Can a Maryland hospital association publish reports on doctors' practice patterns using ID numbers instead of names?

Plain-English summary

In 1987, the President of the Maryland Senate asked the Attorney General whether the Maryland Hospital Association ("MHA") could lawfully compile and market a published report analyzing individual physicians' practice patterns across hospitals, using a physician identifier number system set up under HG §19-213(4) of the Health-General Article. That statute required hospitals to report physician-specific data to the Health Services Cost Review Commission ("HSCRC") for cost-containment purposes, but kept the physicians' actual names confidential and limited disclosure of names to a short list of authorized recipients.

The Attorney General concluded that MHA's report did not violate HG §19-213(4), because it used only the nonconfidential physician identification number, not physicians' names, so it did not disclose confidential information. But the opinion also flagged a real concern: since some hospitals could match their own physicians' identifier numbers back to names, a hospital could use MHA's cross-hospital report to pressure a physician into changing admitting practices to that hospital's advantage, something the opinion said was inconsistent with the statute's purpose even if not literally a name disclosure. The opinion supported the HSCRC's plan to fix this by giving each physician two separate identifier numbers, one for hospital reporting and a different one for the public data set, so that no hospital could link its own physicians' identities to the cross-hospital practice-pattern data.

Currency note

This opinion was issued in 1987. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

Could a hospital association compile physician practice-pattern reports under 1987 Maryland law?
According to this opinion, yes, so long as the reports relied on the nonconfidential physician identification number rather than the physician's name, which HG §19-213(4) kept confidential.

Could a hospital use physician identifier data to pressure a doctor over admitting practices?
The opinion said no. Even though a hospital's use of its own physicians' identifiers to track cross-hospital practice patterns did not technically disclose a name, the opinion found that using the data this way was inconsistent with the statute's purpose, and supported the Health Services Cost Review Commission's plan for a dual-identifier system to prevent it.

Background and statutory framework

The HSCRC had required Maryland hospitals to report inpatient discharge data, including a physician identifier number, since 1976, originally using hospital-specific numbers that could not be matched across different hospitals. HG §19-213(4), enacted by Chapter 112 of the Laws of Maryland 1985 on the recommendation of the Governor's Task Force on Health Care Cost Containment, was meant to let the HSCRC track a physician's practice patterns across multiple hospitals while keeping the physician's name confidential, disclosable only to the hospital's own utilization review committee, the Medical and Chirurgical Faculty of Maryland, the State Board of Medical Examiners, or the Commission on Medical Discipline.

In response, the HSCRC adopted a system, developed with the Medical and Chirurgical Faculty and effective July 1, 1985 under COMAR 10.37.06, in which each hospital submitted a physician's name and license number to the Medical and Chirurgical Faculty to obtain one shared identification number, reported to HSCRC on discharge records. The opinion found that because only the number, not the name, went into HSCRC's nonconfidential data base, MHA's report compiling those numbers across hospitals did not violate HG §19-213(4)'s confidentiality requirement. But because a single shared number let any hospital that already knew its own physicians' numbers track those same physicians' patterns at other hospitals, the opinion supported the HSCRC's planned fix: assigning each physician two numbers, one disclosed only to the reporting hospital and a different one placed in the public, cross-hospital data set, so no hospital could link the two and identify a physician outside its own walls.

Citations

Statutes:

• HG §19-213(4) (confidentiality of physician-identifying discharge data reported to the HSCRC, with a limited list of authorized recipients)
• HG §19-213(4)(i) (utilization review committee as an authorized recipient of a physician's name)
• Chapter 112, Laws of Maryland 1985 (enacted HG §19-213(4) on the Governor's Task Force recommendation)
• COMAR 10.37.06 (HSCRC regulation implementing the modified physician identifier system)

Cases: none cited in this opinion.

Source

• Landing page: https://oag.maryland.gov/resources-info/Pages/attorney-general%E2%80%99s-opinions.aspx
• Original PDF: https://oag.maryland.gov/resources-info/Documents/pdfs/Opinions/1987/Volume72_1987.pdf

Original opinion text

Best-effort transcription from a scanned PDF. Minor errors may remain, the linked PDF is authoritative.

HEALTH SERVICES COST REVIEW COMMISSION

Physician Identification—Confidentiality—Compilation Of Public Data By Hospital Association Not Prohibited, But Commission's Plan To Assure Fuller Protection Of Identities Will Properly Carry Out Legislative Intent.

September 10, 1987

The Honorable Thomas V. Mike Miller, Jr.
President, Senate of Maryland

You have requested our opinion regarding the permissible use of physician identifier numbers under §19-213 of the Health General Article ("HG" Article). Specifically, you ask whether the current practice of the Maryland Hospital Association ("MHA") in compiling and then marketing these numbers in a published report is prohibited by HG §19-213(4). Under this provision, all Maryland hospitals are required to submit to the Health Services Cost Review Commission ("HSCRC") information that includes:

"physician information sufficient to identify practice patterns of individual physicians across all facilities. The names of individual physicians are confidential and are not discoverable or admissible in evidence in a civil or criminal proceeding, and may only be disclosed to the following:
(i) The utilization review committee of a Maryland hospital;
(ii) The Medical and Chirurgical Faculty of the State of Maryland;
(iii) The State Board of Medical Examiners; or
(iv) The Commission on Medical Discipline of Maryland."

