BILL ANALYSIS

 

 

 

C.S.H.B. 1680

By: Raymond

Human Services

Committee Report (Substituted)

 

 

 

BACKGROUND AND PURPOSE

 

The Legislature created the Texas Health Services Authority (THSA) in 2007 as a public nonprofit corporation to help promote use of electronic health records and health information exchanges (HIEs) in Texas.  Health information exchanges are the underlying IT networks that allow healthcare providers like hospitals and physicians to share electronic health records quickly across distances.  THSA provides a variety of services to local health information exchanges and other entities for fees that it charges, including a statutory program for certifying that organizations and persons working with protected health records have complied with privacy and security standards adopted in rule by the Health and Human Services Commission.

 

THSA is subject to the Sunset Act and will be abolished on September 1, 2015, unless continued by the Legislature.  The Sunset Commission concluded that THSA needed six additional years of operation as a statutory entity to prepare it for transition to a private nonprofit corporation so that it could further develop revenue-producing services.  After that, THSA would continue in the private sector in conformance with market-based principles. 

 

CRIMINAL JUSTICE IMPACT

 

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

 

RULEMAKING AUTHORITY

 

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

 

ANALYSIS

 

Expiration of THSA in Six Years

 

C.S.H.B. 1680 makes changes necessary to remove THSA from statute as of September 1, 2021.  The bill amends the Health and Safety Code to remove THSA’s current Sunset date of September 1, 2015 and delete language allowing the governor to order the dissolution of THSA.  The bill amends the Government Code to eliminate, as of September 1, 2021, the requirements that the Electronic Health Information Exchange System Advisory Committee include at least one representative of THSA, and that the advisory committee collaborate with THSA on certain matters related to the interoperability of health information exchange systems.  The bill amends the Health and Safety Code to make other changes as follows.  C.S.H.B. 1680 removes THSA, as of September 1, 2021, from requirements to coordinate or consult with specific state agencies in matters related to certain federal audits or in seeking federal funds for enforcing Chapter 181 of the Health and Safety Code dealing with medical records privacy.  The bill amends the Health and Safety Code to expire, as of September 1, 2021, various subchapters of Chapter 182 related generally to THSA’s purpose, definitions, and administration; and sections of that chapter covering THSA-related topics concerning general powers and duties, prohibited acts, privacy of information, security compliance, intellectual property, annual report, and funding.  C.S.H.B. 1680 further amends Chapter 182 by expiring, as of September 1, 2021, subsections (a) – (e) of Section 182.108 of that chapter dealing with standards for electronic sharing of protected health information and certification of covered entities.  The bill renames Chapter 182, Health and Safety Code from “Texas Health Services Authority” to “Electronic Exchange of Health Information”.

 

Privacy and Security Standards and Certification

 

C.S.H.B. 1680 amends the Health and Safety Code to add, effective September 1, 2021, language to provide for continuing after that date the program for certifying past compliance with privacy and security standards for the electronic sharing of protected health information adopted by the Health and Human Services Commission (HHSC).  The bill specifies that the privacy and security standards for the electronic sharing of protected health information in effect on that date continue until amended by rule of HHSC, and authorizes HHSC, in amending these standards, to seek the assistance of a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities.  The bill also specifies requirements in designing these standards.  The bill requires HHSC to publish the adopted standards on its website.  C.S.H.B. 1680 requires HHSC to designate a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities to establish a process by which covered entities may apply for certification by HHSC.  The bill requires HHSC to establish the process or designate another organization with relevant knowledge to establish the process in the absence of such an organization.  C.S.H.B. 1680 provides definitions relevant to the certification program being continued.

 

THSA Board

 

C.S.H.B. 1680 amends the Health and Safety Code to change the composition of the THSA board.  The bill specifies that the governor shall appoint at least two ex officio nonvoting members representing health and human services agencies as state agency data resources instead of at least two such members from the Department of State Health Services as required in current law.  In addition, the bill requires the governor to appoint one person representing Texas local health information exchanges to the board, thus increasing the number of board members from 11 to 12.

 

EFFECTIVE DATE

 

Except as otherwise provided, September 1, 2015.

 

COMPARISON OF ORIGINAL AND SUBSTITUTE

 

While C.S.H.B. 1680 may differ from the original in minor or nonsubstantive ways, the following comparison is organized and formatted in a manner that indicates the substantial differences between the introduced and committee substitute versions of the bill.

