S.F. 2318 Section 1. Section 135.154, Code 2011, is amended by adding 1 the following new subsections: 2 NEW SUBSECTION . 01. “Advisory council” means the electronic 3 health information advisory council created in section 135.156. 4 NEW SUBSECTION . 001. “Authorized” means having met the 5 requirements as a participant for access to and use of the Iowa 6 health information network. 7 NEW SUBSECTION . 2A. “Exchange” means the authorized 8 electronic sharing of health information between health care 9 professionals, payors, consumers, public health agencies, the 10 department, and other authorized participants utilizing the 11 Iowa health information network and Iowa health information 12 network services. 13 NEW SUBSECTION . 2B. “Executive committee” means the 14 executive committee of the electronic health information 15 advisory council created in section 135.156. 16 NEW SUBSECTION . 3A. “Health information” means health 17 information as defined in 45 C.F.R. § 160.103 that is created 18 or received by an authorized participant. 19 NEW SUBSECTION . 4A. “Health Insurance Portability and 20 Accountability Act” means the federal Health Insurance 21 Portability and Accountability Act of 1996, Pub. L. No. 22 104-191, including amendments thereto and regulations 23 promulgated thereunder. 24 NEW SUBSECTION . 4B. “Hospital” means licensed hospital as 25 defined in section 135B.1. 26 NEW SUBSECTION . 4C. “Individually identifiable health 27 information” means individually identifiable health information 28 as defined in 45 C.F.R. § 160.103 that is created or received 29 by an authorized participant. 30 NEW SUBSECTION . 5A. “Iowa health information network” or 31 “network” means the statewide health information technology 32 network created in this division. 33 NEW SUBSECTION . 5B. “Iowa Medicaid enterprise” means the 34 Iowa Medicaid enterprise as defined in section 249J.3. 35 -1- LSB 5257SZ (2) 84 pf/nh 1/ 16

S.F. 2318 NEW SUBSECTION . 5C. “Participant” means an authorized 1 health care professional, payor, patient, health care 2 organization, public health agency, or the department that 3 has agreed to authorize, submit, access, or disclose health 4 information through the Iowa health information network in 5 accordance with this chapter and all applicable laws, rules, 6 agreements, policies, and standards. 7 NEW SUBSECTION . 5D. “Patient” means a person who has 8 received or is receiving health services from a health care 9 professional. 10 NEW SUBSECTION . 5E. “Payor” means a person who makes 11 payments for health services, including but not limited to an 12 insurance company, self-insured employer, government program, 13 individual, or other purchaser that makes such payments. 14 NEW SUBSECTION . 5F. “Protected health information” means 15 protected health information as defined in 45 C.F.R. § 160.103 16 that is created or received by an authorized participant. 17 NEW SUBSECTION . 5G. “Public health agency” means an 18 entity that is governed by or contractually responsible to a 19 local board of health or the department to provide services 20 focused on the health status of population groups and their 21 environments. 22 NEW SUBSECTION . 5H. “Purchaser” means any individual, 23 employer, or organization that purchases health insurance or 24 services and includes intermediaries. 25 Sec. 2. Section 135.155, subsection 2, unnumbered paragraph 26 1, Code 2011, is amended to read as follows: 27 To be effective, the Iowa health information technology 28 system network shall comply with all of the following 29 principles: 30 Sec. 3. Section 135.155, subsection 3, Code 2011, is amended 31 to read as follows: 32 3. Widespread adoption of health information technology is 33 critical to a successful Iowa health information technology 34 system network and is best achieved when all of the following 35 -2- LSB 5257SZ (2) 84 pf/nh 2/ 16

