Compare versions
--- version:Edition 1+++ version:Filed@@ -1,16 +1,16 @@GENERAL ASSEMBLY OF NORTH CAROLINASESSION 2025-S 1-SENATE BILL 509+S D+SENATE BILL DRS15195-MGfa-82Short Title: Health Information Exchange Act Revisions. (Public)Sponsors: Senators Hise, Burgin, and Adcock (Primary Sponsors).-Referred to: Rules and Operations of the Senate-March 26, 2025-*S509-v-1*+Referred to:++*DRS15195-MGfa-82*A BILL TO BE ENTITLED 1-AN ACT REVISING THE STATEWIDE HEALTH INF ORMATION EXCHANGE AC T; 2-AND AUTHORIZING THE IMPOSITION OF NEW CI VIL PENALTIES FOR 3+AN ACT REVISING THE STATEWIDE HEALTH INFORMATION EXCHANGE ACT; 2+AND AUTHORIZING THE IMPOSITION OF NEW CIVIL PENALTIES FOR 3VIOLATIONS OF THE ACT AND A NEW STATE HEALTH DATA ASSESSMENT FEE. 4The General Assembly of North Carolina enacts: 5SECTION 1. Article 29B of Chapter 90 of the General Statutes reads as rewritten: 6@@ -22,7 +22,7 @@"§ 90-414.2. Purpose. 12This Article is intended to improve the quality of health care delivery within this State by 13facilitating and regulating the use of a voluntary, statewide health information exchange network 14-for the secure electronic transmiss ion of individually identifiable health information among 15+for the secure electronic transmission of individually identifiable health information among 15health care providers, health plans, and health care clearinghouses clearinghouses, and the State 16in a manner that is consistent with the Health Insurance Portability and Accountability Act, 17Privacy Rule and Security Rule, 45 C.F.R. §§ 160, 164. 18@@ -38,27 +38,31 @@(3a) Data transfer systems. – Electronic systems or platforms that (i) facilitate the 28submission of any combination of clinical, demographic, or claims data to the 29HIE Network and (ii) are maintained, controlled, directed, or licensed by, or 30-on behalf of, a cov ered entity or hybrid entity subject to this Article. Data 31+on behalf of, a covered entity or hybrid entity subject to this Article. Data 31transfer systems may be comprised of health information technology or claims 32processing technology, or both, including hardware, software, integrated 33technologies and related licenses, or packaged solutions sold as services. Data 34transfer systems include, but are not limited to, electronic systems or platforms 35related to electronic health records, pharmacy benefits and claims, claims 36-General Assembly Of North Carolina Session 2025-Page 2 Senate Bill 509-First Edition-processing, or care management. Data transfer systems do not inclu de any 1+FILED SENATE+Mar 25, 2025+S.B. 509+PRINCIPAL CLERK+General Assembly Of North Carolina Session 2025+Page 2 DRS15195-MGfa-82+processing, or care management. Data transfer systems do not include any 1information technology systems that are directly maintained, controlled, or 2licensed by the State Health Plan for Teachers and State Employees. 3(4) Department. – North Carolina Department of Health and Human Services. 4(5) Disclose or disclosure. – The release, transfer, provision of access to, or 5-divulging in any other manner an individual's protected health information 6+divulging in any other manner an individual 's protected health information 6through the HIE Network. 7(6) Repealed by Session Laws 2017-57, s. 11A.5(f), effective July 1, 2017. 8(7) GDAC. – The North Carolina Government Data Analytics Center. 9(8) HIE Network. – The voluntary, statewide health information exchange 10network network, which is a health data utility overseen and administered by 11the Authority. 12-(9) HIPAA. – Sections 261 through 264 of the federal Health Insurance 13+(9) HIPAA. – Sections 261 through 264 of the federal Health Insurance 13Portability and Accountability Act of 1996, P.L. 104 -191, as amended, and 14any federal regulations adopted to implement these sections, as amended. 15(10) Individual. – As defined in 45 C.F.R. § 160.103. 16@@ -73,7 +77,7 @@(13a) Organization National Provider Identifier or Organization NPI. – The HIPAA 25Administrative Simplification Standard that utilizes a 10-position all-numeric 26identification number assigned by the federal National Provider System to 27-uniquely identify a health care provider that is an ent ity other than an 28+uniquely identify a health care provider that is an entity other than an 28individual human being that furnishes health care. 29(14) Protected health information. – As defined in 45 C.F.R. § 160.103. 30(15) Public health purposes. – The public health activities and purposes described 31@@ -94,22 +98,22 @@(20) State health care funds. – Monies paid to providers or entities for the provision 46of health care services to recipients of State -funded health care. The term 47includes both (i) direct payments from the State to providers and entities and 48-(ii) payments that providers and entit ies receive from third parties, or the 49+(ii) payments that providers and entities receive from third parties, or the 49agents of third parties, that are retained by the State for the administration or 50General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 3+DRS15195-MGfa-82 Page 3delivery, or both, of State -funded health care, including prepaid health plans 1as defined in G.S. 108D-1 and claims processors as defined in G.S. 135-48.1. 2"§ 90-414.4. Required participation in HIE Network for some providers. 3(a) Findings. – The General Assembly makes the following findings: 4-(1) That controlling escalating health care costs of the Medicai d program and 5+(1) That controlling escalating health care costs of the Medicaid program and 5other State-funded health care services is of significant importance to the 6State, its taxpayers, its Medicaid recipients, and other recipients beneficiaries 7of State-funded health care services.care. 8(2) That the State and covered entities in North Carolina need timely access to 9certain demographic and clinical information pertaining to services rendered 10to Medicaid and other beneficiaries of State-funded health care program 11-beneficiaries and paid for with Medicaid or other State-funded State health 12+beneficiaries and paid for with Medicaid or other State-funded State health 12care funds in order to assess performance, improve health care outcomes, 13pinpoint medical expense trends, identify beneficiary health risks, and 14evaluate how the State is spending money on Medicaid and other State-funded 15@@ -122,14 +126,14 @@covered entities in North Carolina by secure electronic means as set forth in 22subsection (b) of this section will improve care coordination within and across 23health systems, increase care quality for such beneficiaries, beneficiaries of 24-State-funded health care, enable more effective population healt h 25+State-funded health care, enable more effective population health 25management, reduce duplication of medical services, augment syndromic 26surveillance, allow more accurate measurement of care services and 27outcomes, increase strategic knowledge about the health of the population, 28and facilitate health care cost containment. 