SENATE/HOUSE FILE _____

BY  (PROPOSED DEPARTMENT OF PUBLIC HEALTH BILL)

A BILL FOR

An Act relating to the Iowa health information network, providing for fees, and including effective date provisions.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 135.154, Code 2011, is amended by adding the following new subsections:
   NEW SUBSECTION.  01.  “Advisory council” means the electronic health information advisory council created in section 135.156.
   NEW SUBSECTION.  001.  “Authorized” means having met the requirements as a participant for access to and use of the Iowa health information network.
   NEW SUBSECTION.  2A.  “Exchange” means the authorized electronic sharing of health information between health care professionals, payors, consumers, public health agencies, the department, and other authorized participants utilizing the Iowa health information network and Iowa health information network services.
   NEW SUBSECTION.  2B.  “Executive committee” means the executive committee of the electronic health information advisory council created in section 135.156.
   NEW SUBSECTION.  3A.  “Health information” means any information, in any form or medium, that is created, transmitted, or received by a health care professional, payor, consumer, public health agency, the department, or other authorized participant, which relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
   NEW SUBSECTION.  4A.  “Health Insurance Portability and Accountability Act” means the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, including amendments thereto and regulations promulgated thereunder.
   NEW SUBSECTION.  5A.  “Iowa health information network” or “network” means the statewide health information technology network created in this division.
   NEW SUBSECTION.  5B.  “Iowa Medicaid enterprise” means the Iowa Medicaid enterprise as defined in section 249J.3.

   NEW SUBSECTION.  5C.  “Participant” means an authorized health care professional, payor, patient, health care organization, public health agency, or the department that has agreed to authorize, submit, access, or disclose health information through the Iowa health information network in accordance with this chapter and all applicable laws, rules, agreements, policies, and standards. 
   NEW SUBSECTION.  5D.  “Patient” means a person who has received or is receiving health services from a health care professional.
   NEW SUBSECTION.  5E.  “Payor” means a person who makes payments for health services, including but not limited to an insurance company, self-insured employer, government program, individual, or other purchaser that makes such payments.
   NEW SUBSECTION.  5F.  “Protected health information” means individually identifiable information, including demographic information, related to the past, present, or future health or condition of a person; the provision of health care to a person; or the past, present, or future payment for such health care; which is created, transmitted, or received by a participant. “Protected health information” does not include education or other records that are covered under the federal Family Educational Rights and Privacy Act of 1974, as codified at 20 U.S.C. § 1232g, as amended; or any employment records maintained by a covered entity, as defined under the Health Insurance Portability and Accountability Act, in its role as an employer.
   NEW SUBSECTION.  5G.  “Public health agency” means an entity that is governed by or contractually responsible to a local board of health or the department to provide services focused on the health status of population groups and their environments.
   NEW SUBSECTION.  5H.  “Purchaser” means any individual, employer, or organization that purchases health insurance or services and includes intermediaries.
    Sec. 2.  Section 135.155, subsection 2, unnumbered paragraph 1, Code 2011, is amended to read as follows:
   To be effective, the
 
Iowa health information technology system
 
network shall comply with all of the following principles:
    Sec. 3.  Section 135.155, subsection 3, Code 2011, is amended to read as follows:
   3.  Widespread adoption of health information technology is critical to a successful
 
Iowa health information technology system
 
network and is best achieved when all of the following occur:
   a.  The market provides a variety of certified products from which to choose in order to best fit the needs of the user.
   b.  The system
 
network provides incentives for health care professionals to utilize the health information technology and provides rewards for any improvement in quality and efficiency resulting from such utilization.
   c.  The system
 
