 ATTORNEY GENERAL OF TEXAS GREG ABBOTT | |
|
May 30, 2003 Mr. Jeffrey S. Young
OR2003-3665 Dear Mr. Young: You ask whether certain information is subject to required public disclosure under chapter 552 of the Government Code. Your request was assigned ID# 181940. The Texas Tech University Health Sciences Center (the "center") received a request for information relating to the requestor's termination. You inform us that the center has released some of the requested information. You claim that the remaining requested information is excepted from disclosure under section 552.101 of the Government Code. We have considered the exception you claim and have reviewed the information you submitted. We also have considered the comments that we received from the requestor. See Gov't Code § 552.304 (any person may submit written comments stating why information at issue in request for attorney general decision should or should not be released). Section 552.101 of the Government Code excepts from required public disclosure "information considered to be confidential by law, either constitutional, statutory, or by judicial decision." This exception encompasses information that other statutes make confidential. The disclosure of medical records is governed by the Medical Practice Act (the "MPA"), subtitle B of title 3 of the Occupations Code. See Occ. Code § 151.001. Section 159.002 of the MPA provides in part: (a) A communication between a physician and a patient, relative to or in connection with any professional services as a physician to the patient, is confidential and privileged and may not be disclosed except as provided by this chapter. (b) A record of the identity, diagnosis, evaluation, or treatment of a patient by a physician that is created or maintained by a physician is confidential and privileged and may not be disclosed except as provided by this chapter. (c) A person who receives information from a confidential communication or record as described by this chapter, other than a person listed in Section 159.004 who is acting on the patient's behalf, may not disclose the information except to the extent that disclosure is consistent with the authorized purposes for which the information was first obtained. Id. § 159.002(a)-(c). This office has determined that in governing access to a specific subset of information, the MPA prevails over the more general provisions of chapter 552 of the Government Code. See Open Records Decision No. 598 (1991). We also have determined that the MPA ordinarily encompasses only records that were created either by a physician or by someone acting under the supervision of a physician. See Open Records Decision Nos. 487 (1987), 370 (1983), 343 (1982). Medical records must be released upon the patient's signed, written consent, provided that the consent specifies (1) the information to be covered by the release, (2) reasons or purposes for the release, and (3) the person to whom the information is to be released. See Occ. Code §§ 159.004, .005. Section 159.002(c) requires that any subsequent release of medical records be consistent with the purposes for which the governmental body obtained the records. See Open Records Decision No. 565 at 7 (1990). Medical records may be released only as provided by the MPA. See Open Records Decision No. 598 (1991). You contend that the MPA is applicable to some of the submitted information. You do not inform us, however, and it is not otherwise clear to this office that any of the information in question was created by a physician or by someone acting under the supervision of a physician. Therefore, we conclude that none of the information in question is excepted from disclosure under section 552.101 of the Government Code in conjunction with the MPA. You also raise section 552.101 in conjunction with section 181.101 of the Health and Safety Code, which provides in part: A covered entity shall comply with the Health Insurance Portability and Accountability Act and Privacy Standards relating to: . . . . (3) uses and disclosures of protected health information, including requirements relating to consent[.] . . . . Health & Safety Code § 181.101(3). This section requires certain entities to comply with the federal Health Insurance Portability and Accountability Act and Privacy Standards ("HIPAA"). See also Attorney General Opinion JC-0508 (2002). A covered entity shall comply with the requirements of chapter 181 of the Health and Safety Code not later than September 1, 2003. See Act of May 27, 2001, 77th Leg., R.S., ch. 1511, § 5, 2001 Tex. Gen. Laws 5384, 5393. You contend that as a covered entity under section 181.001 of the Health and Safety Code, the center must comply with the requirements of HIPAA. We note, however, that compliance by a covered entity with chapter 181 of the Health and Safety Code is not required until September 1, 2003. See Act of May 27, 2001, 77th Leg., R.S., ch. 1511, § 5, 2001 Tex. Gen. Laws 5384, 5393. Thus, there are no legal ramifications for failing to comply before this date. That is, the provisions of chapter 181 cannot provide any possible confidentiality protection to the submitted information before September 1, 2003.(1) Consequently, the center cannot rely on chapter 181 at this time to assert confidentiality for any of the submitted information. Next, we consider whether the submitted information falls within the purview of HIPAA. At the direction of Congress, the Secretary of Health and Human Services ("HHS") promulgated regulations setting privacy standards for medical records, which HHS issued as the Federal Standards for Privacy of Individually Identifiable Health Information. See Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. § 1320d-2 (Supp. IV 1998) (historical & statutory note); Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Pts. 160, 164; see also Attorney General Opinion JC-0508 at 2 (2002). These standards govern the releasability of protected health information by a covered entity. See 45 C.F.R. Pts. 160, 164. Under these standards, a covered entity may not use or disclose protected health information, excepted as provided by parts 160 and 164 of the Code of Federal Regulations. 45 C.F.R. § 164.502(a). Section 160.103 defines a covered entity as a health plan, a health clearinghouse, or a healthcare provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. 