Advisory Opinion 04-010

Facts and Procedural History:

On January 14, 2004, IPAD received a letter dated January 1, 2004, from X. In X's letter, X asked the Commissioner to issue an advisory opinion regarding a possible violation of his/her rights under Minnesota Statutes, Chapter 13, by the Minnesota Department of Employment and Economic Development (DEED). X asserts his/her rights were violated by the Vocational Rehabilitation unit of DEED. The Commissioner notes that Vocational Rehabilitation previously was part of the Minnesota Department of Economic Security.

In response to X's request, IPAD, on behalf of the Commissioner, wrote to Matt Kramer, Commissioner of DEED. The purposes of this letter, dated January 16, 2004, were to inform him of X's request and to ask him to provide information or support for DEED's position. On February 10, 2004, IPAD received a response, dated February 11, 2004, from Julie Leppink, Assistant Attorney General.

A summary of the facts as presented by X is as follows. Regarding the first issue X asked the Commissioner to address, X wrote:

On 6/29/00 I applied, and was accepted for services at VR [Vocational Rehabilitation, a unit within DEED] based on my hearing impairment. After I had been accepted for services, at one of my first meetings, [VR staff] asked me to sign several blank release of information forms for further services. I was under the impression that I was signing forms for VR to share data already in existence in my VR file, with providers for other services, such as peer counseling, or for education on hearing loss. I agreed to do this. On the forms [VR staff] handed me to sign, there were no boxes checked and there was no information written in. The boxes: to obtain/release information from/to... were not filled in. There was no information of any organization that she might ask to provide data or with whom she might share data. [VR staff] asked me to fill in my birthdate and social security number and sign and date it, which I did.

I was not told that this [VR staff] would be using these forms to obtain medical records. I am aware that my medical records contain almost a year's worth of psychotherapy notes. I do not sign any release forms for medical records due to this fact. I told [VR staff] that I would try to bring in records regarding my hand disability, but that I hadn't been to the doctor for my hand in years. I told her I might be able to get something from my primary care doctor, and I would bring those medical records myself, the way I had brought my audiogram with me. I had already been accepted for services based on my audiogram, and I understood that this further information she was asking for regarding my hand disability was just helpful information to her and was not necessary for services or eligibility. [VR staff] noted, in 2 places in my client notes that I told her I wanted to bring in medical records myself. I had no reason to believe she would use the blank release forms to obtain medical records in violation of my expressed wishes. However, on 9/26/00, she did just that. In violation of my expressed wishes, and the day after she noted for the second time, that [X] wanted to obtain the records [him/herself] , [staff] filled in the blank forms I had signed, and used them to obtain hundreds of pages of medical records without any limitation or discretion as to the content, from Mayo Clinic and Fairview Hospital. These records include psychotherapy notes from 5 years prior, and hundreds of pages of other medical records that also did not pertain in any way to my relationship with VR....

Regarding the second issue X asked the Commissioner to address, X wrote:

I did not use the offered services, as I got a full time [job]....In 2002, after my hearing deteriorated further, I left my position, returned to VR, and met with [VR staff] on March 19, 2003. At this meeting, [VR staff] told me he would like to send me for vocational interest and abilities testing. In actuality, [VR staff] ordered a psychological assessment from a 3rd party vendor....I was not given any type of Tennessen Warning alerting me to the type of data he was requesting me to provide, other than his verbal statement that he was sending me for vocational interest testing....

[VR staff] did not ask me to sign a release of information form for this vendor at our meeting. Instead, he sent me an email on 3/24/03 at 12:55 pm, saying he was going to mail me some things, and asking me to sign them and return them as soon as possible. He sent me two forms in the US mail.

