S.F. _____ H.F. _____ DIVISION I 1 IOWA HEALTH INFORMATION NETWORK —— FUTURE ADMINISTRATION BY 2 DESIGNATED ENTITY 3 Section 1. NEW SECTION . 135D.1 Short title. 4 This chapter shall be known and may be cited as the “Iowa 5 Health Information Network Act” . 6 Sec. 2. NEW SECTION . 135D.2 Definitions. 7 As used in this chapter, unless the context otherwise 8 requires: 9 1. “Board of directors” or “board” means the entity that 10 governs and administers the Iowa health information network. 11 2. “Care coordination” means the management of all aspects 12 of a patient’s care to improve health care quality. 13 3. “Department” means the department of public health. 14 4. “Designated entity” means the nonprofit corporation 15 designated by the department through a competitive process as 16 the entity responsible for administering and governing the Iowa 17 health information network. 18 5. “Exchange” means the authorized electronic sharing of 19 health information between health care professionals, payors, 20 consumers, public health agencies, the designated entity, the 21 department, and other authorized participants utilizing the 22 Iowa health information network and Iowa health information 23 network services. 24 6. “Health care professional” means a person who is 25 licensed, certified, or otherwise authorized or permitted by 26 the law of this state to administer health care in the ordinary 27 course of business or in the practice of a profession. 28 7. “Health information” means health information as defined 29 in 45 C.F.R. §160.103 that is created or received by an 30 authorized participant. 31 8. “Health information technology” means the application 32 of information processing, involving both computer hardware 33 and software, that deals with the storage, retrieval, sharing, 34 and use of health care information, data, and knowledge for 35 -1- LSB 1221XD (8) 86 pf/nh 1/ 16

S.F. _____ H.F. _____ communication, decision making, quality, safety, and efficiency 1 of clinical practice, and may include but is not limited to: 2 a. An electronic health record that electronically compiles 3 and maintains health information that may be derived from 4 multiple sources about the health status of an individual and 5 may include a core subset of each care delivery organization’s 6 electronic medical record such as a continuity of care record 7 or a continuity of care document, computerized physician order 8 entry, electronic prescribing, or clinical decision support. 9 b. A personal health record through which an individual and 10 any other person authorized by the individual can maintain and 11 manage the individual’s health information. 12 c. An electronic medical record that is used by health care 13 professionals to electronically document, monitor, and manage 14 health care delivery within a care delivery organization, is 15 the legal record of the patient’s encounter with the care 16 delivery organization, and is owned by the care delivery 17 organization. 18 d. A computerized provider order entry function that permits 19 the electronic ordering of diagnostic and treatment services, 20 including prescription drugs. 21 e. A decision support function to assist physicians and 22 other health care providers in making clinical decisions by 23 providing electronic alerts and reminders to improve compliance 24 with best practices, promote regular screenings and other 25 preventive practices, and facilitate diagnosis and treatments. 26 f. Tools to allow for the collection, analysis, and 27 reporting of information or data on adverse events, the quality 28 and efficiency of care, patient satisfaction, and other health 29 care-related performance measures. 30 9. “Health Insurance Portability and Accountability Act” 31 or “HIPAA” means the federal Health Insurance Portability and 32 Accountability Act of 1996, Pub. L. No. 104-191, including 33 amendments thereto and regulations promulgated thereunder. 34 10. “Hospital” means a licensed hospital as defined in 35 -2- LSB 1221XD (8) 86 pf/nh 2/ 16

