[Until this opinion appears in the Ohio Official Reports advance sheets, it may be cited as State ex rel. Huwig v. Dept. of Health, Slip Opinion No. 2025-Ohio-4454.]

NOTICE This slip opinion is subject to formal revision before it is published in an advance sheet of the Ohio Official Reports. Readers are requested to promptly notify the Reporter of Decisions, Supreme Court of Ohio, 65 South Front Street, Columbus, Ohio 43215, of any typographical or other formal errors in the opinion, in order that corrections may be made before the opinion is published.

SLIP OPINION NO. 2025-OHIO-4454 THE STATE EX REL. HUWIG v. DEPARTMENT OF HEALTH ET AL. [Until this opinion appears in the Ohio Official Reports advance sheets, it may be cited as State ex rel. Huwig v. Dept. of Health, “Slip Opinion No.” 2025-Ohio-4454.] Mandamus—Public Records Act—R.C. 149.43—Relator not entitled to spreadsheets of certain information maintained by Ohio Department of Health in the databases in which it compiles death-related information and COVID-19 vaccination information, because production of the requested spreadsheets would require department to create a new record—Writ and relator’s requests for statutory damages, court costs, and attorney’s fees denied. (No. 2023-0936—Submitted February 11, 2025—Decided September 30, 2025.) IN MANDAMUS. __________________ The per curiam opinion below was joined by FISCHER, DEWINE, DETERS, and HAWKINS, JJ. KENNEDY, C.J., concurred in part and dissented in part, with an opinion joined by SHANAHAN, J. BRUNNER, J., concurred in part and dissented in SUPREME COURT OF OHIO

part and would grant the writ and relator’s request for costs, award $1,000 in statutory damages, and award partial attorney’s fees.

Per Curiam. {¶ 1} Relator, Kathryn Huwig, wants to research the effects of COVID-19 vaccinations using health data that respondents, the Ohio Department of Health and its director, Bruce Vanderhoff, M.D., and State Registrar Rena Bolar1 in the Bureau of Vital Statistics (collectively, “the department”), have compiled in databases. But when she invoked Ohio’s Public Records Act, R.C. 149.43, to ask the department for spreadsheets containing information from those databases, the department refused her request. It claimed that her request was too broad, sought protected health information, and would require it to make a new record, thus exempting the department from having to produce the requested spreadsheets. Huwig petitions this court for a writ of mandamus to compel the department to produce the spreadsheets she seeks. {¶ 2} Responding to Huwig’s public-records request would require the department to create a new record, which is more than the law commands. We therefore deny Huwig’s mandamus petition and her requests for statutory damages, court costs, and attorney’s fees. I. FACTS AND PROCEDURAL HISTORY A. The department’s databases contain death and vaccination information {¶ 3} The department compiles information pertaining to the deaths of Ohioans in two separate databases. Most of the information contained in the first database (which is kept for the sole purpose of producing death certificates) is also transferred and kept in the second database (which contains a broader range of death

1. Huwig named as a respondent Judith Nagy, the former state registrar in the Bureau of Vital Statistics. Rena Bolar succeeded Nagy, and we have automatically substituted Bolar for Nagy in this case. See S.Ct.Prac.R. 4.06(B).

2 January Term, 2025

information and has greater functionality). The more detailed database (“death- information database”) has a line entry for each death, with each entry containing fields for information such as the decedent’s name, cause of death, and address. {¶ 4} Utilizing third-party software, the department can export line items from the death-information database into a plain-text spreadsheet known as a CSV (comma-separated values) file that a standard computer-spreadsheet program, such as Microsoft Excel, can read. The department can program the database to export a specified set of fields into this format while excluding other fields. It has compiled and maintains spreadsheets of death data for each year dating back to 2007. Prior to the COVID-19 pandemic, the department produced customized datasets upon public request, though each dataset required the department to develop a custom query to narrow the fields to be included in the exported file. {¶ 5} To produce a limited dataset directly from the death-information database for public inspection, the department can run a query to produce a spreadsheet that contains only specific fields. But depending on the complexity of the query, doing so could take the department one minute to several months. And the database does not have the functionality to redact or obscure data fields for a particular dataset, so redaction would still have to be performed in another computer-based spreadsheet program, such as Excel, afterward. The department can also generate from its database a spreadsheet containing a complete copy of the death data for a particular year, then redact that data using a spreadsheet program, such as Excel. {¶ 6} The department similarly compiles Ohioans’ vaccination records in a separate database. It uses this information to conduct research, to provide data to doctors for coordinating patient care, to provide patients with a record of their own vaccination status, and to send redacted data to researchers who have received the requisite approval. The department also used this database to comply with federal reporting requirements during the COVID-19 pandemic.

