House Amendment to Senate Amendment to House File 1028 S-5152 Amend the Senate amendment, H-1343, to House File 1028, as 1 amended, passed, and reprinted by the House, as follows: 2 1. By striking page 1, line 1, through page 14, line 3, and 3 inserting: 4 < Amend House File 1028, as amended, passed, and reprinted by 5 the House, as follows: 6 1. By striking everything after the enacting clause and 7 inserting: 8 < Section 1. Section 8.39, subsection 2, Code 2026, is 9 amended to read as follows: 10 2. If the appropriation of a department, institution, 11 or agency is insufficient to properly meet the legitimate 12 expenses of the department, institution, or agency, the 13 director of the department of management , with the approval 14 of the governor, may make an interdepartmental transfer from 15 any other department, institution, or agency of the state 16 having an appropriation in excess of its needs, of sufficient 17 funds moneys to meet that deficiency. Such transfer shall 18 be to an appropriation made from the same funding source and 19 within the same fiscal year. The amount of a transfer made 20 from an appropriation under this subsection shall be limited 21 to not more than one-tenth of one percent of the total of all 22 appropriations made from the funding source of the transferred 23 appropriation for the fiscal year in which the transfer is 24 made. An interdepartmental transfer to an appropriation which 25 is not an entitlement appropriation is not authorized when 26 the general assembly is in regular session and, in addition, 27 the sum of interdepartmental transfers in a fiscal year to 28 an appropriation which is not an entitlement appropriation 29 shall not exceed fifty one hundred percent of the amount of 30 the appropriation as enacted by the general assembly. For the 31 purposes of this subsection , an entitlement appropriation is : 32 a. “Appropriation in excess of its needs” means the 33 amount appropriated by the general assembly for a purpose is 34 determined by the department, institution, or agency receiving 35 -1- H 1343.3758.H (1) 91 md 1/ 15 #1.

the appropriation to be more than the amount necessary to carry 1 out that purpose. An appropriation for an unspecified dollar 2 amount, whether the appropriation is limited to be sufficient 3 to carry out a particular purpose or is unlimited, shall not 4 be considered an appropriation in excess of a department’s, 5 institution’s, or agency’s needs. 6 b. “Entitlement appropriation” means a line item 7 appropriation to the state public defender for indigent defense 8 or to the department of health and human services for foster 9 care, state supplementary assistance, medical assistance, or 10 for the family investment program. 11 Sec. 2. Section 8.57C, subsections 2, 3, and 4, Code 2026, 12 are amended to read as follows: 13 2. Moneys in the fund in a fiscal year shall be used as 14 appropriated by the general assembly for the acquisition 15 of computer hardware and software, software development, 16 telecommunications equipment, and maintenance and lease 17 agreements associated with technology components and for the 18 purchase of equipment intended to provide an uninterruptible 19 power supply to the department of management to provide 20 a stable funding source for implementation costs of state 21 information technology projects that enhance the state’s 22 technology infrastructure, improve government services, 23 and promote innovation and economic development, including 24 but not limited to new information technology projects 25 and infrastructure replacement efforts of a department or 26 establishment, while protecting the privacy of residents of 27 this state . 28 3. a. There is appropriated from the general fund of the 29 state to the technology reinvestment fund for the fiscal year 30 beginning July 1, 2026, and for each fiscal year thereafter, 31 the sum of seventeen million five hundred thousand dollars. 32 b. There is appropriated from the rebuild Iowa 33 infrastructure fund for the fiscal year beginning July 1, 2025, 34 and ending June 30, 2026, the sum of eighteen million two 35 -2- H 1343.3758.H (1) 91 md 2/ 15