29(a1) Mandatory Connection to HIE Network. – Notwithstanding the voluntary nature of 30the HIE Network under G.S. 90-414.2, the following providers and entities shall be connected to 31-the HIE Network and begin submitting data through the HIE Network pertain ing to services 32+the HIE Network and begin submitting data through the HIE Network pertaining to services 32rendered to Medicaid beneficiaries and to other of State-funded health care program beneficiaries 33and paid for with Medicaid or other State-funded State health care funds in accordance with the 34following time line: 35@@ -149,8 +153,8 @@(3) The following entities shall submit encounter and claims data, as appropriate, 49in accordance with the following time line: 50General Assembly Of North Carolina Session 2025-Page 4 Senate Bill 509-First Edition-a. Prepaid Health Plans, as defined in G.S. 108D-1, by the 1+Page 4 DRS15195-MGfa-82+a. Prepaid Health Plans, as defined in G.S. 108D-1, by the 1commencement date of a capitated contract with the Division of 2Health Benefits for the delivery of Medicaid services as specified in 3Article 4 of Chapter 108D of the General Statutes. 4@@ -159,7 +163,7 @@If authorized by the Authority in accordance with this Article, the Department 7of Health and Human Services may submit the data required by this subsection 8on behalf of the entities specified in this subdivision. 9-(4) The following entities shall begin submitting demographic and clinical data 10+(4) The following entities shall begin submitting demographic and clinical data 10by January 1, 2023: 11a. Physicians who perform procedures at ambulatory surgical centers as 12defined in G.S. 131E-146. 13@@ -190,10 +194,10 @@Network and commencing data submission as required by this section. Neither the Department 38of Information Technology, the Department of Health and Human Services, nor the State Health 39Plan for Teachers and State Employees shall grant an extension of time (i) to any provider or 40-entity that fails to provide this information to both Departments, and the State Health Plan for 41+entity that fails to provide this information to both Departments, and the State Health Plan for 41Teachers and State Employees, (ii) that would result in the provider or entity connecting to the 42HIE Network and commencing data submission as required by this section later than January 1, 43-2023. The Department of Information Technol ogy shall consult with the Department of Health 44+2023. The Department of Information Technology shall consult with the Department of Health 44and Human Services and the State Health Plan for Teachers and State Employees to review and 45decide upon a request for an extension of time under this section within 30 days after receiving 46a request for an extension. 47@@ -202,9 +206,9 @@classes of providers of Medicaid and other State-funded health care services for whom acquiring 50and implementing an electronic health record system and connecting to the HIE Network as 51General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 5+DRS15195-MGfa-82 Page 5required by this section would constitute an undue hardship. The Secretary, or the Secretary's 1-designee, shall promptly notify the Department o f Information Technology of classes of 2+designee, shall promptly notify the Department of Information Technology of classes of 2providers granted hardship exemptions under this subsection. Neither the Secretary nor the 3Secretary's designee shall grant any hardship exemption that would result in any class of provider 4connecting to the HIE Network and submitting data later than December 31, 2022. 5@@ -223,22 +227,22 @@(5) Either has met or is making reasonable efforts to meet data quality standards 18established by the Authority that are published on its website. 19(b) Mandatory Submission of Demographic and Clinical Data. – Notwithstanding the 20-voluntary nature of the HIE Network under G.S. 90-414.2 and, except as otherwise provided in 21+voluntary nature of the HIE Network under G.S. 90-414.2 and, except as otherwise provided in 21subsection subsections (c) and (c1) of this section, as a condition of receiving State funds, 22including Medicaid funds, the following entities shall submit at least twice daily, through the 23HIE network, demographic and clinical information pertaining to services rendered to Medicaid 24and other beneficiaries of State-funded health care program beneficiaries and paid for with 25Medicaid or other State -funded State health care funds, solely for the purposes set forth in 26subsection (a) of this section: 27-(1) Each hospital, as defined in G.S. 131E-176(13) that has an electronic health 28+(1) Each hospital, as defined in G.S. 131E-176(13) that has an electronic health 28record system. 29(2) Each Medicaid provider, unless the provider is an ambulatory surgical center 30as defined in G.S. 131E-146; however, a physician who performs a procedure 31at the ambulatory surgical center must be connected to the HIE Network. 32(3) Each provider that receives State health care funds for the provision of health 33services, State-funded health care, unless the provider is an ambulatory 34-surgical center as defined in G.S. 131E-146; however, a physician who 35-performs a procedure at the ambulatory surgical center must be connected t o 36+surgical center as defined in G.S. 131E-146; however, a physician who 35+performs a procedure at the ambulatory surgical center must be connected to 36the HIE Network. 37(4) Each prepaid health plan, as defined in G.S. 58-93-5, that is under a capitated 38contract with the Department for the delivery of Medicaid services, or a local 39@@ -255,13 +259,13 @@(c) Exemption for Certain Records. – Providers with patient records that are subject to 50the disclosure restrictions of 42 C.F.R. § 2 are exempt from the requirements of subsection (b) 51General Assembly Of North Carolina Session 2025-Page 6 Senate Bill 509-First Edition+Page 6 DRS15195-MGfa-82of this section but only with respect to the patient records subject to these disclosure restrictions. 