Oregon Health & Science University v. Oregonian Publishing Co.

SERCOMBE, P. J. Plaintiff Oregon Health and Science University (OHSU) is a health and research public university that provides patient care at its hospital. OHSU appeals the trial court’s judgment enjoining it from withholding particular information contained in public records that defendant Oregonian Publishing Company, LLC (The Oregonian) requested under the Oregon Public Records Law (OPRL), ORS 192.410 - 192.505. OHSU contends that the information is exempt from disclosure under the OPRL and that the court erred in compelling its disclosure. As explained below, we conclude that some of the requested information may be exempt from public disclosure if it is contained in a document described in ORS 192.496(1). That subsection exempts from disclosure records that “contain information about the physical or mental health or psychiatric care or treatment of a living individual.” Because the requested public records were not part of the record before the trial court, we cannot determine if any of those records and the information in those records are exempt from disclosure under ORS 192.496(1). We also conclude that the record is insufficient to determine whether one of the relevant records is an “education record” under the Family Educational Rights and Privacy Act (FERPA), 20 USC § 1232g, and therefore exempt from disclosure under ORS 192.502(8). Accordingly, we remand the case to the trial court to consider the application of ORS 192.496(1) and ORS 192.502(8) to the requested public records. Otherwise, we conclude that disclosure of the requested information in the tort claim notices that are the subject of this appeal is not precluded by state or federal law. Accordingly, we reverse and remand the judgment ordering disclosure and the supplemental judgment awarding The Oregonian its attorney fees. I. BACKGROUND The Oregon Tort Claims Act, ORS 30.260 - 30.300, limits the tort liability of public bodies of the state, including OHSU, and regulates the manner in which those claims are prosecuted. ORS 30.275(1) provides that no tort claim “shall be maintained unless notice of claim is given as required by [192] this section.” ORS 30.275(4) sets forth a formal method for giving a tort claim notice: “Formal notice of claim is a written communication from a claimant or representative of a claimant containing: “(a) A statement that a claim for damages is or will be asserted against the public body or an officer, employee or agent of the public body; “(b) A description of the time, place and circumstances giving rise to the claim, so far as known to the claimant; and “(c) The name of the claimant and the mailing address to which correspondence concerning the claim may be sent.” The Oregonian publishes a newspaper of that name that is of general circulation within Oregon. In 2011, through a reporter, The Oregonian requested that OHSU provide it information from tort claim notices given to OHSU. Specifically, “[u]nder Oregon Public Records Law, I am requesting a list of tort claims filed against Oregon Health & Science University and its affiliated entities, preferably in spreadsheet form, with information dating back to Jan 1, 2006 and including only the following types of information or data fields: claim number, claimant full name, attorney full name, date of alleged tort, date of tort claim notice, and whether it is closed or open.” It further noted: “I am not requesting any information generated in the course of medical treatment. I am not requesting health information of any kind. *** This is tort information, not health information, and it is submitted by individuals voluntarily, outside the course of medical treatment, to a public institution and in a venue—torts against public institutions—that is well recognized to be public information.” OHSU had received eight tort claim notices during the period of the request. It compiled a document that listed the type of claim asserted in each notice and then either purported to disclose the requested information about that tort claim notice or cited statutory provisions that excused the [193] obligation to disclose that information. The eight tort claims notices were described as: “professional liability where litigation filed,” “professional liability where no litigation filed,” “employment liability for faculty,” “employment liability for non-faculty,” “general liability involving students,” “general liability course-of-care patient claims if litigation filed,” “general liability course-of-care patient claims if no litigation filed,” and “other general liability.” The document then listed whether the requested information for each claim (the type of claim, open or closed status, the name of the claimant, the date of the alleged tort, the name of claimant’s attorney, the date of notice, and the claim number) would be disclosed or whether OHSU took the position that the particular information was exempt from disclosure. In the document, OHSU proposed to disclose all of the information with respect to the “other general liability” claim, but withheld the names of the claimants for all of the remaining claims. It also withheld the dates of the alleged torts and names of the claimants’ attorneys for some of those claims. The document cited one or more of various parts of the OPRL, ORS 353.260, the Health Insurance Portability and Accountability Act Privacy Rule, 45 CFR parts 160 and 164 (Privacy Rule),1 and FERPA, 20 USC § 1232g, as the justification for each of the nondisclosures. The Oregonian responded that those policies did not justify any of the nondisclosures. Pursuant to ORS 192.450 and ORS 192.460,2 The Oregonian petitioned the Multnomah County district attorney for an order