Bill Text: IA SF404 | 2011-2012 | 84th General Assembly | Amended

---

Bill Title: A bill for an act relating to health information technology including the creation of a statewide health information exchange, providing for fees, and including effective date provisions. (Formerly SSB 1060.)

Sponsorship: Committee Bill

Status: (Engrossed - Dead) 2011-12-31 - END OF 2011 ACTIONS [SF404 Detail]

Download: Iowa-2011-SF404-Amended.html

---

Senate File 404 - Reprinted
SENATE FILE 404
BY COMMITTEE ON HUMAN
RESOURCES
(SUCCESSOR TO SSB 1060)
(As Amended and Passed by the Senate March 15, 2011 )
A BILL FOR
An Act relating to health information technology including
the creation of a statewide health information exchange,
providing for fees, and including effective date provisions.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:
SF 404 (5) 84
pf/nh

S.F. 404
Section 1. NEW SECTION . 135D.1 Findings and intent.
1. The general assembly finds all of the following:
a. Technology used to support health-related functions is
widely known as health information technology. Electronic
health records are used to collect and store relevant patient
health information. Electronic health records serve as a means
of bringing evidence-based knowledge resources and patient
information to the point of care to support better decision
making and more efficient care processes.
b. Health information technology allows for comprehensive
management of health information and its secure electronic
exchange between providers, public health agencies, payers,
and consumers. Broad use of health information technology
should improve health care quality and the overall health of
the population, increase efficiencies in administrative health
care, reduce unnecessary health care costs, and help prevent
medical errors.
c. Health information technology provides a mechanism to
transform the delivery of health and medical care in Iowa and
across the nation.
2. It is the intent of the general assembly to use health
information technology as a catalyst to achieve a healthier
Iowa through the electronic sharing of health information. A
health information exchange involves sharing health information
across the boundaries of individual practice and institutional
health settings and with consumers. The result is a public
good that will contribute to improved clinical outcomes and
patient safety, population health, access to and quality of
health care, and efficiency in health care delivery.
Sec. 2. NEW SECTION . 135D.2 Definitions.
For the purposes of this chapter, unless the context
otherwise requires:
1. “Authorized” means having met the requirements as a
participant for access to the health information exchange.
2. “Board” means the board of directors of Iowa e-health.
-1-
SF 404 (5) 84
pf/nh 1/ 26

S.F. 404
3. “Consumers” means people who acquire and use goods and
services for personal need.
4. “Continuity of care document” means a summary of a
patient’s health information for each visit to a provider to be
delivered through the health information exchange.
5. “Department” means the department of public health.
6. “Deputy director” means the deputy director of public
health.
7. “Director” means the director of public health.
8. “Exchange” means the authorized electronic sharing
of health information between providers, payers, consumers,
public health agencies, the department, and other authorized
participants utilizing the health information exchange and
health information exchange services.
9. “Executive director” means the executive director of the
office of health information technology.
10. “Health information” means any information, in any
form or medium, that is created, transmitted, or received
by a provider, payer, consumer, public health agency, the
department, or other authorized participant, which relates
to the past, present, or future physical or mental health or
condition of an individual; the provision of health care to an
individual; or the past, present, or future payment for the
provision of health care to an individual.
11. “Health information exchange” means the exclusive
statewide electronic health information exchange.
12. “Health information exchange services” means the
exchanging of health information via the health information
exchange; education and outreach to support connection and
access to and use of the health information exchange; and all
other activities related to the electronic exchange of health
information.
13. “Health Insurance Portability and Accountability
Act” means the federal Health Insurance Portability and
Accountability Act of 1996, Pub. L. No. 104-191, including
-2-
SF 404 (5) 84
pf/nh 2/ 26

S.F. 404
amendments thereto and regulations promulgated thereunder.
14. “Infrastructure” means technology including
architecture, hardware, software, networks, terminology and
standards, and policies and procedures governing the electronic
exchange of health information.
15. “Iowa e-health” means the collaboration between the
department and other public and private stakeholders to
establish, operate, and sustain an exclusive statewide health
information exchange.
16. “Iowa Medicaid enterprise” means Iowa medicaid
enterprise as defined in section 249J.3.
17. “Local board of health” means a city, county, or
district board of health.
18. “Office” means the office of health information
technology within the department.
19. “Participant” means an authorized provider, payer,
patient, public health agency, the department, or other
authorized person that has agreed to authorize, submit, access,
and disclose health information through the health information
exchange in accordance with this chapter and all applicable
laws, rules, agreements, policies, and procedures.
20. “Participation and data sharing agreement” means
the agreement outlining the terms of access and use for
participation in the health information exchange.
21. “Patient” means a person who has received or is
receiving health services from a provider.
22. “Payer” means a person who makes payments for health
services, including but not limited to an insurance company,
self-insured employer, government program, individual, or other
purchaser that makes such payments.
23. “Protected health information” means individually
identifiable patient information, including demographic
information, related to the past, present, or future health
or condition of a person; the provision of health care to
a person; or the past, present, or future payment for such
-3-
SF 404 (5) 84
pf/nh 3/ 26