I received these forms, signed and returned them to him on 3/26/03. One form was a release of information agreement for peer counseling, that later was not needed. The second form was for release/exchange of information for Gary Fischler and Associates. When he sent me this form, the box for Fischler and Associates was filled in and [VR staff's] name was printed. It had these boxes checked: Name, Address, Phone Number, Birthdate, Social Security Number, Skills and Work Qualifications, Work History, Reasonable Accommodation Needed, and the box for Coordinate or provide services to me was checked and underlined. There was an X in the Signature box and the printed word Date was circled. I signed and dated this release/exchange agreement on 3/26/03 and put the date 6/30/03 in the line this consent is good for one year or until:

...At 9:38 in the morning, over 3 hours before he informed me he was sending me some things in the mail he wanted me to sign, and at least 3 days before he received my consent to release private data information, [VR staff] wrote an email to Gary Fischler containing a good deal of private, including information that would easily identify me.

...all without any consent for release of information from me, and days before I even knew the name or existence of this vendor. Gary Fischler wrote back to [VR staff] immediately that day....All of this information (personal and some of it incorrect) was shared without any consent from me, and was damaging to me in many ways.

I received the forms, and signed them and returned them on 3/26/03. [VR staff] could not have received the release of information agreement until at least 3 days after he had already shared this private data. I believe this violated my rights under Minnesota Statutes Chapter 13. I believe it also violated the policies the VR has in place prohibiting the sharing of private data when making referrals to 3rd party vendors. Page 11-9 of the VR Policy and Procedure Manual states, A consent for release of information must also be obtained to discuss private data with a potential service provider prior to making a referral ....

Issues:

In his/her request for an opinion, X asked the Commissioner to address the following issues:

Pursuant to Minnesota Statutes, Chapter 13, did the Minnesota Department of Employment and Economic Development violate a data subject's rights by asking the subject to sign informed consents following which staff filled in the identification of the organizations asked to provide data? Pursuant to Minnesota Statutes, Chapter 13, did the Minnesota Department of Employment and Economic Development violate a data subject's rights by releasing, on March 24, 2003, data about the subject to Gary Fischler and Associates?

---

Discussion:

Issue 1:

Pursuant to Minnesota Statutes, Chapter 13, did the Minnesota Department of Employment and Economic Development violate a data subject's rights by asking the subject to sign informed consents following which staff filled in the identification of the organizations asked to provide data?

Pursuant to Minnesota Statutes, Chapter 13, government data are public unless otherwise classified. Data DEED collects and maintains about its clients are private pursuant to Minnesota Statutes, section 268A.05.

Pursuant to section 13.05, subdivision 4(d), private data may be used by and disseminated to any person or agency if the data subject has given his/her informed consent. Minnesota Rules, section 1205.1400, subparts 3 and 4, provide further guidance for complying with this requirement. Pursuant to subpart 3 of Minnesota Rules, section 1205.1400, informed consent means, ...the data subject possesses and exercises sufficient mental capacity to make a decision which reflects an appreciation of the consequences of allowing the entity to initiate a new purpose or use of the data in question.

Subpart 4 of Minnesota Rules, section 1205.1400, provides that the responsible authority must not coerce a data subject to give informed consent, that an informed consent must be made in writing, that an informed consent must identify the consequences of the giving of informed consent, and that a data subject be given the option of consenting to release some or all of the data.

In her comments to the Commissioner, Ms. Leppink wrote:

...X asserts that the Department violated [his/her] rights under Minn. Stat., Ch. 13, by asking [him/her] to sign blank informed consent forms for release of [X's] medical records and by then filling in the names of the medical providers at a later time. The Department did not ask X to sign blank consent forms. X signed the completed informed consent forms, including the names of the organizations asked to provide data at [his/her] intake meeting. The forms were held in X's file to allow X time to provide [his/her] own records. When X did not to [sic] provide complete records, the informed consent forms were used to obtain medical records relevant to vocational rehabilitation planning, including mental health records. Because the Department obtained a completed, signed, informed consent form from X, it did not violate [his/her] rights.