3 SUPREME COURT OF OHIO

{¶ 7} Information in the vaccinations database can also be exported into a plain-text spreadsheet by running a new search query using a specialized third-party software program. These queries can be complex or straightforward. As with the other databases, the resulting spreadsheet can be redacted using a computer- spreadsheet program, such as Excel. B. Huwig requested specific datasets from the department’s databases {¶ 8} Huwig analyzes health data as a private citizen who runs a Facebook group and podcast that focus on issues regarding COVID-19 data. In 2021, based on her own analyses of the department’s then-public datasets, she twice testified before an Ohio House committee. At the first hearing, she criticized the department’s data. Shortly thereafter, the department changed which data were publicly available online, with the effect that Huwig had fewer data to analyze. {¶ 9} In 2023, Huwig requested from the department a list of the data fields in the death-information and vaccination databases. Once the department provided her with that information, Huwig used the data-field terms to submit a public- records request for spreadsheets from the databases containing a total of over 100 fields of information for a several-year period. When the department responded that such records do not exist and that it would not create them, Huwig amended her request to the same information for a one-year period—2021—with redactions of protected health information. She also asked for more information about how the department organizes the databases so that she could fine-tune her request. {¶ 10} The department informed Huwig that the databases were organized by person but refused to provide her with further information about how it maintains and accesses the data on the ground that such information involves critical infrastructure and is not subject to release as a public record under R.C. 149.433(B)(1). It also denied Huwig’s amended request for the 2021 data, asserting that (1) the request was overbroad, (2) the request would require the department to create a new record, and (3) the department could not avoid revealing protected

4 January Term, 2025

health information even if it created a new record to respond to the request. Brian Fowler, who oversees public-health informatics at the department, later explained that since so much information is available on the internet, the department cannot know how much information it would need to redact from the requested spreadsheets to prevent bad actors from identifying individuals whose information is contained on those spreadsheets. {¶ 11} Huwig brings this original action, seeking a writ of mandamus to compel the department to provide her with the records she requested. We granted an alternative writ and ordered merits briefing. 2024-Ohio-2781. II. ANALYSIS A. We grant Huwig’s motion for leave to submit rebuttal evidence {¶ 12} Huwig moved for leave to file rebuttal evidence under S.Ct.Prac.R. 12.06(B), consisting of an affidavit by Robert Bounds, a data-warehouse developer who works as an independent contractor, and an affidavit of her own. The department objects to admission of the former on the ground that it does not respond to any new fact or argument the department presented. And it objects to admission of the latter on the ground that the new affidavit testimony merely expands on Huwig’s earlier affidavit testimony about her attorney’s fees. We disagree with both the department’s rationales. {¶ 13} This court has discretion to admit rebuttal evidence in writ cases, provided it is timely filed. See, e.g., State ex rel. Gil-Llamas v. Hardin, 2021-Ohio- 1508, ¶ 14. The department does not dispute that Huwig’s motion for leave to submit rebuttal evidence was timely filed. Therefore, we consider whether the proposed rebuttal evidence is “‘given to explain, refute, or disprove new facts introduced into evidence by the adverse party . . . to challenge the evidence offered by the opponent.’ ” State ex rel. Mobley v. Powers, 2024-Ohio-104, ¶ 11, quoting State v. McNeill, 1998-Ohio-293, ¶ 44. The department claims that neither of the

5 SUPREME COURT OF OHIO

affidavits proposed as rebuttal evidence responds to any fact or argument that it has presented. {¶ 14} Bounds’s new affidavit adds to testimony he presented in an earlier affidavit that Huwig submitted with her evidence in this case. In this new affidavit, Bounds renews his averment that he received upon request a copy of the 2019 death-information database from the department. He includes additional details about his receipt of that information from the department and appends a copy of emails he exchanged with the department related thereto. {¶ 15} The department contends that such evidence is not responsive to any facts or arguments that it presented in its merit brief or evidence. And it claims that it never disputed any of the facts Bounds testified to in his first affidavit. But it did dispute Bounds’s initial affidavit testimony. In its merit brief, the department noted that it “does not . . . create or release custom reports with line-level death data in response to public records requests.” This contradicts Bounds’s initial affidavit testimony that he received such data from the department. Bounds refutes the department’s assertion in his new affidavit, with emails attached in support of his testimony. {¶ 16} Huwig’s new affidavit also adds to testimony she presented in an earlier affidavit concerning her attorney’s fees. In a prior affidavit, Huwig averred that she will need to pay her attorney, but in this new affidavit, she explains that she will need to pay “legal fees for services rendered in connection with this matter” and appends the attorney-fee agreement. The information Huwig provides in this new affidavit refutes the department’s representation in its merit brief that “the evidence shows that Ms. Huwig has not incurred, and will not incur, any attorney’s fees.” Accordingly, we grant Huwig’s motion and admit both affidavits and their attachments as rebuttal evidence.

