Gov. Bill Haslam speaks during the 37th annual Chattanooga Area Leadership Prayer Breakfast at the Chattanooga Convention Center in this file photo."The release of the of the information in response to requests made under Tennessee's Public Records Act does not violate the HIPAA Privacy Rule," the opinion says.
HIPPA is the federal Health Insurance Portability and Accountability Act.
The opinion was requested by Rep. Kevin Brooks, R-Cleveland, and Rep. Rick Womick, R-Murfreesboro.
It comes with many Republican lawmakers incensed after the administration released the names of current and retired lawmakers as well as their monthly premium payments and state taxpayers' contributions to the premiums.
That was done in response to Open Record Act requests by news organizations' following Republican lawmakers' rejection of Haslam's proposed expansion of Medicaid under President Barack Obama's Affordable Care Act.
The information among other things revealed that six of seven Republican senators, including Todd Gardenhire, R-Chattanooga, voting to kill Haslam's proposed Insure Tennessee plan in committee during a special session were on the state-subsidized health plan.
Republican senators, including Gardenhire and Sen. Bo Watson, R-Hixson, voted to kill the proposal when it resufraced during the regular legislative session.
None of the released information revealed information about illnesses, surgeries or similar, specific information.
In their legal opinion, Slatery and state Solicitor General Andree Sophia Blumstein noted Tennessee's Open Records Act "mandates" that "all state, county and municipal records shall be open for inspection by any citizen of this state" unless otherwise provided by state law.
"The request for the information was made by citizens of Tennessee," the opinion continues. "The State was, therefore, required to make the information open for inspection, and those in charge of the records were required to make them available since state law does not provide otherwise."
The opinion notes the HIPAA Privacy Rule generally prohibits a "covered entity" from using or disclosing "protected health information." The opinion assumes the state is a covered entity but says if the disclosed information is not "protected health information" as defined in the federal privacy rule, "there can be no HIPAA violation."
Slatery and Blumstein's opinion goes on to cite what is considered protected information. The list includes health information that relates to past, present or future physical or mental health or condition of an individual or relates to the provision of health care to an individual.
"Even assuming that the information was disclosed by a covered entity and even assuming that the information is [Protected Health Information], there is no violation of the HIPAA Privacy Rule," the opinion continues. "The Privacy Rule contains exceptions. As specifically applicable here, the Privacy Rule includes an exception that allows the disclosure of [Protection Health Information] when disclosure is 'required by law.'"
The opinion notes that a "frequently asked questions" section on the U.S. Department of Health and Human Services' website specifically addresses the issue.
It says: "[W]here a state pubic records law mandates that a coered entity disclose protected health information, the covered entity is permitted by the Privacy Rule to make the diclosure, provided the disclosure complies with and is limited to the relevant requirements of the public records law."