HF 2623 (LSB 5482HV (4) 90)

HOUSE FILE 2623

BY  COMMITTEE ON HEALTH AND HUMAN SERVICES

(SUCCESSOR TO HSB 623)

A BILL FOR

An Act relating to the Iowa health information network including functioning as the state-designated health data utility.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  Section 135D.2, Code 2024, is amended to read as follows:
   135D.2  Definitions.
   As used in this chapter, unless the context otherwise requires:
   1.  “Board of directors” or “board” means the entity that governs and administers the Iowa health information network. 
   2.  1.  “Care coordination” means the management of all aspects of a patient’s care to improve health care quality. 
   2.  “Community information exchange” means an ecosystem comprised of multidisciplinary network participants that use standardized technical language, a resource database, and an integrated technology platform to deliver enhanced community care planning using care planning tools that enable participants to integrate data from multiple sources and make bidirectional referrals to create a shared longitudinal record.
   3.  “Department” means the department of health and human services.
   4.  “Designated entity” means the nonprofit corporation designated by the department through a competitive process as the entity responsible for administering and governing the Iowa health information network.
   5.  “Exchange” means the authorized electronic sharing of health information and data between health care professionals, payors, consumers, public health agencies, the designated entity, the department, and other authorized participants utilizing the Iowa health information network and Iowa health information network services.
   6.  “Federally qualified health center” means a health care entity that receives grant funding under section 330 of the federal Public Health Service Act, Pub. L. No. 78-410.
   7.  “Governing board” means the board of directors that governs and administers the designated entity.
   6.  8.  “Health care professional” means a person who is licensed, certified, or otherwise authorized or permitted by the law of this state to administer health care in the ordinary course of business or in the practice of a profession.
   9.  “Health data utility” means a locally governed, statewide, multifaceted resource that provides services for the interchange of health data within the health care and public health ecosystems for the purpose of advancing health care and improving public health outcomes. A “health data utility” combines, enhances, and exchanges electronic health data across care and service settings for treatment, care coordination, quality improvement, and public and community health purposes, in accordance with applicable state and federal laws protecting patient privacy.
   7.  10.  “Health information” means health information as defined in 45 C.F.R. §160.103 that is created or received by an authorized a participant.
   11.  “Health information exchange” means participants contributing to the sharing and movement of health information electronically across participants within a state, region, community, or health care delivery system.
   12.  “Health information network” means participants in the health information exchange in the aggregate.
   8.  13.  “Health information technology” means the application of information processing, involving both computer hardware and software, that deals with the storage, retrieval, sharing, and use of health care information, data, and knowledge for communication, decision making, quality, safety, and efficiency of clinical practice, and may include but is not limited to:
   a.  An electronic health record that electronically compiles and maintains health information that may be derived from multiple sources about the health status of an individual and may include a core subset of each care delivery organization’s electronic medical record such as a continuity of care record or a continuity of care document, computerized physician order entry, electronic prescribing, or clinical decision support.
   b.  A personal health record through which an individual and any other person authorized by the individual can maintain and manage the individual’s health information. 
   c.  An electronic medical record that is used by health care professionals to electronically document, monitor, and manage health care delivery within a care delivery organization, is the legal record of the patient’s encounter with the care delivery organization, and is owned by the care delivery organization. 
   d.  A computerized provider health care professional order entry function that permits the electronic ordering of diagnostic and treatment services, including prescription drugs. 
   e.  A decision support function to assist physicians and other health care providers professionals in making clinical decisions by providing electronic alerts and reminders to improve compliance with best practices, promote regular screenings and other preventive practices, and facilitate diagnosis and treatments treatment.
   f.  Tools to allow for the collection, analysis, and reporting of information or data on adverse events, the quality and efficiency of care, patient satisfaction, and other health care-related performance measures. 
   9.  14.  “Health Insurance Portability and Accountability Act” or “HIPAA” means the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, including amendments thereto and regulations promulgated thereunder.
   10.  15.  “Hospital” means a licensed hospital as defined in section 135B.1.
   11.  16.  “Interoperability” means the ability of two or more systems or components to exchange information or data in an accurate, effective, secure, and consistent manner and to use the information or data that has been exchanged and includes but is not limited to:
   a.  The capacity to connect to a network for the purpose of exchanging information or data with other users.
   b.  The ability of a connected, authenticated user participant to demonstrate appropriate permissions to participate in the instant transaction over the network. 
   c.  The capacity of a connected, authenticated user participant to access, transmit, receive, and exchange usable information with other users participants.