S.F. 404
health care; which is created, transmitted, or received by a
participant. “Protected health information” does not include
education and other records that are covered under the federal
Family Educational Rights and Privacy Act of 1974, as codified
at 20 U.S.C. 1232g, as amended; or any employment records
maintained by a covered entity, as defined under the Health
Insurance Portability and Accountability Act, in its role as
an employer.
24. “Provider” means a hospital, physician clinic, pharmacy,
laboratory, health service provider, or other person that is
licensed, certified, or otherwise authorized or permitted
by law to administer health care in the ordinary course of
business or in the practice of a profession, or any other
person or organization that furnishes, bills, or is paid for
health care in the normal course of business.
25. “Public health agency” means an entity that is governed
by or contractually responsible to a local board of health or
the department to provide services focused on the health status
of population groups and their environments.
26. “Purchaser” means any individual, employer, or
organization that purchases health insurance or services and
includes intermediaries.
27. “Vendor” means a person or organization that provides
or proposes to provide goods or services to the department
pursuant to a contract, but does not include an employee of the
state, a retailer, or a state agency or instrumentality.
Sec. 3. NEW SECTION . 135D.3 Iowa e-health established ——
guiding principles, goals, domains.
1. Iowa e-health is established as a public-private,
multi-stakeholder collaborative. The purpose of Iowa e-health
is to develop, administer, and sustain the health information
exchange to improve the quality, safety, and efficiency of
health care available to Iowans.
2. Iowa e-health shall manage and operate the health
information exchange. Nothing in this chapter shall be
-4-
SF 404 (5) 84
pf/nh 4/ 26

S.F. 404
interpreted to impede or preclude the formation and operation
of regional, population-specific, or local health information
exchanges or their participation in the health information
exchange.
3. Iowa e-health shall facilitate the exchange of health
information for prevention and treatment purposes to help
providers make the best health care decisions for patients and
to provide patients with continuity of care regardless of the
provider the patient visits.
4. The guiding principles of Iowa e-health include all of
the following:
a. To engage in a collaborative, public-private,
multi-stakeholder effort including providers, payers,
purchasers, governmental entities, educational institutions,
and consumers.
b. To create a sustainable health information exchange which
makes information available when and where it is needed.
c. To ensure the health information exchange incorporates
provider priorities and appropriate participant education.
d. To instill confidence in consumers that their health
information is secure, private, and accessed appropriately.
e. To build on smart practices and align with federal
standards to ensure interoperability within and beyond the
state.
5. The goals of Iowa e-health include all of the following:
a. To build awareness and trust of health information
technology through communication and outreach to providers and
consumers.
b. To safeguard privacy and security of health information
shared electronically between participants through the health
information exchange so that the health information is secure,
private, and accessed only by authorized individuals and
entities.
c. To promote statewide deployment and use of electronic
health records.
-5-
SF 404 (5) 84
pf/nh 5/ 26

S.F. 404
d. To enable the electronic exchange of health information.
e. To advance coordination of activities across state and
federal governments.
f. To establish a governance model for the health
information exchange.
g. To establish sustainable business and technical
operations for the health information exchange.
h. To secure financial resources to develop and sustain the
health information exchange.
i. To monitor and evaluate health information technology
progress and outcomes.
6. Iowa e-health shall include the following five domains:
a. Governance. Iowa e-health shall be governed by a board
of directors whose members represent stakeholders such as
provider organizations and associations, providers, payers,
purchasers, governmental entities, business, and consumers.
Iowa e-health shall be supported by the department’s office of
health information technology. The board shall set direction,
goals, and policies for Iowa e-health and provide oversight of
the business and technical operations of the health information
exchange and health information exchange services.
b. Business and technical operations. The office of health
information technology shall perform day-to-day operations
to support and advance Iowa e-health, the health information
exchange, and health information exchange services.
c. Finance. Iowa e-health shall identify and manage
financial resources to achieve short-term and long-term
sustainability of the health information exchange, so that the
health information exchange is financed by all who benefit
from the improved quality, efficiency, and other benefits that
result from the use of health information technology.
d. Technical infrastructure. Iowa e-health shall implement
and manage the core infrastructure and standards to enable the
safe and secure delivery of health information to providers and
consumers through the health information exchange.
-6-
SF 404 (5) 84
pf/nh 6/ 26

