SENATE/HOUSE FILE _____

BY  (PROPOSED DEPARTMENT OF PUBLIC HEALTH BILL)

A BILL FOR

An Act relating to health information technology including the creation of a statewide health information exchange, providing for fees, and including effective date provisions.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

   Section 1.  NEW SECTION.  135D.1  Findings and intent.
   1.  The general assembly finds all of the following:
   a.  Technology used to support health-related functions is widely known as health information technology. Electronic health records are used to collect and store relevant patient health information. Electronic health records serve as a means of bringing evidence-based knowledge resources and patient information to the point of care to support better decision making and more efficient care processes.
   b.  Health information technology allows for comprehensive management of health information and its secure electronic exchange between providers, public health agencies, payers, and consumers. Broad use of health information technology should improve health care quality and the overall health of the population, increase efficiencies in administrative health care, reduce unnecessary health care costs, and help prevent medical errors.
   c.  Health information technology provides a mechanism to transform the delivery of health and medical care in Iowa and across the nation. 
   2.  It is the intent of the general assembly to use health information technology as a catalyst to achieve a healthier Iowa through the electronic sharing of health information. A health information exchange involves sharing health information across the boundaries of individual practice and institutional health settings and with consumers. The result is a public good that will contribute to improved clinical outcomes and patient safety, population health, access to and quality of health care, and efficiency in health care delivery.
   Sec. 2.  NEW SECTION.  135D.2  Definitions.
   For the purposes of this chapter, unless the context otherwise requires:
   1.  “Authorized” means having met the requirements as a participant for access to the health information exchange.
   2.  “Board” means the board of directors of Iowa e-health.
   3.  “Consumers” means people who acquire and use goods and services for personal need.
   4.  “Continuity of care document” means a summary of a patient’s health information for each visit to a provider to be delivered through the health information exchange.
   5.  “Department” means the department of public health.
   6.  “Deputy director” means the deputy director of public health.
   7.  “Director” means the director of public health.
   8.  “Exchange” means the authorized electronic sharing of health information between providers, payers, consumers, local boards of health, the department, and other authorized participants utilizing the health information exchange and health information exchange services.
   9.  “Executive director” means the executive director of the office of health information technology.
   10.  “Health information” means any information, in any form or medium, that is created, transmitted, or received by a provider, payer, consumer, local board of health, the department, or other authorized participant, which relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
   11.  “Health information exchange” means the exclusive statewide electronic health information exchange.
   12.  “Health information exchange services” means the exchanging of health information via the health information exchange; education and outreach to support connection and access to and use of the health information exchange; and all other activities related to the electronic exchange of health information.
   13.  “Health Insurance Portability and Accountability Act” means the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, including amendments thereto and regulations promulgated thereunder.
   14.  “Infrastructure” means technology including architecture, hardware, software, networks, terminology and standards, and policies and procedures governing the electronic exchange of health information.
   15.  “Iowa e-health” means the collaboration between the department and other public and private stakeholders to establish, operate, and sustain an exclusive statewide health information exchange.
   16.  “Iowa Medicaid enterprise” means Iowa medicaid enterprise as defined in section 249J.3.
   17.  “Local board of health” means a county or district board of health.
   18.  “Office” means the office of health information technology within the department.
   19.  “Participant” means an authorized provider, payer, patient, local board of health, the department, or other authorized person that has agreed to authorize, submit, access, and disclose health information through the health information exchange in accordance with this chapter and all applicable laws, rules, agreements, policies, and procedures.
   20.  “Participation and data sharing agreement” means the agreement outlining the terms of access and use for participation in the health information exchange.
   21.  “Patient” means a person who has received or is receiving health services from a provider.
   22.  “Payer” means a person who makes payments for health services, including but not limited to an insurance company, self-insured employer, government program, individual, or other purchaser that makes such payments.
   23.  “Protected health information” means individually identifiable information, including demographic information, related to the past, present, or future health or condition of a person; the provision of health care to a person; or the past, present, or future payment for such health care; which is created, transmitted, or received by a participant. “Protected health information” does not include education and other records that are covered under the federal Family Educational Rights and Privacy Act of 1974, as codified at 20 U.S.C. 1232g, as amended; or any employment records maintained by a covered entity, as defined under the Health Insurance Portability and Accountability Act, in its role as an employer.