S.F. 2318 occur: 1 a. The market provides a variety of certified products from 2 which to choose in order to best fit the needs of the user. 3 b. The system network provides incentives for health care 4 professionals to utilize the health information technology and 5 provides rewards for any improvement in quality and efficiency 6 resulting from such utilization. 7 c. The system network provides protocols to address critical 8 problems. 9 d. The system network is financed by all who benefit from 10 the improved quality, efficiency, savings, and other benefits 11 that result from use of health information technology. 12 Sec. 4. NEW SECTION . 135.155A Findings and intent —— Iowa 13 health information network. 14 1. The general assembly finds all of the following: 15 a. Technology used to support health care-related functions 16 is known as health information technology. Health information 17 technology provides a mechanism to transform the delivery of 18 health and medical care in Iowa and across the nation. 19 b. A health information network involves the secure 20 electronic sharing of health information across the boundaries 21 of individual practice and institutional health settings and 22 with consumers. Broad use of health information technology and 23 a health information network should improve health care quality 24 and the overall health of the population, increase efficiencies 25 in administrative health care, reduce unnecessary health care 26 costs, and help prevent medical errors. 27 2. It is the intent of the general assembly that Iowa 28 establish a statewide health information technology network. 29 The Iowa health information network shall not constitute a 30 health benefit network or a health insurance network. Nothing 31 in this division shall be interpreted to impede or preclude the 32 formation and operation of regional, population-specific, or 33 local health information networks or their participation in the 34 Iowa health information network. 35 -3- LSB 5257SZ (2) 84 pf/nh 3/ 16

S.F. 2318 Sec. 5. Section 135.156, subsection 1, paragraphs a and b, 1 Code Supplement 2011, are amended to read as follows: 2 a. The department shall direct a public and private 3 collaborative effort to promote the adoption and use of health 4 information technology in this state in order to improve 5 health care quality, increase patient safety, reduce health 6 care costs, enhance public health, and empower individuals 7 and health care professionals with comprehensive, real-time 8 medical information to provide continuity of care and make 9 the best health care decisions. The department shall provide 10 coordination for the development and implementation of an 11 interoperable electronic health records system, telehealth 12 expansion efforts, the health information technology 13 infrastructure, the Iowa health information network, and other 14 health information technology initiatives in this state. 15 The department shall be guided by the principles and goals 16 specified in section 135.155 and the findings and intent 17 specified for an Iowa health information network in section 18 135.155A . 19 b. All health information technology efforts shall endeavor 20 to represent the interests and meet the needs of consumers and 21 the health care sector, protect the privacy of individuals 22 and the confidentiality of individuals’ information, promote 23 physician best practices, and make information easily 24 accessible to the appropriate parties. The system network 25 developed shall be consumer-driven, flexible, and expandable. 26 Sec. 6. Section 135.156, subsection 2, paragraph a, Code 27 Supplement 2011, is amended to read as follows: 28 a. An electronic health information advisory council is 29 established which shall consist of the representatives of 30 entities involved in the electronic health records system task 31 force established pursuant to section 217.41A , Code 2007, a 32 pharmacist, a licensed practicing physician, a consumer who 33 is a member of the state board of health, a representative 34 of the state’s Medicare quality improvement organization, 35 -4- LSB 5257SZ (2) 84 pf/nh 4/ 16

S.F. 2318 the executive director of the Iowa communications network, a 1 representative of the private telecommunications industry, a 2 representative of the Iowa collaborative safety net provider 3 network created in section 135.153 , a nurse informaticist from 4 the university of Iowa, and any other members the department 5 or executive committee of the advisory council determines 6 necessary and appoints to assist the department or executive 7 committee at various stages of development of the electronic 8 Iowa health information system network . Executive branch 9 agencies shall also be included as necessary to assist in the 10 duties of the department and the executive committee. Public 11 members of the advisory council shall receive reimbursement 12 for actual expenses incurred while serving in their official 13 capacity only if they are not eligible for reimbursement by 14 the organization that they represent. Any legislative members 15 shall be paid the per diem and expenses specified in section 16 2.10 . 17 Sec. 7. Section 135.156, subsection 3, paragraph a, 18 subparagraphs (6) and (10), Code Supplement 2011, are amended 19 to read as follows: 20 (6) Policies relating to governance of the various facets of 21 the Iowa health information technology system network . 22 (10) Economic incentives and support to facilitate 23 participation in an interoperable system network by health care 24 professionals. 25 Sec. 8. Section 135.156, subsection 3, paragraph c, 26 unnumbered paragraph 1, Code Supplement 2011, is amended to 27 read as follows: 28 Coordinate public and private efforts to provide the 29 network backbone infrastructure for the Iowa health information 30 technology system network . In coordinating these efforts, the 31 executive committee shall do all of the following: 32 Sec. 9. Section 135.156, subsection 3, paragraphs h and i, 33 Code Supplement 2011, are amended to read as follows: 34 h. Seek and apply for any federal or private funding to 35 -5- LSB 5257SZ (2) 84 pf/nh 5/ 16

