ORS 192.558(1), which prohib-

its the unauthorized disclosure of protected health infor-

mation; ORS 192.502(9)(a), which exempts from disclosure

public records that are confidential; ORS 192.496(1), which

exempts certain records that contain information about the

physical or mental health or psychiatric care or treatment

of a living person if public disclosure would constitute an

unreasonable invasion of privacy; and ORS 192.502(2),

which exempts personal information if public disclosure

would constitute an unreasonable invasion of privacy. For

claims related to students, OHSU argued that the students’

names were protected under FERPA and therefore were

exempt from disclosure under ORS 192.502(8). OHSU also

argued that, if the Court of Appeals modified the judgment

ordering disclosure, an award of attorney fees would be

discretionary under ORS 192.490(3), and the supplement

judgment awarding fees should be remanded to determine

whether attorney fees should be awarded, and, if so, in what

amount.

In response, The Oregonian reiterated its position

that it was not seeking “protected health information” or edu-

cation records that are exempt from disclosure. According

to The Oregonian, if OHSU complied with its request, The

Oregonian would not receive any information regarding the

status of any claimant—including whether the claimant

was a patient or a student—or the nature or description of

any claim.

In its opinion, the Court of Appeals first noted that,

by its terms, the OPRL does not require a public body to

create new public records in response to a public records

request. OHSU v. Oregonian Publishing Co., LLC, 278 Or

App 189, 194 n 3, 373 P3d 1233 (2016). The court further

stated:

“The parties assume, as do we, that the question presented

in this case is whether the requested information (name of

claimant, date of the alleged tort, name of claimant’s attor-

ney) can be redacted from the tort claim public records that

could otherwise be provided to The Oregonian pursuant

to its demand and whether OHSU may disclose any of the

information in some of the tort claim notices. For purposes

76 OHSU v. Oregonian Publishing Co., LLC

of this case, the compilation of that information into a dif-

ferent public record does not change the issues that must

be resolved.”

Id.

In considering the application of HIPAA’s Privacy

Rule to patient claims, the Court of Appeals assumed for

the sake of its decision that the patients’ names, names of

the patients’ attorneys, and the dates of the alleged torts

in the tort claim notices constituted “protected health

information.” Id. at 201. The court noted, though, that the

Privacy Rule allows disclosure of protected health infor-

mation when disclosure is “required by law.” Id. (citing 45

CFR § 164.512(a)(1)). The court then concluded that, if the

requested record was not exempt from disclosure under

the OPRL, its disclosure would be “required by” the OPRL

and, therefore, allowed by the Privacy Rule. Id. at 202.

The court further reasoned that, if disclosure of protected

health information is allowed by the Privacy Rule because

it is otherwise “required by” the OPRL, then disclosure

is not “prohibited by federal law” under ORS 192.502(8).

Id. Because it concluded that the Privacy Rule and ORS

192.502(8) did not prohibit disclosure of the protected

health information in the tort claim notices, the Court of

Appeals opined that whether disclosure was prohibited

depended on whether an exemption from disclosure existed

under the OPRL for information about the physical or

mental health or psychiatric care or treatment of a living

individual, ORS 192.496(1), or personal information, ORS

192.502(2). Id.

Turning to the exemption in ORS 192.496(1),

the Court of Appeals explained that the determination

whether the requested record contained information about

the physical or mental health or psychiatric care or treat-

ment of a living individual and, if so, whether its disclo-

sure would constitute an unreasonable invasion of patient

privacy, necessarily would require examination of the

information contained in the tort claim notices. Id. at 206.

The court concluded that the circuit court had failed to

apply ORS 192.496(1) correctly; instead, the circuit court

had applied ORS 192.505—directing redacted disclosure

Cite as 362 Or 68 (2017) 77

in certain circumstances6 —and it had ordered OHSU to

disclose the nonexempt material. Id. at 204. In the Court

of Appeals’ view, ORS 192.505 does not apply to a claimed

exemption under ORS 192.496(1) because, on its face, ORS

192.505 applies only to records that contain both exempt

and nonexempt material under ORS 192.501 and 192.502,

and the record created by OHSU contains only nonexempt

material.7 Id. The Court of Appeals concluded that ORS

192.505 does not apply to exemptions that classify an

entire record as exempt from disclosure; rather, it applies

only to public record exemptions that classify information

in a record as exempt from disclosure. Id. at 205 (emphasis

in original). Because the circuit court had applied ORS

192.505 without reviewing the requested record to deter-

mine whether it was exempt from disclosure under ORS

192.496(1), the Court of Appeals concluded that the circuit

court had erred in granting The Oregonian’s motion for

summary judgment.8 Id. at 206. Accordingly, the Court of

Appeals reversed and remanded with regard to the patient

claims.

