Texas open records law sparks HIPAA lawsuit

Texas courts will be the first to answer this question: Does a state open records law trump HIPAA?

A Texas trial court said the state law that ensures public access to government records doesn't supersede the Health Insurance Portability and Accountability Act provisions that assure medical records privacy. Now the case is in the hands of the Texas Court of Appeals in Austin, where separate divisions of the Texas Attorney General's Office in May presented oral arguments of both the office's opinion and the state's mental health agency.

The case revolves around a news organization's request for five years of statistics related to sexual assault allegations and investigations at each state hospital and Texas Dept. of Mental Health and Mental Retardation facility. Texas Attorney General Greg Abbott argued that HIPAA didn't apply. On the other side of the debate, MHMR said the act is applicable and, therefore, the agency could only release statewide numbers that weren't specific to individual facilities.

The Texas Medical Assn. has not weighed in on the case. Health care lawyers say doctors are split on how they want to see the court rule.

If the lower court ruling stands, "and doctors disclose information to the Texas Dept. of Health, it could go out to the public," said Cheryl Camin, a lawyer on the health care practice team at Gardere Wynne Sewell in Dallas. "But on the flip side, if they are researchers, they would have better access to information."

Lawyers defending the attorney general's opinion would not comment on the pending litigation. In court documents, though, they argue that the state Public Information Act prevents a government agency from disclosing protected health information but requires that unprotected health information be released when a state governmental body collects, assembles or maintains the information.

Abbott said the news organization's request for statistics didn't involve protected health information and that the numbers must be released under the Public Information Act.

"This case is not about releasing individual personal medical information," he said in court documents. "The information at issue here is statistical information. ... [The] record contains no evidence that the information here is protected."

Making the case against disclosure

Lawyers from the attorney general's office who are representing the mental health agency disagree. In court documents, they said the MHMR released a statewide total number only because of HIPAA rules.

The agency said privacy law requires that identifying information be removed before information is released, including addresses and other geographic information. MHMR argued that if it were to release statistics tied to the names of its facilities, the information could easily be linked to facilities' addresses and "that in turn would reveal the address of residence or treatment for every individual to whom the information pertains."

Because the data could be combined with other databases to identify individuals, according to MHMR, the privacy law requires the agency to do one of two things before releasing data. It must have a professional statistician evaluate the risk of a personal privacy breach to determine whether removal of identifiers is warranted, or remove all identifiers before releasing the data. In this case, MHMR chose to remove the identifiers by not releasing facility-specific information and giving the news organization only the aggregate statewide number.

"Knowing that 100% of the residents at a particular facility have a diagnosis of schizophrenia would enable a data broker with access to a residential address database to find the names of all residents at the facility and to know that each named person has a diagnosis of schizophrenia," attorneys for MHMR argue in court documents. "The analysis does not change if the information is abuse rather than schizophrenia or if the percentage is 90% or 40%."

Sheryl T. Dacso, DrPH, a lawyer who runs her own firm in Houston and represents physicians, said privacy advocates want to see HIPAA prevail because if this information were allowed to be revealed, it would open the door to other sensitive patient information being released.

"The controversy comes down to: 'How easy is it going to be to go back and figure out names of people at the facility?' " Dacso said. "HIPAA set standards for privacy and exceptions for disclosure."