network provides protocols to address critical problems.
   d.  The system
 
network is financed by all who benefit from the improved quality, efficiency, savings, and other benefits that result from use of health information technology.
    Sec. 4.  NEW SECTION.  135.155A  Findings and intent —— Iowa health information network.
   1.  The general assembly finds all of the following:
   a.  Technology used to support health care-related functions is known as health information technology. Health information technology provides a mechanism to transform the delivery of health and medical care in Iowa and across the nation.
   b.  A health information network involves the secure electronic sharing of health information across the boundaries of individual practice and institutional health settings and with consumers. Broad use of health information technology and a health information network should improve health care quality and the overall health of the population, increase efficiencies in administrative health care, reduce unnecessary health care costs, and help prevent medical errors.
   2.  It is the intent of the general assembly that Iowa establish a statewide health information technology network. The Iowa health information network shall not constitute a health benefit network or a health insurance network. Nothing in this division shall be interpreted to impede or preclude the formation and operation of regional, population-specific, or local health information networks or their participation in the Iowa health information network.
    Sec. 5.  Section 135.156, subsection 1, paragraphs a and b, Code Supplement 2011, are amended to read as follows:
   a.  The department shall direct a public and private collaborative effort to promote the adoption and use of health information technology in this state in order to improve health care quality, increase patient safety, reduce health care costs, enhance public health, and empower individuals and health care professionals with comprehensive, real-time medical information to provide continuity of care and make the best health care decisions. The department shall provide coordination for the development and implementation of an interoperable electronic health records system, telehealth expansion efforts, the health information technology infrastructure,
 
the Iowa health information network, and other health information technology initiatives in this state. The department shall be guided by the principles and goals specified in section 135.155
 
and the findings and intent specified for an Iowa health information network in section 135.155A.
   b.  All health information technology efforts shall endeavor to represent the interests and meet the needs of consumers and the health care sector, protect the privacy of individuals and the confidentiality of individuals’ information, promote physician best practices, and make information easily accessible to the appropriate parties. The system
 
network developed shall be consumer-driven, flexible, and expandable.
    Sec. 6.  Section 135.156, subsection 2, paragraph a, Code Supplement 2011, is amended to read as follows:
   a.  An electronic health information advisory council is established which shall consist of the representatives of entities involved in the electronic health records system task force established pursuant to section 217.41A, Code 2007, a pharmacist, a licensed practicing physician, a consumer who is a member of the state board of health, a representative of the state’s Medicare quality improvement organization, the executive director of the Iowa communications network, a representative of the private telecommunications industry, a representative of the Iowa collaborative safety net provider network created in section 135.153, a nurse informaticist from the university of Iowa, and any other members the department or executive committee of the advisory council determines necessary and appoints to assist the department or executive committee at various stages of development of the electronic
 
Iowa health information system
 
network. Executive branch agencies shall also be included as necessary to assist in the duties of the department and the executive committee. Public members of the advisory council shall receive reimbursement for actual expenses incurred while serving in their official capacity only if they are not eligible for reimbursement by the organization that they represent. Any legislative members shall be paid the per diem and expenses specified in section 2.10.
    Sec. 7.  Section 135.156, subsection 3, paragraph a, subparagraphs (6) and (10), Code Supplement 2011, are amended to read as follows:
   (6)  Policies relating to governance of the various facets of the
 
Iowa health information technology system
 
network.
   (10)  Economic incentives and support to facilitate participation in an interoperable system
 
network by health care professionals.
    Sec. 8.  Section 135.156, subsection 3, paragraph c, unnumbered paragraph 1, Code Supplement 2011, is amended to read as follows:
   Coordinate public and private efforts to provide the network backbone infrastructure for the
 
Iowa health information technology system
 
network. In coordinating these efforts, the executive committee shall do all of the following:
    Sec. 9.  Section 135.156, subsection 3, paragraphs h and i, Code Supplement 2011, are amended to read as follows:
   h.  Seek and apply for any federal or private funding to assist in the implementation and support of the
 
Iowa health information technology system
 
network and make recommendations for funding mechanisms for the ongoing development and maintenance costs of the
 
Iowa health information technology system
 
network.
   i.  Identify state laws and rules that present barriers to the development of the
 
