Senate Study Bill 1060 - Introduced SENATE/HOUSE FILE _____ BY (PROPOSED DEPARTMENT OF PUBLIC HEALTH BILL) A BILL FOR An Act relating to health information technology including 1 the creation of a statewide health information exchange, 2 providing for fees, and including effective date provisions. 3 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: 4 TLSB 1257DP (17) 84 pf/nh

S.F. _____ H.F. _____ Section 1. NEW SECTION . 135D.1 Findings and intent. 1 1. The general assembly finds all of the following: 2 a. Technology used to support health-related functions is 3 widely known as health information technology. Electronic 4 health records are used to collect and store relevant patient 5 health information. Electronic health records serve as a means 6 of bringing evidence-based knowledge resources and patient 7 information to the point of care to support better decision 8 making and more efficient care processes. 9 b. Health information technology allows for comprehensive 10 management of health information and its secure electronic 11 exchange between providers, public health agencies, payers, 12 and consumers. Broad use of health information technology 13 should improve health care quality and the overall health of 14 the population, increase efficiencies in administrative health 15 care, reduce unnecessary health care costs, and help prevent 16 medical errors. 17 c. Health information technology provides a mechanism to 18 transform the delivery of health and medical care in Iowa and 19 across the nation. 20 2. It is the intent of the general assembly to use health 21 information technology as a catalyst to achieve a healthier 22 Iowa through the electronic sharing of health information. A 23 health information exchange involves sharing health information 24 across the boundaries of individual practice and institutional 25 health settings and with consumers. The result is a public 26 good that will contribute to improved clinical outcomes and 27 patient safety, population health, access to and quality of 28 health care, and efficiency in health care delivery. 29 Sec. 2. NEW SECTION . 135D.2 Definitions. 30 For the purposes of this chapter, unless the context 31 otherwise requires: 32 1. “Authorized” means having met the requirements as a 33 participant for access to the health information exchange. 34 2. “Board” means the board of directors of Iowa e-health. 35 -1- LSB 1257DP (17) 84 pf/nh 1/ 27

S.F. _____ H.F. _____ 3. “Consumers” means people who acquire and use goods and 1 services for personal need. 2 4. “Continuity of care document” means a summary of a 3 patient’s health information for each visit to a provider to be 4 delivered through the health information exchange. 5 5. “Department” means the department of public health. 6 6. “Deputy director” means the deputy director of public 7 health. 8 7. “Director” means the director of public health. 9 8. “Exchange” means the authorized electronic sharing 10 of health information between providers, payers, consumers, 11 local boards of health, the department, and other authorized 12 participants utilizing the health information exchange and 13 health information exchange services. 14 9. “Executive director” means the executive director of the 15 office of health information technology. 16 10. “Health information” means any information, in any 17 form or medium, that is created, transmitted, or received 18 by a provider, payer, consumer, local board of health, the 19 department, or other authorized participant, which relates 20 to the past, present, or future physical or mental health or 21 condition of an individual; the provision of health care to an 22 individual; or the past, present, or future payment for the 23 provision of health care to an individual. 24 11. “Health information exchange” means the exclusive 25 statewide electronic health information exchange. 26 12. “Health information exchange services” means the 27 exchanging of health information via the health information 28 exchange; education and outreach to support connection and 29 access to and use of the health information exchange; and all 30 other activities related to the electronic exchange of health 31 information. 32 13. “Health Insurance Portability and Accountability 33 Act” means the federal Health Insurance Portability and 34 Accountability Act of 1996, Pub. L. No. 104-191, including 35 -2- LSB 1257DP (17) 84 pf/nh 2/ 27