S.F. 404
e. Legal and policy. Iowa e-health shall establish privacy
and security policies and guidelines, and participation and
data sharing agreements, to protect consumers and enforce rules
for utilization of the health information exchange.
Sec. 4. NEW SECTION . 135D.4 Governance —— board of
directors —— advisory council.
1. Iowa e-health shall be governed by a board of directors.
Board members shall be residents of the state of Iowa.
Notwithstanding sections 69.16 and 69.16A, the persons
specified to appoint or designate board members shall consider
gender balance and geographic representation in the appointment
process.
2. The board of directors shall be comprised of the
following voting members:
a. Three members appointed by the governor subject to
confirmation by the senate, with one member representing
consumers, one member representing small business interests,
and one member representing large business interests.
b. Four members, each of whom is the designee of one of the
four largest health care systems in the state.
c. Two members, one of whom represents rural hospitals and
one of whom represents independent hospitals, who are members
of the Iowa hospital association, designated by the Iowa
hospital association.
d. Two members who represent two different private health
insurance carriers, designated by the federation of Iowa
insurers, one of which has the largest health market share in
Iowa.
e. One member representing the department who is designated
by the department.
f. One member representing the Iowa Medicaid enterprise who
is the Iowa Medicaid director or the director’s designee.
g. One member who is a licensed physician, designated by the
Iowa medical society.
h. One member who is a licensed practicing physician in an
-7-
SF 404 (5) 84
pf/nh 7/ 26

S.F. 404
office or clinic setting, designated by the Iowa osteopathic
medical association.
i. One member who is a licensed practicing nurse in an
office or clinic setting, designated by the Iowa nurses
association.
j. One member who is a licensed pharmacist practicing in a
pharmacy setting, designated by the Iowa pharmacy association.
k. Two members representing the Iowa collaborative safety
net provider network created in section 135.153, designated by
the network.
l. One member representing substance abuse programs,
designated by the Iowa behavioral health association.
m. One at-large board member, who may be appointed by and at
the sole discretion of the board.
n. One member who is a licensed physician designated by the
Iowa academy of family physicians.
o. One member representing community mental health centers,
designated by the Iowa association of community providers.
p. One member representing long-term care providers,
designated by the Iowa health care association/Iowa center for
assisted living and the Iowa association of homes and services
for the aging.
q. One member representing chiropractors, designated by the
Iowa chiropractic society.
3. A person shall not serve on the board in any capacity if
the person is required to register as a lobbyist under section
68B.36 because of the person’s activities for compensation
on behalf of a profession or an entity that is engaged in
providing health care, reviewing or analyzing health care,
paying for health care services or procedures, or providing
health information technology or health information exchange
services.
4. a. Board members shall serve four-year terms but shall
not serve more than two consecutive four-year terms. However,
the board members who are the four chief information officers
-8-
SF 404 (5) 84
pf/nh 8/ 26

S.F. 404
of the four largest health care systems in the state and those
representing state agencies are not subject to term limits.
b. At the end of any term, a member of the board may
continue to serve until the appointing or designating authority
names a successor.
c. A vacancy on the board shall be filled for the remainder
of the term in the manner of the original appointment. A
vacancy in the membership of the board shall not impair the
right of the remaining members to exercise all the powers and
perform all the duties of the board.
d. A board member may be removed by the board for cause
including but not limited to malfeasance in office, failure
to attend board meetings, misconduct, or violation of ethical
rules and standards. Nonattendance of board members appointed
by the governor shall be governed by the provisions of section
69.15. A board member may be removed by a vote of the board if,
based on the criteria provided in section 69.15, subsection 1,
paragraphs “a” and “b” , the board member would be deemed to have
submitted a resignation from the board.
e. The board members shall elect a chairperson from their
membership. The department’s designee shall serve as vice
chairperson.
5. Meetings of the board shall be governed by the provisions
of chapter 21.
a. The board shall meet upon the call of the chairperson
or the vice chairperson. Notice of the time and place of each
board meeting shall be given to each member. The board shall
keep accurate and complete records of all of its meetings.
b. A simple majority of the members shall constitute a
quorum to enable the transaction of any business and for the
exercise of any power or function of the board. Action may be
taken and motions and resolutions adopted by the affirmative
vote of a majority of the members attending the meeting whether
in person, by telephone, web conference, or other means. A
board member shall not vote by proxy or through a delegate.
-9-
SF 404 (5) 84
pf/nh 9/ 26