S.F. _____ H.F. _____ section 135B.1. 1 11. “Interoperability” means the ability of two or more 2 systems or components to exchange information or data in an 3 accurate, effective, secure, and consistent manner and to use 4 the information or data that has been exchanged and includes 5 but is not limited to: 6 a. The capacity to connect to a network for the purpose of 7 exchanging information or data with other users. 8 b. The ability of a connected, authenticated user to 9 demonstrate appropriate permissions to participate in the 10 instant transaction over the network. 11 c. The capacity of a connected, authenticated user to 12 access, transmit, receive, and exchange usable information with 13 other users. 14 12. “Iowa health information network” or “network” means the 15 statewide health information technology network that is the 16 sole statewide network for Iowa pursuant to this chapter. 17 13. “Iowa Medicaid enterprise” means the centralized 18 medical assistance program infrastructure, based on a business 19 enterprise model, and designed to foster collaboration among 20 all program stakeholders by focusing on quality, integrity, and 21 consistency. 22 14. “Participant” means an authorized health care 23 professional, payor, patient, health care organization, public 24 health agency, or the department that has agreed to authorize, 25 submit, access, or disclose health information through the Iowa 26 health information network in accordance with this chapter 27 and all applicable laws, rules, agreements, policies, and 28 standards. 29 15. “Patient” means a person who has received or is 30 receiving health services from a health care professional. 31 16. “Payor” means a person who makes payments for health 32 services, including but not limited to an insurance company, 33 self-insured employer, government program, individual, or other 34 purchaser that makes such payments. 35 -3- LSB 1221XD (8) 86 pf/nh 3/ 16

S.F. _____ H.F. _____ 17. “Protected health information” means protected health 1 information as defined in 45 C.F.R. §160.103 that is created or 2 received by an authorized participant. 3 18. “Public health activities” means actions taken by a 4 participant in its capacity as a public health authority under 5 the Health Insurance Portability and Accountability Act or as 6 required or permitted by other federal or state law. 7 19. “Public health agency” means an entity that is governed 8 by or contractually responsible to a local board of health or 9 the department to provide services focused on the health status 10 of population groups and their environments. 11 20. “Record locator service” means the functionality of the 12 Iowa health information network that queries data sources to 13 locate and identify potential patient records. 14 Sec. 3. NEW SECTION . 135D.3 Iowa health information network 15 —— findings and intent. 16 1. The general assembly finds all of the following: 17 a. Technology used to support health care-related functions 18 is known as health information technology. Health information 19 technology provides a mechanism to transform the delivery of 20 health and medical care in Iowa and across the nation. 21 b. Health information technology is rapidly evolving to 22 contribute to the goals of improving the experience of care, 23 improving the health of populations, and reducing per capita 24 costs of health care. 25 c. A health information network involves the secure 26 electronic sharing of health information across the boundaries 27 of individual practice and institutional health settings and 28 with consumers. The broad use of health information technology 29 and a health information network should improve health care 30 quality and the overall health of the population, increase 31 efficiencies in administrative health care, reduce unnecessary 32 health care costs, and help prevent medical errors. 33 d. All health information technology efforts shall endeavor 34 to represent the interests and meet the needs of consumers and 35 -4- LSB 1221XD (8) 86 pf/nh 4/ 16

S.F. _____ H.F. _____ the health care sector, protect the privacy of individuals 1 and the confidentiality of individuals’ information, promote 2 best practices, and make information easily accessible to 3 the members of the patient-centered care coordination team, 4 including but not limited to patients, providers, and payors. 5 2. It is the intent of the general assembly that the Iowa 6 health information network shall not constitute a health 7 benefit network or a health insurance network. 8 Sec. 4. NEW SECTION . 135D.4 Iowa health information network 9 —— principles —— technical infrastructure requirements. 10 1. The Iowa health information network shall be 11 administered and governed by a designated entity using, at a 12 minimum, the following principles: 13 a. Be patient-centered and market-driven. 14 b. Comply with established national standards. 15 c. Protect the privacy of consumers and the security and 16 confidentiality of all health information. 17 d. Promote interoperability. 18 e. Increase the accuracy, completeness, and uniformity of 19 data. 20 f. Preserve the choice of the patient to have the patient’s 21 health information available through the record locator 22 service. 23 g. Provide education to the general public and provider 24 communities on the value and benefits of health information 25 technology. 26 2. Widespread adoption of health information technology is 27 critical to a successful Iowa health information network and is 28 best achieved when all of the following occur: 29 a. The network, through the designated entity complying 30 with chapter 504 and reporting as required under this chapter, 31 operates in an entrepreneurial and businesslike manner in which 32 it is accountable to all participants utilizing the network’s 33 products and services. 34 b. The network provides a variety of services from which to 35 -5- LSB 1221XD (8) 86 pf/nh 5/ 16