   12.  17.  “Iowa health information network” or “network” means the statewide health information technology network that is the sole statewide health information network for Iowa pursuant to this chapter.
   13.  18.  “Medicaid program” means the medical assistance program as defined in section 249A.2.
   19.  “Nursing facility” means a licensed nursing facility as defined in section 135C.1.
   14.  20.  “Participant” means an authorized health care professional, payor, patient, health care organization, public health agency, or the department entity described in section 135D.4, subsection 4, paragraph “d”, that has agreed entered into an agreement to authorize, submit, access, or disclose health information and data through the Iowa health information network in accordance with this chapter and all applicable laws, rules, agreements, policies, and standards.
   15.  21.  “Patient” means a person who has received or is receiving health services from a health care professional. 
   16.  22.  “Payor” means a person who makes payments for health services, including but not limited to an insurance company, self-insured employer, government program, individual, or other purchaser that makes such payments.
   23.  “Payor information exchange” means a large-scale database that systematically collects health care claims data from a variety of payor sources, including claims from health care professionals.
   24.  “Pharmacy” means a pharmacy as defined in section 155A.3.
   25.  “Pharmacy information exchange” means the participants contributing to the sharing and movement of dispensed pharmacy information electronically across participants within a state, region, community, or health care delivery system.
   17.  26.  “Protected health information” means protected health information as defined in 45 C.F.R. §160.103 that is created or received by an authorized a participant.
   18.  27.  “Public health activities” means actions taken by a participant in its the participant’s capacity as a public health authority under the Health Insurance Portability and Accountability Act or as required or permitted by other federal or state law.
   19.  28.  “Public health agency” means an entity that is governed by or contractually responsible to a local board of health or the department to provide services focused on the health status of population groups and their the population groups’ environments. 
   20.  29.  “Record locator service” means the functionality of the Iowa health information network that queries data sources to locate and identify potential patient records.
   30.  “Rehabilitative services” means the same as defined in section 135C.1.
   31.  “Social care” means any care, service, good, or supply related to an individual’s social needs. “Social care” includes but is not limited to support and assistance for an individual’s food stability and nutritional needs, housing, transportation, economic stability, employment, education access and quality, child care and family relationship needs, and environmental and physical safety.
   32.  “Social care referral system” means a system that shares an individual’s social care information for the purpose of referrals among health care entities, public health agencies, and community-based organizations. “Social care referral system” includes but is not limited to a network, software, or technology platform.
    Sec. 2.  Section 135D.3, subsection 1, paragraph c, Code 2024, is amended to read as follows:
   c.  A health information network involves the secure electronic sharing of health information across the boundaries of individual practice and institutional health settings and with consumers. The broad use of health information technology and a health information network should improve improves health care quality and the overall health of the population, increase increases efficiencies in administrative health care, reduce reduces unnecessary health care costs, and help helps prevent medical errors.
    Sec. 3.  Section 135D.4, Code 2024, is amended to read as follows:
   135D.4  Iowa health information network —— principles —— technical infrastructure requirements —— function as state-designated health data utility.
   1.  The Iowa health information network shall be administered and governed by a designated entity using, at a minimum, the following principles:
   a.  Be patient-centered and market-driven.
   b.  Comply with established national standards.
   c.  Protect the privacy of consumers and the security and confidentiality of all health information.
   d.  Promote interoperability.
   e.  Increase the accuracy, completeness, and uniformity of data.
   f.  Preserve the choice of the patient to have the patient’s health information available through the record locator service.
   g.  Provide education to the general public and provider communities on the value and benefits of health information technology. 
   2.  Widespread adoption of health information technology is critical to a successful Iowa health information network and is best achieved when all of the following occur:
   a.  The network, through the designated entity complying with chapter 504 and reporting as required under this chapter, operates in an entrepreneurial and businesslike manner in which it is accountable to all participants utilizing the network’s products and services.
   b.  The network provides a variety of services from which to choose in order to best fit the needs of the user participant.
   c.  The network is financed by all who benefit from the improved quality, efficiency, savings, and other benefits that result from use of health information technology.
   d.  The network is operated with integrity and freedom from political influence.
   3.  The Iowa health information network technical infrastructure shall provide a mechanism for all of the following:
   a.  The facilitation and support of the secure electronic exchange of health information between participants. 
   b.  Participants The opportunity for the participants without an electronic health records system to access health information from the Iowa health information network.
   4.  a.  Beginning July 1, 2024, the Iowa health information network shall function as the state-designated health data utility or state-designated HDU, operated and governed by the designated entity. The state-designated HDU shall operate as a public-private partnership to facilitate the secure electronic sharing of health information and data across a variety of settings including health care delivery settings, payors, social care entities, and consumers.