1Providers shall comply with the requirements of subsection (b) of this section with respect to all 2other patient records. A pharmacy shall only be Pharmacies registered with the North Carolina 3Board of Pharmacy under Article 4A of this Chapter and dentists licensed under Article 2 of this 4Chapter are only required to submit claims data pertaining to services rendered to Medicaid and 5-other State-funded health ca re program beneficiaries of State-funded health care and paid for 6+other State-funded health care program beneficiaries of State-funded health care and paid for 6with Medicaid or other State-funded State health care funds. 7(c1) Exemption from Twice Daily Submission. – A pharmacy shall only be The following 8entities are required to submit claims data only once daily through the HIE Network Network: 9@@ -306,15 +310,15 @@subsections (a1) and (b) of this section to connect to the HIE Network or submit data is voluntary. 48(e1) Mandatory and Voluntary Connection and Submissions by the Same Covered Entity. 49– A covered entity that provides, maintains, controls, directs, or licenses a data transfer system 50-on behalf of providers and entities that are required to connect to, and submi t data through, the 51-General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 7+on behalf of providers and entities that are required to connect to, and submit data through, the 51+General Assembly Of North Carolina Session 2025+DRS15195-MGfa-82 Page 7HIE Network under this Article, as well as on behalf of providers and entities that voluntarily 1connect to, and submit data through, the HIE Network may elect not to submit through the HIE 2-Network clinical, demographic, or claims data g enerated by the providers and entities that 3+Network clinical, demographic, or claims data generated by the providers and entities that 3voluntarily connect to, and submit data through, the HIE Network. However, the covered entity 4is required to submit through the HIE Network clinical, demographic, or claims data generated 5-by providers and entitie s that are required to connect to, and submit data through, the HIE 6+by providers and entities that are required to connect to, and submit data through, the HIE 6Network. 7(f) Confidentiality of Data. – All data submitted to or through the HIE Network 8containing protected health information, personally identifying information, or a combination of 9@@ -322,7 +326,7 @@agency of the State are confidential and shall not be defined as public records under G.S. 132-1. 11This subsection shall not be construed to prohibit the disclosure of any such data as otherwise 12permitted under federal law. 13-(g) Time-Limited Exceptions for Connecting to, and Submitting Data Through, the HIE 14+(g) Time-Limited Exceptions for Connecting to, and Submitting Data Through, the HIE 14Network. – All of the following apply to any exception granted by the Authority for connecting 15to, and submitting data through, the HIE Network: 16(1) A covered entity that provides, maintains, controls, directs, or licenses a data 17@@ -335,7 +339,7 @@submitting required data through, the HIE Network. The Authority shall make 24the final determination about whether to grant or deny requests for a 25time-limited exception. Any exception authorized by the Authority may not 26-exceed a on e-year period. However, a covered entity may seek to renew an 27+exceed a one -year period. However, a covered entity may seek to renew an 27exception. 28(3) In order for a covered entity to obtain a time -limited exception for the 29providers and entities on whose behalf it provides, maintains, controls, directs, 30@@ -346,21 +350,21 @@a data transfer system received in the aggregate less than one million 35dollars ($1,000,000) in State health care funds for providing health 36care services to beneficiaries of State-funded health care. 37-b. The covered entity and the prov iders and entities on whose behalf it 38+b. The covered entity and the providers and entities on whose behalf it 38provides, maintains, controls, directs, or licenses a data transfer system 39operated in whole or in part in a geographic area with limited or 40emergent broadband availability. The Department of Information 41Technology, Division of Broadband, shall identify these geographic 42areas and the Authority shall publish a list of the identified geographic 43areas to its website . Alternatively, the Authority, after consultation 44-with the Department of Information Technology, Division of 45+with the Department of Information Technology, Division of 45Broadband, may, in its discretion, grant a time-limited exception after 46evaluating materials provided by a covered entity regarding its level 47of broadband connectivity. 48c. The covered entity will close, dissolve, or be acquired by another 49entity within the next 12 months. 50General Assembly Of North Carolina Session 2025-Page 8 Senate Bill 509-First Edition+Page 8 DRS15195-MGfa-82d. The provider or entity has not yet implemented or is in the process of 1implementing a data transfer system. 2(4) To request a time-limited exception under this subsection, the covered entity 3@@ -373,7 +377,7 @@applying, as well as their respective Organization NPIs. 10d. Technical information regarding its data transfer system and vendor, 11if applicable. 12-e. Provider network information for the State Heal th Plan for Teachers 13+e. Provider network information for the State Health Plan for Teachers 13and State Employees and the North Carolina Medicaid program, as 14applicable. 