 Office of the ATTORNEY GENERAL GREG ABBOTT | |
|
April 23, 2003 Mr. Thomas F. Best
OR2003-2726 Dear Mr. Best: You ask whether certain information is subject to required public disclosure under chapter 552 of the Government Code. Your request was assigned ID# 179088. The Texas Commission on Alcohol and Drug Abuse (the "Commission") received a request for statistical information regarding drug usage among youths in various zip codes. You assert the requested information is excepted from disclosure under section 552.101 of the Government Code in conjunction with chapter 164 of the Code of Federal Regulations and chapter 181 of the Health and Safety Code. We have reviewed the information you submitted and we have considered the exception you claim. Section 552.101 of the Government Code excepts from disclosure "information considered to be confidential by law, either constitutional, statutory, or by judicial decision." Gov't Code § 552.101. This section encompasses information made confidential by other statutes. Section 181.101 of the Health and Safety Code states the following: A covered entity shall comply with the Health Insurance Portability and Accountability Act and Privacy Standards relating to: . . . . (3) uses and disclosures of protected health information, including requirements relating to consent[.] . . . . Health & Safety Code § 181.101. This section requires certain entities to comply with the federal Health Insurance and Portability and Accountability Act and Privacy Standards ("HIPAA"). Health & Safety Code § 181.101; see also Attorney General Opinion JC-0508 (2002). A covered entity shall comply with the requirements of Chapter 181 not later than September 1, 2003. Act of May 27, 2001, 77th Leg., R.S., ch. 1511, § 5, Tex. Gen. Laws 5384, 5393. The Commission argues that as a covered entity under section 181.001, it must adhere to the requirements of HIPAA. However, compliance with chapter 181 is not required until September 1, 2003. See Act of May 27, 2001, 77th Leg., R.S., ch. 1511, § 5, Tex. Gen. Laws 5384, 5393. Thus, there are no legal ramifications for failing to comply before this date. That is, the provisions of chapter 181 cannot provide any possible confidentiality protection to the information before September 1, 2003.(1) Consequently, the Commission cannot rely on chapter 181 at this time to assert confidentiality for the requested information. Next, we address the issue of whether the submitted information falls within the purview of HIPAA. At the direction of Congress, the Secretary of Health and Human Services ("HHS") promulgated regulations setting privacy standards for medical records, which HHS issued as the Federal Standards for Privacy of Individually Identifiable Health Information. See Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. § 1320d-2 (Supp. IV 1998) (historical & statutory note); Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Pts. 160, 164; see also Attorney General Opinion JC-0508 at 2 (2002). These standards govern the releasability of protected health information by a covered entity. See 45 C.F.R. Pts. 160, 164. Under these standards, a covered entity may not use or disclose protected health information, excepted as provided by parts 160 and 164 of the Code of Federal Regulations. 45 C.F.R. § 164.502(a). Section 160.103 defines a covered entity as a health plan, a health clearinghouse, or a healthcare provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. 45 C.F.R. § 160.103. In this instance, because the Commission has not explained how it qualifies as a covered entity under HIPAA, we have no basis to conclude the information warrants protection under the federal act. In summary, the Commission cannot rely on chapter 181 of the Health and Safety Code at this time to protect any of the submitted information. Further, because the Commission has not established it meets the definition of a covered entity under the federal counterpart, it may not withhold any information based on HIPAA. Therefore, as the Commission claims no other exception to disclosure, we conclude it must release the submitted information to the requestor. This letter ruling is limited to the particular records at issue in this request and limited to the facts as presented to us; therefore, this ruling must not be relied upon as a previous determination regarding any other records or any other circumstances. This ruling triggers important deadlines regarding the rights and responsibilities of the governmental body and of the requestor. For example, governmental bodies are prohibited from asking the attorney general to reconsider this ruling. Gov't Code § 552.301(f). If the governmental body wants to challenge this ruling, the governmental body must appeal by filing suit in Travis County within 30 calendar days. Id. § 552.324(b). In order to get the full benefit of such an appeal, the governmental body must file suit within 10 calendar days. Id. § 552.353(b)(3), (c). If the governmental body does not appeal this ruling and the governmental body does not comply with it, then both the requestor and the attorney general have the right to file suit against the governmental body to enforce this ruling. Id. § 552.321(a). If this ruling requires the governmental body to release all or part of the requested information, the governmental body is responsible for taking the next step. Based on the statute, the attorney general expects that, within 10 calendar days of this ruling, the governmental body will do one of the following three things: 1) release the public records; 2) notify the requestor of the exact day, time, and place that copies of the records will be provided or that the records can be inspected; or 3) notify the requestor of the governmental body's intent to challenge this letter ruling in court. If the governmental body fails to do one of these three things within 10 calendar days of this ruling, then the requestor should report that failure to the attorney general's Open Government Hotline, toll free, at (877) 673-6839. The requestor may also file a complaint with the district or county attorney. Id. § 552.3215(e). If this ruling requires or permits the governmental body to withhold all or some of the requested information, the requestor can appeal that decision by suing the governmental body. Id. § 552.321(a); Texas Dep't of Pub. Safety v. Gilbreath, 842 S.W.2d 408, 411 (Tex. App.--Austin 1992, no writ). Please remember that under the Act the release of information triggers certain procedures for costs and charges to the requestor. If records are released in compliance with this ruling, be sure that all charges for the information are at or below the legal amounts. Questions or complaints about over-charging must be directed to Hadassah Schloss at the Texas Building and Procurement Commission at (512) 475-2497. If the governmental body, the requestor, or any other person has questions or comments about this ruling, they may contact our office. We note that a third party may challenge this ruling by filing suit seeking to withhold information from a requestor. Gov't Code § 552.325. Although there is no statutory deadline for contacting us, the attorney general prefers to receive any comments within 10 calendar days of the date of this ruling. Sincerely, Christen Sorrell
c: Mr. Nick Rocha
Footnotes 1. We note the 78th Legislature passed Senate Bill 330, which repeals section 181.101 of the Health and Safety Code. Tex. S.B. 330, 78th Leg., R.S. (2003); see Health & Safety Code § 181.101 (requiring covered entities to comply with HIPAA). This act, signed by Governor Perry on April 10, 2003, becomes effective September 1, 2003. POST OFFICE BOX 12548, AUSTIN, TEXAS 78711-2548 TEL: (512) 463-2100 WEB: WWW.OAG.STATE.TX.US |