   24.  “Provider” means a hospital, physician clinic, pharmacy, laboratory, health service provider, or other person that is licensed, certified, or otherwise authorized or permitted by law to administer health care in the ordinary course of business or in the practice of a profession, or any other person or organization that furnishes, bills, or is paid for health care in the normal course of business.
   25.  “Purchaser” means any individual, employer, or organization that purchases health insurance or services and includes intermediaries.
   26.  “Vendor” means a person or organization that provides or proposes to provide goods or services to the department pursuant to a contract, but does not include an employee of the state, a retailer, or a state agency or instrumentality.
   Sec. 3.  NEW SECTION.  135D.3  Iowa e-health established —— guiding principles, goals, domains.
   1.  Iowa e-health is established as a public-private, multi-stakeholder collaborative. The purpose of Iowa e-health is to develop, administer, and sustain the health information exchange to improve the quality, safety, and efficiency of health care available to Iowans.
   2.  Iowa e-health shall manage and operate the health information exchange. Nothing in this chapter shall be interpreted to impede or preclude the formation and operation of regional, population-specific, or local health information exchanges or their participation in the health information exchange.
   3.  Iowa e-health shall facilitate the exchange of health information for prevention and treatment purposes to help providers make the best health care decisions for patients and to provide patients with continuity of care regardless of the provider the patient visits.
   4.  The guiding principles of Iowa e-health include all of the following:
   a.  To engage in a collaborative, public-private, multi-stakeholder effort including providers, payers, purchasers, governmental entities, educational institutions, and consumers.
   b.  To create a sustainable health information exchange which makes information available when and where it is needed.
   c.  To ensure the health information exchange incorporates provider priorities and appropriate participant education.
   d.  To instill confidence in consumers that their health information is secure, private, and accessed appropriately.
   e.  To build on smart practices and align with federal standards to ensure interoperability within and beyond the state.
   5.  The goals of Iowa e-health include all of the following:
   a.  To build awareness and trust of health information technology through communication and outreach to providers and consumers.
   b.  To safeguard privacy and security of health information shared electronically between participants through the health information exchange so that the health information is secure, private, and accessed only by authorized individuals and entities.
   c.  To promote statewide deployment and use of electronic health records.
   d.  To enable the electronic exchange of health information.
   e.  To advance coordination of activities across state and federal governments.
   f.  To establish a governance model for the health information exchange.
   g.  To establish sustainable business and technical operations for the health information exchange.
   h.  To secure financial resources to develop and sustain the health information exchange.
   i.  To monitor and evaluate health information technology progress and outcomes.
   6.  Iowa e-health shall include the following five domains:
   a.  Governance.  Iowa e-health shall be governed by a board of directors whose members represent stakeholders such as provider organizations and associations, providers, payers, purchasers, governmental entities, business, and consumers. Iowa e-health shall be supported by the department’s office of health information technology. The board shall set direction, goals, and policies for Iowa e-health and provide oversight of the business and technical operations of the health information exchange and health information exchange services.
   b.  Business and technical operations.  The office of health information technology shall perform day-to-day operations to support and advance Iowa e-health, the health information exchange, and health information exchange services.
   c.  Finance.  Iowa e-health shall identify and manage financial resources to achieve short-term and long-term sustainability of the health information exchange, so that the health information exchange is financed by all who benefit from the improved quality, efficiency, and other benefits that result from the use of health information technology.
   d.  Technical infrastructure.  Iowa e-health shall implement and manage the core infrastructure and standards to enable the safe and secure delivery of health information to providers and consumers through the health information exchange.
   e.  Legal and policy.  Iowa e-health shall establish privacy and security policies and guidelines, and participation and data sharing agreements, to protect consumers and enforce rules for utilization of the health information exchange.
   Sec. 4.  NEW SECTION.  135D.4  Governance —— board of directors —— advisory council.
   1.  Iowa e-health shall be governed by a board of directors. Board members shall be residents of the state of Iowa. Notwithstanding sections 69.16 and 69.16A, the persons specified to appoint or designate board members shall consider gender balance and geographic representation in the appointment process.