Similarly, the Court of Appeals concluded that, to

determine whether FERPA and ORS 192.502(8) prohib-

ited the disclosure of claimants’ names for student-related

claims, the circuit court was required to examine the tort

claim notices involving students to determine whether they

described and directly related to activities of a student or

the educational status of a student. Id. at 210-11. Because

the circuit court had not reviewed the tort claim notices, the

6

ORS 192.505 provides:

“If any public record contains material which is not exempt under ORS

192.501 and 192.502, as well as material which is exempt from disclosure,

the public body shall separate the exempt and nonexempt material and make

the nonexempt material available for examination.”

7

ORS 192.501 provides that certain public records, including trade secrets,

investigatory information compiled for criminal law purposes, and a personnel

discipline action and associated materials, as well as others, are exempt from dis-

closure unless the public interest requires disclosure in the particular instance.

ORS 192.502 exempts from disclosure public records made confidential under

Oregon law, the addresses of certain state employees and retirees, and other enu-

merated records.

8

In light of its resolution of the claimed exemption under ORS 192.496(1),

the Court of Appeals did not consider the personal information exemption under

ORS 192.502(2). OHSU, 278 Or App at 206.

78 OHSU v. Oregonian Publishing Co., LLC

Court of Appeals reversed and remanded with respect to the

student claims as well.9

We allowed review primarily to determine whether

the names of the claimants and their attorneys, and the

dates of the alleged torts, are exempt from disclosure as

(1) “protected health information” under HIPAA (and thus

unconditionally exempt from disclosure pursuant to ORS

192.502(8)); (2) protected health information that is con-

fidential under ORS 192.558(1) (and consequently exempt

from disclosure under ORS 192.502(9)(a)); (3) information

about the physical or mental health or psychiatric care or

treatment of a living individual that is exempt from dis-

closure under ORS 192.496(1); or (4) information of a per-

sonal nature that is exempt from disclosure under ORS

192.502(2).10 As noted, The Oregonian does not seek unre-

dacted copies of the tort claim notices themselves or specific

information about claimants’ health conditions, treatments,

or diagnoses.

II. ANALYSIS

A.  Standard of Review

On review of cross-motions for summary judgment,

we determine whether there are any disputed issues of mate-

rial fact and whether either party is entitled to judgment as

a matter of law. ORCP 47. We state the facts in the light

90

The Court of Appeals also reversed the supplemental judgment awarding

fees to The Oregonian on the ground that, on remand, The Oregonian may not be

entitled to those fees as a matter of right. Id. at 211 (citing ORS 192.490(3)).

10

After we allowed review, OHSU provided a spreadsheet to The Oregonian

that contained the requested information for which it did not claim an exemp-

tion, but with the information still at issue on review redacted pursuant to ORS

192.505. Specifically, for patient claims, the spreadsheet included the claim num-

ber, date of tort claim notice, and indicated whether the claim is open or closed.

For student claims, OHSU provided all the requested information except the

claimant name. For all other claims, the spreadsheet provided all the requested

information. The Oregonian rejected the spreadsheet on the ground that it did

not comply with the public records request that The Oregonian had made. In its

brief before this court, OHSU argues that, because the spreadsheet contains the

requested information for all claims other than patient claims and student claims,

The Oregonian no longer has any basis to argue that patient names cannot be dif-

ferentiated from other claimant names. At oral argument, The Oregonian argued

that, by submitting the spreadsheet, OHSU had strategically attempted to alter

the record in this case. Because of our disposition of the case, we do not address

that procedural issue.

Cite as 362 Or 68 (2017) 79

most favorable to the party against whom summary judg-

ment was granted—in this case, OHSU. See Double Eagle

Golf, Inc. v. City of Portland, 322 Or 604, 606, 910 P2d 1104

(1996).

B.  Overview

As noted, ORS 192.420(1) provides that “[e]very

person has a right to inspect any public record of a public

body in this state, except as otherwise expressly provided by

ORS 192.501 to 192.505.” A public record “includes any writ-

ing that contains information relating to the conduct of the

public’s business * * * prepared, owned, used or retained by

a public body regardless of physical form or characteristics.”

ORS 192.410(4)(a).11 Generally, disclosure of public records

is the presumption, and exemptions from disclosure are

narrowly construed and made on an individualized basis.

Guard Publishing Co. v. Lane County School Dist. No. 4J,

310 Or 32, 37, 791 P2d 854 (1990). The public body or agency

withholding a record has the burden “to sustain its action.”

ORS 192.490(1).

C.  Patient Claims

As noted, OHSU asserts that the claimant names,

attorney names, and dates of the alleged torts for patient

claims are “protected health information” that is shielded

from disclosure by both HIPAA and exemptions under

Oregon law. In contrast, The Oregonian has not addressed

any of the exemptions from disclosure under Oregon law

on which OHSU relies. Instead, The Oregonian primarily

has staked its position on the threshold proposition that

the requested record does not contain any protected health

information under HIPAA and, therefore, its disclosure is

required by ORS 192.420(1).12 The Oregonian asserts that

11

The 2017 Legislative Assembly renumbered subsection (4)(a) to subsection

(5)(a), effective January 1, 2018. Oregon Laws 2017, ch 456.