45 C.F.R. § 160.103. In this instance, the center has not explained how it qualifies as a covered entity under HIPAA, and therefore we have no basis to conclude that any of the submitted information warrants protection under the federal act. You also raise section 552.101 of the Government Code in conjunction with the common-law right to privacy. Information is excepted from public disclosure under section 552.101 in conjunction with common-law privacy when it is (1) highly intimate or embarrassing, such that release of the information would be highly objectionable to a person of ordinary sensibilities, and (2) of no legitimate public interest. See Industrial Found. v. Texas Ind. Accident Bd., 540 S.W.2d 668, 685 (Tex. 1976), cert. denied, 430 U.S. 931 (1977). Common-law privacy under section 552.101 protects the types of information that the Texas Supreme Court held to be intimate or embarrassing in Industrial Foundation. See 540 S.W.2d at 683 (information relating to sexual assault, pregnancy, mental or physical abuse in the workplace, illegitimate children, psychiatric treatment of mental disorders, attempted suicide, and injuries to sexual organs). This office has since concluded that other types of information also are private under section 552.101. See Open Records Decision Nos. 659 at 4-5 (1999) (summarizing information attorney general has determined to be private), 470 at 4 (1987) (illness from severe emotional job-related stress), 455 at 9 (1987) (prescription drugs, illnesses, operations, and physical handicaps), 343 at 1-2 (1982) (references in emergency medical records to a drug overdose, acute alcohol intoxication, obstetrical/gynecological illness, convulsions/seizures, or emotional/mental distress). We conclude that a small portion of the submitted information is protected by common-law privacy. The center must withhold that information, which we have marked, under section 552.101 of the Government Code. The center also may be required to withhold a small portion of the remaining information under section 552.117 of the Government Code. Section 552.117(1) excepts from public disclosure the home address and telephone number, social security number, and family member information of a current or former official or employee of a governmental body who requests that this information be kept confidential under section 552.024. Whether a particular item of information is protected by section 552.117(1) must be determined at the time that the request for the information is received by the governmental body. See Open Records Decision No. 530 at 5 (1989). Therefore, the center may only withhold information under section 552.117(1) on behalf of a current or former official or employee who made a request for confidentiality under section 552.024 prior to the date on which the center received the request for information. The center may not withhold information under section 552.117(1) for a current or former official or employee who did not make a timely election under section 552.024 to keep the information confidential. We have marked what appears to be information that reveals whether an employee of the center has a family member. If the marked information relates to a current or former employee, the center must withhold that information under section 552.117(1) if the employee in question timely requested confidentiality for the employee's family member information under section 552.024. We note that the requestor has a special right of access to her own section 552.117 information.(2) Information to which the requestor has a right of access under section 552.023 may not be withheld from her under section 552.117. In summary, the center must withhold a small portion of the submitted information under section 552.101 of the Government Code in conjunction with common-law privacy. The center may be required to withhold another small portion of the submitted information under section 552.117(1). The rest of the submitted information must be released. This letter ruling is limited to the particular records at issue in this request and limited to the facts as presented to us; therefore, this ruling must not be relied upon as a previous determination regarding any other records or any other circumstances. This ruling triggers important deadlines regarding the rights and responsibilities of the governmental body and of the requestor. For example, governmental bodies are prohibited from asking the attorney general to reconsider this ruling. Gov't Code § 552.301(f). If the governmental body wants to challenge this ruling, the governmental body must appeal by filing suit in Travis County within 30 calendar days. Id. § 552.324(b). In order to get the full benefit of such an appeal, the governmental body must file suit within 10 calendar days. Id. § 552.353(b)(3), (c). If the governmental body does not appeal this ruling and the governmental body does not comply with it, then both the requestor and the attorney general have the right to file suit against the governmental body to enforce this ruling. Id. § 552.321(a). If this ruling requires the governmental body to release all or part of the requested information, the governmental body is responsible for taking the next step. Based on the statute, the attorney general expects that, within 10 calendar days of this ruling, the governmental body will do one of the following three things: 1) release the public records; 2) notify the requestor of the exact day, time, and place that copies of the records will be provided or that the records can be inspected; or 3) notify the requestor of the governmental body's intent to challenge this letter ruling in court. If the governmental body fails to do one of these three things within 10 calendar days of this ruling, then the requestor should report that failure to the attorney general's Open Government Hotline, toll free, at (877) 673-6839. The requestor may also file a complaint with the district or county attorney. Id. § 552.3215(e). If this ruling requires or permits the governmental body to withhold all or some of the requested information, the requestor can appeal that decision by suing the governmental body. Id. § 552.321(a); Texas Dep't of Pub. Safety v. Gilbreath, 842 S.W.2d 408, 411 (Tex. App.--Austin 1992, no writ). Please remember that under the Act the release of information triggers certain procedures for costs and charges to the requestor. If records are released in compliance with this ruling, be sure that all charges for the information are at or below the legal amounts. Questions or complaints about over-charging must be directed to Hadassah Schloss at the Texas Building and Procurement Commission at (512) 475-2497. If the governmental body, the requestor, or any other person has questions or comments about this ruling, they may contact our office. We note that a third party may challenge this ruling by filing suit seeking to withhold information from a requestor. Gov't Code § 552.325. Although there is no statutory deadline for contacting us, the attorney general prefers to receive any comments within 10 calendar days of the date of this ruling. Sincerely, James W. Morris, III
c: Ms. Rachel K. Mendez
Footnotes 1. We note that the 78th Legislature passed Senate Bill 330, which repeals section 181.101 of the Health and Safety Code. See S.B. 330, Acts 2003, 78th Leg., R.S. This act, which Governor Perry signed April 10, 2003, becomes effective September 1, 2003. 2. See Gov't Code § 552.023(a) (person or person's authorized representative has special right of access, beyond right of general public, to information held by governmental body that relates to person and is protected from public disclosure by laws intended to protect person's privacy interests). POST OFFICE BOX 12548, AUSTIN, TEXAS 78711-2548 TEL: (512) 463-2100 WEB:WWW.OAG.STATE.TX.US |