hundred sixty-nine thousand two hundred seventeen dollars to 1 the technology reinvestment fund, notwithstanding section 8.57, 2 subsection 3 , paragraph “c” . 3 3. a. The department of management shall prioritize 4 proposed projects based on all of the following considerations: 5 (1) Whether the project aligns with the state’s strategic 6 priorities. 7 (2) Whether the project promotes or introduces new 8 technology or significantly improves an existing system. 9 (3) Whether the project is feasible and whether the 10 department or establishment has established readiness for the 11 project to proceed, including a clear assessment of timelines, 12 budgets, and measurable outcomes. 13 (4) Whether the project includes a clear change management 14 strategy to support user adoption and aligns with lean 15 enterprise principles to maximize value, minimize waste, and 16 ensure continuous improvement. 17 (5) Whether the project provides a positive return on 18 investment, considering both financial returns and nonfinancial 19 benefits such as improved public safety, education, or health 20 care. 21 (6) Whether the project results in infrastructure that is 22 scalable across the state enterprise. 23 (7) Whether the department or establishment has identified 24 how the completed project will be sustained beyond the initial 25 funding period. 26 (8) Whether the project improves access to governmental 27 services, particularly in rural communities. 28 (9) Whether the project involves an infrastructure project 29 as opposed to maintenance or standard upgrades of existing 30 technology. 31 b. The department of management shall provide a prioritized 32 list of proposed projects for funding to the governor, who 33 shall use the list in developing a budgetary recommendation 34 for the general assembly pursuant to section 8.21 for the 35 -3- H 1343.3758.H (1) 91 md 3/ 15

fiscal year beginning July 1, 2027, and for each fiscal year 1 thereafter. 2 c. Notwithstanding section 8.33, moneys in the technology 3 reinvestment fund that remain unencumbered or unobligated at 4 the close of a fiscal year shall not revert but shall remain 5 available for expenditure for the purposes designated until 6 the close of the fiscal year that ends two years after the 7 end of the fiscal year for which the appropriation was made. 8 Notwithstanding section 12C.7, subsection 2, interest or 9 earnings on moneys in the fund shall be credited to the fund. 10 4. Annually, on On or before January 15 of each year, a 11 state agency that received an appropriation from this fund 12 the department of management shall report to the legislative 13 services agency and the department of management general 14 assembly the status of all projects funded under this section 15 that have been completed since the previous report was 16 submitted or that are in progress. The report shall must 17 include a description of the project, the progress of work 18 completed, the total estimated cost of the project, a list of 19 all revenue sources being used to fund the project, the amount 20 of funds moneys expended, the amount of funds moneys obligated, 21 and the date the project was completed or an estimated 22 completion date of the project, where applicable. 23 Sec. 3. Section 8.78, Code 2026, is amended to read as 24 follows: 25 8.78 Background checks. 26 An applicant for employment with the department, or 27 an applicant for employment with a supported entity for a 28 position as information technology staff, may be subject to a 29 background investigation by the department. The background 30 investigation may include, without limitation, a work history, 31 financial review, request for criminal history data, and 32 national criminal history check through the federal bureau of 33 investigation. In addition, a contractor, vendor, employee, or 34 any other individual performing work for the department, or an 35 -4- H 1343.3758.H (1) 91 md 4/ 15

individual on the information technology staff of a supported 1 entity, may be subject to a national criminal history check 2 through the federal bureau of investigation at least once 3 every ten five years, including, without limitation, any time 4 the department or supported entity has reason to believe an 5 individual has been convicted of a crime. The department may 6 request the national criminal history check and, if requested, 7 shall provide the individual’s fingerprints to the department 8 of public safety for submission through the state criminal 9 history repository to the federal bureau of investigation. 10 The individual shall authorize release of the results of the 11 national criminal history check to the department and the 12 applicable supported entity. The department shall pay the 13 actual cost of the fingerprinting and national criminal history 14 check, if any, unless otherwise agreed as part of a contract 15 between the department or supported entity and a vendor or 16 contractor performing work for the department or supported 17 entity. The results of a criminal history check conducted 18 pursuant to this section shall not be considered a public 19 record under chapter 22 . 20 Sec. 4. NEW SECTION . 8.94 Contracts —— prohibited terms. 21 Provisions included in a contract entered into pursuant to 22 this subchapter that impose terms or conditions prohibited by 23 this section are void as contrary to public policy. Such a 24 contract shall be interpreted and enforced as if the contract 25 did not include the prohibited terms or conditions. Prohibited 26 terms and conditions include all of the following: 27 1. A provision requiring the department or a supported 28 entity to defend, indemnify, hold harmless another person, or 29 otherwise assume the debt or liability of another person in 30 violation of Article VII, section 1, of the Constitution of the 31 State of Iowa. 32 2. A provision that seeks to impose a term that is unknown 33 to the department or supported entity at the time of signing 34 the contract or that can be unilaterally changed by an entity 35 -5- H 1343.3758.H (1) 91 md 5/ 15

