TEXAS Texas Health and Human Services Commission Health and Human Services Phil Wilson Executive EbmmssIoner May 4, 2020 VIA INTERAGENCY MAIL Mr. Justin Gordon Office of the Attorney General Open Records Division Price Daniel, Sr., State Office Building P. 0. Box 12548 Austin, TX 7871 C2548 HHSC ReferenceNos. 22: 048, 22054. 22081, 22098. 22152, 22158, 22169, 22174, •Re: 22183. 22187. 22193. 22195. 22212, 22213. 22217, 22218. 22224, and 22229 Dear Mr. Gordon: From April 14, 2020 to April 23, 2020, the .Heaith and Human Sen••ices Commission (“HHSC” or “the Commission”) has received eighteen requests seeking information regarding COVID- 19 cases in nursing homes, assisted living.: facilities, and state facilities, The Commission has been releasing aggregate statewide numbers. but the requestors generally seek facility specific COVID 19 infection numbers. The Commission believes that it lacks the authority under state law to release the.. requestedinformation; The Commission received an additional ten requests seekingthe same or similar information afier the date of our initial letter. We have added those requests, HHSC ReferenceNos,,22054,22169.22i74,22183,22l87,22193,22195,22212,222l3.22217,22218. 22224, and 22229, to this brief The Commission believes the information at issue is either not subject to the Act under Section 552.002(d) of the Act and Health and Safety Code 18 1.006 or, in the alternative, is confidential under section 552,101 of the Government Code, For certain facilities, other statutory’ bars to release are present. Copies of the requests are enclosed as Exhibit A. We have enclosed a representative sample of the records at issue as Exhibit B. Please use HHSC Reference Nos. 22048. 22054. 22081. 22098, 22152. 22158, 22169, 22174, 22183,22187,22193,22195,22212,22213. 22217, 22218, 22224, and 22229 when corresponding regarding this request. This letter was deposited into interoffice mail on May 4, 2020. We are aware that the Office of the Attorney General has followed Abbott v. Texas Dep ‘t ofMental Austin 2006, no pet), in resolving Health & Mental Retardation. 212 S.W.3d 648 (Tex. App. — P.O. Box 13247 Austin, Texas 7871F3247 512-42465OO hhs.texcis.gov IllS RfrercnceNos 2’048 ?04 208 2 098 12 __18 224 e2222 2219 _212 213 22 age2 3 l58 2 9 2174 2183 187 2D3 ‘ similar requests. However, the Commission believes that subsequent changes in state law make it clear that the Commission is not authorized to release the requested information. Gov’t Code 552.002(d) and Health and Safety Code 181.006 HHSC believes the requested information is not subject to the Act. Section 551002(d) of the Government Code (enacted in 2019) states that “protected health information” as defined by section 18L006 of the Health and Safety Code is not public information and is not subject to disclosure under Chapter 552. Section 181 006 was added o (hapter 181 f the Health and Safety Code by the Legislature n 2009 and was subsequently amended in 2011 Ihus since the ruling in 4bbott r Jas Dep t of ustin 2006 no pet) and the Mental health & i/fental Retardation, 212 S.W 3d 648 (lex App. underlying O&G ruling, there haxe been sigmficant cfanges in law requiring HHS( to look to the Ieueial HIPA definitiuii of pruLcteu iiea h i’$urniatiurt, im..iuding th rquircmerit bat information that can form a reasonable basis o F elie e it can be used to identify an ndi idual must be sithheld ccordingly, we belice this is distinguishable from those rulings as ne ther eetior 552.002(d) of the Government Code nor section 184 006 of the Health and Safety Code had been promulqated at the time. — Seenon 181 )Oo of the Healt and Safety ( ode tate [F o 1 r i cnered entity that is a gocmmental unit infonr ation i indrviduai’s orotcete I health (1) ‘ncludes ny nformation hat reflects an i idi idual received realt i ca he eo ered entity’ and ft iv (2) is not public information and is not subject to disclosure under Chapter 52 Government Code, Health and Safety Code § 184.006. The word “includes” indicates that the definition of protected health information encompasses more than the ords of Health and Safety Code 181.006(1). Section 181.00% (b)(2)(A) defines “covered entity,” in part, as any person s ho: F PS R frerc c 2 18 ‘2054 ‘208k 2 )8 21 1 2218, 2h4 nd22__9 2 ° 22 1 , for commercial, financial, or professional gain, monetary fees, or dues, or on a cooperative, nonprofit, or pro bono basis, engages, in whole or in part. and with real or constructive knowledge, in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information. The term includes a business