Eduardo J. Sanchez, M.D., M.P.H. Commissioner of Health Texas Department of Health 1100 West 49th Street Austin, Texas 78756-3199
Re: Whether chapter 108 of the Health and Safety Code authorizes or requires the Texas Health Care Information Council to provide the Department of Health with individually identifiable health care information (RQ-0010-GA)
Dear Commissioner Sanchez:
You have asked whether chapter 108 of the Health and Safety Code authorizes or requires the Texas Health Care Information Council (the "Council") to provide the Texas Department of Health ("TDH" or "the Department") with data containing individually identifiable health care information.1 After you posed your question, the 78th Texas Legislature enacted House Bill 2292, which profoundly restructures health and human service agencies.See Act of June 2, 2003, 78th Leg., R.S., H.B. 2292 (signed by the Governor on June 10, 2003). Pursuant to the bill, the Council and the Department will be abolished and their powers transferred to the Department of State Health Services. See id. §§ 1.19(a)(1), (4), 1.23(a), 126(a)(5), (9). However, consolidation of the Council's and TDH's powers in a single agency must occur pursuant to a transition plan, which House Bill 2292 indicates will not be developed for several months. See id. § 1.23(a) (stating that the transfer must be accomplished according to a transition plan, to be developed no later than December 1, 2003). Consequently, we address your question under the current statutory framework.
We begin with an overview of the Council's duties under chapter 108. See Tex. Health Safety Code Ann. §§ 108.001-108.015 (Vernon 2001 Supp. 2003). The legislature commissioned the Council to "develop a statewide health care data collection system to collect health care charges, utilization data, provider quality data, and outcome data to facilitate the promotion and accessibility of cost-effective, good quality health care." Id. § 108.006(a) (Vernon 2001). The Council, as the primary administrator of chapter 108, directs the collection, dissemination, and analysis of financial and medical performance data about health care facilities such as hospitals and health maintenance organizations ("HMOs"). Id. §§ 108.001, 108.006(a)(1). The Council discharges its duties under chapter 108 with TDH's assistance and administrative support. Id. § 108.008(b).
The Council gathers hospital data primarily from reports generated when a patient is discharged from a hospital. A "provider," defined as "a physician or health care facility," must submit discharge data for each patient to the Council in a uniform electronic format. Id. §§ 108.002(15) (Vernon Supp. 2003) (defining "Provider"); 108.009(a) (Vernon 2001) (requiring submission); 108.009(h) (authorizing standard formats such as the "Uniform Hospital Billing Form UB 92"); 25 Tex. Admin. Code § 1301.19(a) (2003) (requiring hospitals to use specified formats). The hospital discharge report includes specific and detailed information such as the patient's name, social security number, diagnoses, treatment, and the hospital's charges for various procedures. Tex. Admin. Code §§ 1301.19(c)-(e) (2003). Providers submit the hospital discharge reports to TDH, which is the "single collection point," for such data. Tex. Health Safety Code Ann. §
The Council receives reports from HMOs in a standard electronic format designed to allow comparison of managed care health plans. Tex. Admin. Code § 1301.32(3), 1301.33(a) (2003). HMO information includes such matters as "effectiveness of care, accessibility/availability of care, satisfaction with the experience of care, cost of care, stability of the health plan, informed health care choices, use of services, and plan descriptive information." Id. § 1301.32(3); see also Tex. Health Safety Code Ann. §
The Council may also obtain information from other sources. The Council is directed to acquire information from public records "[t]o the extent feasible." Tex. Health Safety Code §
The Council must use the data it receives for the public's benefit. See id. § 108.013(a) (Vernon Supp. 2003). From the data it obtains, the Council must prepare reports to the governor, legislature, and the public about health care quality, effectiveness, accessibility, and costs, id. §§ 108.001, 108.006(a)(9), 108.011(b) (Vernon 2001), and reports to the public about hospital services. Id. §§ 108.010(c), 108.011(c). Seegenerally Tex. Att'y Gen. Op. No.