12

At oral argument, The Oregonian appeared to concede that, if the

requested record indicated that the claimants were patients, HIPPA’s protections

would be invoked. However, although The Oregonian asserts that the disposi-

tive issue is whether the requested record contains protected health information

under HIPAA, it also has generally adopted the Court of Appeals’ conclusion that,

even if the requested record contains protected health information under HIPAA,

its disclosure is not prohibited because of HIPAA’s “required by law” exemption,

45 CFR § 164.512(a)(1).

80 OHSU v. Oregonian Publishing Co., LLC

the Court of Appeals incorrectly determined that the tort

claim notices themselves were the public records at issue

instead of the requested record—a list that The Oregonian

argues is a different public record. The Oregonian argues

that its instructions to OHSU were to make sufficient redac-

tions from the tort claim notices such that the requested

record would not contain protected health information.

According to The Oregonian, providing claimant names,

attorney names, and dates of alleged torts would not iden-

tify any claimant as a patient or disclose any health infor-

mation that could implicate HIPAA’s protections.

As we now explain, we conclude that, in combination,

the requested record contained identifiers—including claim-

ant and attorney names, and dates of the alleged torts—that

constitute protected health information under HIPAA that

cannot be disclosed unless an exemption applies. Although

an exemption exists under HIPAA for disclosures “required

by law,” disclosure of the protected health information at

issue here is not required under ORS 192.420(1), the provi-

sion on which The Oregonian relies, because the unautho-

rized disclosure of protected health information is restricted

by ORS 192.558(1). Therefore, protected health information

is exempt from disclosure under ORS 192.502(9)(a). It fol-

lows that OHSU is not required to disclose claimant names,

attorney names, and dates of the alleged torts for patient

claims.

1.  Is the information at issue protected health

information?

We begin our analysis with the question whether

the information at issue constitutes protected health infor-

mation under HIPAA. Congress enacted HIPAA to “improve

the efficiency and effectiveness of the health care system

by facilitating the electronic exchange of information with

respect to financial and administrative transactions car-

ried out by health plans, health care clearinghouses, and

health care providers.” Standards for Privacy of Individually

Identifiable Health Information, 67 Fed Reg 14776-01,

14776 (Mar 27, 2002). In addition, HIPAA protects the pri-

vacy and confidentiality of health information. See 42 USC

§ 1320d-2. To advance those protections, Congress directed

Cite as 362 Or 68 (2017) 81

the Secretary of Health and Human Services to establish

regulations for implementing each of the standards adopted

by HIPAA. 42 USC § 1320d-1(d). The regulations that the

Secretary adopted relating to the electronic exchange of

health information and providing for the security and confi-

dentiality of those exchanges are known as the Privacy Rule.

See 45 CFR Parts 160 and 164. While HIPAA established

that disclosure of a person’s health information is a federal

offense, 42 USC § 1320d-6, the Privacy Rule described the

specific circumstances under which disclosure is permitted

and prohibited.

The Privacy Rule is animated by three major

purposes:

“(1) To protect and enhance the rights of consumers

by providing them access to their health information and

controlling the inappropriate use of that information;

(2) to improve the quality of health care in the U.S. by

restoring trust in the health care system among con-

sumers, health care professionals, and the multitude of

organizations and individuals committed to the delivery

of care; and (3) to improve the efficiency and effectiveness

of health care delivery by creating a national framework

for health privacy protection that builds on efforts by

states, health systems, and individual organizations and

individuals.”

Standards for Privacy of Individually Identifiable Health

Information, 65 Fed Reg 82462-01, 82463 (Dec 28, 2000).

In recognition that state laws concerning the confidentiality

and privacy of health information are not uniform or con-

sistent, the Privacy Rule established “a set of basic national

privacy standards” to provide “all Americans with a basic

level of protection.” Id. at 82464. The Privacy Rule sets a

ground floor of rules for health care providers, creating “a

framework of protection that can be strengthened by both

the federal government and by states as health information

systems continue to evolve.” Id.

Under HIPAA and the Privacy Rule, “protected

health information” is “individually identifiable health infor-

mation” that is transmitted or maintained in any form or

medium. 45 CFR § 160.103. “Individually identifiable health

82 OHSU v. Oregonian Publishing Co., LLC

information” is health information, including demographic

information, that:

“(1)  Is created or received by a health care provider,

health plan, employer, or health care clearinghouse; and

“(2)  Relates to the past, present, or future physical or

mental health or condition of an individual; the provision of

health care to an individual; or the past, present, or future

payment for the provision of health care to an individual;

and

“(i)  That identifies the individual; or

“(ii)  With respect to which there is a reasonable basis

to believe the information can be used to identify the

individual.”