other than the department or a supported entity. 1 3. A provision that violates chapter 13 by not allowing 2 the department or a supported entity to participate in its own 3 defense through representation by the attorney general. 4 4. A provision that grants to a person other than the 5 attorney general the authority to convey to a court or litigant 6 the state’s consent to any settlement of a suit involving the 7 contract when such settlement could impose liability on the 8 state. 9 5. A provision that specifies that the contract is governed 10 by the laws of a foreign state or nation. 11 6. A provision that claims blanket confidentiality of the 12 contract’s terms. 13 7. A provision that claims that payment terms, including but 14 not limited to cost proposals or other pricing information, of 15 the contract are confidential. 16 8. A provision that authorizes or requires a venue for 17 litigation other than an appropriate state or federal court 18 sitting in Iowa. 19 9. A provision that requires the department or a supported 20 entity to pay attorney fees, court costs, or other litigation 21 expenses in the event of a contractual dispute. 22 10. A provision that imposes on the department or a 23 supported entity binding arbitration or any other binding 24 extrajudicial dispute resolution process in which the final 25 resolution is not determined by the state. 26 11. A provision that waives the department’s or a supported 27 entity’s right to a jury trial. 28 12. A provision that obligates the department or a supported 29 entity to pay late payment charges not consistent with section 30 8A.514, interest greater than allowed under section 8A.514 or 31 other applicable law, or any cancellation charges, as such 32 charges constitute pledges of the state’s credit. 33 13. A provision that obligates the department or a supported 34 entity to pay a tax. 35 -6- H 1343.3758.H (1) 91 md 6/ 15

14. A provision that imposes a prior notice obligation 1 on the department or a supported entity as a condition for 2 the automatic renewal of a software license. The department 3 or a supported entity may provide notice of its intent to 4 terminate a software license at any time before the renewal 5 date established in the contract. 6 15. A provision that obligates the department or a supported 7 entity to accept risk of loss before the receipt of items or 8 goods. 9 16. A provision that obligates the department or a supported 10 entity to have commercial insurance. 11 17. A provision that obligates the department or a supported 12 entity to grant to a nongovernmental entity full or partial 13 ownership of intellectual property developed pursuant to the 14 contract when the intellectual property is developed in whole 15 or in part using federal funding. 16 18. A provision that limits the time in which the department 17 or a supported entity may bring a legal claim under the 18 contract to a period shorter than that provided in Iowa law. 19 19. A boilerplate provision included in transactional 20 documents received by the department or a supported entity that 21 seeks to alter the terms of the contract or to impose new terms 22 in the contract. 23 Sec. 5. NEW SECTION . 8.95 Contracts —— required terms. 24 All of the following provisions shall be deemed to be 25 included in a contract entered into by the department or a 26 supported entity under this subchapter: 27 1. Governing law. The contract shall be governed by 28 the laws of the state of Iowa, without giving effect to any 29 conflicts of law principles of Iowa law that may require the 30 application of another jurisdiction’s law. 31 2. Venue. Any litigation commenced in connection with the 32 contract shall be brought and maintained in an appropriate 33 state or federal court sitting in Iowa. 34 3. State data. “State data” means all data, records, 35 -7- H 1343.3758.H (1) 91 md 7/ 15

