S3220 1R

An Act concerning the establishment of a ¹[health data system] process to integrate certain health data and other data from publicly supported programs for population health research¹ and supplementing Title 30 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. The Legislature finds and declares that:

a. Many New Jersey administrative departments and agencies, including, but not limited to, the Departments of Health, Human Services, Community Affairs, Corrections, and Agriculture, currently create, maintain, receive, and transmit individually identifiable data and aggregated data sets in order to perform necessary and vital administrative functions delegated to the agencies.

b. ¹[These administrative departments and agencies often lack the technological and operational resources necessary to create, receive, maintain, and transmit individually identifiable data and data sets created or maintained by other agencies or to execute linkages among data sets and conduct valid statistical analyses while protecting the privacy and security of such and data sets.

c. ]¹ The creation of a ¹[mechanism] process¹ by which a State or federal administrative department or agency or an authorized researcher can access data and data sets created or maintained by a federal, State, or local administrative department or agency will help facilitate the development and evaluation of this data, reduce duplicative data collection and maintenance efforts, and allow for comparison of data for accuracy and reliability.

¹[d.] c.¹ The linkage of multiple sources of State, federal, and local data and the application of valid statistical techniques can facilitate the identification of population trends and individual and community-level determinants directly related to the health, safety, security, and well-being of New Jersey residents.

¹[e.] d.¹ The establishment of a secure, Statewide, integrated ¹[population health data system (“iPHD”)] Population Health Data Project (“iPHD Project)”¹ containing ¹certain¹ data collected by New Jersey administrative departments and agencies, that includes data related to ¹[public health and safety and social services programs,] health and publicly supported programs that¹ will facilitate ¹approved, project-by-project¹ analysis and research and the development of the most effective means for improving the health, safety, security, and well-being of New Jersey residents and the overall cost-efficiency of government programs.

¹[f.] e.¹ The Medicaid Accountable Care Organization Demonstration Project established pursuant to P.L.2011, c.114 (C.30:4D-8.1 et seq.) requires the Rutgers Center for State Health Policy to analyze patient data received from the Department of Human Services and from certified Medicaid Accountable Care Organizations in order to evaluate the achievement of the health care quality improvement and cost containment goals of the Demonstration Project, and the Rutgers Center for State Health Policy currently has the technological and operational resources required to receive, maintain, and transmit individually identifiable data and data sets in a secure database.

¹[g.] f.¹ The Rutgers Center for State Health Policy is responsible for evaluating New Jersey’s Comprehensive Medicaid Waiver Demonstration Project with funding from the New Jersey Department of Human Services and the Robert Wood Johnson Foundation, whereby it receives comprehensive Medicaid enrollment data, fee-for-service claims data, and managed care encounter data, and conducts analyses of Medicaid claims and encounter data to inform recommendations to improve care and reduce costs for the top one percent of Medicaid beneficiaries who account for a disproportionate share of program spending.

2. As used in this act:

“Aggregated data” means information that has been combined into groups showing averages or other summary statistics, and that is not individually identifiable information as defined in this act.

“De-identified data” means information that does not identify an individual and for which there is no reasonable basis to believe that the information can be used to identify an individual, and which meets the requirements for de-identification of protected health information under HIPAA.

“Governing Board” or “Board” means the board charged with responsibility for governing the integrated population health data ¹[system] project¹ established pursuant to section 3 of this act.

“Health data” means information that is created or received by a governmental department or agency that relates to the past, present, or future physical or mental health or condition of an individual or the past, present, or future payment for the provision of health care to an individual.

“HIPAA” means the “Health Insurance Portability and Accountability Act of 1996,” Pub.L.104-191, and any regulations promulgated thereunder by the Secretary of the U.S. Department of Health and Human Services.

“Individually identifiable information” means information that identifies an individual, or with respect to which there is a reasonable basis to believe the information can be used to identify an individual.

“IRB” means an institutional review board designated by the Governing Board and established pursuant to federal regulations (45 CFR 46) with a Federalwide Assurance for the Protection of Human Subjects approved by the U.S. Department of Health and Human Services, Office for Human Research Protections, to review and monitor research involving human subjects to ensure that the subjects are protected from harm and that the rights of subjects are adequately protected.

