H.F. 2283 Section 1. Section 135.154, Code 2011, is amended by adding 1 the following new subsections: 2 NEW SUBSECTION . 01. “Advisory council” means the electronic 3 health information advisory council created in section 135.156. 4 NEW SUBSECTION . 001. “Authorized” means having met the 5 requirements as a participant for access to and use of the Iowa 6 health information network. 7 NEW SUBSECTION . 2A. “Exchange” means the authorized 8 electronic sharing of health information between health care 9 professionals, payors, consumers, public health agencies, the 10 department, and other authorized participants utilizing the 11 Iowa health information network and Iowa health information 12 network services. 13 NEW SUBSECTION . 2B. “Executive committee” means the 14 executive committee of the electronic health information 15 advisory council created in section 135.156. 16 NEW SUBSECTION . 3A. “Health information” means any 17 information, in any form or medium, that is created, 18 transmitted, or received by a health care professional, payor, 19 consumer, public health agency, the department, or other 20 authorized participant, which relates to the past, present, or 21 future physical or mental health or condition of an individual; 22 the provision of health care to an individual; or the past, 23 present, or future payment for the provision of health care to 24 an individual. 25 NEW SUBSECTION . 4A. “Health Insurance Portability and 26 Accountability Act” means the federal Health Insurance 27 Portability and Accountability Act of 1996, Pub. L. No. 28 104-191, including amendments thereto and regulations 29 promulgated thereunder. 30 NEW SUBSECTION . 5A. “Iowa health information network” or 31 “network” means the statewide health information technology 32 network created in this division. 33 NEW SUBSECTION . 5B. “Iowa Medicaid enterprise” means the 34 Iowa Medicaid enterprise as defined in section 249J.3. 35 -1- LSB 5257HV (3) 84 pf/nh 1/ 15

H.F. 2283 NEW SUBSECTION . 5C. “Participant” means an authorized 1 health care professional, payor, patient, health care 2 organization, public health agency, or the department that 3 has agreed to authorize, submit, access, or disclose health 4 information through the Iowa health information network in 5 accordance with this chapter and all applicable laws, rules, 6 agreements, policies, and standards. 7 NEW SUBSECTION . 5D. “Patient” means a person who has 8 received or is receiving health services from a health care 9 professional. 10 NEW SUBSECTION . 5E. “Payor” means a person who makes 11 payments for health services, including but not limited to an 12 insurance company, self-insured employer, government program, 13 individual, or other purchaser that makes such payments. 14 NEW SUBSECTION . 5F. “Protected health information” means 15 individually identifiable health information which is created, 16 transmitted, or received by a participant. “Protected health 17 information” does not include education or other records that 18 are covered under the federal Family Educational Rights and 19 Privacy Act of 1974, as codified at 20 U.S.C. § 1232g, as 20 amended; or any employment records maintained by a covered 21 entity, as defined under the Health Insurance Portability and 22 Accountability Act, in its role as an employer. 23 NEW SUBSECTION . 5G. “Public health agency” means an 24 entity that is governed by or contractually responsible to a 25 local board of health or the department to provide services 26 focused on the health status of population groups and their 27 environments. 28 NEW SUBSECTION . 5H. “Purchaser” means any individual, 29 employer, or organization that purchases health insurance or 30 services and includes intermediaries. 31 Sec. 2. Section 135.155, subsection 2, unnumbered paragraph 32 1, Code 2011, is amended to read as follows: 33 To be effective, the Iowa health information technology 34 system network shall comply with all of the following 35 -2- LSB 5257HV (3) 84 pf/nh 2/ 15

