H.B. 199 Health Data Amendments: transcript

Thank Mr. Chair. Um, I have with me Nate Winters from the Department of Health and Human Services, and then also online, uh, Kyle Lund, and, I dunno, Patrice may be online as well. So tho they're, they're gonna help me with the presentation. Um, this is a department request bill. I'll give a brief introduction and then I'll ask, um, Nate and Kyle to provide more detail. So, uh, healthcare data has been collected in the state of Utah since 1990, and it is very important for us to be able to collect the healthcare data for lots of reasons. And I'll let Nate and Kyle talk about those reasons. Um, it is collected in all 50 states. Every state does this. Um, and the, the reason why we need the bill is because it was up for a Sunset review review two years ago. We decided to extend the Sunset for two years to allow a deep dive into the policies, processes, and procedures, uh, specifically related to privacy and protecting privacy, but also operations. The legislative auditor General conducted a performance review and found several recommendations for, uh, making the program a stronger program. Uh, mostly in the area of making sure that the data is actually used. I was, I was a little bit surprised at the finding, because usually the finding doesn't come back that way. It says, well, we're collecting this data, we can see lots of applications, lots of ways that it should be used, but we don't see it being used. And so in the process of adopting those recommendations, both to protect privacy and also to make sure that it's being used appropriately, uh, we have created this bill, which dramatically strengthens those privacy protections and requires the department to take some additional steps in transparency about what their program is. Uh, we worked with the state privacy officer's office to come up with this, the language that's in this bill. And, um, at one point we were told that this, in their opinion, most of this is their suggestion, that this would represent model language for any, uh, state agency that is collecting, uh, particularly private data. So whatever division that is having this sort of, um, this guidelines on an agency would be, uh, considered best in class among state agencies. So with that, I'm gonna ask, uh, Nate and Kyle, and maybe Patrice to kinda just give a brief overview of what's in this bill and why it's important to them.

All right. Thank, thank you Representative Thurston, uh, for working on this bill for, for, you know, well, well over the last year, uh, as Representative Thurston said, I'm Nate Winters. I'm one of the Deputy directors with the Utah Department of Health and Human Services. And joining me, uh, virtually today is Kyle Lund, who's our Director of Data Systems and Evaluation. Um, and he'll go into to more of the detail on the bill itself, but, but really high level, what this bill does is it does three things. Uh, it extends the Sunset. As Representative Thurston talked about this, this data has been collected for well over 30 years, and this extends the Sunset out, uh, for a period of time. It implements several of the audit recommendations from the, the recent OA audit. Um, again, several of those, as Representative Thurston already already mentioned, are around how we can utilize this, this resource to the state better, uh, and strengthens data privacy protections. Uh, with that, uh, I'll turn, I'll turn the time over to Kyle, who can kind of walk us through some of the particulars on the bill. Um, so yeah, Kyle. Yeah. And also, I just would note that we do have provided a bill analysis from Ledge Research. I don't know if that has been circulated to the committee, but that that is in front of you. That is the, so the re the one that has Red Ink is the bill analysis from our staff, and the one that has greeting is the, uh, speaking points from Department of Health and Human Services. So, Kyle, go ahead.

