Eduardo J. Sanchez, M.D., M.P.H. Commissioner of Health Texas Department of Health 1100 West 49th Street Austin, Texas 78756-3199
Re: Whether chapter 108 of the Health and Safety Code authorizes or requires the Texas Health Care Information Council to provide the Department of Health with individually identifiable health care information (RQ-0010-GA)
Dear Commissioner Sanchez:
You have asked whether chapter 108 of the Health and Safety Code authorizes or requires the Texas Health Care Information Council (the "Council") to provide the Texas Department of Health ("TDH" or "the Department") with data containing individually identifiable health care information.1 After you posed your question, the 78th Texas Legislature enacted House Bill 2292, which profoundly restructures health and human service agencies.See Act of June 2, 2003, 78th Leg., R.S., H.B. 2292 (signed by the Governor on June 10, 2003). Pursuant to the bill, the Council and the Department will be abolished and their powers transferred to the Department of State Health Services. See id. §§ 1.19(a)(1), (4), 1.23(a), 126(a)(5), (9). However, consolidation of the Council's and TDH's powers in a single agency must occur pursuant to a transition plan, which House Bill 2292 indicates will not be developed for several months. See id. § 1.23(a) (stating that the transfer must be accomplished according to a transition plan, to be developed no later than December 1, 2003). Consequently, we address your question under the current statutory framework.
We begin with an overview of the Council's duties under chapter 108. See Tex. Health Safety Code Ann. §§ 108.001-108.015 (Vernon 2001 Supp. 2003). The legislature commissioned the Council to "develop a statewide health care data collection system to collect health care charges, utilization data, provider quality data, and outcome data to facilitate the promotion and accessibility of cost-effective, good quality health care." Id. § 108.006(a) (Vernon 2001). The Council, as the primary administrator of chapter 108, directs the collection, dissemination, and analysis of financial and medical performance data about health care facilities such as hospitals and health maintenance organizations ("HMOs"). Id. §§ 108.001, 108.006(a)(1). The Council discharges its duties under chapter 108 with TDH's assistance and administrative support. Id. § 108.008(b).
The Council gathers hospital data primarily from reports generated when a patient is discharged from a hospital. A "provider," defined as "a physician or health care facility," must submit discharge data for each patient to the Council in a uniform electronic format. Id. §§ 108.002(15) (Vernon Supp. 2003) (defining "Provider"); 108.009(a) (Vernon 2001) (requiring submission); 108.009(h) (authorizing standard formats such as the "Uniform Hospital Billing Form UB 92"); 25 Tex. Admin. Code § 1301.19(a) (2003) (requiring hospitals to use specified formats). The hospital discharge report includes specific and detailed information such as the patient's name, social security number, diagnoses, treatment, and the hospital's charges for various procedures. Tex. Admin. Code §§ 1301.19(c)-(e) (2003). Providers submit the hospital discharge reports to TDH, which is the "single collection point," for such data. Tex. Health Safety Code Ann. § 108.009(e) (Vernon 2001); but see 25 Tex. Admin. Code § 1301.12(e) (2003) (requiring hospitals to submit discharge reports and other information to the "Council or its agents" as directed by the Council's executive director).
The Council receives reports from HMOs in a standard electronic format designed to allow comparison of managed care health plans. Tex. Admin. Code § 1301.32(3), 1301.33(a) (2003). HMO information includes such matters as "effectiveness of care, accessibility/availability of care, satisfaction with the experience of care, cost of care, stability of the health plan, informed health care choices, use of services, and plan descriptive information." Id. § 1301.32(3); see also Tex. Health Safety Code Ann. § 108.009(o) (Vernon 2001) (requiring health care plan provider to "submit to the council aggregate data . . . required by the Health Plan Employer Data Information Set (HEDIS) as operated by the National Committee for Quality Assurance.").
The Council may also obtain information from other sources. The Council is directed to acquire information from public records "[t]o the extent feasible." Tex. Health Safety Code §108.009(m) (Vernon 2001). On the Council's request, TDH must "give the council access to data collected by the department."Id. § 108.008(b)(4). The Council may enter into a memorandum of understanding with a state agency "to share data and expertise, to obtain data for the council, or to make data available to the council." Id. § 108.007(b).
The Council must use the data it receives for the public's benefit. See id. § 108.013(a) (Vernon Supp. 2003). From the data it obtains, the Council must prepare reports to the governor, legislature, and the public about health care quality, effectiveness, accessibility, and costs, id. §§ 108.001, 108.006(a)(9), 108.011(b) (Vernon 2001), and reports to the public about hospital services. Id. §§ 108.010(c), 108.011(c). Seegenerally Tex. Att'y Gen. Op. No. JC-0511 (2002) (analyzing use of data for statutory reports).