directing OHSU to disclose “tort claim notices submitted to OHSU since 2006, including claimant [194] name, attorney name, date of tort, date of tort claim notice, and whether it was closed or open.”3 The district attorney ruled that none of the claimed exemptions from disclosure applied and “ordered that OHSU promptly disclose the records sought in the petition.” OHSU then instituted proceedings for declaratory relief in the circuit court, seeking a determination that the information withheld is exempt from disclosure under the OPRL.4 See ORS 192.490(1) (“The court shall determine the matter de novo and the burden is on the public body to sustain its action.”). The parties filed cross-motions for summary judgment; the trial court granted The Oregonian’s motion and denied OHSU’s. Pursuant to that judgment, OHSU “is enjoined from withholding the requested records and ordered to disclose the requested records” to The Oregonian. The trial court also entered a supplemental judgment awarding attorney fees to The Oregonian. OHSU raises three arguments on appeal. First, as to claims by patients, OHSU contends that the names of claimants, their attorneys, and the dates of the alleged torts in the four tort claims notices from patients are exempt from disclosure under the statutory exemptions for records containing “information about the physical or mental health [195] or psychiatric care or treatment of a living individual,” ORS 192.496(1), and “[information of a personal nature” in a record, ORS 192.502(2). Additionally, OHSU argues that the health care information is “protected health information” under ORS 192.556(ll)(a) and is made confidential by ORS 192.553(l)(a). Under ORS 192.558(2)(b), “protected health information” is to be disclosed only as “otherwise permitted or required by state or federal law or by order of the court” and, OHSU submits, no legal requirement to disclose exists. Similarly, OHSU contends that the health care information is confidential under the Privacy Rule and, because of that confidentiality, it is exempt from disclosure under ORS 192.502(8) as “public records or information the disclosure of which is prohibited by federal law or regulations.” As to the two employment-related claims, OHSU asserts that the names of the claimants are exempt from disclosure under ORS 192.502(2) as “[information of a personal nature.” Moreover, OHSU argues, the employment tort claim notice related to a faculty member is a confidential personnel record under OHSU rules authorized by ORS 353.260(1) and is not a public record that must be disclosed under ORS 353.260(6). With respect to claims involving a student, OHSU contends that the name of the claimant is part of the student’s “education records” and confidential under FERPA and, thus, exempt from disclosure under ORS 192.502(8). Finally, OHSU maintains that if, on review or remand, the court modifies the judgment ordering disclosure, then an award of attorney fees is discretionary, ORS 192.490(3), and the supplemental judgment on fees should be reevaluated for a determination of whether to award fees. II. OREGON PUBLIC RECORDS LAW Under ORS 192.420(1), “Every person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505.” ORS 192.420(1) creates a “statutory presumption that documents will be disclosed to the public.” City of Portland v. Oregonian Publishing Co., 200 Or App 120, 124, 112 P3d 457 (2005). [196] “Exemptions are to be narrowly construed, i.e., they are to be made on an individualized basis and are to be based on a sufficient showing of justification.” Guard Publishing Co. v. Lane County School Dist., 310 Or 32, 39, 719 P2d 854 (1990). “Th[e] ‘narrow construction’ rule can be applied to resolve ambiguity about the scope of a statutory public records exemption” so that, “if there is a plausible construction of a statute favoring disclosure of public records, that is the construction that prevails.” Colby v. Gunson, 224 Or App 666, 676, 199 P3d 350 (2008).5 A public body that withholds records as exempt from disclosure has the initial burden in a review proceeding of showing that a claimed exemption applies. ORS 192.490(1) (“[T]he burden is on the public body to sustain its action.”); see Mail Tribune, Inc. v. Winters, 236 Or App 91, 95, 237 P3d 831 (2010). “To satisfy that burden, a public body must establish exemptions from disclosure ‘on an individualized basis.’ ” Mail Tribune, Inc., 236 Or App at 95 (quoting Guard Publishing Co., 310 Or at 39). In establishing whether an exemption applies, a public body may conclude that the individual requesting disclosure has not met the showing required by the text of the statutory exemption. See, e.g., ORS 192.496(1) (establishing exemption for medical records “if the public disclosure thereof would constitute an unreasonable invasion of privacy” but providing that the requestor has “the burden of showing by clear and convincing evidence that the public interest requires disclosure in the particular instance and that public disclosure would not constitute an unreasonable invasion of privacy”). III. PATIENT INFORMATION OHSU initially asserts that information about the physical care and medical treatment of an identified person that is contained in a patient tort claim notice (including [197] the name of the patient, the date of the allegedly negligent treatment, and the name of the patient’s attorney) is exempt from disclosure for two reasons. First, OHSU claims that the information is contained in a medical record that is entirely exempt from disclosure under ORS 192.496(1), which provides: “The following public records are exempt from disclosure: “(1) Records less than 75 years old which contain information about the physical or mental health or psychiatric care or treatment of a