H.F. 2283 principles: 1 Sec. 3. Section 135.155, subsection 3, Code 2011, is amended 2 to read as follows: 3 3. Widespread adoption of health information technology is 4 critical to a successful Iowa health information technology 5 system network and is best achieved when all of the following 6 occur: 7 a. The market provides a variety of certified products from 8 which to choose in order to best fit the needs of the user. 9 b. The system network provides incentives for health care 10 professionals to utilize the health information technology and 11 provides rewards for any improvement in quality and efficiency 12 resulting from such utilization. 13 c. The system network provides protocols to address critical 14 problems. 15 d. The system network is financed by all who benefit from 16 the improved quality, efficiency, savings, and other benefits 17 that result from use of health information technology. 18 Sec. 4. NEW SECTION . 135.155A Findings and intent —— Iowa 19 health information network. 20 1. The general assembly finds all of the following: 21 a. Technology used to support health care-related functions 22 is known as health information technology. Health information 23 technology provides a mechanism to transform the delivery of 24 health and medical care in Iowa and across the nation. 25 b. A health information network involves the secure 26 electronic sharing of health information across the boundaries 27 of individual practice and institutional health settings and 28 with consumers. Broad use of health information technology and 29 a health information network should improve health care quality 30 and the overall health of the population, increase efficiencies 31 in administrative health care, reduce unnecessary health care 32 costs, and help prevent medical errors. 33 2. It is the intent of the general assembly that Iowa 34 establish a statewide health information technology network. 35 -3- LSB 5257HV (3) 84 pf/nh 3/ 15

H.F. 2283 The Iowa health information network shall not constitute a 1 health benefit network or a health insurance network. Nothing 2 in this division shall be interpreted to impede or preclude the 3 formation and operation of regional, population-specific, or 4 local health information networks or their participation in the 5 Iowa health information network. 6 Sec. 5. Section 135.156, subsection 1, paragraphs a and b, 7 Code Supplement 2011, are amended to read as follows: 8 a. The department shall direct a public and private 9 collaborative effort to promote the adoption and use of health 10 information technology in this state in order to improve 11 health care quality, increase patient safety, reduce health 12 care costs, enhance public health, and empower individuals 13 and health care professionals with comprehensive, real-time 14 medical information to provide continuity of care and make 15 the best health care decisions. The department shall provide 16 coordination for the development and implementation of an 17 interoperable electronic health records system, telehealth 18 expansion efforts, the health information technology 19 infrastructure, the Iowa health information network, and other 20 health information technology initiatives in this state. 21 The department shall be guided by the principles and goals 22 specified in section 135.155 and the findings and intent 23 specified for an Iowa health information network in section 24 135.155A . 25 b. All health information technology efforts shall endeavor 26 to represent the interests and meet the needs of consumers and 27 the health care sector, protect the privacy of individuals 28 and the confidentiality of individuals’ information, promote 29 physician best practices, and make information easily 30 accessible to the appropriate parties. The system network 31 developed shall be consumer-driven, flexible, and expandable. 32 Sec. 6. Section 135.156, subsection 2, paragraph a, Code 33 Supplement 2011, is amended to read as follows: 34 a. An electronic health information advisory council is 35 -4- LSB 5257HV (3) 84 pf/nh 4/ 15

H.F. 2283 established which shall consist of the representatives of 1 entities involved in the electronic health records system task 2 force established pursuant to section 217.41A , Code 2007, a 3 pharmacist, a licensed practicing physician, a consumer who 4 is a member of the state board of health, a representative 5 of the state’s Medicare quality improvement organization, 6 the executive director of the Iowa communications network, a 7 representative of the private telecommunications industry, a 8 representative of the Iowa collaborative safety net provider 9 network created in section 135.153 , a nurse informaticist from 10 the university of Iowa, and any other members the department 11 or executive committee of the advisory council determines 12 necessary and appoints to assist the department or executive 13 committee at various stages of development of the electronic 14 Iowa health information system network . Executive branch 15 agencies shall also be included as necessary to assist in the 16 duties of the department and the executive committee. Public 17 members of the advisory council shall receive reimbursement 18 for actual expenses incurred while serving in their official 19 capacity only if they are not eligible for reimbursement by 20 the organization that they represent. Any legislative members 21 shall be paid the per diem and expenses specified in section 22 2.10 . 23 Sec. 7. Section 135.156, subsection 3, paragraph a, 24 subparagraphs (6) and (10), Code Supplement 2011, are amended 25 to read as follows: 26 (6) Policies relating to governance of the various facets of 27 the Iowa health information technology system network . 28 (10) Economic incentives and support to facilitate 29 participation in an interoperable system network by health care 30 professionals. 31 Sec. 8. Section 135.156, subsection 3, paragraph c, 32 unnumbered paragraph 1, Code Supplement 2011, is amended to 33 read as follows: 34 Coordinate public and private efforts to provide the 35 -5- LSB 5257HV (3) 84 pf/nh 5/ 15

