This is a fascinating case dealing with access to cancer registry data through a state Freedom of
Information Act (FOIA). A FOIA allows the public access to information held by the state, subject
to exceptions designed to protect personal privacy and the confidentiality of certain state
functions. The requesting party files a written request for the information and the agency has a set
time to provide the information, or provide an estimate of the time necessary to provide the
information and the cost of production, or provide a rationale based on applicable law why it will not
provide the information. The Southern Illinoisan issued a letter on October 28, 1997, to the Illinois
Department of Public Health (the Department), asking for copies of the documents relating to the
incidence of neuroblastoma from 1985 to the date of the letter, as they were available by the type of
cancer, zip code, and date of diagnosis. The Department denied the Southern Illinoisan's request,
citing the Medical Studies Act as the basis for the exemption from disclosure. In response, the
Southern Illinoisan filed a complaint in the circuit court under the FOIA, seeking an order requiring
the release of the requested information. The Department raised affirmative defenses, citing the
Medical Studies Act and the Illinois Health and Hazardous Substances Registry Act (Cancer
Registry Act). The question before the court was, narrowly, do the cited statutes require the state
to withhold the information? More broadly, what is the proper balance between informing the public
about health risks and protecting the confidentiality of the reported data.
The major complicating factor in this case is whether the data is sufficiently identifiable to fall under
the exception in the FOIA that prevents the release of information that "...would constitute a clearly
unwarranted invasion of personal privacy." The plaintiff argues that it is not asking for names, only
the type of cancer, the zip code, and the data of diagnosis. The agency countered with expert
testimony that an investigator could then take this data and with other data that is readily available
(although not clearly legally available) identify the affected individual. Unfortunately, the court does
not attack this analysis directly - with enough money to investigate, you could get the information
without asking the agency at all, since medical privacy systems, like all privacy systems, are
imperfect and only raise the cost of finding out the information. The court engages in a balancing of
the potential risk of disclosure against the purpose of the statute:
"Health records include a vast amount of personal and private information. It is elementary that if
access to sensitive and personal information is more open, it becomes more difficult to prevent the
uses that may stigmatize or otherwise harm the subjects of that information. Therefore, when the
disclosure of information that applies to a particular individual is sought from government records,
courts must determine whether the release of the information would constitute a clearly
unwarranted invasion of that person's privacy."
The court found that a major purpose of the Cancer Registry Act was to provide the public with
information about the risks of cancer, and to stimulate research into the causes and strategies to
prevent cancer. This implies some right of public access to the data. The court reversed the
summary judgment for the agency and remanded to the trial court for more factfinding on whether
the potential for identifying persons from the zip code, type of cancer, and date of diagnosis
constituted an unwarranted invasion of personal privacy. After criticizing the agency for being overly
protective of its data, the court found:
"In conclusion, we believe that it is unrealistic to try to mold a public health information system that
promises both the ready availability of information and absolute privacy. Public health data
collection is a worthwhile cause in the name of reducing morbidity and mortality. Although the strict
confidentiality of health data is a noble cause and is worthy of statutory protections, ultimately a
balance must be struck between public health concerns and privacy conce
