Can Tennessee's stroke-registry annual report identify which hospitals had which stroke outcomes?

Plain-English summary

The Tennessee Stroke Registry Act of 2008 (Tenn. Code Ann. § 68-1-1903) directed the East Tennessee State University College of Public Health, working with the Tennessee stroke systems task force, to build a statewide stroke database. Hospitals are encouraged to report 20 specific categories of data on stroke prevalence, mortality, and performance metrics aligned with the American Heart Association, the Centers for Disease Control and Prevention, and the Joint Commission. The College then makes the data available to the public health community through an annual report.

Rep. Craig Fitzhugh asked two related questions about the report's scope. First, can the College name the hospitals in the report? Second, what does the statute mean when it says the College cannot disclose "hospital-specific information"?

The AG read the statute's three subsections together. Subsection (a) requires the annual report to contain "aggregate data." Subsection (c)(3) prohibits the College from disclosing "any hospital-specific information reported to it." Subsection (c)(2) layers on a HIPAA carve-out (no disclosure prohibited by 42 U.S.C. § 1320d). The combined effect is clear: the College may publish combined or consolidated statewide stroke metrics, but it cannot identify individual hospitals or release data tied to any particular hospital. The plain meaning of "aggregate" and "specific" controls under the standard Tennessee canon (Kite v. Kite, 22 S.W.3d 803 (Tenn. 1997); Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1 (Tenn. 1993)). "Aggregate" means combined into a single whole; "specific" means relating to a particular named thing.

The opinion adds a practical caution: the bar on identifying specific hospitals is not just a bar on naming them. It also reaches information that would indirectly identify a hospital. The example the AG gave is reporting data tied to "the hospital in [a particular county]" when only one hospital exists in that county. Indirect identification (by location, by patient volume, by ownership) is just as prohibited as direct naming. The College has to design the annual report so that no individual hospital's performance can be reverse-engineered from the published data.

The takeaway for the public-health community: the Tennessee Stroke Registry produces statewide and regional-aggregate stroke outcome metrics. It is not a hospital-quality scorecard. Anyone wanting hospital-specific stroke outcomes has to look elsewhere (federal Medicare quality reporting, hospital-disclosed Joint Commission data, public-records requests to specific hospitals, etc.).

Currency note

This opinion was issued in 2010. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

The Tennessee Stroke Registry Act has been amended at various points since 2010, and federal HIPAA regulations and the federal hospital-quality-reporting landscape have evolved substantially. Anyone evaluating a current Tennessee stroke-data disclosure question should look at the current text of Tenn. Code Ann. § 68-1-1903 and current federal hospital-data rules, not at the 2010 framework.

Common questions

Q: What is the Tennessee Stroke Registry?
A: A statewide stroke-care database maintained by the East Tennessee State University College of Public Health, in cooperation with the Tennessee stroke systems task force. The Registry collects 20 categories of stroke-care data from participating hospitals (prevalence, mortality, treatment timing, transfer patterns) aligned with national-consensus stroke metrics.

Q: Why doesn't the Registry name hospitals?
A: Because the legislature expressly chose confidentiality at the hospital level. Tenn. Code Ann. § 68-1-1903(c)(3) prohibits the College from disclosing "any hospital-specific information reported to it." The legislative choice reflects a tradeoff: hospitals are more willing to participate honestly in a registry if they know the data will not be used to embarrass or rank them publicly.

Q: What counts as "hospital-specific information"?
A: Any non-aggregate data. That includes hospital names, hospital identifiers, and any information that would indirectly identify a specific hospital (by county, by volume, by ownership type, etc.) when only a few hospitals fit the description.

Q: What can the annual report include?
A: Aggregate statewide and possibly regional data: combined stroke prevalence, combined mortality rates, combined adherence to best-practice metrics. The data has to be consolidated across multiple hospitals so that no single hospital's data can be inferred.

Q: Does HIPAA also limit what can be disclosed?
A: Yes. The statute's (c)(2) clause says nothing in the Stroke Registry Act authorizes disclosure that would be prohibited under HIPAA (42 U.S.C. § 1320d et seq.). HIPAA primarily protects individual patient information, so it adds a patient-level confidentiality layer on top of the hospital-level confidentiality already required by (c)(3).

Q: Can a patient or researcher get hospital-specific stroke data directly from a hospital?
A: Possibly, but not through the Stroke Registry. The Registry itself cannot release it. A patient with their own medical records or a researcher with an institutional data-sharing agreement may have other paths, subject to HIPAA and to whatever the hospital's own disclosure policies allow.

