North Carolina SB 509: Health Information Exchange Act Revisions.

Bill Text

GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
S 1
SENATE BILL 509

Short Title: Health Information Exchange Act Revisions. (Public)
Sponsors: Senators Hise, Burgin, and Adcock (Primary Sponsors).
Referred to: Rules and Operations of the Senate
March 26, 2025
*S509-v-1*
A BILL TO BE ENTITLED 1
AN ACT REVISING THE STATEWIDE HEALTH INFORMATION EXCHANGE ACT; 2
AND AUTHORIZING THE IMPOSITION OF NEW CIVIL PENALTIES FOR 3
VIOLATIONS OF THE ACT AND A NEW STATE HEALTH DATA ASSESSMENT FEE. 4
The General Assembly of North Carolina enacts: 5
SECTION 1. Article 29B of Chapter 90 of the General Statutes reads as rewritten: 6
"Article 29B. 7
"Statewide Health Information Exchange Act. 8
"§ 90-414.1. Title. 9
This act Article shall be known and may be cited as the "Statewide Health Information 10
Exchange Act." 11
"§ 90-414.2. Purpose. 12
This Article is intended to improve the quality of health care delivery within this State by 13
facilitating and regulating the use of a voluntary, statewide health information exchange network 14
for the secure electronic transmission of individually identifiable health information among 15
health care providers, health plans, and health care clearinghouses clearinghouses, and the State 16
in a manner that is consistent with the Health Insurance Portability and Accountability Act, 17
Privacy Rule and Security Rule, 45 C.F.R. §§ 160, 164. 18
"§ 90-414.3. Definitions. 19
The following definitions apply in this Article: 20
(1) Annual compliance report. – The annual report required by G.S. 90-414.13. 21
(1a) Business associate. – As defined in 45 C.F.R. § 160.103. 22
(2) Business associate contract. – The documentation required by 45 C.F.R. § 23
164.502(e)(2) that meets the applicable requirements of 45 C.F.R. § 24
164.504(e). 25
(3) Covered entity. – Any entity described in 45 C.F.R. § 160.103 or any other 26
facility or practitioner licensed by the State to provide health care services. 27
(3a) Data transfer systems. – Electronic systems or platforms that (i) facilitate the 28
submission of any combination of clinical, demographic, or claims data to the 29
HIE Network and (ii) are maintained, controlled, directed, or licensed by, or 30
on behalf of, a covered entity or hybrid entity subject to this Article. Data 31
transfer systems may be comprised of health information technology or claims 32
processing technology, or both, including hardware, software, integrated 33
technologies and related licenses, or packaged solutions sold as services. Data 34
transfer systems include, but are not limited to, electronic systems or platforms 35
related to electronic health records, pharmacy benefits and claims, claims 36

General Assembly Of North Carolina Session 2025
Page 2 Senate Bill 509-First Edition
processing, or care management. Data transfer systems do not include any 1
information technology systems that are directly maintained, controlled, or 2
licensed by the State Health Plan for Teachers and State Employees. 3
(4) Department. – North Carolina Department of Health and Human Services. 4
(5) Disclose or disclosure. – The release, transfer, provision of access to, or 5
divulging in any other manner an individual's protected health information 6
through the HIE Network. 7
(6) Repealed by Session Laws 2017-57, s. 11A.5(f), effective July 1, 2017. 8
(7) GDAC. – The North Carolina Government Data Analytics Center. 9
(8) HIE Network. – The voluntary, statewide health information exchange 10
network network, which is a health data utility overseen and administered by 11
the Authority. 12
(9) HIPAA. – Sections 261 through 264 of the federal Health Insurance 13
Portability and Accountability Act of 1996, P.L. 104-191, as amended, and 14
any federal regulations adopted to implement these sections, as amended. 15
(10) Individual. – As defined in 45 C.F.R. § 160.103. 16
(11) North Carolina Health Information Exchange Advisory Board or Advisory 17
Board. – The Advisory Board established under G.S. 90-414.8. 18
(12) North Carolina Health Information Exchange Authority or Authority. – The 19
entity established pursuant to G.S. 90-414.7. 20
(13) Opt out. – An individual's affirmative decision communicated to the Authority 21
in writing to disallow his or her protected health information from being 22
disclosed by the Authority to covered entities or other persons or entities 23
through the HIE Network. 24
(13a) Organization National Provider Identifier or Organization NPI. – The HIPAA 25
Administrative Simplification Standard that utilizes a 10-position all-numeric 26
identification number assigned by the federal National Provider System to 27
uniquely identify a health care provider that is an entity other than an 28
individual human being that furnishes health care. 29
(14) Protected health information. – As defined in 45 C.F.R. § 160.103. 30
(15) Public health purposes. – The public health activities and purposes described 31
in 45 C.F.R. § 164.512(b). 32
(16) Qualified organization. – An entity with