H.F. 2283 network backbone infrastructure for the Iowa health information 1 technology system network . In coordinating these efforts, the 2 executive committee shall do all of the following: 3 Sec. 9. Section 135.156, subsection 3, paragraphs h and i, 4 Code Supplement 2011, are amended to read as follows: 5 h. Seek and apply for any federal or private funding to 6 assist in the implementation and support of the Iowa health 7 information technology system network and make recommendations 8 for funding mechanisms for the ongoing development and 9 maintenance costs of the Iowa health information technology 10 system network . 11 i. Identify state laws and rules that present barriers 12 to the development of the Iowa health information technology 13 system network and recommend any changes to the governor and 14 the general assembly. 15 Sec. 10. NEW SECTION . 135.156A Iowa health information 16 network —— business and financial sustainability plan and 17 participant fees. 18 1. The board, with the support of the department and 19 the advice of the executive committee and advisory council, 20 shall establish and annually review and update a business and 21 financial sustainability plan for the Iowa health information 22 network. The plan shall include fees to be paid to the 23 department by participants who choose to access and use the 24 Iowa health information network. The participant fee schedule 25 shall be structured using fair share, value-based principles. 26 2. The department shall update and submit a financial model, 27 including fee schedule, revenue and expense projections, and a 28 budget, to the executive committee and the board for approval 29 on an annual basis. 30 Sec. 11. NEW SECTION . 135.156B Iowa health information 31 network —— duties of the department. 32 The department shall do all of the following: 33 1. Develop, implement, and enforce the following, as 34 approved by the board: 35 -6- LSB 5257HV (3) 84 pf/nh 6/ 15

H.F. 2283 a. Strategic, operational, and business and financial 1 sustainability plans for the Iowa health information network. 2 b. Standards, requirements, policies, and procedures for 3 access to and use, secondary use, and privacy and security 4 of health information exchanged through the Iowa health 5 information network, consistent with applicable federal and 6 state standards and laws. 7 c. Rules, policies, and procedures for monitoring 8 participant usage of the Iowa health information network and 9 enforcing compliance with applicable standards, requirements, 10 policies, rules, and procedures. 11 d. Policies and procedures for administering the 12 infrastructure, technology, and associated professional 13 services required for operation of the Iowa health information 14 network and the provision of services through the Iowa health 15 information network. 16 e. An annual budget and fiscal report for the business and 17 technical operations of the Iowa health information network 18 and an annual report for the Iowa health information network 19 and the services provided through the Iowa health information 20 network. 21 2. Provide human resources, budgeting, project and activity 22 coordination, and related management functions to the Iowa 23 health information network and the services provided through 24 the Iowa health information network. 25 3. Enter into participation agreements with participants in 26 the Iowa health information network. 27 4. Collect participant fees, record receipts and approvals 28 of payments, and file required financial reports. 29 5. Apply for, acquire by gift or purchase, and hold, 30 dispense, or dispose of funds and real or personal property 31 from any person, governmental entity, or organization in 32 the exercise of its powers or performance of its duties in 33 accordance with this division. 34 6. Select and contract with vendors of goods and services in 35 -7- LSB 5257HV (3) 84 pf/nh 7/ 15