S.F. _____ H.F. _____ choose in order to best fit the needs of the user. 1 c. The network is financed by all who benefit from the 2 improved quality, efficiency, savings, and other benefits that 3 result from use of health information technology. 4 d. The network is operated with integrity and freedom from 5 political influence. 6 3. The Iowa health information network technical 7 infrastructure shall provide a mechanism for all of the 8 following: 9 a. The facilitation and support of the secure electronic 10 exchange of health information between participants. 11 b. Participants without an electronic health records system 12 to access health information from the Iowa health information 13 network. 14 4. Nothing in this chapter shall be interpreted to 15 impede or preclude the formation and operation of regional, 16 population-specific, or local health information networks 17 or the participation of such networks in the Iowa health 18 information network. 19 Sec. 5. NEW SECTION . 135D.5 Designated entity —— 20 administration and governance. 21 1. The Iowa health information network shall be 22 administered and governed by a designated entity selected by 23 the department through a competitive process. The designated 24 entity shall be established as a nonprofit corporation 25 organized under chapter 504. Unless otherwise provided in 26 this chapter, the corporation is subject to the provisions of 27 chapter 504. The designated entity shall be established for 28 the purpose of administering and governing the statewide Iowa 29 health information network. 30 2. The designated entity shall collaborate with the 31 department, but the designated entity shall not be considered, 32 in whole or in part, an agency, department, or administrative 33 unit of the state. 34 a. The designated entity shall not be required to comply 35 -6- LSB 1221XD (8) 86 pf/nh 6/ 16

S.F. _____ H.F. _____ with any requirements that apply to a state agency, department, 1 or administrative unit and shall not exercise any sovereign 2 power of the state. 3 b. The designated entity does not have authority to pledge 4 the credit of the state. The assets and liabilities of 5 the designated entity shall be separate from the assets and 6 liabilities of the state and the state shall not be liable 7 for the debts or obligations of the designated entity. All 8 debts and obligations of the designated entity shall be payable 9 solely from the designated entity’s funds. The state shall 10 not guarantee any obligation of or have any obligation to the 11 designated entity. 12 3. The articles of incorporation of the designated entity 13 shall provide for its governance and its efficient management. 14 In providing for its governance, the articles of the designated 15 entity shall address the following: 16 a. A board of directors to govern the designated entity. 17 b. The appointment of a chief executive officer by the board 18 to manage the designated entity’s daily operations. 19 c. The delegation of such powers and responsibilities to the 20 chief executive officer as may be necessary for the designated 21 entity’s efficient operation. 22 d. The employment of personnel necessary for the efficient 23 performance of the duties assigned to the designated entity. 24 All such personnel shall be considered employees of a private, 25 nonprofit corporation and shall be exempt from the personnel 26 requirements imposed on state agencies, departments, and 27 administrative units. 28 e. The financial operations of the designated entity 29 including the authority to receive and expend funds from public 30 and private sources and to use its property, money, or other 31 resources for the purpose of the designated entity. 32 Sec. 6. NEW SECTION . 135D.6 Board of directors —— 33 composition —— duties. 34 1. The designated entity shall be administered by a board 35 -7- LSB 1221XD (8) 86 pf/nh 7/ 16

S.F. _____ H.F. _____ of directors. 1 2. A single industry shall not be disproportionately 2 represented as voting members of the board. The board shall 3 include at least one member who is a consumer of health 4 services and a majority of the voting members of the board 5 shall be representative of participants in the Iowa health 6 information network. The director of public health or the 7 director’s designee and the director of the Iowa Medicaid 8 enterprise or the director’s designee shall act as voting 9 members of the board. The commissioner of insurance shall act 10 as an ex officio, nonvoting member of the board. Individuals 11 serving in an ex officio, nonvoting capacity shall not be 12 included in the total number of individuals authorized as 13 members of the board. 14 3. The board of directors shall do all of the following: 15 a. Ensure that the designated entity enters into contracts 16 with each state agency necessary for state reporting 17 requirements. 18 b. Develop, implement, and enforce the following: 19 (1) A single patient identifier or alternative mechanism to 20 share secure patient information that is utilized by all health 21 care professionals. 22 (2) Standards, requirements, policies, and procedures for 23 access to, use, secondary use, privacy, and security of health 24 information exchanged through the Iowa health information 25 network, consistent with applicable federal and state standards 26 and laws. 27 c. Direct a public and private collaborative effort to 28 promote the adoption and use of health information technology 29 in the state to improve health care quality, increase patient 30 safety, reduce health care costs, enhance public health, 31 and empower individuals and health care professionals with 32 comprehensive, real-time medical information to provide 33 continuity of care and make the best health care decisions. 34 d. Educate the public and the health care sector about 35 -8- LSB 1221XD (8) 86 pf/nh 8/ 16