15f. Identification of the bases criterion, or criteria, in subdivision (g)(3) of 16@@ -388,16 +392,16 @@"§ 90-414.5. State agency and legislative access to HIE Network data. 25(a) The Authority shall provide the Department and the State Health Plan for Teachers 26and State Employees secure, real-time access to data and information disclosed through the HIE 27-Network, solely for the purposes set forth in G.S. 90-414.4(a) and in G.S. 90-414.2. The 28-Authority shall limit access granted to the State Health Plan f or Teachers and State Employees 29+Network, solely for the purposes set forth in G.S. 90-414.4(a) and in G.S. 90-414.2. The 28+Authority shall limit access granted to the State Health Plan for Teachers and State Employees 29pursuant to this section to data and information disclosed through the HIE Network that pertains 30to services (i) rendered to teachers and State employees and (ii) paid for by the State Health Plan. 31(b) At the written request of the Director of the Fiscal Research, Legislative Drafting, or 32Legislative Analysis Division of the General Assembly for an aggregate analysis of the data and 33information disclosed through the HIE Network, the Authority shall provide the professional 34staff of these Divisions with the aggregated analysis responsive to the Director's request. Prior to 35-providing the Director or General Assembly's staff with any aggregate data or information 36-submitted through the HIE Network or with any analysis of this aggr egate data or information, 37+providing the Director or General Assembly 's staff with any aggregate data or information 36+submitted through the HIE Network or with any analysis of this aggregate data or information, 37the Authority shall redact any personal identifying information in a manner consistent with the 38standards specified for de -identification of health information under the HIPAA Privacy Rule, 3945 C.F.R. § 164.514, as amended. 40@@ -408,27 +412,27 @@property of the State. Any data or product derived from the aggregated, de -identified data 45submitted to and stored by the HIE Network pursuant to G.S. 90-414.4 or any other provision of 46this Article, shall be and will remain the sole property of the State. The Authority shall not allow 47-data it receives pursuant to G.S. 90-414.4 or any other provision of this Article to be used or 48-disclosed by or to any person or entity for commercial pur poses or for any other purpose other 49-than those set forth in G.S. 90-414.4(a) or G.S. 90-414.2. To the extent the Authority receives 50+data it receives pursuant to G.S. 90-414.4 or any other provision of this Article to be used or 48+disclosed by or to any person or entity for commercial purposes or for any other purpose other 49+than those set forth in G.S. 90-414.4(a) or G.S. 90-414.2. To the extent the Authority receives 50requests for electronic health information as the term is defined in 45 C.F.R. § 171.102, or other 51General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 9-medical records from an individual, an individual's personal representative, or an individual or 1+DRS15195-MGfa-82 Page 9+medical records from an individual, an individual 's personal representative, or an individual or 1entity purporting to act on an individual's behalf, the Authority (i) shall not fulfill the request and 2(ii) shall make available to the requester and the public, via the Authority's website, educational 3materials about how to access such information from other sources. If the Authority participates 4in the Trusted Exchange Framework and Common Agreement, then it may provide individual 5-access services through the Trusted Exchange Framew ork and Common Agreement. Patient 6+access services through the Trusted Exchange Framework and Common Agreement. Patient 6identifiers created and utilized by the Authority to integrate identity data in the HIE Network, 7along with the minimum necessary required demographic information related to those patients, 8-shall be released to the GDAC an d the Department by the Authority for purposes of entity 9+shall be released to the GDAC and the Department by the Authority for purposes of entity 9resolution and master data management. These identifiers shall not be considered public records 10pursuant to Chapter 132 of the General Statutes. 11"§ 90-414.7. North Carolina Health Information Exchange Authority. 12(a) Creation. – There is hereby established the North Carolina Health Information 13Exchange Authority to oversee and administer the HIE Network in accordance with this Article. 14-The Authority shall be located within the Department of Informatio n Technology and shall be 15+The Authority shall be located within the Department of Information Technology and shall be 15under the supervision, direction, and control of the State CIO. The State CIO shall employ an 16Authority Director and may delegate to the Authority Director all powers and duties associated 17with the daily operation of the Authority, its staff, and the performance of the powers and duties 18@@ -443,7 +447,7 @@c. Compliance with the terms of any participation agreement, business 27associate agreement, or other agreement the Authority or qualified 28organization or other person or entity enters into with a covered entity 29-participating in submis sion of data through or accessing the HIE 30+participating in submission of data through or accessing the HIE 30Network. 31d. Notice to the patient by the healthcare provider or other person or 32entity about the HIE Network, including information and education 33@@ -452,7 +456,7 @@e. Opportunity for all individuals whose data has been submitted to the 36HIE Network to exercise on a continuing basis the right to opt out or 37rescind a decision to opt out. 38-f. Nondiscriminatory treatment by covered entities of individuals who 39+f. Nondiscriminatory treatment by covered entities of individuals who 39exercise the right to opt out. 40g. Facilitation of HIE Network interoperability with electronic health 41record systems of all covered entities listed in G.S. 90-414.4(b). 42@@ -460,13 +464,13 @@G.S. 90-414.4(b) and any use or disclosure of such data to what is 44determined by the Authority to be required in order to advance the 45purposes set forth in G.S. 90-414.2 and G.S. 90-414.4(a). 46-(2) In consultation with the Advisory Board, set guiding princip les for the 47+(2) In consultation with the Advisory Board, set guiding principles for the 47development, implementation, and operation of the HIE Network. 48(3) Employ staff necessary to carry out the provisions of this Article and 49determine the compensation, duties, and other terms and conditions of 50employment of hired staff. 51General Assembly Of North Carolina Session 2025-Page 10 Senate Bill 509-First Edition+Page 10 DRS15195-MGfa-82(4) Enter into contracts pertaining to the oversight and administration of the HIE 1Network, including contracts of a consulting or advisory nature. 2G.S. 143-64.20 does not apply to this subdivision. 3@@ -474,32 +478,32 @@fees to the General Assembly, with an explanation of the fee determination 5process. 