6 January Term, 2025

B. The records Huwig requested do not exist {¶ 17} Ohio’s Public Records Act requires a custodian of public records to make those records not subject to an exception available to any person upon request. R.C. 149.43(B)(1)2. If the records custodian fails in this duty, the requesting party may petition this court for a writ of mandamus to enforce its legal right to the record. R.C. 149.43(C)(1). {¶ 18} To be entitled to a writ of mandamus, Huwig must prove that she has a clear legal right to the records she requested and that the department has a clear legal duty to provide them. State ex rel. Cincinnati Enquirer v. Sage, 2015-Ohio- 974, ¶ 10. If the department has withheld a requested public record, it must prove that some exception to disclosure applies. See State ex rel. School Choice Ohio, Inc. v. Cincinnati Pub. School Dist., 2016-Ohio-5026, ¶ 11. {¶ 19} The parties dispute whether the databases are themselves public records and whether the records Huwig requested even exist. Huwig must prove the requested records are existing “(1) documents, devices, or items, (2) created or received by or coming under the jurisdiction of the [department], (3) which serve to document the organization functions, policies, decisions, procedures, operations, or other activities of the office,” State ex rel. Dispatch Printing Co. v. Johnson, 2005-Ohio-4384, ¶ 19. {¶ 20} We need not resolve whether the databases at issue here are themselves public records. Huwig did not request copies of the databases but, rather, spreadsheets containing certain information generated from the databases. The department argues that the records Huwig seeks (i.e., spreadsheets summarizing certain death and vaccination data) do not exist. It asserts that

2. The General Assembly amended R.C. 149.43 in 2024 Sub.H.B. No. 265 with an effective date of April 9, 2025. This opinion applies the version of the statute enacted in 2022 Am.Sub.H.B. No. 45 (effective Apr. 7, 2023).

7 SUPREME COURT OF OHIO

although it could produce spreadsheets from its databases with the information Huwig seeks and then redact those files, it is not required to do so. We agree. {¶ 21} If a requested record does not already exist, the custodian of records need not search through another record to find information that the requester seeks and compile it into a new record. State ex rel. Kerner v. State Teachers Retirement Bd., 1998-Ohio-242, ¶ 6; see also State ex rel. Adkins v. Cantrell, 2023-Ohio-1323, ¶ 30. An agency has a duty to respond only to requests for public records that exist, not to respond to requests for information contained in those records. State ex rel. Morgan v. New Lexington, 2006-Ohio-6365, ¶ 30. {¶ 22} A digital record that is the subject of a public-records request exists at the time the request was made only if the “computer were already programmed to produce the desired printout,” State ex rel. Scanlon v. Deters, 45 Ohio St.3d 376, 379 (1989), overruled on other grounds by State ex rel. Steckman v. Jackson, 70 Ohio St.3d 420 (1994), overruled in part on other grounds by State ex rel. Caster v. Columbus, 2016-Ohio-8394, ¶ 47. A public official is not required to “create a new ‘document’ by compiling material to facilitate review of the public records.” Id. Reprogramming a computer’s software to extract certain information from an existing public record and then compiling that information into a new file creates a new record to the same extent that combing through an existing public record and copying the relevant information by hand onto a steno pad would. But the Public Records Act does not impose such a duty on public-records custodians. See State ex rel. O’Shea & Assocs. Co., L.P.A. v. Cuyahoga Metro. Hous. Auth., 2012-Ohio- 115, ¶ 19-21; Adkins at ¶ 30. To be sure, there are clear digital analogs to photocopying and redacting a paper record, such as copying an existing computer file onto a flash drive. But Huwig has not requested an existing document or a redacted copy of an existing document. {¶ 23} To fulfill Huwig’s public-records request, the department would have to run a complex query to extract certain information from the existing

