1997 Regular Session
To: Public Health and Welfare
By: Representative Moody
House Bill 1374
(As Passed the House)
AN ACT TO ESTABLISH THE MISSISSIPPI HEALTH DATA COMMISSION; TO EMPOWER THE COMMISSION TO COLLECT AND DISSEMINATE DATA ON HEALTH CARE COSTS, QUALITY AND ACCESSIBILITY; TO PROVIDE FOR THE APPOINTMENT OF AN ADMINISTRATIVE OFFICER; TO PROHIBIT THE DISCLOSURE OF IDENTIFIABLE HEALTH DATA; TO AUTHORIZE THE COMMISSION TO CHARGE FEES; TO PROVIDE PENALTIES FOR NONCOMPLIANCE WITH THIS ACT; AND FOR RELATED PURPOSES.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI:
SECTION 1. Short title. This act shall be known as the "Mississippi Health Data Commission Act."
SECTION 2. Definitions. As used in this act:
(a) "Commission" means the Mississippi Health Data Commission created by Section 4 of this act.
(b) "Control number" means a number assigned by the commission to an individual's health data as an identifier so that the health data can be disclosed or used in research and statistical analysis without readily identifying the individual.
(c) "Data supplier" means a health care facility, health care provider, self-funded employer, third-party payer, health maintenance organization, government department, or other health care delivery organization which could reasonably be expected to provide health data under this act.
(d) "Disclosure" or "disclose" means the communication of health care data to any individual or organization outside the commission, its staff, and contracting agencies.
(e) "Chairman" means the chairman of the commission.
(f) "Health care facility" means all facilities and institutions, whether public or private, proprietary or nonprofit, which offer diagnosis, treatment, inpatient or ambulatory care to two (2) or more unrelated persons and shall include, but shall not be limited to, all facilities and institutions included in
Section 41-7-173(h). The commission may by rule add, delete or modify the list of facilities that come within this definition for purposes of this act.
(g) "Health care provider" means any person, partnership, association, corporation, or other facility or institution that renders or causes to be rendered health care or professional services as a physician, registered nurse, licensed practical nurse, nurse-midwife, dentist, dental hygienist, optometrist, clinical laboratory technologist, pharmacist, physical therapist, podiatrist, psychologist, chiropractic physician, naturopathic physician, osteopathic physician, osteopathic physician and surgeon, audiologist, speech pathologist, certified social worker, social service worker, social service aide, marriage and family counselor, or practitioner of obstetrics, and others rendering similar care and services relating to or arising out of the health needs of persons or groups of persons, and officer, employees or agents of any of the above acting in the course and scope of their employment.
(h) "Health data" means information relating to the health status of individuals, health services delivered, the availability of health manpower and facilities, and the use and costs of resources and services to the consumer, except vital statistics as defined in Section 41-57-1 et seq. shall be excluded.
(i) "Health maintenance organization" has the meaning set forth in Section 83-41-305(n).
(j) "Identifiable health data" means any item, collection or grouping of health data that makes the individual described in the health data identifiable.
(k) "Individual" means a natural person.
(l) "Organization" means any corporation, association, partnership, agency, department, unit, or other legally constituted institution or entity, or part thereof.
(m) "Research and statistical analysis" means activities using health data analysis including:
(i) Describing the group characteristics of individuals or organizations;
(ii) Analyzing the noncompliance among the various characteristics of individuals or organizations;
(iii) Conducting statistical procedures or studies to improve the quality of health data;
(iv) Designing sample surveys and selecting samples of individuals/organizations; and
(v) Preparing and publishing reports describing these matters.
(n) "Self-funded employer" means an employer who provides for the payment of health care services for his employees directly from the employer's funds, thereby assuming the financial risks rather than passing them on to an outside insurer through premium payments.
(o) "Plan" means the plan developed and adopted by the commission under Section 6(1)(a) of this act.
(p) "Third-party payer" means any insurer offering health care insurance, as defined by Section 83-9-1 any nonprofit health service insurance corporation licensed under Title 83, Mississippi Code of 1972, any program funded or administered by the State of Mississippi for the provision of health care services including the Medicaid and medical assistance programs described in Section 43-13-1 et seq. or any other similar corporation, organization, association, entity or person.