H.F. 2283 compliance with all applicable state and federal procurement 1 laws and regulations. 2 7. Work to align interstate and intrastate interoperability 3 standards in accordance with national health information 4 exchange standards. 5 8. Execute all instruments necessary or incidental to the 6 performance of its duties and the execution of its powers under 7 this division. 8 Sec. 12. NEW SECTION . 135.156C Iowa health information 9 network fund. 10 1. The Iowa health information network fund is created as a 11 separate fund within the state treasury under the control of 12 the board. Revenues, donations, gifts, interest, participant 13 fees, and other moneys received or generated relative to the 14 operation and administration of the Iowa health information 15 network shall be deposited in the fund. 16 2. Moneys in the fund are appropriated to and shall be 17 expended by the department only for activities and operations 18 suitable to the performance of the department’s duties, 19 subject to executive committee review and board approval. 20 Disbursements may be made from the fund for purposes related 21 to the administration, management, operations, functions, 22 activities, or sustainability of the Iowa health information 23 network. 24 3. Notwithstanding section 12C.7, subsection 2, earnings 25 or interest on moneys deposited in the fund shall be credited 26 to the fund. Moneys in the fund at the end of each fiscal year 27 shall not revert to another fund but shall remain in the fund 28 for expenditure in subsequent fiscal years. 29 4. The moneys in the fund shall be subject to financial and 30 compliance audits by the auditor of state. 31 Sec. 13. NEW SECTION . 135.156D Technical infrastructure. 32 1. The Iowa health information network shall provide a 33 mechanism to facilitate and support the secure electronic 34 exchange of health information between participants. 35 -8- LSB 5257HV (3) 84 pf/nh 8/ 15

H.F. 2283 2. The Iowa health information network shall not function as 1 a central repository of all health information. 2 3. The Iowa health information network shall provide a 3 mechanism for participants without an electronic health records 4 system to access health information from the Iowa health 5 information network. 6 Sec. 14. NEW SECTION . 135.156E Legal and policy. 7 1. Upon approval from the board, the department shall 8 implement appropriate security standards, policies, and 9 procedures to protect the transmission and receipt of 10 protected health information exchanged through the Iowa health 11 information network, which shall, at a minimum, comply with the 12 Health Insurance Portability and Accountability Act security 13 rule pursuant to 45 C.F.R. pt. 164, subpt. C, and shall reflect 14 all of the following: 15 a. Include authorization controls, including the 16 responsibility to authorize, maintain, and terminate a 17 participant’s use of the Iowa health information network. 18 b. Require authentication controls to verify the identify 19 and role of the participant using the Iowa health information 20 network. 21 c. Include role-based access controls to restrict 22 functionality and information available through the Iowa health 23 information network. 24 d. Include a secure and traceable electronic audit system 25 to document and monitor the sender and the recipient of health 26 information exchanged through the Iowa health information 27 network. 28 e. Require standard participation agreements which 29 define the minimum privacy and security obligations of all 30 participants using the Iowa health information network and 31 services available through the Iowa health information network. 32 f. Include controls over access to and the collection, 33 organization, and maintenance of records and data for 34 purposes of research or population health that protect the 35 -9- LSB 5257HV (3) 84 pf/nh 9/ 15

H.F. 2283 confidentiality of consumers who are the subject of the health 1 information. 2 2. A patient shall have the opportunity to decline exchange 3 of the patient’s health information through the Iowa health 4 information network. A patient shall not be denied care or 5 treatment for declining to exchange the patient’s health 6 information, in whole or in part, through the Iowa health 7 information network. The board shall provide by rule the means 8 and process by which patients may decline participation. The 9 means and process utilized under the rules shall minimize the 10 burden on patients and health care professionals. 11 3. Unless otherwise authorized by law or rule, a patient’s 12 decision to decline participation means that none of the 13 patient’s health information shall be accessible through the 14 record locator service function of the Iowa health information 15 network. A patient’s decision to decline having health 16 information shared through the record locator service function 17 shall not limit a health care professional with whom the 18 patient has or is considering a treatment relationship from 19 sharing health information concerning the patient through 20 the secure messaging function of the Iowa health information 21 network. 22 4. A patient who declines participation in the Iowa health 23 information network may later decide to have health information 24 shared through the Iowa health information network. A patient 25 who is participating in the Iowa health information network may 26 later decline participation in the network. 27 5. A participant shall not release or use protected health 28 information exchanged through the Iowa health information 29 network for purposes unrelated to prevention, treatment, 30 payment, or health care operations unless otherwise authorized 31 or required by state or federal law. Participants shall 32 limit the use and disclosure of protected health information 33 for payment or health care operations to the minimum amount 34 required to accomplish the intended purpose of the use or 35 -10- LSB 5257HV (3) 84 pf/nh 10/ 15