living individual, if the public disclosure thereof would constitute an unreasonable invasion of privacy. The party seeking disclosure shall have the burden of showing by clear and convincing evidence that the public interest requires disclosure in the particular instance and that public disclosure would not constitute an unreasonable invasion of privacy.” Second, OHSU contends that the nondisclosed information from patient tort claim notices is exempt from disclosure under ORS 192.502(2), which exempts the following records from disclosure: “Information of a personal nature such as but not limited to that kept in a personal, medical or similar file, if public disclosure would constitute an unreasonable invasion of privacy, unless the public interest by clear and convincing evidence requires disclosure in the particular instance. The party seeking disclosure shall have the burden of showing that public disclosure would not constitute an unreasonable invasion of privacy.” In OHSU’s view, direct or indirect patient identification information in a tort claim notice, including the name of the patient, date of the tort, and name of the patient’s attorney, is “information about the physical or mental health or psychiatric care or treatment of a living individual” and “[ijnformation of a personal nature,” the disclosure of which would be an unreasonable invasion of privacy without any clear public interest in favor of disclosure. More specifically, OHSU suggests that any disclosure of individually identifiable health information is an unreasonable invasion of privacy under either statutory exemption because: (1) that type of information is given special protection limiting [198] disclosure in civil discovery under ORCP 55 H;6 (2) ORS 192.553 to 192.581 categorizes that type of information as protected under state law and creates privacy rights in its nondisclosure;7 (3) the Privacy Rule classifies that information as “protected health information” and requires that it be kept confidential in the circumstances of this case; (4) as evidenced by a survey placed in the trial court record, reasonable persons would not wish or expect that written complaints about their health care would be released to the public; and (5) release of the information by OHSU would expose it to liability to the affected patients for the common law tort of unreasonable invasion of privacy. OHSU finally suggests that The Oregonian did not produce clear and convincing evidence that “the public interest requires disclosure” in these instances under ORS 192.496(1) and ORS 192.502(2), given that disclosure would be an unreasonable [199] invasion of privacy and that there are public interests in nondisclosure. Additionally, OHSU argues that, because the information is “protected health information” and is confidential under the Privacy Rule, it is exempt from disclosure under ORS 192.502(8) (exempting from disclosure “[a]ny public records or information the disclosure of which is prohibited by federal law or regulations”). According to OHSU, HIPPA protected information is exempt from disclosure under ORS 192.502(8) independent of the question whether that disclosure would be unreasonable or in the public interest. The Oregonian responds that it did not seek the disclosure of “information about the physical or mental health or psychiatric care or treatment of a living individual” under ORS 192.496(1), nor did it seek “[information of a personal nature” under ORS 192.502(2). Rather, it sought the claimant names, tort dates, and attorney names in tort claim notices filed during a particular period. Moreover, with respect to ORS 192.496(1), The Oregonian asserts that “ [d] efendant does not seek any ‘information about the physical or mental health or psychiatric care or treatment’ of any person. ORS 192.505 requires a public body to segregate nonexempt material from any exempt material within a record. That a given document might otherwise ‘contain’ medical information within it does not exempt all information in that document from disclosure. ORS 192.496 does not provide a basis for exemption of the information defendant seeks, the names of persons who have filed tort claim notices.” In all events, according to The Oregonian, the information in the patient tort claim notices is not private (primarily because it is disclosed in a legal demand intended for use in litigation that might be filed), nor is there a right of confidentiality about that information under state or federal law. Finally, The Oregonian argues that, without showing what particular health or personal information was part of the tort claim notices, OHSU has not met its burden to make a “sufficient showing of justification” to prove that an exemption applies on an “individualized basis” under Guard Publishing Co., 310 Or at 39. [200] A. Application of the Privacy Rule As noted, OHSU submits that, because the information sought by The Oregonian from the patient tort claim notices is protected health information under the Privacy Rule, it is exempt from disclosure under ORS 192.502(8). In relevant part, the Privacy Rule prohibits a “covered entity”8 from disclosing protected health information, unless an exception applies. See 45 CFR § 164.502(a) (“A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchap-ter.”). “Protected health information” includes “individually identifiable health information,” defined as follows: “Individually identifiable health information is information * * * [that includes] demographic information collected from an individual, and: “(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and “(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and “(i) That identifies the individual; or “(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.” 