“iPHD ¹Project¹” means the integrated population health data ¹[system] project¹ established pursuant to section 4 of this act.

“Medicaid Accountable Care Organization” means an organization established pursuant to P.L.2011, c.114 (C.30:4D-8.1 et seq.).

“Protected health information” has the same meaning as defined under HIPAA.

¹“Publicly supported programs data” means information relating to an individual’s receipt of services from or through public support programs administered by a federal, State, or local government or by a private entity, including, but not limited to, an individual’s participation in or eligibility for Medicaid benefits, Supplemental Nutrition Assistance Program benefits, Low Income Home Energy Assistance Program benefits, and Social Services for the Homeless program benefits.¹

“Research” means a systematic investigation, including research development, testing, and evaluation, which is designed to develop or contribute to generalizable knowledge as defined pursuant to 45 C.F.R. 46.102(d).

“Researcher” means a private entity or public entity that conducts research under the review and monitoring of an IRB ¹and has received approval from the data steward for the purpose of requested data elements¹.

¹[“Social services data” means information relating to an individual’s receipt of services from or through public support programs administered by a federal, State, or local government or by a private entity, including, but not limited to, an individual’s participation in or eligibility for Medicaid benefits, Supplemental Nutrition Assistance Program benefits, Low Income Home Energy Assistance Program benefits, and Social Services for the Homeless program benefits.]¹

3. a. The iPHD ¹Project¹ Governing Board is hereby established in, but not of, the Department of ¹[State] Health¹. The Governing Board shall consist of ¹[ten] 10¹ members: one of whom shall be the Director of the Rutgers Center for State Health Policy, who shall serve as a non-voting, ex-officio member; ¹one of whom shall be a public member appointed by the President of the Senate, representing an organization capable of advocating on behalf of persons whose data may be received, maintained, or transmitted by the iPHD Project in accordance with this act; one of whom shall be a public member appointed by the Speaker of the General Assembly, with experience in human subjects research who is affiliated with a research university in New Jersey;¹ and ¹[four] two¹ of whom shall be public members appointed by the Governor ¹[with the advice and consent of the Senate]¹, as follows:

(1) ¹[An individual representing an organization capable of advocating on behalf of persons whose social services data may be received, maintained, or transmitted by the iPHD in accordance with this act;

(2)]¹ An individual with legal expertise and interest in protecting the privacy and security of individually identifiable information; ¹and¹

¹[(3)] (2)¹ An individual with technical expertise and interest in the creation and maintenance of large data systems and data security ¹[; and

(4) An individual with experience in human subjects research, who is affiliated with a research university in New Jersey]¹.

The five remaining members shall be voting, ex-officio members representing ¹the Commissioner of Health, who shall also serve as chair of the Board;¹ the Commissioner of Human Services; the ¹[Commissioner of Health] State Treasurer¹; the Attorney General; ¹and¹ the Chief Information Officer for Rutgers, The State University of New Jersey ¹[; and the Secretary of State, who shall also serve as chair of the Board]¹. Ex-officio members may be represented by designees.

Of the public members first appointed to the Governing Board, two shall be appointed to terms of three years, one shall be appointed to a term of two years, and one shall be appointed to a term of one year. Following the expiration of the initial terms, public members of the Board shall be appointed for terms of three years. The voting ex-officio members of the Board shall serve during their respective terms of office. Any vacancy occurring in the membership of the Board shall be filled in the same manner as the original appointment, but for the unexpired term only. The Board shall meet at least quarterly, and at such other times as it determines, in its judgment, to be necessary. The appointed members of the Board shall serve without compensation but may be reimbursed for necessary expenses incurred in the performance of their duties. In addition, the Board shall be entitled to and avail itself of the assistance and services of the staff of the Department of ¹[State] Health¹, and of the employees of any other State department, board, bureau, commission, or agency, as it may require and as may be available for its purposes.