   (1)  The state-designated HDU is designed to achieve better health care outcomes, improve the overall health and well-being of the people of the state, and reduce the cost of health care by creating a more seamless, transparent, and modernized approach to the sharing of health information and data.
   (2)  Utilization of health information and data requires appropriate governance and policy leadership. The state-designated HDU provides clear data governance, privacy, and security policies to facilitate the sharing of health information and data, ensuring that the health information and data follow the patient and improve the health of all citizens of the state.
   (3)  Health care professionals and entities have been subject to HIPAA since 1996, and HIPAA has driven initial efforts to develop a culture and infrastructure of health information governance. As holders of personal information, state agencies have a responsibility to demonstrate to the public the state’s commitment to respecting personal privacy.
   (4)  Health care entities have a duty to share health information and data, in accordance with applicable law, with other health care entities to ensure that optimal patient and population health is achieved. To further demonstrate the commitment to privacy, the state-designated HDU provides opt-out policies and procedures to allow patients to opt out of health information and data sharing.
   b.  The purposes of the state-designated HDU include all of the following:
   (1)  The transmittal, collection, aggregation, and analysis of clinical information, public health data, and health administrative and operations data to assist the department, local health departments, health care professionals, patients, policymakers, and the governing board in understanding the population health of Iowa.
   (2)  The enhancement and acceleration of the interoperability of health information and data throughout the state, ensuring compliance with all applicable privacy and security laws and regulations.
   (3)  The empowerment of patients in accessing and directing their health information and data, health care costs, and overall health to improve quality of life in the state.
   c.  The state-designated HDU shall provide health information and data, in accordance with applicable law, to patients and organizations involved in the treatment and care coordination of patients, and shall support the health goals of the community and the state. The state-designated HDU shall be comprised of all of the following data sources:
   (1)  A health information exchange. The governing board shall adopt health care information interoperability standards for the health information exchange. The minimum standard of sharing shall be the most recently approved version of the United States core data of interoperability. The minimum standard of sharing may be enhanced by the governing board.
   (2)  A pharmacy information exchange.
   (a)  Unless otherwise prohibited by state or federal law, each licensed pharmacy that dispenses prescription drugs to patients in the state shall provide all dispensed prescription information to the state-designated HDU in compliance with all applicable state and federal rules.
   (b)  The governing board shall adopt interoperability standards, data elements, and terminologies necessary to provide data in as close to real time as possible to facilitate data exchange.
   (3)  A payor information exchange. The governing board shall adopt the interoperability standards for claims data sharing by all payors required to share data.
   (4)  A community information exchange. The governing board shall adopt the interoperability standards for data sharing by social care entities specified by the governing board.
   d.  (1)  By December 31, 2024, all hospitals, critical access hospitals, general acute care hospitals, and rehabilitative hospitals in the state shall be participants with the state-designated HDU, and shall share all data in accordance with standards, policies, and procedures adopted by the governing board pursuant to this chapter.
   (2)  By December 31, 2025, all provider clinics, ambulatory surgical centers, mental health and substance use treatment centers, psychiatric or mental hospitals, facilities providing rehabilitative services, imaging centers, laboratories, federally qualified health centers, and payors in the state shall be participants with the state-designated HDU, and shall share all data in accordance with standards, policies, and procedures adopted by the governing board pursuant to this chapter.
   (3)  By December 31, 2025, all health clinics, public health clinics, urgent care facilities, nursing facilities, and pharmacies shall be participants with the state-designated HDU, and shall share all data in accordance with policies and procedures adopted by the governing board pursuant to this chapter.
   (4)  By December 31, 2028, all entities utilizing digital technology for the purposes of social care referral and care coordination in the state, including but not limited to community-based organizations, shall be participants with the state-designated HDU, and shall share data in accordance with federal interoperability guidance and policies adopted by the governing board pursuant to this chapter.
   e.  Any entity specified in paragraph “d” that does not own or has not contracted for an electronic records management system or service on or before July 1, 2024, shall not be required to purchase or contract for an electronic records management system or service in order to comply with paragraph “d”.
   f.  Paragraph “d” shall not apply to any of the following:
   (1)  A facility or institution controlled, managed, directed, or operated under the jurisdiction of the department of health and human services, including the state mental health institutes.
   (2)  Medicaid fee-for-service programs under the Medicaid program.
   4.  5.  Nothing in this chapter shall be interpreted to impede or preclude the formation and operation of regional, population-specific, or local health information networks or the participation of such networks in the Iowa health information network.
