ARC 1315C
PUBLIC HEALTH DEPARTMENT[641]
Notice of Intended Action
Twenty-five interested persons, a governmental subdivision, an agency or association of 25 or more persons may demand an oral presentation hereon as provided in Iowa Code section 17A.4(1)“b.”
Notice is also given to the public that the Administrative Rules Review Committee may, on its own motion or on written request by any individual or group, review this proposed action under section 17A.8(6) at a regular or special meeting where the public or interested persons may be heard.
Pursuant to the authority of Iowa Code section 135.156B, the Iowa Department of Public Health hereby gives Notice of Intended Action to adopt new Chapter 206, “Iowa Health Information Network,” Iowa Administrative Code.
This proposed chapter will accomplish the following:
	●	Identify the procedure by which the Iowa Health Information Network (IHIN) policies and procedures are developed and approved with the input from workgroup members and oversight of the Executive Committee and approval of the State Board of Health.
	●	Provide the policies and procedures for monitoring participant usage and the enforcement of compliance standards.
	●	Provide the means and the process by which patients may choose to opt out of participation in the IHIN as well as the process by which patients may choose to opt back in.
	●	Provide procedures for patients to receive notice of violation of confidentiality.
	●	Provide procedures for patients to request and receive an audit report.
Any interested person may make written comments or suggestions on the proposed rules on or before February 25, 2014. Such written comments should be directed to Sarah Brooks, Department of Public Health, Lucas State Office Building, 321 E. 12th Street, Des Moines, Iowa 50319. Comments may be sent by e-mail to sarah.brooks@idph.iowa.gov.
After analysis and review of this rule making, no impact on jobs has been found.
These rules are intended to implement Iowa Code sections 135.156E(2) and 135.156E(9).
The following amendment is proposed.
	Adopt the following new 641—Chapter 206:
CHAPTER 206
IOWA HEALTH INFORMATION NETWORK
641—206.1(135) Scope and applicability. This chapter describes how the department will address issues regarding the Iowa health information network, including: the development of policies and procedures for auditing participants’ usage of the Iowa health information network and enforcing compliance with applicable standards, requirements, rules and procedures; the process by which individuals can decline to have their health information shared through the Iowa health information network; and the process by which the department will notify individuals if there has been unauthorized access to or disclosure of their protected health information through the Iowa health information network.
641—206.2(135) Definitions. For the purposes of this chapter, the following definitions shall apply:
“Advisory council” means the electronic health information advisory council established in Iowa Code section 135.156(2)“a.”
“Board” means the state board of health established in Iowa Code chapter 136.
“Breach” means breach as such term is defined in the HIPAA Privacy Rule.
“Department” means the Iowa department of public health.
“Executive committee”  means the executive committee of the electronic health information advisory council established in Iowa Code section 135.156(2)“b.”
“HIPAA” means the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and the regulations promulgated thereunder, including the Privacy Rule, the Security Rule and the Omnibus Final Rule.
“Individual” means a patient or client of a participant.
“Iowa health information network” means the health information exchange operated by the department pursuant to Iowa Code section 135.155.
“Opt out”  means to decline to have one’s health information exchanged through the Iowa health information network.
“Participant” means an authorized organization or individual that has voluntarily agreed to enter into a participation agreement to access or use the Iowa health information network.
“Participation agreement” means the agreement that is entered into between the department and a participant and prescribes the terms and conditions for access and use of the Iowa health information network.
“Privacy policies and security policies”  means the department’s rules, regulations, policies and procedures for access to and use of the Iowa health information network, as approved and amended by the executive committee and advisory council and the board, that are posted electronically on the Iowa health information network Web site or otherwise furnished to participants.
“Protected health information” means protected health information as defined in HIPAA that is created, transmitted or received by an authorized participant.
“Provider” means a person or organization that is a health care provider under HIPAA and is licensed or otherwise permitted to provide health care items and services under applicable state law.
“Security incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information available through the Iowa health information network or interference with Iowa health information network operations, including attempted and successful privacy breaches.
641—206.3(135) Policy development and governance. The department is required to develop and implement the privacy policies and security policies to protect protected health information exchanged through the Iowa health information network. The policies must be reviewed by the executive committee and advisory council and approved by the board prior to implementation. Any changes to the policies must go through the same review and approval process.
641—206.4(135) Monitoring and audit. The department shall monitor and audit participant usage of the Iowa health information network in a manner consistent with the privacy policies and security policies.
	206.4(1) The department shall enforce the privacy policies and security policies, which shall include audit and monitoring requirements for participants.
	206.4(2) Participant monitoring and audit activity requirements shall be included in the participation agreement. Participants unwilling or unable to abide by the requirements and participants that violate the policies or terms of the participation agreement may face sanctions up to and including suspension or termination of the participation agreement.
641—206.5(135) Consumer participation in the Iowa health information network. Pursuant to Iowa Code section 135.156E(2), consumers have the opportunity to opt out of participation in the Iowa health information network.
	206.5(1) The department shall explain the process and provide forms for patients to complete in order to opt out of participation in the Iowa health information network. The information shall be made available in places including, but not limited to, provider offices and on the Iowa health information network Web site.
	206.5(2) Patients who decline to have their health information shared through the Iowa health information network may later choose to have their information shared by providing verification of identity.
641—206.6(135) Security incidents, breaches.
	206.6(1) The department and all participants shall promptly investigate, respond to and report privacy breaches related to the Iowa health information network in compliance with applicable federal and state law.
	206.6(2) The department shall include in the privacy policies and security policies more detailed requirements regarding security incidents and shall develop a security incident response plan identifying the responsible parties and action steps to be taken in the event of a security incident.
641—206.7(135) Health information audit. The department shall make available upon request and on the Iowa health information network Web site a form for individuals to request an audit report showing who or what system has accessed their health information through the Iowa health information network.
	206.7(1) Individuals may request an audit report by contacting the department by:
Mail: Office of Health IT
Iowa Department of Public Health
Lucas State Office Building
321 E. 12th Street
Des Moines, Iowa 50319
Fax: (515)281-4958
E-mail: ehealth@idph.state.ia.us
The department may require proof of legal authority to view health information records.
	206.7(2) The department shall process the health information audit request and provide a response to the individual within 30 days of receipt of the request.
These rules are intended to implement Iowa Code sections 135.156E(2) and 135.156E(9).