 

COLUMN 1

COLUMN 2

SECTION 1.  Section 531.904, Government Code, is amended by amending Subsections (c) and (g) and adding Subsection (c-1) to read as follows:

(c)  The advisory committee must include the following members:

(1)  Medicaid providers;

(2)  child health plan program providers;

(3)  fee-for-service providers;

(4)  [at least one representative of the Texas Health Services Authority established under Chapter 182, Health and Safety Code;

[(5)]  at least one representative of each health and human services agency;

(5) [(6)]  at least one representative of a major provider association;

(6) [(7)]  at least one representative of a health care facility;

(7) [(8)]  at least one representative of a managed care organization;

(8) [(9)]  at least one representative of the pharmaceutical industry;

(9) [(10)]  at least one representative of Medicaid recipients and child health plan enrollees;

(10) [(11)]  at least one representative of a local or regional health information exchange; and

(11) [(12)]  at least one representative who is skilled in pediatric medical informatics.

(c-1)  Notwithstanding Subsection (c), the advisory committee must include at least one representative of the Texas Health Services Authority established under Chapter 182, Health and Safety Code. This subsection expires September 1, 2021.

 

 

 

 

 

 

 

 

 

 

(g)  The advisory committee shall collaborate with the Texas Health Services Authority to ensure that the health information exchange system is interoperable with, and not an impediment to, the electronic health information infrastructure that the authority assists in developing.  This subsection expires September 1, 2021.

 

SECTION 1.  Section 531.904, Government Code, is amended by amending Subsections (c) and (g) and adding Subsections (c-1) and (c-2) to read as follows:

(c)  The advisory committee must include the following members:

(1)  Medicaid providers;

(2) child health plan program providers;

(3)  fee-for-service providers;

(4)  [at least one representative of the Texas Health Services Authority established under Chapter 182, Health and Safety Code;

[(5)]  at least one representative of each health and human services agency;

(5) [(6)]  at least one representative of a major provider association;

(6) [(7)]  at least one representative of a health care facility;

(7) [(8)]  at least one representative of a managed care organization;

(8) [(9)]  at least one representative of the pharmaceutical industry;

(9) [(10)]  at least one representative of Medicaid recipients and child health plan enrollees;

(10) [(11)]  at least one representative of a local or regional health information exchange; and

(11) [(12)]  at least one representative who is skilled in pediatric medical informatics.

(c-1)  Notwithstanding Subsection (c), the advisory committee must include at least one representative of the Texas Health Services Authority established under Chapter 182, Health and Safety Code. This subsection  expires September 1, 2021.

(c-2)  Notwithstanding Subsection (c), on and after September 1, 2021, the advisory committee must include at least one representative of the private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities designated under Section 182.108(j), Health and Safety Code.

(g)  The advisory committee shall collaborate with the Texas Health Services Authority to ensure that the health information exchange system is interoperable with, and not an impediment to, the electronic health information infrastructure that the authority assists in developing.  This subsection expires September 1, 2021.

 

SECTION 2.  Section 181.206, Health and Safety Code, is amended by amending Subsection (a) and adding Subsection (a-1).

SECTION 2. Same as introduced version.

 

SECTION 3.  Section 181.207, Health and Safety Code, is amended.

SECTION 3. Same as introduced version.

SECTION 4.  The heading to Chapter 182, Health and Safety Code, is amended.

SECTION 4. Same as introduced version.

 

SECTION 5.  Subchapter A, Chapter 182, Health and Safety Code, is amended by adding Section 182.003.

SECTION 5. Same as introduced version.

 

SECTION 6.  Section 182.052, Health and Safety Code, is amended.

SECTION 6. Same as introduced version.

SECTION 7.  Section 182.053, Health and Safety Code, is amended by amending Subsections (a) and (b) and adding Subsections (b-1)  and (h).

SECTION 7. Same as introduced version.

 

 

SECTION 8.  Section 182.101, Health and Safety Code, is amended.

SECTION 8. Same as introduced version.

SECTION 9.  Section 182.102, Health and Safety Code, is amended by adding Subsection (c).

SECTION 9. Same as introduced version.

 

SECTION 10.  Section 182.103, Health and Safety Code, is amended by adding Subsection (d).

SECTION 10. Same as introduced version.

 

SECTION 11.  Section 182.104, Health and Safety Code, is amended.

SECTION 11. Same as introduced version.

SECTION 12.  Section 182.105, Health and Safety Code, is amended.