Here, there is a factual dispute that the Commissioner cannot resolve. X asserts that when s/he signed and dated the two forms entitled, Consent to Release/Obtain Private Information, DEED had not filled in the identity of the organization from which DEED was obtaining data. Ms. Leppink, on the other hand, asserts that when X signed the consent forms, they were complete and included the names of the two organizations. It is the Commissioner's opinion that it is not possible for X to have given informed consent if s/he did not have specific information about what data s/he was consenting to have released to DEED, and from which organizations s/he was consenting to have data released to DEED. Thus, if DEED did not fill in the names of the organizations prior to X signing the forms, X's rights were violated. If, however, as Ms. Leppink asserts, the forms contained the names of organizations when X signed them, X's rights were not violated.

The Commissioner wishes to comment briefly on the Consent to Release/Obtain Private Information form that X submitted to IPAD. It appears the form is designed to function as authorization for DEED both to obtain information from outside organizations and to release information to outside organizations. However, in this case, it is not clear whether X was asked to provide consent for DEED to obtain data from the organizations or for DEED to release information to the organizations.

Additionally, the form is designed so that the data subject authorizes release of particular types of data by checking boxes that correspond to each data type. The problem with using such a check-off system is that someone easily could alter the form after the subject has completed and signed it. The Commissioner recommends that the data subject authorize the release of specific data or types of data by initializing each box or type of data s/he selects, and crossing out or drawing a line through each box or type of data not selected. Such practice leaves no room for confusion.

Further, the form X signed includes a space labeled, Known consequences of giving or refusing to give this consent. This portion of the form is blank. Pursuant to Minnesota Rules, section 1205.1400, subpart 4, DEED is obligated to describe the consequences to the data subject of consenting or not consenting to release the data the subject has specified on the form. Given the nature of the types of data collected, used, and released in providing vocational rehabilitation services, the Commissioner finds it unlikely that there would be no known consequences to X if s/he consents or refuses to consent to the release of the data. As the Commissioner also stated in 04-009, if there are no known consequences, the form should so state.

Finally, the form contains a space for the data subject's Social Security number. X stated that DEED asked X to provide this information. As the Commissioner has stated in several previous advisory opinions, when an individual is asked to supply his/her Social Security number, state law requires that the entity provide a Tennessen warning notice (see section 13.49) and federal law also requires a notice (see the federal Privacy Act of 1974, U.S.C. section 552a note - Disclosure of Social Security Number.)

Issue 2:

Pursuant to Minnesota Statutes, Chapter 13, did the Minnesota Department of Employment and Economic Development violate a data subject's rights by releasing, on March 24, 2003, data about the subject to Gary Fischler and Associates?

The term data on individuals is defined as data in which any individual is or can be identified as the subject of the data, unless the appearance of the name or other identifying data clearly can be demonstrated to be only incidental to the data. (See section 13.02, subdivision 5.)

Section 13.02, subdivision 12, defines private data on individuals as data that are not public but are accessible to the data subject. Minnesota Rules, section 1205.0400, subpart 2, provides further guidance: Private data also are available to (1) individuals within the entity whose work assignment reasonably requires access, (2) entities and agencies as determined by the responsible authority who are authorized by statute or federal law to gain access to the specific data, and (3) entities or individuals given access by the express written direction of the data subject.

Pursuant to Minnesota Statutes, section 268A.05, data DEED collects and maintains about its clients are private data on individuals.

In her comments to the Commissioner, Ms. Leppink first argued that the data in the emails DEED staff sent to Gary Fischler and Associates (GFA) are not private because X was not identified in the emails. (GFA is an organization with which DEED contracts. In Advisory Opinion 04-009, the Commissioner examined the contractual elationship between DEED and GFA and determined that pursuant to section 13.05, subdivision 11, GFA must comply with the requirements of Chapter 13.)

