Administrative Law / Public Health Reporting and Testing / FOIA

Cancer Registry Data May Be Available Through FOIA - Southern Illinoisan, a Div. of Lee Enterprises, Inc. v. Department of Public Health, 319 Ill.App.3d 979, 747 N.E.2d 401 (Ill.App. 5 Dist. 2001), and Southern Illinoisan v. Department of Public Health, 349 Ill.App.3d 431, 812 N.E.2d 27 (Ill.App. Dist.5 2004)

This is a fascinating case dealing with access to cancer registry data through a state Freedom of Information Act (FOIA).  A FOIA allows the public access to information held by the state, subject to exceptions designed to protect personal privacy and the confidentiality of certain state functions.  The requesting party files a written request for the information and the agency has a set time to provide the information, or provide an estimate of the time necessary to provide the information and the cost of production, or provide a rationale based on applicable law why it will not provide the information.  The Southern Illinoisan issued a letter on October 28, 1997, to the Illinois Department of Public Health (the Department), asking for copies of the documents relating to the incidence of neuroblastoma from 1985 to the date of the letter, as they were available by the type of cancer, zip code, and date of diagnosis. The Department denied the Southern Illinoisan's request, citing the Medical Studies Act as the basis for the exemption from disclosure. In response, the Southern Illinoisan filed a complaint in the circuit court under the FOIA, seeking an order requiring the release of the requested information. The Department raised affirmative defenses, citing the Medical Studies Act and the Illinois Health and Hazardous Substances Registry Act (Cancer Registry Act).  The question before the court was, narrowly, do the cited statutes require the state to withhold the information?  More broadly, what is the proper balance between informing the public about health risks and protecting the confidentiality of the reported data.

The major complicating factor in this case is whether the data is sufficiently identifiable to fall under the exception in the FOIA that prevents the release of information that "...would constitute a clearly unwarranted invasion of personal privacy."  The plaintiff argues that it is not asking for names, only the type of cancer, the zip code, and the data of diagnosis.  The agency countered with expert testimony that an investigator could then take this data and with other data that is readily available (although not clearly legally available) identify the affected individual.  Unfortunately, the court does not attack this analysis directly - with enough money to investigate, you could get the information without asking the agency at all, since medical privacy systems, like all privacy systems, are imperfect and only raise the cost of finding out the information.  The court engages in a balancing of the potential risk of disclosure against the purpose of the statute:

"Health records include a vast amount of personal and private information. It is elementary that if access to sensitive and personal information is more open, it becomes more difficult to prevent the uses that may stigmatize or otherwise harm the subjects of that information. Therefore, when the disclosure of information that applies to a particular individual is sought from government records, courts must determine whether the release of the information would constitute a clearly unwarranted invasion of that person's privacy."

The court found that a major purpose of the Cancer Registry Act was to provide the public with information about the risks of cancer, and to stimulate research into the causes and strategies to prevent cancer.  This implies some right of public access to the data.  The court reversed the summary judgment for the agency and remanded to the trial court for more factfinding on whether the potential for identifying persons from the zip code, type of cancer, and date of diagnosis constituted an unwarranted invasion of personal privacy.  After criticizing the agency for being overly protective of its data, the court found:

"In conclusion, we believe that it is unrealistic to try to mold a public health information system that promises both the ready availability of information and absolute privacy. Public health data collection is a worthwhile cause in the name of reducing morbidity and mortality. Although the strict confidentiality of health data is a noble cause and is worthy of statutory protections, ultimately a balance must be struck between public health concerns and privacy concerns."