S.F. 404
c. All board members shall be entitled to reimbursement
for actual and necessary expenses incurred in the performance
of their official duties as members in accordance with state
rules and guidelines. A person who serves as a member of the
board shall not by reason of such membership be entitled to
membership in the Iowa public employees’ retirement system or
service credit for any public retirement system.
6. The board may exercise its powers, duties, and functions
as prescribed by law, independently of the director except in
matters involving violation or risk of violation of applicable
state or federal laws and regulations; overriding public policy
or public safety concerns; or compliance with the office of the
national coordinator for health information technology state
health information exchange cooperative agreement program or
any other cooperative agreement programs or grants supporting
Iowa e-health. The board has all powers incidental or
necessary to accomplish the purposes of this chapter and shall
do all of the following:
a. Participate in the selection of the executive director
and assist in the development of performance standards and
evaluations of the executive director.
b. Establish priorities among health information exchange
services based on the needs of the population of this state.
c. Establish by rule any fees, charges, costs, or expenses
that may be collected as the board deems necessary to operate,
maintain, support, and sustain the health information exchange
and health information exchange services. Any fees or charges
established by rule shall be based upon the results of a
financial sustainability study conducted by the department, the
results of which shall be submitted to the general assembly.
d. Oversee the handling and accounting of assets and moneys
received for or generated by the health information exchange.
e. Establish committees and workgroups as needed.
f. Review and approve or disapprove all of the following,
as proposed by the department:
-10-
SF 404 (5) 84
pf/nh 10/ 26

S.F. 404
(1) Strategic, operational, and financial sustainability
plans for Iowa e-health, the health information exchange, and
health information exchange services.
(2) Standards, requirements, policies, and procedures for
access, use, secondary use, and privacy and security of health
information exchanged through the health information exchange,
consistent with applicable federal and state standards and
laws.
(3) Policies and procedures for administering the
infrastructure, technology, and associated professional
services necessary for the business and technical operation of
the health information exchange and health information exchange
services.
(4) Policies and procedures for evaluation of the health
information exchange and health information exchange services.
(5) Mechanisms for periodic review and update of policies
and procedures.
(6) An annual budget and fiscal report for the operations of
the health information exchange and an annual report for Iowa
e-health and health information exchange services.
(7) Major purchases of goods and services.
g. Adopt administrative rules pursuant to chapter 17A
to implement this chapter and relating to the management
and operation of the health information exchange and health
information exchange services.
h. Adopt rules for monitoring access to and use of
the health information exchange and enforcement of health
information exchange rules, standards, requirements, policies,
and procedures. The board may suspend, limit, or terminate a
participant’s utilization of the health information exchange
for violation of such rules, standards, requirements, policies,
or procedures, and shall establish, by rule, a process for
notification, right to respond, and appeal relative to such
violations.
i. Have all remedies allowed by law to address any violation
-11-
SF 404 (5) 84
pf/nh 11/ 26

S.F. 404
of the terms of the participation and data sharing agreement.
j. Perform any and all other activities in furtherance of
its purpose.
7. a. A board member is subject to chapter 68B, the rules
adopted by the Iowa ethics and campaign disclosure board, and
the ethics rules and requirements that apply to the executive
branch of state government.
b. A board member shall not participate in any matter
before the board in which the board member has a direct or
indirect interest in an undertaking that places the board
member’s personal or business interests in conflict with those
of Iowa e-health, including but not limited to an interest in
a procurement contract, or that may create the appearance of
impropriety.
8. Advisory council.
a. An advisory council to the board is established
to provide an additional mechanism for obtaining broader
stakeholder advice and input regarding health information
technology, the health information exchange, and health
information exchange services.
b. The members of the advisory council shall be appointed
by the board for two-year staggered terms and shall include a
representative of all of the following:
(1) The state board of health.
(2) Informaticists.
(3) Academics.
(4) The Iowa Medicare quality improvement organization.
(5) The state chief information officer.
(6) The private telecommunications industry.
(7) The Iowa collaborative safety net provider network.
(8) The department of human services.
(9) Des Moines university.
(10) The Iowa health care collaborative.
(11) The department of veterans affairs.
(12) Consumers.
-12-
SF 404 (5) 84
pf/nh 12/ 26