S.F. _____ H.F. _____ amendments thereto and regulations promulgated thereunder. 1 14. “Infrastructure” means technology including 2 architecture, hardware, software, networks, terminology and 3 standards, and policies and procedures governing the electronic 4 exchange of health information. 5 15. “Iowa e-health” means the collaboration between the 6 department and other public and private stakeholders to 7 establish, operate, and sustain an exclusive statewide health 8 information exchange. 9 16. “Iowa Medicaid enterprise” means Iowa medicaid 10 enterprise as defined in section 249J.3. 11 17. “Local board of health” means a county or district board 12 of health. 13 18. “Office” means the office of health information 14 technology within the department. 15 19. “Participant” means an authorized provider, payer, 16 patient, local board of health, the department, or other 17 authorized person that has agreed to authorize, submit, access, 18 and disclose health information through the health information 19 exchange in accordance with this chapter and all applicable 20 laws, rules, agreements, policies, and procedures. 21 20. “Participation and data sharing agreement” means 22 the agreement outlining the terms of access and use for 23 participation in the health information exchange. 24 21. “Patient” means a person who has received or is 25 receiving health services from a provider. 26 22. “Payer” means a person who makes payments for health 27 services, including but not limited to an insurance company, 28 self-insured employer, government program, individual, or other 29 purchaser that makes such payments. 30 23. “Protected health information” means individually 31 identifiable information, including demographic information, 32 related to the past, present, or future health or condition 33 of a person; the provision of health care to a person; or the 34 past, present, or future payment for such health care; which is 35 -3- LSB 1257DP (17) 84 pf/nh 3/ 27

S.F. _____ H.F. _____ created, transmitted, or received by a participant. “Protected 1 health information” does not include education and other records 2 that are covered under the federal Family Educational Rights 3 and Privacy Act of 1974, as codified at 20 U.S.C. 1232g, as 4 amended; or any employment records maintained by a covered 5 entity, as defined under the Health Insurance Portability and 6 Accountability Act, in its role as an employer. 7 24. “Provider” means a hospital, physician clinic, pharmacy, 8 laboratory, health service provider, or other person that is 9 licensed, certified, or otherwise authorized or permitted 10 by law to administer health care in the ordinary course of 11 business or in the practice of a profession, or any other 12 person or organization that furnishes, bills, or is paid for 13 health care in the normal course of business. 14 25. “Purchaser” means any individual, employer, or 15 organization that purchases health insurance or services and 16 includes intermediaries. 17 26. “Vendor” means a person or organization that provides 18 or proposes to provide goods or services to the department 19 pursuant to a contract, but does not include an employee of the 20 state, a retailer, or a state agency or instrumentality. 21 Sec. 3. NEW SECTION . 135D.3 Iowa e-health established —— 22 guiding principles, goals, domains. 23 1. Iowa e-health is established as a public-private, 24 multi-stakeholder collaborative. The purpose of Iowa e-health 25 is to develop, administer, and sustain the health information 26 exchange to improve the quality, safety, and efficiency of 27 health care available to Iowans. 28 2. Iowa e-health shall manage and operate the health 29 information exchange. Nothing in this chapter shall be 30 interpreted to impede or preclude the formation and operation 31 of regional, population-specific, or local health information 32 exchanges or their participation in the health information 33 exchange. 34 3. Iowa e-health shall facilitate the exchange of health 35 -4- LSB 1257DP (17) 84 pf/nh 4/ 27

S.F. _____ H.F. _____ information for prevention and treatment purposes to help 1 providers make the best health care decisions for patients and 2 to provide patients with continuity of care regardless of the 3 provider the patient visits. 4 4. The guiding principles of Iowa e-health include all of 5 the following: 6 a. To engage in a collaborative, public-private, 7 multi-stakeholder effort including providers, payers, 8 purchasers, governmental entities, educational institutions, 9 and consumers. 10 b. To create a sustainable health information exchange which 11 makes information available when and where it is needed. 12 c. To ensure the health information exchange incorporates 13 provider priorities and appropriate participant education. 14 d. To instill confidence in consumers that their health 15 information is secure, private, and accessed appropriately. 16 e. To build on smart practices and align with federal 17 standards to ensure interoperability within and beyond the 18 state. 19 5. The goals of Iowa e-health include all of the following: 20 a. To build awareness and trust of health information 21 technology through communication and outreach to providers and 22 consumers. 23 b. To safeguard privacy and security of health information 24 shared electronically between participants through the health 25 information exchange so that the health information is secure, 26 private, and accessed only by authorized individuals and 27 entities. 28 c. To promote statewide deployment and use of electronic 29 health records. 30 d. To enable the electronic exchange of health information. 31 e. To advance coordination of activities across state and 32 federal governments. 33 f. To establish a governance model for the health 34 information exchange. 35 -5- LSB 1257DP (17) 84 pf/nh 5/ 27