6(6) Following consultation with the Advisory Board, develop, approve, and enter 7-into, directly or through qualified organizations acting under the authorit y of 8+into, directly or through qualified organizations acting under the authority of 8the Authority, written participation agreements with persons or entities that 9participate in or are granted access or user rights to the HIE Network. The 10participation agreements shall set forth terms and conditions governing 11participation in, access to, or use of the HIE Network not less than those set 12-forth in agreements already governing covered entities' participation in the 13+forth in agreements already governing covered entities ' participation in the 13federal eHealth Exchange. The agreement shall also require compliance with 14-policies developed by the Authority pursuant to th is Article or pursuant to 15+policies developed by the Authority pursuant to this Article or pursuant to 15applicable laws of the state of residence for entities located outside of North 16Carolina. 17(7) Receive, access, add, and remove data submitted through and stored by the 18HIE Network in accordance with this Article. 19-(8) Following con sultation with the Advisory Board, enter into, directly or 20+(8) Following consultation with the Advisory Board, enter into, directly or 20through qualified organizations acting under the authority of the Authority, a 21HIPAA compliant business associate agreement with each of the persons or 22-entities participating in or granted access o r user rights to the HIE 23+entities participating in or granted access or user rights to the HIE 23Network.Network, except for federal agencies that access the HIE Network 24solely to review patient data for treatment purposes and exchanges made 25through eHealth Exchange or the Trusted Exchange Framework and Common 26-Agreement so lon g as the Authority enters into the agreements that are 27+Agreement so long as the Authority enters into the agreements that are 27required to participate in each of these respective national networks. 28(9) Following consultation with the Advisory Board, grant user rights to the HIE 29-Network to business associates of covered entitie s participating in the HIE 30+Network to business associates of covered entities participating in the HIE 30Network (i) at the request of the covered entities and (ii) at the discretion of 31and subject to contractual, policy, and other requirements of the Authority 32-upon consideration of and consistent with the business associates' legit imate 33+upon consideration of and consistent with the business associates ' legitimate 33need for utilizing the HIE Network and privacy and security concerns. 34(10) Facilitate and promote use of the HIE Network by covered entities.entities and 35business associates acting on their behalf. 36@@ -514,11 +518,11 @@and maintenance of the HIE Network. 45(13) Initiate or direct expansion of existing public -private partnerships within the 46GDAC as necessary to meet the requirements, duties, and obligations of the 47-Authority. Notwithstanding any other provision of law and subject to t he 48+Authority. Notwithstanding any other provision of law and subject to the 48availability of funds, the State CIO, at the request of the Authority, shall assist 49and facilitate expansion of existing contracts related to the HIE Network, 50General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 11+DRS15195-MGfa-82 Page 11provided that such request is made in writing by the Authority to the State 1CIO with reference to specific requirements set forth in this Article. 2(14) In consultation with the Advisory Board, develop a strategic plan for 3@@ -528,12 +532,12 @@operation of the HIE Network: 7a. Business policy. 8b. Protocols for data integrity, data sharing, data security, HIPAA 9-compliance, and business intelligence as defined in G.S. 143B-1381. 10+compliance, and business intelligence as defined in G.S. 143B-1381. 10To the extent permitted by HIPAA, protocols for data sharing shall 11allow for the disclosure of data for academic research. 12c. Qualitative and quantitative performance measures. 13d. An operational budget and assumptions. 14-(16) Annually report to the Join t Legislative Oversight Committee on Health and 15+(16) Annually report to the Joint Legislative Oversight Committee on Health and 15Human Services and the Joint Legislative Oversight Committee on 16Information Technology on the following: 17a. The operation of the HIE Network. 18@@ -570,7 +574,7 @@c. The Secretary of Health and Human Services, or a designee. 49(4) The following ex officio, voting member:members: 50General Assembly Of North Carolina Session 2025-Page 12 Senate Bill 509-First Edition+Page 12 DRS15195-MGfa-82a. The Executive Administrator of the State Health Plan for Teachers and 1State Employees, or a designee. 2b. The Deputy Secretary for the State's Medicaid program, or a designee. 3@@ -579,26 +583,26 @@(c) Administrative Support. – The Department of Information Technology shall provide 6necessary clerical and administrative support to the Advisory Board. 7(d) Meetings. – The Advisory Board shall meet at least quarterly and at the call of the 8-chairperson. A majority of the Advisory Board constitutes a quorum f or the transaction of 9+chairperson. A majority of the Advisory Board constitutes a quorum for the transaction of 9business. 10(e) Terms. – In order to stagger terms, in making initial appointments, the President Pro 11Tempore of the Senate shall designate two of the members appointed under subdivision (1) of 12subsection (a) of this section to serve for a one-year period from the date of appointment and, the 13Speaker of the House of Representatives shall designate two members appointed under 14subdivision (2) of subsection (a) of this section to serve for a one -year period from the date of 15-appointment. The remaining appointed voting members shall serve two -year periods. Future 16+appointment. The remaining appointed voting members shall serve two -year periods. Future 16appointees who are voting members shall serve terms of two years, with staggered terms based 17on this subsection. Appointed voting members may serve up to two consecutive terms, not 18including the abbreviated two-year terms that establish staggered terms or terms of less than two 19years that result from the filling of a vacancy. Ex officio, nonvoting and voting members are not 20-subject to these term limits. A vacancy other than by expirati on of a term shall be filled by the 21+subject to these term limits. A vacancy other than by expiration of a term shall be filled by the 21appointing authority. 