45 CFR § 160.103 (emphasis in original); see also 42 USC § 1320d(6). In a provision related to procedures for notifying patients of data breaches, the Privacy Rule lists examples of types of protected health information, which include a patient’s “full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information.” 45 CFR § 164.404(c)(1)(b). [201] We assume, for our purposes, that the patient name, date of the alleged medical care tort, and name of the patient’s attorney in the tort claim notices relate to the claimant’s condition or provision of health care and can identify the patient or provide a reasonable basis that can be used to identify the patient. If that is true, the information is “individually identifiable health information” and “protected health information” under the Privacy Rule and subject to the nondisclosure requirement of 45 CFR section 164.502(a). The Privacy Rule, however, allows disclosure of protected information when that disclosure is “required by law.” 45 CFR § 164.512(a)(1). The Oregonian argues that disclosure of the public records containing the requested information is “required” by ORS 192.420(1), which confers a “right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.501 to 192.505,” and that no exemption from disclosure under state law mitigates that requirement. OHSU counters that the Privacy Rule prohibits the disclosure of protected health information so that disclosure of that information is inhibited (and not “required”) by ORS 192.502(8) (exempting from disclosure “[a]ny public records or information the disclosure of which is prohibited by federal law or regulations”). OHSU also contends that the definition of “required by law” at 45 CFR section 164.103 does not contemplate the disclosure of protected health information under a public records law. 45 CFR section 164.103 provides: “Required by law means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes [202] or regulations that require such information if payment is sought under a government program providing public benefits.” (Emphases in original.) In OHSU’s view, a public records law is not like those required disclosures and, therefore, would not fit the exception. We conclude that, if the information is not otherwise exempt from disclosure under the OPRL, its disclosure is “required by” ORS 192.420 and, accordingly, allowed by 45 CFR section 164.512(a)(1). That disclosure requirement is the plain meaning of the “right to inspect” conferred by ORS 192.420 and its companion policy in ORS 192.440(1) that the “custodian of any public record that a person has a right to inspect shall give the person, upon request” either “[a] copy of the public record” or “[a] reasonable opportunity to inspect or copy the public record.” Under 45 CFR section 164.103, the statutory disclosure requirements are “mandate [s] contained in law that compel [] an entity to make a * * * disclosure” that are “enforceable in a court of law” under ORS 192.490 (court authority in reviewing action denying right to inspect public records). If disclosure of protected health information is allowed by 45 CFR section 164.512(a)(1) because it is otherwise “required by” ORS 192.420, then that disclosure is not “prohibited by federal law” under ORS 192.502(8). We reject OHSU’s assertion that “federal law” refers only to the disclosure limitations in the Privacy Rule and does not include the disclosure allowances in that same rule. The obvious meaning of “federal law” is the entire law; the entire operation of the Privacy Rule excuses the nondisclosure limitation in 45 CFR section 164.502(a) if the disclosure is “required by” an enforceable state law under 45 CFR section 164.512(a)(1). Put another way, whether any protected health information in the patient tort claim notices must be disclosed under the Privacy Rule and the OPRL depends entirely on whether an exemption from disclosure exists under ORS 192.496(1) and ORS 192.502(2).9 [203] B. Application of ORS 192.496(1) As noted, ORS 192.496(1) exempts from disclosure “ [r] ecords less than 75 years old which contain information about the physical or mental health or psychiatric care or treatment of a living individual, if the public disclosure thereof would constitute an unreasonable invasion of privacy. The party seeking disclosure shall have the burden of showing by clear and convincing evidence that the public interest requires disclosure in the particular instance and that public disclosure would not constitute an unreasonable invasion of privacy.” The issue framed by the parties, in the summary judgment proceedings and on appeal, assumed that the patient tort claim notices fit the definition of exempt medical records under ORS 192.496(1). That is to say, because a tort claim notice is required to disclose the “circumstances giving rise to the claim,” ORS 30.275(4)(b), a medical treatment tort claim notice necessarily would describe “the physical or mental health or psychiatric care or treatment” of the claimant and the notice might then qualify as a nondisclosable record under ORS 192.496(1). Assuming that the patient tort claim notices qualified as exempt records under ORS 192.496(1), the parties framed the question to be whether certain information in those potentially exempt records (name of the patient, date of the tort, name of the patient’s attorney) must be disclosed under ORS 192.505. That statute requires: “If any public record contains material which is not exempt under ORS 192.501 and 192.502, as well as material which is exempt from disclosure, the public body shall separate the exempt and nonexempt material and make the nonexempt material available for examination.” In light of the issue framed by the parties, the trial court concluded that the name