S.F. _____ H.F. _____ Section 1. Section 135.154, Code 2011, is amended by adding 1 the following new subsections: 2 NEW SUBSECTION . 01. “Advisory council” means the electronic 3 health information advisory council created in section 135.156. 4 NEW SUBSECTION . 001. “Authorized” means having met the 5 requirements as a participant for access to and use of the Iowa 6 health information network. 7 NEW SUBSECTION . 2A. “Exchange” means the authorized 8 electronic sharing of health information between health care 9 professionals, payors, consumers, public health agencies, the 10 department, and other authorized participants utilizing the 11 Iowa health information network and Iowa health information 12 network services. 13 NEW SUBSECTION . 2B. “Executive committee” means the 14 executive committee of the electronic health information 15 advisory council created in section 135.156. 16 NEW SUBSECTION . 3A. “Health information” means any 17 information, in any form or medium, that is created, 18 transmitted, or received by a health care professional, payor, 19 consumer, public health agency, the department, or other 20 authorized participant, which relates to the past, present, or 21 future physical or mental health or condition of an individual; 22 the provision of health care to an individual; or the past, 23 present, or future payment for the provision of health care to 24 an individual. 25 NEW SUBSECTION . 4A. “Health Insurance Portability and 26 Accountability Act” means the federal Health Insurance 27 Portability and Accountability Act of 1996, Pub. L. No. 28 104-191, including amendments thereto and regulations 29 promulgated thereunder. 30 NEW SUBSECTION . 5A. “Iowa health information network” or 31 “network” means the statewide health information technology 32 network created in this division. 33 NEW SUBSECTION . 5B. “Iowa Medicaid enterprise” means the 34 Iowa Medicaid enterprise as defined in section 249J.3. 35 -1- LSB 5257DP (16) 84 pf/nh 1/ 15

S.F. _____ H.F. _____ NEW SUBSECTION . 5C. “Participant” means an authorized 1 health care professional, payor, patient, health care 2 organization, public health agency, or the department that 3 has agreed to authorize, submit, access, or disclose health 4 information through the Iowa health information network in 5 accordance with this chapter and all applicable laws, rules, 6 agreements, policies, and standards. 7 NEW SUBSECTION . 5D. “Patient” means a person who has 8 received or is receiving health services from a health care 9 professional. 10 NEW SUBSECTION . 5E. “Payor” means a person who makes 11 payments for health services, including but not limited to an 12 insurance company, self-insured employer, government program, 13 individual, or other purchaser that makes such payments. 14 NEW SUBSECTION . 5F. “Protected health information” means 15 individually identifiable information, including demographic 16 information, related to the past, present, or future health 17 or condition of a person; the provision of health care to 18 a person; or the past, present, or future payment for such 19 health care; which is created, transmitted, or received by a 20 participant. “Protected health information” does not include 21 education or other records that are covered under the federal 22 Family Educational Rights and Privacy Act of 1974, as codified 23 at 20 U.S.C. § 1232g, as amended; or any employment records 24 maintained by a covered entity, as defined under the Health 25 Insurance Portability and Accountability Act, in its role as 26 an employer. 27 NEW SUBSECTION . 5G. “Public health agency” means an 28 entity that is governed by or contractually responsible to a 29 local board of health or the department to provide services 30 focused on the health status of population groups and their 31 environments. 32 NEW SUBSECTION . 5H. “Purchaser” means any individual, 33 employer, or organization that purchases health insurance or 34 services and includes intermediaries. 35 -2- LSB 5257DP (16) 84 pf/nh 2/ 15

