Bill Text: IA SF2318 | 2011-2012 | 84th General Assembly | Enrolled

---

Bill Title: A bill for an act relating to the Iowa health information network, providing for fees, and including effective date provisions. (Formerly SSB 3056 and SF 2166.) Effective 4-12-12.

Spectrum: Committee Bill

Status: (Passed) 2012-04-12 - Signed by Governor. S.J. 794. [SF2318 Detail]

Download: Iowa-2011-SF2318-Enrolled.html

---

Senate File 2318
AN ACT
RELATING TO THE IOWA HEALTH INFORMATION NETWORK, PROVIDING FOR
FEES, AND INCLUDING EFFECTIVE DATE PROVISIONS.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:
Section 1. Section 135.154, Code 2011, is amended by adding
the following new subsections:
NEW SUBSECTION . 01. “Advisory council” means the electronic
health information advisory council created in section 135.156.
NEW SUBSECTION . 001. “Authorized” means having met the
requirements as a participant for access to and use of the Iowa
health information network.
NEW SUBSECTION . 2A. “Exchange” means the authorized
electronic sharing of health information between health care
professionals, payors, consumers, public health agencies, the
department, and other authorized participants utilizing the
Iowa health information network and Iowa health information
network services.
NEW SUBSECTION . 2B. “Executive committee” means the
executive committee of the electronic health information
advisory council created in section 135.156.
NEW SUBSECTION . 3A. “Health information” means health
information as defined in 45 C.F.R. § 160.103 that is created
or received by an authorized participant.
NEW SUBSECTION . 4A. “Health Insurance Portability and
Accountability Act” means the federal Health Insurance
Portability and Accountability Act of 1996, Pub. L. No.
104-191, including amendments thereto and regulations
promulgated thereunder.
NEW SUBSECTION . 4B. “Hospital” means licensed hospital as
defined in section 135B.1.

Senate File 2318, p. 2
NEW SUBSECTION . 4C. “Individually identifiable health
information” means individually identifiable health information
as defined in 45 C.F.R. § 160.103 that is created or received
by an authorized participant.
NEW SUBSECTION . 5A. “Iowa health information network” or
“network” means the statewide health information technology
network created in this division.
NEW SUBSECTION . 5B. “Iowa Medicaid enterprise” means the
Iowa Medicaid enterprise as defined in section 249J.3.
NEW SUBSECTION . 5C. “Participant” means an authorized
health care professional, payor, patient, health care
organization, public health agency, or the department that
has agreed to authorize, submit, access, or disclose health
information through the Iowa health information network in
accordance with this chapter and all applicable laws, rules,
agreements, policies, and standards.
NEW SUBSECTION . 5D. “Patient” means a person who has
received or is receiving health services from a health care
professional.
NEW SUBSECTION . 5E. “Payor” means a person who makes
payments for health services, including but not limited to an
insurance company, self-insured employer, government program,
individual, or other purchaser that makes such payments.
NEW SUBSECTION . 5F. “Protected health information” means
protected health information as defined in 45 C.F.R. § 160.103
that is created or received by an authorized participant.
NEW SUBSECTION . 5G. “Public health agency” means an
entity that is governed by or contractually responsible to a
local board of health or the department to provide services
focused on the health status of population groups and their
environments.
NEW SUBSECTION . 5H. “Purchaser” means any individual,
employer, or organization that purchases health insurance or
services and includes intermediaries.
Sec. 2. Section 135.155, subsection 2, unnumbered paragraph
1, Code 2011, is amended to read as follows:
To be effective, the Iowa health information technology
system network shall comply with all of the following
principles:
Sec. 3. Section 135.155, subsection 3, Code 2011, is amended
to read as follows:
3. Widespread adoption of health information technology is
critical to a successful Iowa health information technology

Senate File 2318, p. 3
system network and is best achieved when all of the following
occur:
a. The market provides a variety of certified products from
which to choose in order to best fit the needs of the user.
b. The system network provides incentives for health care
professionals to utilize the health information technology and
provides rewards for any improvement in quality and efficiency
resulting from such utilization.
c. The system network provides protocols to address critical
problems.
d. The system network is financed by all who benefit from
the improved quality, efficiency, savings, and other benefits
that result from use of health information technology.
Sec. 4. NEW SECTION . 135.155A Findings and intent —— Iowa
health information network.
1. The general assembly finds all of the following:
a. Technology used to support health care-related functions
is known as health information technology. Health information
technology provides a mechanism to transform the delivery of
health and medical care in Iowa and across the nation.
b. A health information network involves the secure
electronic sharing of health information across the boundaries
of individual practice and institutional health settings and
with consumers. Broad use of health information technology and
a health information network should improve health care quality
and the overall health of the population, increase efficiencies
in administrative health care, reduce unnecessary health care
costs, and help prevent medical errors.
2. It is the intent of the general assembly that Iowa
establish a statewide health information technology network.
The Iowa health information network shall not constitute a
health benefit network or a health insurance network. Nothing
in this division shall be interpreted to impede or preclude the
formation and operation of regional, population-specific, or
local health information networks or their participation in the
Iowa health information network.
Sec. 5. Section 135.156, subsection 1, paragraphs a and b,
Code Supplement 2011, are amended to read as follows:
a. The department shall direct a public and private
collaborative effort to promote the adoption and use of health
information technology in this state in order to improve
health care quality, increase patient safety, reduce health
care costs, enhance public health, and empower individuals