   2.  The board of directors shall be comprised of the following voting members:
   a.  Three members appointed by the governor subject to confirmation by the senate, with one member representing consumers, one member representing small business interests, and one member representing large business interests.
   b.  Four members who are the chief information officer, or a designee, of each of the four largest health care systems in the state.
   c.  One member who represents rural hospitals and is a member of the Iowa hospital association, designated by the Iowa hospital association.
   d.  Two members who represent two different private health insurance carriers, designated by the federation of Iowa insurers, one of which has the largest health market share in Iowa.
   e.  One member representing the department who is the deputy director.
   f.  One member representing the Iowa Medicaid enterprise who is the Iowa Medicaid director or the director’s designee.
   g.  One member who is a licensed practicing physician in an office or clinic setting, designated by the Iowa medical society.
   h.  One member who is a licensed practicing physician in an office or clinic setting, designated by the Iowa osteopathic medical association.
   i.  One member who is a licensed practicing nurse in an office or clinic setting, designated by the Iowa nurses association.
   j.  One member who is a licensed pharmacist practicing in a pharmacy setting, designated by the Iowa pharmacy association.
   k.  One member representing the Iowa collaborative safety net provider network created in section 135.153, designated by the network.
   l.  One member representing substance abuse and mental health programs, designated by the Iowa behavioral health association.
   m.  One at-large board member, who may be appointed by and at the sole discretion of the board.
   3.  A person shall not serve on the board in any capacity if the person is required to register as a lobbyist under section 68B.36 because of the person’s activities for compensation on behalf of a profession or an entity that is engaged in providing health care, reviewing or analyzing health care, paying for health care services or procedures, or providing health information technology or health information exchange services.
   4.
  a.  Board members shall serve four-year terms but shall not serve more than two consecutive four-year terms. However, the board members who are the four chief information officers of the four largest health care systems in the state and those representing state agencies are not subject to term limits.
   b.  At the end of any term, a member of the board may continue to serve until the appointing or designating authority names a successor.
   c.  A vacancy on the board shall be filled for the remainder of the term in the manner of the original appointment. A vacancy in the membership of the board shall not impair the right of the remaining members to exercise all the powers and perform all the duties of the board.
   d.  A board member may be removed by the board for cause including but not limited to malfeasance in office, failure to attend board meetings, misconduct, or violation of ethical rules and standards. Nonattendance of board members appointed by the governor shall be governed by the provisions of section 69.15. A board member may be removed by a vote of the board if, based on the criteria provided in section 69.15, subsection 1, paragraphs“a” and “b”, the board member would be deemed to have submitted a resignation from the board.
   e.  The board members shall elect a chairperson from their membership. The deputy director shall serve as vice chairperson.
   5.  Meetings of the board shall be governed by the provisions of chapter 21.
   a.  The board shall meet upon the call of the chairperson or the vice chairperson. Notice of the time and place of each board meeting shall be given to each member. The board shall keep accurate and complete records of all of its meetings.
   b.  A simple majority of the members shall constitute a quorum to enable the transaction of any business and for the exercise of any power or function of the board. Action may be taken and motions and resolutions adopted by the affirmative vote of a majority of the members attending the meeting whether in person, by telephone, web conference, or other means. A board member shall not vote by proxy or through a delegate.
   c.  All board members shall be entitled to reimbursement for actual and necessary expenses incurred in the performance of their official duties as members in accordance with state rules and guidelines. A person who serves as a member of the board shall not by reason of such membership be entitled to membership in the Iowa public employees’ retirement system or service credit for any public retirement system.
   6.  The board may exercise its powers, duties, and functions as prescribed by law, independently of the director except in matters involving violation or risk of violation of applicable state or federal laws and regulations; overriding public policy or public safety concerns; or compliance with the office of the national coordinator for health information technology state health information exchange cooperative agreement program or any other cooperative agreement programs or grants supporting Iowa e-health. The board has all powers incidental or necessary to accomplish the purposes of this chapter and shall do all of the following:
   a.  Participate in the selection of the executive director and assist in the development of performance standards and evaluations of the executive director.
   b.  Establish priorities among health information exchange services based on the needs of the population of this state.
   c.  Establish by rule any fees, charges, costs, or expenses that may be collected as the board deems necessary to operate, maintain, support, and sustain the health information exchange and health information exchange services.
   d.  Oversee the handling and accounting of assets and moneys received for or generated by the health information exchange.
   e.  Establish committees and workgroups as needed.
   f.  Review and approve or disapprove all of the following, as proposed by the department:
   (1)  Strategic, operational, and financial sustainability plans for Iowa e-health, the health information exchange, and health information exchange services.
   (2)  Standards, requirements, policies, and procedures for access, use, secondary use, and privacy and security of health information exchanged through the health information exchange, consistent with applicable federal and state standards and laws.
   (3)  Policies and procedures for administering the infrastructure, technology, and associated professional services necessary for the business and technical operation of the health information exchange and health information exchange services.