information, or content, in any form, that is provided by a 1 state governmental entity to a vendor or that is collected, 2 generated, or otherwise obtained by the vendor in the course of 3 providing a good or service to the state governmental entity. 4 “State data” does not include aggregated or deidentified data 5 collected by the vendor and used exclusively for the vendor’s 6 internal purposes directly related to evaluating or improving 7 system performance, ensuring reliability, evaluating product 8 functionality, conducting system analytics, projecting needs 9 through capacity planning, ensuring license compliance, or 10 evaluating security. State data shall at all times remain the 11 sole and exclusive property of the state, and the vendor shall 12 use state data only as necessary to provide the contracted 13 services to the state. Upon request, the vendor shall provide 14 the state, at no cost, a current copy of all state data in a 15 commercially reasonable and state-acceptable digital format 16 that enables the state to readily use, transfer, or migrate 17 the state data. Except to the extent retention of state data 18 is required by law, grant, or other governmental requirement, 19 the vendor shall, after confirming that the state has received 20 a copy of the state data, permanently delete all state data 21 within a commercially reasonable period of time after the 22 conclusion or termination of the contract. At all times, 23 including any post-contract period in which state data is 24 retained due to record retention obligations, the vendor shall 25 protect state data in accordance with current state data 26 protection policies. 27 Sec. 6. NEW SECTION . 8.96 Contracts —— limitation of 28 liability —— prohibited terms. 29 Notwithstanding section 8A.311, subsection 22, and rules 30 adopted pursuant to that subsection, the director may include 31 a contractual limitation of vendor liability in information 32 technology goods and services contracts. A contractual 33 limitation of vendor liability must take into consideration the 34 public interest and the mitigation of risks associated with the 35 -8- H 1343.3758.H (1) 91 md 8/ 15

use of information technology goods or services. Any portion 1 of a contractual limitation of vendor liability that includes 2 a repudiation of all liability for cybersecurity incidents or 3 a limitation on the vendor’s liability for intentional torts, 4 criminal acts, fraudulent conduct, intentional or willful 5 misconduct, gross negligence, death, bodily injury, damage to 6 real or personal property, intellectual property violations, 7 liquidated damages, compliance with applicable laws, violations 8 of confidential information obligations, or contractual 9 obligations of the vendor pertaining to indemnification shall 10 be void as a matter of law as contrary to public policy. A 11 contractual limit of vendor liability that does not apply 12 equally to the contracted parties or that limits a vendor’s 13 liability to less than the contract value inclusive of all 14 possible extensions is void as a matter of law as contrary to 15 public policy. 16 Sec. 7. NEW SECTION . 8.97 Confidentiality of communications 17 with chief information security officer. 18 In the interest of facilitating communication between 19 the chief information security officer and other entities 20 concerning security incidents and security breaches, all such 21 communications and any documents generated based in whole or in 22 part on such communications are confidential. Notwithstanding 23 chapter 22 or any other provision of law to the contrary, the 24 department shall not release such communications pursuant to 25 state open records laws, and such communications shall not be 26 received into evidence, subject to discovery, or otherwise 27 used in a trial, hearing, or other proceeding in or before any 28 court, regulatory body, or other authority of the state or a 29 political subdivision of the state, unless the communications 30 are subject to a protective order that prohibits further 31 disclosure of such communications and requires any court 32 filings of such communications to be made under seal. It is 33 the intent of the general assembly that these prohibitions and 34 restrictions also apply to federal courts, regulatory bodies, 35 -9- H 1343.3758.H (1) 91 md 9/ 15