S.F. 404
(13) Home health care providers.
(14) The state hygienic laboratory.
c. The board may change the membership and the composition
of the advisory council, by rule, to accommodate changes in
stakeholder interests and the evolution of health information
technology, the health information exchange, and health
information exchange services.
d. Advisory council members shall be entitled to
reimbursement for actual and necessary expenses incurred in the
performance of their official duties as members in accordance
with state rules and guidelines.
Sec. 5. NEW SECTION . 135D.5 Business and technical
operations —— office of health information technology.
1. The office of health information technology is
established within the department and shall be responsible for
the day-to-day business and operations of Iowa e-health, the
health information exchange, and health information exchange
services. The office shall be under the direction of the
director and under the supervision of the deputy director.
2. a. The department shall employ an executive director to
manage the office and who shall report to the deputy director.
b. The executive director shall manage the planning and
implementation of Iowa e-health, the health information
exchange, and health information exchange services, and provide
high-level coordination across public and private sector
stakeholders.
c. The executive director shall serve as Iowa’s health
information technology coordinator and primary point of
contact for the office of the national coordinator for health
information technology, other federal and state agencies
involved in health information technology, and state health
information technology coordinators from other states.
3. a. The executive director and all other employees of
the office shall be employees of the state, classified and
compensated in accordance with chapter 8A, subchapter IV, and
-13-
SF 404 (5) 84
pf/nh 13/ 26

S.F. 404
chapter 20.
b. Subject to approval of the board, the director shall
have the sole power to determine the number of full-time and
part-time equivalent positions necessary to carry out the
provisions of this chapter.
c. An employee of the office shall not have a financial
interest in any vendor doing business or proposing to do
business with Iowa e-health.
4. The department shall do all of the following:
a. Develop, implement, and enforce the following, as
approved by the board:
(1) Strategic, operational, and financial sustainability
plans for the health information exchange, Iowa e-health, and
health information exchange services.
(2) Standards, requirements, policies, and procedures for
access, use, secondary use, and privacy and security of health
information exchanged through the health information exchange,
consistent with applicable federal and state standards and
laws.
(3) Policies and procedures for monitoring participant
usage of the health information exchange and health information
exchange services; enforcing noncompliance with health
information exchange standards, requirements, policies, rules,
and procedures.
(4) Policies and procedures for administering the
infrastructure, technology, and associated professional
services required for operation of the health information
exchange and health information exchange services.
(5) Policies and procedures for evaluation of the health
information exchange and health information exchange services.
(6) A mechanism for periodic review and update of policies
and procedures.
(7) An annual budget and fiscal report for the business
and technical operations of the health information exchange
and an annual report for Iowa e-health, the health information
-14-
SF 404 (5) 84
pf/nh 14/ 26

S.F. 404
exchange, and health information exchange services.
b. Convene and facilitate board, advisory council,
workgroup, committee, and other stakeholder meetings.
c. Provide technical and operational assistance for
planning and implementing Iowa e-health activities, the health
information exchange, and health information exchange services.
d. Provide human resource, budgeting, project and
activity coordination, and related management functions to
Iowa e-health, the health information exchange, and health
information exchange services.
e. Develop educational materials and educate the general
public on the benefits of electronic health records, the health
information exchange, and the safeguards available to prevent
unauthorized disclosure of health information.
f. Enter into participation and data sharing agreements with
participants of the health information exchange.
g. Administer and enforce the collection of fees, charges,
costs, and expenses for the health information exchange and
health information exchange services.
h. Record receipts and approval of payments, and file
required financial reports.
i. Apply for, acquire by gift or purchase, and hold,
dispense, or dispose of funds and real or personal property
from any person, governmental entity, or organization in
the exercise of its powers and performance of its duties in
accordance with this chapter.
j. Administer grant funds in accordance with the terms of
the grant and all applicable state and federal laws, rules, and
regulations.
k. Select and contract with vendors in compliance with
applicable state and federal procurement laws and regulations.
l. Coordinate with other health information technology and
health information exchange programs and activities.
m. Work to align interstate and intrastate interoperability
and standards in accordance with national health information
-15-
SF 404 (5) 84
pf/nh 15/ 26

S.F. 404
exchange standards.
n. Execute all instruments necessary or incidental to the
performance of its duties and the execution of its powers.
Sec. 6. NEW SECTION . 135D.6 Iowa e-health finance fund.
1. The Iowa e-health finance fund is created as a separate
fund within the state treasury under the control of the board.
Fees collected or revenues arising from the operation and
administration of the health information exchange and health
information exchange services, including but not limited to
fees and charges for participants of the health information
exchange, donations, gifts, interest, or other moneys, shall be
deposited into the fund. Funds generated from fees collected
and revenues generated from the health information exchange
shall be used to establish, operate, and sustain the health
information exchange and health information exchange services.
2. Moneys in the fund shall be expended by the department
only on activities and operations suitable to the performance
of the department’s duties on behalf of the board and Iowa
e-health as specified in this chapter, subject to board
approval. Disbursements may be made from the fund for purposes
related to the administration, management, operations,
functions, activities, and sustainability of the health
information exchange and health information exchange services.
3. Notwithstanding section 12C.7, subsection 2, earnings or
interest on moneys deposited in the fund shall be credited to
the fund. Notwithstanding section 8.33, any unexpended balance
in the fund at the end of each fiscal year shall be retained in
the fund and shall not be transferred to the general fund of
the state.
4. The moneys in the fund shall be subject to financial and
compliance audits by the auditor of state.
5. The general assembly may appropriate moneys in the fund
to the department on behalf of Iowa e-health for the health
information exchange and health information exchange services.
Sec. 7. NEW SECTION . 135D.7 Technical infrastructure.
-16-
SF 404 (5) 84
pf/nh 16/ 26