   6.  The Iowa health information network shall not constitute a health benefit network or a health insurance network.
    Sec. 4.  Section 135D.5, Code 2024, is amended to read as follows:
   135D.5  Designated entity —— selection, administration, and governance.
   1.  The Iowa health information network shall be administered and governed by a designated entity selected by the department through a competitive process. The designated entity shall be established as a nonprofit corporation organized under chapter 504. Unless otherwise provided in this chapter, the corporation is subject to the provisions of chapter 504. The designated entity shall be established for the purpose of administering and governing the statewide Iowa health information network.
   2.  The designated entity shall collaborate with the department, but the designated entity shall not be considered, in whole or in part, an agency, department, or administrative unit of the state.
   a.  The designated entity shall not be required to comply with any requirements that apply to a state agency, department, or administrative unit and shall not exercise any sovereign power of the state.
   b.  The designated entity does not have authority to pledge the credit of the state. The assets and liabilities of the designated entity shall be separate from the assets and liabilities of the state and the state shall not be liable for the debts or obligations of the designated entity. All debts and obligations of the designated entity shall be payable solely from the designated entity’s funds. The state shall not guarantee any obligation of or have any obligation to the designated entity.
   3.  The articles of incorporation of the designated entity shall provide for its the designated entity’s governance and its efficient management. In providing for its the designated entity’s governance, the articles of incorporation of the designated entity shall address the following:
   a.  A governing board of directors to govern the designated entity.
   b.  The appointment of a chief executive officer by the governing board to manage the designated entity’s daily operations.
   c.  The delegation of such powers and responsibilities to the chief executive officer as may be necessary for the designated entity’s efficient operation.
   d.  The employment of personnel necessary for the efficient performance of the duties assigned to the designated entity. All such personnel shall be considered employees of a private, nonprofit corporation and shall be exempt from the personnel requirements imposed on state agencies, departments, and administrative units.
   e.  The financial operations of the designated entity including the authority to receive and expend funds from public and private sources and to use its property, money, or other resources for the purpose of the designated entity.
    Sec. 5.  Section 135D.6, Code 2024, is amended to read as follows:
   135D.6  Board of directors Governing board —— composition —— duties.
   1.  The designated entity shall be administered by a governing board of directors.
   2.  A single industry shall not be disproportionately represented as voting members of the governing board. The governing board shall include at least one member who is a consumer of health services and a majority of the voting members of the governing board shall be representative of participants in the Iowa health information network. The director of health and human services or the director’s designee and the director of the Medicaid program or the director’s designee shall act as voting members of the governing board. The commissioner of insurance shall act as an ex officio, nonvoting member of the governing board. Individuals serving in an ex officio, nonvoting capacity shall not be included in the total number of individuals authorized as members of the governing board.
   3.  The governing board of directors shall do all of the following:
   a.  Ensure that the designated entity enters into contracts with each state agency necessary for state reporting requirements.
   b.  Develop, implement, and enforce the following:
   (1)  A single patient identifier or alternative mechanism to share secure patient health information and data that is utilized by all health care professionals.
   (2)  Standards, requirements, policies, and procedures for access to, use, secondary use, privacy, and security of health information and data, including clinical information, exchanged through the Iowa health information network, consistent with applicable federal and state standards and laws. 
   c.  Direct a public and private collaborative effort to promote the adoption and use of health information technology in the state to improve health care quality, increase patient safety, reduce health care costs, enhance public health, and empower individuals and health care professionals with comprehensive, real-time medical information to provide continuity of care and make the best health care decisions. 
   d.  Educate the public and the health care sector about the value of health information technology in improving patient care, and methods to promote increased support and collaboration of state and local public health agencies, health care professionals, and consumers in health information technology initiatives. 
   e.  Work to align interstate and intrastate interoperability standards in accordance with national health information exchange standards.
   f.  Provide an annual budget and fiscal report for the Iowa health information network to the governor, the department of health and human services, the department of management, the chairs and ranking members of the legislative government oversight standing committees, and the legislative services agency. The report shall also include information about the services provided through the network and information on the participant usage of the network. 
   g.  Ensure any health information and data within the Iowa health information network is shared and accessed according to all applicable state and federal laws and standards, including HIPAA, to uphold the privacy and security of a patient’s protected health information.
    Sec. 6.  Section 135D.7, Code 2024, is amended to read as follows:
   135D.7  Legal and policy —— liability —— confidentiality.