22(f) Expenses. – Members of the Advisory Board who are State officers or employees 23shall receive no compensation for serving on the Advisory Board but may be reimbursed for their 24-expenses in accordan ce with G.S. 138-6. Members of the Advisory Board who are full -time 25+expenses in accordance with G.S. 138-6. Members of the Advisory Board who are full -time 25salaried public officers or employees other than State officers or employees shall receive no 26compensation for serving on the Advisory Board but may be reimbursed for their expenses in 27-accordance with G.S. 138-5(b). All other members of the Advisory Board may receive 28+accordance with G.S. 138-5(b). All other members of the Advisory Board may receive 28compensation and reimbursement for expenses in accordance with G.S. 138-5. 29(g) Duties. – The Advisory Board shall provide consultation to the Authority with respect 30to the advancement, administration, and operation of the HIE Network and on matters pertaining 31@@ -608,38 +612,38 @@"§ 90-414.9. Participation by covered entities. 35(a) Each Except for federal agencies that access the HIE Network solely to review patient 36data for treatment purposes, all covered entity that participates entities that participate in the HIE 37-Network shall enter into a HIPAA compliant business associate agreement describ ed in 38+Network shall enter into a HIPAA compliant business associate agreement described in 38G.S. 90-414.7(b)(8) and a written participation agreement described in G.S. 90-414.7(b)(6) with 39the Authority or qualified organization prior to submitting data through or in the HIE Network. 40-Notwithstanding this subsection, the Authority may exchang e data in the HIE Network through 41+Notwithstanding this subsection, the Authority may exchange data in the HIE Network through 41the national eHealth Exchange and the Trusted Exchange Framework and Common Agreement 42so long as the Authority enters into the agreements that are necessary to participate in each of 43these national networks. 44(b) Each covered entity that participates in the HIE Network may authorize its business 45associates on behalf of the covered entity to submit data through, or access data stored in, the 46-HIE Network in accordance with this Article and at the discretion of the Authori ty, as provided 47+HIE Network in accordance with this Article and at the discretion of the Authority, as provided 47in G.S. 90-414.7(b)(8). 48(c) Notwithstanding any federal or State law or regulation to the contrary, each covered 49-entity that participates in the HIE Network may disclose an individual's protected health 50-General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 13-information through the HIE Network t o other covered entities for any purpose permitted by 1+entity that participates in the HIE Network may disclose an individual 's protected health 50+General Assembly Of North Carolina Session 2025+DRS15195-MGfa-82 Page 13+information through the HIE Network to other covered entities for any purpose permitted by 1HIPAA. 2"§ 90-414.10. Continuing right to opt out; effect of opt out. 3(a) Each individual has the right on a continuing basis to opt out or rescind a decision to 4opt out. 5-(b) The Authority or its design ee shall enforce an individual's decision to opt out or 6+(b) The Authority or its designee shall enforce an individual 's decision to opt out or 6rescind an opt out prospectively from the date the Authority or its designee receives written notice 7-of the individual's decision to opt out or rescind an opt out in the manner prescribed by the 8+of the individual 's decision to opt out or rescind an opt out in the manner prescribed by the 8Authority. An individual's decision to opt out or rescind an opt out does not affect any disclosures 9made by the Authority or covered entities through the HIE Network prior to receipt by the 10Authority or its designee of the individual's written notice to opt out or rescind an opt out. 11(c) A covered entity shall not deny treatment, coverage, or benefits to an individual 12-because of the individual's decision to opt out. However, nothing in this Article is intended to 13-restrict a health care provider from otherwise a ppropriately terminating a relationship with an 14+because of the individual 's decision to opt out. However, nothing in this Article is intended to 13+restrict a health care provider from otherwise appropriately terminating a relationship with an 14individual in accordance with applicable law and professional ethical standards. 15-(d) Except as otherwise permitted in G.S. 90-414.11(a)(3), or as required by law, the 16-protected health information of an indivi dual who has exercised the right to opt out may not be 17+(d) Except as otherwise permitted in G.S. 90-414.11(a)(3), or as required by law, the 16+protected health information of an individual who has exercised the right to opt out may not be 17made accessible or disclosed to covered entities or any other person or entity through the HIE 18Network for any purpose. 19(e) Repealed by Session Laws 2017-57, s. 11A.5(e), effective July 1, 2017. 20@@ -661,8 +665,8 @@Network for public health purposes or research purposes, so long as disclosure 36is permitted by both HIPAA and State law. 37(4) Prohibit the Authority or any covered entity participating in the HIE Network 38-from maintaining in the Authority's or qualified organization's computer 39-system a copy of the protected health information of an individual who ha s 40+from maintaining in the Authority 's or qualified organization 's computer 39+system a copy of the protected health information of an individual who has 40exercised the right to opt out, as long as the Authority or the qualified 41organization does not access, use, or disclose the individual's protected health 42information for any purpose other than for necessary system maintenance or 43@@ -674,10 +678,10 @@"§ 90-414.12. Penalties and remedies; immunity for covered entities and business associates 49for good faith participation. 