Preemption Analysis of Texas Laws Relating to the Privacy of Health ...

Texas Health & Safety Code
Section/
Chapter
Related/
Contrary
Explanation
Preemption
Exception
Is State Law
Preempted?
Recommendation
§ 142.009
Surveys;
Consumer
Complaints
Related/
Not Contrary
Dept. of Human Services has identified itself as a covered
entity but has not identified any health care components.
Therefore, DHS is a wholly covered entity and not a hybrid.
§§ 142.009(d)(1) and (2) authorize DHS to release the
"reports, records, and working papers used or developed in
an investigation made under [the] section" to a state or
federal agency or to law enforcement personnel.
On its face, the authorized disclosure does not incorporate
HIPAA's limitations on such disclosure. As a covered entity,
DHS could be required to follow such limitations. However, it
appears that DHS could release them in a non-HIPAA
deidentified manner consistently with its functions as a health
oversight agency.
No
As a matter of clarification, there is no distinction within the
statute for "agency" as used to refer to a licensee and
"agency" as used to refer to a governmental entity.
§ 142.0092
Consumer
Complaint Data
§ 142.0093
Resolution
Prohibited
Related/
Not Contrary
Not Related
The complaint is made by the consumer--and therefore may
be IIHI but is not PHI b/c consumer makes complaint and
brings to the attention of the covered entity. Note that in (b),
there is a reference to deidentification.
Given DHS's designation as a covered entity, this information
may be HIPAA de-identified and may therefore not meet the
"useful format" requirement. On the other hand, it appears
that such information would be released pursuant to DHS's
health oversight functions and may not have to follow
HIPAA's more stringent de-identification procedures.
No
No
194