SECTION 3. Purpose.
(1) The Legislature recognizes that:
(a) The State of Mississippi established the Mississippi Information for State Health Policy Project (MSINFOSHPP) in 1992;
(b) MSINFOSHPP has been governed by an Interagency Work Group (IWG) comprised of state agency representatives, providers, consumers and payors of health services;
(c) The TWG has conducted a variety of activities, including the developing of a comprehensive data strategy;
(d) The IWG has identified four (4) data strategies for immediate implementation;
(e) The members of the IWG are desirous for the activities of the IWG and MSINFOSHPP to continue;
(f) The members of the IWG wish to continue in the revision of data strategies and selection of enhancements to be developed.
(2) The purpose of this act is to establish the Mississippi Health Data Commission to direct a statewide effort to collect, analyze and distribute health care data to facilitate the promotion and accessibility of quality and cost-effective health care, and also to facilitate interaction among those with concern for health care issues.
SECTION 4. Creation of commission. There is created the Mississippi Health Data Commission, to be supervised and administered by a board of commissioners as specified in Section 5 and housed by the Mississippi State Department of Health.
SECTION 5. Commission membership; terms; chairman; compensation. (1) The Mississippi Health Data Commission created by Section 4 of this act shall be composed of eight (8) voting members composed of and appointed as follows:
(a) The State Health Officer;
(b) The Executive Director of the Division of Medicaid;
(c) The Executive Director of the Department of Human Services;
(d) The Executive Director of the Department of Mental Health;
(e) The Executive Director of the Department of Rehabilitation Services;
(f) The State Superintendent of Public Education;
(g) One (1) representative of the State Employees' Health Insurance Plan, named by the Executive Director of the Department of Finance and Administration; and
(h) The Executive Director of the Mississippi Primary Health Care Association.
(2) The terms of the commission members shall be concurrent with their holding office in state government.
(3) Commission members shall annually elect by simple majority vote a chairman and a vice-chairman of the commission from among their membership.
(4) The commission shall meet at least once during each calendar quarter, and may provide for special meetings as the members deem necessary. Meeting dates shall be set by the chairman upon ten (10) working days' notice to the other members, or upon written request by at least three (3) commission members with at least ten (10) working days' notice to other commission members. Five (5) commission members constitute a quorum for the transaction of business. Action may not be taken except upon the affirmative vote of a majority of a quorum of the commission.
(5) All meetings of the commission shall be open to the public, except that the commission may hold executive sessions if the requirements of Section 25-41-7 are met.
SECTION 6. Powers and duties of the commission. (1) The commission shall:
(a) Develop and adopt by rule a health data plan that shall:
(i) Identify the key health care issues, questions and problems amenable to resolution or improvement through better data, more extensive or careful analysis, or improved dissemination of health data;
(ii) Document existing health data activities in the state to collect, organize or make available types of data pertinent to the needs identified in subparagraph (i);
(iii) Describe and prioritize the actions suitable for the commission to take in response to the needs identified in subparagraph (i) in order to obtain or to facilitate the obtaining of needed data, and to encourage improvements in existing data collection, interpretation and reporting activities, and indicate how those actions relate to the activities identified under subparagraph (ii);
(iv) Detail the types of data needed for the commission's work, the intended data suppliers and the form in which such data are to be supplied, noting the consideration given to the potential alternative sources and forms of such data and to the estimated cost to the individual suppliers as well as to the commission of acquiring these data in the proposed manner; the plan shall reasonably demonstrate that the commission has attempted to maximize cost-effectiveness in the data acquisition approaches selected;
(v) Describe the types and methods of validation to be performed to assure data validity and reliability;
(vi) Explain the intended uses of and expected benefits to be derived from the data specified in subparagraph (iv), including the contemplated tabulation formats and analysis methods; the benefits described must demonstrably relate to one or more of the following: promoting quality health care, managing health care costs, or improving access to health care services;
(vii) Describe the expected processes for interpretation and analysis of the data flowing to the commission, noting specifically the types of expertise and participation to be sought in those processes; and
(viii) Describe the types of reports to be made available by the commission and the intended audiences and uses;
(b) Evaluate existing identification coding methods and, if necessary, require by rule that health data suppliers use a uniform system for identification of patients, health care facilities, and health care providers on health data they submit under this act;
(c) Report annually to the Governor and the Legislature on how the commission is meeting its responsibilities under this act; and
(d) Advise, consult, contract and cooperate with any corporation, association or other entity for the collection, analysis, processing or reporting of health data identified by control number only in accordance with the plan.
