Can Tennessee's stroke-registry annual report identify which hospitals had which stroke outcomes?

Plain-English summary

The Tennessee Stroke Registry Act of 2008 (Tenn. Code Ann. § 68-1-1903) directed the East Tennessee State University College of Public Health, working with the Tennessee stroke systems task force, to build a statewide stroke database. Hospitals are encouraged to report 20 specific categories of data on stroke prevalence, mortality, and performance metrics aligned with the American Heart Association, the Centers for Disease Control and Prevention, and the Joint Commission. The College then makes the data available to the public health community through an annual report.

Rep. Craig Fitzhugh asked two related questions about the report's scope. First, can the College name the hospitals in the report? Second, what does the statute mean when it says the College cannot disclose "hospital-specific information"?

The AG read the statute's three subsections together. Subsection (a) requires the annual report to contain "aggregate data." Subsection (c)(3) prohibits the College from disclosing "any hospital-specific information reported to it." Subsection (c)(2) layers on a HIPAA carve-out (no disclosure prohibited by 42 U.S.C. § 1320d). The combined effect is clear: the College may publish combined or consolidated statewide stroke metrics, but it cannot identify individual hospitals or release data tied to any particular hospital. The plain meaning of "aggregate" and "specific" controls under the standard Tennessee canon (Kite v. Kite, 22 S.W.3d 803 (Tenn. 1997); Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1 (Tenn. 1993)). "Aggregate" means combined into a single whole; "specific" means relating to a particular named thing.

The opinion also cautions against disclosure that might indirectly or by implication identify a hospital. Its example is referring to an unnamed hospital by county when only one hospital exists in that county. The opinion does not identify other indirect identifiers or state a separate rule for them.

The takeaway for readers of the annual report is that the College may disclose combined or consolidated data from the hospitals, without tying a part of the report to a particular named hospital.

Currency note

This opinion was issued in 2010. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The opinion describes Tenn. Code Ann. § 68-1-1903 as it stood in April 2010. Check its current text before relying on the disclosure rule for a later report.

Common questions

Q: What is the Tennessee Stroke Registry?
A: A statewide stroke-care database maintained by the East Tennessee State University College of Public Health, in cooperation with the Tennessee stroke systems task force. The Registry collects 20 categories of stroke-care data from participating hospitals (prevalence, mortality, treatment timing, transfer patterns) aligned with national-consensus stroke metrics.

Q: Why doesn't the Registry name hospitals?
A: Tenn. Code Ann. § 68-1-1903(c)(3) prohibits the College from disclosing "any hospital-specific information reported to it." The opinion applies that text together with the annual report's aggregate-data requirement.

Q: What counts as "hospital-specific information"?
A: The opinion defines the term as non-aggregate data. It says the College cannot disclose hospital names or tie part of its annual report to a particular named hospital. It cautions against indirect identification, giving the example of naming a county with only one hospital.

Q: What can the annual report include?
A: Combined or consolidated information from the hospitals, rather than information tied to a particular named hospital. The opinion does not specify a geographic reporting level.

Q: Does HIPAA also limit what can be disclosed?
A: Yes. The statute's (c)(2) clause says nothing in the Stroke Registry Act authorizes disclosure that would be prohibited under HIPAA (42 U.S.C. § 1320d et seq.). HIPAA primarily protects individual patient information, so it adds a patient-level confidentiality layer on top of the hospital-level confidentiality already required by (c)(3).

Q: Can a patient or researcher get hospital-specific stroke data directly from a hospital?
A: The opinion addresses what the College of Public Health may disclose from the Stroke Database. It does not decide what an individual hospital may release under other laws or agreements.

Q: Why does the AG warn against indirect identification?
A: The opinion cautions that identifying an unnamed hospital's county could reveal the hospital when it is the county's only one. It does not give a broader list of indirect identifiers.

Background and statutory framework

The Tennessee Stroke Registry Act of 2008 is part of a larger Tennessee public-health framework for improving stroke care. The legislature created a stroke care, education, and outreach collaborative in each grand division of the state under Tenn. Code Ann. § 68-1-1901, designed to help community hospitals acquire the skills to qualify as stroke centers. The Stroke Registry under § 68-1-1903 is the data-collection arm of that framework.