8 January Term, 2025

databases and then organize that information in two new files. So the spreadsheets Huwig requested will exist only if the department runs a newly created query in the databases to create them. The department claims that doing this would be akin to reprogramming its computer software and that that type of reprogramming would equate to searching through existing records to compile information into a new record. {¶ 24} We agree. Though the department would not have to completely reprogram its computer to extract the data Huwig requests, Scanlon at 379, it would have to (1) write a new query to search both databases to extract the specifically requested information from each one, (2) save that information in a new record that another computer program can read, and (3) then redact protected health information from each spreadsheet. Such a process more closely resembles handwriting a new record using existing information than it does copying and redacting an already existing record. Compare Kerner, 1998-Ohio-242, at ¶ 2, 6- 7, with State ex rel. Shaughnessy v. Cleveland, 2016-Ohio-8447, ¶ 12. {¶ 25} Huwig amended her public-records request, narrowing it to a request for data from 2021 instead of a several-year period, with the information to be redacted as the department saw fit. This amendment, however, does not change the fact that the department would have to program a new query to search for and extract the information that Huwig requests and then save that information in a new document, thereby creating a new record. {¶ 26} The fact that a spreadsheet already exists that contains death data from 2021 does not save Huwig’s case. The existing spreadsheet contains categories of data that Huwig did not request, and in her request, Huwig asked for data that the 2021 spreadsheet does not contain. Her request would therefore require the department to create a new spreadsheet with the specific data she seeks, rather than redacting an existing spreadsheet.

9 SUPREME COURT OF OHIO

{¶ 27} For these reasons, we find that Huwig has failed to prove that the department has a clear legal duty to produce the spreadsheets she has requested, and thus she is not entitled to the requested writ of mandamus. Because we deny the writ on this basis, we need not address the two exceptions under R.C. 149.43 that the department asserted in denying Huwig’s public-records request—that the request was overbroad and sought protected health information. And since the department did not violate any statutory duty under R.C. 149.43(B), Huwig has no grounds to receive an award of statutory damages, court costs, or attorney’s fees. See R.C. 149.43(C). III. CONCLUSION {¶ 28} The law does not require the department to create new records to respond to a public-records request. Writing a new query to extract certain information from existing digital records is legally no different from asking a custodian to comb through an existing record and handwrite certain information in a new document. Yet this is what Huwig expects the department to do to respond to her public-records request. {¶ 29} We find that Huwig has not shown by clear and convincing evidence that the department has a clear legal duty to produce the spreadsheets she requested. We therefore deny Huwig’s claim for mandamus relief and her requests for statutory damages, court costs, and attorney’s fees. Writ denied. __________________ KENNEDY, C.J., joined by SHANAHAN, J., concurring in part and dissenting in part. {¶ 30} I concur in the court’s judgment granting relator Kathryn Huwig’s motion for leave to submit rebuttal evidence. I write separately, however, because the majority errs in denying Huwig’s request for a writ of mandamus ordering respondents, the Ohio Department of Health and its director, Bruce Vanderhoff,

10 January Term, 2025

M.D., and State Registrar Rena Bolar3 of the Bureau of Vital Statistics (collectively, “the department”), to produce the records Huwig asked for in a public-records request. {¶ 31} The majority concludes that the department would have to create a new record to respond to Huwig’s public-records request. See majority opinion, ¶ 2. However, as the majority itself recognizes, the department admits that it could provide the records Huwig requested by producing spreadsheets from its databases with the specific information Huwig seeks. See id. at ¶ 20. And Huwig’s request that the public records be produced as electronic spreadsheets is no different than if she had asked for a printout of an electronic public record. No one would suggest that if Huwig had asked for the latter that she would be seeking the creation of a new public record. {¶ 32} Accordingly, I concur in part and dissent in part. In addition to granting Huwig’s motion for leave to submit rebuttal evidence, I would grant the writ and award court costs, statutory damages, and attorney fees. Facts Huwig’s Public-Records Request {¶ 33} Huwig first transmitted her public-records request to the department on May 12, 2023, by email, seeking a report of data contained in the Ohio Mortality Download File (“death database”) for the years 2017 through 2023. In the same email, Huwig requested a report of vaccination data from Ohio’s Impact SIIS COVID-19 Vaccination dataset (“vaccination database”) for the years 2020 through 2023. Huwig requested that the records be provided as plain-text spreadsheets, which are saved as CSV files, a format that is readable by Microsoft Excel. As the majority recognizes, the department admittedly can export

3. Huwig named Judith Nagy, the former state registrar in the Bureau of Vital Statistics, as a respondent. Rena Bolar succeeded Nagy, and this court automatically substituted Bolar for Nagy in this case. See S.Ct.Prac.R. 4.06(B).