Hello. Good afternoon. Thank you, uh, for having me. Uh, thank you Mr. Chair, and to the whole committee, uh, for hearing our bill. Uh, I apologize, I'm not with you in, uh, person. You, I'm, I'm quite under the weather today. Um, so for, for those who are unfamiliar, uh, with the Health Data Authority Act, the reason it's, uh, it's so valuable within the state of Utah is it creates really unique resources in terms of understanding cost and, and utilization of our healthcare, uh, in the state. Some good examples of how this data is used. Um, the one, Utah Health Collaborative has used some of it to, to study cost patterns and cost drivers in Utah. Uh, we've worked with the legislature and your general counsel to answer some data questions to inform policy. Uh, so some of these questions have been around, uh, the prevalence of cavities in, in different areas. Uh, last year, as you looked at, um, fluorinate, Fluor Nation of wa uh, the water, uh, we've had questions about, uh, hormone therapies for minors and, and things like that. And so it provides a really unique resource that allows us to answer some of those questions. Um, as Nate Winter's mentioned, the key points of this bill, number one, is, uh, is to extend the Sunset date so that we can continue operating the program. Number two is it, uh, removes the health data plan, uh, that was formally code and requires the department to create a strategic plan. This is, uh, this is also one of the findings from the legislative auditors is that, uh, while the data is incredibly valuable, the program had lacked some strategic direction. So we're excited to, uh, be required to do that, um, and be, be very strategic with how we operate. Um, it also clarifies the department's authority to share with, with the certain other public entities like public health or behavioral health authorities. Um, and it an important component of that. It also limits to what extent we can share, uh, what we term direct identifiers in this bill. And so we see that as a really valuable privacy protection, where we can, um, do a lot of this important work while sharing just the minimum necessary data, uh, to get that done. What, one, one thing that is, uh, I think helpful to know, and you know, I'd like to report to, to the committee, is that as we operate this, uh, this very private and sensitive data, the vast majority of data requests, um, under HIPAA Safe Harbor standards can be met with either a fully de-identified or limited data set. And so our goal is always to release only the minimum necessary to, to achieve the desired outcome. Excuse me. Um, so with that, I think we'll, uh, we'll hand it, uh, back to you, Representative Thurston and, and to the committee. Thank you.

Great. Thank you Kyle. And Nate. Um, so I just wanna just kind of add on to what, uh, Kyle said about using data for policy. Uh, Utah is known as one of the leading states in terms of data availability for policymakers. In other words, legislators. And the case that he referred to last year was actually very critical. We had a bill talking about the fluoridation of water, and there was a question about what difference does it make? Well, where do you find data on that? Well, fortunately, the State Department of Health has data on cavities and, and children's health, oral health, and was able to provide data that helped us all to make that policy decision. I've also seen a bill again already this year that is using similar data from the Department of Health Insurance, human Services about the cost of, um, an autism treatment. So we're gonna have a bill about autism treatment. Well, how much are we paying for? What types of things we're paying for? How many kids are we talking about? And without data, we can't make good policy. And so these are critical data resources that we've, we've had great opportunities to use them, but I do think that it is important that we continue to have access to this data for lots of reasons. And, and I, Kyle just mentioned a few, there are dozens, if not hundreds of other data. Uh, and I would also, just for the chair's note, there is a, a, a amend that we have proposed, which will add one more, um, privacy protection to the, to the bill.

Thank you for your tremendous work on this. All of you. Uh, I had a question about, there, there's a line here looking at he, that, that, uh, DHSS put together, looking at healthcare claims and facility data together we can lower costs, basically we can find fraud or find inappropriate uses. Could you just speak to that a a little bit, how this will help us Yeah. Identify instances of, of inappropriate use or, or fraud that is in the news and things.

Yeah, so, absolutely. So one of the things that you can do when you have the look at the entire state, and that's what the goal is, is to be able to look at our entire marketplace for the entire state, you can de detect outliers. So when I worked for the Medicaid data program years ago, like 2005 ish, um, one of the things that we did is like, okay, and you'll think this was like obvious now, but it wasn't obvious then, was we looked at all of the Medicaid prescribers who were prescribing opioids, and what was the number of prescriptions of that they were submitting for opioids. And you would think, well, gosh, everybody's doing that now. Back then we weren't doing that. And so we could pull up that count and you could identify the providers, the physicians who are prescribing opioids, like they were Carter's little pills, right? It was, it was obvious who the bad actors were. And so then you could have the fraud unit go take, have, call them and say, look, it says here that you're seeing 250 patients a day, and every one of them is getting a prescription for opioids. We would like to talk to you about how that's happening. Well, what's your business practice? So that's an example of that one. But also I, because you mentioned the, the overlay of the hospital data with the all payer claims database. So there are two major components in this data program, hospital discharge data. We get everybody who, uh, is seen in a Utah hospital, a hundred percent. All of those people, whether they're insured or whether they're not insured. And then with the all payer claims database, you can see the people who live in the state of Utah to have health insurance, including Medicaid. And so you can use those two things, kind of like a stereo view to observe outliers, uh, outliers in terms of, I think in terms of fraud, it's often just, uh, utilization, but also over billing. Um, there are, uh, there was a analysis not to done too long ago. When you go to a doctor's office, they code your office visit from level one to level five. And we have an idea that certain percent of those should be level one, level two, level three, level four, level five. Well, there was a clinic that was billing 80% as levels four and five. And so again, somebody's, somebody's gonna want to have a que a talk to you about how, you know, are your, are the children coming to your pediatric clinic that much more complicated than everybody else in the state? So that's an example of that. And also with the hospital data, you can look at, um, how those patients transition from hospitals to nursing homes. There's just a lot of areas that can be, that you can use this for, for detecting fraud, waste, and abuse. It's a very incredibly valuable resource.

