### ATTORNEY GENERAL OFTEXAS GREG ABBOTT

June 30,2003

Eduardo J. Sanchez, M.D., M.P.H. Commissioner ofHealth Texas Department of Health 1100 West 49th Street Austin, Texas 78756-3 199 Opinion No. GA-0083

Re: Whether chapter 108ofthe Health and Safety Code authorizes orrequires the Texas Health Care Information Council toprovide the Department of Health with individually identifiable health care information (RQ-001 O-GA)

Dear Commissioner Sanchez:

You have asked whether chapter 108 of the Health and Safety Code authorizes or requires the Texas Health Care Information Council (the “Council”) to provide the Texas Department of Health (“TDH” or “the Department”) with data containing individually identifiable health care information.’ After you posed your question, the 78th Texas Legislature enacted House Bill 2292, which profoundly restructures health and human service agencies. See Act of June 2, 2003, 78th Leg., R.S., H.B. 2292 (signed by the Governor on June 10,2003). Pursuant to the bill, the Council and the Department will be abolished and their powers transferred tothe Department ofState Health Services. See id. $0 1.19(a)(l), (4), 1.23(a), 126(a)(5), (9). However, consolidation ofthe Council’s and TDH’s powers in a single agency must occur pursuant to atransition plan, which House Bill 2292 indicates will not be developed for several months. See id. 5 1.23(a) (stating that the transfer must be accomplished according to atransition plan, to be developed no later than December 1, 2003). Consequently, we address your question under the current statutory framework.

We begin with an overview of the Council’s duties under chapter 108. See TEX. HEALTH & SAFETY CODE ANN. $5 108.001-108.015 (Vernon 2001 & Supp. 2003). The legislature commissioned the Council to “develop a statewide health care data collection system to collect health care charges, utilization data, provider quality data, and outcome data to facilitate the promotion and accessibility of cost-effective, good quality health care.” Id. 5 108.006(a) (Vernon 2001). The Council, as the primary administrator of chapter 108, directs the collection, dissemination, and analysis of financial and medical performance data about health care facilities such ashospitals and health maintenance organizations (“HMOs”). Id. @ 108.001, 108.006(a)( 1).

‘See Letter from Eduardo J. Sanchez, M.D., M.P.H., Commissioner of Health, Texas Department of Health, to Honorable Greg Abbott, Texas Attorney General (Dec. 17, 2002) (on file with Opinion Committee) (hereinafter Request Letter).Eduardo J. Sanchez, M.D., M.P.H. - Page 2 (GA-0083)

The Council discharges its duties under chapter 108 with TDH’s assistance and administrative support. Id. 5 108.008(b).
The Council gathers hospital data primarily from reports generated when a patient is discharged from a hospital. A “provider,” defined as “a physician or health care facility,” must submit discharge data for each patient to the Council in a uniform electronic format. Id. $9 108.002(15) (Vemon Supp. 2003) (defining “Provider”); 108.009(a) (Vernon 2001) (requiring submission); 108.009(h) (authorizing standard formats such asthe “Uniform Hospital Billing Form UB 92”); 25 TEX.ADMIN.CODE5 1301.19(a) (2003) (requiring hospitals to use specified formats). The hospital discharge report includes specific and detailed information such asthe patient’s name, social security number, diagnoses, treatment, and the hospital’s charges forvarious procedures. TEX. ADMIN. CODE $5 1301.19(c)-(e) (2003). Providers submit the hospital discharge reports to TDH, which is the “single collection point,” for such data. TEX.HEALTH& SAFETYCODEANN. 8 108.009(e) (Vemon 2001); butsee 25 TEX.ADMIN.CODE4 1301.12(e) (2003) (requiring hospitals to submit discharge reports and other information to the “Council or its agents” as directed by the Council’s executive director).
The Council receives reports from HMOs in a standard electronic format designed to allow comparison of managed care health plans. TEX.ADMIN.CODE8 1301.32(3), 1301.33(a) (2003). HMO information includes such matters as “effectiveness ofcare, accessibility/availability of care, satisfaction with the experience ofcare, cost ofcare, stability ofthe health plan, informed health care choices, use of services, and plan descriptive information.” Id. 51301.32(3); see also TEX.HEALTH & SAFETYCODEANN. 6 108.009(o) (Vernon 2001) (requiring health care plan provider to “submit to the council aggregate data