11 SUPREME COURT OF OHIO

information from these two databases into that file format. See majority opinion at ¶ 4. {¶ 34} The department denied Huwig’s public-records request, stating that it would have to create new records to respond to the request and that the requested information could reveal protected health information. {¶ 35} Huwig offered to resolve the issue by “revising [her] request to include the entire [death database] and [vaccination] database record(s) for the years and in the file format originally requested.” The department denied her request again, stating that the request was overbroad and that the requested records did not exist. {¶ 36} In response, Huwig asked that the department explain how the requested records are maintained and categorized so she could revise her public- records request. But the department said no, asserting that information about the databases’ file structure constitutes “an infrastructure record” that is not subject to release as a public record under R.C. 149.433(B)(1). {¶ 37} Later, in a May 19 email, Huwig requested “the [death database] and the [vaccination database] only for the year 2021.” The department denied the request, saying that it was still overbroad. And in response to Huwig’s renewed request for information regarding how the records are maintained, the department said only that “[t]he systems are person-based and information is recalled by person.” The Death Database and the Vaccination Database {¶ 38} The death database consists of information compiled from death certificates of persons who die in the State of Ohio and for Ohioans who die in another state. This database has a line entry for each death and contains information such as the cause of death and conditions contributing to death and the decedent’s name, address, date of birth, and race. The database can be accessed online by members of the public through a public portal and by the department through a

12 January Term, 2025

secure portal. The public portal allows members of the public to see “canned” reports or to build custom reports from the database of deidentified aggregate data. And, as the department concedes, from its secure portal, it can download mortality datasets into a CSV file, including datasets for the year 2021. {¶ 39} The department similarly maintains Ohioans’ vaccination records in the vaccination database. The department uses this information to provide vaccination data to doctors on request, and to send to researchers as part of approved research requests. The department also used this database to comply with the reporting requirements of the Centers for Disease Control and Prevention (“CDC”) during the COVID-19 pandemic. The department concedes that it can output the vaccination database into a CSV file. Law and Analysis {¶ 40} The majority declines to consider whether the death database and the vaccination database are public records because “Huwig did not request copies of the databases but, rather, spreadsheets containing certain information generated from the databases.” See majority opinion at ¶ 20. But Huwig did request copies of the databases as output through spreadsheets; therefore, I first address whether the databases are public records. The Death Database and the Vaccination Database Are Public Records {¶ 41} A “record” within the context of Ohio’s Public Records Act, R.C. 149.43,4 is “any document, device, or item, regardless of physical form or characteristic, including an electronic record” that “serves to document the organization, functions, policies, decisions, procedures, operations, or other activities of the [public] office.” R.C. 149.011(G).

4. The General Assembly amended R.C. 149.43 in 2024 Sub.H.B. No. 265 with an effective date of April 9, 2025. This opinion applies the version of the statute enacted in 2022 Am.Sub.H.B. No. 45 (effective Apr. 7, 2023).

13 SUPREME COURT OF OHIO

{¶ 42} To prove that the records she requested are public records, Huwig must show by clear and convincing evidence that they are “‘(1) documents, devices, or items, (2) created or received by or coming under the jurisdiction of the [department], (3) which serve to document the organization functions, policies, decisions, procedures, operations, or other activities of the [department],’ ” Hicks v. Union Twp., Clermont Cty. Bd. of Trustees, 2024-Ohio-5449, ¶ 15, quoting State ex rel. Dispatch Printing Co. v. Johnson, 2005-Ohio-4384, ¶ 19; see also R.C. 149.011(G). {¶ 43} This court has previously held that records compiled in a single database are public records, the production of which may be compelled by a writ of mandamus. In State ex rel. Cincinnati Enquirer v. Jones-Kelley, a newspaper sought access to an electronic database maintained by the Ohio Department of Job and Family Services (“ODJFS”) containing the names and addresses of foster caregivers. 2008-Ohio-1770, ¶ 2. This court held that ODJFS maintained the database as “part of the department’s duty in certifying foster caregivers” and that it was therefore a public record. Id. at ¶ 7. {¶ 44} Here, the department maintains the death database to carry out its function of providing death certificates, and it maintains the COVID-19 vaccination data in its vaccination database because it used that database to carry out its reporting function to the CDC during the COVID-19 pandemic. The databases at issue, then, are public records. How Records Are Stored Does Not Exempt Them from Disclosure Under the Public Records Act {¶ 45} The issue in this case is whether a public-records request for a portion of a database containing aggregated data requires the public office responsible for the database to create a new record to respond to the request or whether the requested record already exists when the public office can export the database into a CSV file and redact it as needed.