   (4)  Policies and procedures for evaluation of the health information exchange and health information exchange services.
   (5)  Mechanisms for periodic review and update of policies and procedures.
   (6)  An annual budget and fiscal report for the operations of the health information exchange and an annual report for Iowa e-health and health information exchange services.
   (7)  Major purchases of goods and services.
   g.  Adopt administrative rules pursuant to chapter 17A to implement this chapter and relating to the management and operation of the health information exchange and health information exchange services.
   h.  Adopt rules for monitoring and enforcement of, and sanctions for actions including but not limited to noncompliance with health information exchange standards, requirements, policies, and procedures; and violation of applicable laws.
   i.  Have all remedies allowed by law to address any violation of the terms of the participation and data sharing agreement.
   j.  Perform any and all other activities in furtherance of its purpose.
   7.
  a.  A board member is subject to chapter 68B, the rules adopted by the Iowa ethics and campaign disclosure board, and the ethics rules and requirements that apply to the executive branch of state government.
   b.  A board member shall not participate in any matter before the board in which the board member has a direct or indirect interest in an undertaking that places the board member’s personal or business interests in conflict with those of Iowa e-health, including but not limited to an interest in a procurement contract, or that may create the appearance of impropriety.
   8.  Advisory council.
   a.  An advisory council to the board is established to provide an additional mechanism for obtaining broader stakeholder advice and input regarding health information technology, the health information exchange, and health information exchange services.
   b.  The members of the advisory council shall be appointed by the board for two-year staggered terms and shall include a representative of all of the following:
   (1)  The state board of health.
   (2)  Informaticists.
   (3)  Academics.
   (4)  The Iowa Medicare quality improvement organization.
   (5)  The state chief information officer.
   (6)  The private telecommunications industry.
   (7)  The Iowa collaborative safety net provider network.
   (8)  The department of human services.
   (9)  Des Moines university.
   (10)  The Iowa health care collaborative.
   (11)  The department of veterans affairs.
   (12)  Consumers.
   (13)  Home health care providers.
   (14)  Long-term care providers.
   (15)  The state hygienic laboratory.
   c.  The board may change the membership and the composition of the advisory council, by rule, to accommodate changes in stakeholder interests and the evolution of health information technology, the health information exchange, and health information exchange services.
   d.  Advisory council members shall be entitled to reimbursement for actual and necessary expenses incurred in the performance of their official duties as members in accordance with state rules and guidelines.
   Sec. 5.  NEW SECTION.  135D.5  Business and technical operations —— office of health information technology.
   1.  The office of health information technology is established within the department and shall be responsible for the day-to-day business and operations of Iowa e-health, the health information exchange, and health information exchange services. The office shall be under the direction of the director and under the supervision of the deputy director.
   2.
  a.  The department shall employ an executive director to manage the office and who shall report to the deputy director.
   b.  The executive director shall manage the planning and implementation of Iowa e-health, the health information exchange, and health information exchange services, and provide high-level coordination across public and private sector stakeholders.
   c.  The executive director shall serve as Iowa’s health information technology coordinator and primary point of contact for the office of the national coordinator for health information technology, other federal and state agencies involved in health information technology, and state health information technology coordinators from other states.
   3.
  a.  The executive director and all other employees of the office shall be employees of the state, classified and compensated in accordance with chapter 8A, subchapter IV, and chapter 20.
   b.  Subject to approval of the board, the director shall have the sole power to determine the number of full-time and part-time equivalent positions necessary to carry out the provisions of this chapter.
   c.  An employee of the office shall not have a financial interest in any vendor doing business or proposing to do business with Iowa e-health.
   4.  The department shall do all of the following:
   a.  Develop, implement, and enforce the following, as approved by the board:
   (1)  Strategic, operational, and financial sustainability plans for the health information exchange, Iowa e-health, and health information exchange services.
   (2)  Standards, requirements, policies, and procedures for access, use, secondary use, and privacy and security of health information exchanged through the health information exchange, consistent with applicable federal and state standards and laws.
   (3)  Policies and procedures for monitoring participant usage of the health information exchange and health information exchange services; enforcing noncompliance with health information exchange standards, requirements, policies, procedures, and violations of applicable law; and imposing sanctions.
   (4)  Policies and procedures for administering the infrastructure, technology, and associated professional services required for operation of the health information exchange and health information exchange services.
   (5)  Policies and procedures for evaluation of the health information exchange and health information exchange services.
   (6)  A mechanism for periodic review and update of policies and procedures.