. . . required by the Health Plan Employer Data Information Set (HEDIS) as operated by the National Committee for Quality Assurance.“).
The Council may also obtain information from other sources. The Council is directed to acquire information from public records “[t]o the extent feasible.” TEX.HEALTH& SAFETYCODE tj 108.009(m) (Vemon 2001). On the Council’s request, TDH must “give the council access to data collected by the department.” Id. 9 108.008(b)(4). The Council may enter into amemorandum of understanding with a state agency “to share data and expertise, to obtain data for the council, or to make data available to the council.” Id. 8 108.007(b).
The Council must use the data it receives for the public’s benefit. See id. 9 108.013(a) (Vernon Supp. 2003). From the data it obtains, the Council must prepare reports to the governor, legislature, and the public about health care quality, effectiveness, accessibility, and costs, id. $5 108.001, 108.006(a)(9), 108.01 l(b) (Vemon 2001), and reports to the public about hospital services. Id. §§ 108.010(c), 108.011(c). See generally Tex. Att’y Gen. Op. No. JC-0511 (2002) (analyzing use of data for statutory reports).
The Council must make health care information available and accessible to the public. See TEX.HEALTH& SAFETYCODEANN. 6j108.006(a)(6) (Vemon 2001). In that regard, the Council is responsible for developing aprocess and methodology to allow public access to certain classes of data and controlled dissemination of other classes of data while maintaining strict confidentialityEduardo J. Sanchez, M.D., M.P.H. - Page 3 (GA-0083)

requirements. Seeid. $5 108.006(a)(6), 108.0065(d), 108.010(h), 108.01 l(a)-(i), 108.012(a)(Vemon 2001), 108.013 (Vernon Supp. 2003); see also Tex. Att’y Gen. Op. No. JC-0469 (2002), at 3-5 (describing council’s duties). The Council’s public use data must be computer accessible. TEX. HEALTH& SAFETYCODEANN. 5 108.012 (Vernon 2001).2 Upon proper request, the Council may make available some health care information that is not contained in the public use data file. See id. 6 108.013(a) (Vernon Supp. 2003). The Council must decide information requests in favor of access, subject to chapter 108’s specific limitations. Id.
Concomitant with its duties to collect and disclose health care data, the Council must protect certain information from disclosure. Except as specifically authorized in chapter 108, the Council “may not release and aperson or entity may not gain access to any data: (1) that could reasonably be expected to reveal the identity of apatient[, or] (2) that could reasonably be expected to reveal the identity ofaphysician.” Id. $5 108.013(c)(l), (2). Thus, topreserve confidentiality inthe public
use data file, the Council processes the hospital discharge data it receives to remove individually identifiable data before affording public access. Id. 5 108.012 (Vernon 2001); 25 TEX.ADMIN.CODE 4 1301.18 (2003). The Council maintains data other than public use data in aresearch file, which may be accessed only by arequest approved by the Council’s scientific review panel. TEX.HEALTH & SAFETYCODEANN. 5 108.0135 (Vernon 2001); 25 TEX.ADMIN.CODE0 1301.18(1) (2003). A memorandum ofunderstanding between the Council and another state agency must protect patient confidentiality. TEX.HEALTH& SAFETYCODEANN. 8 108.007(b) (Vernon 2001). Neither the Council nor TDH may release information that is confidential under chapter 108 to any other state agency. Id. 8 108.013(i) (Vernon Supp. 2003). Chapter 108 contains civil and criminal penalties for violating its confidentiality provisions. Id. §§ 108.014, 108.0141 (Vernon 2001).
Under chapter 108, the Council has aduty to improve the efficiency ofthe state’s health care data collection programs. When implementing the statewide information collection system under chapter 108, the Council must “build on and not duplicate other data collection required by state or federal law, by an accreditation organization, or by board rule.” Id. 5 108.006(4). The Council is to review state public health data collection programs and recommend consolidation where appropriate. Id. 8 108.006(5). Most pertinent toyour question, chapter 108charges the Council with developing and implementing ahealth care information plan for TDH to use to:

(A) support public health and preventative health initiatives; (B) assist in the delivery of primary and preventive health care services; (C) facilitate the establishment of appropriate benchmark data to measure performance improvements;

*See www.thcic.state.tx.us/default.htm.Eduardo J. Sanchez, M.D., M.P.H. - Page 4 (GA-0083)

(D) establish and maintain a systematic approach to the collection, storage, and analysis of health care data for longitudinal, epidemiological, and policy impact studies; and (E) develop and use system-based protocols to identify individuals and populations atrisk.
Id. 0 108.006(a)( 14).

You state that the publicly available health care information that the Council presently provides is not adequate for TDH to accomplish these duties. See Request Letter, supra note 1, at 2. You ask whether authority for TDH to obtain individually identifiable information from the Council may be distilled from TDH’s duty to assist in data collection under sections 108.008 and 108.009, the Council’s duty to formulate an information plan for TDH’s public health responsibilities under section 108.006(a)( 14), and the directive tothe Council in section 108.006(4) to avoid duplication of state data collection efforts. See id.
Section 108.013 prohibits the Council from releasing information that reveals apatient’s or physician’s identity “[ulnless specifically authorized bythis chapter [1081.” TEX.HEALTH& SAFETY CODEANN. 8 108.013(c) (Vernon Supp. 2003). This unambiguous mandate may only be construed
as written. See Fitzgerald v.Advanced Spine Fixation Sys., Inc., 996 S.W.2d 864, 865-66 (Tex. 1999). Thus, the Council may provide individually identifiable information only as specifically authorized by chapter 108. Chapter 108 assigns TDH anumber of duties in support ofthe Council and the health care information data collection system. Under Section 108.008, TDH must: (1)contract with the council to collect data under this chapter; (2) provide administrative assistance to the council; (3)coordinate administrative responsibilities with the council to avoid unnecessary duplication of the collection of data and other duties; (4) on request of the council, give the council access to data collected by [TDH];

(6) work with the Department of Information Resources in developing and implementing the statewide health care data collection system and maintain consistency with Department of Information Resources standards.Eduardo J. Sanchez, M.D., M.P.H. - Page 5 (GA-0083)