14 January Term, 2025

{¶ 46} Relying on State ex rel. Scanlon v. Deters, 45 Ohio St.3d 376 (1989), overruled on other grounds by State ex rel. Steckman v. Jackson, 70 Ohio St.3d 420 (1994), overruled in part on other grounds by State ex rel. Caster v. Columbus, 2016-Ohio-8394, ¶ 47, the majority concludes that Huwig’s public-records request would require the department to create a new document. See majority opinion at ¶ 22-24. {¶ 47} In Scanlon, the relator requested that the clerk of court “compile for relator’s inspection records of all dispositions of criminal cases concerning Robert A. Scanlon, by utilizing a computer system.” Scanlon at 376. This court determined that to respond to the request, the clerk would have to create a new public record because the request would “require the clerk of courts to compile [the requested] data through a search of the files in his possession.” Id. at 379. This court reasoned that to constitute a record that already exists, the clerk’s computer would need to “already [be] programmed to produce the desired printout,” but it was not. Id. {¶ 48} All of that is dicta because in Scanlon, this court denied the writ because the relator had an adequate remedy in the ordinary course of the law. Id.; see also id. at 378. Therefore, it was unnecessary for this court to decide in Scanlon whether the database at issue was a public record or whether the clerk had been asked to create a new record. And dicta in a prior case “has no binding effect on this court’s decision in this case.” Cosgrove v. Williamsburg of Cincinnati Mgt. Co., Inc., 1994-Ohio-295, ¶ 16. {¶ 49} But in any event, to the extent Scanlon was correctly decided, it is distinguishable. Unlike in Scanlon, Huwig did not ask the department to compile the data in a manner that would create a new record, such as by requesting that the department merge the data in the death and vaccination databases. Rather, Huwig simply requested that the data in those databases be exported and produced to her in a certain manner. What she requested is no different from a person’s asking a

15 SUPREME COURT OF OHIO

public office to make a paper copy of a file kept on microfiche, to print a hard copy of an electronic document, or to export a copy of an electronic record to a PDF file. Consequently, Huwig did not ask the department to create a new record, because the information she seeks from the department’s databases can be exported to a CSV file and redacted to contain only the necessary fields of information. No Exception Applies to Huwig’s Public-Records Request {¶ 50} Because the records that Huwig requested from the department are public records that exist, to deny Huwig’s public-records request, the public office must show that the records are excepted from disclosure. State ex rel. School Choice Ohio, Inc. v. Cincinnati Pub. School Dist., 2016-Ohio-5026, ¶ 11. {¶ 51} The department’s rationale for withholding the requested records is twofold: First, it claims that Huwig’s public-records request is overbroad, amounting to a request for the complete reproduction of all information in its death and vaccination databases for the identified years. Second, the department claims that Huwig requests protected health information, the production of which is excepted by statute from public-records requests, see R.C. 149.43(A)(1)(a); R.C. 3701.17(B). {¶ 52} To begin with, the department cannot claim overbreadth as a defense for failing to produce to Huwig the requested records. When denying a public- records request as overbroad, a records custodian is required to “provide the requester with an opportunity to revise the request by informing the requester of the manner in which records are maintained by the public office and accessed in the ordinary course of the public office’s . . . duties.” R.C. 149.43(B)(2). The department refused to inform Huwig of the manner in which the requested records are maintained, claiming that doing so would reveal critical infrastructure; it informed Huwig only that the records are “person-based” and that the “information is recalled by person,” which does not explain how the records are maintained. Having failed to allow Huwig the opportunity to cure, the department cannot assert

16 January Term, 2025

an overbreadth defense now. See State ex rel. Summers v. Fox, 2020-Ohio-5585, ¶ 74. {¶ 53} Whether a public-records request is overbroad is a determination that must be made on a case-by-case basis, “analyzed under the totality of facts and circumstances,” State ex rel. Zidonis v. Columbus State Community College, 2012- Ohio-4228, ¶ 26. If a public-records requester asks for the “‘complete duplication of voluminous files kept by government agencies,’ ” the request is overbroad and the records custodian may deny the request. State ex rel. Cleveland Assn. of Rescue Emps. v. Cleveland, 2023-Ohio-3112, ¶ 17, quoting State ex rel. Warren Newspapers, Inc. v. Hutson, 1994-Ohio-5, ¶ 22. {¶ 54} However, neither the time range nor the category of documents requested independently determines overbreadth. See id. at ¶ 17, 24-25. Rather, the keys to determining whether a public-records request is overbroad are clarity and concision: the custodian must be able to identify the files requested without extensive research. See State ex rel. Carr v. London Corr. Inst., 2015-Ohio-2363, ¶ 22. {¶ 55} The department argues that Huwig’s public-records request is overbroad because the responsive CSV files would contain millions of cells of data. Overbreadth, however, does not refer to the size of the requested records but rather to a lack of specificity in a public-records request leading to an overinclusion of an immense volume of records. E.g., State ex rel. Data Trace Info. Servs., L.L.C. v. Cuyahoga Cty. Fiscal Officer, 2012-Ohio-753, ¶ 1, 71 (granting a writ of mandamus compelling a public office to provide on compact disc to a public- records requester a copy of all documents recorded in that office over a two-month period). {¶ 56} The department knows exactly which records Huwig has requested here, and its argument against producing those records is tantamount to a claim that a public office can deny a public-records request if the requested record is too many