For the reasons stated below, we conclude that MHA's publication, which analyzes physician practice patterns across all hospitals based on physician identifier numbers but which does not disclose the names of those physicians, is not prohibited under HG §19-213(4). Nevertheless, the subsequent use of the published information by a hospital to place pressure on a physician to change his or her admitting practices to that hospital's advantage would be inconsistent with the purpose of HG §19-213. Hence, we support the HSCRC's current effort to develop a new reporting methodology that will assure greater confidentiality of physicians' identification.

I
Background

The HSCRC has been requiring Maryland hospitals to report discharge data since 1976. These reports include clinical, demographic, and charge data for all inpatient cases discharged from general acute care hospitals. The original data set included a physician identifier number for both the attending and operating physician in each case. This number was a hospital assigned physician identifier that preserved the confidentiality of the names of individual physicians involved.

The HSCRC sought this information in order to monitor the practice patterns of physicians in particular hospitals, so as to carry out more effectively its hospital cost containment responsibilities. However, the HSCRC's performance of this function was restricted by its inability to track physician practice patterns across hospitals.

HG §19-213(4), enacted as part of Chapter 112 of the Laws of Maryland 1985, was intended to solve this problem. The provision embodies one of the recommendations made by the Governor's Task Force on Health Care Cost Containment.1 The Task Force recommended that the HSCRC have the authority "to collect and utilize information identifying practice patterns of individual physicians, including patterns of practice across different hospitals." Report to the Governor, Recommendation No. 11, at 31 (December 14, 1984). The Task Force believed that the data obtained by the HSCRC would be "of value to all Maryland practitioners, health planners and policy makers, and hospital medical boards," to make utilization review easier and to assist the HSCRC in its examination of the impact on hospital costs of physician practice patterns. Report at 32. However, the Task Force emphasized that "[i]ndividual physicians should not be subject to public disclosure." Id.

II
Confidentiality Requirements

In response to HG §19-213(4), the HSCRC modified its physician identifier reporting regulations to require a physician identification system that was not hospital-specific. The development of the modified identification system resulted from the participation of the Medical and Chirurgical Faculty of Maryland ("Med Chi"), the MHA, and the HSCRC staff. The modified system became effective on July 1, 1985. See 12:13 Md. Reg. 1280 (June 21, 1985).

Under the system, each hospital submits the name and physician license number of all physicians reported on the HSCRC discharge data base to Med Chi in order to obtain a unique physician identification number. The hospital then reports the number obtained from Med Chi to HSCRC on the appropriate discharge record. See COMAR 10.37.06.

This system was designed to permit the tracking of physician practice patterns across hospitals while maintaining the confidentiality of individual physician names. The physician identification number, but not the physician's name, is included in the HSCRC's nonconfidential data base. The number itself is properly treated as public information. Thus, an MHA report that simply compiles this public information does not violate the confidentiality provisions of HG §19-213(4).

However, we share your concern about any hospital that, with the capacity to correlate identification numbers with the names of its own physicians, then examines the practice patterns of those physicians across other hospitals and is able, as you put it, "to place pressure on a physician to change his admitting practices to that hospital's advantage." Nothing in the history behind the enactment of HG §19-213(4) or in the law itself suggests that a hospital may use the physician identifier for this purpose.2 Indeed, only the utilization review committee of a hospital is legally authorized to be privy to the name of an individual physician that is reported by the hospital to the HSCRC. HG §19-213(4)(i).

To correct what it believes to be a misuse of the physician identifier, the HSCRC intends to implement a new alternate identification system this year. Under the new system, recommended by Med Chi, each physician will be assigned two identification numbers: one given to a hospital for its reports, the alternate disclosed to the public on the nonconfidential data base. Each hospital will have access only to the physician identifier it submitted on the discharge data base; a hospital will not be able to examine the practice patterns of its physicians across other hospitals, because it will not be able to match up its physician identifiers with the alternates. The new system will restrict the tracking of practice patterns of physicians across hospitals to the legally authorized entities only. It will thereby carry out the purpose of the confidentiality requirement of HG §19-213(4).

III
Conclusion

In summary, it is our opinion that the use by the Maryland Hospital Association of the nonconfidential, unique physician identification number in its reports of physician practice patterns is not prohibited under HG §19-213(4). At the same time, a hospital's subsequent use of this number to place pressure on a physician to change his or her admitting practices to that hospital's advantage is contrary to the intent underlying HG §19-213(4). To correct this misuse of the physician identifier, the HSCRC is implementing this year an alternate identification system that will allow the tracking of practice patterns of physicians across hospitals without impairing the confidentiality guaranteed by HG §19-213(4).

J. Joseph Curran, Jr., Attorney General
Stanley Lustman, Assistant Attorney General

Jack Schwartz
Chief Counsel
Opinions and Advice

1 The Task Force was convened by Governor Hughes in August 1984 to address the problem of the rapid escalation in health care costs. The Task Force developed a series of specific recommendations to address each of its concerns.

2 To the contrary, the Task Force recommended that the data not be made public "in a way that will improperly focus public attention on particular physicians. . . ." Report at 32.