135DIOWA HEALTH INFORMATION NETWORK135D.1Short title.This chapter shall be known and may be cited as the “Iowa Health Information Network Act”.2015 Acts, ch 73, §1, 9135D.2Definitions.As used in this chapter, unless the context otherwise requires:1“Care coordination” means the management of all aspects of a patient’s care to improve health care quality. 2“Department” means the department of health and human services.3“Designated entity” means the corporation selected by the department through a competitive process as the entity responsible for administering the Iowa health information network.4“Director” means the director of health and human services.5“Exchange” means the authorized electronic sharing of health information between health care professionals, payors, consumers, public health agencies, the designated entity, the department, and other authorized participants utilizing the Iowa health information network and Iowa health information network services.6“Exchange advisory committee” or “advisory committee” means the exchange advisory committee appointed by the director pursuant to section 135D.6.7“Health care professional” means a person who is licensed, certified, or otherwise authorized or permitted by the law of this state to administer health care in the ordinary course of business or in the practice of a profession.8“Health information” means health information as defined in 45 C.F.R. §160.103 that is created or received by an authorized participant.9“Health information technology” means the application of information processing, involving both computer hardware and software, that deals with the storage, retrieval, sharing, and use of health care information, data, and knowledge for communication, decision making, quality, safety, and efficiency of clinical practice, and may include but is not limited to:aAn electronic health record that electronically compiles and maintains health information that may be derived from multiple sources about the health status of an individual and may include a core subset of each care delivery organization’s electronic medical record such as a continuity of care record or a continuity of care document, computerized physician order entry, electronic prescribing, or clinical decision support.bA personal health record through which an individual and any other person authorized by the individual can maintain and manage the individual’s health information. cAn electronic medical record that is used by health care professionals to electronically document, monitor, and manage health care delivery within a care delivery organization, is the legal record of the patient’s encounter with the care delivery organization, and is owned by the care delivery organization. dA computerized provider order entry function that permits the electronic ordering of diagnostic and treatment services, including prescription drugs. eA decision support function to assist physicians and other health care providers in making clinical decisions by providing electronic alerts and reminders to improve compliance with best practices, promote regular screenings and other preventive practices, and facilitate diagnosis and treatments. fTools to allow for the collection, analysis, and reporting of information or data on adverse events, the quality and efficiency of care, patient satisfaction, and other health care-related performance measures. 10“Health Insurance Portability and Accountability Act” or “HIPAA” means the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, including amendments thereto and regulations promulgated thereunder.11“Hospital” means a licensed hospital as defined in section 135B.1.12“Interoperability” means the ability of two or more systems or components to exchange information or data in an accurate, effective, secure, and consistent manner and to use the information or data that has been exchanged and includes but is not limited to:aThe capacity to connect to a network for the purpose of exchanging information or data with other users.bThe ability of a connected, authenticated user to demonstrate appropriate permissions to participate in the instant transaction over the network. cThe capacity of a connected, authenticated user to access, transmit, receive, and exchange usable information with other users.13“Iowa health information network” or “network” means the statewide health information technology network that is the sole statewide network for Iowa pursuant to this chapter.14“Medicaid program” means the medical assistance program as defined in section 249A.2.15“Participant” means an authorized health care professional, payor, patient, health care organization, public health agency, or the department that has agreed to authorize, submit, access, or disclose health information through the Iowa health information network in accordance with this chapter and all applicable laws, rules, agreements, policies, and standards.16“Patient” means a person who has received or is receiving health services from a health care professional. 17“Payor” means a person who makes payments for health services, including but not limited to an insurance company, self-insured employer, government program, individual, or other purchaser that makes such payments.18“Protected health information” means protected health information as defined in 45 C.F.R. §160.103 that is created or received by an authorized participant.19“Public health activities” means actions taken by a participant in its capacity as a public health authority under the Health Insurance Portability and Accountability Act or as required or permitted by other federal or state law.20“Public health agency” means an entity that is governed by or contractually responsible to a local board of health or the department to provide services focused on the health status of population groups and their environments. 