17 SUPREME COURT OF OHIO

pages long. However, that is not the law. Huwig specified with clarity the records she requested and the data she is seeking to obtain from those records. Therefore, the department’s overbreadth defense fails. {¶ 57} Next, the department maintains that protected health information is excepted from disclosure. See R.C. 3701.17(B). “Protected health information” includes any information that “describes an individual’s past, present, or future physical or mental health status or condition, receipt of treatment or care, or purchase of health products” and is linked to information that “reveals the identity of the individual” or “could be used to reveal the identity of the individual.” R.C. 3701.17(A)(2)(a) and (b). If the information does not identify the individual, then it is not protected health information. R.C. 3701.17(C); see Ludlow v. Ohio Dept. of Health, 2024-Ohio-1399, ¶ 1. So, when responding to a public-records request, a public office may produce records that contain protected health information so long as the protected health information is redacted. Cuyahoga Cty. Bd. of Health v. Lipson O’Shea Legal Grp., 2016-Ohio-556, ¶ 10-12. {¶ 58} Here, no one disputes that the death and vaccination databases maintained by the department likely contain protected health information. The department claims that because of the nearly infinite amount of information available on the internet and its policy to avoid providing the public with any information that could be used to identify a particular individual, it is difficult for the department to know which data it could leave unredacted in the records requested by Huwig. {¶ 59} If accepted, this argument would practically vitiate all public-records requests made to the department. And that would be contrary to R.C. 3701.17(C), which says:

Information that does not identify an individual is not protected health information and may be released in summary,

18 January Term, 2025

statistical, or aggregate form. Information that is in a summary, statistical, or aggregate form and that does not identify an individual is a public record under section 149.43 of the Revised Code and, upon request, shall be released by the director [of health].

{¶ 60} It may be true that the availability of information on the internet makes redacting information from public records to preclude an individual’s being identified from that information harder than it would have been in the predigital era. E.g., State ex rel. Beacon Journal Publishing Co. v. Akron, 1994-Ohio-6, ¶ 12- 13, 37 (concluding that to protect individuals’ federal right to privacy, a city must delete its employees’ Social Security numbers from a computer database before producing the database to a public-records requester). But the department must prove that an exception applies to its duty to produce public records requested under R.C. 149.43, and the department has not presented any evidence in this case to show that it has actually tried to redact protected health information from the records that Huwig requested. {¶ 61} Anyone who has used spreadsheet software understands how to delete or obscure a column or row of information. And here, the department has not shown that it could not redact protected health information from the records Huwig requested once those records are exported to a CSV file. Therefore, I would grant the writ ordering the department to produce the requested records after redacting protected health information. Huwig Is Entitled to Court Costs, Statutory Damages, and Attorney Fees {¶ 62} R.C. 149.43(C)(3)(a)(i) provides that “[i]f the court orders the public office or the person responsible for the public record to comply with [R.C. 149.43(B)], the court shall determine and award to the relator all court costs, which shall be construed as remedial and not punitive.” Because I would grant the writ, I would also award Huwig court costs.