S.F. _____ H.F. _____ g. To establish sustainable business and technical 1 operations for the health information exchange. 2 h. To secure financial resources to develop and sustain the 3 health information exchange. 4 i. To monitor and evaluate health information technology 5 progress and outcomes. 6 6. Iowa e-health shall include the following five domains: 7 a. Governance. Iowa e-health shall be governed by a board 8 of directors whose members represent stakeholders such as 9 provider organizations and associations, providers, payers, 10 purchasers, governmental entities, business, and consumers. 11 Iowa e-health shall be supported by the department’s office of 12 health information technology. The board shall set direction, 13 goals, and policies for Iowa e-health and provide oversight of 14 the business and technical operations of the health information 15 exchange and health information exchange services. 16 b. Business and technical operations. The office of health 17 information technology shall perform day-to-day operations 18 to support and advance Iowa e-health, the health information 19 exchange, and health information exchange services. 20 c. Finance. Iowa e-health shall identify and manage 21 financial resources to achieve short-term and long-term 22 sustainability of the health information exchange, so that the 23 health information exchange is financed by all who benefit 24 from the improved quality, efficiency, and other benefits that 25 result from the use of health information technology. 26 d. Technical infrastructure. Iowa e-health shall implement 27 and manage the core infrastructure and standards to enable the 28 safe and secure delivery of health information to providers and 29 consumers through the health information exchange. 30 e. Legal and policy. Iowa e-health shall establish privacy 31 and security policies and guidelines, and participation and 32 data sharing agreements, to protect consumers and enforce rules 33 for utilization of the health information exchange. 34 Sec. 4. NEW SECTION . 135D.4 Governance —— board of 35 -6- LSB 1257DP (17) 84 pf/nh 6/ 27

S.F. _____ H.F. _____ directors —— advisory council. 1 1. Iowa e-health shall be governed by a board of directors. 2 Board members shall be residents of the state of Iowa. 3 Notwithstanding sections 69.16 and 69.16A, the persons 4 specified to appoint or designate board members shall consider 5 gender balance and geographic representation in the appointment 6 process. 7 2. The board of directors shall be comprised of the 8 following voting members: 9 a. Three members appointed by the governor subject to 10 confirmation by the senate, with one member representing 11 consumers, one member representing small business interests, 12 and one member representing large business interests. 13 b. Four members who are the chief information officer, or a 14 designee, of each of the four largest health care systems in 15 the state. 16 c. One member who represents rural hospitals and is a 17 member of the Iowa hospital association, designated by the Iowa 18 hospital association. 19 d. Two members who represent two different private health 20 insurance carriers, designated by the federation of Iowa 21 insurers, one of which has the largest health market share in 22 Iowa. 23 e. One member representing the department who is the deputy 24 director. 25 f. One member representing the Iowa Medicaid enterprise who 26 is the Iowa Medicaid director or the director’s designee. 27 g. One member who is a licensed practicing physician in 28 an office or clinic setting, designated by the Iowa medical 29 society. 30 h. One member who is a licensed practicing physician in an 31 office or clinic setting, designated by the Iowa osteopathic 32 medical association. 33 i. One member who is a licensed practicing nurse in an 34 office or clinic setting, designated by the Iowa nurses 35 -7- LSB 1257DP (17) 84 pf/nh 7/ 27