21“Record locator service” means the functionality of the Iowa health information network that queries data sources to locate and identify potential patient records.2015 Acts, ch 73, §2, 9; 2023 Acts, ch 19, §180; 2025 Acts, ch 120, §73 – 75135D.3Iowa health information network findings and intent.1The general assembly finds all of the following:aTechnology used to support health care-related functions is known as health information technology. Health information technology provides a mechanism to transform the delivery of health and medical care in Iowa and across the nation.bHealth information technology is rapidly evolving to contribute to the goals of improving the experience of care, improving the health of populations, and reducing per capita costs of health care.cA health information network involves the secure electronic sharing of health information across the boundaries of individual practice and institutional health settings and with consumers. The broad use of health information technology and a health information network should improve health care quality and the overall health of the population, increase efficiencies in administrative health care, reduce unnecessary health care costs, and help prevent medical errors.dAll health information technology efforts shall endeavor to represent the interests and meet the needs of consumers and the health care sector, protect the privacy of individuals and the confidentiality of individuals’ information, promote best practices, and make information easily accessible to the members of the patient-centered care coordination team, including but not limited to patients, providers, and payors.2It is the intent of the general assembly that the Iowa health information network shall not constitute a health benefit network or a health insurance network.2015 Acts, ch 73, §3, 9135D.4Iowa health information network principles technical infrastructure requirements.1The Iowa health information network shall be administered and governed by a designated entity using, at a minimum, the following principles:aBe patient-centered and market-driven.bComply with established national standards.cProtect the privacy of consumers and the security and confidentiality of all health information.dPromote interoperability.eIncrease the accuracy, completeness, and uniformity of data.fPreserve the choice of the patient to have the patient’s health information available through the record locator service.gProvide education to the general public and provider communities on the value and benefits of health information technology. 2Widespread adoption of health information technology is critical to a successful Iowa health information network and is best achieved when all of the following occur:aThe network, through the designated entity complying with chapters 490, 496C, and 504 and reporting as required under this chapter, operates in an entrepreneurial and businesslike manner in which it is accountable to all participants utilizing the network’s products and services.bThe network provides a variety of services from which to choose in order to best fit the needs of the user.cThe network is financed by all who benefit from the improved quality, efficiency, savings, and other benefits that result from use of health information technology.dThe network is operated with integrity and freedom from political influence.3The Iowa health information network technical infrastructure shall provide a mechanism for all of the following:aThe facilitation and support of the secure electronic exchange of health information between participants. bParticipants without an electronic health records system to access health information from the Iowa health information network.4Nothing in this chapter shall be interpreted to impede or preclude the formation and operation of regional, population-specific, or local health information networks or the participation of such networks in the Iowa health information network.2015 Acts, ch 73, §4, 9; 2025 Acts, ch 120, §76135D.5Designated entity administration and governance.1The Iowa health information network shall be administered by a designated entity selected by the department through a competitive process. The designated entity shall be established as a corporation organized under chapter 490, 496C, or 504. The designated entity shall be established for the purpose of administering the statewide Iowa health information network. Notwithstanding any provision of law to the contrary, the department shall conduct a competitive process to select a designated entity at least every eight years.2The designated entity shall collaborate with the department, but the designated entity shall not be considered, in whole or in part, an agency, department, or administrative unit of the state.aThe designated entity shall not be required to comply with any requirements that apply to a state agency, department, or administrative unit and shall not exercise any sovereign power of the state.bThe designated entity does not have authority to pledge the credit of the state. The assets and liabilities of the designated entity shall be separate from the assets and liabilities of the state and the state shall not be liable for the debts or obligations of the designated entity. All debts and obligations of the designated entity shall be payable solely from the designated entity’s funds. The state shall not guarantee any obligation of or have any obligation to the designated entity.3The articles of incorporation of the designated entity shall provide for its governance and its efficient management. In providing for its governance, the articles of the designated entity shall address the following:aA board of directors to govern the designated entity.bThe appointment of a chief executive officer by the board to manage the designated entity’s daily operations.cThe delegation of such powers and responsibilities to the chief executive officer as may be necessary for the designated entity’s efficient operation.dThe employment of personnel necessary for the efficient performance of the duties assigned to the designated entity. All such personnel shall be considered employees of a private corporation and shall be exempt from the personnel requirements imposed on state agencies, departments, and administrative units.eThe financial operations of the designated entity including the authority to receive and expend funds from public and private sources and to use its property, money, or other resources for the purpose of the designated entity.2015 Acts, ch 73, §5, 9; 2025 Acts, ch 120, §77, 78135D.6Exchange advisory committee.1The director shall appoint an exchange advisory committee.2The advisory committee shall include at least one member who is a consumer of health services, and a majority of the advisory committee members shall be representative of participants in the Iowa health information network.3The exchange advisory committee shall do all of the following:aAdvise the department regarding the needs of participants and nonparticipants relating to the exchange of health information.bEnsure the