OVERVIEW OF THE PRIVACY ACT OF 1974

AGENCY RULES

To implement the Act, an agency that maintains a system of records "shall promulgate rules, in accordance with [notice and comment rulemaking, see 5 U.S.C. § 553]," which shall--

C. 5 U.S.C. § 552a(f)(3)

"establish procedures for the disclosure to an individual upon his request of his record or information pertaining to him, including special procedure, if deemed necessary, for the disclosure to an individual of medical records, including psychological records pertaining to him."

comment --

In the past, a typical regulation consistent with this provision would allow an agency to advise an individual requester that his medical records would be provided only to a physician, designated by the individual, who requested the records and established his identity in writing, and that the designated physician would determine which records should be provided to the individual and which should not be disclosed because of the possible harm to the individual or another person.

However, as a result of the opinion by the Court of Appeals for the District of Columbia Circuit in Benavides v. United States Bureau of Prisons, 995 F.2d 269 (D.C. Cir. 1993), such regulations are no longer valid. In Benavides, the D.C. Circuit held that subsection (f)(3) is "strictly procedural . . . merely authoriz[ing] agencies to devise the manner in which they will disclose properly requested non-exempt records" and that "[a] regulation that expressly contemplates that the requesting individual may never see certain medical records [as a result of the discretion of the designated physician] is simply not a special procedure for disclosure to that person." Id. at 272. The D.C. Circuit went on to state that the Justice Department's subsection (f)(3) regulation at issue, 28 C.F.R. § 16.43(d) (1992), "in effect, create[d] another substantive exemption" to Privacy Act access, and it accordingly held the regulation to be "ultra vires." 995 F.2d at 272-73.

Nevertheless, the D.C. Circuit in Benavides rejected the argument that the Privacy Act requires direct disclosure of medical records to the individual. Recognizing the "potential harm that could result from unfettered access to medical and psychological records," the court provided that "as long as agencies guarantee the ultimate disclosure of the medical records to the requesting individual . . . they should have freedom to craft special procedures to limit the potential harm." Id. at 273; cf. Waldron v. Social Sec. Admin., No. CS-92-334, slip op. at 9-10 (E.D. Wash. July 21, 1993) (holding claim not ripe because plaintiff had not designated representative and had not been denied information (only direct access), but stating that portion of regulation granting representative discretion in providing access to medical records "is troubling because it could be applied in such a manner as to totally deny an individual access to his medical records").

As a result of the Benavides decision, prior case law applying (and thus implicitly upholding) subsection (f)(3) regulations, such as the Justice Department's former regulation, is unreliable. See, e.g., Cowsen-El v. United States Dep't of Justice, 826 F. Supp. 532, 535-37 (D.D.C. 1992) (although recognizing that "the Privacy Act does not authorize government agencies to create new disclosure exemptions by virtue of their regulatory powers under the Privacy Act," nevertheless upholding Department of Justice regulation); Becher v. Demers, No. 91-C-99-S, 1991 WL 333708, at *4 (W.D. Wis. May 28, 1991) (where plaintiff failed to designate medical representative and agency determined that direct access would have adverse effect on plaintiff, request was properly denied); Sweatt v. United States Navy, 2 Gov't Disclosure Serv. (P-H) ¶ 81,038, at 81,102 (D.D.C. Dec. 19, 1980) (withholding of "raw psychological data" in accordance with regulation, on ground that disclosure would adversely affect requester's health, deemed not denial of request), aff'd per curiam, 683 F.2d 420 (D.C. Cir. 1982). But see Hill v. Blevins, No. 3-CV-92-0859, slip op. at 5-7 (M.D. Pa. Apr. 12, 1993) (finding Social Security Administration procedure requiring designation of representative other than family member for receipt and review of medical and psychological information valid), aff'd, 19 F.3d 643 (3d Cir. 1994) (unpublished table decision); Besecker v. Social Sec., No. 91-C-4818, 1992 WL 32243, at *2 (N.D. Ill. Feb. 18, 1992) (dismissal for failure to exhaust administrative remedies where plaintiff failed to designate representative to receive medical records), aff'd, 48 F.3d 1221 (7th Cir. 1995) (unpublished table decision); cf. Polewsky v. Social Sec. Admin., No. 95-6125, 1996 WL 110179, at **1-2 (2d Cir. Mar. 12, 1996) (affirming lower court decision which held that plaintiff's access claims were moot because he had ultimately designated representative to receive medical records and had been provided with them (even though prior to filing suit, plaintiff had refused to designate representative); stating further that plaintiff decided voluntarily to designate representative and thus although issue was "capable of repetition" it had "not been shown to evade review").

Although there is no counterpart provision qualifying a requester's independent right of access to his medical records under the FOIA, the D.C. Circuit found it unnecessary in Benavides to confront this issue. See 995 F.2d at 273. In fact, only two courts have addressed the matter of separate FOIA access and the possible applicability of 5 U.S.C. § 552a(t)(2) (addressing access interplay between Privacy Act and FOIA), one of which was the lower court in a companion case to Benavides. See Smith v. Quinlan, No. 91-1187, 1992 WL 25689, at *4 (D.D.C. Jan. 13, 1992) (court did "not find Section 552a(f)(3) as implemented [by 28 C.F.R. § 16.43(d)] and Section 552a(t)(2) to be incompatible"; reasoning that "if Congress had intended Section 552a(t) to disallow or narrow the scope of special procedures that agencies may deem necessary in releasing medical and psychological records, it would have so indicated by legislation"), rev'd & remanded sub nom. Benavides v. United States Bureau of Prisons, 995 F.2d 269 (D.C. Cir. 1993); Waldron v. Social Sec. Admin., No. CS-92-334, slip op. at 10-15 (E.D. Wash. June 1, 1993) (same as Smith, but with regard to Social Security Administration regulation); cf. Hill, No. 3-CV-92-0859, slip op. at 7 (M.D. Pa. Apr. 12, 1993) (incorrectly interpreting subsection (f)(3) as constituting an "exempting statute" under FOIA).

For further discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,957, 28,967 (1975), and the Report of the House Committee on Government Operations, H.R. Rep. No. 1416, 93d Cong., 2d Sess., at 16-17 (1974), reprinted in


Go to Table of Contents || Previous Section Agency Rules: 5 U.S.C. § 552a(f)(2) || Next Section Agency Rules: 5 U.S.C. § 552a(f)(4)