S.F. 404
1. The health information exchange shall provide a
mechanism to facilitate and support the secure electronic
exchange of health information between participants. The
health information exchange shall not function as a central
repository of all health information.
2. The health information exchange shall provide a
mechanism for participants without an electronic health record
system to access health information from the health information
exchange.
3. The technical infrastructure of the health information
exchange shall be designed to facilitate the secure electronic
exchange of health information using functions including but
not limited to all of the following:
a. A master patient index, in the absence of a single,
standardized patient identifier, to exchange secure health
information among participants.
b. A record locator service to locate and exchange secure
health information among participants.
c. Authorization, authentication, access, and auditing
processes for security controls to protect the privacy of
consumers and participants and the confidentiality of health
information by limiting access to the health information
exchange and health information to participants whose identity
has been authenticated, and whose access to health information
is limited by their role and recorded through an audit trail.
d. Electronic transmission procedures and software necessary
to facilitate the electronic exchange of various types of
health information through the health information exchange.
e. Telecommunications through coordination of public
and private networks to provide the backbone infrastructure
to connect participants exchanging health information. The
networks may include but are not limited to the state-owned
communications network, other fiber optic networks, and private
telecommunications service providers.
4. The state shall own or possess the rights to use all
-17-
SF 404 (5) 84
pf/nh 17/ 26

S.F. 404
processes and software developed, and hardware installed,
leased, designed, or purchased for the health information
exchange, and shall permit participants to use the health
information exchange and health information exchange services
in accordance with the standards, policies, procedures, rules,
and regulations approved by the board, and the terms of the
participation and data sharing agreement.
Sec. 8. NEW SECTION . 135D.8 Legal and policy.
1. Upon approval from the board, the office of health
information technology shall establish appropriate security
standards, policies, and procedures to protect the transmission
and receipt of individually identifiable health information
exchanged through the health information exchange. The
security standards, policies, and procedures shall, at a
minimum, comply with the Health Insurance Portability and
Accountability Act security rule pursuant to 45 C.F.R. pt. 164,
subpt. C, and shall reflect all of the following:
a. Include authorization controls, including the
responsibility to authorize, maintain, and terminate a
participant’s use of the health information exchange.
b. Require authentication controls to verify the identity
and role of the participant using the health information
exchange.
c. Include role-based access controls to restrict
functionality and information available through the health
information exchange.
d. Include a secure and traceable electronic audit system
to document and monitor the sender and the recipient of health
information exchanged through the health information exchange.
e. Require standard participation and data sharing
agreements which define the minimum privacy and security
obligations of all participants using the health information
exchange and health information exchange services.
f. Include controls over access to and the collection,
organization, and maintenance of records and data for
-18-
SF 404 (5) 84
pf/nh 18/ 26

S.F. 404
purposes of research or population health that protect the
confidentiality of consumers who are the subject of the health
information.
2. a. A patient shall have the opportunity to decline
exchange of their health information through the health
information exchange. The board shall provide by rule the
means and process by which patients may decline participation.
A patient shall not be denied care or treatment for declining
to exchange their health information, in whole or in part,
through the health information exchange. The means and process
utilized under the rules shall minimize the burden on patients
and providers.
b. Unless otherwise authorized by law or rule, a patient’s
decision to decline participation means that none of the
patient’s health information shall be exchanged through the
health information exchange. If a patient does not decline
participation, the patient’s health information may be
exchanged through the health information exchange except as
follows:
(1) If health information associated with a patient
visit with a provider is protected by state law that is
more restrictive than the Health Insurance Portability and
Accountability Act, a patient shall have the right to decline
sharing of health information through the health information
exchange from such visit as provided by rule.
(2) With the consent of the patient, a provider may
limit health information associated with a patient visit
from being shared through the health information exchange if
such limitation is reasonably determined by the provider, in
consultation with the patient, to be in the best interest of
the patient as provided by rule.
c. A patient who declines participation in the health
information exchange may later decide to have health
information shared through the health information exchange. A
patient who is participating in the health information exchange
-19-
SF 404 (5) 84
pf/nh 19/ 26