Senate File 2318, p. 4
and health care professionals with comprehensive, real-time
medical information to provide continuity of care and make
the best health care decisions. The department shall provide
coordination for the development and implementation of an
interoperable electronic health records system, telehealth
expansion efforts, the health information technology
infrastructure, the Iowa health information network, and other
health information technology initiatives in this state.
The department shall be guided by the principles and goals
specified in section 135.155 and the findings and intent
specified for an Iowa health information network in section
135.155A .
b. All health information technology efforts shall endeavor
to represent the interests and meet the needs of consumers and
the health care sector, protect the privacy of individuals
and the confidentiality of individuals’ information, promote
physician best practices, and make information easily
accessible to the appropriate parties. The system network
developed shall be consumer-driven, flexible, and expandable.
Sec. 6. Section 135.156, subsection 2, paragraph a, Code
Supplement 2011, is amended to read as follows:
a. An electronic health information advisory council is
established which shall consist of the representatives of
entities involved in the electronic health records system task
force established pursuant to section 217.41A , Code 2007, a
pharmacist, a licensed practicing physician, a consumer who
is a member of the state board of health, a representative
of the state’s Medicare quality improvement organization,
the executive director of the Iowa communications network, a
representative of the private telecommunications industry, a
representative of the Iowa collaborative safety net provider
network created in section 135.153 , a nurse informaticist from
the university of Iowa, and any other members the department
or executive committee of the advisory council determines
necessary and appoints to assist the department or executive
committee at various stages of development of the electronic
Iowa health information system network . Executive branch
agencies shall also be included as necessary to assist in the
duties of the department and the executive committee. Public
members of the advisory council shall receive reimbursement
for actual expenses incurred while serving in their official
capacity only if they are not eligible for reimbursement by
the organization that they represent. Any legislative members

Senate File 2318, p. 5
shall be paid the per diem and expenses specified in section
2.10 .
Sec. 7. Section 135.156, subsection 3, paragraph a,
subparagraphs (6) and (10), Code Supplement 2011, are amended
to read as follows:
(6) Policies relating to governance of the various facets of
the Iowa health information technology system network .
(10) Economic incentives and support to facilitate
participation in an interoperable system network by health care
professionals.
Sec. 8. Section 135.156, subsection 3, paragraph c,
unnumbered paragraph 1, Code Supplement 2011, is amended to
read as follows:
Coordinate public and private efforts to provide the
network backbone infrastructure for the Iowa health information
technology system network . In coordinating these efforts, the
executive committee shall do all of the following:
Sec. 9. Section 135.156, subsection 3, paragraphs h and i,
Code Supplement 2011, are amended to read as follows:
h. Seek and apply for any federal or private funding to
assist in the implementation and support of the Iowa health
information technology system network and make recommendations
for funding mechanisms for the ongoing development and
maintenance costs of the Iowa health information technology
system network .
i. Identify state laws and rules that present barriers
to the development of the Iowa health information technology
system network and recommend any changes to the governor and
the general assembly.
Sec. 10. NEW SECTION . 135.156A Iowa health information
network —— business and financial sustainability plan and
participant fees.
1. The board, with the support of the department and
the advice of the executive committee and advisory council,
shall establish and annually review and update a business and
financial sustainability plan for the Iowa health information
network. The plan shall include fees to be paid to the
department by participants who choose to access and use the
Iowa health information network. The participant fee schedule
shall be structured using fair share, value-based principles.
2. The department shall update and submit a financial model,
including fee schedule, revenue and expense projections, and a
budget, to the executive committee and the board for approval

