Office of the Attorney General — State of Texas John Cornyn Mr. Jim Loyd Executive Director Texas Health Care Information Council 206 East Ninth Street, Suite 19.140 Austin, Texas 78701
Re: Whether the Texas Health Care Information Council may use certain data to prepare reports (RQ-0480-JC)
Dear Mr. Loyd:
Chapter 108 of the Texas Health and Safety Code requires the Texas Health Care Information Council (the "Council") to develop a statewide health care data collection system, to collect certain data, and to prepare reports based on that data. In addition, chapter 108 requires the Council to make available to the public a limited subset of data, termed "public use data," and, with certain exceptions, requires that requests for other information be reviewed and approved by a scientific review panel. You ask whether Council reports may be based on data other than public use data and, if so, whether the Council must obtain authorization from the scientific review panel to use such data.1 We conclude that the Council is limited to using public use data to prepare reports under section 108.011(c), but that the Council is not limited to using public use data to prepare reports under sections 108.010 and 108.011(b). The Council need not obtain the approval of the scientific review panel in order to use other data to prepare those reports. In those reports, the Council may not release data in violation of applicable provisions of sections 108.010 and 108.011, which establish certain procedures and requirements for the release of information, and section 108.013, which provides for confidentiality of certain data, such as information that could reasonably be expected to reveal the identity of a patient or a physician.
The Council is charged generally with administering chapter 108 and with reporting to the governor, the legislature, and the public. See Tex. Health Safety Code Ann. § 108.001 (Vernon 2001). In this effort, it is assisted by the Texas Department of Health ("TDH") and the Texas Department of Information Resources ("DIR"). See id. § 108.008(b)(6); see also Tex. Gov't Code Ann. § 2054.0541 (Vernon 2000) (DIR "shall assist the [Council] and [TDH] with planning, analyses, and management functions relating to the procurement, use, and implementation of a statewide health care data collection system under Chapter 108, Health and Safety Code.").
Chapter 108 specifically requires the Council to "develop a statewide health care data collection system to collect health care charges, utilization data, provider quality data, and outcome data to facilitate the promotion and accessibility of cost-effective, good quality health care." Tex. Health Safety Code Ann. § 108.006(a) (Vernon 2001). Section 108.006 directs the Council, among other things, to direct the collection, dissemination, and analysis of data under chapter 108; to contract with TDH to collect the data; to adopt policies and rules necessary to carry out chapter 108, including rules concerning data collection requirements; and to assure that public use data is made available and accessible to interested persons. See id. § 108.006(a)(1)-(3), (6). The Council must make reports to the legislature, the governor, and the public on matters such as health care costs, the quality and effectiveness of health care, and access to health care. See id. § 108.006(a)(9).
The Council collects data under sections 108.0065, 108.009, and 108.010. Section 108.0065 authorizes the Council to collect information about Medicaid managed care organizations at the direction of the Texas Health and Human Services Commission. See id. § 108.0065. Section 108.009 provides for the general collection of data, and section 108.010 provides for the collection of provider quality data. See id. §§ 108.009, .010. The term "provider" refers to both physicians and health care facilities. See id. § 108.002(15) (Vernon Supp. 2002).
The Council must maintain a set of data that may be released to the public, "public use data," which chapter 108 defines as:
patient level data relating to individual hospitalizations that has not been summarized or analyzed, that has had patient identifying information removed, that identifies physicians only by use of uniform physician identifiers, and that is severity and risk adjusted, edited, and verified for accuracy and consistency. Public use data may exclude some data elements submitted to the council.
Id. § 108.002(17); see also id. § 108.002(1) ("`Accurate and consistent data' means data that has been edited by the council and subject to provider validation and certification."), (8) ("`Edit' means to use an electronic standardized process developed and implemented by council rule to identify potential errors and mistakes in data elements by reviewing data fields for the presence or absence of data and the accuracy and appropriateness of data.").
The Council must prescribe by rule "a public use data file minimum data set that maintains patient confidentiality and establishes data accuracy and consistency." Id. § 108.006(f) (Vernon 2001). The public use data file minimum data set is subject to annual review by the Council with the assistance of an advisory committee:
The purpose of the review is to evaluate requests to modify the existing minimum data set and editing process. A decision to modify the minimum data set by the addition or deletion of data elements shall include consideration of the value of the specific data to be added or deleted and the technical feasibility of establishing data accuracy and consistency.
Id. § 108.006(g). The Council must also "adopt procedures to establish the accuracy and consistency of the public use data before releasing the public use data to the public." Id. § 108.011(d).