Id. A covered entity may determine that health informa-

tion is not individually identifiable health information if

the name, address, all elements of dates, and certain other

identifiers relating to an individual are removed. 45 CFR

§ 164.514(b)(2)(i).

In light of those provisions, we conclude that the

requested record contains “protected health information”

under HIPAA and the Privacy Rule.13 In the absence of a

patient’s written authorization or a permissible purpose, the

disclosure of a patient’s name or the fact that she received

health services is prohibited under HIPAA and the Privacy

Rule. Breach Notification for Unsecured Protected Health

Information, 74 Fed Reg 42740-01, 42745 (Aug 24, 2009).

For such protected health information to lose HIPAA con-

fidentiality protections, HIPAA provides that 19 separate

identifiers must all be removed, including the very informa-

tion requested by The Oregonian here: patient names, all

elements of dates, and any other information that could be

used alone or in combination with other information to iden-

tify an individual as a patient. 45 CFR § 164.514(b)(2)(i).14

13

As noted, the definition of “individually identifiable health information”

is part of the definition of “protected health information.” For ease of reference,

and because “protected health information” is “individually identifiable health

information” that is transmitted or maintained in any form or medium, we refer

to “protected health information” from this point forward.

14

Indeed, under the Privacy Rule, a hospital must inform patients of the pro-

tected health information that may be included in a patient directory, including

Cite as 362 Or 68 (2017) 83

As noted above, The Oregonian remonstrates that

the requested record is a different public record from the

tort claim notices themselves and that, under its instruc-

tions to OHSU, sufficient information was redacted from the

tort claim notices such that the requested record would not

contain protected health information. The difficulty with

The Oregonian’s position is that, regardless of the form in

which the information that it sought was presented, that

information was not sufficiently redacted in the requested

record to lose its status as protected health information.15

Although The Oregonian instructed OHSU to

redact any unrequested information contained in the tort

claim notices in producing the requested record, it still

would have been a relatively straightforward exercise for

it to discern—from the requested information in combina-

tion—which of the claimants were health care patients, the

fact that they had received treatment, and the dates of their

treatment. In short, the patient identifiers would not be suf-

ficiently obscured as undifferentiated data in the requested

record to satisfy the privacy interests in protected health

information with which HIPAA and the Privacy Rule are

concerned. Nothing in HIPAA or the Privacy Rule indicates

that the creation by redaction of a document that still con-

tains such identifiers can somehow alter their status as pro-

tected health information. Accordingly, we conclude that

the requested record contains protected health information

under HIPAA.16

The question remains whether, despite its status as

protected health information, ORS 192.420(1) nonetheless

the patient’s name, and the persons to whom that information may be disclosed—

only clergy members and persons who specifically ask for the patient by name—

and provide the patient with the opportunity to prohibit or restrict such disclo-

sure. 45 CFR § 164.510(a).

15

The Oregonian has consistently pointed out that it has not sought the tort

claim notices themselves. But, as the Court of Appeals observed, “[f]or purposes

of this case, the compilation of [the information that The Oregonian seeks] into a

different public record does not change the issues that must be resolved.” OHSU,

278 Or App at 194 n 3.

16

Because The Oregonian has not separately analyzed the categories of

information that it requested in terms of whether those categories independently

qualify as protected health information, it is sufficient for us to conclude that,

in combination, the information contained in the requested record constitutes

protected health information.

84 OHSU v. Oregonian Publishing Co., LLC

requires the disclosure of that information. Although we

ultimately conclude that its disclosure is not required under

that statute, we first discuss the parties’ arguments under

HIPAA, which will provide a foundation for our discussion

of Oregon law.

2.  Prohibited disclosure under HIPAA and the “required

by law” exception

The Privacy Rule defines “disclosure” as “the

release, transfer, provision of access to, or divulging in

any manner of information outside the entity holding the

information.” 45 CFR § 160.103. A “covered entity” is pro-

hibited from disclosing protected health information unless

an exception applies.17 45 CFR § 164.502(a). Exceptions

include disclosure to the patient, disclosure with the

patient’s authorization, and disclosure when the protected

health information has been “de-identified”, among others.

See, e.g., 45 CFR § 164.502(a)(1)(i); 45 CFR § 164.508; 45

CFR § 164.502(d)(2).

As discussed, in concluding that disclosure of

the disputed information could be required, the Court of

Appeals relied on a HIPAA exception that allows a covered

entity to “use or disclose protected health information to

the extent that such use or disclosure is required by law

and the use or disclosure complies with and is limited to the

relevant requirements of such law.” 45 CFR § 164.512(a)(1).

