Opinion Library

To return to this list after selecting an opinion, click on the "View entire list" link above the opinion title.

RSS feed

Advisory Opinion 96-014

March 29, 1996; City of Virginia

3/29/1996 10:14:43 AM

This is an opinion of the Commissioner of Administration issued pursuant to section 13.072 of Minnesota Statutes, Chapter 13 - the Minnesota Government Data Practices Act. It is based on the facts and information available to the Commissioner as described below.

Facts and Procedural History:

For purposes of simplification, the information presented by the citizen who requested this opinion and the response from the government entity with which the citizen disagrees are presented in summary form. Copies of the complete submissions are on file at the offices of PIPA and, unless classified as not public, are available for public access.

On February 8, 1996, PIPA received two letters, dated February 5 and 6, 1996, from Peter J. Nickitas, an attorney representing Conchetta Wiedenhoft. In his letters, Mr. Nickitas requested that the Commissioner issue an advisory opinion regarding Ms. Wiedenhoft's access to certain data maintained by the City of Virginia, hereinafter City, and the collection of certain data about Ms. Wiedenhoft by the City.

In response to Mr. Nickitas' request, PIPA, on behalf of the Commissioner, wrote to Nicholas Dragisich, Administrator of the City. The purposes of this letter, dated February 14, 1996, were to inform Mr. Dragisich of Mr. Nickitas' request, to ask him or the City's attorney to provide information or support for the City's position, and to inform him of the date by which the Commissioner was required to issue this opinion. On February 26, 1996, PIPA received a faxed response from Thomas Butorac, Attorney for the City.

(Mr. Nickitas attached copies of several documents to his opinion request. One is a copy of his request, dated January 17, 1996, to the City. Another is a copy of a letter dated January 29, 1996, from Mr. Butorac to Mr. Nickitas in which Mr. Butorac stated that because Ms. Wiedenhoft's file was quite large, Mr. Nickitas might wish to view the file to determine if, indeed, Ms. Wiedenhoft desired copies of all the documents. Another is Mr. Nickitas' January 30, 1996, response to Mr. Butorac that Ms. Wiedenhoft still desired copies of all requested data. An additional document is a copy of a letter dated February 1, 1996, from the City to Mr. Nickitas which apparently was attached to the copies of Ms. Wiedenhoft's personnel and medical files when they were sent to Mr. Nickitas.)

A summary of the facts surrounding this matter is as follows. In his February 5, 1996, letter, Mr. Nickitas stated that his client, Ms. Wiedenhoft, is employed by the City at the Virginia Regional

Medical Center Convalescent Center, hereinafter VRMC. Mr. Nickitas discussed that he, on behalf of Ms. Wiedenhoft, made a request for access to data about Ms. Wiedenhoft. Mr. Nickitas wrote, The Data Practices Act request went unfulfilled as of 29 January 1996.

Mr. Nickitas also raised an issue about the City's charge for copying the data. (After formulating the issues to be addressed in this opinion, and sending a copy of those issues to the City for comment, the Commissioner determined that Mr. Nickitas had actually raised a different issue relating to the copying charges. However, because the City responded to the issue as it was formulated by the Commissioner, and because Mr. Nickitas received a copy of the same issues, this opinion will address the issue as it was formulated by the Commissioner, i.e., whether a copy charge of $.25 per page represents the actual costs, pursuant to Minnesota Statutes Section 13.04, subdivision 4, for copying government data.)

In his February 5, 1996, letter Mr. Nickitas also stated, Ms. Wiedenhoft discovered a file in her former supervisor's office that contained her medical excuse slips...The slips remained in a folder, in an unlocked drawer, available to employees with no need to know of [the information contained in the medical excuse slips].

In addition, Mr. Nickitas asserted that Ms. Wiedenhoft did not receive a Tennessen Warning notice when she was asked by the City to provide data regarding the diagnosis and prognosis of her medical condition.

In his February 6, 1996, letter, Mr. Nickitas noted that he had received, from the City, 569 pieces of paper which are copies from Ms. Wiedenhoft's personnel and medical files and files from the Convalescent Care Center Administrator's office. Mr. Nickitas stated, The Medical Center never requested an extension under Minn. Stat. section 13.04, subd. 3. It would appear that its answer remains untimely.