Section 108.011(a) requires the council to promptly provide public use data to those requesting it and also provides that public use data "does not include provider quality data prescribed by Section 108.010 or confidential data prescribed by Section 108.013." Id. § 108.011(a). Thus, provider quality data collected under section 108.010 is excluded from public use data, as is data that is confidential under section 108.013. See, e.g., id. § 108.013(c) (Vernon Supp. 2002) ("Unless specifically authorized by this chapter, the council may not release and a person or entity may not gain access to any data . . . ."), (d) ("All data collected and used by the department and the council under this chapter is subject to the confidentiality provisions and criminal penalties of . . . ."). If public use data is requested about a specific provider, the Council is required to notify the provider about the release of data, and the Council must allow the provider to provide written comments to be released with the data. See id. § 108.011(e), (g) (Vernon 2001).
Under section 108.010, the Council must collect "provider quality data."See id. § 108.010. Subject to certain limitations, see id. § 108.010(e), (g)-(i), the Council may make "provider quality data" publicly available. See id. § 108.010(c) ("After the review and revision process, provider quality data for subsequent reports shall be published and made available to the public, on a time schedule the council considers appropriate."), (d) ("If the council determines that provider quality data to be published under Subsection (c) does not provide the intended result or is inaccurate or inappropriate for dissemination, the council is not required to publish the data or reports based in whole or in part on the data."); see also id. §§ 108.006(11) (requiring Council to "provide consumer education on the interpretation and understanding of the public use or provider quality data before the data is disseminated to the public"); .011(h) ("Tapes containing public use data and provider quality reports that are released to the public must include general consumer education material, including an explanation of the benefits and limitations of the information provided in the public use data and provider quality reports."); .012(b) ("The council may charge a person requesting public use or provider quality data a fee for the data.").
Under section 108.0135, "requests for information other than public use data" must be approved by a scientific review panel, which the Council is required to establish under section 108.0135. See id. § 108.0135(a) ("The council shall establish a scientific review panel to review and approve requests for information other than public use data. The members of the panel shall have experience and expertise in ethics, patient confidentiality, and health care data."); see also id. § 108.006(h) ("In accordance with Section 108.0135, the council may release data collected under Section 108.009 that is not included in the public use data file minimum data set established under Subsection (f)."). Subject to chapter 108's restrictions on the release of data, the Council is subject to the Public Information Act. See id. § 108.0045. Section 108.013 requires that the Council use data it collects "for the benefit of the public," and also provides that "[s]ubject to specific limitations established by this chapter and council rule, the council shall make determinations on requests for information in favor of access." Id. § 108.013(a) (Vernon Supp. 2002); see also Tex. Att'y Gen. Op. No.JC-0469 (2002) (authority of Council to charge fees for release of information).
Your query does not ask about the authority of the Council to provide information in response to a request for information, but rather about the authority of the Council to use data it collects to prepare reports. Specifically, you ask whether the Council may prepare reports using data that is broader in scope than "public use data." See Request Letter,supra note 1, at 2. You explain that under the authority of its administrative rules, see 25 Tex. Admin. Code §§ 13.11-.20 (2002), the Council requires hospitals to provide inpatient discharge data. See Request Letter, supra note 1, at 1. "Data from one or more claims concerning a given patient's hospital stay is compiled into the Encounter File." Id. The encounter file as a whole is made available only to the hospital that provided the data, Council staff, and the private vendors who collect and store the data under contract. See id. Public use data is a subset of this information that has undergone the procedures to establish its accuracy and consistency required by section 108.011(d).See id. The Council also maintains a research data file, which includes some data elements that are not included in the public use data. See id. at 2. The Council makes this information available for bonafide research purposes, but only with the approval of the scientific review panel. Seeid.
You ask whether the Council may prepare reports using data contained in the research and encounter files and, if it may, whether it must obtain the approval of the scientific review panel before doing so. See id. Section 108.011 requires the Council to prepare two kinds of reports: (i) general reports to the governor, the legislature, and the public; and (ii) reports about providers. See Tex. Health Safety Code Ann. § 108.011(b), (c) (Vernon 2001). In addition, section 108.010 requires the Council to prepare provider quality reports. See id. § 108.010. The provisions for each type of report are somewhat different and we address them separately. We conclude that the Council is not limited to using public use data to prepare reports under sections 108.011(b) and 108.010 and that it need not obtain the approval of the scientific review panel in order to use other data to prepare those reports. The Council is limited to using public use data to prepare reports under section 108.011(c).