S.F. _____ H.F. _____ association. 1 j. One member who is a licensed pharmacist practicing in a 2 pharmacy setting, designated by the Iowa pharmacy association. 3 k. One member representing the Iowa collaborative safety net 4 provider network created in section 135.153, designated by the 5 network. 6 l. One member representing substance abuse and mental health 7 programs, designated by the Iowa behavioral health association. 8 m. One at-large board member, who may be appointed by and at 9 the sole discretion of the board. 10 3. A person shall not serve on the board in any capacity if 11 the person is required to register as a lobbyist under section 12 68B.36 because of the person’s activities for compensation 13 on behalf of a profession or an entity that is engaged in 14 providing health care, reviewing or analyzing health care, 15 paying for health care services or procedures, or providing 16 health information technology or health information exchange 17 services. 18 4. a. Board members shall serve four-year terms but shall 19 not serve more than two consecutive four-year terms. However, 20 the board members who are the four chief information officers 21 of the four largest health care systems in the state and those 22 representing state agencies are not subject to term limits. 23 b. At the end of any term, a member of the board may 24 continue to serve until the appointing or designating authority 25 names a successor. 26 c. A vacancy on the board shall be filled for the remainder 27 of the term in the manner of the original appointment. A 28 vacancy in the membership of the board shall not impair the 29 right of the remaining members to exercise all the powers and 30 perform all the duties of the board. 31 d. A board member may be removed by the board for cause 32 including but not limited to malfeasance in office, failure 33 to attend board meetings, misconduct, or violation of ethical 34 rules and standards. Nonattendance of board members appointed 35 -8- LSB 1257DP (17) 84 pf/nh 8/ 27

S.F. _____ H.F. _____ by the governor shall be governed by the provisions of section 1 69.15. A board member may be removed by a vote of the board if, 2 based on the criteria provided in section 69.15, subsection 1, 3 paragraphs “a” and “b” , the board member would be deemed to have 4 submitted a resignation from the board. 5 e. The board members shall elect a chairperson from 6 their membership. The deputy director shall serve as vice 7 chairperson. 8 5. Meetings of the board shall be governed by the provisions 9 of chapter 21. 10 a. The board shall meet upon the call of the chairperson 11 or the vice chairperson. Notice of the time and place of each 12 board meeting shall be given to each member. The board shall 13 keep accurate and complete records of all of its meetings. 14 b. A simple majority of the members shall constitute a 15 quorum to enable the transaction of any business and for the 16 exercise of any power or function of the board. Action may be 17 taken and motions and resolutions adopted by the affirmative 18 vote of a majority of the members attending the meeting whether 19 in person, by telephone, web conference, or other means. A 20 board member shall not vote by proxy or through a delegate. 21 c. All board members shall be entitled to reimbursement 22 for actual and necessary expenses incurred in the performance 23 of their official duties as members in accordance with state 24 rules and guidelines. A person who serves as a member of the 25 board shall not by reason of such membership be entitled to 26 membership in the Iowa public employees’ retirement system or 27 service credit for any public retirement system. 28 6. The board may exercise its powers, duties, and functions 29 as prescribed by law, independently of the director except in 30 matters involving violation or risk of violation of applicable 31 state or federal laws and regulations; overriding public policy 32 or public safety concerns; or compliance with the office of the 33 national coordinator for health information technology state 34 health information exchange cooperative agreement program or 35 -9- LSB 1257DP (17) 84 pf/nh 9/ 27

S.F. _____ H.F. _____ any other cooperative agreement programs or grants supporting 1 Iowa e-health. The board has all powers incidental or 2 necessary to accomplish the purposes of this chapter and shall 3 do all of the following: 4 a. Participate in the selection of the executive director 5 and assist in the development of performance standards and 6 evaluations of the executive director. 7 b. Establish priorities among health information exchange 8 services based on the needs of the population of this state. 9 c. Establish by rule any fees, charges, costs, or expenses 10 that may be collected as the board deems necessary to operate, 11 maintain, support, and sustain the health information exchange 12 and health information exchange services. 13 d. Oversee the handling and accounting of assets and moneys 14 received for or generated by the health information exchange. 15 e. Establish committees and workgroups as needed. 16 f. Review and approve or disapprove all of the following, 17 as proposed by the department: 18 (1) Strategic, operational, and financial sustainability 19 plans for Iowa e-health, the health information exchange, and 20 health information exchange services. 21 (2) Standards, requirements, policies, and procedures for 22 access, use, secondary use, and privacy and security of health 23 information exchanged through the health information exchange, 24 consistent with applicable federal and state standards and 25 laws. 26 (3) Policies and procedures for administering the 27 infrastructure, technology, and associated professional 28 services necessary for the business and technical operation of 29 the health information exchange and health information exchange 30 services. 31 (4) Policies and procedures for evaluation of the health 32 information exchange and health information exchange services. 33 (5) Mechanisms for periodic review and update of policies 34 and procedures. 35 -10- LSB 1257DP (17) 84 pf/nh 10/ 27