The Council must make health care information available and accessible to the public. See Tex. Health Safety Code Ann. §
Concomitant with its duties to collect and disclose health care data, the Council must protect certain information from disclosure. Except as specifically authorized in chapter 108, the Council "may not release and a person or entity may not gain access to any data: (1) that could reasonably be expected to reveal the identity of a patient[, or] (2) that could reasonably be expected to reveal the identity of a physician." Id. §§ 108.013(c)(1), (2). Thus, to preserve confidentiality in the public use data file, the Council processes the hospital discharge data it receives to remove individually identifiable data before affording public access. Id. § 108.012 (Vernon 2001); 25 Tex. Admin. Code § 1301.18 (2003). The Council maintains data other than public use data in a research file, which may be accessed only by a request approved by the Council's scientific review panel. Tex. Health Safety Code Ann. §
Under chapter 108, the Council has a duty to improve the efficiency of the state's health care data collection programs. When implementing the statewide information collection system under chapter 108, the Council must "build on and not duplicate other data collection required by state or federal law, by an accreditation organization, or by board rule." Id. § 108.006(4). The Council is to review state public health data collection programs and recommend consolidation where appropriate. Id. § 108.006(5). Most pertinent to your question, chapter 108 charges the Council with developing and implementing a health care information plan for TDH to use to:
(A) support public health and preventative health initiatives;
(B) assist in the delivery of primary and preventive health care services;
(C) facilitate the establishment of appropriate benchmark data to measure performance improvements;
(D) establish and maintain a systematic approach to the collection, storage, and analysis of health care data for longitudinal, epidemiological, and policy impact studies; and
(E) develop and use system-based protocols to identify individuals and populations at risk.
Id. § 108.006(a)(14).
You state that the publicly available health care information that the Council presently provides is not adequate for TDH to accomplish these duties. See Request Letter, supra note 1, at 2. You ask whether authority for TDH to obtain individually identifiable information from the Council may be distilled from TDH's duty to assist in data collection under sections 108.008 and 108.009, the Council's duty to formulate an information plan for TDH's public health responsibilities under section 108.006(a)(14), and the directive to the Council in section 108.006(4) to avoid duplication of state data collection efforts.See id.
Section 108.013 prohibits the Council from releasing information that reveals a patient's or physician's identity "[u]nless specifically authorized by this chapter [108]." Tex. Health
Safety Code Ann. §
Chapter 108 assigns TDH a number of duties in support of the Council and the health care information data collection system. Under Section 108.008, TDH must:
(1) contract with the council to collect data under this chapter;
(2) provide administrative assistance to the council;
(3) coordinate administrative responsibilities with the council to avoid unnecessary duplication of the collection of data and other duties;
(4) on request of the council, give the council access to data collected by [TDH];
. . . .
(6) work with the Department of Information Resources in developing and implementing the statewide health care data collection system and maintain consistency with Department of Information Resources standards.
Tex. Health Safety Code Ann. §
However, TDH's duties under chapter 108 authorize it to gather health care information only for the Council as its agent, not for TDH's own purposes. See, e.g., 25 Tex. Admin. Code § 1301.12(g) (2003) (directing hospitals to provide the Council's executive director, "or the director's agent, the Texas Department of Health," access to records). In that respect, TDH provides services to the health care information system under chapter 108 similar to the services TDH provides the Interagency Council on Pharmaceuticals Bulk Purchasing ("the Interagency Council") under chapter 431. See Tex. Health
Safety Code Ann. §
As is the case with the bulk pharmaceutical system in chapters 110 and 431, TDH's only duties under chapter 108 are to provide assistance and administrative support to the Council as it gathers health care information. Nothing in TDH's duties under chapter 108 suggest that it is authorized to use individually identifiable information to discharge its public health care responsibilities outside of chapter 108. Chapter 108 does not specifically require or authorize TDH to access or use individually identifiable data for purposes unrelated to the statewide health care information system.
Similarly, the Council's directive to develop a health care information plan for TDH under section 108.006(a)(14) does not specifically authorize the Council to release individually identifiable information to TDH. The Council must develop an information plan to support health initiatives, assist in delivering of health care services, establish benchmark data, establish a systematic approach to data collection and analysis for certain studies, and develop a protocol for identifying individuals and populations at risk. See Tex. Health Safety Code Ann. §
You suggest that if TDH is authorized to obtain individually identifiable information under chapter 108, that authority would also satisfy the governmental purpose exceptions to other confidentiality requirements imposed by the federal Health Insurance Portability and Accountability Act of 1996 and chapter 181 of the Texas Health and Safety Code. See
Section 108.013(c) prohibits any entity from gaining access to data that could reasonably be expected to reveal the identity of a patient or a physician, except as "specifically authorized" by chapter 108. See Tex. Health Safety Code Ann. §
Very truly yours,
GREG ABBOTT Attorney General of Texas
BARRY R. McBEE First Assistant Attorney General
DON R. WILLETT Deputy Attorney General — General Counsel
NANCY S. FULLER Chair, Opinion Committee
William A. Hill Assistant Attorney General, Opinion Committee