Can the North Carolina Medical Database Commission, by changing its own administrative rules, start releasing patient-level health data instead of only aggregate statistics, even if the patient identities are encrypted? Who legally 'owns' the data submitted by hospitals, and are hospitals exposed to liability if a patient is inadvertently identified despite encryption?

Plain-English summary

The North Carolina Medical Database Commission asked whether it could change its rules to release patient-level data, including data encrypted to mask patient identities. The AG said no: G.S. 131E-210 authorized dissemination of aggregate data, and a rule under G.S. 150B-2(8a) could only implement or interpret a statute. The Commission could not redefine “aggregate” to mean “non-aggregate.” Legislative action was needed before it could release patient-level information.

The AG also answered two related questions. Neither submitting hospitals nor the Commission had exclusive ownership rights in the data. The opinion says that plans to release data in a new form did not affect who owned it; the obstacle was the statute's restriction on dissemination. It also said G.S. 131E-212(e) made a person who submits data to the Commission immune from liability in a civil action, answering a question about inadvertent patient identification. The opinion did not say the State assumed liability instead.

Currency note

The opinion interprets the Commission's authority and data protections as they stood in 1993. Check current statutes and rules for a present disclosure decision.

Background and statutory framework

G.S. 131E-211 allowed the Commission to require data from medical care providers. G.S. 131E-210(b) made compiled data available in aggregate form, while G.S. 131E-212(g) limited use of collected data to purposes authorized by the relevant statutory article. The AG said the Commission could continue collecting data without a statutory amendment so long as collection and dissemination followed the law.

The ownership answer was separate from the disclosure answer. The opinion agreed with the Commission that a different release format would not alter ownership issues. It then repeated that legislation was required before any release other than in aggregate form.

Common questions

Could a Commission rule allow release of encrypted patient-level data?

The AG said legislative action was required before the Commission could release patient-level data. A rule could not turn the statutory term “aggregate” into “non-aggregate.” The request discussed masking identities, but that did not change the statutory answer.

Did either the hospital or the Commission own the submitted data exclusively?

No. The opinion says neither had exclusive ownership rights. It also says a new disclosure form would not itself change the ownership issue.

Was a hospital liable if a patient was identified despite masking efforts?

The AG answered no to that question, citing G.S. 131E-212(e), which immunized a person submitting data to the Commission from liability in any civil action. It did not address liability of the State or another party.

Citations

• G.S. 131E-210, G.S. 131E-210(b)
• G.S. 131E-211
• G.S. 131E-212(e), G.S. 131E-212(g)
• G.S. 150B-2(8a)

Source

• Landing page: https://ncdoj.gov/opinions/release-of-patient-specific-information-by-the-north-carolina-medical-database-commission/

Original opinion text

April 12, 1993

Mr. James Hazelrigs, Director
Medical Database Commission
3901 Barrett Drive, Suite 204
Raleigh, North Carolina 27609

Re: Advisory Opinion Regarding the Release of Patient-Specific Information by the North Carolina Medical Database Commission Pursuant to G.S. 131E-210

Dear Mr. Hazelrigs: You have raised a number of questions concerning the authority of the North Carolina Medical Database Commission. Those questions generally relate to the Commission's desire to begin releasing reports which contain patient-specific data. You have asked this Office to review the Commission's enabling legislation and respond to three questions. Those questions, along with our responses, are set out separately below.

Question 1: Can the Commission change its administrative Rules to allow the release of patient level data as long as the general guidance of the legislature is followed, or is specific legislative modification needed?

The Medical Database Commission is authorized by G.S. 131E-210 to disseminate aggregate data. Pursuant to G.S. 150B-2(8a), a rule can only "implement or interpret" a statute. Therefore, the Commission may not, by rule, change "aggregate" to mean "non-aggregate". It is our opinion that legislative action would be required to authorize the Commission to release patient level data.

Question 2: Who "owns" the data submitted to the Commission? Since the Commission releases aggregated information by statute now without permission, how is this policy changed if we release patient level information that has been encrypted so as to prevent actual patient "John Doe" identification?

Neither the hospital nor the Medical Database Commission has exclusive ownership rights in the data. G.S. 131E-211 provides that the Medical Database Commission may require that data be submitted to it from all medical care providers. G.S. 131E-210(b) provides that the data compiled will be made available in aggregate form to interested persons. G.S. 131E-212(g) provides that the Commission may not use the data collected for a purpose other than one authorized by this Article. The Commission does not need a statutory amendment in order to continue to collect the data. So long as the data is collected and disseminated in a manner authorized by statute, the Commission does not violate any ownership rights that the hospitals may have in the data.

Although hospitals have been providing this data to the Commission since its inception, they raised no ownership issues so long as the Commission's release of the data provided was consistent with the requirements of G.S. 131E-210. You correctly note that issues as to who owns the data are not affected by your plans to release the data in a new form. However, in our response to your first question, we concluded that legislation would be required before the Commission could release data other than in "aggregate" form.

Question 3: Are there any considerations concerning liability for the original providers of the information (the hospital) to the Commission, if for any reason a patient is inadvertently identified despite all attempts to mask the identification?

No. G.S. 131E-212(e) provides that any person who submits data to the Commission shall be immune from liability in any civil action. I hope you find this information useful.

Jo Ann Sanford, Special Deputy Attorney General

Evelyn B. Terry, Associate Attorney General