S.F. 2318 assist in the implementation and support of the Iowa health 1 information technology system network and make recommendations 2 for funding mechanisms for the ongoing development and 3 maintenance costs of the Iowa health information technology 4 system network . 5 i. Identify state laws and rules that present barriers 6 to the development of the Iowa health information technology 7 system network and recommend any changes to the governor and 8 the general assembly. 9 Sec. 10. NEW SECTION . 135.156A Iowa health information 10 network —— business and financial sustainability plan and 11 participant fees. 12 1. The board, with the support of the department and 13 the advice of the executive committee and advisory council, 14 shall establish and annually review and update a business and 15 financial sustainability plan for the Iowa health information 16 network. The plan shall include fees to be paid to the 17 department by participants who choose to access and use the 18 Iowa health information network. The participant fee schedule 19 shall be structured using fair share, value-based principles. 20 2. The department shall update and submit a financial model, 21 including fee schedule, revenue and expense projections, and a 22 budget, to the executive committee and the board for approval 23 on an annual basis. 24 Sec. 11. NEW SECTION . 135.156B Iowa health information 25 network —— duties of the department. 26 The department shall do all of the following: 27 1. Develop, implement, and enforce the following, as 28 approved by the board: 29 a. Strategic, operational, and business and financial 30 sustainability plans for the Iowa health information network. 31 b. Standards, requirements, policies, and procedures for 32 access to and use, secondary use, and privacy and security 33 of health information exchanged through the Iowa health 34 information network, consistent with applicable federal and 35 -6- LSB 5257SZ (2) 84 pf/nh 6/ 16

S.F. 2318 state standards and laws. 1 c. Rules, policies, and procedures for monitoring 2 participant usage of the Iowa health information network and 3 enforcing compliance with applicable standards, requirements, 4 policies, rules, and procedures. 5 d. Policies and procedures for administering the 6 infrastructure, technology, and associated professional 7 services required for operation of the Iowa health information 8 network and the provision of services through the Iowa health 9 information network. 10 e. An annual budget and fiscal report for the business and 11 technical operations of the Iowa health information network 12 and an annual report for the Iowa health information network 13 and the services provided through the Iowa health information 14 network. 15 2. Provide human resources, budgeting, project and activity 16 coordination, and related management functions to the Iowa 17 health information network and the services provided through 18 the Iowa health information network. 19 3. Enter into participation agreements with participants in 20 the Iowa health information network. 21 4. Collect participant fees, record receipts and approvals 22 of payments, and file required financial reports. 23 5. Apply for, acquire by gift or purchase, and hold, 24 dispense, or dispose of funds and real or personal property 25 from any person, governmental entity, or organization in 26 the exercise of its powers or performance of its duties in 27 accordance with this division. 28 6. Select and contract with vendors of goods and services in 29 compliance with all applicable state and federal procurement 30 laws and regulations. 31 7. Work to align interstate and intrastate interoperability 32 standards in accordance with national health information 33 exchange standards. 34 8. Execute all instruments necessary or incidental to the 35 -7- LSB 5257SZ (2) 84 pf/nh 7/ 16

S.F. 2318 performance of its duties and the execution of its powers under 1 this division. 2 Sec. 12. NEW SECTION . 135.156C Iowa health information 3 network fund. 4 1. The Iowa health information network fund is created as a 5 separate fund within the state treasury under the control of 6 the board. Revenues, donations, gifts, interest, participant 7 fees, and other moneys received or generated relative to the 8 operation and administration of the Iowa health information 9 network shall be deposited in the fund. 10 2. Moneys in the fund are appropriated to and shall be 11 expended by the department only for activities and operations 12 suitable to the performance of the department’s duties, 13 subject to executive committee review and board approval. 14 Disbursements may be made from the fund for purposes related 15 to the administration, management, operations, functions, 16 activities, or sustainability of the Iowa health information 17 network. 18 3. Notwithstanding section 12C.7, subsection 2, earnings 19 or interest on moneys deposited in the fund shall be credited 20 to the fund. Moneys in the fund at the end of each fiscal year 21 shall not revert to another fund but shall remain in the fund 22 for expenditure in subsequent fiscal years. 23 4. The moneys in the fund shall be subject to financial and 24 compliance audits by the auditor of state. 25 Sec. 13. NEW SECTION . 135.156D Technical infrastructure. 26 1. The Iowa health information network shall provide a 27 mechanism to facilitate and support the secure electronic 28 exchange of health information between participants. 29 2. The Iowa health information network shall not function as 30 a central repository of all health information. 31 3. The Iowa health information network shall provide a 32 mechanism for participants without an electronic health records 33 system to access health information from the Iowa health 34 information network. 35 -8- LSB 5257SZ (2) 84 pf/nh 8/ 16