   (7)  An annual budget and fiscal report for the business and technical operations of the health information exchange and an annual report for Iowa e-health, the health information exchange, and health information exchange services.
   b.  Convene and facilitate board, advisory council, workgroup, committee, and other stakeholder meetings.
   c.  Provide technical and operational assistance for planning and implementing Iowa e-health activities, the health information exchange, and health information exchange services.
   d.  Provide human resource, budgeting, project and activity coordination, and related management functions to Iowa e-health, the health information exchange, and health information exchange services.
   e.  Develop educational materials and educate the general public on the benefits of electronic health records, the health information exchange, and the safeguards available to prevent unauthorized disclosure of health information.
   f.  Enter into participation and data sharing agreements with participants of the health information exchange.
   g.  Administer and enforce the collection of fees, charges, costs, and expenses for the health information exchange and health information exchange services.
   h.  Record receipts and approval of payments, and file required financial reports.
   i.  Apply for, acquire by gift or purchase, and hold, dispense, or dispose of funds and real or personal property from any person, governmental entity, or organization in the exercise of its powers and performance of its duties in accordance with this chapter.
   j.  Administer grant funds in accordance with the terms of the grant and all applicable state and federal laws, rules, and regulations.
   k.  Select and contract with vendors in compliance with applicable state and federal procurement laws and regulations.
   l.  Coordinate with other health information technology and health information exchange programs and activities.
   m.  Work to align interstate and intrastate interoperability and standards in accordance with national health information exchange standards.
   n.  Execute all instruments necessary or incidental to the performance of its duties and the execution of its powers.
   Sec. 6.  NEW SECTION.  135D.6  Iowa e-health finance fund.
   1.  The Iowa e-health finance fund is created as a separate fund within the state treasury under the control of the board. Fees collected or revenues arising from the operation and administration of the health information exchange and health information exchange services, including but not limited to fees and charges for participants of the health information exchange, donations, gifts, interest, or other moneys, shall be deposited into the fund. Funds generated from fees collected and revenues generated from the health information exchange shall be used to establish, operate, and sustain the health information exchange and health information exchange services.
   2.  Moneys in the fund shall be expended by the department only on activities and operations suitable to the performance of the department’s duties on behalf of the board and Iowa e-health as specified in this chapter, subject to board approval. Disbursements may be made from the fund for purposes related to the administration, management, operations, functions, activities, and sustainability of the health information exchange and health information exchange services.
   3.  Notwithstanding section 12C.7, subsection 2, earnings or interest on moneys deposited in the fund shall be credited to the fund. Notwithstanding section 8.33, any unexpended balance in the fund at the end of each fiscal year shall be retained in the fund and shall not be transferred to the general fund of the state.
   4.  The moneys in the fund shall be subject to financial and compliance audits by the auditor of state.
   5.  The general assembly may appropriate moneys in the fund to the department on behalf of Iowa e-health for the health information exchange and health information exchange services.
   Sec. 7.  NEW SECTION.  135D.7  Technical infrastructure.
   1.  The health information exchange shall provide a mechanism to facilitate and support the secure electronic exchange of health information between participants. The health information exchange shall not function as a central repository of all health information.
   2.  The health information exchange shall provide a mechanism for participants without an electronic health record system to access health information from the health information exchange.
   3.  The technical infrastructure of the health information exchange shall be designed to facilitate the secure electronic exchange of health information using functions including but not limited to all of the following:
   a.  A master patient index, in the absence of a single, standardized patient identifier, to exchange secure health information among participants.
   b.  A record locator service to locate and exchange secure health information among participants.
   c.  Authorization, authentication, access, and auditing processes for security controls to protect the privacy of consumers and participants and the confidentiality of health information by limiting access to the health information exchange and health information to participants whose identity has been authenticated, and whose access to health information is limited by their role and recorded through an audit trail.
   d.  Electronic transmission procedures and software necessary to facilitate the electronic exchange of various types of health information through the health information exchange.
   e.  Telecommunications through coordination of public and private networks to provide the backbone infrastructure to connect participants exchanging health information. The networks may include but are not limited to the state-owned communications network, other fiber optic networks, and private telecommunications service providers.
   4.  The state shall own or possess the rights to use all processes and software developed, and hardware installed, leased, designed, or purchased for the health information exchange, and shall permit participants to use the health information exchange and health information exchange services in accordance with the standards, policies, procedures, rules, and regulations approved by the board, and the terms of the participation and data sharing agreement.