With respect to reports to the governor, the legislature, and the public, section 108.011(b) provides:
Subject to the restrictions on access to council data prescribed by Sections 108.010 and 108.013, and using the public use data and other data, records, and matters of record available to it, the council shall prepare and issue reports to the governor, the legislature, and the public as provided by this section and Section 108.006(a). The council must issue the reports at least annually.
Id. § 108.011(b) (emphasis added). Section 108.011(b) refers to reports that the Council must prepare for the governor, the legislature, and the public under section 108.006(a)(9) on:
(A) the charges and rate of change in the charges for health care services in this state;
(B) the effectiveness of the council in carrying out the legislative intent of this chapter;
(C) if applicable, any recommendations on the need for further legislation; and
(D) the quality and effectiveness of health care and access to health care for all citizens of this state.
Id. § 108.006(a)(9); see also id. § 108.0065(g) (Medicaid managed care report required by section 108.0065(f) may be consolidated with report under section 108.006(a)(9)).
Section 108.011(b) charges the Council with preparing reports not just from public use data but also from "other data" available to the Council. See id. § 108.011(b) ("using the public use data and otherdata, records, and matters of record available to it, the council shall prepare and issue reports") (emphasis added). Section 108.002(6) defines "data" for purposes of chapter 108 to mean "information collected under Section 108.0065 or 108.009 in the form initially received." Id. § 108.002(6) (Vernon Supp. 2002). Thus, on its face, section 108.011(b) authorizes the Council to prepare reports using data collected under sections 108.0065 and 108.009, which would appear to include the data about which you ask.
Even though the Council may use data to prepare reports under section 108.011(b), certain data may not be revealed in the reports. Significantly, under section 108.011(b), the duty to prepare reports is "[s]ubject to the restrictions on access to council data prescribed by Sections 108.010 and 108.013." Id. § 108.011(b) (Vernon 2001). Thus, reports may not reveal information that may not be released under section 108.013 or section 108.010. As we discuss in greater detail below, however, these provisions do not preclude the Council from using data to prepare reports, so long as the reports themselves do not reveal protected data.
Section 108.010 requires the Council to collect and release provider quality data and to prepare and publish provider quality reports. Seeid. § 108.010(a)-(c). It contains three restrictions on access to council data. First, under section 108.010(e), the Council must allow a provider to submit comments regarding specific provider quality data to be released concerning the provider and must include the comments with any public release of the data. See id. § 108.010(e). Second, under section 108.010(g), if information is requested about a specific provider, the Council must notify the provider about the release of the information, and the Council must include a reasonable review and comment period for affected providers before publicly releasing a report. See id. § 108.010(g) ("In addition to the requirements of this section, any release of provider quality data shall comply with Sections 108.011(e) and (f)."); see also id. § 108.011(e), (f). Third, under section 108.010(h), a "provider quality data report" may not identify an individual physician by name, but must identify a physician by a uniform physician identifier, see id. § 108.010(h), and, under section 108.010(i), the Council must release provider quality data in aggregate form without uniform physician identifiers when it relates to rural providers or when the "cell size of the data" is so small that it would identify individual patients or physicians, see id. § 108.010(i). By reference to section 108.010, section 108.011(b) imposes these limitations on disclosure of information in the reports it requires. Seeid. § 108.011(b).
A section 108.011(b) report is also subject to the restrictions on access to Council data in section 108.013. Section 108.013 provides that the Council "may not release and a person or entity may not gain access to" several categories of data: data that "could reasonably be expected to reveal" the identity of a patient or physician; data "disclosing provider discounts or differentials between payments and billed charges"; data "relating to actual payments to an identified provider made by a payer"; and data "submitted to the council in a uniform submission format that is not included in the public use data set." Id. § 108.013(c)(1)-(5) (Vernon Supp. 2002); see also id. § 108.013(g) (Council may not release data elements in a manner that will reveal identity of patient or physician), (h) (subsections (c) and (g) of section 108.013 do not prohibit release of uniform physician identifier in conjunction with associated public use data in accordance with section 108.011). Section 108.013 also incorporates the confidentiality provisions and criminal penalties of Health and Safety Code section 311.037, which makes confidential certain data submitted by hospitals to TDH; Health and Safety Code section 81.103, which makes confidential AIDS and HIV test results; and Occupations Code section 159.002, which makes confidential physician-patient communications. See id. § 108.013(d).