S.F. _____ H.F. _____ (6) An annual budget and fiscal report for the operations of 1 the health information exchange and an annual report for Iowa 2 e-health and health information exchange services. 3 (7) Major purchases of goods and services. 4 g. Adopt administrative rules pursuant to chapter 17A 5 to implement this chapter and relating to the management 6 and operation of the health information exchange and health 7 information exchange services. 8 h. Adopt rules for monitoring and enforcement of, 9 and sanctions for actions including but not limited to 10 noncompliance with health information exchange standards, 11 requirements, policies, and procedures; and violation of 12 applicable laws. 13 i. Have all remedies allowed by law to address any violation 14 of the terms of the participation and data sharing agreement. 15 j. Perform any and all other activities in furtherance of 16 its purpose. 17 7. a. A board member is subject to chapter 68B, the rules 18 adopted by the Iowa ethics and campaign disclosure board, and 19 the ethics rules and requirements that apply to the executive 20 branch of state government. 21 b. A board member shall not participate in any matter 22 before the board in which the board member has a direct or 23 indirect interest in an undertaking that places the board 24 member’s personal or business interests in conflict with those 25 of Iowa e-health, including but not limited to an interest in 26 a procurement contract, or that may create the appearance of 27 impropriety. 28 8. Advisory council. 29 a. An advisory council to the board is established 30 to provide an additional mechanism for obtaining broader 31 stakeholder advice and input regarding health information 32 technology, the health information exchange, and health 33 information exchange services. 34 b. The members of the advisory council shall be appointed 35 -11- LSB 1257DP (17) 84 pf/nh 11/ 27

S.F. _____ H.F. _____ by the board for two-year staggered terms and shall include a 1 representative of all of the following: 2 (1) The state board of health. 3 (2) Informaticists. 4 (3) Academics. 5 (4) The Iowa Medicare quality improvement organization. 6 (5) The state chief information officer. 7 (6) The private telecommunications industry. 8 (7) The Iowa collaborative safety net provider network. 9 (8) The department of human services. 10 (9) Des Moines university. 11 (10) The Iowa health care collaborative. 12 (11) The department of veterans affairs. 13 (12) Consumers. 14 (13) Home health care providers. 15 (14) Long-term care providers. 16 (15) The state hygienic laboratory. 17 c. The board may change the membership and the composition 18 of the advisory council, by rule, to accommodate changes in 19 stakeholder interests and the evolution of health information 20 technology, the health information exchange, and health 21 information exchange services. 22 d. Advisory council members shall be entitled to 23 reimbursement for actual and necessary expenses incurred in the 24 performance of their official duties as members in accordance 25 with state rules and guidelines. 26 Sec. 5. NEW SECTION . 135D.5 Business and technical 27 operations —— office of health information technology. 28 1. The office of health information technology is 29 established within the department and shall be responsible for 30 the day-to-day business and operations of Iowa e-health, the 31 health information exchange, and health information exchange 32 services. The office shall be under the direction of the 33 director and under the supervision of the deputy director. 34 2. a. The department shall employ an executive director to 35 -12- LSB 1257DP (17) 84 pf/nh 12/ 27