is not breached in cyber attacks becoming a normal thing? Yeah, and I think that's a, a critical part of this bill, is that the data is already being shared. And the department does have great rules, strong rules, 36 years. There's never been, to my knowledge, there's never been a violation even of the data use agreements. So not only just a breach, but even in terms of data use agreements. But this requires the department to go back and rethink all of those data sharing policies. Um, do you know what, what, what needs to be in all of those data sharing policies? Because we are in more modern times and create those strategic plans for data use, data protection. And so that when that data is gonna be shared, um, what, what, first of all, what type of data can be shared? And that's, and I think the answer to that is, is the very least amount that you possibly need to do the job. Uh, and then moving on to that, what are the contractual obligations? Does it have to be stored on a separate server? What are the security and policy or pr, uh, privacy provisions that you're gonna have in place as a data user, et cetera, et cetera. What's new about this bill is not that we're going to have a bunch more users, it's that we're gonna have stronger protections because we'll actually have a written policy that guides all of those contracts.

Yeah. So I'm gonna give an example that's outside of this frame, and then I'll talk about this framework. So, um, we have the statewide immunization system uses, um, and pharmacies, every time a child gets an injection, the pharmacist is required by law to report that data. They're, they don't even ask you, they just report it. They're required to report it. So, so now uses, has all of these pharmac or these pharmacists and doctor's offices sending in these immunization claims. But well suppose that a, a child has been opted out of the system. What all you need to make this happen from a data perspective is you need a filter that is on the very front end that said, these are the list of the do not collect kids. When a data comes in, it's scrubbed against that list. If the name, if the identity is in that identity file, the data is deleted from the intake file and is never actually input in the system. Uh, so the, the all pair claims database, the hospital discharge database work the same way that they create a, a filter of the do not collects and the data as it's coming in a scrubbed against that list. And then on the back end, now you've got a problem because the people may already be there, and it does take some amount of effort to go track down in all of the little corners and all of the tables. But to do a comprehensive search to find data that's already existing in the system going backwards. But going forward, it's actually a fairly straightforward process. Just, you just have a do not collect. And that data is removed before it's even goes through the intake process. Uh, from the public's perspective, there is an online form. You just, it's on the website. In fact, it toxin here, it's required to be on the website. You fill out the form, you say, this is my identity, do not collect data on me. And it, and it, and it happens. It, it is already in practice, it is already happening. There are people who have opted out of uses and who have opted out of some of these other databases as well.

Yeah. So I received that similar similar com uh, comment feedback. So amendment one adds a requirement that the health department, um, include in their plan actions or efforts that will be used to prevent, identify individual re-identification. So they, they already have policies, they're already doing that. But we wanna make sure that that is consciously front of mind that this issue of re-identification is something that is part of their strategic plan. And so that they are taking, you know, again, working with the state privacy officer to figure out how do we prevent this? There, there are, there are guidelines, there are federal guidelines, and there are other best practices that can be used to prevent re-identification.