The Council must make health care information available and accessible to the public. See Tex. Health Safety Code Ann. §108.006(a)(6) (Vernon 2001). In that regard, the Council is responsible for developing a process and methodology to allow public access to certain classes of data and controlled dissemination of other classes of data while maintaining strict confidentiality requirements. See id. §§ 108.006(a)(6), 108.0065(d), 108.010(h), 108.011(a)-(i), 108.012(a) (Vernon 2001), 108.013 (Vernon Supp. 2003); see also Tex. Att'y Gen. Op. No. JC-0469 (2002), at 3-5 (describing council's duties). The Council's public use data must be computer accessible. Tex. Health Safety Code Ann. § 108.012 (Vernon 2001).2 Upon proper request, the Council may make available some health care information that is not contained in the public use data file.See id. § 108.013(a) (Vernon Supp. 2003). The Council must decide information requests in favor of access, subject to chapter 108's specific limitations. Id.
Concomitant with its duties to collect and disclose health care data, the Council must protect certain information from disclosure. Except as specifically authorized in chapter 108, the Council "may not release and a person or entity may not gain access to any data: (1) that could reasonably be expected to reveal the identity of a patient[, or] (2) that could reasonably be expected to reveal the identity of a physician." Id. §§ 108.013(c)(1), (2). Thus, to preserve confidentiality in the public use data file, the Council processes the hospital discharge data it receives to remove individually identifiable data before affording public access. Id. § 108.012 (Vernon 2001); 25 Tex. Admin. Code § 1301.18 (2003). The Council maintains data other than public use data in a research file, which may be accessed only by a request approved by the Council's scientific review panel. Tex. Health Safety Code Ann. § 108.0135 (Vernon 2001); 25 Tex. Admin. Code § 1301.18(l) (2003). A memorandum of understanding between the Council and another state agency must protect patient confidentiality. Tex. Health Safety Code Ann. §108.007(b) (Vernon 2001). Neither the Council nor TDH may release information that is confidential under chapter 108 to any other state agency. Id. § 108.013(i) (Vernon Supp. 2003). Chapter 108 contains civil and criminal penalties for violating its confidentiality provisions. Id. §§ 108.014, 108.0141 (Vernon 2001).
Under chapter 108, the Council has a duty to improve the efficiency of the state's health care data collection programs. When implementing the statewide information collection system under chapter 108, the Council must "build on and not duplicate other data collection required by state or federal law, by an accreditation organization, or by board rule." Id. § 108.006(4). The Council is to review state public health data collection programs and recommend consolidation where appropriate. Id. § 108.006(5). Most pertinent to your question, chapter 108 charges the Council with developing and implementing a health care information plan for TDH to use to:
(A) support public health and preventative health initiatives;
(B) assist in the delivery of primary and preventive health care services;
(C) facilitate the establishment of appropriate benchmark data to measure performance improvements;
(D) establish and maintain a systematic approach to the collection, storage, and analysis of health care data for longitudinal, epidemiological, and policy impact studies; and
(E) develop and use system-based protocols to identify individuals and populations at risk.
Id. § 108.006(a)(14).
You state that the publicly available health care information that the Council presently provides is not adequate for TDH to accomplish these duties. See Request Letter, supra note 1, at 2. You ask whether authority for TDH to obtain individually identifiable information from the Council may be distilled from TDH's duty to assist in data collection under sections 108.008 and 108.009, the Council's duty to formulate an information plan for TDH's public health responsibilities under section 108.006(a)(14), and the directive to the Council in section 108.006(4) to avoid duplication of state data collection efforts.See id.
Section 108.013 prohibits the Council from releasing information that reveals a patient's or physician's identity "[u]nless specifically authorized by this chapter [108]." Tex. Health Safety Code Ann. § 108.013(c) (Vernon Supp. 2003). This unambiguous mandate may only be construed as written. SeeFitzgerald v. Advanced Spine Fixation Sys., Inc., 996 S.W.2d 864,865-66 (Tex. 1999). Thus, the Council may provide individually identifiable information only as specifically authorized by chapter 108.
Chapter 108 assigns TDH a number of duties in support of the Council and the health care information data collection system. Under Section 108.008, TDH must:
(1) contract with the council to collect data under this chapter;
(2) provide administrative assistance to the council;
(3) coordinate administrative responsibilities with the council to avoid unnecessary duplication of the collection of data and other duties;
(4) on request of the council, give the council access to data collected by [TDH];
. . . .
(6) work with the Department of Information Resources in developing and implementing the statewide health care data collection system and maintain consistency with Department of Information Resources standards.
