BILL ANALYSIS

 

 

 

C.S.S.B. 203

By: Nelson

Human Services

Committee Report (Substituted)

 

 

 

BACKGROUND AND PURPOSE

 

The Legislature created the Texas Health Services Authority (THSA) in 2007 as a public nonprofit corporation to help promote use of electronic health records and health information exchanges (HIEs) in Texas.  Health information exchanges are the underlying IT networks that allow healthcare providers like hospitals and physicians to share electronic health records quickly across distances.  THSA provides a variety of services to local health information exchanges and other entities for fees that it charges, including a statutory program for certifying that organizations and persons working with protected health records have complied with privacy and security standards adopted in rule by the Health and Human Services Commission.

 

THSA is subject to the Sunset Act and will be abolished on September 1, 2015, unless continued by the Legislature.  The Sunset Commission concluded that THSA needed six additional years of operation as a statutory entity to prepare it for transition to a private nonprofit corporation so that it could further develop revenue-producing services.  After that, THSA would continue in the private sector in conformance with market-based principles. 

 

CRIMINAL JUSTICE IMPACT

 

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

 

RULEMAKING AUTHORITY

 

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

 

ANALYSIS

 

Expiration of THSA in Six Years

 

C.S.S.B. 203 makes changes necessary to remove Texas Health Services Authority (THSA)  from statute as of September 1, 2021.  The bill amends the Health and Safety Code to remove the current THSA Sunset date of September 1, 2015, and delete language allowing the governor to order the dissolution of THSA.  The bill amends the Government Code to eliminate, as of September 1, 2021, the requirement that the Electronic Health Information Exchange System Advisory Committee include at least one representative of THSA, and adds the requirement that, on and after that date, the advisory committee include at least one representative of the private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities designated under Section 182.108(j), Health and Safety Code.  The bill also eliminates, as of September 1, 2021, the requirement that the advisory committee collaborate with THSA to ensure the interoperability of health information exchange systems.  The bill amends the Health and Safety Code to make other changes as follows. 

 

C.S.S.B. 203 removes, as of September 1, 2021, THSA’s coordination and consultation role in matters related to certain federal audits or in seeking federal funds for enforcing Chapter 181 of the Health and Safety Code dealing with medical records privacy.  The bill amends the Health and Safety Code to expire, as of September 1, 2021, various subchapters of Chapter 182 generally related to THSA’s purpose, definitions, and administration; and sections of that chapter covering THSA-related topics concerning general powers and duties, prohibited acts, privacy of information, security compliance, intellectual property, annual report, and funding.  The bill further amends Chapter 182 by expiring, as of September 1, 2021, Sections 182.108(a) – (e)  relating to standards for electronic sharing of protected health information and certification of covered entities.  The bill renames Chapter 182, Health and Safety Code from "Texas Health Services Authority" to "Electronic Exchange of Health Information."

 

Privacy and Security Standards and Certification

 

C.S.S.B. 203 amends the Health and Safety Code to add language that provides for continuing beyond September 1, 2021, the program for certifying past compliance with privacy and security standards for the electronic sharing of protected health information adopted by the Health and Human Services Commission (HHSC).  The bill specifies that the privacy and security standards for the electronic sharing of protected health information in effect on that date continue until amended by rule of HHSC, and requires HHSC, in amending these standards, to seek the assistance of a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities. The bill also specifies requirements in designing these standards.  C.S.S.B. 203 requires HHSC to designate a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities to establish a process for this organization to certify past compliance with these standards by covered entities.  The bill requires HHSC to establish the process or designate another entity with relevant knowledge to establish the process in the absence of such an organization.  The bill requires the organization or entity establishing the process to publish the adopted standards on its website.  The bill requires HHSC to ensure that any fee charged for the certification process by the designated private nonprofit organization or entity, including a person acting on behalf of a designated organization or entity, is reasonable.  If HHSC establishes such a certification process, HHSC shall set a reasonable fee for the process.  For good cause, HHSC may revoke the designation of the private nonprofit organization or entity to establish or offer the certification process.  C.S.S.B. 203 provides definitions relevant to the certification program being continued.