S.F. 2318 Sec. 14. NEW SECTION . 135.156E Legal and policy. 1 1. Upon approval from the board, the department shall 2 implement appropriate security standards, policies, and 3 procedures to protect the transmission and receipt of 4 protected health information exchanged through the Iowa health 5 information network, which shall, at a minimum, comply with the 6 Health Insurance Portability and Accountability Act security 7 rule pursuant to 45 C.F.R. pt. 164, subpt. C, and shall reflect 8 all of the following: 9 a. Include authorization controls, including the 10 responsibility to authorize, maintain, and terminate a 11 participant’s use of the Iowa health information network. 12 b. Require authentication controls to verify the identify 13 and role of the participant using the Iowa health information 14 network. 15 c. Include role-based access controls to restrict 16 functionality and information available through the Iowa health 17 information network. 18 d. Include a secure and traceable electronic audit system 19 to document and monitor the sender and the recipient of health 20 information exchanged through the Iowa health information 21 network. 22 e. Require standard participation agreements which 23 define the minimum privacy and security obligations of all 24 participants using the Iowa health information network and 25 services available through the Iowa health information network. 26 f. Include controls over access to and the collection, 27 organization, and maintenance of records and data for 28 purposes of research or population health that protect the 29 confidentiality of consumers who are the subject of the health 30 information. 31 2. A patient shall have the opportunity to decline exchange 32 of the patient’s health information through the Iowa health 33 information network. A patient shall not be denied care or 34 treatment for declining to exchange the patient’s health 35 -9- LSB 5257SZ (2) 84 pf/nh 9/ 16

S.F. 2318 information, in whole or in part, through the Iowa health 1 information network. The board shall provide by rule the means 2 and process by which patients may decline participation. The 3 means and process utilized under the rules shall minimize the 4 burden on patients and health care professionals. 5 3. Unless otherwise authorized by law or rule, a patient’s 6 decision to decline participation means that none of the 7 patient’s health information shall be accessible through the 8 record locator service function of the Iowa health information 9 network. A patient’s decision to decline having health 10 information shared through the record locator service function 11 shall not limit a health care professional with whom the 12 patient has or is considering a treatment relationship from 13 sharing health information concerning the patient through 14 the secure messaging function of the Iowa health information 15 network. 16 4. A patient who declines participation in the Iowa health 17 information network may later decide to have health information 18 shared through the Iowa health information network. A patient 19 who is participating in the Iowa health information network may 20 later decline participation in the network. 21 5. A participant shall not release or use protected health 22 information exchanged through the Iowa health information 23 network for purposes unrelated to prevention, treatment, 24 payment, or health care operations unless otherwise authorized 25 or required by state or federal law. Participants shall 26 limit the use and disclosure of protected health information 27 for payment or health care operations to the minimum amount 28 required to accomplish the intended purpose of the use or 29 request, in compliance with the Health Insurance Portability 30 and Accountability Act and other applicable state or federal 31 law. Use or distribution of the information for a marketing 32 purpose, as defined by the Health Insurance Portability and 33 Accountability Act, is strictly prohibited. 34 6. The department and all persons using the Iowa health 35 -10- LSB 5257SZ (2) 84 pf/nh 10/ 16