Q: Why does the AG warn against indirect identification?
A: Because publishing data tied to "the hospital in [County X]" when only one hospital exists in that county effectively names the hospital. The statutory prohibition on "hospital-specific" disclosure would be hollow if the College could just describe the hospital instead of naming it.

Background and statutory framework

The Tennessee Stroke Registry Act of 2008 is part of a larger Tennessee public-health framework for improving stroke care. The legislature created a stroke care, education, and outreach collaborative in each grand division of the state under Tenn. Code Ann. § 68-1-1901, designed to help community hospitals acquire the skills to qualify as stroke centers. The Stroke Registry under § 68-1-1903 is the data-collection arm of that framework.

Statutory structure. Section 68-1-1903 has three subsections that matter here:

• Subsection (a) directs ETSU's College of Public Health to maintain the statewide database, requires the data platform to use nationally available stroke registry tools, requires coordination with national voluntary health organizations, and provides: "The college of public health shall make aggregate data available to the public health community via an annual report."

• Subsection (b)(1)-(20) lists 20 categories of stroke-care data hospitals are encouraged to report.

• Subsection (c) has three protections: (c)(1) clarifies the Act is not a medical practice guideline; (c)(2) preserves HIPAA's protections; (c)(3) states "[t]he college of public health shall not disclose any hospital-specific information reported to it."

Statutory interpretation canon. Tennessee follows the plain-meaning canon. Kite v. Kite, 22 S.W.3d 803, 805 (Tenn. 1997) (citing Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1, 2 (Tenn. 1993)): "When a statute's language is unambiguous, the legislative intent shall be derived from the plain and ordinary meaning of the statutory language."

Black's Law Dictionary definitions. "Aggregate" means "formed by combining into a single whole or total." "Specific" means "[o]f, relating to, or designating a particular or defined thing; explicit" and "[o]f or relating to a particular named thing." Taken together, they mean: the College may publish combined-total data; it may not publish data tied to any particular named thing (hospital).

The indirect-identification problem. The opinion's caution about indirect identification is critical. A naive reading might suggest that as long as the College does not literally print hospital names, it can publish anything. But the legislative purpose (hospital-level confidentiality to encourage candid reporting) is defeated by indirect identifiers. The opinion's example: identifying a stroke patient's hospital by county when only one hospital exists in that county. By the same logic, identifying the only Tier 1 trauma center in a region, the only academic medical center, or the only hospital of a particular ownership type would also violate (c)(3). The College has to design reports to suppress small-cell counts and similar deanonymizing structures.

Practical consequences for users of the data. Public-health researchers can get statewide stroke trends from the annual report. Hospital administrators get a benchmark against the state aggregate but not against named peers. Journalists and patients cannot use the Registry to compare hospitals. The Registry's design choice (hospital-level confidentiality) is a deliberate legislative tradeoff: it produces less consumer-facing transparency, but it gets more honest participation from hospitals. Whether that tradeoff is the right one is a policy question the AG did not address.

Citations and references

Statutes:

• Tenn. Code Ann. § 68-1-1901 (stroke care collaborative)
• Tenn. Code Ann. § 68-1-1903 (Tennessee Stroke Registry Act of 2008)
• Tenn. Code Ann. § 68-1-1903(a) (aggregate annual report)
• Tenn. Code Ann. § 68-1-1903(b)(1)-(20) (categories of reported data)
• Tenn. Code Ann. § 68-1-1903(c)(1) (not a medical practice guideline)
• Tenn. Code Ann. § 68-1-1903(c)(2) (HIPAA carve-out)
• Tenn. Code Ann. § 68-1-1903(c)(3) (no disclosure of hospital-specific information)
• 42 U.S.C. § 1320d et seq. (HIPAA)

Cases:

• Kite v. Kite, 22 S.W.3d 803 (Tenn. 1997)
• Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1 (Tenn. 1993)

Source

• Landing page: https://www.tn.gov/attorneygeneral/opinions.html
• Original PDF: https://www.tn.gov/content/dam/tn/attorneygeneral/documents/ops/2010/op10-057.pdf

Original opinion text

April 28, 2010

Opinion No. 10-57

Disclosure of Information Reported to the Tennessee Stroke Database

QUESTIONS

1. Does the Tennessee Stroke Registry Act of 2008, Tenn. Code Ann. § 68-1-1903, permit the East Tennessee State University College of Public Health to disclose identifying information regarding hospitals, including but not limited to hospital names, when sharing data reported to the Tennessee Stroke Database?