“Required by law” refers to “a mandate contained in law

that compels an entity to make a use or disclosure of pro-

tected health information and that is enforceable in a court

of law” and includes “statutes or regulations that require

the production of information.” 45 CFR § 164.103.

The question then is whether the OPRL—in par-

ticular, ORS 192.420(1), the sole provision on which The

Oregonian relies—”requires” disclosure of the protected

health information at issue here. As amplified below, we

conclude that ORS 192.420(1) does not require disclosure

of the protected health information; to the contrary, we con-

clude that, in the absence of a law requiring its disclosure,

such disclosure is prohibited under Oregon law. To ground

17

The parties agree that OHSU is a covered entity.

Cite as 362 Or 68 (2017) 85

our discussion, we briefly explain HIPAA’s relationship to

state laws such as ORS 192.420(1) that generally require

the inspection of public records.

Where a conflict between HIPAA and state law

exists, HIPAA’s provisions “shall supersede any contrary

provision of State law.” 42 USC § 1320d-7(a). State laws that

provide “more stringent” privacy protections than HIPAA

affords are not superseded by HIPAA. 45 CFR § 160.203(b).

A state law is “contrary” to HIPAA and, thus, superseded by

HIPAA, if:

“(1)  A covered entity or business associate would find

it impossible to comply with both the State and Federal

requirements; or

“(2)  The provision of State law stands as an obstacle to

the accomplishment and execution of the full purposes and

objectives of [HIPAA].”

45 CFR § 160.202.

As noted, the Privacy Rule permits disclosure

of protected health information where such disclosure is

required by law. 45 CFR § 164.512(a)(1). The commentary

to the Privacy Rule states that many apparent conflicts

between HIPAA and other laws will not be true conflicts

because of the “required by law” exception. Standards for

Privacy of Individually Identifiable Health Information,

65 Fed Reg at 82481-82. As an example of the interaction

between HIPAA and other laws requiring disclosure of pro-

tected health information, the commentary states that the

Freedom of Information Act (FOIA), 5 USC § 552, provides

for public disclosure—upon the request of any person—of

many types of information possessed by the federal govern-

ment, subject to certain exceptions and exemptions. The

Privacy Rule commentary states that uses and disclosures

of protected health information required by FOIA fall within

the “required by law” exception. Standards for Privacy of

Individually Identifiable Health Information, 65 Fed Reg at

82482. The commentary further states that, in responding

to a FOIA request that includes protected health informa-

tion, a federal agency, when appropriate, must apply FOIA’s

Exemption 6, which “permits federal agencies to withhold

86 OHSU v. Oregonian Publishing Co., LLC

‘* * * medical files and similar files the disclosure of which

would constitute a clearly unwarranted invasion of personal

privacy.’ ” Id. (quoting 5 USC § 522(b)(6)). The commentary

ultimately observes: “We believe that generally a disclo-

sure of protected health information, when requested under

FOIA, would come within FOIA Exemption 6.” Id.

Following the guidance provided in the Privacy

Rule commentary, a covered entity responding to a public

records request often could comply with both HIPAA and

a law requiring disclosure of public records. In particu-

lar, under HIPAA’s “required by law” exception, a covered

entity might be required by a law such as ORS 192.420(1)

to disclose protected health information, thus complying

with both laws. However, if an exemption or exception to a

law such as ORS 192.420(1) exists, the covered entity must

consider that exemption or exception as part of its deter-

mination whether disclosure is required by law. See U.S.

Dep’t of Health & Human Services, FAQ (Aug 2004), avail-

able at https://www.hhs.gov/hipaa/for-professionals/faq/506/

how-does-the-hipaa-rule-relate-to-freedom-of-information-

laws/index.html (accessed Oct 10, 2017) (“For example, if a

state public records law includes an exemption that affords

a state agency discretion not to disclose medical or other

information where such disclosure would constitute a clearly

unwarranted invasion of personal privacy, the disclosure of

such records is not required by the public records law, and

therefore is not permissible under § 164.512(a).”).

In short, although particular circumstances could

require a different outcome, it generally is possible for a cov-

ered entity to comply both with HIPAA and a state law such

as ORS 192.420(1), after considering any applicable exemp-

tions or exceptions from disclosure under such a law. See

generally Abbott v. Texas Dept. of Mental Health & Mental

Retardation, 212 SW3d 648, 665 (Tex Ct App 2006) (state

public records law not superseded, because state agency

could comply with both state public records law and Privacy

Rule, as Privacy Rule allows disclosure of information at

issue under “required by law” exception). Accordingly, we

must determine whether Oregon law exempts the protected

health information at issue from disclosure under ORS

192.420(1).

Cite as 362 Or 68 (2017) 87

3.  Exemption from disclosure of protected health infor-

mation under Oregon law

As noted, a right to inspect public records is the rule

in Oregon, unless an exemption applies. See ORS 192.420(1)

(“Every person has a right to inspect any public record of

a public body in this state, except as otherwise expressly

provided by ORS 192.501 to 192.505.”). As we now explain,

we conclude that the protected health information at issue

is exempt from disclosure under ORS 192.502(9)(a) and that

its disclosure therefore is not “required” by ORS 192.420(1).