b. A member of the Governing Board shall not, by reason of the member’s performance of any duty, function, or activity required of, or authorized to be undertaken by, the Board, be liable in an action for damages to any person for any action taken or recommendation made by the member within the scope of the member’s duty, function, or activity as a member of the Board, if the action or recommendation was taken or made without malice. The members of the Board shall be indemnified and their defense of any action provided for in the same manner and to the same extent as employees of the State under the “New Jersey Tort Claims Act,” ¹[P.L.1972, c.45 (C.59:1-1 et seq.)] N.J.S.59:1-1 et seq.¹, on the basis of acts or omissions in the scope of their service.

c. A member of the Governing Board shall not ¹participate in deliberations or¹ vote on any matter before the Board concerning an individual or entity with which the member has, or within the last 12 months has had, any substantial ownership, employment, medical staff, fiduciary, contractual, creditor, or consultative relationship. A member who has or who has had such a relationship with an individual or entity involved in any matter before the Board shall make a written disclosure before any action is taken by the Board with respect to the matter, and shall make the relationship public in any meeting in which action on the matter is to be taken.

d. The iPHD ¹Project¹ Governing Board shall be a public body for the purposes of the “Senator Byron M. Baer Open Public Meetings Act,” P.L.1975, c.231 ¹[(C.10:4-8)] (C.10:4-6 et seq.)¹, and shall conduct its business in accordance with the provisions of that act. ¹All proceedings of the Governing Board shall be subject to P.L.2001, c.404 (C.47:1A-5 et al.).¹

4. a. No later than 12 months after the effective date of this act, the Rutgers Center for State Health Policy shall establish an operational iPHD ¹Project¹ capable of securely receiving, maintaining, and transmitting data in accordance with this act and the HIPAA privacy and security standards applicable to this act. The Rutgers Center for State Health Policy may employ staff to assist with carrying out the functions associated with the establishment and maintenance of the iPHD ¹Project¹.

b. Notwithstanding any provision of this act to the contrary, the iPHD ¹Project¹ shall seek to receive, maintain, and transmit de-identified data wherever possible, and shall only receive, maintain, and transmit individually identifiable information ¹if permitted by this section and other applicable law and if the information is¹ in a form and format that is secured to prevent disclosure of individually identifiable information.

¹c. A consortium of researchers from New Jersey academic institutions and from medical schools affiliated with New Jersey universities will be organized by the Rutgers Center for State Health Policy to facilitate actionable population health research to help improve health outcomes for New Jersey residents, as well as promote New Jersey’s research institutions as leaders in social science research.¹

5. Oversight of the operations of the iPHD ¹Project¹, established pursuant to section 4 of this act, shall be vested in the Governing Board. The iPHD ¹Project¹ shall receive, maintain, and transmit data only as permitted by this act and approved by the Governing Board ¹and agency or department whose data is requested¹. The Governing Board’s responsibilities shall include:

a. Identification of ¹[social services] publicly supported programs¹ data that has been created, received, or maintained by agencies that may be appropriate for receipt, maintenance, and transmission by the iPHD ¹Project¹ in furtherance of the purposes of this act;

b. Prior to the receipt of data by the iPHD ¹Project¹, the review and approval of the appropriateness of such receipt, including consideration of the following factors:

(1) whether the transmitting department or agency has authority to collect the data proposed to be received by the iPHD ¹Project¹, particularly if the data includes individually identifiable information;

(2) whether collection of the data proposed to be received by the iPHD ¹Project¹ is expected to further the purpose of this act, namely, the improvement of public health, safety, security, ¹[or] and¹ well-being of New Jersey residents ¹[or] and¹ the improvement of the overall cost-efficiency of government assistance programs; and

(3) whether reasonable efforts have been made to ensure that the iPHD ¹Project¹ will receive only the appropriate data needed to accomplish the purposes of this act;

c. Prior to the receipt or transmission of data by the iPHD ¹Project¹, the review and approval of any necessary data use agreements or business associate agreements with any person or entity from which or to which information is received or transmitted in compliance with all applicable privacy and security standards, including, but not limited to, HIPAA, when such data includes individually identifiable information that is protected health information as defined under HIPAA; and

d. Adopting and publishing policies and procedures for the efficient and transparent operation of the iPHD ¹Project¹, including, but not limited to, the following:

(1) Privacy and data security policies and procedures that comply with the applicable federal and State privacy and security statutes and regulations, including HIPAA; ¹[and]¹