S.F. _____ H.F. _____ manage the office and who shall report to the deputy director. 1 b. The executive director shall manage the planning and 2 implementation of Iowa e-health, the health information 3 exchange, and health information exchange services, and provide 4 high-level coordination across public and private sector 5 stakeholders. 6 c. The executive director shall serve as Iowa’s health 7 information technology coordinator and primary point of 8 contact for the office of the national coordinator for health 9 information technology, other federal and state agencies 10 involved in health information technology, and state health 11 information technology coordinators from other states. 12 3. a. The executive director and all other employees of 13 the office shall be employees of the state, classified and 14 compensated in accordance with chapter 8A, subchapter IV, and 15 chapter 20. 16 b. Subject to approval of the board, the director shall 17 have the sole power to determine the number of full-time and 18 part-time equivalent positions necessary to carry out the 19 provisions of this chapter. 20 c. An employee of the office shall not have a financial 21 interest in any vendor doing business or proposing to do 22 business with Iowa e-health. 23 4. The department shall do all of the following: 24 a. Develop, implement, and enforce the following, as 25 approved by the board: 26 (1) Strategic, operational, and financial sustainability 27 plans for the health information exchange, Iowa e-health, and 28 health information exchange services. 29 (2) Standards, requirements, policies, and procedures for 30 access, use, secondary use, and privacy and security of health 31 information exchanged through the health information exchange, 32 consistent with applicable federal and state standards and 33 laws. 34 (3) Policies and procedures for monitoring participant 35 -13- LSB 1257DP (17) 84 pf/nh 13/ 27

S.F. _____ H.F. _____ usage of the health information exchange and health information 1 exchange services; enforcing noncompliance with health 2 information exchange standards, requirements, policies, 3 procedures, and violations of applicable law; and imposing 4 sanctions. 5 (4) Policies and procedures for administering the 6 infrastructure, technology, and associated professional 7 services required for operation of the health information 8 exchange and health information exchange services. 9 (5) Policies and procedures for evaluation of the health 10 information exchange and health information exchange services. 11 (6) A mechanism for periodic review and update of policies 12 and procedures. 13 (7) An annual budget and fiscal report for the business 14 and technical operations of the health information exchange 15 and an annual report for Iowa e-health, the health information 16 exchange, and health information exchange services. 17 b. Convene and facilitate board, advisory council, 18 workgroup, committee, and other stakeholder meetings. 19 c. Provide technical and operational assistance for 20 planning and implementing Iowa e-health activities, the health 21 information exchange, and health information exchange services. 22 d. Provide human resource, budgeting, project and 23 activity coordination, and related management functions to 24 Iowa e-health, the health information exchange, and health 25 information exchange services. 26 e. Develop educational materials and educate the general 27 public on the benefits of electronic health records, the health 28 information exchange, and the safeguards available to prevent 29 unauthorized disclosure of health information. 30 f. Enter into participation and data sharing agreements with 31 participants of the health information exchange. 32 g. Administer and enforce the collection of fees, charges, 33 costs, and expenses for the health information exchange and 34 health information exchange services. 35 -14- LSB 1257DP (17) 84 pf/nh 14/ 27

S.F. _____ H.F. _____ h. Record receipts and approval of payments, and file 1 required financial reports. 2 i. Apply for, acquire by gift or purchase, and hold, 3 dispense, or dispose of funds and real or personal property 4 from any person, governmental entity, or organization in 5 the exercise of its powers and performance of its duties in 6 accordance with this chapter. 7 j. Administer grant funds in accordance with the terms of 8 the grant and all applicable state and federal laws, rules, and 9 regulations. 10 k. Select and contract with vendors in compliance with 11 applicable state and federal procurement laws and regulations. 12 l. Coordinate with other health information technology and 13 health information exchange programs and activities. 14 m. Work to align interstate and intrastate interoperability 15 and standards in accordance with national health information 16 exchange standards. 17 n. Execute all instruments necessary or incidental to the 18 performance of its duties and the execution of its powers. 19 Sec. 6. NEW SECTION . 135D.6 Iowa e-health finance fund. 20 1. The Iowa e-health finance fund is created as a separate 21 fund within the state treasury under the control of the board. 22 Fees collected or revenues arising from the operation and 23 administration of the health information exchange and health 24 information exchange services, including but not limited to 25 fees and charges for participants of the health information 26 exchange, donations, gifts, interest, or other moneys, shall be 27 deposited into the fund. Funds generated from fees collected 28 and revenues generated from the health information exchange 29 shall be used to establish, operate, and sustain the health 30 information exchange and health information exchange services. 31 2. Moneys in the fund shall be expended by the department 32 only on activities and operations suitable to the performance 33 of the department’s duties on behalf of the board and Iowa 34 e-health as specified in this chapter, subject to board 35 -15- LSB 1257DP (17) 84 pf/nh 15/ 27