Iowa health information technology system
 
network and recommend any changes to the governor and the general assembly.
    Sec. 10.  NEW SECTION.  135.156A  Iowa health information network —— business and financial sustainability plan and participant fees.
   1.  The board, with the support of the department and the advice of the executive committee and advisory council, shall establish and annually review and update a business and financial sustainability plan for the Iowa health information network. The plan shall include fees to be paid to the department by participants who choose to access and use the Iowa health information network. The participant fee schedule shall be structured using fair share, value-based principles.
   2.  The department shall update and submit a financial model, including fee schedule, revenue and expense projections, and a budget, to the executive committee and the board for approval on an annual basis.
    Sec. 11.  NEW SECTION.  135.156B  Iowa health information network —— duties of the department.
   The department shall do all of the following:
   1.  Develop, implement, and enforce the following, as approved by the board:
   a.  Strategic, operational, and business and financial sustainability plans for the Iowa health information network.
   b.  Standards, requirements, policies, and procedures for access to and use, secondary use, and privacy and security of health information exchanged through the Iowa health information network, consistent with applicable federal and state standards and laws.
   c.  Rules, policies, and procedures for monitoring participant usage of the Iowa health information network and enforcing compliance with applicable standards, requirements, policies, rules, and procedures.
   d.  Policies and procedures for administering the infrastructure, technology, and associated professional services required for operation of the Iowa health information network and the provision of services through the Iowa health information network. 
   e.  An annual budget and fiscal report for the business and technical operations of the Iowa health information network and an annual report for the Iowa health information network and the services provided through the Iowa health information network.
   2.  Provide human resources, budgeting, project and activity coordination, and related management functions to the Iowa health information network and the services provided through the Iowa health information network.
   3.  Enter into participation agreements with participants in the Iowa health information network.
   4.  Collect participant fees, record receipts and approvals of payments, and file required financial reports.
   5.  Apply for, acquire by gift or purchase, and hold, dispense, or dispose of funds and real or personal property from any person, governmental entity, or organization in the exercise of its powers or performance of its duties in accordance with this division.
   6.  Select and contract with vendors of goods and services in compliance with all applicable state and federal procurement laws and regulations.
   7.  Work to align interstate and intrastate interoperability standards in accordance with national health information exchange standards.
   8.  Execute all instruments necessary or incidental to the performance of its duties and the execution of its powers under this division.
    Sec. 12.  NEW SECTION.  135.156C  Iowa health information network fund.
   1.  The Iowa health information network fund is created as a separate fund within the state treasury under the control of the board. Revenues, donations, gifts, interest, participant fees, and other moneys received or generated relative to the operation and administration of the Iowa health information network shall be deposited in the fund.
   2.  Moneys in the fund are appropriated to and shall be expended by the department only for activities and operations suitable to the performance of the department’s duties, subject to executive committee review and board approval. Disbursements may be made from the fund for purposes related to the administration, management, operations, functions, activities, or sustainability of the Iowa health information network.
   3.  Notwithstanding section 12C.7, subsection 2, earnings or interest on moneys deposited in the fund shall be credited to the fund. Moneys in the fund at the end of each fiscal year shall not revert to another fund but shall remain in the fund for expenditure in subsequent fiscal years. 
   4.  The moneys in the fund shall be subject to financial and compliance audits by the auditor of state.
    Sec. 13.  NEW SECTION.  135.156D  Technical infrastructure.
   1.  The Iowa health information network shall provide a mechanism to facilitate and support the secure electronic exchange of health information between participants.
   2.  The Iowa health information network shall not function as a central repository of all health information.
   3.  The Iowa health information network shall provide a mechanism for participants without an electronic health records system to access health information from the Iowa health information network.
    Sec. 14.  NEW SECTION.  135.156E  Legal and policy.
   1.  Upon approval from the board, the department shall implement appropriate security standards, policies, and procedures to protect the transmission and receipt of protected health information exchanged through the Iowa health information network, which shall, at a minimum, comply with the Health Insurance Portability and Accountability Act security rule pursuant to 45 C.F.R. pt. 164, subpt. C, and shall reflect all of the following:
   a.  Include authorization controls, including the responsibility to authorize, maintain, and terminate a participant’s use of the Iowa health information network.