S.F. _____ H.F. _____ Sec. 2. Section 135.155, subsection 2, unnumbered paragraph 1 1, Code 2011, is amended to read as follows: 2 To be effective, the Iowa health information technology 3 system network shall comply with all of the following 4 principles: 5 Sec. 3. Section 135.155, subsection 3, Code 2011, is amended 6 to read as follows: 7 3. Widespread adoption of health information technology is 8 critical to a successful Iowa health information technology 9 system network and is best achieved when all of the following 10 occur: 11 a. The market provides a variety of certified products from 12 which to choose in order to best fit the needs of the user. 13 b. The system network provides incentives for health care 14 professionals to utilize the health information technology and 15 provides rewards for any improvement in quality and efficiency 16 resulting from such utilization. 17 c. The system network provides protocols to address critical 18 problems. 19 d. The system network is financed by all who benefit from 20 the improved quality, efficiency, savings, and other benefits 21 that result from use of health information technology. 22 Sec. 4. NEW SECTION . 135.155A Findings and intent —— Iowa 23 health information network. 24 1. The general assembly finds all of the following: 25 a. Technology used to support health care-related functions 26 is known as health information technology. Health information 27 technology provides a mechanism to transform the delivery of 28 health and medical care in Iowa and across the nation. 29 b. A health information network involves the secure 30 electronic sharing of health information across the boundaries 31 of individual practice and institutional health settings and 32 with consumers. Broad use of health information technology and 33 a health information network should improve health care quality 34 and the overall health of the population, increase efficiencies 35 -3- LSB 5257DP (16) 84 pf/nh 3/ 15

S.F. _____ H.F. _____ in administrative health care, reduce unnecessary health care 1 costs, and help prevent medical errors. 2 2. It is the intent of the general assembly that Iowa 3 establish a statewide health information technology network. 4 The Iowa health information network shall not constitute a 5 health benefit network or a health insurance network. Nothing 6 in this division shall be interpreted to impede or preclude the 7 formation and operation of regional, population-specific, or 8 local health information networks or their participation in the 9 Iowa health information network. 10 Sec. 5. Section 135.156, subsection 1, paragraphs a and b, 11 Code Supplement 2011, are amended to read as follows: 12 a. The department shall direct a public and private 13 collaborative effort to promote the adoption and use of health 14 information technology in this state in order to improve 15 health care quality, increase patient safety, reduce health 16 care costs, enhance public health, and empower individuals 17 and health care professionals with comprehensive, real-time 18 medical information to provide continuity of care and make 19 the best health care decisions. The department shall provide 20 coordination for the development and implementation of an 21 interoperable electronic health records system, telehealth 22 expansion efforts, the health information technology 23 infrastructure, the Iowa health information network, and other 24 health information technology initiatives in this state. 25 The department shall be guided by the principles and goals 26 specified in section 135.155 and the findings and intent 27 specified for an Iowa health information network in section 28 135.155A . 29 b. All health information technology efforts shall endeavor 30 to represent the interests and meet the needs of consumers and 31 the health care sector, protect the privacy of individuals 32 and the confidentiality of individuals’ information, promote 33 physician best practices, and make information easily 34 accessible to the appropriate parties. The system network 35 -4- LSB 5257DP (16) 84 pf/nh 4/ 15

S.F. _____ H.F. _____ developed shall be consumer-driven, flexible, and expandable. 1 Sec. 6. Section 135.156, subsection 2, paragraph a, Code 2 Supplement 2011, is amended to read as follows: 3 a. An electronic health information advisory council is 4 established which shall consist of the representatives of 5 entities involved in the electronic health records system task 6 force established pursuant to section 217.41A , Code 2007, a 7 pharmacist, a licensed practicing physician, a consumer who 8 is a member of the state board of health, a representative 9 of the state’s Medicare quality improvement organization, 10 the executive director of the Iowa communications network, a 11 representative of the private telecommunications industry, a 12 representative of the Iowa collaborative safety net provider 13 network created in section 135.153 , a nurse informaticist from 14 the university of Iowa, and any other members the department 15 or executive committee of the advisory council determines 16 necessary and appoints to assist the department or executive 17 committee at various stages of development of the electronic 18 Iowa health information system network . Executive branch 19 agencies shall also be included as necessary to assist in the 20 duties of the department and the executive committee. Public 21 members of the advisory council shall receive reimbursement 22 for actual expenses incurred while serving in their official 23 capacity only if they are not eligible for reimbursement by 24 the organization that they represent. Any legislative members 25 shall be paid the per diem and expenses specified in section 26 2.10 . 27 Sec. 7. Section 135.156, subsection 3, paragraph a, 28 subparagraphs (6) and (10), Code Supplement 2011, are amended 29 to read as follows: 30 (6) Policies relating to governance of the various facets of 31 the Iowa health information technology system network . 32 (10) Economic incentives and support to facilitate 33 participation in an interoperable system network by health care 34 professionals. 35 -5- LSB 5257DP (16) 84 pf/nh 5/ 15