of the patient, date of the tort, and name of the patient’s attorney in a patient tort claim notice [204] is not “information about the physical or mental health or psychiatric care or treatment” of the patient, and, therefore, is not exempt from disclosure. Thus, the court ordered that OHSU “make [that] nonexempt material available for examination.” However, the parties led the court down the wrong path. ORS 192.496 describes four types of records that are entirely exempt from disclosure: medical records, sealed records, custodial records, and student records. ORS 192.496(1) exempts from disclosure all—and any part of—a medical record that qualifies under the statute. In order to properly apply ORS 192.496(1), under the plain meaning of its text, a court must evaluate whether the record contains “information about the physical or mental health or psychiatric care or treatment of a living individual.” If it does, then the court must determine whether the disclosure of that health, care, or treatment information “would not constitute an unreasonable invasion of privacy” and is otherwise in “the public interest.” If the medical record qualifies, and disclosure of the record with that information is not otherwise warranted, then the record, in whole or in part, is exempt from disclosure. The trial court did not conduct that evaluation in this case. Instead of determining whether the entire record was exempt from disclosure, the court applied ORS 192.505, concluded that the patient tort claim notices contained “material which is not exempt under ORS 192.501 and 192.502 [claimant name, the name of the claimant’s attorney, and the date of the tort], as well as material which is exempt from disclosure,” and ordered OHSU to make that “nonexempt material available for examination.” In doing so, the reviewing court misconstrued ORS 192.505, which does not apply to a medical record that otherwise qualifies as exempt from disclosure under ORS 192.496(1). On its face, ORS 192.505 applies only to records that contain material that is nonexempt and material that is exempt from disclosure “under ORS 192.501 and 192.502.” The medical records in question contain material that might be exempt from disclosure under a different statute, ORS 192.496(1). [205] More broadly, however, we have construed ORS 192.505 to apply to public record exemptions that classify information in a record as exempt from disclosure—so as to require the sorting of that information from other information to be disclosed in the record—and not to apply to exemptions that classify an entire record as exempt from disclosure for which no sorting is necessary. Thus, in Brown v. Guard Publishing Co., 267 Or App 552, 554, 341 P3d 145 (2014), a newspaper sought disclosure of an energy supply contract between a municipal utility and an energy company. The municipal utility claimed that the contract was exempt from disclosure, and relied upon ORS 192.502(26), which exempts from disclosure certain “[sensitive business, commercial or financial information” furnished to or developed by a public body engaged in the business of providing electricity if “disclosure of the information would cause a competitive disadvantage for the public body or its retail electricity customers.” At issue was whether the contract should be treated as exempt in its entirety or whether the municipal utility was required to separate out, and disclose, any nonexempt material within the contract under ORS 192.505. We noted that, “[a]s will later prove important, each of the exemptions in ORS 192.502 is worded slightly differently. Some of the exemptions describe particular types of documents and categorically exempt those documents from disclosure. E.g., ORS 192.520(32) (exempting county election security plans); *** ORS 192.502(7), (15) (exempting certain ‘reports’). Other exemptions, however, are phrased in terms of particular types of data or information within public records. E.g., ORS 192.502(3) (‘Public body employee or volunteer addresses, Social Security numbers, dates of birth and telephone numbers contained in personnel records maintained by the public body that is the employer or the recipient of volunteer services.’). Thus, although the definition of ‘public records’—and, by incorporation, the exemptions * * *—are phrased in terms of whether a writing ‘contains’ information related to public business, the specific exemptions themselves may apply to a writing in whole or in part.” 267 Or App at 563-64. We concluded that ORS 192.505, requiring separation of exempt and nonexempt material in the provision of public records, applies only to the exemptions [206] within ORS 192.501 and ORS 192.502 that apply to parts of a writing. Id. at 564-65. ORS 192.502(26) was such an exemption, and the case was remanded to the trial court for application of the exemption to parts of the energy supply contract. Id. at 569-7010 In light of the reasoning in Brown, we conclude that the reviewing court erred in applying ORS 192.496(1) to classify information within a patient tort claim notice as subject to disclosure under ORS 192.505. Instead, application of ORS 192.496(1) necessarily requires examination of the actual “information about the physical or mental health or psychiatric care or treatment of a living individual” that is contained in the public record to determine whether the exemption applies, and then consideration of whether “the public disclosure thereof would constitute an unreasonable invasion of privacy.” Thus, the court erred in granting The Oregonian’s motion for summary judgment on the patient health information without a sufficient record to determine the application of ORS 192.496(1) to public records containing that information. See ORS 192.490(1) (in a public