   Sec. 8.  NEW SECTION.  135D.8  Legal and policy.
   1.  Upon approval from the board, the office of health information technology shall establish appropriate security standards, policies, and procedures to protect the transmission and receipt of individually identifiable health information exchanged through the health information exchange. The security standards, policies, and procedures shall, at a minimum, comply with the Health Insurance Portability and Accountability Act security rule pursuant to 45 C.F.R. pt. 164, subpt. C, and shall reflect all of the following:
   a.  Include authorization controls, including the responsibility to authorize, maintain, and terminate a participant’s use of the health information exchange.
   b.  Require authentication controls to verify the identity and role of the participant using the health information exchange.
   c.  Include role-based access controls to restrict functionality and information available through the health information exchange.
   d.  Include a secure and traceable electronic audit system to document and monitor the sender and the recipient of health information exchanged through the health information exchange.
   e.  Require standard participation and data sharing agreements which define the minimum privacy and security obligations of all participants using the health information exchange and health information exchange services.
   f.  Include controls over access to and the collection, organization, and maintenance of records and data for purposes of research or population health that protect the confidentiality of consumers who are the subject of the health information.
   2.
  a.  A patient shall have the opportunity to decline exchange of their health information through the health information exchange. The board shall provide by rule the means and process by which patients may decline participation.
   b.  Unless otherwise authorized by law or rule, a patient’s decision to decline participation means that none of the patient’s health information shall be exchanged through the health information exchange. If a patient does not decline participation, the patient’s health information may be exchanged through the health information exchange except as follows:
   (1)  If health information associated with a patient visit with a provider is protected by state law that is more restrictive than the Health Insurance Portability and Accountability Act, a patient shall have the right to decline sharing of health information through the health information exchange from such visit as provided by rule.
   (2)  With the consent of the patient, a provider may limit health information associated with a patient visit from being shared through the health information exchange if such limitation is reasonably determined by the provider, in consultation with the patient, to be in the best interest of the patient as provided by rule.
   c.  A patient who declines participation in the health information exchange may later decide to have health information shared through the health information exchange. A patient who is participating in the health information exchange may later decline participation in the health information exchange.
   3.  The office shall develop and distribute educational tools and information for consumers, patients, and providers to inform them about the health information exchange, including but not limited to the safeguards available to prevent unauthorized disclosure of health information and a patient’s right to decline participation in the health information exchange.
   4.
  a.  A participant shall not release or use protected health information exchanged through the health information exchange for purposes unrelated to prevention, treatment, payment, or health care operations unless otherwise authorized or required by law. Participants shall limit the use and disclosure of protected health information to the minimum amount required to accomplish the intended purpose of the use or request, in compliance with the Health Insurance Portability and Accountability Act and other applicable federal law. Use or distribution of the information for a marketing purpose, as defined by the Health Insurance Portability and Accountability Act, is strictly prohibited.
   b.  The department, the office, and all persons using the health information exchange shall be individually responsible for following breach notification policies as provided by the Health Insurance Portability and Accountability Act.
   c.  A provider shall not be compelled by subpoena, court order, or other process of law to access health information through the health information exchange in order to gather records or information not created by the provider.
   5.
  a.  If a patient has declined participation in the health information exchange, the patient’s health information may be released to a provider through the health information exchange if all of the following circumstances exist:
   (1)  The patient is unable to provide consent due to incapacitation.
   (2)  The requesting provider believes, in good faith, that the information is necessary to prevent imminent serious injury to the patient. Imminent serious injury includes but it not limited to death, injury or disease that creates a substantial risk of death, or injury or disease that causes protracted loss or impairment of any organ or body system.
   (3)  Such information cannot otherwise be readily obtained.
   b.  The department shall provide by rule for the reporting of emergency access and use by a provider.
   6.
  All participants exchanging health information and data through the health information exchange shall grant to participants of the health information exchange a nonexclusive license to retrieve and use that information or data in accordance with applicable state and federal laws, and the policies, procedures, and rules established by the board.
   7.  The department shall establish by rule the procedures for a patient who is the subject of health information to do all of the following:
   a.  Receive notice of a violation of the confidentiality provisions required under this chapter.
   b.  Upon request to the department, view an audit report created under this chapter for the purpose of monitoring access to the patient’s records.