S.F. _____ H.F. _____ the value of health information technology in improving 1 patient care, and methods to promote increased support and 2 collaboration of state and local public health agencies, 3 health care professionals, and consumers in health information 4 technology initiatives. 5 e. Work to align interstate and intrastate interoperability 6 standards in accordance with national health information 7 exchange standards. 8 f. Provide an annual budget and fiscal report for the Iowa 9 health information network to the governor, the department 10 of public health, the department of management, the chairs 11 and ranking members of the legislative government oversight 12 standing committees, and the legislative services agency. 13 The report shall also include information about the services 14 provided through the network and information on the participant 15 usage of the network. 16 Sec. 7. NEW SECTION . 135D.7 Legal and policy —— liability 17 —— confidentiality. 18 1. The board shall implement industry-accepted security 19 standards, policies, and procedures to protect the transmission 20 and receipt of protected health information exchanged through 21 the Iowa health information network, which shall, at a minimum, 22 comply with HIPAA and shall include all of the following: 23 a. A secure and traceable electronic audit system to 24 document and monitor the sender and recipient of health 25 information exchanged through the Iowa health information 26 network. 27 b. A required standard participation agreement which 28 defines the minimum privacy and security obligations of all 29 participants using the Iowa health information network and 30 services available through the Iowa health information network. 31 c. The opportunity for a patient to decline exchange of the 32 patient’s health information through the record locator service 33 of the Iowa health information network. 34 (1) A patient shall not be denied care or treatment for 35 -9- LSB 1221XD (8) 86 pf/nh 9/ 16

S.F. _____ H.F. _____ declining to exchange the patient’s health information, in 1 whole or in part, through the network. 2 (2) The board shall provide the means and process by which 3 a patient may decline participation. The means and process 4 utilized shall minimize the burden on patients and health care 5 professionals. 6 (3) Unless otherwise authorized by law or rule, a patient’s 7 decision to decline participation means that none of the 8 patient’s health information shall be accessible through the 9 record locator service function of the Iowa health information 10 network. A patient’s decision to decline having health 11 information shared through the record locator service function 12 shall not limit a health care professional with whom the 13 patient has or is considering a treatment relationship from 14 sharing health information concerning the patient through 15 the secure messaging function of the Iowa health information 16 network. 17 (4) A patient who declines participation in the Iowa health 18 information network may later decide to have health information 19 shared through the network. A patient who is participating in 20 the network may later decline participation in the network. 21 2. A participant shall not be compelled by subpoena, court 22 order, or other process of law to access health information 23 through the Iowa health information network in order to gather 24 records or information not created by the participant. 25 3. A participant exchanging health information and data 26 through the Iowa health information network shall grant to 27 other participants of the network a nonexclusive license to 28 retrieve and use that information in accordance with applicable 29 state and federal laws, and the policies and standards 30 established by the board. 31 4. A health care professional who relies reasonably and 32 in good faith upon any health information provided through 33 the Iowa health information network in treatment of a patient 34 who is the subject of the health information shall be immune 35 -10- LSB 1221XD (8) 86 pf/nh 10/ 16