   b.  Require authentication controls to verify the identify and role of the participant using the Iowa health information network.
   c.  Include role-based access controls to restrict functionality and information available through the Iowa health information network.
   d.  Include a secure and traceable electronic audit system to document and monitor the sender and the recipient of health information exchanged through the Iowa health information network.
   e.  Require standard participation agreements which define the minimum privacy and security obligations of all participants using the Iowa health information network and services available through the Iowa health information network.
   f.  Include controls over access to and the collection, organization, and maintenance of records and data for purposes of research or population health that protect the confidentiality of consumers who are the subject of the health information.
   2.  A patient shall have the opportunity to decline exchange of the patient’s health information through the Iowa health information network. A patient shall not be denied care or treatment for declining to exchange the patient’s health information, in whole or in part, through the Iowa health information network. The board shall provide by rule the means and process by which patients may decline participation. The means and process utilized under the rules shall minimize the burden on patients and health care professionals.
   3.  Unless otherwise authorized by law or rule, a patient’s decision to decline participation means that none of the patient’s health information shall be accessible through the record locator service function of the Iowa health information network. A patient’s decision to decline having health information shared through the record locator service function shall not limit a health care professional with whom the patient has or is considering a treatment relationship from sharing health information concerning the patient through the secure messaging function of the Iowa health information network.
   4.  A patient who declines participation in the Iowa health information network may later decide to have health information shared through the Iowa health information network. A patient who is participating in the Iowa health information network may later decline participation in the network.
   5.  A participant shall not release or use protected health information exchanged through the Iowa health information network for purposes unrelated to prevention, treatment, payment, or health care operations unless otherwise authorized or required by law. Participants shall limit the use and disclosure of protected health information to the minimum amount required to accomplish the intended purpose of the use or request, in compliance with the Health Insurance Portability and Accountability Act and other applicable federal law. Use or distribution of the information for a marketing purpose, as defined by the Health Insurance Portability and Accountability Act, is strictly prohibited.
   6.  The department and all persons using the Iowa health information network are individually responsible for following breach notification policies as provided by the Health Insurance Portability and Accountability Act.
   7.  A participant shall not be compelled by subpoena, court order, or other process of law to access health information through the Iowa health information network in order to gather records or information not created by the participant.
   8.  All participants exchanging health information and data through the Iowa health information network shall grant to other participants of the network a nonexclusive license to retrieve and use that information in accordance with applicable state and federal laws, and the policies, standards, and rules established by the board.
   9.  The board shall establish by rule the procedures for a patient who is the subject of health information to do all of the following:
   a.  Receive notice of a violation of the confidentiality provisions required under this division.
   b.  Upon request to the department, view an audit report created under this division for the purpose of monitoring access to the patient’s health care information.
   10.  A health care professional who relies reasonably and in good faith upon any health information provided through the Iowa health information network in treatment of a patient who is the subject of the health information shall be immune from criminal or civil liability arising from any damages caused by such reasonable, good-faith reliance. Such immunity shall not apply to acts or omissions constituting negligence, recklessness, or intentional misconduct.
   11.  A participant that has disclosed health information through the Iowa health information network in compliance with applicable law and the standards, requirements, policies, procedures, and agreements of the network shall not be subject to criminal or civil liability for the use or disclosure of the health information by another participant.
   12.  Notwithstanding chapter 22, the following records shall be kept confidential, unless otherwise ordered by a court or consented to by the patient or by a person duly authorized to release such information:
   a.  The protected health information contained in, stored in, submitted to, transferred or exchanged by, or released from the Iowa health information network.
   b.  Any protected health information in the possession of the department due to its administration of the Iowa health information network.
   13.  Unless otherwise provided in this division, when using the Iowa health information network for the purpose of patient treatment, a health care professional is exempt from any other state law that is more restrictive than the Health Insurance Portability and Accountability Act that would otherwise prevent or hinder the exchange of patient information by the patient’s health care professionals.