50General Assembly Of North Carolina Session 2025-Page 14 Senate Bill 509-First Edition+Page 14 DRS15195-MGfa-82(a) Except as provided in subsection (b) of this section, a covered entity that discloses 1protected health information in violation of this Article is subject to the following: 2-(1) Any civil penalty or criminal penalty, or both, that may be imposed on the 3+(1) Any civil penalty or criminal penalty, or both, that may be imposed on the 3covered entity pursuant to the Health Information Technology for Economic 4and Clinical Health (HITECH) Act, P.L. 111 -5, Div. A, Title XIII, section 513001, as amended, and any regulations adopted under the HITECH 6@@ -698,7 +702,7 @@presented to the Authority a false record to avoid full payment of the State health data assessment 21under G.S. 90-414.4. The Authority may assess against any person or entity that violates this 22subsection a civil penalty of not less than five thousand dollars ($5,000) and not more than ten 23-thousand dollars ($10,000), plus three times the am ount of damages sustained by the Authority 24+thousand dollars ($10,000), plus three times the amount of damages sustained by the Authority 24as a result of that person 's or entity's actions. The clear proceeds of civil penalties provided for 25in this subsection shall be remitted to the Civil Penalty and Forfeiture Fund in accordance with 26G.S. 115C-457.2. 27@@ -707,7 +711,7 @@of compliance with the requirements prescribed by G.S. 90-414.13. 30(b) To the extent permitted under or consistent with federal law, a covered entity or its 31business associate that in good faith submits data through, accesses, uses, discloses, or relies 32-upon data submitted through the HIE Network shall not be subj ect to criminal prosecution or 33+upon data submitted through the HIE Network shall not be subject to criminal prosecution or 33civil liability for damages caused by such submission, access, use, disclosure, or reliance. 34"§ 90-414.13. Annual compliance report. 35(a) Reporting Requirement. – Each covered entity that provides, maintains, controls, 36@@ -726,8 +730,8 @@(3) Acknowledgment of the provision of health care services to beneficiaries of 49State-funded health care. 50General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 15-(4) Status of technical connection to the HIE Network, as determined unde r 1+DRS15195-MGfa-82 Page 15+(4) Status of technical connection to the HIE Network, as determined under 1G.S. 90-414.4(a4). 2(5) The status of data submission through the HIE Network that is in compliance 3with G.S. 90-414.4. 4@@ -751,16 +755,16 @@form and all representations contained on the form. 22(c) Covered entities shall submit to the Authority all reports and related statements, 23documents, and payments required by this section by the first of May each year. Covered entities 24-shall be deemed to have submitted timely annual compliance repo rts if complete reports are 25+shall be deemed to have submitted timely annual compliance reports if complete reports are 25postmarked or digitally time-stamped on or before the day the reports are due to the Authority. 26If an annual compliance report or any related statements, documents, or payments are submitted 27in a manner that does not comply with this section, the Authority may assess a civil penalty not 28to exceed fifty dollars ($50.00) for each day after the first of May that the report remains out of 29-compliance with the requirements of this section. The clear proceeds of civil penalties provided 30+compliance with the requirements of this section. The clear proceeds of civil penalties provided 30for in this subsection shall be remitted to the Civil Penalty and Forfeiture Fund in accordance 31with G.S. 115C-457.2. 32(d) A covered entity that provides, maintains, controls, directs, or licenses a data transfer 33-system solely on behalf of a provider or en tity that voluntarily connects to the HIE Network 34+system solely on behalf of a provider or entity that voluntarily connects to the HIE Network 34pursuant to G.S. 90-414.4(e) is not required to submit an annual compliance report. 35(e) State agencies are required to submit an abbreviated annual compliance report, on a 36form provided by the Authority, that shall be made available only to State agencies. 37@@ -778,11 +782,11 @@by or on behalf of that provider. 49"§ 90-414.14. Annual State health data assessment fee. 50General Assembly Of North Carolina Session 2025-Page 16 Senate Bill 509-First Edition+Page 16 DRS15195-MGfa-82(a) Annual Fee Requirement. – Each covered entity that provides, maintains, controls, 1directs, or licenses a data transfer system on behalf of a provider or entity subject to the 2mandatory connection and data submission requirements of G.S. 90-414.4 shall pay a n annual 3-State health data assessment fee each year if the covered entity meets any of the following 4+State health data assessment fee each year if the covered entity meets any of the following 4criteria: 5(1) Is not connected to the HIE Network, as determined pursuant to subsection 6(a4) of G.S. 90-414.4. 7@@ -795,7 +799,7 @@G.S. 90-414.13. 14(d) HIE Network Data and Participation Fund; Use of Proceeds. – The HIE Network Data 15and Participation Fund (Fund) is established as a special fund in the Department of Information 16-Technology under the management and control of the Authority. The Fund shall consist of the 17+Technology under the management and control of the Authority. The Fund shall consist of the 17fees collected by the Authority pursuant to this section and all other funds received by the 18Authority pursuant to this Article, except for the clear proceeds of civil penalties collected 19pursuant to G.S. 90-414.12, 90-414.13, 90-414.16, and subsection (g) of this section. The Fund 20@@ -806,14 +810,14 @@an act of appropriation of the General Assembly. The Fund is subject to the provisions of the 25State Budget Act, except that no unexpended surplus of the Fund shall revert to the General Fund. 26(e) Fee Exemption. – A covered entity that provides, maintains, controls, directs, or 27-licenses a data transfer system for providers or entities subject to the HI E Network connection 28+licenses a data transfer system for providers or entities subject to the HIE Network connection 28and data submission requirements of this Article may claim an exemption from the State health 29data assessment fee during a reporting period by demonstrating to the satisfaction of the 30Authority that one or more of the following is true: 31(1) The covered entity has secured a time -limited exception from the Authority 32under G.S. 90-414.4(g) for the applicable State health data assessment fee 33reporting period. 