S.F. _____ H.F. _____ Sec. 8. Section 135.156, subsection 3, paragraph c, 1 unnumbered paragraph 1, Code Supplement 2011, is amended to 2 read as follows: 3 Coordinate public and private efforts to provide the 4 network backbone infrastructure for the Iowa health information 5 technology system network . In coordinating these efforts, the 6 executive committee shall do all of the following: 7 Sec. 9. Section 135.156, subsection 3, paragraphs h and i, 8 Code Supplement 2011, are amended to read as follows: 9 h. Seek and apply for any federal or private funding to 10 assist in the implementation and support of the Iowa health 11 information technology system network and make recommendations 12 for funding mechanisms for the ongoing development and 13 maintenance costs of the Iowa health information technology 14 system network . 15 i. Identify state laws and rules that present barriers 16 to the development of the Iowa health information technology 17 system network and recommend any changes to the governor and 18 the general assembly. 19 Sec. 10. NEW SECTION . 135.156A Iowa health information 20 network —— business and financial sustainability plan and 21 participant fees. 22 1. The board, with the support of the department and 23 the advice of the executive committee and advisory council, 24 shall establish and annually review and update a business and 25 financial sustainability plan for the Iowa health information 26 network. The plan shall include fees to be paid to the 27 department by participants who choose to access and use the 28 Iowa health information network. The participant fee schedule 29 shall be structured using fair share, value-based principles. 30 2. The department shall update and submit a financial model, 31 including fee schedule, revenue and expense projections, and a 32 budget, to the executive committee and the board for approval 33 on an annual basis. 34 Sec. 11. NEW SECTION . 135.156B Iowa health information 35 -6- LSB 5257DP (16) 84 pf/nh 6/ 15

S.F. _____ H.F. _____ network —— duties of the department. 1 The department shall do all of the following: 2 1. Develop, implement, and enforce the following, as 3 approved by the board: 4 a. Strategic, operational, and business and financial 5 sustainability plans for the Iowa health information network. 6 b. Standards, requirements, policies, and procedures for 7 access to and use, secondary use, and privacy and security 8 of health information exchanged through the Iowa health 9 information network, consistent with applicable federal and 10 state standards and laws. 11 c. Rules, policies, and procedures for monitoring 12 participant usage of the Iowa health information network and 13 enforcing compliance with applicable standards, requirements, 14 policies, rules, and procedures. 15 d. Policies and procedures for administering the 16 infrastructure, technology, and associated professional 17 services required for operation of the Iowa health information 18 network and the provision of services through the Iowa health 19 information network. 20 e. An annual budget and fiscal report for the business and 21 technical operations of the Iowa health information network 22 and an annual report for the Iowa health information network 23 and the services provided through the Iowa health information 24 network. 25 2. Provide human resources, budgeting, project and activity 26 coordination, and related management functions to the Iowa 27 health information network and the services provided through 28 the Iowa health information network. 29 3. Enter into participation agreements with participants in 30 the Iowa health information network. 31 4. Collect participant fees, record receipts and approvals 32 of payments, and file required financial reports. 33 5. Apply for, acquire by gift or purchase, and hold, 34 dispense, or dispose of funds and real or personal property 35 -7- LSB 5257DP (16) 84 pf/nh 7/ 15