S.F. _____ H.F. _____ from criminal or civil liability arising from the damages 1 caused by such reasonable, good-faith reliance. Such immunity 2 shall not apply to acts or omissions constituting negligence, 3 recklessness, or intentional misconduct. 4 5. A participant who has disclosed health information 5 through the Iowa health information network in compliance with 6 applicable law and the standards, requirements, policies, 7 procedures, and agreements of the network shall not be subject 8 to criminal or civil liability for the use or disclosure of the 9 health information by another participant. 10 6. The following records shall be confidential records 11 pursuant to chapter 22, unless otherwise ordered by a court or 12 consented to by the patient or by a person duly authorized to 13 release such information: 14 a. The health information contained in, stored in, submitted 15 to, transferred or exchanged by, or released from the Iowa 16 health information network. 17 b. Any health information in the possession of the board due 18 to its administration of the Iowa health information network. 19 7. Unless otherwise provided in this chapter, when sharing 20 health information through the Iowa health information network 21 or a private health information network maintained in this 22 state that complies with the privacy and security requirements 23 of this chapter for the purposes of patient treatment, payment 24 or health care operations, as such terms are defined in 25 HIPAA, or for the purposes of public health activities or 26 care coordination, a participant authorized by the designated 27 entity to use the record locator service is exempt from any 28 other state law that is more restrictive than HIPAA that would 29 otherwise prevent or hinder the exchange of patient information 30 by the participant. 31 8. A patient aggrieved or adversely affected by the 32 designated entity’s failure to comply with subsection 1, 33 paragraph “c” , may bring a civil action for equitable relief as 34 the court deems appropriate. 35 -11- LSB 1221XD (8) 86 pf/nh 11/ 16

S.F. _____ H.F. _____ Sec. 8. REPEAL. Sections 135.154, 135.155, 135.155A, 1 135.156, 135.156A, 135.156B, 135.156C, 135.156D, 135.156E, 2 and 135.156F, are repealed upon the assumption of the 3 administration and governance, including but not limited to the 4 assumption of the assets and liabilities, of the Iowa health 5 information network by the designated entity. The department 6 of public health shall notify the Code editor of the date of 7 such assumption by the designated entity. 8 Sec. 9. EFFECTIVE DATES. This division of this Act 9 takes effect upon the assumption of the administration and 10 governance, including but not limited to the assumption of the 11 assets and liabilities, of the Iowa health information network 12 by the designated entity. The department of public health 13 shall notify the Code editor of the date of such assumption by 14 the designated entity. 15 DIVISION II 16 SELECTION OF DESIGNATED ENTITY 17 AND TRANSITION PROVISIONS 18 Sec. 10. Section 135.154, Code 2015, is amended by adding 19 the following new subsections: 20 NEW SUBSECTION . 3A. “Care coordination” means the 21 management of all aspects of a patient’s care to improve health 22 care quality. 23 NEW SUBSECTION . 19A. “Public health activities” means 24 actions taken by a participant in its capacity as a public 25 health authority under the Health Insurance Portability and 26 Accountability Act or as required or permitted by other federal 27 or state law. 28 NEW SUBSECTION . 23. “Record locator service” means the 29 functionality of the Iowa health information network that 30 queries data sources to locate and identify potential patient 31 records. 32 Sec. 11. Section 135.155, subsection 2, Code 2015, is 33 amended by adding the following new paragraph: 34 NEW PARAGRAPH . f. Preserve the choice of the patient to 35 -12- LSB 1221XD (8) 86 pf/nh 12/ 16

S.F. _____ H.F. _____ have the patient’s health information available through the 1 record locator service. 2 Sec. 12. Section 135.156E, subsections 2 and 13, Code 2015, 3 are amended to read as follows: 4 2. A patient shall have the opportunity to decline exchange 5 of the patient’s health information through the record locator 6 service of the Iowa health information network. A patient 7 shall not be denied care or treatment for declining to exchange 8 the patient’s health information, in whole or in part, through 9 the record locator service of the Iowa health information 10 network. The board shall provide by rule the means and process 11 by which patients may decline participation. The means and 12 process utilized under the rules shall minimize the burden on 13 patients and health care professionals. 14 13. Unless otherwise provided in this division , when 15 using sharing health information through the Iowa health 16 information network or a private health information network 17 maintained in this state that complies with the privacy and 18 security requirements of this chapter for the purposes of 19 patient treatment, payment, or health care operations, as 20 such terms are defined in the Health Insurance Portability 21 and Accountability Act, or for the purposes of public health 22 activities or care coordination, a health care professional 23 or a hospital participant authorized to use the record 24 locator service is exempt from any other state law that is 25 more restrictive than the Health Insurance Portability and 26 Accountability Act that would otherwise prevent or hinder the 27 exchange of patient information by the patient’s health care 28 professional or hospital such participant . 29 Sec. 13. SELECTION OF A DESIGNATED ENTITY. The department 30 of public health shall utilize a competitive process to select 31 a designated entity to administer and govern the Iowa health 32 information network. 33 Sec. 14. CONTINUATION OF PARTICIPATION AGREEMENTS. If 34 the department of public health selects a designated entity 35 -13- LSB 1221XD (8) 86 pf/nh 13/ 16