S.F. _____ H.F. _____ approval. Disbursements may be made from the fund for purposes 1 related to the administration, management, operations, 2 functions, activities, and sustainability of the health 3 information exchange and health information exchange services. 4 3. Notwithstanding section 12C.7, subsection 2, earnings or 5 interest on moneys deposited in the fund shall be credited to 6 the fund. Notwithstanding section 8.33, any unexpended balance 7 in the fund at the end of each fiscal year shall be retained in 8 the fund and shall not be transferred to the general fund of 9 the state. 10 4. The moneys in the fund shall be subject to financial and 11 compliance audits by the auditor of state. 12 5. The general assembly may appropriate moneys in the fund 13 to the department on behalf of Iowa e-health for the health 14 information exchange and health information exchange services. 15 Sec. 7. NEW SECTION . 135D.7 Technical infrastructure. 16 1. The health information exchange shall provide a 17 mechanism to facilitate and support the secure electronic 18 exchange of health information between participants. The 19 health information exchange shall not function as a central 20 repository of all health information. 21 2. The health information exchange shall provide a 22 mechanism for participants without an electronic health record 23 system to access health information from the health information 24 exchange. 25 3. The technical infrastructure of the health information 26 exchange shall be designed to facilitate the secure electronic 27 exchange of health information using functions including but 28 not limited to all of the following: 29 a. A master patient index, in the absence of a single, 30 standardized patient identifier, to exchange secure health 31 information among participants. 32 b. A record locator service to locate and exchange secure 33 health information among participants. 34 c. Authorization, authentication, access, and auditing 35 -16- LSB 1257DP (17) 84 pf/nh 16/ 27

S.F. _____ H.F. _____ processes for security controls to protect the privacy of 1 consumers and participants and the confidentiality of health 2 information by limiting access to the health information 3 exchange and health information to participants whose identity 4 has been authenticated, and whose access to health information 5 is limited by their role and recorded through an audit trail. 6 d. Electronic transmission procedures and software necessary 7 to facilitate the electronic exchange of various types of 8 health information through the health information exchange. 9 e. Telecommunications through coordination of public 10 and private networks to provide the backbone infrastructure 11 to connect participants exchanging health information. The 12 networks may include but are not limited to the state-owned 13 communications network, other fiber optic networks, and private 14 telecommunications service providers. 15 4. The state shall own or possess the rights to use all 16 processes and software developed, and hardware installed, 17 leased, designed, or purchased for the health information 18 exchange, and shall permit participants to use the health 19 information exchange and health information exchange services 20 in accordance with the standards, policies, procedures, rules, 21 and regulations approved by the board, and the terms of the 22 participation and data sharing agreement. 23 Sec. 8. NEW SECTION . 135D.8 Legal and policy. 24 1. Upon approval from the board, the office of health 25 information technology shall establish appropriate security 26 standards, policies, and procedures to protect the transmission 27 and receipt of individually identifiable health information 28 exchanged through the health information exchange. The 29 security standards, policies, and procedures shall, at a 30 minimum, comply with the Health Insurance Portability and 31 Accountability Act security rule pursuant to 45 C.F.R. pt. 164, 32 subpt. C, and shall reflect all of the following: 33 a. Include authorization controls, including the 34 responsibility to authorize, maintain, and terminate a 35 -17- LSB 1257DP (17) 84 pf/nh 17/ 27