We construe section 108.011(b)'s reference to the restrictions on access to data in section 108.013 to preclude the Council from revealing data in its reports, but not to preclude the Council from using such data to prepare reports. Section 108.013(c)(5), for example, provides that the Council may not release and a person may not gain access to data "submitted to the council in a uniform submission format that is not included in the public use data set established under Sections 108.006(f) and (g), except in accordance with Section 108.0135." Id. § 108.013(c)(5). The phrase "uniform submission format" appears to refer to data submitted to the Council by providers under section 108.009. Seeid. § 108.009(a) ("The council may collect, and, except as provided by Subsections (c) and (d), providers shall submit to the council or another entity as determined by the council, all data required by this section. The data shall be collected according to uniform submissionformats, coding systems, and other technical specifications necessary to make the incoming data substantially valid, consistent, compatible, and manageable using electronic data processing, if available.") (emphasis added).
Construed broadly in conjunction with section 108.011(b), section 108.013(c)(5) could be read to preclude the Council from preparing section 108.011(b) reports using any data other than public use data, unless approved by the scientific review panel under section 108.0135. This construction, however, would conflict with the express provision in section 108.011(b) that the Council prepare reports using "the public use data and other data, records, and matters of record available to it."Id. § 108.011(b) (Vernon 2001) (emphasis added). Because we must harmonize these two provisions of chapter 108 if possible, see Tex. Gov't Code Ann. § 311.025(b) (Vernon 1998), we conclude that the prohibition in section 108.013(c)(5) against the release of data "submitted to the council in a uniform submission format that is not included in the public use data set . . . except in accordance with Section 108.0135" applies to the release of data by the Council to another person or entity, but does not apply to the Council's use of data in preparing reports.
This construction is further supported by the subsection's reference to section 108.0135, which requires the approval of the scientific review panel for requests for information other than public use data. Section 108.0135 applies to requests for information submitted to the Council by other entities and not to uses of information by the Council itself. See Tex. Health Safety Code Ann. § 108.0135(a) (Vernon 2001) ("The council shall establish a scientific review panel to review and approverequests for information other than public use data."), (c) ("A requestfor information other than public use data must be made on the form created by the council.") (emphasis added); see also id. § 108.006(h) ("In accordance with Section 108.0135, the council may release data collected under Section 108.009 that is not included in the public use data file minimum data set established under Subsection (f).") (emphasis added). The legislature did not explicitly require the Council to obtain the approval of the scientific review panel to use data other than public use data in section 108.0135, nor does section 108.011(b) make any reference to the scientific review panel. We do not believe that the legislature intended to preclude the Council from using data to prepare reports that entities other than the Council may obtain from the Council under section 108.0135 with the scientific review board's approval.
In sum, section 108.013 limits the data that may be revealed in a section 108.011(b) report, but does not limit the data that may be used to prepare such reports. Thus, a report issued pursuant to section 108.011(b) may not, for example, include data that could reasonably be expected to reveal the identity of a patient or physician or that would reveal a physician-patient communication. But the Council may use any of the data or other information listed in section 108.011(b) to prepare the reports.
By contrast, section 108.011(c) requires the Council to prepare reports that provide information relating to providers, "such as the incidence rate of selected medical or surgical procedures." Id. § 108.011(c). The reports must provide the data "in a manner that identifies individual providers, including individual physicians, and that identifies and compares data elements for all providers. Individual physicians may not be identified by name, but shall be identified by uniform physician identifiers." Id. With respect to the information to be used to prepare these reports, section 108.011(c) provides that the Council "shall use public use data" and makes no reference to any other data or information, stating: "Subject to the restrictions on access to council data prescribed by Sections 108.010 and 108.013, the council shall use publicuse data to prepare and issue reports that provide information relating to providers." Id. (emphasis added). Thus, we conclude that this provision limits the Council to preparing reports using public use data.
Finally, we consider provider quality reports required by section 108.010. Section 108.010 provides that, subject to section 108.009, the Council must "collect data reflecting provider quality based on a methodology and review process" established in Council rules. See id. § 108.010(a); see also id. § 108.006(a)(8) (requiring Council to "adopt by rule and implement a methodology to collect and disseminate data reflecting provider quality in accordance with Section 108.010."). For purposes of chapter 108, "provider quality" means "the extent to which a provider renders care that, within the capabilities of modern medicine, obtains for patients medically acceptable health outcomes and prognoses, after severity adjustment." Id. § 108.002(16) (Vernon Supp. 2002). Section 108.010(f) gives the Council broad discretion to determine how it will assess provider quality data, stating, "The methodology adopted by the council for measuring quality shall include case-mix qualifiers, severity adjustment factors, adjustments for medical education and research, and any other factors necessary to accurately reflect provider quality." Id. § 108.010(f) (Vernon 2001).