associate, health care payer, governmental unit, information or computer management entity, school, health researcher, health care facility, clinic, health care provider, or person who maintains an Internet site[J” Heal h and Safety Code i 181 001 (b)(2)(A). HHSC regularly assembles, collects, analyzes, uses, e aluates, stores, and transmits protected health information and elected to be a hybrid covered ent ty under HIPA \ because ts activities include both covered and nomco crcd functions. HIISC s a c ,ered entity under the definition of 181 Wc note that while scction 552 002(d) imp rt th d t itio i of protected health information ( PHI’) it does not appear to in port the ecu m u t at the PH he held by a c ered enuty T erctore the cope of onfdentia’ity found 2 02(d) H the j vernmcnt C’ ide is broader than that Pu id in ect on 81 006 of the Health and afe y (ode as i does rot cquirc that an cntity be a o ered erti for PH r t possessior excluded tro n equ red public disclosure urder the A t tected hcaltf \s addressed abo e sec ion i52002 of he Goernmert oce states that n o mation’ a d ir d by section 181 06 of the Health and Safety C ode is excluded from the c s defirnt n of oublie i iformation However while chapter 181 discasses F HI t docs not etine t To address this we note section 181 001(a) of tire Health and Safety ( de proxides that [r]nlcss o ierwisc dc rd in this chapter, each term tha is usud in his uharner ras hc meanm assumed by the Hea’th Insurance Portability and ccountability Act and Prtracy Standards turn to IIPA \ t dete’m c th dcfinition o’ HIT \j. re etc c hanter 181 cq tires s ‘protected health ‘nforrnation” IIIP A defines ‘protected health information” as indwidually identifiable health information that is transmitted or maintained in electronic media or any other form or medium S’ee 45 CFR. ‘ l60103. ‘Indi’vidually identifiable health information” is defined as a subset ofhealth information including demographic information collected from an individual, and. https: hhs.texas. go laws-regulations 1ega1-information/hipaa-privacy-lav $ hhs-st stem-privacy-di ision-hbnd covered-entity-statement TIHSC Reteence \os 22u-n< 2)54. 22i 221Qic, 2252. 22155. 2269 217-t. 22i3. 221S, ‘93 2295, 2222 222i3. 22’T. 2221s. 22221 aid 22229 Page 4 (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and 2) Relates to the past. present. or future physical or mental health or condition of an mdix idual; the prox ision of health care to an individual: or the past. present. or future payment for the provision of health care to an individual: and (i) That identifies the individual; or (II) With respect to xhich there is a reasonable basis to believe the information can be used to identify the indiiduaI (emphasis added) It!. lie ntormation at issue was created proxders and otlier coxered entities. HHSC from documents collected from health care The information relates to the past or present pnycicdi health oindiiduais in certain faci1ties and IIHSC has a reasonable basis to hel ev that the release of the information could be used to identif he ndixiduals, While there does not appear to be an explicit definition of what makes information dentifiable. HIPAA provides that geographic data namely location data for areas smaller than a tate is PHI. 45 C FR l64.5I4(b)(2). Sinc the requests at issue are asking for Iealth ‘nfonnaton numbers broken doun hr health condition and hs mdviduai faci1tr. ise he!exe the nfonnauon at isne iS PHI and, thus. excluded from the disclosure under section 52,O02d or the — Goxerrmient Code and section lSi.flOO of the Health and Safetr Code. de242,O49 Section 552.101 of the Government Code excepts from public disclosure “intormation considered to be confidential by law either constitutional. statutory. or by judicial decision. Govtt Code 552.101. Thus. section 552.101 of the Goxernnient Code encompasses information made confidential by other statutes. Section 242049 of the Health and Safety Code prox ides, in pertinent part: (a) The [Commission] may evaluate data for quality of care in nursing facilities. (b) The [Commission] may gather data on a form or forms to be provided by the [Commission] to improx e the quality of care in nursing facilities and may provide information to nursing facilities which will allow them to improx e and maintain the quality FfrISCR feren so 21a t95,22L 2048 22054 22081 2 98 )b2,2 b8 221 9. 