Ohio Public Records Act Exemptions: Scope, Redaction, and Denials

The Ohio Public Records Act exemptions are the categories of government records that Ohio Revised Code 149.43 removes from the statute’s default rule of public access. The Act starts from the premise that records held by public offices are open, then carves out specific protections for medical files, confidential law enforcement investigations, security and infrastructure information, personal identifiers, trade secrets, attorney-client communications, student education records, and roughly two dozen other categories. Knowing which exemption an agency is citing — and whether it actually applies — is the difference between accepting a denial and successfully challenging one.¹

Medical Records

Ohio Revised Code 149.43(A)(1)(a) lists medical records as a category excluded from the definition of a public record.¹ That covers files held by county hospitals, state-run nursing homes, correctional facilities, and emergency medical services.

Federal law layers on top. The HIPAA Privacy Rule bars covered entities, including public hospitals and government health plans, from disclosing individually identifiable health information without patient authorization unless a specific exception applies, such as treatment, payment, or public health oversight.²

Ohio law also protects health data gathered during disease surveillance. Ohio Revised Code 3701.17 makes information reported to or obtained by the Ohio Department of Health or local health districts confidential, releasable only with written consent unless a narrow exception applies, such as the health director’s determination that release is necessary to control a clear public health threat.³ Mental health records maintained by state psychiatric hospitals and community mental health agencies receive separate protection under Ohio Revised Code 5122.31.⁴

Confidential Law Enforcement Investigatory Records

Ohio Revised Code 149.43(A)(1)(h) exempts “confidential law enforcement investigatory records.”¹ The word doing the work is “confidential.” Routine incident reports and arrest records are generally available because they document what happened. What the exemption protects is information that would reveal investigative techniques, confidential informant identities, undercover officer details, and similar material that could compromise an active case or endanger someone.

Courts have held that the exemption applies to records compiled in the course of an investigation, not to every document a police department happens to possess. Closing an investigation does not automatically strip a record of confidential status. If releasing the information would still jeopardize a related case, reveal protected techniques, or endanger a witness, the exemption continues to apply.

Records like 911 call recordings, body camera footage, and dispatch logs occupy a middle zone. They are not inherently investigatory, but portions may be redacted where they contain information tied to an active investigation or would reveal details that could endanger someone. In practice you can often obtain these records, with sensitive portions blacked out.

Personal Privacy and Identifying Information

Several exemptions in Ohio Revised Code 149.43(A)(1) exist to prevent identity theft, harassment, and retaliation. Ohio Revised Code 149.45 allows certain public employees — including law enforcement officers, judges, prosecutors, and other specified professions — to request that their home addresses and other personal identifying information be redacted from records made available online.⁵ Financial account numbers, taxpayer identification numbers, and Social Security numbers in government records are also protected.

Crime victims have a separate layer of privacy. Ohio voters approved Marsy’s Law as a constitutional amendment in November 2017, giving victims of crime the right to keep personal information — including addresses and contact details — confidential unless they consent to disclosure. That protection operates independently from the Public Records Act and applies even when no statutory exemption would otherwise cover the information.

Security and Infrastructure Records

Ohio Revised Code 149.433 creates a dedicated exemption for security records used to protect public offices against attack, interference, or sabotage.⁶ It reaches vulnerability assessments of bridges and water treatment plants, emergency evacuation plans for government buildings, security system configurations, and threat assessments prepared for public facilities.

Cybersecurity records fall inside this exemption too. Network architecture diagrams, hardware and software configurations, encryption protocols, and incident response plans can be withheld because their release would hand attackers a roadmap to public systems. The same logic covers counter-terrorism protocols, tactical response plans, and intelligence gathered about threats to public infrastructure. If you request records from a city water department or a transit authority, you can generally obtain operational documents such as budgets, contracts, and meeting minutes, but not the security assessment identifying where the system is vulnerable.

Trade Secrets and Proprietary Business Data

Businesses dealing with Ohio government agencies do not automatically surrender proprietary information. Ohio Revised Code 149.43(A)(1) includes protection for trade secrets, and the Act’s catch-all at subsection (v) shields any record whose release is prohibited by other state or federal law, which pulls in records protected under Ohio’s Uniform Trade Secrets Act.¹ Ohio Revised Code 1333.61 defines a trade secret as information that derives independent economic value from not being generally known and is the subject of reasonable efforts to maintain its secrecy.⁷

This comes up whenever a company submits financial projections, proprietary technology descriptions, or internal market research as part of a government bid, regulatory filing, or economic development application. The burden falls on the business claiming the exemption, not on the records requester. A company cannot simply stamp “confidential” on a bid package and expect blanket protection; it must identify specific information that qualifies as a trade secret and explain why disclosure would be harmful. In State ex rel. Besser v. Ohio State University (2000), the Ohio Supreme Court held that trade secrets held by a public university warranted in camera judicial review rather than automatic disclosure.⁸ Courts generally require disclosure of contract terms and public spending figures while shielding the proprietary methods or technology behind the work.