Tex. Health Safety Code Ann. § 108.008(b) (Vernon 2001). Also, at the Council's direction, TDH is authorized to inspect underlying documentation and records used by data sources, and "compel providers to produce accurate documents and records." Id. § 108.007(a)(1), (2). In the course of carrying out these duties, TDH will necessarily come into possession of information that chapter 108 makes confidential.
However, TDH's duties under chapter 108 authorize it to gather health care information only for the Council as its agent, not for TDH's own purposes. See, e.g., 25 Tex. Admin. Code § 1301.12(g) (2003) (directing hospitals to provide the Council's executive director, "or the director's agent, the Texas Department of Health," access to records). In that respect, TDH provides services to the health care information system under chapter 108 similar to the services TDH provides the Interagency Council on Pharmaceuticals Bulk Purchasing ("the Interagency Council") under chapter 431. See Tex. Health Safety Code Ann. § 431.116 (Vernon Supp. 2003). Section 431.116 authorizes TDH to obtain information from drug manufacturers, verify its accuracy, and report the information collected to the Interagency Council.See id. Section 110.006(g) of the Health and Safety Code prohibits the Interagency Council from disclosing "information that identifies a specific manufacturer or wholesaler or the prices charged by a specific manufacturer or wholesaler for a specific pharmaceutical." Id. § 110.006(g).3 In Texas Attorney General Opinion GA-0019, this office determined that TDH's role as the Interagency Council's agent did not authorize the Interagency Council to disclose confidential information to TDH. See Tex. Att'y Gen. Op. No. GA-0019 (2003).
As is the case with the bulk pharmaceutical system in chapters 110 and 431, TDH's only duties under chapter 108 are to provide assistance and administrative support to the Council as it gathers health care information. Nothing in TDH's duties under chapter 108 suggest that it is authorized to use individually identifiable information to discharge its public health care responsibilities outside of chapter 108. Chapter 108 does not specifically require or authorize TDH to access or use individually identifiable data for purposes unrelated to the statewide health care information system.
Similarly, the Council's directive to develop a health care information plan for TDH under section 108.006(a)(14) does not specifically authorize the Council to release individually identifiable information to TDH. The Council must develop an information plan to support health initiatives, assist in delivering of health care services, establish benchmark data, establish a systematic approach to data collection and analysis for certain studies, and develop a protocol for identifying individuals and populations at risk. See Tex. Health Safety Code Ann. § 108.006(a)(14)(A)-(E) (Vernon 2001). On their face, these stated purposes do not necessarily imply that they may be accomplished only by providing TDH with individually identifiable information. Finally, the directive in section 108.006(a)(4), that the Council not duplicate other required data collection efforts, does not specifically authorize the Council to disclose individually identifiable information to TDH. Id. § 108.006(a)(4).
You suggest that if TDH is authorized to obtain individually identifiable information under chapter 108, that authority would also satisfy the governmental purpose exceptions to other confidentiality requirements imposed by the federal Health Insurance Portability and Accountability Act of 1996 and chapter 181 of the Texas Health and Safety Code. See42 U.S.C. § 1320d-2(d), 1320d-3(a) (2000); 45 C.F.R. § 160.103,164.502(a), 164.502(a)(1)(i) (2002 2003); Tex. Health Safety Code Ann. §§181.001(b)(1)(B), 181.001(b)(5), 181.103(1)-(3) (Vernon Supp. 2003). Because we conclude that chapter 108 does not authorize the Council to provide individually identifiable information, we do not address these issues.
Section 108.013(c) prohibits any entity from gaining access to data that could reasonably be expected to reveal the identity of a patient or a physician, except as "specifically authorized" by chapter 108. See Tex. Health Safety Code Ann. § 108.013(c) (Vernon Supp. 2003). Chapter 108 does not specifically authorize the Council to provide TDH with such information. Consequently, we conclude that the Council is not authorized to provide TDH with access to health care data containing individually identifiable information.
SUMMARY Under current law, the Texas Health Care Information Council is not authorized to provide the Texas Department of Health with data containing individually identifiable health information.
Very truly yours,
GREG ABBOTT Attorney General of Texas
BARRY R. McBEE First Assistant Attorney General
DON R. WILLETT Deputy Attorney General — General Counsel
NANCY S. FULLER Chair, Opinion Committee
William A. Hill Assistant Attorney General, Opinion Committee
1 See Letter from Eduardo J. Sanchez, M.D., M.P.H., Commissioner of Health, Texas Department of Health, to Honorable Greg Abbott, Texas Attorney General (Dec. 17, 2002) (on file with Opinion Committee) (hereinafter Request Letter).
2 See www.thcic.state.tx.us/default.htm.
3 This section 110.006 was added by Act of May 27, 2001, 77th Leg., R.S., ch. 1003, sec. 1, § 110.006, 2001 Tex. Gen. Laws 2184, 2185.