In his response to Mr. Nickitas' concern regarding a timely response by the City, Mr. Butorac wrote:

In reviewing Mr. Nickitas' request, VRMC was unsure as to whether Mr. Nickitas wanted Ms. Weidenhoft's [sic] entire personnel file copied which is quite lengthy as Ms. Weidenhoft [sic] has been a longtime employee of VRMC....The purpose of my letter to Mr. Nickitas was to inform him of the copying charges and to find out if he wanted to review the file himself or have his client review it and have copies made of what he needed, or if he wanted a copy of the entire file. The purpose of our inquiry was merely to be helpful to Mr. Nickitas and save his client copying expenses. If there was a technical violation of the statute there was no intent by VRMC or its employees to prohibit Ms. Weidenhoft [sic] from reviewing her file....As soon as VRMC became aware of the fact that Mr. Nickitas wanted the entire file copied it was promptly copied and sent to him [on] February 1, 1996.

With regards to the copying charge, Mr. Butorac wrote that the VRMC's policy for copying documents within the control of the hospital is $.25 per page.

With regards to the issue of data security, Mr. Butorac stated that VRMC takes seriously its obligation under Chapter 13 to protect individual data. He wrote, VRMC keeps individual data only accessible to authorized personnel of the hospital. If there were medical slips of Ms. Weidenhoft [sic] in her supervisor's desk, this is not the usual and customary rule for personnel data....

With regards to whether the City is required to provide a Tennessen Warning notice when collecting data about an individual from that individual, Mr. Butorac wrote:

The Human Services Director sent Ms. Weidenhoft [sic] a letter asking for the above information....Ms. Weidenhoft [sic] called the Human Services Director stating that she needed a Tennessen Warning before she would provide any information....VRMC provided the Tennessen Warning before any medical information was provided. At this time Ms. Weidenhoft [sic] has not provided any information pursuant to the request; we are waiting for compliance.

Issues:

In his request for an opinion, Mr. Nickitas asked the Commissioner to address the following issues:

Has the City of Virginia complied with the requirements of Minnesota Statutes Section 13.04, subdivision 3, regarding access to data by a data subject?
Does a copy charge of $.25 per page represent the actual costs, pursuant to Section 13.04, subdivision 3, for copying government data?
What is a government entity's obligation, pursuant to Chapter 13, regarding protection of data on individuals?
Is the City of Virginia required, pursuant to Section 13.04, subdivision 2, to provide a Tennessen Warning notice to an individual upon the City's collection of health insurance/medical data about that individual from that individual?

Discussion:

Before directly addressing the issues raised by Mr. Nickitas, it should be noted that pursuant to Minnesota Statutes Section 13.01, the City is subject to the requirements of Chapter 13, the Minnesota Government Data Practices Act.

The first issue to be addressed in this opinion is whether the City has complied with the requirements of Section 13.04, subdivision 3, in responding to Mr. Nickitas' request for access to data about Ms. Wiedenhoft. Pursuant to Section 13.04, subdivision 3, if immediate compliance is not possible, a government entity must provide a data subject with access to the public and private data it maintains about that individual within five working days (excluding Saturdays, Sundays, and legal holidays) of the date of the request. However, upon notice to the individual, the government entity may have an additional five days (excluding Saturdays, Sundays, and legal holidays) within which to comply with the request.

In the current situation, it appears there is no dispute that Mr. Nickitas made a request for access to data in a letter dated January 17, 1996. However, because the Commissioner received no documentation as to when the City received Mr. Nickitas' request or when Mr. Nickitas received the copies of data about Ms. Wiedenhoft, it is difficult for the Commissioner to make a determination as to whether the City's response did or did not fall within ten days of the City's receipt of the request. The Commissioner knows only the following: that Mr. Nickitas requested the data in a letter dated January 17, 1996; that Mr. Nickitas informed the Commissioner, in a letter dated February 6, 1996, that he had received the requested copies; that Mr. Butorac stated the copies were sent to [Mr. Nickitas] on February 1, 1996; and that the letter from Stephen Roskoski, Human Resources Manager for VRMC, which apparently was attached to the copies of the data about Ms. Wiedenhoft, is dated February 1, 1996.

Therefore, if the City received the request on January 18, 1996, and if the City were in compliance with Chapter 13, Mr. Nickitas should have received copies of the data by February 1, 1996. Or, if the City received the request on January 19, 1996, Mr. Nickitas should have received copies of the data by February 2, 1996. Or, if the City received the request on January 22, 1996, Mr. Nickitas should have received copies of the data by February 5, 1996. Although the Commissioner is unable to make an express determination regarding this issue, it does appear that the City made a reasonable attempt to respond within the statutory time frame.