S.F. 2318 information network are individually responsible for following 1 breach notification policies as provided by the Health 2 Insurance Portability and Accountability Act. 3 7. A participant shall not be compelled by subpoena, court 4 order, or other process of law to access health information 5 through the Iowa health information network in order to gather 6 records or information not created by the participant. 7 8. All participants exchanging health information and data 8 through the Iowa health information network shall grant to 9 other participants of the network a nonexclusive license to 10 retrieve and use that information in accordance with applicable 11 state and federal laws, and the policies, standards, and rules 12 established by the board. 13 9. The board shall establish by rule the procedures for a 14 patient who is the subject of health information to do all of 15 the following: 16 a. Receive notice of a violation of the confidentiality 17 provisions required under this division. 18 b. Upon request to the department, view an audit report 19 created under this division for the purpose of monitoring 20 access to the patient’s health care information. 21 10. A health care professional who relies reasonably and 22 in good faith upon any health information provided through 23 the Iowa health information network in treatment of a patient 24 who is the subject of the health information shall be immune 25 from criminal or civil liability arising from any damages 26 caused by such reasonable, good-faith reliance. Such immunity 27 shall not apply to acts or omissions constituting negligence, 28 recklessness, or intentional misconduct. 29 11. A participant that has disclosed health information 30 through the Iowa health information network in compliance with 31 applicable law and the standards, requirements, policies, 32 procedures, and agreements of the network shall not be subject 33 to criminal or civil liability for the use or disclosure of the 34 health information by another participant. 35 -11- LSB 5257SZ (2) 84 pf/nh 11/ 16

S.F. 2318 12. Notwithstanding chapter 22, the following records shall 1 be kept confidential, unless otherwise ordered by a court or 2 consented to by the patient or by a person duly authorized to 3 release such information: 4 a. The protected health information contained in, stored in, 5 submitted to, transferred or exchanged by, or released from the 6 Iowa health information network. 7 b. Any protected health information in the possession of 8 the department due to its administration of the Iowa health 9 information network. 10 13. Unless otherwise provided in this division, when 11 using the Iowa health information network or a private health 12 information network maintained in this state that complies 13 with the privacy and security requirements of this chapter for 14 the purposes of patient treatment, a health care professional 15 or a hospital is exempt from any other state law that is 16 more restrictive than the Health Insurance Portability and 17 Accountability Act that would otherwise prevent or hinder the 18 exchange of patient information by the patient’s health care 19 professional or hospital. 20 Sec. 15. NEW SECTION . 135.156F Governance review. 21 1. The governance structure as provided in this division 22 consisting of the department acting on behalf of the board 23 subject to executive committee review and board approval shall 24 continue during the term of the state health information 25 exchange cooperative agreement between the department and the 26 office of the national coordinator for health information 27 technology to address the development of standards, policies, 28 and procedures; dissemination of interoperability standards; 29 the installation, testing, and operation of the Iowa health 30 information network infrastructure; and the evolution of Iowa 31 health information network services to improve patient care for 32 the population. 33 2. During the final year of the term of the cooperative 34 agreement, the executive committee and the department shall 35 -12- LSB 5257SZ (2) 84 pf/nh 12/ 16

S.F. 2318 review the governance structure, operations of the Iowa 1 health information network, and the business and financial 2 sustainability plan and make recommendations to the board 3 regarding the future governance of the Iowa health information 4 network. 5 Sec. 16. ADOPTION OF RULES. The state board of health 6 shall adopt rules within twelve months of the effective date 7 of this Act, pursuant to the directive in section 135.156E, 8 as enacted in this Act, to provide the means and process by 9 which patients may decline participation in the Iowa health 10 information network, in whole or in part, including but not 11 limited to, in consultation with the patient’s health care 12 professional, limiting health information associated with a 13 specific visit from being exchanged through the Iowa health 14 information network. 15 Sec. 17. DETERMINATION OF USE, RELEASE, OR DISCLOSURE OF 16 PROTECTED HEALTH INFORMATION. The department of public health 17 shall review the potential of the use, release, or disclosure 18 of protected health information under this Act for the purposes 19 of research, and shall submit its findings and recommendations 20 to the general assembly within twelve months of the effective 21 date of this Act. 22 Sec. 18. EFFECTIVE UPON ENACTMENT. This Act, being deemed 23 of immediate importance, takes effect upon enactment. 24 EXPLANATION 25 This bill provides for the creation of a statewide Iowa 26 health information network (network). The bill provides 27 definitions used in the bill. The bill provides findings and 28 intent for the network, describing the importance of health 29 information technology in transforming the delivery of health 30 and medical care in the state and across the nation and in 31 improving health care quality and the overall health of the 32 population, increasing efficiencies in administrative health 33 care, reducing unnecessary health care costs, and preventing 34 medical errors. The network is to provide for the secure 35 -13- LSB 5257SZ (2) 84 pf/nh 13/ 16