Senate File 2318, p. 6
on an annual basis.
Sec. 11. NEW SECTION . 135.156B Iowa health information
network —— duties of the department.
The department shall do all of the following:
1. Develop, implement, and enforce the following, as
approved by the board:
a. Strategic, operational, and business and financial
sustainability plans for the Iowa health information network.
b. Standards, requirements, policies, and procedures for
access to and use, secondary use, and privacy and security
of health information exchanged through the Iowa health
information network, consistent with applicable federal and
state standards and laws.
c. Rules, policies, and procedures for monitoring
participant usage of the Iowa health information network and
enforcing compliance with applicable standards, requirements,
policies, rules, and procedures.
d. Policies and procedures for administering the
infrastructure, technology, and associated professional
services required for operation of the Iowa health information
network and the provision of services through the Iowa health
information network.
e. An annual budget and fiscal report for the business and
technical operations of the Iowa health information network
and an annual report for the Iowa health information network
and the services provided through the Iowa health information
network.
2. Provide human resources, budgeting, project and activity
coordination, and related management functions to the Iowa
health information network and the services provided through
the Iowa health information network.
3. Enter into participation agreements with participants in
the Iowa health information network.
4. Collect participant fees, record receipts and approvals
of payments, and file required financial reports.
5. Apply for, acquire by gift or purchase, and hold,
dispense, or dispose of funds and real or personal property
from any person, governmental entity, or organization in
the exercise of its powers or performance of its duties in
accordance with this division.
6. Select and contract with vendors of goods and services in
compliance with all applicable state and federal procurement
laws and regulations.

Senate File 2318, p. 7
7. Work to align interstate and intrastate interoperability
standards in accordance with national health information
exchange standards.
8. Execute all instruments necessary or incidental to the
performance of its duties and the execution of its powers under
this division.
Sec. 12. NEW SECTION . 135.156C Iowa health information
network fund.
1. The Iowa health information network fund is created as a
separate fund within the state treasury under the control of
the board. Revenues, donations, gifts, interest, participant
fees, and other moneys received or generated relative to the
operation and administration of the Iowa health information
network shall be deposited in the fund.
2. Moneys in the fund are appropriated to and shall be
expended by the department only for activities and operations
suitable to the performance of the department’s duties,
subject to executive committee review and board approval.
Disbursements may be made from the fund for purposes related
to the administration, management, operations, functions,
activities, or sustainability of the Iowa health information
network.
3. Notwithstanding section 12C.7, subsection 2, earnings
or interest on moneys deposited in the fund shall be credited
to the fund. Moneys in the fund at the end of each fiscal year
shall not revert to another fund but shall remain in the fund
for expenditure in subsequent fiscal years.
4. The moneys in the fund shall be subject to financial and
compliance audits by the auditor of state.
Sec. 13. NEW SECTION . 135.156D Technical infrastructure.
1. The Iowa health information network shall provide a
mechanism to facilitate and support the secure electronic
exchange of health information between participants.
2. The Iowa health information network shall not function as
a central repository of all health information.
3. The Iowa health information network shall provide a
mechanism for participants without an electronic health records
system to access health information from the Iowa health
information network.
Sec. 14. NEW SECTION . 135.156E Legal and policy.
1. Upon approval from the board, the department shall
implement appropriate security standards, policies, and
procedures to protect the transmission and receipt of

Senate File 2318, p. 8
protected health information exchanged through the Iowa health
information network, which shall, at a minimum, comply with the
Health Insurance Portability and Accountability Act security
rule pursuant to 45 C.F.R. pt. 164, subpt. C, and shall reflect
all of the following:
a. Include authorization controls, including the
responsibility to authorize, maintain, and terminate a
participant’s use of the Iowa health information network.
b. Require authentication controls to verify the identify
and role of the participant using the Iowa health information
network.
c. Include role-based access controls to restrict
functionality and information available through the Iowa health
information network.
d. Include a secure and traceable electronic audit system
to document and monitor the sender and the recipient of health
information exchanged through the Iowa health information
network.
e. Require standard participation agreements which
define the minimum privacy and security obligations of all
participants using the Iowa health information network and
services available through the Iowa health information network.
f. Include controls over access to and the collection,
organization, and maintenance of records and data for
purposes of research or population health that protect the
confidentiality of consumers who are the subject of the health
information.
2. A patient shall have the opportunity to decline exchange
of the patient’s health information through the Iowa health
information network. A patient shall not be denied care or
treatment for declining to exchange the patient’s health
information, in whole or in part, through the Iowa health
information network. The board shall provide by rule the means
and process by which patients may decline participation. The
means and process utilized under the rules shall minimize the
burden on patients and health care professionals.
3. Unless otherwise authorized by law or rule, a patient’s
decision to decline participation means that none of the
patient’s health information shall be accessible through the
record locator service function of the Iowa health information
network. A patient’s decision to decline having health
information shared through the record locator service function
shall not limit a health care professional with whom the