(2) Data access policies and procedures that allow access by a public entity or a private entity, including a researcher, only when such access request meets the standards set forth in the data access policies and procedures and has been approved by the Governing Board ¹and the appropriate agency or department¹. When data access is requested by any ¹public or¹ private entity, including a researcher, for the purpose of conducting research, the Governing Board shall only approve access to data after review and approval by an IRB, and such access shall be limited to data identified in approved IRB research protocols and only for the period of the approval. In no event shall the Governing Board approve access to health data that identifies, or that may be used to identify, rates of payment by a private entity for the provision of health care services to an individual unless the party seeking access agrees to keep such information confidential and to prevent public disclosure of such data or the rates of payment derived from such data ¹;

(3) Data retention policies identifying that data shall be returned to sponsoring agencies or destroyed when it is no longer in the State’s interest to promote analysis of the data and in accordance with applicable HIPAA regulations, data use agreements, and provisions of IRB approvals;

(4) Policies to require researchers to consult with subject matter experts in the datasets being linked on a specific project. The purpose of such consultation shall be to help researchers understand and interpret the data being linked for a specific project; and

(5) Policies that establish processes to engage researchers and academic institutions across New Jersey to help set research priorities and promote the use of the iPHD Project to accelerate population health research in this State¹.

6. No later than 12 months following the receipt of data by the iPHD ¹Project¹ pursuant to this act, and on an annual basis thereafter, the ¹Rutgers Center for State Health Policy, in consultation with the¹ Governing Board ¹,¹ shall publish a report that is made available and accessible to the public and that contains the following information:

a. A description of the implementation of the iPHD ¹Project¹, including identification of the sources and types of data received and maintained by the iPHD ¹Project¹ over the prior 12 months;

b. A list of all aggregated data maintained by the iPHD ¹Project¹;

c. A description of each IRB-approved disclosure of data or data sets by the iPHD ¹Project¹;

d. A description of disclosures to Medicaid Accountable Care Organizations recognized by the ¹[state] State¹ in accordance with P.L.2011, c.114 (C.30:4D-8.1 et seq.);

e. A list of publications and other reports based on iPHD ¹Project¹ data;

f. A strategic plan for achieving the purposes of this act during the successive 12 month period; and

g. Any other information deemed appropriate by the Governing Board.

7. The iPHD ¹Project¹ Governing Board and the Rutgers Center for State Health Policy may apply for and receive funding in relation to the iPHD ¹Project¹ from the following sources:

a. ¹[Grants or other financial assistance from State or local departments, agencies, authorities, and organizations;

b. Federal grants;

c. ]¹ Grants from ¹[other public or] research or other¹ private entities; ¹[and

d.] b.¹ Fees paid by persons or entities requesting access to iPHD ¹Project¹ data or the performance of analyses by the iPHD ¹Project¹, which fees have been approved by the Governing Board to support the cost of preparing data for access or the performance of analyses ¹;

c. Federal grants; and

d. Grants or other financial assistance from State or local departments, agencies, authorities, and organizations at the discretion of these entities, for specific projects of interest to these entities¹.

8. Any department or agency that creates, receives, or maintains ¹[social services] publicly supported programs¹ data or health data shall ¹, only after execution of an enforceable data use, data sharing, or other similar agreement that is acceptable to the department or agency,¹ transmit or allow access to such data as is necessary and appropriate to further the goals of this act and shall cooperate with iPHD ¹Project¹ requests for receipt of, or access to, such data. Notwithstanding the foregoing, no department or agency shall be required to transmit data it creates, receives, or maintains to the iPHD ¹Project¹, or to allow access to such data, if the Attorney ¹[General] General’s review or the applicable department’s or agency’s review¹ determines that such transmission or access would violate State or federal law. ¹The Attorney General’s review shall include consideration of an analysis from the department or agency whose data is being requested.¹ This section shall not prohibit the Rutgers Center for State Health Policy or any department or agency from creating, receiving, maintaining, or transmitting data in data systems that are separate and distinct from the iPHD ¹Project¹.

9. This act shall take effect immediately and within 60 days after the effective date of this act, the Governor shall appoint four public members to the iPHD ¹Project¹ Governing Board in accordance with section 3 of this act.