 

THSA Board

 

C.S.S.B. 203 amends the Health and Safety Code to change the composition of the THSA board.  The bill specifies that the ex officio nonvoting members currently representing the Department of State Health Services are instead to represent health and human services agencies as state agency data resources.  The bill also provides a definition of health and human services agencies.  In addition, the bill requires the governor to appoint as a voting board member one person representing Texas local health information exchanges to the board, thus increasing the number of board members from 11 to 12.

 

Technical Changes

 

C.S.S.B. 203 makes technical changes to align with the changes in law enacted by S.B. 219, Acts of the 84th Legislature, Regular Session, 2015 signed by the Governor on April 2, 2015, giving effect to the bill on that date. 

 

EFFECTIVE DATE

 

Except as otherwise provided, September 1, 2015.

 

COMPARISON OF SENATE ENGROSSED AND SUBSTITUTE

 

While C.S.S.B. 203 may differ from the original in minor or nonsubstantive ways, the following comparison is organized and formatted in a manner that indicates the substantial differences between the engrossed and committee substitute versions of the bill.

 

SENATE ENGROSSED

HOUSE COMMITTEE SUBSTITUTE

SECTION 1.  Section 531.904, Government Code, is amended.

SECTION 1. Same as engrossed version.

 

SECTION 2.  Section 181.206, Health and Safety Code, is amended.

SECTION 2.  Same as engrossed version.

 

SECTION 3.  Section 181.207, Health and Safety Code, is amended to read as follows:

Sec. 181.207.  FUNDING.  (a)  The commission and the Texas Department of Insurance[, in consultation with the Texas Health Services Authority,] shall apply for and actively pursue available federal funding for enforcement of this chapter.

(b)  Notwithstanding Subsection (a), the commission and the Texas Department of Insurance shall consult with the Texas Health Services Authority when applying for or pursuing federal funding under Subsection (a).  This subsection expires September 1, 2021.

SECTION 3. Same as engrossed version.

 

 

SECTION 4.  The heading to Chapter 182, Health and Safety Code, is amended.

SECTION 4. Same as engrossed version.

 

SECTION 5.  Subchapter A, Chapter 182, Health and Safety Code, is amended.

SECTION 5. Same as engrossed version.

 

SECTION 6.  Section 182.052, Health and Safety Code, is amended.

SECTION 6. Same as engrossed version.

 

SECTION 7.  Section 182.053, Health and Safety Code, is amended.

SECTION 7.  Substantially the same as engrossed version.

SECTION 8.  Section 182.101, Health and Safety Code, is amended.

SECTION 8. Same as engrossed version.

 

SECTION 9.  Section 182.102, Health and Safety Code, is amended.

SECTION 9. Same as engrossed version.

 

SECTION 10.  Section 182.103, Health and Safety Code, is amended.

SECTION 10. Same as engrossed version.

 

SECTION 11.  Section 182.104, Health and Safety Code, is amended.

SECTION 11. Same as engrossed version.

 

SECTION 12.  Section 182.105, Health and Safety Code, is amended.

SECTION 12. Same as engrossed version.

 

SECTION 13.  Section 182.106, Health and Safety Code, is amended.

SECTION 13. Same as engrossed version.

 

SECTION 14.  Section 182.107, Health and Safety Code, is amended.

SECTION 14. Same as engrossed version.

 

SECTION 15.  (a)  Section 182.108, Health and Safety Code, is amended by adding Subsection (f) to read as follows:

(f)  Subsections (a)-(e) and this subsection expire September 1, 2021.

(b)  Effective September 1, 2021, Section 182.108, Health and Safety Code, is amended by adding Subsections (g), (h), (i), (j), (k), and (l) to read as follows:

(g)  The privacy and security standards for the electronic sharing of protected health information adopted under this section and in effect on September 1, 2021, continue until amended by rule by the Health and Human Services Commission.

(h)  In amending standards under Subsection (g), the Health and Human Services Commission shall seek the assistance of a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities.