records review proceeding, the “court, on its own motion, may view the documents in controversy in camera before reaching a decision”)11 Because the application of ORS 192.496(1) on remand may obviate the need to consider the applicability of ORS 192.502(2), we remand to the circuit court to make that determination only if it becomes necessary. IV. EMPLOYMENT-RELATED TORT CLAIMS The reviewing court ordered disclosure of the name of the claimant in the two tort claim notices pertaining to employment liability. One of the claims was from a faculty member; the other was not. OHSU disclosed the date [207] of the alleged tort and the name of the claimant’s attorney for those two claims. It argues that the identity of the non-faculty employee-claimant is “[information of a personal nature” under ORS 192.502(2) and exempt from disclosure. As noted, ORS 192.502(2) exempts from disclosure “[information of a personal nature such as but not limited to that kept in a personal, medical or similar file, if public disclosure would constitute an unreasonable invasion of privacy, unless the public interest by clear and convincing evidence requires disclosure in the particular instance. The party seeking disclosure shall have the burden of showing that public disclosure would not constitute an unreasonable invasion of privacy.” In contrast to ORS 192.496, ORS 192.502(2) is framed to exempt “information” instead of “records.” Thus, the issue is whether the name of the claimant can be excluded, under ORS 192.502(2), from the other information disclosed from the record under ORS 192.420. In Mail Tribune, Inc., 236 Or App at 96, we framed the test for an exemption under ORS 192.502(2) as follows: “The personal privacy exemption may be invoked by a public custodian of records upon evidence that (1) the information is personal in nature and (2) disclosure would unreasonably invade privacy. If the public body produces evidence to satisfy those criteria, the burden shifts to the party seeking disclosure, who must show, by clear and convincing evidence, that the public interest nonetheless demands disclosure.” Here, OHSU argues that the identity of the nonfaculty employment tort claimant is “[information of a personal nature” because “[disclosure of the employee’s name in that context establishes that the identified employee asserts that her employment was adversely affected with resulting financial, physical, mental or emotional injury.” OHSU explains that “[t]here are manifest public interests in employment privacy related to the nature of employment claims, which are implicated by disclosure of an employee’s name to a newspaper * ⅜ *.” We conclude that the name of a claimant in a tort claim notice is not “ information of a personal nature” exempt from disclosure under ORS 192.502(2). [208] In Jordan v. MVD, 308 Or 433, 441, 781 P2d 1203 (1989), the Supreme Court construed the plain meaning of ‘^Information of a personal nature” in ORS 192.502(2) to be information that was “specific to one individual.” We expanded on the plain meaning of the phrase in City of Portland v. Anderson, 163 Or App 550, 555, 988 P2d 402 (1999). The issue in Anderson was whether ORS 192.502(2) exempted from disclosure records of a disciplinary investigation against a police officer. We concluded that the city failed to prove under ORS 192.502(2) either that the information in the disciplinary records was information of a personal nature or that disclosing the records would constitute an unreasonable invasion of privacy. Id. at 556-57. We also set out the dictionary definition of “personal” that we had relied on in Jordan: “‘Webster’s Third New International Dictionary, at 1686 (Unabridged 1971), defines “personal” as meaning “1: of or relating to a particular person: affecting one individual or each of many individuals: peculiar or proper to private concerns: not public or general *** (personal baggage): *** 6: exclusively for a given individual (a personal letter) **$»>» Id. at 555 (quoting Jordan, 308 Or at 441 (emphasis in Jordan)). In determining that the information in the disciplinary file was not information of a personal nature, we concluded that “the records in this case, although relating to a specific individual, also have a bearing on his qualification to serve in a position of public trust. The tension between individually specific information and its reflection on matters of public concern is also present in the dictionary definition of the word ‘personal’ endorsed by the court in Jordan. On the one hand, ‘personal’ means ‘relating’ to a particular person. On the other hand, ‘personal’ means ‘peculiar or proper to private concerns: not public or general.’ Although the disputed records in this case pertain specifically to [the police officer], they do not affect him exclusively and are not peculiar to his private concerns.” Id. at 556. Here, while the claimant identification in the tort claim notice does relate to a particular person, it is not [209] “peculiar to [the claimant’s] private concerns.” Instead, the claimant identification is made to qualify the tort claim notice as sufficient under ORS 30.275(4)(c) (requiring formal tort claim notices to contain the “name of the claimant”). ORS 30.279(2) requires that a tort claim notice be given to a public body within 180 days after an alleged loss or injury that did not result in death. The timely filing of a sufficient tort claim notice is a necessary predicate to maintaining a tort claim against a public body or its agents. ORS 30.275(1). The purposes of an early and sufficient tort claim notice are to allow a timely investigation of the merits of the claim and a possibility of quick resolution, a process that necessarily requires examination of the information in the