Statutory structure. Tenn. Code Ann. § 68-1-1903 has three subsections that matter here:

• Subsection (a) directs ETSU's College of Public Health to maintain the statewide database, requires the data platform to use nationally available stroke registry tools, requires coordination with national voluntary health organizations, and provides: "The college of public health shall make aggregate data available to the public health community via an annual report."

• Subsection (b)(1)-(20) lists 20 categories of stroke-care data hospitals are encouraged to report.

• Subsection (c) has three protections: (c)(1) clarifies the Act is not a medical practice guideline; (c)(2) preserves HIPAA's protections; (c)(3) states "[t]he college of public health shall not disclose any hospital-specific information reported to it."

Statutory interpretation canon. Tennessee follows the plain-meaning canon. Kite v. Kite, 22 S.W.3d 803, 805 (Tenn. 1997) (citing Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1, 2 (Tenn. 1993)): "When a statute's language is unambiguous, the legislative intent shall be derived from the plain and ordinary meaning of the statutory language."

Black's Law Dictionary definitions. "Aggregate" means "formed by combining into a single whole or total." "Specific" means "[o]f, relating to, or designating a particular or defined thing; explicit" and "[o]f or relating to a particular named thing." Taken together, they mean: the College may publish combined-total data; it may not publish data tied to any particular named thing (hospital).

Indirect identification. Beyond its conclusion about named hospitals, the opinion cautions against information that might indirectly or by implication identify a specific hospital. Its sole example is identifying an unnamed hospital's county when that county has only one hospital.

Practical consequences for users of the data. The annual report must present aggregate information to the public health community. This opinion does not address uses of other stroke-care data sources or the policy reasons for the statute's reporting limits.

Citations and references

Statutes:

• Tenn. Code Ann. § 68-1-1901 (stroke care collaborative)
• Tenn. Code Ann. § 68-1-1903 (Tennessee Stroke Registry Act of 2008)
• Tenn. Code Ann. § 68-1-1903(a) (aggregate annual report)
• Tenn. Code Ann. § 68-1-1903(b)(1)-(20) (categories of reported data)
• Tenn. Code Ann. § 68-1-1903(c)(1) (not a medical practice guideline)
• Tenn. Code Ann. § 68-1-1903(c)(2) (HIPAA carve-out)
• Tenn. Code Ann. § 68-1-1903(c)(3) (no disclosure of hospital-specific information)
• 42 U.S.C. § 1320d et seq. (HIPAA)

Cases:

• Kite v. Kite, 22 S.W.3d 803 (Tenn. 1997)
• Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1 (Tenn. 1993)

Source

• Landing page: https://www.tn.gov/attorneygeneral/opinions.html
• Original PDF: https://www.tn.gov/content/dam/tn/attorneygeneral/documents/ops/2010/op10-057.pdf

Original opinion text

April 28, 2010

Opinion No. 10-57

Disclosure of Information Reported to the Tennessee Stroke Database

QUESTIONS

1. Does the Tennessee Stroke Registry Act of 2008, Tenn. Code Ann. § 68-1-1903, permit the East Tennessee State University College of Public Health to disclose identifying information regarding hospitals, including but not limited to hospital names, when sharing data reported to the Tennessee Stroke Database?

2. What constitutes "hospital-specific information" within the meaning of Tenn. Code Ann. § 68-1-1903(c)(3)?

OPINIONS

1. No.

2. The term "hospital-specific information," as that term is used in Tenn. Code Ann. § 68-1-1903(c)(3), means non-aggregate data.

ANALYSIS

1. The Tennessee Stroke Registry Act of 2008, Tenn. Code Ann. § 68-1-1903, provides that the East Tennessee State University College of Public Health, in cooperation with the Tennessee stroke systems task force, shall maintain a statewide stroke database that compiles information and statistics on stroke care involving prevalence, mortality and performance metrics that align with the stroke consensus metrics developed and approved by the American Heart Association, Centers for Disease Control and Prevention and the Joint Commission. Tenn. Code Ann. § 68-1-1903(a).