H.F. 2283 request, in compliance with the Health Insurance Portability 1 and Accountability Act and other applicable state or federal 2 law. Use or distribution of the information for a marketing 3 purpose, as defined by the Health Insurance Portability and 4 Accountability Act, is strictly prohibited. 5 6. The department and all persons using the Iowa health 6 information network are individually responsible for following 7 breach notification policies as provided by the Health 8 Insurance Portability and Accountability Act. 9 7. A participant shall not be compelled by subpoena, court 10 order, or other process of law to access health information 11 through the Iowa health information network in order to gather 12 records or information not created by the participant. 13 8. All participants exchanging health information and data 14 through the Iowa health information network shall grant to 15 other participants of the network a nonexclusive license to 16 retrieve and use that information in accordance with applicable 17 state and federal laws, and the policies, standards, and rules 18 established by the board. 19 9. The board shall establish by rule the procedures for a 20 patient who is the subject of health information to do all of 21 the following: 22 a. Receive notice of a violation of the confidentiality 23 provisions required under this division. 24 b. Upon request to the department, view an audit report 25 created under this division for the purpose of monitoring 26 access to the patient’s health care information. 27 10. A health care professional who relies reasonably and 28 in good faith upon any health information provided through 29 the Iowa health information network in treatment of a patient 30 who is the subject of the health information shall be immune 31 from criminal or civil liability arising from any damages 32 caused by such reasonable, good-faith reliance. Such immunity 33 shall not apply to acts or omissions constituting negligence, 34 recklessness, or intentional misconduct. 35 -11- LSB 5257HV (3) 84 pf/nh 11/ 15

H.F. 2283 11. A participant that has disclosed health information 1 through the Iowa health information network in compliance with 2 applicable law and the standards, requirements, policies, 3 procedures, and agreements of the network shall not be subject 4 to criminal or civil liability for the use or disclosure of the 5 health information by another participant. 6 12. Notwithstanding chapter 22, the following records shall 7 be kept confidential, unless otherwise ordered by a court or 8 consented to by the patient or by a person duly authorized to 9 release such information: 10 a. The protected health information contained in, stored in, 11 submitted to, transferred or exchanged by, or released from the 12 Iowa health information network. 13 b. Any protected health information in the possession of 14 the department due to its administration of the Iowa health 15 information network. 16 13. Unless otherwise provided in this division, when using 17 the Iowa health information network for the purpose of patient 18 treatment, a health care professional is exempt from any other 19 state law that is more restrictive than the Health Insurance 20 Portability and Accountability Act that would otherwise prevent 21 or hinder the exchange of patient information by the patient’s 22 health care professionals. 23 Sec. 15. NEW SECTION . 135.156F Governance review. 24 1. The governance structure as provided in this division 25 consisting of the department acting on behalf of the board 26 subject to executive committee review and board approval shall 27 continue during the term of the state health information 28 exchange cooperative agreement between the department and the 29 office of the national coordinator for health information 30 technology to address the development of standards, policies, 31 and procedures; dissemination of interoperability standards; 32 the installation, testing, and operation of the Iowa health 33 information network infrastructure; and the evolution of Iowa 34 health information network services to improve patient care for 35 -12- LSB 5257HV (3) 84 pf/nh 12/ 15