(2) The commission shall have the authority to engage the services of a private, nongovernmental vendor, pursuant to the considerations of subsection (1)(a)(iv), such vendor to have the responsibility to: (a) serve as the collection agent for the data; (b) validate the data as detailed by the commission in the plan; (c) mask identifiers through the use of appropriate measures to include, but not be limited to, encryption, technical scrambling, and use of control numbers; and (d) submit the validated, masked data to the administrative officer for the purpose of analysis and presentation in accordance with the plan.
(3) The commission may adopt rules to carry out the provisions of this act in accordance with the Administrative Procedures Act.
(4) Except for data collection, analysis and validation functions described in this section, nothing in this act shall be construed to authorize or permit the commission to perform regulatory functions which are delegated by law to other agencies of the state or federal government, or to perform quality assurance or medical record audit functions that health care facilities, health care providers, or third-party payers are required to conduct to comply with federal or state law. The commission shall not recommend or determine whether a health care provider, health care facility, third-party payer or self-funded employer is in compliance with federal or state law, including but not limited to federal or state licensure, insurance, reimbursement, tax, malpractice or quality assurance statutes or common law.
(5) Nothing in this act shall be construed to require a data supplier to supply health data identifying a patient by name, or describing detail on a patient beyond that needed to achieve the approved purposes included in the plan.
(6) No request for health data shall be made of health care providers, health care delivery organizations, and other data suppliers until a plan for the use of such health data has been adopted.
(7) If a proposed request for health data imposes unreasonable costs on a data supplier, due consideration shall be given by the commission to altering the request. If the request is not altered, the commission shall pay the costs incurred by the data supplier associated with satisfying the request that are demonstrated by the data supplier to be unreasonable.
(8) The commission does not have the authority to require any data supplier to submit fee schedules, maximum allowable costs, area prevailing costs, terms of contracts, discounts, fixed reimbursement arrangements, capitations, or other specific arrangements for reimbursement to a health care provider.
(9) The commission shall not publish any health data which would disclose any of the information described in Section 9(1) of this act.
(10) Nothing in this act shall prevent the commission from requiring the submission of health data on the reimbursements actually made to health care providers and health care delivery organizations from any source of payment, including consumers.
SECTION 7. Administrative officer; appointment; powers. (1) An administrative officer shall be appointed by the commission and shall serve at the will and pleasure of the commission. The administrative officer shall be the agent of the commission for the purpose of receiving all services of process, summonses and notices directed to the commission, shall direct the daily operation of the commission, and shall perform such other duties as the commission may delegate.
(2) The administrative officer shall supervise and conduct the staff functions of the commission in order to assist the commission in meeting its responsibilities under this act. Duties of the office shall include, but not be limited to, the employment of full-time employees necessary to carry out this act. Before the hiring of employees, all positions must be authorized and approved by the commission itself in accordance with the laws and regulations set forth by the State Personnel Board; the salary and compensation of such employees shall be subject to the rules and regulations adopted and promulgated by the State Personnel Board created under Section 25-9-101 et seq. The administrative officer shall have the responsibility of supervising the development of a draft health data plan for the commission's review, modification and approval.
SECTION 8. Limitations on use of health data. The commission may not use the health data provided to it by third-party payers, health care providers, health care delivery organizations, or health care facilities to evaluate or make recommendations with regard to a single health care provider or health care facility, or a group of health care providers or health care facilities.