Thank you so much. Committee Delaine England. I'm speaking for myself, but, um, I had my identity stolen from the University of Utah Hospital. Guess how many times I've ever been to the U of U hospital? Zero. I've never been there. I've never had any services from there. And yet they got hacked. Even though they had this amazing system to stop anybody from being able to hack them, they got hacked. And somehow they had my personal private health information that I have never shared with them or given any authority to share with them. I have so little, to be honest. I have so little health information that I, it was, it just blew my mind. And so I have a lot of concerns with this. Number one is line 41 on identifiable. I love research. I am not anti doing research. I don't think that the health department, that they're, the value that they would get from my personal identifiable health information is more valuable to them or constitutional than it is to me. My and yours, our personal health information is personal. It's private, and I don't, I just don't think that it should just be shared willy-nilly with everybody. I, I have a huge issue with this. When it becomes identifiable, you take identifiable out. It a game changer. Um, I don't think that anything is really hack proof. If you can get in the front door, some nefarious person can get in the front door or the back door. So I don't think it can be safe. Consolidation of data is never wise. And I, in my personal opinion, I think this is very much a violation of our fourth amendment right to privacy. Thank you so much.

Yes. Thank you. So, um, in, in conversations with others about where does the Utah State Government derive its authority to collect health data, including personal health data, I'm usually referred to a, uh, health and public safety kind of nebulous idea. And, but I've checked Utah's constitution, and that's not even stated as an objective in our state constitution. So, uh, my primary curiosity around this is just to, uh, ask the sponsor, if you would, just to cite the, the clause in the state constitution that authorizes the gathering of such data. I, I understand the, the usual pedigree as well from, from a legal perspective, is to try to chase it down and trace it to the state's police powers. But if you press on that, that was an argument that was invented by the, uh, federal courts general police powers on the part of state governments that came from, uh, Jacobson v Massachusetts in 1905, which was a case involving vaccine mandates in which the courts asserted essentially out of thin air that states have general police powers. And they derived that supposedly from Federalist Number 45, which states that the powers of the state governments are numerous and indefinite. And I would just like to point out that indefinite does not mean unlimited, right? Indefinite from the perspective of the founding fathers of the nation, simply means per the 10th, uh, amendment to the Constitution that they're not defined within the United States Constitution. It doesn't mean that state governments are not beholden to restrict their powers to those which are expressly delegated and enumerated within their state constitutions. So the entire premise, this, this, this stack of, uh, J blocks goes back to this case, which involves this mandate, which created this fictitious, uh, general police powers. And then here in this last, uh, legislative session last year, we had a bill that was proposed, which would grant the state legislature power to declare its own act constitutional by, by raising the standard and shifting the burden of proof on someone in a civil suit to prove in advance that something is unconstitutional. So, just to tighten it all up, I would just like to ask the sponsor, where, where is the specific clause in the state constitution that authorizes the gathering of health information? I understand we've been doing this for a long time, but precedent does not equal constitutionality. Thank you.

Thank you, Mr. Chair. I move, We bring the mic Amendment one. Can you hear me? Yeah, There you go. Is that better? Yeah. Uh, yare. Um, thank you, Mr. Chair. Uh, I, uh, move amendment one.

This is an important addition to the privacy protections requiring the Health Department to have and to publish their strategy for preventing re-identification.

No. Representative Miller? No. Well, I'll, I'll, I'll move to favorably recommend this bill to the House four for their consideration.

Thank you, Mr. Chair. Um, I'm having heartburn. I want to be clear, uh, just at the start of this is I support using data to improve health outcomes. I'm not opposed to data, and I'm not opposed to coordination. What I am opposed to and have heartburn around is expanding access to sensitive health data without expanding, um, and tightening the guardrails in cybersecurity. Um, and so I, I like the idea, but I would love to be more confident that we're tightening cybersecurity, especially in a day and age, where today about 3000 people globally have the technical expertise to hack into a, in a critical infrastructure, into a government. Now with ai, um, just about any, with one with an internet connection can do that. Um, the CCP use cloud code to code the cyber, uh, attack that they used to attack governments. And so I, I'm just a little worried that we're opening the door to share. Again, I'm not opposed to that, but again, without additional measures to say, yes, we're gonna share, but on top of that, we're going even tighten security even more because of that. And, and that's what I think is missing today for me. And so unfortunately, I'll be a no.

Um, I am also, uh, with representative from the Herriman area. I believe that any good government's worth having will protect everyone equally in their inalienable rights. Governments are instituted by men, not the other way around, and they are instituted for men, not the other way around. And for that reason, I'm also a no.