    Sec. 15.  NEW SECTION.  135.156F  Governance review.
   1.  The governance structure as provided in this division consisting of the department acting on behalf of the board subject to executive committee review and board approval shall continue during the term of the state health information exchange cooperative agreement between the department and the office of the national coordinator for health information technology to address the development of standards, policies, and procedures; dissemination of interoperability standards; the installation, testing, and operation of the Iowa health information network infrastructure; and the evolution of Iowa health information network services to improve patient care for the population. 
   2.  During the final year of the term of the cooperative agreement, the executive committee and the department shall review the governance structure, operations of the Iowa health information network, and the business and financial sustainability plan and make recommendations to the board regarding the future governance of the Iowa health information network.
    Sec. 16.  EFFECTIVE UPON ENACTMENT.  This Act, being deemed of immediate importance, takes effect upon enactment.
EXPLANATION
   This bill provides for the creation of a statewide Iowa health information network (network). The bill provides definitions used in the bill. The bill provides findings and intent for the network, describing the importance of health information technology in transforming the delivery of health and medical care in the state and across the nation and in improving health care quality and the overall health of the population, increasing efficiencies in administrative health care, reducing unnecessary health care costs, and preventing medical errors. The network is to provide for the secure electronic sharing of health information. The bill provides that it is the intent of the general assembly to establish a statewide Iowa health information network, which is not to constitute a health benefit network or health insurance network; and is not to preclude the formation and operation of regional, population-specific, or local health information networks or their participation in the statewide network. 
   The bill provides that the state board of health (board), with the support of the department of public health and the advice of the existing electronic health information executive committee and advisory council, is to establish and annually review and update a business and financial sustainability plan for the network. The plan shall include fees to be paid by participants who access and use the network. The fee schedule is to be structured using fair share and value-based principles. The department is directed to update and submit a financial model to the executive committee and the board annually.
   The bill specifies the duties of the department in the day-to-day operations of the Iowa health information network.
   The bill provides for the creation of a separate Iowa health information network fund within the state treasury under the control of the board. All revenues, donations, gifts, interest, participant fees, and other moneys received or generated relative to the network are to be deposited in the fund. Moneys in the fund are appropriated to and are only to be expended by the department on activities and operations of the Iowa health information network, subject to board approval. Moneys in the fund at the end of each fiscal year remain in the fund. The fund is subject to financial and compliance audits by the auditor of state.
   The bill provides for the technical infrastructure of the network. The network is to provide a mechanism to facilitate and support the secure exchange of electronic health information. The network is not to function as a central repository of all health information, and is to provide a means for participants without an electronic health record system to access health information through the network.
   The bill includes provisions relating to the legal and policy aspects of the network. The bill authorizes the department, with approval from the board, to develop security standards, policies, and procedures to protect the transmission and receipt of individually identifiable health information shared through the network. These include: authorization and authentication controls, role-based access, a secure and traceable electronic audit system, use of participant and data-sharing agreements, and controls over access, collection, and maintenance of health information. These provisions specify a patient’s choice of participation in the Iowa health information network, and the requirements for sharing information in accordance with all other laws, including the federal Health Insurance Portability and Accountability Act.
   The bill provides that the governance structure as provided in the bill consisting of the department acting on behalf of the board, subject to executive committee review and board approval, is to continue during the term of the state health information exchange cooperative agreement between the department and the office of the national coordinator for health information technology to address the development of standards, policies, and procedures; dissemination of interoperability standards; the installation, testing, and operation of the network infrastructure; and the evolution of health information network services to improve patient care for the population. During the final year of the term of the cooperative agreement (March 2014), the executive committee and the department are directed to review the governance structure, operations of the network, and the business and financial sustainability plan, and make recommendations to the board regarding the future governance of the network.
   The bill takes effect upon enactment.