Section 323D-18.5 - Access to health and dental insurance data; mandatory reporting for certain insurers; uses; confidentiality(a) Providers of health insurance doing business in the State and who are not subject to subsection (b) may submit to the state agency or its designee, upon request of the state agency, administrative data that the state agency deems necessary to perform its functions.(b) Providers of health insurance subject to this subsection shall submit administrative data as follows:(1) Beginning November 1, 2016, providers of health insurance that provide health benefits plans funded by the Hawaii employer-union health benefits trust fund, the state medicaid agency, or both, shall provide to the state agency, or its designee, administrative data required by the state agency to determine health benefits costs, including health care services claims and payment data regarding beneficiaries of health benefits plans funded by the Hawaii employer-union health benefits trust fund, the state medicaid agency, or both; and(2) Beginning July 1, 2019, providers of health insurance that provide medicare advantage (medicare part C) health benefits plans to residents of the State shall provide to the state agency, or its designee, administrative data required by the state agency, using the same standard format as required by the Centers for Medicare and Medicaid Services to determine health benefits costs, including health care services claims and payment data.(c) The state agency shall submit data collected pursuant to this section to the college of social sciences, social sciences research institute, Pacific health informatics and data center at the University of Hawaii for processing, assignment of encrypted identifiers, and any other task deemed necessary by the state agency. After July 1, 2018, the state agency may designate another data center to which to submit the data obtained pursuant to this section; provided that the data center is established under and meets the conflict of interest requirements of 42 United States Code section 300gg-94. The state agency may contract with entities for the analysis of data collected under this section and processed by a data center pursuant to this subsection to benefit medicaid and medicare recipients, public employees, and public sector retirees and for other public purposes.(d) The state agency shall develop and update an annual plan for the analysis, maintenance, and publication of data collected pursuant to this section. The state agency shall seek approval for the annual plan from the director of health, administrator of the MedQuest division of the department of human services, and the chief information officer of the State.(e) The state agency shall adopt rules, pursuant to chapter 91, for the schedule and frequency with which providers of health insurance shall provide administrative data to the state agency. Administrative rules shall also include provisions relating to data governance, data submission, use and sharing, information security, privacy protection, reporting, and any other matter necessary for the state agency to perform its functions under this section. In adopting administrative rules, the state agency shall consider the measures necessary to implement data submission requirements by providers of health insurance subject to this section, using methods that are reasonable and cost-effective for data submitters.(f) The state agency or its designee shall not disclose any individual patient's personal health information in violation of state or federal law.(g) To minimize any risk of data breaches and re-identification of data, the data and information submitted to the state agency shall include only the minimum protected health information identifiers necessary to link public and private data sources and the geographic and services data to undertake studies.(h) The state agency or its designee, and any recipient of data collected pursuant to this section, shall maintain the original protected health information identifier in a separate database that is not linked with any other data and shall use a proxy or encrypted record identifier for data analysis.(i) Under no circumstances shall a person attempt to re-identify subjects of protected health information from the data submitted to the state agency or its designee. No person may disclose data that contains direct personal identifiers, including but not limited to name, mailing address, e-mail, telephone number, date of birth, or social security number.(j) The state agency or its designee may acquire federal medicare data sets specific to Hawaii and made available to states. Any public agency that possesses medicare data sets specific to Hawaii shall share the data with the state agency or its designee at no additional cost to the state agency or its designee.(k) No later than twenty days prior to the convening of each regular session, the state agency shall submit an annual report to the legislature on the submission, maintenance, and use of data submitted to the state agency pursuant to this section.(l) For the purposes of this section: "Administrative data" means:
(1) Statistical and financial reports of information;(2) Patient invoices or similar patient encounter data;(3) Records of services used for or resulting from administering delivery of health care, pharmacy benefits, or dental care, including records of services provided under health benefits plans as defined in section 87A-1; and(4) Any other records as established pursuant to administrative rules adopted pursuant to chapter 91. "Provider of health insurance" means a group health insurance contract or service agreement that may include medical, hospital, surgical, prescription drug, vision, or dental services, in which a carrier agrees to provide, pay for, arrange for, or reimburse the cost of the services, including third party administrators.
Amended by L 2019, c 88,§ 2, eff. 7/1/2019.Amended by L 2016, c 139,§ 2, eff. 7/1/2016.