Senate File 2318, p. 9
patient has or is considering a treatment relationship from
sharing health information concerning the patient through
the secure messaging function of the Iowa health information
network.
4. A patient who declines participation in the Iowa health
information network may later decide to have health information
shared through the Iowa health information network. A patient
who is participating in the Iowa health information network may
later decline participation in the network.
5. A participant shall not release or use protected health
information exchanged through the Iowa health information
network for purposes unrelated to prevention, treatment,
payment, or health care operations unless otherwise authorized
or required by state or federal law. Participants shall
limit the use and disclosure of protected health information
for payment or health care operations to the minimum amount
required to accomplish the intended purpose of the use or
request, in compliance with the Health Insurance Portability
and Accountability Act and other applicable state or federal
law. Use or distribution of the information for a marketing
purpose, as defined by the Health Insurance Portability and
Accountability Act, is strictly prohibited.
6. The department and all persons using the Iowa health
information network are individually responsible for following
breach notification policies as provided by the Health
Insurance Portability and Accountability Act.
7. A participant shall not be compelled by subpoena, court
order, or other process of law to access health information
through the Iowa health information network in order to gather
records or information not created by the participant.
8. All participants exchanging health information and data
through the Iowa health information network shall grant to
other participants of the network a nonexclusive license to
retrieve and use that information in accordance with applicable
state and federal laws, and the policies, standards, and rules
established by the board.
9. The board shall establish by rule the procedures for a
patient who is the subject of health information to do all of
the following:
a. Receive notice of a violation of the confidentiality
provisions required under this division.
b. Upon request to the department, view an audit report
created under this division for the purpose of monitoring

Senate File 2318, p. 10
access to the patient’s health care information.
10. A health care professional who relies reasonably and
in good faith upon any health information provided through
the Iowa health information network in treatment of a patient
who is the subject of the health information shall be immune
from criminal or civil liability arising from any damages
caused by such reasonable, good-faith reliance. Such immunity
shall not apply to acts or omissions constituting negligence,
recklessness, or intentional misconduct.
11. A participant that has disclosed health information
through the Iowa health information network in compliance with
applicable law and the standards, requirements, policies,
procedures, and agreements of the network shall not be subject
to criminal or civil liability for the use or disclosure of the
health information by another participant.
12. Notwithstanding chapter 22, the following records shall
be kept confidential, unless otherwise ordered by a court or
consented to by the patient or by a person duly authorized to
release such information:
a. The protected health information contained in, stored in,
submitted to, transferred or exchanged by, or released from the
Iowa health information network.
b. Any protected health information in the possession of
the department due to its administration of the Iowa health
information network.
13. Unless otherwise provided in this division, when
using the Iowa health information network or a private health
information network maintained in this state that complies
with the privacy and security requirements of this chapter for
the purposes of patient treatment, a health care professional
or a hospital is exempt from any other state law that is
more restrictive than the Health Insurance Portability and
Accountability Act that would otherwise prevent or hinder the
exchange of patient information by the patient’s health care
professional or hospital.
Sec. 15. NEW SECTION . 135.156F Governance review.
1. The governance structure as provided in this division
consisting of the department acting on behalf of the board
subject to executive committee review and board approval shall
continue during the term of the state health information
exchange cooperative agreement between the department and the
office of the national coordinator for health information
technology to address the development of standards, policies,

Senate File 2318, p. 11
and procedures; dissemination of interoperability standards;
the installation, testing, and operation of the Iowa health
information network infrastructure; and the evolution of Iowa
health information network services to improve patient care for
the population.
2. During the final year of the term of the cooperative
agreement, the executive committee and the department shall
review the governance structure, operations of the Iowa
health information network, and the business and financial
sustainability plan and make recommendations to the board
regarding the future governance of the Iowa health information
network.
Sec. 16. DETERMINATION OF USE, RELEASE, OR DISCLOSURE OF
PROTECTED HEALTH INFORMATION. The department of public health
shall review the potential of the use, release, or disclosure
of protected health information under this Act for the purposes
of research, and shall submit its findings and recommendations
to the general assembly within twelve months of the effective
date of this Act.
Sec. 17. EFFECTIVE UPON ENACTMENT. This Act, being deemed
of immediate importance, takes effect upon enactment.
______________________________
JOHN P. KIBBIE
President of the Senate
______________________________
KRAIG PAULSEN
Speaker of the House
I hereby certify that this bill originated in the Senate and
is known as Senate File 2318, Eighty-fourth General Assembly.
______________________________
MICHAEL E. MARSHALL
Secretary of the Senate
Approved _______________, 2012
______________________________
TERRY E. BRANSTAD
Governor