Thank you. Thank you, Mr. Chair. I just wanna speak in favor of this. I'm supportive of it. I, I believe based on what OG found and based on the work, that this will actually improve security protections for our citizens and, uh, improve the, uh, security of, of, of data. That, that's my perception. And so I think reasonable people can disagree on that, and I respect, uh, uh, my distinguished colleagues' opinions, but I think this is a step in the right direction rather than in the wrong, wrong direction.

Alright. Thank you, Mr. Chair. I'm, I'm gonna attempt to miracle. I'm gonna try to re help my colleague change his mind on the spot. Um, the, the, the reason why cybersecurity is not mentioned in this particular section of code is because it is mentioned already in the Department of Health and Human Services code. So they already have a cybersecurity requirement by the state of Utah. They're already working with the state privacy officer, the state cybersecurity office. All of those people are already, this falls under the umbrella of all of that additional protection. So we didn't feel a need to call it out special in this section of code because it is captured, uh, at the department level and at the state level. So, um, I, I agree and I agree with a lot of what has been said, that this is, this is, this is sensitive data, driver's license, data sensitive data. There are a lot of, there's a lot of sensitive data that the state government collects so that we can conduct our business. Um, and what we've done here is that we have basically set a new structure in place for processes and procedures to protect the privacy of those data so that people can, uh, be assured that they can still use those data. And, and anybody who wants to opt out, if they're concerned that their data is gonna be used and appropriately, it's gonna be violated. It's very simple to opt out. The opt, opt-out process is not difficult. So, and I understand that, that some people, when, when you ask them, um, is this, is this a good thing? Is this a bad thing? On the one hand, everybody can see the benefit and everybody can see the risk. And what this bill does is this strengthens the addressing of the risk so that there is more policy, more transparency in the policy for the risk. And so I think with that, uh, that I, I would be really reluctant to yank out from underneath our state government, our ability to regulate insurance markets, regulate hospitals and facilities, um, monitor Medicaid for fraud, waste, and abuse. The, the, the benefit is tremendous. Um, and the risk I think can be addressed. So with that, I would encourage your vote. So I don't know if I have convinced my colleague to change his mind, but I've done my best.

I'd like to make a substitute motion. Okay. I move to table this and to bring it back next week, um, on, on the agenda next week. So I, I think it's a hold table is basically, yeah,

But I will be happy, I will be happy to work with Representative ffi to, to look at other changes or strengthen how this, we, you do that From the committee member made the motion substitute, right? Still has to come back to you. You're the one who made the final. Still not, it's still not still not done until the maker of the motion. So we're still in the, in between of to hold.

Yeah. Okay. I wanna Hold. I don't wanna kill it. I, I, I Wanna work on it, but I,

Yeah. So my motion is to hold,

I would love to get to a point where I support this and I want this to go to the floor with support. Um, and so I would love to sit down and, and figure out and, and feel more confident. My hesitation is the amount of tax that happen on the state, the amount of breaches we've had on, uh, social securities being released, health data, student data, universities paying ransoms over $400,000. And so my confidence level is not, Hey, we're safe. And so if we are going to share this sensitive data more, I would love to just feel a little bit more comfortable before having a vote no. And having that on the floor.

I like his bill. I stand by my original motions. Okay. So I'm gonna, I'll, I'll, I'll waive Mr. Chair. I will waive any summation and anything. Okay. I just stand by what I make.

Yeah. So, um, absolutely. If the representative has some specific ideas of the way that we could change Lake Wind to the bill that would get his support, I would a hundred percent want that. Not only because I want his vote, which is good, but because I want it to be the best policy. Yeah. And I think that's the most important thing. And as we all know that we would prefer to do our work here in the committee if we can, uh, before we get to the house floor. And, you know, it's day three. Yeah. We got time. So, um, I'm not opposed, um, I'm taking him at his word that we are gonna be able to figure out language that that can work better. And then come back to another Mr. Chair, if that's okay with you. Another Yep. Another bite at the apple at a future meeting.

Yeah, I appreciate it. Uh, let's, let's sit down and talk and let's get to a point where we feel comfortable with it. Yep.

I would love this motion just as much as the last one.

Uh, nothing to restate. Mr. Chair, I, I stand by the original motion to, uh, favorably recommend this, uh, bill out to the house floor.

Adjourn. Motion To adjourn. That motion is non debatable on.