ORS 192.502(9)(a) exempts from disclosure under

ORS 192.410 to 192.505 “[p]ublic records or information

the disclosure of which is prohibited or restricted or other-

wise made confidential or privileged under Oregon law.”

ORS 192.553 to 192.581 does just that. It makes “protected

health information” confidential. ORS 192.553 provides, in

part:

“(1)  It is the policy of the State of Oregon that an indi-

vidual has:

“(a)  The right to have protected health informa-

tion of the individual safeguarded from unlawful use or

disclosure[.]”

“Protected health information” is defined by ORS 192.556

(11)(a) to mean:

“[I]ndividually identifiable health information that

is maintained or transmitted in any form of electronic or

other medium by a covered entity.”

ORS 192.556(8) defines “Individually identifiable health

information” as:

“any oral or written health information in any form or

medium that is:

“(a)  Created or received by a covered entity * * *; and

“(b)  Identifiable to an individual, including demo-

graphic information that identifies the individual, or for

which there is a reasonable basis to believe the information

can be used to identify an individual, and that relates to:

“(A)  The past, present or future physical or mental

health or condition of an individual; [or]

88 OHSU v. Oregonian Publishing Co., LLC

“(B)  The provision of health care to an individual[.]”

Those definitions are substantively comparable to the defi-

nitions of “protected health information” and “individu-

ally identifiable health information” under HIPAA and the

Privacy Rule, and The Oregonian does not contend other-

wise.18 Based on our analysis under HIPAA, we therefore

conclude that the information at issue here also is “protected

health information” for purposes of ORS 192.556(11)(a).

ORS 192.558(1) generally permits the disclosure of

a person’s protected health information only “in a manner

that is consistent with an authorization provided by the indi-

vidual or a personal representative of the individual.”19 The

OPRL reinforces the prohibition against unauthorized dis-

closure of protected health information in ORS 192.558(1)

by providing an unconditional exemption for information

protected by state law. In particular, ORS 192.502(9)(a)

provides that “[p]ublic records or information the disclosure

of which is prohibited or restricted or otherwise made con-

fidential or privileged under Oregon law,” are exempt from

disclosure under the OPRL.

The legislative history of ORS 192.553 to ORS

192.558 is consistent with the foregoing analysis.20 Before

those provisions were enacted in 2003, Oregon law provided:

“[I]t is the policy of the State of Oregon to protect both

the rights of an individual to have the medical history of

the individual protected from disclosure to persons other

18

In symmetry with HIPAA, ORS 192.553(2) provides that,

“[i]n addition to the rights and obligations expressed in ORS 192.553 to

192.581, [HIPAA] establish[es] additional rights and obligations regarding

the use and disclosure of protected health information and the rights of indi-

viduals regarding the protected health information of the individual.”

(Emphasis added.)

19

ORS 192.558(2)(a) and (3) contain specific exceptions to the prohibition

in ORS 192.558(1) against unauthorized disclosures of protected health infor-

mation. Specifically, ORS 192.558(2)(a) allows disclosure “[f]or the provider’s

or plan’s own treatment, payment or health care operations.” In addition, ORS

192.558(2)(b) allows disclosure “[a]s otherwise permitted or required by state or

federal law or by order of the court.” The Oregonian does not assert that any of

those exceptions apply in this instance and therefore we need not address them.

20

ORS 192.553 to 192.558 were enacted by Oregon Laws 2003, chapter 86,

sections 1 to 3, and codified as former ORS 192.518 to 192.520 (2003). The stat-

utes were renumbered in 2011.

Cite as 362 Or 68 (2017) 89

than the health care provider and insurer of the individual

who needs such information * * *. It is recognized that both

rights may be limited, but only to benefit the patient. These

rights of confidentiality and full access must be protected

by private and public institutions providing health care

services * * *. The State of Oregon commits itself to fulfill-

ing the objectives of this public policy for public providers

of health care.”

Former ORS 192.525(1) (2001), repealed by Or Laws 2003,

ch 86, § 8. The proponents of the 2003 legislation were

members of an interim legislative committee that had been

tasked with reviewing (and revising as appropriate) Oregon

privacy laws to ensure their consistency with federal law

before the effective date of HIPAA in 2003. The commit-

tee members emphasized that the intent of the legislation

was to maintain the existing policy of protecting the confi-

dentiality of patient medical records set out in former ORS

192.525 (2001), while harmonizing Oregon’s statutory pol-

icy and terminology with HIPAA. As Representative Max

Williams explained on the House floor:

“The HIPAA privacy regulations provide new protection

for the use and disclosure of patient health information by

health care providers and insurers. They also enact addi-

tional patient rights regarding access to information about

their health care and their health information. HIPAA

regulations are extensive and complex. And they preempt

Oregon law to the extent that Oregon law is contrary to the

federal law. It is this preemption issue that brings HB 2305

before you today. HB 2305 is the product of the advisory

committee on privacy of medical information and records.