[Footnote 1: We understand this to refer to Tenn. Code Ann. § 68-1-1901, which provides that "[t]he commissioner of health shall establish a stroke care, education, and outreach collaborative in each grand division of the state. The members of the collaborative shall be hospitals and health care providers providing stroke care in the grand division. The collaborative shall develop and support a program of education and outreach focused on helping community hospitals acquire the skills and resources necessary to qualify them as stroke centers, equipped for the treatment of a patient with acute stroke. The program will be targeted to hospitals and providers in the grand division."]

Further, "[t]he college of public health shall make aggregate data available to the public health community via an annual report." Id. (Emphasis added). The statute requires that the college "shall support this data platform based on nationally available stroke registry tools that are based on nationally recognized, evidence-based guidelines," and that to every extent possible, the College of Public Health "shall coordinate with national voluntary health organizations involved in stroke quality improvement to avoid duplication and redundancy." Id. Beginning with calendar year 2009 and for each subsequent calendar year, hospitals are encouraged to report annually certain categories of information to the College of Public Health, which categories are described specifically in Tenn. Code Ann. § 68-1-1903(b)(1) - (20). However, Tenn. Code Ann. § 68-1-1903 "shall not be construed as a medical practice guideline and shall not be used to restrict the authority of a hospital to provide services for which it has received a license to provide such services under state law," nor shall it be construed "to authorize any disclosure of information that would be prohibited pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) compiled in 42 U.S.C. § 1320d, et seq." Tenn. Code Ann. § 68-1-1903(c)(1) and (2). Last, Tenn. Code Ann. § 68-1-1903(c)(3) provides that "[t]he college of public health shall not disclose any hospital-specific information reported to it."

The above language precludes the College of Public Health from disclosing any hospital-specific information reported to it; it also requires that the annual report, which is to be made available annually by the College of Public Health to the public health community, be in the form of "aggregate data." Therefore, it is our opinion that Tenn. Code Ann. § 68-1-1903 prohibits such annual report(s) promulgated by the College of Public Health from disclosing identifying information regarding hospitals, including but not limited to hospital names, when sharing data reported to the Tennessee Stroke Database.

2. As is referenced above, Tenn. Code Ann. § 68-1-1903(a) provides that the College of Public Health "shall make aggregate data available to the public health community via an annual report." (Emphasis added). Thus, the statutory proscription against release of "hospital-specific information," as that term is used in Tenn. Code Ann. § 68-1-1903(c)(3), means non-aggregate data. "When a statute's language is unambiguous, the legislative intent shall be derived from the plain and ordinary meaning of the statutory language." Kite v. Kite, 22 S.W.3d 803, 805 (Tenn. 1997) (citing Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1, 2 (Tenn. 1993)).

Since the College of Public Health is limited to making available "aggregate" data gleaned from the various hospitals, it may only disclose combined or consolidated information in its reports. Black's Law Dictionary defines the adjective "aggregate" as "formed by combining into a single whole or total." Black's Law Dictionary 72 (8th ed. 2004). It also defines the word "specific" in pertinent part as, variously, "[o]f, relating to, or designating a particular or defined thing; explicit" and "[o]f or relating to a particular named thing." Id. at 1434. Therefore, we think that the statute clearly prohibits the College of Public Health from disclosing identifying information about specific hospitals, or from tying any facet of its annual report to any particular named hospital. Further, we would also caution against any disclosure of information by the college that might indirectly or by implication identify a specific hospital (such as referring to an unnamed hospital's location by county, when only one hospital exists in such county).

ROBERT E. COOPER, JR.
Attorney General and Reporter

MICHAEL E. MOORE
Solicitor General

SARA E. SEDGWICK
Senior Counsel

Requested by:

Honorable Craig Fitzhugh
State Representative
33 Legislative Plaza
Nashville, Tennessee, TN 37243-0182