HF 488 (LSB 2216HV (3) 89)

HOUSE FILE 488

BY  COMMITTEE ON HUMAN RESOURCES

(SUCCESSOR TO HSB 141)

A BILL FOR

An Act relating to health-related data including hospital data and certain information included in reportable disease reports.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 11.41, subsection 3, Code 2021, is amended to read as follows:
   3.  If the information, records, instrumentalities, and properties sought by the auditor of state are required by law to be kept confidential, the auditor of state shall have access to the information, records, instrumentalities, and properties, but shall maintain the confidentiality of all such information and is subject to the same penalties as the lawful custodian of the information for dissemination of the information. However, the auditor of state shall not have access to the income tax returns of individuals or to an individual’s name or residential address from a reportable disease report under section 139A.3.
    Sec. 2.  Section 135.166, subsection 2, Code 2021, is amended to read as follows:
   2.  Unless otherwise authorized or required by state or federal law, data collected under this section shall not include the social security number or name of the individual subject of the data.
    Sec. 3.  Section 139A.3, Code 2021, is amended by adding the following new subsection:
   NEW SUBSECTION.  1A.  A state or local agency employee or agent shall not have access to personally identifiable information included in a reportable disease report provided to or maintained by the department, a local board, or a local department, unless the employee or agent has completed data confidentiality training.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to health-related data protections.
   The bill provides that the auditor of state shall not have access to an individual’s name or residential address from a reportable disease report.
   The bill includes provisions related to health data collected and used by the department of public health (DPH). Current law directs DPH to enter into a memorandum of understanding with a contractor selected through a request for proposals process to collect, maintain, and disseminate hospital inpatient, outpatient, and ambulatory data. Current law also provides that unless otherwise authorized by state or federal law, the data collected shall not include the social security number of the individual subject of the data. Under the bill, data prohibited from collection would also include the name of the individual subject of the data.
   The bill also prohibits a state or local agency employee or agent from having access to personally identifiable information included in a reportable disease report provided to or maintained by the department of public health, a local board of health, or a local public health department, unless the employee or agent has completed data confidentiality training.