Texas: New safeguards to protect sensitive information

30

Healthcare Alert

By:

As fiscal year reporting deadlines approach, organizations doing business in the State of Texas should be aware of new amendments to the Texas Public Information Act (PIA) that  will become effective January 1, 2020.  The changes will apply to information that may be filed with state or local governmental entities for economic development, contracting and procurement, periodic reporting, or other purposes.

The PIA requires state and local governmental units, which may include advisory boards and other subordinate bodies (collectively, agencies), to release information within their possession to any member of the public who requests it.  This includes information that was received by outside parties and private entities.

An agency may object to the release of certain  information pursuant to privacy or confidentiality laws, but those objections are generally waived if the agency fails to file a timely objection.   Once information has been released to anyone under the PIA, it remains public for everyone.   

When an agency possesses sensitive information that has been submitted by a business organization, whether through regulatory reports, bid responses, or contracting obligations, the agency must notify the business of any public requests for that information.  The organization may object to the disclosure of such information by submitting timely objections to the Office of Attorney General, and the Office issues a ruling as to whether the information must be released.

Businesses sometimes prevent the release of sensitive information by asserting that the information relates to competition or bidding and its disclosure to competitors would harm the organization in ongoing and future procurements.  Organizations also commonly object to the release of trade secrets, as defined by a 1939 comment to the Restatement of Torts.

The new PIA amendments will change the grounds upon which organizations may object to the disclosure of their sensitive information.   The Act now defines a category of “contracting information,” which is presumptively public.  Contracting information includes pricing terms, items or services provided, service and delivery deadlines, remedies, identification of subcontractors, and performance reports.

The following changes will also occur:

  • Under current law, an agency is not required to produce information that is not within its custody or control.The new law will require agencies to request the relevant information from their third-party vendors if the contract has a stated or actual expenditure of at least $1 million for goods or services.The vendor will be required by contract to retain all contracting information during the agency’s retention period and to promptly produce such information upon request.
  • Agencies generally may terminate the contracts of third-party vendors who refuse to comply with such documentation requests.Agencies are also generally prohibited from awarding any new contracts to vendors that have knowingly or intentionally failed to comply with prior PIA requests.
  • Third parties will no longer be authorized to object on the basis that their information is related to competition or bidding.Under the new law, only a governmental agency may raise this exception.Moreover, the test for protecting the information has changed to require a showing of actual or threatened harm in a particular bidding situation, rather than an assertion of future potential harm.
  • The amendments create a new exception for “proprietary information,” which can only be asserted by the business organization.This new exception protects information that would reveal an individual approach to work, organizational structure, staffing, internal operations, processes, discounts or other pricing methodology, or information that would give advantage to a competitor.This new exception does not protect information regarding the receipt or expenditure of public funds by an agency or communications between the agency and a vendor regarding the performance of a contract.
  • The term “trade secret” has been defined to include a broad range of business information that the owner has taken reasonable measures to keep secret and that derives independent actual or potential economic value from not being generally known and not readily ascertainable by another person who can obtain economic value from the information.This definition is arguably broader than the Restatement of Torts definition, but it only applies to information submitted in response to a request for bid, proposal, or qualification.

Because the amendments have substantially redefined “trade secret” and “proprietary information,” it remains unclear how the Office of Attorney General will assess future requests to withhold sensitive information. There is no precedent by which third parties can assess their potential risk exposure. 

Nevertheless, organizations can implement certain safeguards to help mitigate the possibility of disclosure.  Organizations should consider conducting legal reviews of any planned submissions to governmental entities.  Although such submissions may not normally warrant high-level review, it may be beneficial to enlist in-house or other counsel to ensure that the information provided is not overbroad and has been tailored to the specific reporting requirements.

If certain sensitive information must be provided, the organization should clearly mark each page containing such information as “proprietary information,” “trade secret,” “commercial information,” and “financial information,” as applicable.  The organization must be able to demonstrate that it took reasonable measures to keep the information secret, and it will be difficult to establish that fact if the information has not been marked.

If the governmental agency requires sensitive information that is not directly relevant to performance of the contract, it may be worthwhile to reassess the requirements.  It may possible to renegotiate any overbroad requests in light of the new law.

Find out more about the implications of the new guidance for your healthcare business by contacting the author.