S.F. _____ H.F. _____ from any person, governmental entity, or organization in 1 the exercise of its powers or performance of its duties in 2 accordance with this division. 3 6. Select and contract with vendors of goods and services in 4 compliance with all applicable state and federal procurement 5 laws and regulations. 6 7. Work to align interstate and intrastate interoperability 7 standards in accordance with national health information 8 exchange standards. 9 8. Execute all instruments necessary or incidental to the 10 performance of its duties and the execution of its powers under 11 this division. 12 Sec. 12. NEW SECTION . 135.156C Iowa health information 13 network fund. 14 1. The Iowa health information network fund is created as a 15 separate fund within the state treasury under the control of 16 the board. Revenues, donations, gifts, interest, participant 17 fees, and other moneys received or generated relative to the 18 operation and administration of the Iowa health information 19 network shall be deposited in the fund. 20 2. Moneys in the fund are appropriated to and shall be 21 expended by the department only for activities and operations 22 suitable to the performance of the department’s duties, 23 subject to executive committee review and board approval. 24 Disbursements may be made from the fund for purposes related 25 to the administration, management, operations, functions, 26 activities, or sustainability of the Iowa health information 27 network. 28 3. Notwithstanding section 12C.7, subsection 2, earnings 29 or interest on moneys deposited in the fund shall be credited 30 to the fund. Moneys in the fund at the end of each fiscal year 31 shall not revert to another fund but shall remain in the fund 32 for expenditure in subsequent fiscal years. 33 4. The moneys in the fund shall be subject to financial and 34 compliance audits by the auditor of state. 35 -8- LSB 5257DP (16) 84 pf/nh 8/ 15

S.F. _____ H.F. _____ Sec. 13. NEW SECTION . 135.156D Technical infrastructure. 1 1. The Iowa health information network shall provide a 2 mechanism to facilitate and support the secure electronic 3 exchange of health information between participants. 4 2. The Iowa health information network shall not function as 5 a central repository of all health information. 6 3. The Iowa health information network shall provide a 7 mechanism for participants without an electronic health records 8 system to access health information from the Iowa health 9 information network. 10 Sec. 14. NEW SECTION . 135.156E Legal and policy. 11 1. Upon approval from the board, the department shall 12 implement appropriate security standards, policies, and 13 procedures to protect the transmission and receipt of 14 protected health information exchanged through the Iowa health 15 information network, which shall, at a minimum, comply with the 16 Health Insurance Portability and Accountability Act security 17 rule pursuant to 45 C.F.R. pt. 164, subpt. C, and shall reflect 18 all of the following: 19 a. Include authorization controls, including the 20 responsibility to authorize, maintain, and terminate a 21 participant’s use of the Iowa health information network. 22 b. Require authentication controls to verify the identify 23 and role of the participant using the Iowa health information 24 network. 25 c. Include role-based access controls to restrict 26 functionality and information available through the Iowa health 27 information network. 28 d. Include a secure and traceable electronic audit system 29 to document and monitor the sender and the recipient of health 30 information exchanged through the Iowa health information 31 network. 32 e. Require standard participation agreements which 33 define the minimum privacy and security obligations of all 34 participants using the Iowa health information network and 35 -9- LSB 5257DP (16) 84 pf/nh 9/ 15

S.F. _____ H.F. _____ services available through the Iowa health information network. 1 f. Include controls over access to and the collection, 2 organization, and maintenance of records and data for 3 purposes of research or population health that protect the 4 confidentiality of consumers who are the subject of the health 5 information. 6 2. A patient shall have the opportunity to decline exchange 7 of the patient’s health information through the Iowa health 8 information network. A patient shall not be denied care or 9 treatment for declining to exchange the patient’s health 10 information, in whole or in part, through the Iowa health 11 information network. The board shall provide by rule the means 12 and process by which patients may decline participation. The 13 means and process utilized under the rules shall minimize the 14 burden on patients and health care professionals. 15 3. Unless otherwise authorized by law or rule, a patient’s 16 decision to decline participation means that none of the 17 patient’s health information shall be accessible through the 18 record locator service function of the Iowa health information 19 network. A patient’s decision to decline having health 20 information shared through the record locator service function 21 shall not limit a health care professional with whom the 22 patient has or is considering a treatment relationship from 23 sharing health information concerning the patient through 24 the secure messaging function of the Iowa health information 25 network. 26 4. A patient who declines participation in the Iowa health 27 information network may later decide to have health information 28 shared through the Iowa health information network. A patient 29 who is participating in the Iowa health information network may 30 later decline participation in the network. 31 5. A participant shall not release or use protected health 32 information exchanged through the Iowa health information 33 network for purposes unrelated to prevention, treatment, 34 payment, or health care operations unless otherwise authorized 35 -10- LSB 5257DP (16) 84 pf/nh 10/ 15