721 4 2783 22i 22 33. a l_22_9 4 l722 8_222 of care which they provide. Data referred to in this section can include information compiled from documents otherwise available under Chapter 552. Government Code, including hut not limited to individual survey reports and investigation reports. (c) All licensed nursing facilities in the state may be required to submit information designated by the [Commission] as necessary to improve the quality of care in nursing facilities. (d) The collection, compilation. and analysis of the information and any reports produced from these sources shall be done in a manner that protects the privacy of any individual about whom information is given and is explicitly confidential (emphasis added). The [Commissonj shall protect and maintain the confidentiality of the information. The information receied by the [Commission]. any information compiled as a resu t of rnview of internal agency documents and any reports. compilations, and nalys ‘s prod ced from these sources shall not be available for pub ic nspection or disclo ure. nor are these sources public records within the meaning of C hapter 552, Go ernmem Code. The information and any compilations, reports. or analyses produced Ircim the information shall not be subject to discor cry, subpoena. or other means of legal or entity except as provided in this section and shall compu s on for release to any pers ot 1 e dmissible in any ci ii adm n strati e. or criminal proceeding. Ihs pnri ege haIl be recounzed b\ Rules 501 and 502 of the Texas Rules of Esidence. Health and Safety Code 242 049 The information compiled from nursing facilities was obtained iursing facilities were required to prox ide that y t ic Commission as quality of care data oformation o the Commission pursuant t subsections (b) and (c) of ection 4249 Pursuant to subsection (d). the information provided to the Commission. and the reports. compilations, and the na1vses created by the Commission based on the provided data are not public records meaning of C hapter 552. Accordingly, we believe that the information derived from records provided to the Commission from nursing facilities pursuant to Health and Safety Code 242.049(b) must be withheld from disclosure under section 242.049(d). Gov ‘t Code ,‘ 552.101 Health and Sattv Code . 247.051 Section 552.101 of the Government Code excepts from public disclosure “information considered to be confidential by law, either constitutional, statutor, or by judicial decision. Govt Code HHSC Refer nec ‘Nos 2’( 48, “O 4 27O1 2u98 221 223D, 222 2 21 22S 2 21, in122J Pa e 551101. Thus, section 551101 of the Government Code encompasses section 247M5i of the Health and Safety Code. Upon receipt of information indicating a NF has a confirmed COVID- 19 case, HHSC may initiate an investigation as the state agency regulating NFs under HSC 242 and the federal survey agency pursuant to HHSC’s Section 1864 agreement with CMS. HSC 242 requires HHSC to release certain information concerning completed investigations, and CMS guidance allows the release of certain information concerning completed investigations. Information concerning pending mr estigations and surveys, including the existence of such initiated by a selfrreport of COVID 19, must be protected from public disclosure in order to protect the Integrity of the investigatir c process and the privacs nghts of thc affected institutions See I lealth and Safety Code 247 051. I he infbrnation ompi1ed from assisted irs inc, faclities ma’e result in a tatement ot ri fiations and r formal dispute resolution under Health and Safety ( ode 247 051 Th. assisted Iirnng facilities crc requirea o pro Ge that i rto mation to the ommisslon as sell report to be investigated by the Commission Pursuant to subsection (di of section 247 051, the statement of violations prepared by the (ommission foil rsring a survey inspection, investigation, or risit is confidential pending the outcome of the informal dispute resolution process. ccordingly, we believe that the information derrred from records prorided o the Commission from assisted living facilities may be r’ ithheld from disclosure und r subsection (d) of section 41 051 pending the outcome f the nforrnal dispute resolution procss ‘t that time we ‘clie e that the information relat ng t rfections ir specific assisted rinI, facilities ould st 11 nt be releasable under (or t (ode 52 002(d) aid Health and Safety Code § 181 006 ode 2604 Section 52,101 also encompasses Chapter 260A of the lexas Health & Safety Code. wnich addresses another type of mr estigation in which the requested information may be found. Section 260A,002 of the Health & Safety (ode requires any person who believes that the physical or mental health or welfare of a nursing facility resident has been or may be affected by abuse, neglect, or exploitation to report that potential abuse, neglect, or exploitation. HHSC is initiating investigations upon receipt of this information. Section 260AM08 of the Health & Safety Code provides that reports, records, and rs orking papers used or developed under Chapter 260A are confidential and may only be disclosed pursuant to HHSC rule, To the extent that the information at issue was derived from a report made or an investigation conducted under section 260A,002, we believe it is confidential and not subject to disclosure HHS( her 2219. 