tort claim notice and processing of the claim by a number of public employees and agents. The claimant identification information in a tort claim notice is necessary to advance those purposes and to comply with statutory requirements, all of which are matters of public concern that are rooted in statutory policy. The reviewing court did not err in concluding that the name of the claimant in the nonfaculty employment tort claim notice was not “[i]nformation of a personal nature” under ORS 192.502(2) and, thus, was subject to disclosure under the OPRL. OHSU argues that the tort claim notice by a faculty member is not a public record under ORS 353.260. That statute relates to personnel records maintained by OHSU. Under ORS 353.260(7), the term “personnel records” is defined as “records containing information kept by the university concerning a faculty member and furnished by the faculty member or by others about the faculty member at the member’s or at the university’s request, including but not limited to information concerning discipline, membership activity, employment performance or other personal records of individual persons.” ORS 353.260(1) authorizes OHSU to “adopt policies governing access to university personnel records that are less than 25 years old.” ORS 353.260(2) requires those policies to “require that personnel records be subjected to restrictions on access unless the president of the university finds [210] that the public interest in maintaining individual rights to privacy in an adequate educational environment would not suffer by disclosure of such records.” ORS 353.260(6) provides that “[a]ny category of personnel records specifically designated as confidential pursuant to valid policies or orders as provided in this section shall not be deemed a public record for the purposes of ORS 192.420.” OHSU claims that, under its adopted policies, all “information in the personnel file, apart from that identified above [stating exceptions that do not include tort claim notices], shall be confidential and restricted to access as hereinafter set forth.” OHSU asserts that this designation suffices to disqualify the faculty member tort claim notice as a public record under ORS 353.260(6). We disagree. The summary judgment record does not show that the faculty member tort claim notice is actually “in the personnel file” of the affected faculty member. Instead, the record shows that the tort claim notices are regularly kept by claims managers in OHSU’s risk management department. Accordingly, the reviewing court did not err in concluding that the faculty member tort claim notice is a public record subject to disclosure under ORS 192.420. V. STUDENT-RELATED TORT CLAIM NOTICE OHSU finally claims that the court erred in ordering disclosure of the student name in the tort claim notice pertaining to “general liability involving students.” OHSU asserts that the information is exempt from disclosure under ORS 192.502(8) as “information the disclosure of which is prohibited by federal law or regulations.” Specifically, OHSU contends that FERPA applies to OHSU and protects the privacy of a student’s “education records.” 20 USC § 1232g. FERPA implementing regulations define “education records” to mean “those records that are *** [d]irectly related to a student * * * [and] [m]aintained by an educational agency or institution or by a party acting for the agency or institution.” 34 CFR § 99.3. We conclude that a student tort claim notice is not an “education record” if it is not “directly related to a student [⅛]” activities or status as a student. We remand to the reviewing court to examine the [211] tort claim notice “involving students” to determine whether it describes and directly relates to activities of a student or the educational status of a student. If it does, then the record may be exempt from disclosure under ORS 192.502(8). VI. CONCLUSIONS In sum, we conclude that any information contained in a patient tort claim notice may be exempt from disclosure under ORS 192.496(1) if the notice contains “information about the physical or mental health or psychiatric care or treatment of a living individual,” the disclosure of which would be an unreasonable invasion of privacy, and if The Oregonian has not shown that “the public interest requires disclosure [of the record] in the particular instance.” We also conclude that any information in the student tort claim notice may be exempt from disclosure if the notice describes and directly relates to activities of a student or the educational status of a student. We remand the case to the reviewing court to make those determinations. The reviewing court did not err in directing the disclosure of the other information. Because The Oregonian may no longer be entitled to an award of attorney fees as a matter of right, ORS 192.490(3), we reverse the supplemental judgment awarding those fees. Reversed and remanded. Footnotes [1] When Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996, it empowered the federal Department of Health and Human Services (DHHS) to promulgate regulations related to the protection of patient health information and the circumstances under which that information could be disclosed if Congress failed to enact legislation addressing those matters within three years. Citizens for Health v. Leavitt, 428 F3d 167, 172 (3rd Cir 2005), cert den, 549 US 941 (2006). Congress did not meet its deadline, and DHHS promulgated the Privacy Rule. Id. [2] Under those statutes, a person denied the right to inspect or copy a public record under the OPRL may seek review by the attorney general or a district attorney, depending on the type of public body, to determine if a public record may be withheld from public inspection. [3] In general, the