2. What constitutes "hospital-specific information" within the meaning of Tenn. Code Ann. § 68-1-1903(c)(3)?

OPINIONS

1. No.

2. The term "hospital-specific information," as that term is used in Tenn. Code Ann. § 68-1-1903(c)(3), means non-aggregate data.

ANALYSIS

1. The Tennessee Stroke Registry Act of 2008, Tenn. Code Ann. § 68-1-1903, provides that the East Tennessee State University College of Public Health, in cooperation with the Tennessee stroke systems task force, shall maintain a statewide stroke database that compiles information and statistics on stroke care involving prevalence, mortality and performance metrics that align with the stroke consensus metrics developed and approved by the American Heart Association, Centers for Disease Control and Prevention and the Joint Commission. Tenn. Code Ann. § 68-1-1903(a).

[Footnote 1: We understand this to refer to Tenn. Code Ann. § 68-1-1901, which provides that "[t]he commissioner of health shall establish a stroke care, education, and outreach collaborative in each grand division of the state. The members of the collaborative shall be hospitals and health care providers providing stroke care in the grand division. The collaborative shall develop and support a program of education and outreach focused on helping community hospitals acquire the skills and resources necessary to qualify them as stroke centers, equipped for the treatment of a patient with acute stroke. The program will be targeted to hospitals and providers in the grand division."]

Further, "[t]he college of public health shall make aggregate data available to the public health community via an annual report." Id. (Emphasis added). The statute requires that the college "shall support this data platform based on nationally available stroke registry tools that are based on nationally recognized, evidence-based guidelines," and that to every extent possible, the College of Public Health "shall coordinate with national voluntary health organizations involved in stroke quality improvement to avoid duplication and redundancy." Id. Beginning with calendar year 2009 and for each subsequent calendar year, hospitals are encouraged to report annually certain categories of information to the College of Public Health, which categories are described specifically in Tenn. Code Ann. § 68-1-1903(b)(1) - (20). However, Tenn. Code Ann. § 68-1-1903 "shall not be construed as a medical practice guideline and shall not be used to restrict the authority of a hospital to provide services for which it has received a license to provide such services under state law," nor shall it be construed "to authorize any disclosure of information that would be prohibited pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) compiled in 42 U.S.C. § 1320d, et seq." Tenn. Code Ann. § 68-1-1903(c)(1) and (2). Last, Tenn. Code Ann. § 68-1-1903(c)(3) provides that "[t]he college of public health shall not disclose any hospital-specific information reported to it."

The above language precludes the College of Public Health from disclosing any hospital-specific information reported to it; it also requires that the annual report, which is to be made available annually by the College of Public Health to the public health community, be in the form of "aggregate data." Therefore, it is our opinion that Tenn. Code Ann. § 68-1-1903 prohibits such annual report(s) promulgated by the College of Public Health from disclosing identifying information regarding hospitals, including but not limited to hospital names, when sharing data reported to the Tennessee Stroke Database.

2. As is referenced above, Tenn. Code Ann. § 68-1-1903(a) provides that the College of Public Health "shall make aggregate data available to the public health community via an annual report." (Emphasis added). Thus, the statutory proscription against release of "hospital-specific information," as that term is used in Tenn. Code Ann. § 68-1-1903(c)(3), means non-aggregate data. "When a statute's language is unambiguous, the legislative intent shall be derived from the plain and ordinary meaning of the statutory language." Kite v. Kite, 22 S.W.3d 803, 805 (Tenn. 1997) (citing Carson Creek Vacation Resorts v. Dept. of Revenue, 865 S.W.2d 1, 2 (Tenn. 1993)).

Since the College of Public Health is limited to making available "aggregate" data gleaned from the various hospitals, it may only disclose combined or consolidated information in its reports. Black's Law Dictionary defines the adjective "aggregate" as "formed by combining into a single whole or total." Black's Law Dictionary 72 (8th ed. 2004). It also defines the word "specific" in pertinent part as, variously, "[o]f, relating to, or designating a particular or defined thing; explicit" and "[o]f or relating to a particular named thing." Id. at 1434. Therefore, we think that the statute clearly prohibits the College of Public Health from disclosing identifying information about specific hospitals, or from tying any facet of its annual report to any particular named hospital. Further, we would also caution against any disclosure of information by the college that might indirectly or by implication identify a specific hospital (such as referring to an unnamed hospital's location by county, when only one hospital exists in such county).

ROBERT E. COOPER, JR.
Attorney General and Reporter

MICHAEL E. MOORE
Solicitor General

SARA E. SEDGWICK
Senior Counsel

Requested by:

Honorable Craig Fitzhugh
State Representative
33 Legislative Plaza
Nashville, Tennessee, TN 37243-0182