   1.  The governing board shall implement industry-accepted security standards, policies, and procedures to protect the transmission and receipt of protected health information and data exchanged through the Iowa health information network, which shall, at a minimum, comply with HIPAA and shall include all of the following:
   a.  A secure and traceable electronic audit system to document and monitor the sender and recipient of health information exchanged through the Iowa health information network.
   b.  A required standard participation agreement which defines the minimum privacy and security obligations of all participants using the Iowa health information network and services available through the Iowa health information network. 
   c.  The opportunity for a patient to decline exchange of the patient’s health information or data through the record locator service of the Iowa health information network. 
   (1)  A patient shall not be denied care or treatment for declining to exchange the patient’s health information or data, in whole or in part, through the network.
   (2)  The governing board shall provide the means and process by which a patient may decline participation. The means and process utilized shall minimize the burden on patients and health care professionals.
   (3)  Unless otherwise authorized by law or rule, a patient’s decision to decline participation means that none of the patient’s health information or data shall be accessible through the record locator service function of the Iowa health information network. A patient’s decision to decline having health information or data shared through the record locator service function shall not limit a health care professional with whom the patient has or is considering a treatment relationship from sharing health information concerning the patient through the secure messaging function of the Iowa health information network.
   (4)  A patient who declines participation in the Iowa health information network may later decide to have the patient’s health information or data shared through the network. A patient who is participating in the network may later decline participation in the network.
   2.  A participant shall not be compelled by subpoena, court order, or other process of law to access health information or data through the Iowa health information network in order to gather records or information not created by the participant. 
   3.  A participant exchanging health information and data through the Iowa health information network shall grant to other participants of the network a nonexclusive license to retrieve and use that health information or data in accordance with applicable state and federal laws, and the policies and standards established by the governing board.
   4.  A health care professional who relies reasonably and in good faith upon any health information or data provided through the Iowa health information network in the treatment of a patient who is the subject of the health information or data shall be immune from criminal or civil liability arising from the damages caused by such reasonable, good-faith reliance. Such immunity shall not apply to acts or omissions constituting negligence, recklessness, or intentional misconduct.
   5.  A participant who has disclosed health information or data through the Iowa health information network in compliance with applicable law and the standards, requirements, policies, procedures, and agreements of the Iowa health information network shall not be subject to criminal or civil liability for the use or disclosure of the health information or data by another participant.
   6.  The following records shall be confidential records pursuant to chapter 22, unless otherwise ordered by a court or consented to by the patient or by a person duly authorized to release such information:
   a.  The health information contained in, stored in, submitted to, transferred or exchanged by, or released from the Iowa health information network. 
   b.  Any health information or data in the possession of the governing board due to its administration and governance of the Iowa health information network.
   7.  Unless otherwise provided in this chapter, when sharing health information or data through the Iowa health information network or through a private health information network maintained in this state that complies with the privacy and security requirements of this chapter for the purposes of patient treatment, payment or health care operations, as such terms are defined in HIPAA, or for the purposes of public health activities or care coordination, a participant authorized by the designated entity to use the record locator service is exempt from any other state law that is more restrictive than HIPAA that would otherwise prevent or hinder the exchange of patient information or data by the participant. 
   8.  A patient aggrieved or adversely affected by the designated entity’s failure to comply with subsection 1, paragraph “c”, may bring a civil action for equitable relief as the court deems appropriate.
    Sec. 7.  NEW SECTION.  135D.8  Funding.
   The department may expend funds appropriated to or received by the department for the purposes of this chapter to carry out the requirements of this chapter.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to the Iowa health information network (IHIN) under Code chapter 135D (Iowa health information network) and the functioning of the IHIN as a state-designated health data utility (state-designated HDU).
   The bill includes definitions used in the bill.
   The bill requires the designated entity to administer and govern the IHIN and thereby, also operate and govern the state-designated HDU for the state. “Health data utility” is defined under the bill as a locally governed, multifaceted resource that provides services for the interchange of health data within the health care and public health ecosystems for the purpose of advancing health care and improving public health outcomes. A “health data utility” combines, enhances, and exchanges electronic health data across care and service settings for treatment, care coordination, quality improvement, and public and community health purposes, in accordance with applicable state and federal laws protecting patient privacy.
   The bill provides the principles, purposes, and composition requirements for the state-designated HDU, including that the state-designated HDU include information and data from a health information exchange, a pharmacy information exchange, a payor information exchange, and a community information exchange.
   The bill requires certain entities to participate with the state-designated HDU by specified dates.
   The bill provides that the department of health and human services (HHS) may expend funds appropriated to or received by HHS for the purposes of the bill to carry out the requirements of the bill.