department develops, and the designated entity complies with, the standards, requirements, policies, and procedures for access to, use, secondary use, privacy, and security of health information exchanged through the Iowa health information network, consistent with applicable federal and state standards and laws.cDirect a public and private collaborative effort to promote the adoption and use of health information technology in the state to improve health care quality, increase patient safety, reduce health care costs, enhance public health, and empower individuals and health care professionals with comprehensive, real-time medical information to provide continuity of care and make the best health care decisions.dEducate the public and the health care sector about the value of health information technology in improving patient care, and methods to promote increased support and collaboration of state and local public health agencies, health care professionals, and consumers in health information technology initiatives.eWork to align interstate and intrastate interoperability standards in accordance with national health information exchange standards.fProvide an annual budget and fiscal report for the Iowa health information network to the governor, the department of health and human services, the department of management, and the general assembly. The report shall also include information about the services provided through the network and information on the participant usage of the network.2015 Acts, ch 73, §6, 9; 2023 Acts, ch 19, §181, 182; 2025 Acts, ch 120, §79135D.7Legal and policy liability confidentiality.1The designated entity shall implement industry-accepted security standards, policies, and procedures to protect the transmission and receipt of protected health information exchanged through the Iowa health information network, which shall, at a minimum, comply with HIPAA and shall include all of the following:aA secure and traceable electronic audit system to document and monitor the sender and recipient of health information exchanged through the Iowa health information network.bA required standard participation agreement which defines the minimum privacy and security obligations of all participants using the Iowa health information network and services available through the Iowa health information network. cThe opportunity for a patient to decline exchange of the patient’s health information through the record locator service of the Iowa health information network. 1A patient shall not be denied care or treatment for declining to exchange the patient’s health information, in whole or in part, through the network.2The designated entity shall provide the means and process by which a patient may decline participation. The means and process utilized shall minimize the burden on patients and health care professionals.3Unless otherwise authorized by law or rule, a patient’s decision to decline participation means that none of the patient’s health information shall be accessible through the record locator service function of the Iowa health information network. A patient’s decision to decline having health information shared through the record locator service function shall not limit a health care professional with whom the patient has or is considering a treatment relationship from sharing health information concerning the patient through the secure messaging function of the Iowa health information network.4A patient who declines participation in the Iowa health information network may later decide to have health information shared through the network. A patient who is participating in the network may later decline participation in the network.2A participant shall not be compelled by subpoena, court order, or other process of law to access health information through the Iowa health information network in order to gather records or information not created by the participant. 3A participant exchanging health information and data through the Iowa health information network shall grant to other participants of the network a nonexclusive license to retrieve and use that information in accordance with applicable state and federal laws, and the policies and standards established by the department.4A health care professional who relies reasonably and in good faith upon any health information provided through the Iowa health information network in treatment of a patient who is the subject of the health information shall be immune from criminal or civil liability arising from the damages caused by such reasonable, good-faith reliance. Such immunity shall not apply to acts or omissions constituting negligence, recklessness, or intentional misconduct. 5A participant who has disclosed health information through the Iowa health information network in compliance with applicable law and the standards, requirements, policies, procedures, and agreements of the network shall not be subject to criminal or civil liability for the use or disclosure of the health information by another participant.6The following records shall be confidential records pursuant to chapter 22, unless otherwise ordered by a court or consented to by the patient or by a person duly authorized to release such information:aThe health information contained in, stored in, submitted to, transferred or exchanged by, or released from the Iowa health information network. bAny health information in the possession of the designated entity due to the designated entity’s administration of the Iowa health information network.7Unless otherwise provided in this chapter, when sharing health information through the Iowa health information network or a private health information network maintained in this state that complies with the privacy and security requirements of this chapter for the purposes of patient treatment, payment or health care operations, as such terms are defined in HIPAA, or for the purposes of public health activities or care coordination, a participant authorized by the designated entity to use the record locator service is exempt from any other state law that is more restrictive than HIPAA that would otherwise prevent or hinder the exchange of patient information by the participant. 8A patient aggrieved or adversely affected by the designated entity’s failure to comply with subsection 1, paragraph “c”, may bring a civil action for equitable relief as the court deems appropriate.2015 Acts, ch 73, §7, 9; 2025 Acts, ch 120, §80 – 83