(i)  Standards amended under Subsection (g) must be designed to:

(1)  comply with the Health Insurance Portability and Accountability Act and Privacy Standards and Chapter 181;

(2)  comply with any other state and federal law relating to the security and confidentiality of information electronically maintained or disclosed by a covered entity;

(3)  ensure the secure maintenance and disclosure of individually identifiable health information;

(4)  include strategies and procedures for disclosing individually identifiable health information; and

(5)  support a level of system interoperability with existing health record databases in this state that is consistent with emerging standards.

(j)  The Health and Human Services Commission shall designate a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities to establish a process by which a covered entity may apply for certification by the designated private nonprofit organization of a covered entity's past compliance with standards adopted under this section.  If a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities does not exist, the Health and Human Services Commission shall either:

(1)  establish the process described by this subsection; or

(2)  designate another entity with relevant knowledge to establish the process described by this subsection.

(k)  The entity that establishes the process under Subsection (j) shall publish the standards adopted under this section on the entity's Internet website.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

(l)  In this section:

(1)  "Covered entity" has the meaning assigned by Section 181.001.

(2)  "Disclose" has the meaning assigned by Section 181.001.

(3)  "Health Insurance Portability and Accountability Act and Privacy Standards" has the meaning assigned by Section 181.001.

(4)  "Individually identifiable health information" means individually identifiable health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

(5)  "Protected health information" means protected health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

 

SECTION 15.  (a)  Section 182.108, Health and Safety Code, is amended by adding Subsection (f) to read as follows:

(f)  Subsections (a)-(e) and this subsection expire September 1, 2021.

(b)  Effective September 1, 2021, Section 182.108, Health and Safety Code, is amended by adding Subsections (g), (h), (i), (j), (k), (l), (m), and (n) to read as follows:

(g)  The privacy and security standards for the electronic sharing of protected health information adopted under this section and in effect on September 1, 2021, continue until amended by rule by the commission.

 

(h)  In amending standards under Subsection (g), the commission shall seek the assistance of a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities.

 

(i)  Standards amended under Subsection (g) must be designed to:

(1)  comply with the Health Insurance Portability and Accountability Act and Privacy Standards and Chapter 181;

(2)  comply with any other state and federal law relating to the security and confidentiality of information electronically maintained or disclosed by a covered entity;

(3)  ensure the secure maintenance and disclosure of individually identifiable health information;

(4)  include strategies and procedures for disclosing individually identifiable health information; and

(5)  support a level of system interoperability with existing health record databases in this state that is consistent with emerging standards.

(j)  The commission shall designate a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities to establish a process by which a covered entity may apply for certification by the designated private nonprofit organization of a covered entity's past compliance with standards adopted under this section.  If a private nonprofit organization with relevant knowledge and experience in establishing statewide health information exchange capabilities does not exist, the commission shall either:

 

(1)  establish the process described by this subsection; or

(2)  designate another entity with relevant knowledge to establish the process described by this subsection.

(k)  The entity that establishes the process under Subsection (j) shall publish the standards adopted under this section on the entity's Internet website.

(l)  The commission shall ensure that any fee charged for the certification process described in Subsection (j) by the private nonprofit organization or entity designated under that subsection, including a person acting on behalf of a designated organization or entity, is reasonable. If the commission establishes the process as described by Subsection (j)(1), the commission shall set a reasonable fee for the certification process.

(m)  For good cause, the commission may revoke the designation or authority of a private nonprofit organization or entity to establish the process or offer certifications under Subsection (j).

(n)  In this section:

(1)  "Covered entity" has the meaning assigned by Section 181.001.

(2)  "Disclose" has the meaning assigned by Section 181.001.

(3)  "Health Insurance Portability and Accountability Act and Privacy Standards" has the meaning assigned by Section 181.001.

(4)  "Individually identifiable health information" means individually identifiable health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

(5)  "Protected health information" means protected health information as that term is defined by the privacy rule of the Health Insurance Portability and Accountability Act and Privacy Standards.

 

SECTION 16.  Except as otherwise provided by this Act, this Act takes effect September 1, 2015.

SECTION 16. Same as engrossed version.