S.F. _____ H.F. _____ or required by law. Participants shall limit the use and 1 disclosure of protected health information to the minimum 2 amount required to accomplish the intended purpose of the use 3 or request, in compliance with the Health Insurance Portability 4 and Accountability Act and other applicable federal law. Use 5 or distribution of the information for a marketing purpose, as 6 defined by the Health Insurance Portability and Accountability 7 Act, is strictly prohibited. 8 6. The department and all persons using the Iowa health 9 information network are individually responsible for following 10 breach notification policies as provided by the Health 11 Insurance Portability and Accountability Act. 12 7. A participant shall not be compelled by subpoena, court 13 order, or other process of law to access health information 14 through the Iowa health information network in order to gather 15 records or information not created by the participant. 16 8. All participants exchanging health information and data 17 through the Iowa health information network shall grant to 18 other participants of the network a nonexclusive license to 19 retrieve and use that information in accordance with applicable 20 state and federal laws, and the policies, standards, and rules 21 established by the board. 22 9. The board shall establish by rule the procedures for a 23 patient who is the subject of health information to do all of 24 the following: 25 a. Receive notice of a violation of the confidentiality 26 provisions required under this division. 27 b. Upon request to the department, view an audit report 28 created under this division for the purpose of monitoring 29 access to the patient’s health care information. 30 10. A health care professional who relies reasonably and 31 in good faith upon any health information provided through 32 the Iowa health information network in treatment of a patient 33 who is the subject of the health information shall be immune 34 from criminal or civil liability arising from any damages 35 -11- LSB 5257DP (16) 84 pf/nh 11/ 15

S.F. _____ H.F. _____ caused by such reasonable, good-faith reliance. Such immunity 1 shall not apply to acts or omissions constituting negligence, 2 recklessness, or intentional misconduct. 3 11. A participant that has disclosed health information 4 through the Iowa health information network in compliance with 5 applicable law and the standards, requirements, policies, 6 procedures, and agreements of the network shall not be subject 7 to criminal or civil liability for the use or disclosure of the 8 health information by another participant. 9 12. Notwithstanding chapter 22, the following records shall 10 be kept confidential, unless otherwise ordered by a court or 11 consented to by the patient or by a person duly authorized to 12 release such information: 13 a. The protected health information contained in, stored in, 14 submitted to, transferred or exchanged by, or released from the 15 Iowa health information network. 16 b. Any protected health information in the possession of 17 the department due to its administration of the Iowa health 18 information network. 19 13. Unless otherwise provided in this division, when using 20 the Iowa health information network for the purpose of patient 21 treatment, a health care professional is exempt from any other 22 state law that is more restrictive than the Health Insurance 23 Portability and Accountability Act that would otherwise prevent 24 or hinder the exchange of patient information by the patient’s 25 health care professionals. 26 Sec. 15. NEW SECTION . 135.156F Governance review. 27 1. The governance structure as provided in this division 28 consisting of the department acting on behalf of the board 29 subject to executive committee review and board approval shall 30 continue during the term of the state health information 31 exchange cooperative agreement between the department and the 32 office of the national coordinator for health information 33 technology to address the development of standards, policies, 34 and procedures; dissemination of interoperability standards; 35 -12- LSB 5257DP (16) 84 pf/nh 12/ 15