S.F. 404
may later decline participation in the health information
exchange.
3. The office shall develop and distribute educational
tools and information for consumers, patients, and providers to
inform them about the health information exchange, including
but not limited to the safeguards available to prevent
unauthorized disclosure of health information and a patient’s
right to decline participation in the health information
exchange.
4. a. A participant shall not release or use protected
health information exchanged through the health information
exchange for purposes unrelated to prevention, treatment,
payment, or health care operations unless otherwise authorized
or required by law. Participants shall limit the use and
disclosure of protected health information to the minimum
amount required to accomplish the intended purpose of the use
or request, in compliance with the Health Insurance Portability
and Accountability Act and other applicable federal law. Use
or distribution of the information for a marketing purpose, as
defined by the Health Insurance Portability and Accountability
Act, is strictly prohibited.
b. The department, the office, and all persons using the
health information exchange shall be individually responsible
for following breach notification policies as provided by the
Health Insurance Portability and Accountability Act.
c. A provider shall not be compelled by subpoena, court
order, or other process of law to access health information
through the health information exchange in order to gather
records or information not created by the provider.
5. a. If a patient has declined participation in the health
information exchange, the patient’s health information may be
released to a provider through the health information exchange
if all of the following circumstances exist:
(1) The patient is unable to provide consent due to
incapacitation.
-20-
SF 404 (5) 84
pf/nh 20/ 26

S.F. 404
(2) The requesting provider believes, in good faith, that
the information is necessary to prevent imminent serious injury
to the patient. Imminent serious injury includes but it not
limited to death, injury or disease that creates a substantial
risk of death, or injury or disease that causes protracted loss
or impairment of any organ or body system.
(3) Such information cannot otherwise be readily obtained.
b. The department shall provide by rule for the reporting of
emergency access and use by a provider.
6. All participants exchanging health information and
data through the health information exchange shall grant to
participants of the health information exchange a nonexclusive
license to retrieve and use that information or data in
accordance with applicable state and federal laws, and the
policies, procedures, and rules established by the board.
7. The department shall establish by rule the procedures for
a patient who is the subject of health information to do all of
the following:
a. Receive notice of a violation of the confidentiality
provisions required under this chapter.
b. Upon request to the department, view an audit report
created under this chapter for the purpose of monitoring access
to the patient’s records.
8. a. A provider who relies reasonably and in good faith
upon any health information provided through the health
information exchange in treatment of a patient shall be immune
from criminal or civil liability arising from any damages
caused by such reasonable, good faith reliance. Such immunity
shall not apply to acts or omissions constituting negligence,
recklessness, or intentional misconduct.
b. A participant that has disclosed health information
through the health information exchange in compliance with
applicable law and the standards, requirements, policies,
procedures, and agreements of the health information exchange
shall not be subject to criminal or civil liability for the use
-21-
SF 404 (5) 84
pf/nh 21/ 26

S.F. 404
or disclosure of the health information by another participant.
9. a. Notwithstanding chapter 22, the following records
shall be kept confidential, unless otherwise ordered by a court
or consented to by the patient or by a person duly authorized
to release such information:
(1) The protected health information contained in, stored
in, submitted to, transferred or exchanged by, or released from
the health information exchange.
(2) Any protected health information in the possession of
Iowa e-health or the department due to its administration of
the health information exchange.
b. Unless otherwise provided in this chapter, when using
the health information exchange for the purpose of patient
treatment, a provider is exempt from any other state law that
is more restrictive than the Health Insurance Portability and
Accountability Act that would otherwise prevent or hinder the
exchange of patient information by the patient’s providers.
Sec. 9. NEW SECTION . 135D.9 Iowa e-health —— health
information exchange services.
Iowa e-health shall facilitate services through the health
information exchange or through other marketplace mechanisms
to improve the quality, safety, and efficiency of health care
available to consumers. These services shall include but are
not limited to all of the following:
1. Patient summary records such as continuity of care
documents.
2. A provider directory and provider messaging.
3. Clinical orders and results.
4. Public health reporting such as electronic reporting to
the statewide immunization registry and reportable diseases.
5. Medication history.
Sec. 10. NEW SECTION . 135D.10 Governance review and
transition.
1. a. The Iowa e-health governance structure shall
continue during the term of the state health information
-22-
SF 404 (5) 84
pf/nh 22/ 26