SECTION 12. Same as introduced version.

SECTION 13.  Section 182.106, Health and Safety Code, is amended.

SECTION 13. Same as introduced version.

SECTION 14.  Section 182.107, Health and Safety Code, is amended by adding Subsection (d).

SECTION 14. Same as introduced version.

 

SECTION 15.  Section 182.108, Health and Safety Code, is amended by adding Subsections (f), (g), (h), (i), (j), (k), and (l) to read as follows:

(f)  Subsections (a)-(e) and this subsection expire September 1, 2021.

 

 

 

 

 

(g)  The privacy and security standards for the electronic sharing of protected health information adopted under this section and in effect on September 1, 2021, continue until amended by rule by the Health and Human Services Commission.

(h)  In amending standards under Subsection (g), the Health and Human Services Commission may seek the assistance of a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities.

 

(i)  Standards amended under Subsection (g) must be designed to:

(1)  comply with the Health Insurance Portability and Accountability Act and Privacy Standards and Chapter 181;

(2)  comply with any other state and federal law relating to the security and confidentiality of information electronically maintained or disclosed by a covered entity;

(3)  ensure the secure maintenance and disclosure of individually identifiable health information;

(4)  include strategies and procedures for disclosing individually identifiable health information; and

(5)  support a level of system interoperability with existing health record databases in this state that is consistent with emerging standards.

(j)  The Health and Human Services Commission shall designate a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities to establish a process by which a covered entity may apply for certification by the Health and Human Services Commission of a covered entity's past compliance with standards adopted under this section.  If a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities does not exist, the Health and Human Services Commission shall either:

 

(1)  establish the process described by this subsection; or

(2)  designate another entity with relevant knowledge to establish the process described by this subsection.

(k)  The Health and Human Services Commission shall publish the standards adopted under this section on the commission's Internet website.

(l)  In this section:

(1)  "Covered entity" has the meaning assigned by Section 181.001.

(2)  "Disclose" has the meaning assigned by Section 181.001.

(3)  "Health Insurance Portability and Accountability Act and Privacy Standards" has the meaning assigned by Section 181.001.

(4)  "Individually identifiable health information" means individually identifiable health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

(5)  "Protected health information" means protected health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

 

SECTION 15.  (a)  Section 182.108, Health and Safety Code, is amended by adding Subsection (f) to read as follows:

(f)  Subsections (a)-(e) and this subsection expire September 1, 2021.

(b)  Effective September 1, 2021, Section 182.108, Health and Safety Code, is amended by adding Subsections (g), (h), (i), (j), (k), and (l) to read as follows:

(g)  The privacy and security standards for the electronic sharing of protected health information adopted under this section and in effect on September 1, 2021, continue until amended by rule by the Health and Human Services Commission.

(h)  In amending standards under Subsection (g), the Health and Human Services Commission shall seek the assistance of a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities.

(i)  Standards amended under Subsection (g) must be designed to:

(1)  comply with the Health Insurance Portability and Accountability Act and Privacy Standards and Chapter 181;

(2)  comply with any other state and federal law relating to the security and confidentiality of information electronically maintained or disclosed by a covered entity;

(3)  ensure the secure maintenance and disclosure of individually identifiable health information;

(4)  include strategies and procedures for disclosing individually identifiable health information; and

(5)  support a level of system interoperability with existing health record databases in this state that is consistent with emerging standards.

(j)  The Health and Human Services Commission shall designate a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities to establish a process by which a covered entity may apply for certification by the designated private nonprofit organization of a covered entity's past compliance with standards adopted under this section.  If a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities does not exist, the Health and Human Services Commission shall either:

(1)  establish the process described by this subsection; or

(2)  designate another entity with relevant knowledge to establish the process described by this subsection.

(k)  The entity that establishes the process under Subsection (j) shall publish the standards adopted under this section on the entity's Internet website.

(l)  In this section:

(1)  "Covered entity" has the meaning assigned by Section 181.001.

(2)  "Disclose" has the meaning assigned by Section 181.001.

(3)  "Health Insurance Portability and Accountability Act and Privacy Standards" has the meaning assigned by Section 181.001.

(4)  "Individually identifiable health information" means individually identifiable health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

(5)  "Protected health information" means protected health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

 

SECTION 16.  This Act takes effect September 1, 2015.

 

SECTION 16.  Except as otherwise provided by this Act, this Act takes effect September 1, 2015.