S.F. 2318 electronic sharing of health information. The bill provides 1 that it is the intent of the general assembly to establish 2 a statewide Iowa health information network, which is not 3 to constitute a health benefit network or health insurance 4 network; and is not to preclude the formation and operation 5 of regional, population-specific, or local health information 6 networks or their participation in the statewide network. 7 The bill provides that the state board of health (board), 8 with the support of the department of public health and the 9 advice of the existing electronic health information executive 10 committee and advisory council, is to establish and annually 11 review and update a business and financial sustainability 12 plan for the network. The plan shall include fees to be paid 13 by participants who access and use the network. The fee 14 schedule is to be structured using fair share and value-based 15 principles. The department is directed to update and submit 16 a financial model to the executive committee and the board 17 annually. 18 The bill specifies the duties of the department in the 19 day-to-day operations of the Iowa health information network. 20 The bill provides for the creation of a separate Iowa 21 health information network fund within the state treasury 22 under the control of the board. All revenues, donations, 23 gifts, interest, participant fees, and other moneys received or 24 generated relative to the network are to be deposited in the 25 fund. Moneys in the fund are appropriated to and are only to 26 be expended by the department on activities and operations of 27 the Iowa health information network, subject to board approval. 28 Moneys in the fund at the end of each fiscal year remain in the 29 fund. The fund is subject to financial and compliance audits 30 by the auditor of state. 31 The bill provides for the technical infrastructure of 32 the network. The network is to provide a mechanism to 33 facilitate and support the secure exchange of electronic health 34 information. The network is not to function as a central 35 -14- LSB 5257SZ (2) 84 pf/nh 14/ 16

S.F. 2318 repository of all health information, and is to provide a means 1 for participants without an electronic health record system to 2 access health information through the network. 3 The bill includes provisions relating to the legal and 4 policy aspects of the network. The bill authorizes the 5 department, with approval from the board, to develop security 6 standards, policies, and procedures to protect the transmission 7 and receipt of individually identifiable health information 8 shared through the network. These include: authorization 9 and authentication controls, role-based access, a secure and 10 traceable electronic audit system, use of participant and 11 data-sharing agreements, and controls over access, collection, 12 and maintenance of health information. These provisions 13 specify a patient’s choice of participation in the Iowa 14 health information network, and the requirements for sharing 15 information in accordance with all other applicable state 16 and federal laws, including the federal Health Insurance 17 Portability and Accountability Act. 18 The bill provides that the governance structure as provided 19 in the bill consisting of the department acting on behalf 20 of the board, subject to executive committee review and 21 board approval, is to continue during the term of the state 22 health information exchange cooperative agreement between 23 the department and the office of the national coordinator 24 for health information technology to address the development 25 of standards, policies, and procedures; dissemination of 26 interoperability standards; the installation, testing, and 27 operation of the network infrastructure; and the evolution of 28 health information network services to improve patient care 29 for the population. During the final year of the term of the 30 cooperative agreement (March 2014), the executive committee and 31 the department are directed to review the governance structure, 32 operations of the network, and the business and financial 33 sustainability plan, and make recommendations to the board 34 regarding the future governance of the network. 35 -15- LSB 5257SZ (2) 84 pf/nh 15/ 16

S.F. 2318 The bill directs the state board of health to adopt 1 rules within 12 months of the effective date of the bill to 2 provide the means and process by which patients may decline 3 participation in the network including health information 4 association with a specific visit. 5 The bill also directs the department of public health to 6 review the potential use, release, or disclosure of protected 7 health information for purposes of research and to submit 8 findings and recommendations to the general assembly within 12 9 months of the effective date of the bill. 10 The bill takes effect upon enactment. 11 -16- LSB 5257SZ (2) 84 pf/nh 16/ 16