S.F. _____ H.F. _____ the installation, testing, and operation of the Iowa health 1 information network infrastructure; and the evolution of Iowa 2 health information network services to improve patient care for 3 the population. 4 2. During the final year of the term of the cooperative 5 agreement, the executive committee and the department shall 6 review the governance structure, operations of the Iowa 7 health information network, and the business and financial 8 sustainability plan and make recommendations to the board 9 regarding the future governance of the Iowa health information 10 network. 11 Sec. 16. EFFECTIVE UPON ENACTMENT. This Act, being deemed 12 of immediate importance, takes effect upon enactment. 13 EXPLANATION 14 This bill provides for the creation of a statewide Iowa 15 health information network (network). The bill provides 16 definitions used in the bill. The bill provides findings and 17 intent for the network, describing the importance of health 18 information technology in transforming the delivery of health 19 and medical care in the state and across the nation and in 20 improving health care quality and the overall health of the 21 population, increasing efficiencies in administrative health 22 care, reducing unnecessary health care costs, and preventing 23 medical errors. The network is to provide for the secure 24 electronic sharing of health information. The bill provides 25 that it is the intent of the general assembly to establish 26 a statewide Iowa health information network, which is not 27 to constitute a health benefit network or health insurance 28 network; and is not to preclude the formation and operation 29 of regional, population-specific, or local health information 30 networks or their participation in the statewide network. 31 The bill provides that the state board of health (board), 32 with the support of the department of public health and the 33 advice of the existing electronic health information executive 34 committee and advisory council, is to establish and annually 35 -13- LSB 5257DP (16) 84 pf/nh 13/ 15

S.F. _____ H.F. _____ review and update a business and financial sustainability 1 plan for the network. The plan shall include fees to be paid 2 by participants who access and use the network. The fee 3 schedule is to be structured using fair share and value-based 4 principles. The department is directed to update and submit 5 a financial model to the executive committee and the board 6 annually. 7 The bill specifies the duties of the department in the 8 day-to-day operations of the Iowa health information network. 9 The bill provides for the creation of a separate Iowa 10 health information network fund within the state treasury 11 under the control of the board. All revenues, donations, 12 gifts, interest, participant fees, and other moneys received or 13 generated relative to the network are to be deposited in the 14 fund. Moneys in the fund are appropriated to and are only to 15 be expended by the department on activities and operations of 16 the Iowa health information network, subject to board approval. 17 Moneys in the fund at the end of each fiscal year remain in the 18 fund. The fund is subject to financial and compliance audits 19 by the auditor of state. 20 The bill provides for the technical infrastructure of 21 the network. The network is to provide a mechanism to 22 facilitate and support the secure exchange of electronic health 23 information. The network is not to function as a central 24 repository of all health information, and is to provide a means 25 for participants without an electronic health record system to 26 access health information through the network. 27 The bill includes provisions relating to the legal and 28 policy aspects of the network. The bill authorizes the 29 department, with approval from the board, to develop security 30 standards, policies, and procedures to protect the transmission 31 and receipt of individually identifiable health information 32 shared through the network. These include: authorization 33 and authentication controls, role-based access, a secure and 34 traceable electronic audit system, use of participant and 35 -14- LSB 5257DP (16) 84 pf/nh 14/ 15

S.F. _____ H.F. _____ data-sharing agreements, and controls over access, collection, 1 and maintenance of health information. These provisions 2 specify a patient’s choice of participation in the Iowa 3 health information network, and the requirements for sharing 4 information in accordance with all other laws, including the 5 federal Health Insurance Portability and Accountability Act. 6 The bill provides that the governance structure as provided 7 in the bill consisting of the department acting on behalf 8 of the board, subject to executive committee review and 9 board approval, is to continue during the term of the state 10 health information exchange cooperative agreement between 11 the department and the office of the national coordinator 12 for health information technology to address the development 13 of standards, policies, and procedures; dissemination of 14 interoperability standards; the installation, testing, and 15 operation of the network infrastructure; and the evolution of 16 health information network services to improve patient care 17 for the population. During the final year of the term of the 18 cooperative agreement (March 2014), the executive committee and 19 the department are directed to review the governance structure, 20 operations of the network, and the business and financial 21 sustainability plan, and make recommendations to the board 22 regarding the future governance of the network. 23 The bill takes effect upon enactment. 24 -15- LSB 5257DP (16) 84 pf/nh 15/ 15