Attorney-Client Communications and Work Product

When a city attorney advises a mayor on pending litigation, or a state agency’s counsel prepares a legal analysis of a regulatory dispute, those communications do not become public because the client is a government entity. The Act recognizes attorney-client privilege and attorney work product, allowing government lawyers to give candid legal advice without it surfacing in a records request.

To qualify, the communication must involve actual legal advice given in confidence and relate to the official duties of the public entity receiving counsel. Internal emails that happen to copy a government attorney do not automatically become privileged; the attorney must be functioning in a legal advisory role. Litigation strategy memoranda, draft legal opinions, and compliance assessments prepared by or at the direction of an attorney generally count as work product. Courts push back when agencies label ordinary policy discussions as privileged because a lawyer happened to be in the room. If the document would exist in the same form regardless of an attorney’s involvement, it likely is not privileged.

Education Records and Student Privacy

The federal Family Educational Rights and Privacy Act (FERPA) blocks public schools, colleges, and universities from disclosing education records containing personally identifiable information without the student’s consent, or the parent’s consent for minors. Education records include anything directly related to a student and maintained by the institution: grades, transcripts, disciplinary files, enrollment information, and financial aid records.⁹ Personally identifiable information under FERPA reaches a student’s name, Social Security number, biometric records, date and place of birth, mother’s maiden name, and any other information that alone or combined could identify a specific student.

Schools may designate certain categories, such as a student’s name, major, enrollment status, and participation in athletics, as directory information and release them without consent, but only after giving students or parents notice and a chance to opt out. If a student exercises that opt-out, even directory information stays confidential.⁹ Records created by a school’s law enforcement unit, records made solely as a personal memory aid by a teacher, and certain treatment records maintained by campus health professionals fall outside FERPA’s definition of education records entirely.

Other Exemptions That Come Up Often

Ohio Revised Code 149.43(A)(1) lists more than two dozen exemption categories. A few others surface regularly:

Adoption records and certain sealed juvenile court records, confidential under separate Ohio statutes.
Trial preparation records: witness lists, evidence compilations, and legal research assembled by or for a government attorney in anticipation of litigation.
Records prohibited by state or federal law under the catch-all in Ohio Revised Code 149.43(A)(1)(v), which pulls in FERPA, HIPAA, and various Ohio confidentiality provisions scattered across the Revised Code.¹
Unpublished research, patent applications, and intellectual property records held by public universities and research institutions.

The volume of exemptions means denials sometimes rest on obscure provisions. If an agency cites an exemption, ask for the specific statutory section so you can verify it yourself.

Redaction, Not Blanket Withholding

An exemption rarely erases an entire document. Ohio law requires agencies to provide the non-exempt portions of a record after redacting protected material. If a police report contains both a factual narrative and a confidential informant’s identity, the agency must black out the informant’s name and hand over the rest. Withholding an entire document because a few lines are protected violates the Act.

Agencies also have to explain what they redact. When a public office denies a request or blacks out portions, it should identify the specific legal exemption justifying each redaction. Vague answers like “this is confidential,” without a statutory citation, are a signal the agency may be overreaching. You are entitled to know which exemption supposedly applies.

Challenging a Denial

Before going to court, consider contacting the agency’s records custodian or the Ohio Attorney General’s office. Many denials come from overcautious employees rather than deliberate obstruction, and a follow-up citing the specific statutory provision often shakes records loose.

If informal steps fail, your primary legal remedy is a mandamus action. Ohio Revised Code 149.43(C) allows a requester to file suit to compel disclosure.¹ If the court finds a violation, it can order the records produced and award court costs, attorney fees, and statutory damages. That fee-shifting rule gives the enforcement mechanism real weight: an agency that plays games with a legitimate request risks paying not only its own legal costs but yours.

1
Ohio Legislative Service Commission. Ohio Revised Code 149.43 – Availability of Public Records for Inspection and Copying
2
eCFR. 45 CFR Part 164 Subpart E – Privacy of Individually Identifiable Health Information
3
Ohio Legislative Service Commission. Ohio Revised Code Chapter 3701 – Department of Health
4
Ohio Legislative Service Commission. Ohio Revised Code 5122.31
5
Ohio Attorney General. Redaction Request Forms
6
Ohio Legislative Service Commission. Ohio Revised Code 149.433 – Exempting Security and Infrastructure Records
7
Ohio Legislative Service Commission. Ohio Revised Code 1333.61 – Uniform Trade Secrets Act Definitions
8
Supreme Court of Ohio. State ex rel. Besser v. Ohio State University
9
Protecting Student Privacy. Family Educational Rights and Privacy Act (FERPA)