H.F. 2283 the population. 1 2. During the final year of the term of the cooperative 2 agreement, the executive committee and the department shall 3 review the governance structure, operations of the Iowa 4 health information network, and the business and financial 5 sustainability plan and make recommendations to the board 6 regarding the future governance of the Iowa health information 7 network. 8 Sec. 16. ADOPTION OF RULES. The state board of health shall 9 adopt rules within twelve months of the effective date of this 10 Act, pursuant to the directive in section 135.156E, as enacted 11 in this Act, to provide the means and process by which patients 12 may decline participation in the Iowa health information 13 network. 14 Sec. 17. EFFECTIVE UPON ENACTMENT. This Act, being deemed 15 of immediate importance, takes effect upon enactment. 16 EXPLANATION 17 This bill provides for the creation of a statewide Iowa 18 health information network (network). The bill provides 19 definitions used in the bill. The bill provides findings and 20 intent for the network, describing the importance of health 21 information technology in transforming the delivery of health 22 and medical care in the state and across the nation and in 23 improving health care quality and the overall health of the 24 population, increasing efficiencies in administrative health 25 care, reducing unnecessary health care costs, and preventing 26 medical errors. The network is to provide for the secure 27 electronic sharing of health information. The bill provides 28 that it is the intent of the general assembly to establish 29 a statewide Iowa health information network, which is not 30 to constitute a health benefit network or health insurance 31 network; and is not to preclude the formation and operation 32 of regional, population-specific, or local health information 33 networks or their participation in the statewide network. 34 The bill provides that the state board of health (board), 35 -13- LSB 5257HV (3) 84 pf/nh 13/ 15

H.F. 2283 with the support of the department of public health and the 1 advice of the existing electronic health information executive 2 committee and advisory council, is to establish and annually 3 review and update a business and financial sustainability 4 plan for the network. The plan shall include fees to be paid 5 by participants who access and use the network. The fee 6 schedule is to be structured using fair share and value-based 7 principles. The department is directed to update and submit 8 a financial model to the executive committee and the board 9 annually. 10 The bill specifies the duties of the department in the 11 day-to-day operations of the Iowa health information network. 12 The bill provides for the creation of a separate Iowa 13 health information network fund within the state treasury 14 under the control of the board. All revenues, donations, 15 gifts, interest, participant fees, and other moneys received or 16 generated relative to the network are to be deposited in the 17 fund. Moneys in the fund are appropriated to and are only to 18 be expended by the department on activities and operations of 19 the Iowa health information network, subject to board approval. 20 Moneys in the fund at the end of each fiscal year remain in the 21 fund. The fund is subject to financial and compliance audits 22 by the auditor of state. 23 The bill provides for the technical infrastructure of 24 the network. The network is to provide a mechanism to 25 facilitate and support the secure exchange of electronic health 26 information. The network is not to function as a central 27 repository of all health information, and is to provide a means 28 for participants without an electronic health record system to 29 access health information through the network. 30 The bill includes provisions relating to the legal and 31 policy aspects of the network. The bill authorizes the 32 department, with approval from the board, to develop security 33 standards, policies, and procedures to protect the transmission 34 and receipt of individually identifiable health information 35 -14- LSB 5257HV (3) 84 pf/nh 14/ 15

H.F. 2283 shared through the network. These include: authorization 1 and authentication controls, role-based access, a secure and 2 traceable electronic audit system, use of participant and 3 data-sharing agreements, and controls over access, collection, 4 and maintenance of health information. These provisions 5 specify a patient’s choice of participation in the Iowa 6 health information network, and the requirements for sharing 7 information in accordance with all other state and federal 8 laws, including the federal Health Insurance Portability and 9 Accountability Act. 10 The bill provides that the governance structure as provided 11 in the bill consisting of the department acting on behalf 12 of the board, subject to executive committee review and 13 board approval, is to continue during the term of the state 14 health information exchange cooperative agreement between 15 the department and the office of the national coordinator 16 for health information technology to address the development 17 of standards, policies, and procedures; dissemination of 18 interoperability standards; the installation, testing, and 19 operation of the network infrastructure; and the evolution of 20 health information network services to improve patient care 21 for the population. During the final year of the term of the 22 cooperative agreement (March 2014), the executive committee and 23 the department are directed to review the governance structure, 24 operations of the network, and the business and financial 25 sustainability plan, and make recommendations to the board 26 regarding the future governance of the network. 27 The bill directs the state board of health to adopt rules 28 within 12 months of the effective date of the bill to provide a 29 means and process by which patients may decline participation 30 in the Iowa health information network. 31 The bill takes effect upon enactment. 32 -15- LSB 5257HV (3) 84 pf/nh 15/ 15