19 SUPREME COURT OF OHIO

{¶ 63} R.C. 149.43(C)(2) provides that a public-records requester is entitled to recover statutory damages “at one hundred dollars for each business day during which the public office or person responsible for the requested public records failed to comply with an obligation in accordance with [R.C. 149.43(B)], beginning with the day on which the requester files a mandamus action to recover statutory damages, up to a maximum of one thousand dollars.” Because the department failed to comply with its statutory obligations by improperly denying Huwig’s public-records request, Huwig is entitled to statutory damages. {¶ 64} However, a court may reduce or decline to award statutory damages if “a well-informed public office . . . reasonably would believe that the conduct of the public office . . . did not constitute a failure to comply with an obligation in accordance with [R.C. 149.43(B)].” R.C. 149.43(C)(2)(a). {¶ 65} The department argues that any damages awarded to Huwig should be reduced because its denial of her public-records request was made on the good- faith bases that (1) the request was overbroad, (2) the department reasonably believed it was not required to create a new record, and (3) the requester sought protected health information. {¶ 66} When a public office claims that a public-records request is overbroad, it has a duty to “inform[] the requester of the manner in which records are maintained by the public office and accessed in the ordinary course of the public office’s . . . duties.” R.C. 149.43(B)(2). But here, the department did not inform Huwig of the manner in which it maintains the requested records; it told her only that the records are “person-based” and “recalled by person.” That information does not explain how the records are maintained. {¶ 67} With respect to its argument that it is not required to create a new record to respond to Huwig’s request, the discussion above demonstrates that the death and vaccination databases themselves are the public records. Therefore, the

20 January Term, 2025

department did not reasonably believe that no responsive public records exist that could be produced. {¶ 68} Although the department has a duty to safeguard protected health information, it also has a duty to try to redact protected health information from the records it maintains to comply with its obligations under the Public Records Act. The department’s denial of Huwig’s public-records request in total, without considering the possibility of redaction, violated the Public Records Act. Therefore, the factors that allow a court to reduce statutory damages do not apply here. And because the department has not produced the public records that Huwig requested in May 2023, she is entitled to an award of $1,000 in statutory damages. {¶ 69} Finally, R.C. 149.43(C)(3)(b) provides that “[i]f the court renders a judgment that orders the public office or the person responsible for the public record to comply with [R.C. 149.43(B)] . . . , the court may award reasonable attorney fees to the relator, subject to [R.C. 149.43(C)(4)].” Because I would order the department to produce the requested records, Huwig would be eligible for attorney fees subject to the limitation in R.C. 149.43(C)(3)(c). {¶ 70} R.C. 149.43(C)(3)(c) provides identical factors to those found in R.C. 149.43(C)(2) that allow a court to reduce or decline to award statutory damages, which must be considered when determining whether to award attorney fees. If both factors are met, the court shall not award attorney fees. R.C. 149.43(C)(3)(c). As discussed above regarding the statutory-damages- reduction factors, the prohibition against awarding attorney fees that arises under R.C. 149.43(C)(3)(c) similarly does not apply here, because no “well-informed public office . . . reasonably would believe” that the department’s actions did not constitute a failure to comply with the Public Records Act. {¶ 71} “When considering whether to award attorney fees in public-records cases, a court may consider the presence of a public benefit conferred by a relator seeking the disclosure and the reasonableness and good faith of a respondent in

21 SUPREME COURT OF OHIO

refusing to disclose.” State ex rel. Cincinnati Enquirer v. Ohio Dept. of Pub. Safety, 2016-Ohio-7987, ¶ 53. {¶ 72} As the majority recognizes, “Huwig analyzes health data as a private citizen who runs a Facebook group and podcast that focus on issues regarding COVID-19 data. In 2021, based on her own analyses of the department’s then- public datasets, she twice testified before an Ohio House committee.” Majority opinion at ¶ 8. And after the department changed which data is publicly available, Huwig made her public-records request. See id. at ¶ 8-9. In analyzing the data and sharing her findings, Huwig seeks to provide a public benefit. {¶ 73} The department argues that Huwig is not entitled to attorney fees because she has not incurred any. But Huwig testified in a deposition that she has an attorney whom she plans to pay for legal services related to this case. And she presented as evidence a copy of a fee agreement that she entered into with an attorney on August 2, 2024. Therefore, I would award Huwig attorney fees in this case, though I would limit that award to only those fees that Huwig incurred after the fee agreement was executed. I would make a final determination of the amount of attorney fees to be awarded upon review of Huwig’s filing of an itemized application with independent evidence supporting the reasonableness of the hourly rates charged and the hours billed, applying the statutory guidelines in R.C. 149.43(C)(4). Conclusion {¶ 74} For the foregoing reasons, I concur in part and dissent in part. I agree with the court’s decision to grant Huwig’s motion for leave to submit rebuttal evidence, but I would also grant Huwig’s request for a writ of mandamus and order respondents to produce the requested records. I would also award court costs, $1,000 in statutory damages, and attorney fees upon review of an itemized application with independent evidence supporting the reasonableness of the hourly rates charged and the hours billed.

22 January Term, 2025

__________________ Mendenhall Law Group and Thomas W. Connors, for relator. Dave Yost, Attorney General, and Katherine Bockbrader and Theresa Dirisamer, Assistant Attorneys General, for respondents. ________________________

23