221 i Nos.22045.22051 2081 ‘i98 ‘22 221 8 221 9 22i73,2l$3 2 87 22i93 213 2222, 2221 S. 24 ard 22229 Pace 7 Gm’ ‘t 1ode 552.1011 Medical Practices Act Section 552.101 also encompasses the Medical Practices Act (“MPA”). subtitle B of title 3 of the Occupations Code. which governs release of medical records. See 0cc. Code § 151.001-168.202. Section 159.002 of the MPA provides, in relevant part: (a) A communication heticn a physician and a patinnt, re1ativ to or in connection with any professional services as a physician to the patient, is confidential and privileged and may not be disclosed except as provided by this chapter ft) A ecord of thu identity, diagnosis, evaluation, or treatment of a pat’ent by a phy ician that s crcatcu r maintained by a physician is confidential and pr vieged and may not be i k sed xcept as pros ided by his chapter (c 8 person \cho receisec inicruation t±om a confidential commrmieation r record a decuribed b\ this chapter. other than a person listed in Section 1 59.004 who s acting on die pinenr’s behalf may not disdose the nIormation except to the extent that disclosure is consistent ssith the authorized purposes for ‘zhich the information isas first obtained. 159,1:02(a) (c). information subject to the MPA iniudes both medical records and 1. aii7irniatiop ‘tained from tjioe medt;-ti records. The submitted informatton contains information i rredical records sub derived the MP.\ We h&’ese t us unforrnaton from all of the dcilut us mus bc vithheld under cc ior 2 101 of the Govemmen C inc in conjunetlo 4ith the In summary, HHSC believes alt of the information at issue is not public information pursuant to section 552.002(d) of the Act and section 181.006 of the Health and Safety Code for all facility types. or is confidential under section 552.101 of the Government Code in conjunction with section 242.049 of the Health and Safety Code or the MPA for nursing facilities and under the MPA and 247.051 of the Health and Safety Code for assisted living facilities and 260A of the Health and safety Code for all facilities. qiCReren’e’os 2 12195 4 l2,2213222i 2054 2’08 22O98,2i5) 1)8 2216) 2 174 2 183 218 22193 ‘2218 292k and29 Page .3 Finally, we would note that the Center for Medicare and Medicaid Services (CMS) has recently issued guidance that it intends to require all nursing facilities to report COVID infections directly to the Center for Disease Control (CDC), for use by CMS and the CDC, and further that CMS is adopting federal regulations to enforce this requirement. This development has the potential to complicate the legal analysis if CMS takes the position that the information gathered by HHSC from nursing facilities is information owned by CMS, subject to the Federal Freedom of Information Act and not state disclosure statutes. See https:/’www.crns.go ;filesidocurnent;qso 20-26-nhpdE While this issue only comes up if you disa’ee with our view that Gov’t Code § c52M02(d) and Health and Safety Code § 181 006 prohibit disclosure, HHSC reserves the right to provide further briefing to the Office of the Attorney General as may be appropriate. Sincerely, cc: Perla Trevizo Reporter ProPub1ica Texas J ri3 ane Ir estigati e unit iA F-Mth Alex Moser VIA E-MAIL Elizabeth Cline-Rew VIA E-MAIL Julie Chang Austin American-Statesman VIA E-MAIL Joseph Ellis Brad Streicher KVUE VIA E-MAIL 22i5222i522139 221 HiSC ReferenceNos 220iS 22054 220Xi22( 222L. 22213. 227. 222i. Z22± and 2222; Emily Foxhall Houston Chronicle VIA E-MAIL Mark Smith VvTAA VIA E-MAIL Chris Kirkham Reuters VIA E-MAIL Cam Deniz Uorbec \ IA I -\L\JL Melanje bITe CBS ustin TA E-MAIL John Fedesco Ibus on ChroniLle \ \ MAIl ‘t.i’ Ia ‘ 11 CBS VIAl MAE Enc Besson rkansas Democrat-Gazette VIA E-MAIL KelIev Shannon Executh e Director Freedom of Information Foundation of Texas VIA E-MAIL Kathleen Warshan sky VL\ E-MAIL Cory McCoy 21a3 221r22i°3, HlSCRefreice\o _(4S O4 Tyler Morning felegraph VIA E-MAIL Laurie Miller VIA E-MAIL 2Oi ‘O),2? ‘. 5&22 69 2 3 2’8 22’8 2293