and other authorities and for purposes of federal open records 1 laws, to the extent allowed by federal law and court rules. 2 The chief information security officer shall not release such 3 communications other than for any of the following purposes: 4 1. Identifying a cybersecurity threat, including the source 5 of the cybersecurity threat, or a security vulnerability, and 6 then only to government officials for purposes of addressing 7 the threat. 8 2. Responding to, or otherwise preventing or mitigating, 9 a specific threat of death, serious bodily harm, or serious 10 economic harm. 11 3. Responding to, investigating, prosecuting, or otherwise 12 preventing or mitigating a serious threat to a minor, including 13 sexual exploitation and threats to physical safety. 14 4. Preventing, investigating, disrupting, or prosecuting an 15 offense under state or federal law. 16 5. Providing a confidential cybersecurity briefing to the 17 governor or a member of the general assembly. 18 Sec. 8. NEW SECTION . 8.98 Criminal justice information. 19 1. The department is authorized to maintain an integrated 20 information system that enables automated data sharing among 21 the executive branch, judicial branch, and local agencies. 22 2. The department is designated as the Iowa statistical 23 analysis center for the purpose of coordinating with data 24 resource agencies to provide data and analytical information 25 to federal, state, and local governments. Notwithstanding any 26 other provision of state law to the contrary, unless prohibited 27 by federal law or regulation, the department shall be granted 28 access, for purposes of research and evaluation, to all of 29 the data listed in this subsection, except that intelligence 30 data and peace officer investigative reports maintained 31 by the department of public safety shall not be considered 32 data for the purposes of this section. The department of 33 management and any record, data, or information obtained by the 34 department under this subsection is subject to the federal and 35 -10- H 1343.3758.H (1) 91 md 10/ 15

state confidentiality laws and rules, including as described 1 in chapter 22, applicable to the original record, data, or 2 information, and to the original custodian of the record, 3 data, or information. Authorized access under this subsection 4 includes but is not limited to all of the following: 5 a. Juvenile court records and all other information 6 maintained under sections 232.147 through 232.151. 7 b. Child abuse information under sections 235A.15 through 8 235A.19. 9 c. Dependent adult abuse records maintained under chapter 10 235B. 11 d. Criminal history data maintained under chapter 692. 12 e. Sex offender registry information maintained under 13 chapter 692A. 14 f. Presentence investigation reports maintained under 15 section 901.4. 16 g. Corrections records maintained under sections 904.601 and 17 904.602. 18 h. Community-based correctional program records maintained 19 under chapter 904. 20 i. Parole records maintained under chapter 906. 21 j. Deferred judgment, deferred or suspended sentence, and 22 probation records maintained under chapter 907. 23 k. Violation of parole or probation records maintained under 24 chapter 908. 25 l. Fine and victim restitution records maintained under 26 chapters 909 and 910. 27 m. Child welfare records maintained under chapter 235. 28 3. The department is authorized to provide data analysis and 29 reporting on issues that may affect the state’s correctional 30 population and various subgroups of the population. This 31 reporting may include the review of filed, public legislative 32 bills, joint resolutions, and amendments, and compiling 33 criminal justice data for completion of correctional impact 34 statements under section 2.56, minority impact statements, and 35 -11- H 1343.3758.H (1) 91 md 11/ 15

an annual prison population forecast. 1 4. The department is authorized to maintain a multiagency 2 information system to track the progress of juveniles and 3 adults who have been charged with a criminal offense in 4 the court system through various state and local agencies 5 and programs. This system must utilize existing databases, 6 including the Iowa court information system, the Iowa 7 corrections offender network, the child welfare information 8 system of the department of health and human services, 9 the federally mandated national adoption and foster care 10 information system, and other state and local databases 11 pertaining to juveniles and to adults who have been charged 12 with a criminal offense in the court system, to the extent 13 practicable. 14 5. The multiagency information system is authorized to 15 count and track decision points for juveniles in the juvenile 16 justice system and minors in the child welfare system, evaluate 17 the experiences of the juveniles and minors, and evaluate 18 the success of the services provided. The system is also 19 authorized to count and track decision points for adults who 20 have been charged with a criminal offense in the court system, 21 including but not limited to dismissed charges, convictions, 22 deferred judgments, and sentence information. 23 6. If the department has insufficient moneys or resources 24 to implement this section, the department is authorized to 25 determine which portion of this section may be implemented, if 26 any, and the remainder of this section shall not apply. 27 Sec. 9. NEW SECTION . 8.99 Confidentiality of data. 28 1. For purposes of chapter 22, the department shall not be 29 deemed to be the lawful custodian of records the department 30 maintains for another department or establishment under this 31 subchapter, to the extent the records in question are held 32 by the department as an automated data processing unit of 33 government or held by the department solely for storage for 34 another department or establishment. Such records include but 35 -12- H 1343.3758.H (1) 91 md 12/ 15