S.F. 404
exchange cooperative agreement with the office of the national
coordinator for health information technology to address
the development of policies and procedures; dissemination
of interoperability standards; the initiation, testing, and
operation of the health information exchange infrastructure;
and the evolution of health information exchange services to
improve patient care for the population.
b. During the final year of the term of the cooperative
agreement, the board and the department shall review the
Iowa e-health governance structure, operations of the health
information exchange, and the business and sustainability plan
to determine if the existing Iowa e-health governance structure
should continue or should be replaced by any of the following:
(1) A public authority or similar body with broad
stakeholder representation on its governing board.
(2) A not-for-profit entity with broad stakeholder
representation on its governing board.
2. If the board and department determine that the governance
structure should be replaced, Iowa e-health shall develop
a transition plan to transfer the responsibilities for the
domains specified in section 135D.3.
Sec. 11. Section 136.3, subsection 14, Code 2011, is amended
to read as follows:
14. Perform those duties authorized pursuant to sections
135.156 , 135.159 , and 135.161 , and other provisions of law.
Sec. 12. Section 249J.14, subsection 2, paragraphs a and b,
Code 2011, are amended to read as follows:
a. Design and implement a program for distribution
and monitoring of provider incentive payments, including
development of a definition of “meaningful use” for purposes
of promoting the use of electronic medical recordkeeping by
providers. The department shall develop this program in
collaboration with the department of public health and the
electronic health information advisory council and executive
committee board of directors and the advisory council to the
-23-
SF 404 (5) 84
pf/nh 23/ 26

S.F. 404
board of Iowa e-health created pursuant to section 135.156
135D.4 .
b. Develop the medical assistance health information
technology plan as required by the centers for Medicare and
Medicaid services of the United States department of health and
human services. The plan shall provide detailed implementation
plans for the medical assistance program for promotion of the
adoption and meaningful use of health information technology by
medical assistance providers and the Iowa Medicaid enterprise.
The plan shall include the integration of health information
technology and health information exchange with the medical
assistance management information system. The plan shall be
developed in collaboration with the department of public health
and the electronic health information advisory council and
executive committee board of directors and the advisory council
to the board of Iowa e-health created pursuant to section
135.156 135D.4 .
Sec. 13. INITIAL APPOINTMENTS —— BOARD.
1. The initial appointments of board member positions
described in section 135D.4, as enacted by this Act, shall have
staggered terms as follows:
a. The three board members appointed by the governor shall
have an initial term of two years, after which the members
shall serve four-year terms, subject to the following:
(1) The terms shall begin and end as provided in section
69.19.
(2) Board members appointed by the governor when the senate
is not in session shall serve only until the end of the next
regular session of the general assembly, unless and until
confirmed by the senate.
b. The board member designated by the Iowa pharmacy
association and the at-large board member, if appointed by the
board, shall have initial terms of two years, after which the
members shall serve four-year terms.
c. The board members designated by the Iowa hospital
-24-
SF 404 (5) 84
pf/nh 24/ 26

S.F. 404
association, the Iowa medical society, the Iowa osteopathic
medical association, the Iowa nurses association, the Iowa
collaborative safety net provider network, the Iowa behavioral
health association, the Iowa academy of family physicians,
the Iowa association of community providers, the Iowa health
care association/Iowa center for assisted living, the Iowa
association of homes and services for the aging, and the Iowa
chiropractic society shall have initial terms of four years,
after which the members shall serve four-year terms.
d. The board members designated by the federation of Iowa
insurers shall serve initial terms of six years, after which
the members shall serve four-year terms.
2. With the exception of members not subject to term limits
as provided in section 135D.4, board members may serve an
additional four-year term, with the exception of those board
members initially serving a two-year term, who may serve two
consecutive four-year terms following the initial two-year
term.
Sec. 14. REPEAL. Sections 135.154, 135.155, and 135.156,
Code 2011, are repealed.
Sec. 15. TRANSITION PROVISIONS. Notwithstanding any other
provision of this Act, the department of public health, and the
executive committee and the advisory council created pursuant
to section 135.156, shall continue to exercise the powers
and duties specified under that section until such time as
all board members have been appointed as provided in section
135D.4, as enacted by this Act.
Sec. 16. EFFECTIVE DATE. The sections of this Act repealing
sections 135.154, 135.155, and 135.156, and amending sections
136.3 and 249J.14, take effect on the date all board members
are appointed as provided in section 135D.4, as enacted by this
Act. The department of public health shall notify the Code
editor of such date.
Sec. 17. EFFECTIVE UPON ENACTMENT. Except as otherwise
provided in this Act, this Act, being deemed of immediate
-25-
SF 404 (5) 84
pf/nh 25/ 26

S.F. 404
importance, takes effect upon enactment.
-26-
SF 404 (5) 84
pf/nh 26/ 26