The Commissioner respectfully disagrees. While Ms. Leppink is correct that X's name does not appear in the emails, the information DEED staff did provide is specific and descriptive enough that X could be identified. For example, in the first email, DEED staff provided GFA with X's age, gender, specific profession, specific disabilities, age at which one of the disabilities occurred, and that X had been struggling with depression. In the second email, DEED staff provided GFA with details about which post-secondary educational institutions X attended and what degree(s) X earned. The Commissioner is of the opinion that DEED staff released to GFA data from which X could be identified. Therefore, the data that DEED released to GFA are private.

Given the set of facts before the Commissioner, DEED may disseminate private data about X to GFA, an outside entity, only in the following situations: (1) if the disclosure is necessary for the administration and management of programs specifically authorized by the Legislature or local governing body, or mandated by the federal government, and DEED communicated the possibility of such a disclosure to X in a Tennessen warning notice; or (2) if X gave his/her informed consent.

Ms. Leppink cites two provisions in the federal rules related to DEED being required by federal law to assess applicants to determine whether they are eligible for services because of a physical or mental impairment before providing vocational rehabilitation benefits. (See 34 C.F.R. 361.42(2)(1) and 34 C.F.R. 361.45(b)(1).) These provisions appear to relate to the need for state entities to conduct an assessment to determine whether an individual is eligible for services. However, from the email messages that DEED staff wrote to GFA, it appears DEED already had decided to send X to GFA for testing. As DEED staff stated in his email, he was writing to find out which GFA staff should conduct the test: I am hoping testing with your agency could provide some realistic career alternatives. I thought I would contact you first to see who would be best suited for this type of testing. In Gary Fischler's response, he recommended a particular staff.

However, even if the disclosure of this type of data was necessary for the administration and management of programs, Ms. Leppink did not provide any documentation that DEED had provided a Tennessen warning notice to X in which DEED indicated that certain data would be disseminated to GFA. In X's opinion request, X stated that s/he had not received any Tennessen warning notice related to the data, nor had s/he signed an informed consent for their release. (For a more detailed discussion about Tennessen warning notices and informed consents, see Advisory Opinion 04-009.)

Ms. Leppink also states that Minnesota Statutes, 268A.05, subdivision 1, authorizes DEED to provide data about X to GFA. The Commissioner does not agree. Further, as the Commissioner discussed above, it does not appear DEED gave X a Tennessen warning notice that discussed dissemination of the data to GFA nor did X sign an informed consent.

Finally, Ms. Leppink argues that because of the nature of the contract between DEED and GFA, DEED can disseminate the data. Ms. Leppink cited section 13.05, subdivision 6. As the Commissioner stated in Advisory Opinion 04-009, GFA's contractual relationship with DEED is determined by the language in section 13.05, subdivision 11, not section 13.05, subdivision 6. Pursuant to section 13.05, subdivision 11, GFA is subject to the requirements of Chapter 13. Again, the only way in which private data can be disseminated from DEED to GFA is (1) if it is necessary for the administration and management of programs specifically authorized by law, and the possibility of such dissemination was communicated to X in a Tennessen warning notice, or (2) if X gave his/her informed consent to the release. Here, regardless of whether the dissemination of private data to GFA was authorized, X apparently did not receive a related Tennessen warning notice nor did s/he give informed consent. Therefore, DEED inappropriately disseminated data about X to GFA.

---

Opinion:

Based on the facts and information provided, my opinion on the issues that X raised is as follows:

The Commissioner cannot determine whether the Minnesota Department of Employment and Economic Development (DEED) violated a data subject's rights under Minnesota Statutes, Chapter 13, by asking the subject to sign informed consents, after which staff filled in the identification of the organizations asked to provide data. If DEED asked the data subject to sign an incomplete consent, it violated the data subject's rights. If the consent form the data subject signed was complete, DEED did not violate the data subject's rights. Pursuant to Minnesota Statutes, Chapter 13, the Minnesota Department of Employment and Economic Development violated a data subject's rights by releasing, on March 24, 2003, data about the subject to Gary Fischler and Associates.

Signed:

Brian J. Lamb
Commissioner

Dated: March 4, 2004

---