   8.
  a.  A provider who relies in good faith upon any health information provided through the health information exchange in treatment of a patient shall be immune from criminal or civil liability arising from any damages caused by such good faith reliance. Such immunity shall not apply to acts or omissions constituting gross negligence, recklessness, or intentional misconduct.
   b.  A participant that has disclosed health information through the health information exchange in compliance with applicable law and the standards, requirements, policies, procedures, and agreements of the health information exchange shall not be subject to criminal or civil liability for the use or disclosure of the health information by another participant.
   9.
  a.  Notwithstanding chapter 22, the following records shall be kept confidential, unless otherwise ordered by a court or consented to by the patient or by a person duly authorized to release such information:
   (1)  The protected health information contained in, stored in, submitted to, transferred or exchanged by, or released from the health information exchange.
   (2)  Any protected health information in the possession of Iowa e-health or the department due to its administration of the health information exchange.
   b.  Unless otherwise provided in this chapter, when using the health information exchange for the purpose of patient treatment, a provider is exempt from any other state law that is more restrictive than the Health Insurance Portability and Accountability Act that would otherwise prevent or hinder the exchange of patient information by the patient’s providers.
   Sec. 9.  NEW SECTION.  135D.9  Iowa e-health —— health information exchange services.
   Iowa e-health shall facilitate services through the health information exchange or through other marketplace mechanisms to improve the quality, safety, and efficiency of health care available to consumers. These services shall include but are not limited to all of the following:
   1.  Patient summary records such as continuity of care documents.
   2.  A provider directory and provider messaging.
   3.  Clinical orders and results.
   4.  Public health reporting such as electronic reporting to the statewide immunization registry and reportable diseases.
   5.  Medication history.
   Sec. 10.  NEW SECTION.  135D.10  Governance review and transition.
   1.
  a.  The Iowa e-health governance structure shall continue during the term of the state health information exchange cooperative agreement with the office of the national coordinator for health information technology to address the development of policies and procedures; dissemination of interoperability standards; the initiation, testing, and operation of the health information exchange infrastructure; and the evolution of health information exchange services to improve patient care for the population.
   b.  During the final year of the term of the cooperative agreement, the board and the department shall review the Iowa e-health governance structure, operations of the health information exchange, and the business and sustainability plan to determine if the existing Iowa e-health governance structure should continue or should be replaced by any of the following:
   (1)  A public authority or similar body with broad stakeholder representation on its governing board.
   (2)  A not-for-profit entity with broad stakeholder representation on its governing board.
   2.  If the board and department determine that the governance structure should be replaced, Iowa e-health shall develop a transition plan to transfer the responsibilities for the domains specified in section 135D.3.
   Sec. 11.  Section 136.3, subsection 14, Code 2011, is amended to read as follows:
   14.  Perform those duties authorized pursuant to sections 135.156, 135.159, and 135.161, and other provisions of law.
   Sec. 12.  Section 249J.14, subsection 2, paragraphs a and b, Code 2011, are amended to read as follows:
   a.  Design and implement a program for distribution and monitoring of provider incentive payments, including development of a definition of“meaningful use” for purposes of promoting the use of electronic medical recordkeeping by providers. The department shall develop this program in collaboration with the department of public health and the electronic health information advisory council and executive committee board of directors and the advisory council to the board of Iowa e-health created pursuant to section 135.156 135D.4.
   b.  Develop the medical assistance health information technology plan as required by the centers for Medicare and Medicaid services of the United States department of health and human services. The plan shall provide detailed implementation plans for the medical assistance program for promotion of the adoption and meaningful use of health information technology by medical assistance providers and the Iowa Medicaid enterprise. The plan shall include the integration of health information technology and health information exchange with the medical assistance management information system. The plan shall be developed in collaboration with the department of public health and the electronic health information advisory council and executive committee board of directors and the advisory council to the board of Iowa e-health created pursuant to section 135.156 135D.4.
   Sec. 13.  INITIAL APPOINTMENTS —— BOARD.
   1.  The initial appointments of board member positions described in section 135D.4, as enacted by this Act, shall have staggered terms as follows:
   a.  The three board members appointed by the governor shall have an initial term of two years, after which the members shall serve four-year terms, subject to the following:
   (1)  The terms shall begin and end as provided in section 69.19.