S.F. _____ H.F. _____ participant’s use of the health information exchange. 1 b. Require authentication controls to verify the identity 2 and role of the participant using the health information 3 exchange. 4 c. Include role-based access controls to restrict 5 functionality and information available through the health 6 information exchange. 7 d. Include a secure and traceable electronic audit system 8 to document and monitor the sender and the recipient of health 9 information exchanged through the health information exchange. 10 e. Require standard participation and data sharing 11 agreements which define the minimum privacy and security 12 obligations of all participants using the health information 13 exchange and health information exchange services. 14 f. Include controls over access to and the collection, 15 organization, and maintenance of records and data for 16 purposes of research or population health that protect the 17 confidentiality of consumers who are the subject of the health 18 information. 19 2. a. A patient shall have the opportunity to decline 20 exchange of their health information through the health 21 information exchange. The board shall provide by rule the 22 means and process by which patients may decline participation. 23 b. Unless otherwise authorized by law or rule, a patient’s 24 decision to decline participation means that none of the 25 patient’s health information shall be exchanged through the 26 health information exchange. If a patient does not decline 27 participation, the patient’s health information may be 28 exchanged through the health information exchange except as 29 follows: 30 (1) If health information associated with a patient 31 visit with a provider is protected by state law that is 32 more restrictive than the Health Insurance Portability and 33 Accountability Act, a patient shall have the right to decline 34 sharing of health information through the health information 35 -18- LSB 1257DP (17) 84 pf/nh 18/ 27

S.F. _____ H.F. _____ exchange from such visit as provided by rule. 1 (2) With the consent of the patient, a provider may 2 limit health information associated with a patient visit 3 from being shared through the health information exchange if 4 such limitation is reasonably determined by the provider, in 5 consultation with the patient, to be in the best interest of 6 the patient as provided by rule. 7 c. A patient who declines participation in the health 8 information exchange may later decide to have health 9 information shared through the health information exchange. A 10 patient who is participating in the health information exchange 11 may later decline participation in the health information 12 exchange. 13 3. The office shall develop and distribute educational 14 tools and information for consumers, patients, and providers to 15 inform them about the health information exchange, including 16 but not limited to the safeguards available to prevent 17 unauthorized disclosure of health information and a patient’s 18 right to decline participation in the health information 19 exchange. 20 4. a. A participant shall not release or use protected 21 health information exchanged through the health information 22 exchange for purposes unrelated to prevention, treatment, 23 payment, or health care operations unless otherwise authorized 24 or required by law. Participants shall limit the use and 25 disclosure of protected health information to the minimum 26 amount required to accomplish the intended purpose of the use 27 or request, in compliance with the Health Insurance Portability 28 and Accountability Act and other applicable federal law. Use 29 or distribution of the information for a marketing purpose, as 30 defined by the Health Insurance Portability and Accountability 31 Act, is strictly prohibited. 32 b. The department, the office, and all persons using the 33 health information exchange shall be individually responsible 34 for following breach notification policies as provided by the 35 -19- LSB 1257DP (17) 84 pf/nh 19/ 27

S.F. _____ H.F. _____ Health Insurance Portability and Accountability Act. 1 c. A provider shall not be compelled by subpoena, court 2 order, or other process of law to access health information 3 through the health information exchange in order to gather 4 records or information not created by the provider. 5 5. a. If a patient has declined participation in the health 6 information exchange, the patient’s health information may be 7 released to a provider through the health information exchange 8 if all of the following circumstances exist: 9 (1) The patient is unable to provide consent due to 10 incapacitation. 11 (2) The requesting provider believes, in good faith, that 12 the information is necessary to prevent imminent serious injury 13 to the patient. Imminent serious injury includes but it not 14 limited to death, injury or disease that creates a substantial 15 risk of death, or injury or disease that causes protracted loss 16 or impairment of any organ or body system. 17 (3) Such information cannot otherwise be readily obtained. 18 b. The department shall provide by rule for the reporting of 19 emergency access and use by a provider. 20 6. All participants exchanging health information and 21 data through the health information exchange shall grant to 22 participants of the health information exchange a nonexclusive 23 license to retrieve and use that information or data in 24 accordance with applicable state and federal laws, and the 25 policies, procedures, and rules established by the board. 26 7. The department shall establish by rule the procedures for 27 a patient who is the subject of health information to do all of 28 the following: 29 a. Receive notice of a violation of the confidentiality 30 provisions required under this chapter. 31 b. Upon request to the department, view an audit report 32 created under this chapter for the purpose of monitoring access 33 to the patient’s records. 34 8. a. A provider who relies in good faith upon any health 35 -20- LSB 1257DP (17) 84 pf/nh 20/ 27