Mr. Butorac's written attempt to ascertain whether Ms. Wiedenhoft did, indeed, wish to have her entire file copied was certainly appropriate, especially given the large number of documents that were contained within that file. In fact, it would have been suitable for the City to require pre-payment of the copying fee. One potential difficulty of attempting written, as opposed to verbal or faxed, clarification (on either the part of the citizen or the government entity) is that the government entity may have greater difficulty meeting the ten day statutory deadline. However, in the present situation, Mr. Butorac's January 29, 1996, letter does not appear to have placed the City's response in jeopardy of being untimely.

Finally, pursuant to Section 13.04, subdivision 3, the City should have indicated to Mr. Nickitas that it intended to take the additional five days to respond to Mr. Nickitas' request. While Mr. Butorac's January 29, 1996, letter might be so interpreted, pursuant to the statutory language, Mr. Butorac should have stated explicitly the City's intention to take the additional five days.

The second issue to be addressed in this opinion is whether a copy charge of $.25 per page represents the actual costs, pursuant to Section 13.04, subdivision 3, for copying government data. In relevant part, subdivision 3 of Section 13.04 states, The responsible authority shall provide copies of the private or public data upon request by the individual subject of the data. The responsible authority may require the requesting person to pay the actual costs of making, certifying, and compiling the copies.

In the February 1, 1996, letter, which apparently was attached to the copies of the data about Ms. Wiedenhoft's files, Mr. Roskoski wrote, As per your request of January 17, 1996, enclosed please find copies of Ms. Wiedenhoft's personnel and medical files. There are

464

copies from Ms. Wiedenhoft's personnel and medical files and

105

copies from the VCC, Administrator's office. Please issue payment to the Medical Center in the amount of

$142.25

for a total of

569

copies at

$.25

per copy.

Mr. Butorac stated that the $.25 per page charge was arrived at by the Hospital Commission taking into account cost of making, certifying and compiling the copies. Mr. Butorac further wrote, VRMC believes this is not excessive in that it takes into account all of its cost in producing the copies.

On its face, a copy charge of $.25 per page does not seem unreasonable. However, such a charge is statutorily permissible onlyif it is the true cost incurred by the City in making, certifying, and compiling each copy. Because the City did not include any documentation indicating how the $.25 per page cost was calculated, the Commissioner is unable to determine if such a charge is appropriate. If the City is able to demonstrate that the $.25 per page charge complies with the language of Section 13.04, subdivision 3, then such a charge is appropriate. If the City cannot so demonstrate, then the charge is not appropriate. It is also unclear whether Mr. Nickitas desired certified copies. Perhaps if he did not, and this had been communicated to or ascertained by the City, the cost per copy would have been less.

The third issue to be addressed in this opinion regards a government entity's obligation, pursuant to Chapter 13, regarding protection of data on individuals. Pursuant to Section 13.05, subdivision 5, government entities are required to establish appropriate security safeguards for all records containing data on individuals. In addition, subdivision 5, of Section 13.05, requires that government entities establish procedures to insure that all data on individuals are accurate, complete, and current.

In his opinion request, Mr. Nickitas stated, Ms. Wiedenhoft discovered a file in her former supervisor's office that contained her medical excuse slips...The slips remained in a folder, in an unlocked drawer, available to employees with no need to know of [the information contained in the medical excuse slips]. Further on this point, in his January 30, 1996, letter to Mr. Butorac, Mr. Nickitas wrote, She has particular concern for the Medical Center's practice of keeping her medical file with her personnel file, its practice of leaving her medical data in an unlocked, unsecured location accessible to those without a need to know....

In his response, Mr. Butorac wrote:

VRMC has an obligation under Chapter 13 of Minnesota Statutes to protect every individual's data which is collected and stored at the hospital. VRMC takes this obligation very seriously. Documents collected on individual personnel of the hospital are kept in a separate area of the hospital. Only hospital employees involved with personnel matters and their immediate supervisors have access to these records. The incident that Ms. Weidenhoft [sic] is referring to is an isolated incident. It is true that her immediate supervisor may have copies of her medical excuse but those copies may be kept by the supervisor in her desk to be readily accessible to the supervisor. If this file had been kept by the supervisor in plain view possibly an argument could be made that VRMC was remiss in its duties to protect the data but this was not the case. VRMC has an obligation to keep the data private and confidential but the obligation must be reasonable. A supervisor having medical slips of an employee under her control in her desk does not violate this obligation.