are not limited to all of the following: 1 a. Electronic messaging system data. 2 b. Mainframe data. 3 c. Storage solutions or other electronic information, such 4 as on-premises server data storage and cloud data storage. 5 2. If the department receives a request pursuant to chapter 6 22 for records over which the department has determined it is 7 not the lawful custodian, the department shall deny the request 8 and inform the requester to seek the information from the 9 lawful custodian as provided in chapter 22. The department’s 10 determination that it is not the lawful custodian of records is 11 presumed valid. The presumption may be rebutted by clear and 12 convincing evidence to the contrary. 13 3. The department shall provide assistance to the lawful 14 custodian of records held by the department so that the lawful 15 custodian can comply with the production obligations of chapter 16 22. 17 4. If the department receives a subpoena in an 18 administrative, civil, or criminal case for records for which 19 the department is not the lawful custodian, the department 20 shall notify the lawful custodian and the attorney general’s 21 office and cooperate in any efforts to resist the subpoena. 22 Sec. 10. Section 216A.131A, Code 2026, is amended to read 23 as follows: 24 216A.131A Criminal and juvenile justice planning. 25 The department shall fulfill the responsibilities of 26 this subchapter , including the duties specified in sections 27 216A.133, 216A.135, 216A.136 , 216A.137 , 216A.138 , and 216A.140 . 28 Sec. 11. Section 216A.133, subsection 1, paragraphs d, e, f, 29 l, and t, Code 2026, are amended by striking the paragraphs. 30 Sec. 12. Section 216A.133, subsection 1, paragraph q, 31 subparagraphs (1) and (6), Code 2026, are amended by striking 32 the subparagraphs. 33 Sec. 13. Section 216A.133, subsection 1, paragraph s, Code 34 2026, is amended to read as follows: 35 -13- H 1343.3758.H (1) 91 md 13/ 15

s. Provide expertise and advice to the legislative 1 services agency, the department of management, the department 2 of corrections, the judicial branch, and others charged 3 with formulating fiscal, correctional, or minority impact 4 statements. 5 Sec. 14. Section 216A.135, subsection 2, paragraph e, Code 6 2026, is amended by striking the paragraph. 7 Sec. 15. Section 232.147, subsection 2, paragraph i, Code 8 2026, is amended to read as follows: 9 i. The statistical analysis center for the purposes stated 10 in section 216A.136 8.98 . 11 Sec. 16. Section 232.147, subsection 3, paragraph n, Code 12 2026, is amended to read as follows: 13 n. The statistical analysis center for the purposes stated 14 in section 216A.136 8.98 . 15 Sec. 17. Section 232.147, subsection 4, paragraph i, Code 16 2026, is amended to read as follows: 17 i. The statistical analysis center for the purposes stated 18 in section 216A.136 8.98 . 19 Sec. 18. Section 232.149, subsection 5, paragraph f, Code 20 2026, is amended to read as follows: 21 f. The statistical analysis center for the purposes stated 22 in section 216A.136 8.98 . 23 Sec. 19. Section 232.149A, subsection 3, paragraph m, Code 24 2026, is amended to read as follows: 25 m. The statistical analysis center for the purposes stated 26 in section 216A.136 8.98 . 27 Sec. 20. REPEAL. Sections 216A.136, 216A.137, and 28 216A.138, Code 2026, are repealed. 29 Sec. 21. EFFECTIVE DATE. The following take effect July 1, 30 2027: 31 The portions of the section of this Act amending section 32 8.57C, subsections 2 and 4. 33 Sec. 22. APPLICABILITY. The following apply to contracts 34 entered into or renewed on or after July 1, 2026: 35 -14- H 1343.3758.H (1) 91 md 14/ 15