A committee that was created by the 2001 Legislative

Assembly * * *.

“It was the goal of the committee to change only those

Oregon statutes that must be changed in light of HIPAA

and to preserve existing Oregon public policy as much as

possible. * * * HB 2305 repeals ORS 192.525 and replaces

it with new provisions that reflect existing Oregon policy

and the new HIPAA privacy regulations. ORS 192.525 is

the core confidentiality statute in Oregon for health care

providers. It governs what disclosure providers can make of

health information. Unfortunately, HIPAA contradicts the

current ORS 192.525. The Oregon law uses terms that do

not make sense after the enactment of HIPAA and contains

90 OHSU v. Oregonian Publishing Co., LLC

an authorization form that does not comply with specific

HIPAA authorization requirements. Because of these prob-

lems, the committee concluded that ORS 192.525 should be

repealed. However, to avoid a vacuum in Oregon medical

confidentiality law, the committee recommended replace-

ment of 192.525 with a new provision intended to serve

much the same purpose as the original statute but in con-

formity with HIPAA. The new statute draws on an existing

policy and the HIPAA privacy regulations to create a new

core patient confidentiality law in Oregon.”

Audio Recording, House Chamber, HB 2305, Mar 17, 2003,

at 27:42 (statement of Rep Max Williams), https://www.ore-

gonlegislature.gov/citizen_engagement/Pages/Legislative-

Video.aspx (accessed Oct 10, 2017).

Other statements made by interim committee mem-

bers reinforced Representative Williams’ comments, includ-

ing those of former Senator Neil Bryant:

“The [interim committee] focused on the privacy aspects

of HIPAA. As many of you know, Oregon has a long his-

tory of protecting privacy and personal information, but we

wanted to ensure that Oregon law would not conflict or be

preempted by federal law and the HIPAA rules.”

Testimony, House Judiciary Committee, HB 2305, Feb 18,

2003, Ex A (statement of former Sen Neil Bryant).21

21

Gwen Dayton, an interim committee member, similarly commented:

“Essentially when we looked for HIPAA preemption, we looked for Oregon

laws that implicated the release of protected health information in a way that

was * * * contrary to HIPAA, meaning that providers and other entities cov-

ered by HIPAA would not be able to comply with both state law and federal

law or state law posed a substantial barrier or obstacle to effective implemen-

tation of HIPAA. * * *.

“The guts of ORS 192.525 is really sub-one, which is a policy statement

about confidentiality of medical records in Oregon. And that section is not

completely preempted, but rather it uses terms that are inconsistent with

HIPAA, that are confusing after implementation of HIPAA, that simply just

don’t make a lot of sense. And there are certain provisions that are flat out

contrary to HIPAA. As you go through the rest of 192.525, you have similar

problems. Confusing use of terminology. The model authorization form that

is contained in the existing statute simply does not comply with HIPAA. * * *

There are other sub-sections of the statute that are preempted because they

refer to this inappropriate authorization form. Others have problems simply

because of the continuing confusing use of terms that just don’t make a lot of

sense.

“So those of us who looked at this statute felt that there was enough of it

that could not be saved that a more effective way of dealing with it would be

Cite as 362 Or 68 (2017) 91

Considering that ORS 192.502(9) exempted infor-

mation protected as confidential under state law from dis-

closure under the OPRL before the enactment of the 2003

legislation, it is likely that HB 2305—with its stated intent

to maintain the confidentiality of protected health informa-

tion with the additional protections of HIPAA—retained the

confidentiality protections for such information that exempt

it from the disclosure requirement set out in ORS 192.420(1).

In sum, we conclude that ORS 192.556(11)(a) des-

ignates the information at issue here as protected health

information, and, subject to certain exceptions that do not

apply here, ORS 192.558(1) prohibits its disclosure with-

out a patient’s written authorization. ORS 192.502(9)(a),

in turn, exempts that information from disclosure under

ORS 192.420(1) because its disclosure is restricted by ORS

192.558(1).22

D.  Student Claims

We briefly turn to the claims filed by students. As

noted, OHSU declined to disclose the names of student

claimants in tort claim notices related to their education,

to simply repeal it and rewrite it. We want to maintain the effect of 192.525.

We don’t want to leave a vacuum in Oregon law, but we want to replace it

with something that does what 192.525 did but also implements HIPAA at

the same time. * * * [W]e considered many options in replacing 192.525. Some

states have actually rewritten HIPAA into state law—hook, line, and sinker.