TEX.HEALTH& SAFETYCODEANN. 8 108.008(b) (Vernon 2001). Also, atthe Council’s direction, TDH is authorized to inspect underlying documentation and records used by data sources, and “compel providers to produce accurate documents and records.” Id. 5 108.007(a)(l), (2). In the
course of carrying out these duties, TDH will necessarily come into possession of information that chapter 108 makes confidential.
However, TDH’s duties under chapter 108 authorize itto gather health care information only for the Council as its agent, not for TDH’s own purposes. See, e.g., 25 TEX.ADMIN. CODE 5 1301.12(g) (2003) (directing hospitals to provide the Council’s executive director, “or the director’s agent, the Texas Department ofHealth,” access torecords). Inthat respect, TDH provides services to the health care information system under chapter 108 similar to the services TDH provides the Interagency Council on Pharmaceuticals Bulk Purchasing (“the Interagency Council”) under chapter 43 1. See TEX.HEALTH& SAFETYCODE ANN. 5 431.116 (Vernon Supp. 2003). Section 43 1.116 authorizes TDH toobtain information from drug manufacturers, verify its accuracy, and report the information collected to the Interagency Council. See id. Section 110.006(g) ofthe Health and Safety Code prohibits the Interagency Council from disclosing “information that identifies a specific manufacturer orwholesaler or the prices charged by aspecific manufacturer or wholesaler for a specific pharmaceutical.” Id. 5 110.006(g).3 In Texas Attorney General Opinion GA-001 9, this office determined that TDH’s role as the Interagency Council’s agent did not authorize the Interagency Council to disclose confidential information to TDH. See Tex. Att’y Gen. Op. No. GA-0019 (2003).
As is the case with the bulk pharmaceutical system in chapters 110 and 43 1, TDH’s only duties under chapter 108 are to provide assistance and administrative support to the Council as it gathers health care information. Nothing in TDH’s duties under chapter 108 suggest that it is authorized to use individually identifiable information to discharge its public health care responsibilities outside ofchapter 108. Chapter 108 does not specifically require or authorize TDH to access or use individually identifiable data for purposes unrelated to the statewide health care information system. Similarly, the Council’s directive to develop ahealth care information plan for TDH under section 1OS.O06(a)(14)does not specifically authorize the Council torelease individually identifiable information to TDH. The Council must develop an information plan to support health initiatives, assist in delivering ofhealth care services, establish benchmark data, establish asystematic approach to data collection and analysis for certain studies, and develop aprotocol for identifying individuals and populations at risk. See TEX. HEALTH & SAFETYCODE ANN. 0 108.006(a)(l4)(A)-(E) (Vernon 2001). On their face, these stated purposes do not necessarily imply that they may be accomplished only by providing TDH with individually identifiable information. Finally, the directive in section 108.006(a)(4), that the Council not duplicate other required data collection efforts, does not specifically authorize the Council to disclose individually identifiable information to TDH. Id. fj 108.006(a)(4).

‘This section 110.006 was added by Act of May 27,2001,77th Leg., R.S., ch. 1003, sec. 1, $ 110.006,2001 Tex. Gen. Laws 2184,2185.Eduardo J. Sanchez, M.D., M.P.H. - Page 6 (GA-0083)

You suggest that ifTDH is authorized to obtain individually identifiable information under chapter 108, that authority would also satisfy the governmental purpose exceptions to other confidentiality requirements imposed by the federal Health Insurance Portability and Accountability Act of 1996 and chapter 181 of the Texas Health and Safety Code. See 42 U.S.C. $5 1320d-2(d), 1320d-3(a) (2000); 45 C.F.R. $5160.103,164.502(a), 164.502(a)(l)(i) (2002 &2003); TEX.HEALTH & SAFETYCODEANN. $5 181.001(b)(l)(B), 181.001(b)(5), 181.103(l)-(3) (Vernon Supp. 2003). Because we conclude that chapter 108 does not authorize the Council to provide individually identifiable information, we do not address these issues.
Section 108.0 13(c) prohibits any entity from gaining access to data that could reasonably be expected to reveal the identity of apatient or aphysician, except as “specifically authorized” by chapter 108. See TEX.HEALTH& SAFETYCODEANN. 8 108.013(c) (Vernon Supp. 2003). Chapter 108 does not specifically authorize the Council to provide TDH with such information. Consequently, we conclude that the Council isnot authorized toprovide TDH with access to health
care data containing individually identifiable information.Eduardo J. Sanchez, M.D., M.P.H. - Page 7 (GA-0083)

SUMMARY
Under current law, the Texas Health Care Inforrnation Council is not authorized to provide the Texas Department ofHealth with data containing individually identifiable health information. Very truly yours,

BARRY R. MCBEE First Assistant Attorney General
DON R. WILLETT Deputy Attorney General for Legal Counsel
NANCY S.FULLER Chair, Opinion Committee
William A. Hill Assistant Attorney General, Opinion Committee