34-(2) The covered entity attests, in writing, that it and the providers and entities on 35+(2) The covered entity attests, in writing, that it and the providers and entities on 35whose behalf it provides, maintains, controls, directs, or licenses a data 36transfer system received less than five hundred thousand dollars ($500,000) 37in State health care funds for providing health care services to beneficiaries of 38@@ -830,9 +834,9 @@(5) The covered entity attests, in writing, that it is actively transitioning between 49data transfer systems. 50General Assembly Of North Carolina Session 2025-Senate Bill 509-First Edition Page 17+DRS15195-MGfa-82 Page 17(f) Revocation of Exempt Status. – The Authority may revoke a covered entity 's 1-exemption from payment of the State h ealth data assessment fee if the covered entity is 2+exemption from payment of the State health data assessment fee if the covered entity is 2unresponsive to communications from the Authority or if the covered entity fails to maintain 3contact with the Authority. The Authority may revoke an exemption from the payment of the 4State health data assessment fee for good cause after giving the covered entity 30 days ' written 5@@ -841,7 +845,7 @@(g) Civil Penalty for Submitting a False Record to Avoid the Fee. – It is unlawful for any 8person or entity to knowingly present or cause to be presented to the Authority a false record to 9avoid full payment of the State health data assessment fee due under this section. The Authority 10-shall assess against any person or entit y that violates this section a civil penalty of not less than 11+shall assess against any person or entity that violates this section a civil penalty of not less than 11five thousand dollars ($5,000) and not more than ten thousand dollars ($10,000), plus three times 12the amount of damages sustained by the Authority as a result of that person 's or entity's actions. 13The clear proceeds of civil penalties provided for in this subsection shall be remitted to the Civil 14@@ -852,7 +856,7 @@time-limited exceptions under G.S. 90-414.4 and (ii) assess penalties under G.S. 90-414.14. The 19Authority shall send these determinations, in writing, to providers and entities via certified mail, 20return receipt requested, and via email, if known to the Authority. If a provider or entity disagrees 21-with the Authority 's determination, it shall deliver a petition for appeal to th e Department of 22+with the Authority 's determination, it shall deliver a petition for appeal to the Department of 22Information Technology's registered agent via certified mail, return receipt requested, within 30 23calendar days after receipt of the Authority's written determination. The petition for appeal shall 24include an explanation of the specific reasons the provider or entity disagrees with the Authority's 25@@ -863,7 +867,7 @@(b) Untimely Appeals. – A petitioner's failure to submit a timely petition for appeal shall 30result in the dismissal of the appeal with prejudice. The Department of Information Technology 31shall notify the provider or entity of such dismissal in writing. 32-(c) Review by the State CIO or the State CIO 's Designee. – The State CIO or the Sta te 33+(c) Review by the State CIO or the State CIO 's Designee. – The State CIO or the State 33CIO's designee shall review all timely petitions for appeal under this section. The State CIO or 34the State CIO 's designee may render a decision on the petition without meeting with the 35petitioner. If the State CIO or State CIO 's designee renders a decision without meeting with the 36@@ -883,7 +887,7 @@designee is mailed to the petitioner or the date the decision of the State CIO or the State CIO 's 50designee is emailed to the petitioner. Except as otherwise provided by this Article, no other 51General Assembly Of North Carolina Session 2025-Page 18 Senate Bill 509-First Edition+Page 18 DRS15195-MGfa-82disputes between the Authority and providers or entities, including disputes involving the terms 1or conditions of any agreement described in G.S. 90-414.7(b), or a party 's performance under 2any such agreement, are subject to the contested case provisions of Chapter 150B of the General 3@@ -891,18 +895,18 @@"§ 90‑414.16. Data related services. 5(a) Data Related Services. – The Authority may provide data related services to a covered 6entity participating in the HIE Network or to a business associate of the participating covered 7-entity that is using the service to perform a function for th e participating covered entity. Only 8+entity that is using the service to perform a function for the participating covered entity. Only 8covered entities participating in the HIE Network may make a request to the Authority for data 9related services. Nothing in this section shall be construed to require the Authority to provide 10data related services to covered entities or their business associates. Data disclosed or used in the 11Authority's provision of these services to any person or entity shall not be used for commercial 12purposes. 13-(b) Cost Recovery. – If the Authority voluntarily elects to provide a data related service 14+(b) Cost Recovery. – If the Authority voluntarily elects to provide a data related service 14to a covered entity, then it may charge a reasonable fee that may not exceed the actual cost 15incurred for the service. The cost recovery shall be based on generally accepted accounting 16-principles and may include labor costs of the personne l providing the service, any information 17+principles and may include labor costs of the personnel providing the service, any information 17technology expense, and any other administrative expense." 18-SECTION 2. The deadline for submitting the first report due under G.S. 90-414.13 19+SECTION 2. The deadline for submitting the first report due under G.S. 90-414.13 19and the accompanying State health data assessment fee, if applicable, is May 1, 2028. 20SECTION 3. Pursuant to G.S. 90-414.14(b), the initial State health data assessment 21fee schedules for annual compliance report periods beginning in 2028, 2029, and 2030 are as 22
Diffs are computed deterministically from extracted bill text and show additions, deletions, and section moves. Scanned-PDF text extracted via OCR is flagged where confidence is low; see methodology.