From Mr. Nickitas' letters, it is not clear if Ms. Wiedenhoft is concerned about a single incident in which she apparently found her medical excuse slips in an unlocked drawer or whether her concern is about ongoing practices at VRMC. From Mr. Butorac's letter, it appears he believes her concern to be directed toward an isolated incident. Regardless, given the sensitive nature of the data, VRMC would be better able to meet its statutory obligations regarding the safeguarding of data on individuals, if those data were kept in locked drawers or locked offices.

(It is unclear to the Commissioner how Ms. Wiedenhoft came to find her medical excuse slips in her supervisor's desk. However, the Commissioner wishes to make clear that nothing in this opinion is meant to condone Ms. Wiedenhoft's actions if she obtained the data in an inappropriate fashion.)

The fourth issue raised by Mr. Nickitas is whether the City is required, pursuant to Section 13.04, subdivision 2, to provide a Tennessen Warning notice upon its collection of medical/insurance data about Ms. Wiedenhoft from Ms. Wiedenhoft. Subdivision 2 of Section 13.04 states:

An individual asked to supply private or confidential data concerning the individual shall be informed of: (a) the purpose and intended use of the requested data within the collecting state agency, political subdivision, or statewide system; (b) whether the individual may refuse or is legally required to supply the requested data; (c) any known consequence arising from supplying or refusing to supply private or confidential data; and (d) the identity of other persons or entities authorized by state or federal law to receive the data.

(It should be noted there does not appear to be any dispute that, in this case, the data requested of Ms. Wiedenhoft would, had she supplied them, have been classified as either private or confidential data.)

According to Mr. Nickitas, Ms. Wiedenhoft received a request for medical data pursuant to a...review of VRMC's health insurance payments for employees who have availed themselves of over $5,000.00 in health care. Also according to Mr. Nickitas, This request included no advisory pursuant to the Data Practices Act....The facts of the matter indicate with no question at all that if Ms. Wiedenhoft did not demand a 'Tennessen Advisory' of her superiors before providing the data, she would have received no advisory at all.

In his response, Mr. Butorac wrote:

The Human Services Director sent Ms. Weidenhoft [sic] a letter asking for the [medical insurance] information. He also talked to Ms. Weidenhoft [sic] about the requested medical data. Ms. Weidenhoft [sic] called the Human Services Director stating that she needed a Tennessen Warning before she would provide any information....VRMC provided the Tennessen Warning before any medical information was provided. At this time Ms. Weidenhoft [sic] has not provided any information pursuant to the request; we are waiting for her compliance.

While Mr. Butorac may be technically correct in stating that Ms. Wiedenhoft has not suffered damages because she has not provided the requested data, Mr. Butorac's argument does not negate the fact that the City is required to administer a Tennessen Warning any time private data is requested from Ms. Wiedenhoft. Chapter 13 is clear that the onus of providing the Tennessen Warning notice falls on the government entity; the individual asked to provide the private or confidential data should not have to request that they be given the notice.

Opinion:

Based on the correspondence in this matter, my opinion on the issues raised by Mr. Nickitas is as follows:

Based on the information provided by the City of Virginia and by Mr. Nickitas, the Commissioner is unable to determine, with exactitude, if the City complied with the requirements of Minnesota Statutes Section 13.04, subdivision 3, regarding access to data by a data subject.
Based on the information provided by the City and Mr. Nickitas, the Commissioner is unable to determine whether a copy charge of $.25 per page represents the actual costs, pursuant to Section 13.04, subdivision 3, for copying government data.
Pursuant to Section 13.05, subdivision 5, government entities are required to establish appropriate security safeguards for all records containing data on individuals. In addition, subdivision 5, of Section 13.05, requires that government entities establish procedures to insure that all data on individuals are accurate, complete, and current.
Yes. The City is required, pursuant to Section 13.04, subdivision 2, to provide a Tennessen Warning notice to an individual upon the City's collection of health insurance/medical data about that individual from that individual.

Signed:

Elaine S. Hansen
Commissioner

Dated: March 29, 1996

Data subjects

Educational data

Tennessen warning

Complete and current 13.05

Security safeguards (13.05, subd. 5)

Tennessen warning notice (13.04, subd. 2)