S.F. _____ H.F. _____ pursuant to this division of this Act, the designated entity 1 shall continue any agreement between an authorized participant 2 and the Iowa health information network existing upon the 3 transition of the assumption of the administration and 4 governance, including but not limited to the assumption of 5 the assets and liabilities of the Iowa health information 6 network by the designated entity, under the same terms through 7 completion of the original agreement period. 8 Sec. 15. IOWA HEALTH INFORMATION NETWORK FUND. If the 9 department of public health selects a designated entity 10 pursuant to this division of this Act, any moneys remaining 11 in the Iowa health information network fund established 12 pursuant to section 135.156C, Code 2015, that are obligated or 13 encumbered for expenses related to the Iowa health information 14 network prior to the assumption of the administration and 15 governance, including but not limited to the assumption of the 16 assets and liabilities, of the Iowa health information network 17 by the designated entity, shall be retained by the department. 18 The remainder of the moneys in the fund shall be transferred to 19 the designated entity upon the assumption of the administration 20 and governance of the Iowa health information network. 21 Sec. 16. TRANSFER OF ASSETS AND LIABILITIES AND 22 ADMINISTRATIVE RESPONSIBILITIES TO THE DESIGNATED ENTITY. If 23 the department of public health selects a designated entity 24 pursuant to this division of this Act, the department shall 25 continue to provide administrative support to the Iowa health 26 information network as provided in section 135.156, Code 27 2015, until such time as the designated entity assumes such 28 responsibilities. Upon selection of the designated entity, the 29 assets and liabilities of the Iowa health information network 30 shall be transferred to the designated entity. 31 Sec. 17. EFFECTIVE UPON ENACTMENT. This division of this 32 Act, being deemed of immediate importance, takes effect upon 33 enactment. 34 EXPLANATION 35 -14- LSB 1221XD (8) 86 pf/nh 14/ 16

S.F. _____ H.F. _____ The inclusion of this explanation does not constitute agreement with 1 the explanation’s substance by the members of the general assembly. 2 This bill provides for the administration and governance of 3 an Iowa health information network by a nonprofit designated 4 entity. The bill creates a new Code chapter, 135D, the Iowa 5 health information network. The new Code chapter includes 6 many of the same provisions existing under Code chapter 7 135, division XXI, which provides for the administration and 8 governance of the Iowa health information network by the 9 department of public health, an electronic health information 10 advisory council, and an executive committee. The bill instead 11 places these functions under a designated entity, which is a 12 nonprofit corporation designated by the department through a 13 competitive process as the entity responsible for administering 14 and governing the network. The bill includes definitions, 15 findings and intent, principles and technical infrastructure 16 requirements, requirements for administration and governance 17 by the designated entity, requirements for the composition and 18 duties of the board of directors of the designated entity, and 19 legal and policy requirements. These provisions take effect 20 only upon the assumption of the administration and governance 21 of the network by the designated entity. 22 The bill makes changes to current Code relating to the 23 definitions of “care coordination”, “public health activities”, 24 and “record locator service”; the sharing of patient health 25 information available through the record locator service; 26 and the privacy and security requirements applicable to the 27 sharing of patient information by participants authorized 28 to use the record locator service for treatments, payment, 29 health care operations, public health activities, and care 30 coordination. The provisions are effective upon enactment and 31 would continue in effect through the transition period. The 32 bill also provides for the transition of the administration 33 and governance of the Iowa health information network to the 34 designated entity and provides for the repeal of the current 35 -15- LSB 1221XD (8) 86 pf/nh 15/ 16