After a year of testing its methodology for collecting this data, the Council is thereafter authorized to publish provider quality reports based on data that has been through a review and revision process "on a time schedule the council considers appropriate." Id. § 108.010(c). A provider must be allowed to submit comments regarding "any specific provider quality data to be released concerning the provider" and the Council must make these comments available to the public when releasing the provider quality data. See id. § 108.010(e). And, as we have noted, a provider quality data report may not identify an individual physician, but must identify physicians by uniform physician identifiers.See id. § 108.010(h); see also id. § 108.013(h) (Vernon Supp. 2002) (section 108.013(c), (g) do not prohibit release of uniform physician identifier in conjunction with associated provider quality report). The Council must aggregate provider quality data regarding rural providers or when the "cell size of the data" is so small that it would identify individual patients or physicians. See id. § 108.010(i) (Vernon 2001).
Unlike section 108.011(b) and (c), section 108.010 is not specific about the kind of data to be used to prepare a provider quality report. Clearly, the Council may use provider quality data collected under section 108.010. But section 108.010, unlike 108.011(c), does not limit the Council to preparing reports using particular data. For this reason, we conclude that the Council may use any data it collects to prepare provider quality reports, provided that the release of information complies with section 108.010's requirements for release of information and does not violate section 108.013.
As with reports under section 108.011(b), we conclude that the confidentiality provisions of section 108.013 do not apply to the use of data to prepare the reports. We also conclude that section 108.0135, which requires approval of the scientific review panel for "requests for information other than public use data," id. § 108.0135, submitted to the Council by other entities, does not apply to the Council's use of provider quality data. Furthermore, the release of data in provider quality reports is subject to section 108.013, to the extent that section's limitations on the release of data apply to data generally. It is not clear, however, whether section 108.013(c)(5), which precludes the release of data "submitted to the council in a uniform submission format that is not included in the public use data set established under Sections 108.006(f) and (g), except in accordance with Section 108.0135,"id. § 108.013(c)(5), applies to the release of provider quality data. Again section 108.009 refers to "uniform submission formats," id. § 108.009, but provider quality data is collected under section 108.010 rather than section 108.009. Furthermore, chapter 108 defines provider quality data and public use data as separate data sets, see id. § 108.011(a) (public use data "does not include provider quality data prescribed by Section 108.010 or confidential data prescribed by Section 108.013"), but also clearly authorizes the release of provider quality data as well as public use data. See, e.g., §§ 108.006(a)(11) (requiring Council to "provide consumer education on the interpretation and understanding of the public use or provider quality data before the data is disseminated to the public"), .010(c)-(d) (authorizing Council to release provider quality data), .011(h) ("Tapes containing public use data and provider quality reports that are released to the public must include general consumer education material, including an explanation of the benefits and limitations of the information provided in the public use data and provider quality reports."), .012(b) ("The council may charge a person requesting public use or provider quality data a fee for the data.").
In sum, we conclude that the Council is limited to using public use data to prepare reports under section 108.011(c). However, the Council is not limited to using public use data to prepare reports under sections 108.010 and 108.011(b) and need not obtain the approval of the scientific review panel in order to use other data it has collected to prepare those reports. In those reports, the Council may not release data in violation of applicable provisions of sections 108.010, 108.011, and 108.013. Furthermore, we note that the Council must provide a review and comment period for affected providers before releasing a report under section 108.010 or section 108.011. See id. §§ 108.010(g) ("any release of provider quality data shall comply with Sections 108.011(e) and (f)"), .011(f) ("A report issued by the council shall include a reasonable review and comment period for the affected providers before public release of the report.").
SUMMARY The Texas Health Care Information Council is limited to using public use data to prepare reports required under section108.011(c) of the Health and Safety Code. The Council is not limited to using public use data to prepare reports under sections 108.010 and 108.011(b) and need not obtain the approval of the scientific review panel under section 108.0135 in order to use other data it has collected to prepare those reports. In those reports, the Council may not release data in violation of applicable provisions of sections 108.010 and 108.011, which establish certain procedures and requirements for the release of information, and section 108.013, which provides for confidentiality of certain data, such as information that could reasonably be expected to reveal the identity of a patient or a physician.
Yours very truly,
JOHN CORNYN Attorney General of Texas
HOWARD G. BALDWIN, JR. First Assistant Attorney General
NANCY FULLER Deputy Attorney General — General Counsel
SUSAN DENMON GUSKY Chair, Opinion Committee
Mary R. Crouter Assistant Attorney General, Opinion Committee
1 See Letter from Jim Loyd, Executive Director, Texas Health Care Information Council, to Honorable John Cornyn, Texas Attorney General (Dec. 17, 2001) (on file with Opinion Committee) [hereinafter Request Letter].