OPRL does not require public bodies to create new public records. The fact that OHSU did so in this case does not change the public records disclosure issues that are presented. The parties assume, as do we, that the question presented in this case is whether the requested information (name of claimant, date of the alleged tort, name of claimant’s attorney) can be redacted from the tort claim public records that could otherwise be provided to The Oregonian pursuant to its demand and whether OHSU may disclose any of the information in some of the tort claim notices. For purposes of this case, the compilation of that information into a different public record does not change the issues that must be resolved. [4] Under ORS 192.460 (l)(a), when a district attorney carries out the review functions for public records disputes involving “a public body other than a state agency,” as here, the procedures in ORS 192.450, for resolution of public records disputes by the attorney general for state agencies, apply. Under ORS 192.450(2), when the attorney general orders disclosure of a public record, “the state agency shall comply with the order in full within seven days after issuance of the order, unless within the seven-day period it issues a notice of its intention to institute proceedings for injunctive or declaratory relief [in the appropriate circuit court]. ⅜⅜* The state agency shall institute the proceedings within seven days after it issues its notice of intention to do so.” OHSU timely instituted that type of proceeding. [5] An exemption “means merely that the public body is not obligated to disclose under ORS 192.420.” Guard Publishing Co., 310 Or at 38 n 6. Thus, if a “public body is satisfied that a claimed exemption from disclosure is justified, it may, but is not required to, withhold disclosure of [exempt] information” under the OPRL. Id. at 37-38 (emphasis added). Apart from the OPRL, other laws may inhibit the disclosure of records that are confidential or privileged. See, e.g., ORS 646.461 - 646.475 (preservation of trade secrets). [6] Under ORCP 55 H, special protection can be given, including a qualified protective order, against discovery by subpoena of “individually identifiable health information,” which is defined to mean “information that identifies an individual or that could be used to identify an individual; that has been collected from an individual and created or received by a health care provider ***; and which relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.” [7] ORS 192.553(l)(a) declares that an individual has the “right to have protected health information of the individual safeguarded from unlawful use or disclosure.” “Protected health information” is defined to mean “individually identifiable health information that is maintained * ⅜ * by a covered entity [including OHSU].” ORS 192.556(ll)(a). ORS 192.556(8) defines “individually identifiable health information” to mean “any oral or written health information in any form or medium that is: (a) [c]reated or received by a covered entity ⅜⅜⅜; and (b) identifiable to an individual *** that relates to: (A) [t]he past, present or future physical or mental health or condition of an individual; (B) [t]he provision of health care to an individual!.]” We note that, whatever relevance those statutes have in classifying privacy interests and the privacy/public interest balancing under the OPRL, they do not operate otherwise to limit or affect the disclosure of public records under the OPRL. ORS 192.558(2)(b) provides, in part, that “[a] health care provider or state health plan: * * * [m] ay use or disclose protected health information of an individual without obtaining an authorization * ⅜ * [a]s otherwise permitted or required by state or federal law or by order of the court.” Here, ORS 192.420(1) provides The Oregonian with a “right to inspect” any public records, and ORS 192.440(1) requires OHSU to provide The Oregonian copies or a reasonable opportunity to inspect the public records that The Oregonian “has a right to inspect.” Those statutes further permit OHSU to disclose those same records even if a public records exemption otherwise applies. Guard Publishing Co., 310 Or at 38. [8] It is undisputed that OHSU is a covered entity under HIPAA. See 45 CFR § 160.103 (“covered entity” means “[a] health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter”). [9] The parties raise no issue about whether the tort claim notices are conditionally exempt from disclosure under ORS 192.501(1) as “[r]ecords of a public body pertaining to litigation to which the public body is a party if the complaint [203] has been filed, or if the complaint has not been filed, if the public body shows that such litigation is reasonably likely to occur” or whether the claimants waived any confidentiality in the protected health information by voluntarily including the information in a formal legal demand that will be evidence in any resulting litigation, and we express no opinion on those issues. [10] Analogously, in Port of Portland v. Ore. Center for Environ. Health, 238 Or App 404, 409-10, 243 P3d 102 (2010), rev den, 350 Or 230 (2011), the issue was whether the exemption in ORS 192.502(9) for “[p]ublic records or information the disclosure of which is prohibited or restricted or otherwise made confidential or privileged under Oregon law” applied to a joint-defense agreement. We concluded that the entire agreement was a “confidential communication” under the exemption, thus “dispos [ing] of defendants’ argument that the Port should separate exempt and nonexempt material under ORS 192.505.” Id. at 413. [11] OHSU represents that it offered the individual notices to the court for an in camera inspection, but the court declined to do so.