AGO Opinion 04018
Release of Information on Death Certificates; HIPAA
SUBJECT: Release of Information on Death Certificates; HIPAA
REQUESTED BY: Stephan B. Curtiss, Director Department of Health and Human Services, Finance & Support
WRITTEN BY: Jon Bruning, Attorney General
Lynn A. Melson, Assistant Attorney General
You have requested our opinion on certain issues relating to a request for access to death certificates of certain persons whose names are not known to the requestor. A news organization has requested certain death certificates from the Vital Records Section of the Department based on the decedents’ cause of death as identified in a Vital Statistics Report issued in 2002. Your specific questions are as follows:
1. Is the Department required to supply the death certificates identified through cause of death by statistical category for farm fatalities and accidental poisonings?
2. Does HIPAA in any way restrict the cause of death information from being disclosed as a part of a public record?
3. Would there be sufficient statutory authority to prevent the Department from supplying a person’s death certificate when the cause of death lists a communicable disease?
By way of background, our office has previously concluded that “birth and death records must be made available to the public in the same fashion as other public records.” Op. Att’y Gen. No. 90039 (November 20, 1990). The purpose of the Nebraska public records statutes is clear. It is intended that all documents of public bodies be public records unless another statute expressly provides otherwise (Neb. Rev. Stat. § 84-712.01) or unless those documents fall within one of the exceptions codified at Neb. Rev. Stat. § 84-712.05 which permits the custodian to keep certain records confidential. “Under Neb. Rev. Stat. § 84-712.05(2), certain medical records may be withheld from the public. However, this section specifically excludes records of births and deaths from those medical records which may be withheld. Consequently, under Nebraska’s public records statutes, birth and death records are public records which specifically may not be withheld from the public unless there is some other statutory provision which prevents their disclosure.” Op. Att’y Gen. No. 91004 (January 25, 1991).
Since the issuance of the opinions cited above, Neb. Rev. Stat. § 71-612(1) was amended to provide for two methods of access to vital records. The department shall supply a certified copy of a vital record to any applicant for any proper purpose. The department shall also now supply a copy of a public vital record for viewing purposes at its office. Laws 1992, LB 1019 § 50. It is § 71-612(1) which likely governs access to public vital records. There is a rule of statutory construction that a specific statute prevails over a general statute. State ex rel. Stenberg v. Murphy, 247 Neb. 358, 527 N.W. 2d 185 (1995).
Your first question is whether the Department is required to supply the death certificates identified through cause of death by statistical category for farm fatalities and accidental poisonings. You have informed us that an annual report is published by the Health and Human Services System which lists statistical data of vital events including deaths. The statistics are compiled from records filed with the Vital Records Section, including certificates of death. Neb. Rev. Stat. § 71-605(1) provides that the standard certificate of death shall include a statement of the cause of death and the forms adopted by the Department contain space for immediate and related causes of death.
None of the information contained in the annual Vital Statistics Report identifies any individual by name. A reporter has requested “the death certificates for the 20 deaths listed in the Nebraska HHS Vital Statistics Report as 2002 farm fatalities” and “the death certificates for the 32 deaths listed in the Nebraska HHS Vital Statistics Report as 2002 accidental poisonings.” In our view, the reporter has provided sufficient information to enable the Department to locate the certificates requested. Our office has previously stated that Neb. Rev. Stat. § 84-712 does not require a public agency to create lists or documents which do not otherwise exist or to answer questions for the public. Op. Att’y Gen. No. 94092. However, if the documents exist they should be provided as long as the requestor provides sufficient information to enable the agency to locate them. We note that there may be certain information on a certificate of death which is not public information and which should be redacted. Examples are Social Security numbers and certain information designated as being for health data and statistical research which information is made confidential pursuant to Neb. Rev. Stat. § 71-602(2).
Your second question is whether HIPAA in any way restricts the cause of death information from being disclosed as part of a public record. You refer to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the privacy rules promulgated under that Act. In short, the privacy rules are applicable to “protected health information”  in the possession of a “covered entity”  as those terms are defined in the federal regulations. 45 C.F.R. § 160.103. You have stated that the Nebraska Health and Human Services System is a covered entity and it is our understanding that no attempt has been made to qualify the agency as a hybrid entity by designating and separating out certain components or divisions which perform non-covered functions. We also assume for purposes of this opinion that the cause of death information is protected health information as it falls within the federal definition.
The general rule under HIPAA is that a covered entity may not use or disclose protected health information without a valid authorization. 45 C.F.R. § 164.508. However, § 164.512 lists several circumstances in which a covered entity may disclose or use protected health information without the individual’s written authorization. In particular, § 164.512(a)(1) provides that “[A] covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with or is limited to the relevant requirements of such law.”
The term “required by law” has been defined at § 164.103 as “a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that
is enforceable in a court of law. Required by law includes...statutes or regulations that require the production of information....” The Nebraska public records statutes clearly mandate or compel state agencies to make records available to the public, including birth and death records.
As the privacy rules have only recently become effective for covered entities there is little in the way of case law to assist us in interpreting the federal regulations. However, we have examined the regulations themselves, the United States Department of Health and Human Services (“HHS”) description and the HHS response to comments received regarding the final HIPAA privacy rules as these materials appear on the United States Health and Human Services website and in the federal register. These materials support our conclusion that the Nebraska public records statutes fall within § 164.512(a)(1) as a disclosure required by law. For example, in an HHS description of HIPAA’s relationship to other federal laws, HHS noted that many federal laws require that entities to provide specific information in specific circumstances. The covered entity must then determine if the disclosure is mandatory rather than merely permissible and, if it is mandatory, a covered entity may disclose the protected health information pursuant to § 164.512(a).
65 Fed. Reg. 82462, 82667-82669 (2000). In response to a comment about state Freedom of Information Act laws, HHS has responded that the “rules permit covered entities to make disclosures that are required by state Freedom of Information Act (FOIA) laws under Sec. 164.512(a). Thus, if a state FOIA law designates death records and autopsy reports as public information that must be disclosed, a covered entity may disclose it without an authorization under the rule. To the extent that such information is required to be disclosed by FOIA or other law, such disclosures are permitted under the final rule.” 65 Fed. Reg. 82597 (2000). For these reasons, it does not appear that HIPAA restricts the cause of death information from being disclosed as part of the public record.
Your third question is whether there is sufficient statutory authority to prevent the Department from supplying a person’s death certificate when the cause of death lists a communicable disease. We have found no provisions of either the Nebraska public records statutes nor the Nebraska statutes pertaining to vital statistics which would authorize the Department to withhold a death certificate when the cause of death lists a communicable disease. Nebraska law does provide certain protections for persons with a communicable disease. Neb. Rev. Stat. § 71-503 requires all attending physicians to report to a local health department or the Department of Health and Human Services Regulation and Licensure the existence of any contagious or infectious disease and Neb. Rev. Stat. § 71-503.01 provides that those reports or notifications and the resulting investigations shall be confidential. However, this statute protects only those specific reports of cases of communicable diseases and not certificates of death. Therefore, it does not appear that the Department currently has statutory authority to withhold a certificate of death for the reason that the cause of death lists a communicable disease.
Lynn A. Melson
Assistant Attorney General
 Protected health information means individually identifiable health information:
(1) Except as provided in paragraph (2) of this definition, that is:
(i) Transmitted by electronic media;
(ii) Maintained in electronic media; or
(iii) Transmitted or maintained in any other form or medium.
45 C.F.R. § 160.103
 Covered entity means:
(1) A health plan.
(2) A health care clearinghouse.
(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. 45 C.F.R. § 160.103.