SECTION 9. Privacy and Confidentiality; disclosure of identifiable health data prohibited. (1) All information, reports, statements, memoranda or other data received by the commission are strictly confidential and shall be protected through the ongoing development and maintenance of policies and procedures to secure all its data files from misuse, to provide confidentiality, to ensure data security, and allow for data release. The commission shall publish data in aggregate form only, with no aggregated cell containing fewer than five (5) records for the protection of individual privacy.
The commission may not disclose any identifiable health data which shall include:
(a) Practitioner - identified information.
(b) Patient - identified information.
(c) Peer Review information.
(d) Data which explicitly or implicitly identifies an individual may not be disclosed. If a hospital has only one physician in a particular service, information about that service would implicitly identify the physician and would not be available for disclosure.
(e) Hospital specific information may be released; but the data report and intended use of the report must be forwarded to the provider before release with a 30-day opportunity for comment, and the provider's comments must be released with the data report.
(2) No member of the commission may be held civilly liable by reason of having released or published reports or compilations of data supplied to the commission so long as the publication or release is in accordance with the requirements of Sections 9(1) and 10 of this act.
(3) No person, corporation or entity may be held civilly liable for having provided data to the commission in accordance with this act.
SECTION 10. Exceptions to prohibition or disclosure of identifiable health data. The disclosure shall be to any organization that has an institutional review board, for a specified period, solely for bona fide research and statistical purposes, determined in accordance with department rules, and the department determines that the data is required for the research and statistical purposes proposed and the requesting individual or organization enters into a written agreement satisfactory to the department to protect the data in accordance with this act or other applicable law and not permit further disclosure without prior approval of the department. Any health data disclosed shall be identified by control number only.
SECTION 11. Penalties. (1) Any use, release or publication of health care data contrary to the provisions of Sections 8, 9 and 10 of this act is a misdemeanor, punishable as provided by law.
(2) Subsection (1) does not relieve the person or organization responsible for that use, release or publication from civil liability.
SECTION 12. Health data not subject to subpoena or compulsory process; exception. Identifiable health data obtained in the course of activities undertaken or supported under this act shall not be subject to subpoena or similar compulsory process in any civil or criminal, judicial, administrative or legislative proceeding, nor shall any individual or organization with lawful access to identifiable health data under the provisions of this act be compelled to testify with regard to such health data, except that data pertaining to a party in litigation may be subject to subpoena or similar compulsory process in an action brought by or on behalf of such individual to enforce any liability arising under this act.
SECTION 13. Fees for health data. (1) The commission may charge fees for the compilation or analysis of data pursuant to a special request made by any health care provider, health care facility, third-party payer, or other person or organization. Those fees charged may not be greater than the actual costs of generating the compilation or analysis of health care data.
(2) The commission may charge fees to cover the costs of printing and distributing any reports created under Section 25-61-7.
(3) All money derived from fees under this act shall be deposited in a fund for the data center.
SECTION 14. Health data not public records. The individual forms, computer tapes, or other forms of data collected by and furnished to the commission or its contract data processor shall not be public records under Title 25, Chapter 61, Mississippi Code of 1972, and shall not be subject to public inspection. The confidentiality of patients' individual personal identifiers, such as name, address, social security or patient identification number, is to be protected and the laws of this state with regard to patient confidentiality apply. The same terms are also to apply to the protection of provider confidentiality.
SECTION 15. Failure to provide data; commission report. (1) In the event the commission concludes that a health care provider, health care facility, health care delivery organization, third-party payer or any other person required to submit data to the commission has not complied with a rule of the commission, or has a pattern of failing to comply with the commission's request for data, and that compliance with the rule or request is within the ability of that person or entity, the commission shall:
(a) Give written notice to that person or entity of its noncompliance at least thirty (30) days before a regularly scheduled meeting of the commission; and
(b) Allow the person or entity accused of noncompliance time at the next regularly-scheduled meeting of the commission to respond.
(2) Any person or entity found to have willfully failed to comply with a rule under this act shall be subject to the penalties provided in Section 11 of this act.
(3) The commission may note in its reports and publications that accurate appraisal of a certain category cannot be presented because of a failure to comply with the commission's request for data.
SECTION 16. This act shall take effect and be in force from and after July 1, 1997.