We considered that and decided against it because we were concerned that if

we didn’t get every comma correct—every word correct—there would be an

implied difference and we would be setting ourselves up for endless litigation

about what we were trying to do in Oregon versus what the feds were doing.

* * *.”

Audio Recording, House Judiciary Committee, HB 2305, Feb 18, 2003, at 17:12

(statement of Gwen Dayton), https://www.oregonlegislature.gov/citizen_engage-

ment/Pages/Legislative-Video.aspx (accessed Oct 10, 2017).

22

In so concluding, we need not consider whether, in different circumstances,

a provision of law other than ORS 192.420(1) could require the disclosure of

protected health information. Further, in light of our resolution of the patient

records issue, we also need not consider the additional arguments of the parties—

and amicus curiae, the State of Oregon, through the attorney general’s—regard-

ing the patient claims, including whether the information at issue is exempt from

disclosure under ORS 192.502(2) or ORS 192.496(1), and whether the Court of

Appeals erred by holding that ORS 192.505 does not apply to ORS 192.496(1);

that ORS 192.505 applies only to exemptions that classify information within

a record as exempt, rather than to exemptions that classify an entire record as

exempt; and that ORS 192.496(1) is an exemption to the disclosure requirements

of the OPRL.

92 OHSU v. Oregonian Publishing Co., LLC

asserting that disclosure of that information was prohib-

ited under FERPA and state law. The Oregonian, however,

argues that the requested record would not identify any

claimant as a student or disclose any student education

records that would implicate FERPA. The Oregonian also

asserts, albeit with scant citation to authority, that a tort

claim notice is not an “education record” and that its dis-

closure is not prohibited in this case because the requested

information is not maintained or located in a place that is a

repository of education records. Accordingly, The Oregonian

argues that the exemption under ORS 192.502(8) for disclo-

sure prohibited by federal law does not apply.

OHSU counters that disclosure of a student’s name,

particularly in the context of a tort claim notice, would con-

vey significant information about the student: namely, that

the student has claimed a compensable injury related to their

education. That information, OHSU argues, is protected

by FERPA’s prohibition against disclosing private records

directly related to a student. Moreover, OHSU asserts,

FERPA does not prescribe any specific location within an

institution where a record must be maintained for it to be

deemed an “education record.”

Although, on the surface, the parties’ arguments

would appear to present significant issues under FERPA,

we conclude that those arguments are not sufficiently devel-

oped for this court to make an informed decision. In par-

ticular, although The Oregonian asserts that disclosure of

education records is not prohibited by FERPA, it has not

analyzed the issue in any detail.23 Nor has The Oregonian

meaningfully addressed FERPA’s definition of “education

records.” Overall, both parties’ arguments about the stu-

dent records are cursory, consisting of a combined total of

only six paragraphs in more than 80 pages of briefing. In

short, in the absence of adequately developed arguments,

we decline to consider whether the tort claim notices filed

by students are “education records” under FERPA and pro-

hibited from disclosure. We therefore leave undisturbed the

23

A brief review discloses that “state and federal courts are sharply divided

on this issue.” See Caledonian-Record Publ’g Co. v. Vt. State Coll., 175 Vt 438, 441-

42, 833 A2d 1273, 1275-76 (2003) (citing cases). The parties have failed to discuss

those authorities.

Cite as 362 Or 68 (2017) 93

Court of Appeals’ disposition of that issue which, to reiter-

ate, was to remand it to the circuit court to examine the tort

claim notices involving students to determine whether they

described and directly related to activities of a student or

the educational status of a student. OHSU, 278 Or App at

210-11.

III. CONCLUSION

To summarize: The Oregonian’s public records

request sought information derived from tort claim notices

received by OHSU. For patient claims, the requested record

contained identifiers—including claimant and attorney

names, and dates of the alleged torts—that, in combination,

constitute protected health information under HIPAA that

cannot be disclosed unless an exemption applies. An exemp-

tion exists under HIPAA for disclosures “required by law.”

However, disclosure of the protected health information at

issue in this case is not required under ORS 192.420(1),

the provision on which The Oregonian relies, because ORS

192.558(1) restricts its unauthorized disclosure. Therefore,

it is exempt under ORS 192.502(9)(a) from disclosure pursu-

ant to ORS 192.420(1). It follows that OHSU is not required

to disclose claimant names, attorney names, and dates of

the alleged torts for patient claims.

With respect to the student claims, the parties

have not adequately developed their arguments concern-

ing whether the tort claim notices are “education records”

under FERPA, and, if they are, whether FERPA prohibits

disclosure of the claimants’ names. Accordingly, we decline

to address that issue.

The decision of the Court of Appeals is reversed in

part and affirmed in part. The judgment of the circuit court

and the supplemental judgment awarding attorney fees

and costs to The Oregonian are reversed, and the case is

remanded to the circuit court for further proceedings.