   (2)  Board members appointed by the governor when the senate is not in session shall serve only until the end of the next regular session of the general assembly, unless and until confirmed by the senate.
   b.  The board member designated by the Iowa pharmacy association and the at-large board member, if appointed by the board, shall have initial terms of two years, after which the members shall serve four-year terms.
   c.  The board members designated by the Iowa hospital association, the Iowa medical society, the Iowa osteopathic medical association, the Iowa nurses association, the Iowa collaborative safety net provider network, and the Iowa behavioral health association shall have initial terms of four years, after which the members shall serve four-year terms.
   d.  The board members designated by the federation of Iowa insurers shall serve initial terms of six years, after which the members shall serve four-year terms.
   2.  With the exception of members not subject to term limits as provided in section 135D.4, board members may serve an additional four-year term, with the exception of those board members initially serving a two-year term, who may serve two consecutive four-year terms following the initial two-year term.
   Sec. 14.  REPEAL.  Sections 135.154, 135.155, and 135.156, Code 2011, are repealed.
   Sec. 15.  TRANSITION PROVISIONS.  Notwithstanding any other provision of this Act, the department of public health, and the executive committee and the advisory council created pursuant to section 135.156, shall continue to exercise the powers and duties specified under that section until such time as all board members have been appointed as provided in section 135D.4, as enacted by this Act.
   Sec. 16.  EFFECTIVE DATE.  The sections of this Act repealing sections 135.154, 135.155, and 135.156, and amending sections 136.3 and 249J.14, take effect on the date all board members are appointed as provided in section 135D.4, as enacted by this Act. The department of public health shall notify the Code editor of such date.
   Sec. 17.  EFFECTIVE UPON ENACTMENT.  Except as otherwise provided in this Act, this Act, being deemed of immediate importance, takes effect upon enactment.
EXPLANATION
   This bill relates to health information technology. The bill provides legislative intent and findings and definitions for the new Code chapter 135D.
   The bill provides for the establishment of Iowa e-health as a public-private, multi-stakeholder collaborative to develop, administer, and sustain an exclusive statewide health information exchange; provides principles and goals of Iowa e-health; and describes the five domains that provide for the structuring of Iowa e-health.
   The bill provides for the governance of Iowa e-health. The bill establishes a board of directors representing consumers, business, health care provider associations and providers, payers, and state government. The bill provides for appointment of members, terms of service, restrictions for membership, powers of the board, board meetings, and provisions relating to ethics and conflicts of interest. The bill also directs the board to appoint an advisory council, specifies the membership of the advisory council, and allows the board to change the number and composition of the members of the advisory council by rule based upon the changes in and evolution of health information technology, the health information exchange, and the services provided.
   The bill provides for the establishment of an office of health information technology in the department of public health, provides that the office is to be managed by an executive director, and specifies the duties of the department relative to the office.
   The bill creates an Iowa e-health finance fund within the state treasury, under the control of the board. All fees collected or revenues arising from the operation and administration of the health information exchange and its services are to be deposited into the fund and the funds are to be used to establish, operate, and sustain the health information exchange and its services.
   The bill specifies the technical infrastructure of the health information exchange to be designed to facilitate the secure electronic exchange of health information. The bill provides that the state has ownership or possesses the rights to use all processes and software developed, and hardware installed, designed, leased, or purchased for the health information exchange.
   The bill directs the office, with approval from the board, to establish appropriate security standards, policies, and procedures to protect the transmission and receipt of individually identifiable health information exchanged through the health information exchange and provides that each patient may choose to decline participation in the health information exchange, but may later choose to participate or, if the patient initially participates, may later decline to participate. The bill provides that participants shall grant to participants of the health information exchange a nonexclusive license to retrieve and use that information and data in accordance with applicable laws, rules, regulations, and policies.
   The bill provides for immunity from civil and criminal liability arising from any damages caused by good faith reliance on health information provided through the health information exchange, but does not protect the provider from acts or omissions constituting gross negligence, recklessness, or intentional misconduct. A participant who discloses health information through the health information exchange in compliance with laws, rules, regulations, policies, and agreements is not subject to criminal or civil liability for the use or disclosure of the health information by another participant.
   The bill provides for sharing of information in accordance with other laws, including Code chapter 22 (open records) and the federal Health Insurance Portability and Accountability Act. The bill provides for governance review and consideration of the transition of the governing body during the final year of the term of the cooperative agreement with the office of the national coordinator for health information technology and directs the board to adopt rules for implementing the Code chapter.
   The bill provides for initial staggered-term appointments to the board.
   The bill takes effect upon enactment, but provides that the executive committee and advisory council for health information technology existing under current law are to continue until all board members are appointed for Iowa e-health. The bill repeals the current law when all board members are appointed and directs the department to notify the Code editor of the date of repeal.