Okay. Thanks, Mr. Chair. You're ready. Uh, thank you Mr. Chair. So, uh, house Bill 1 99. Uh, and I, first of all, I just wanna just recognize and thank Senator Comore for being my Senate sponsor. Uh, he's participated on the legislative audit committee. I know Senator is Kimmy is also on the audit committee. And this is tying directly back to a legislative audit. So we wanna bring that to your attention. Uh, the Utah Health Data Authority was established in 1990 to collect data that is very valuable. It doesn't, we can do a lot of things with the data that's provided. And by the way, I have Kyle Lent here with me from the Department of Health and Human Services, and he can speak more and answer specific questions if needed. Some of those critical functions that are associated with the data are systems planning, medicaid evaluation, regulation, like the regulating of insurance companies, quality reporting, employer support, public health innovation, accountability, and many other uses for this data. It's an incredibly valuable resource. Um, two years ago we had a bill to, it was a Sunset review and the Sunset Review recommended that we make some changes and come back in two years and look and see if those changes needed. Further evaluation. Uh, last year, 2025, Olag performed an audit and basically recommended that the legislature strengthen the statutory requirements on this program. I don't think that that was the, it wasn't that they were critical necessarily of the program itself, but the legislation around this program needed some updates 'cause it was fairly old. So, in what this bill would do, it was, it modernize the health data authority by limiting some antiquated language and requiring the Department of Health and Human Services to maintain publicly available strategic plans for data collection, data management analysis and dissemination. Along with that, we have added several significant safeguards for privacy and security. So you can see those on the back of the page. There are several of those listed there, uh, new ways to keep up with technology and the current state of our affairs with regards to privacy and security have been added to this and requiring the department to adopt those. And with those, I think we would just stop at that point and see if you have any questions for

Um, thank you Mr. Chair. I wanna make a motion that we favorably recommend HB HB 1 99, substitute, first substitute HB 1 99 to the Senate. And if I can speak to that, That is in order. Go ahead. Um, thank you. And I thank you for those changes. I think the, the audit was very helpful to understand that we needed to keep up with some of the changes needed and, and also just a highlight of how important this office is. And that data can certainly help us coordinate all the different things that we're doing. So I am excited to see what the changes, how we're gonna be able to do better. And, you know, those provisions related to all payer claims database is so critical, so excited for the bill. So thank you for doing that. That's my motion, Mr. Chair.

Thank you. I, I, uh, do support the motion. I do have a question though, for the, the sponsor. I'm wondering how far away we're gonna be from being able to carry all of our data right here and go, goes with us.

That, that's a fantastic question. Um, the Health Data Authority does not currently, um, have a functionality to provide individual data to an individual. That functionality is generally, um, tied either to your healthcare providers or to your health insurance company. Um, I would say, just based on my professional experience, we are probably only less than five years away for individuals having access to their complete medical records and their health history on their own devices. So, but that is not currently something that the government is doing for you. It's usually a private sector opportunity. Thank you, chair.

So I'll waive Back to the make of the motion. I'll waive summation. Okay.

Commissioner Speaker, I move the adoption of the first substitute Motions order. Would you like to speak to It? I would. Uh, so there were some comments and, and questions about, um, can we do something to make sure that we are enhancing privacy and security? So over the weekend, last weekend, I worked with, uh, some of our colleagues here. The, the Chief Information Security Officer, the Chief Privacy Officer, the Chief Information Officer, and the first substitution, um, incorporates, um, everything that we could possibly think of to hold the Department of Health and Human Services accountable for. Im implementing the very best available security and privacy protection. So this first substitute is very important because it adds all of those privacy and security protections.

Thank you Mr. Speaker. I think most of you know how I feel about data privacy and I spent a lot of time going through the bill, um, also with Representative Fiefia. And, um, we, we went through it with a pretty fine tooth comb and we appreciate the sponsor for working with us on it and I think we're comfortable with where it is.

You Mr. Speaker. Uh, the Utah, the Utah Health Data Authority was established in 1990 as the entity responsible for collecting data to inform the public policy makers and others, other decision makers about the quality and cost of their healthcare. Uh, this information is used for a lot of different purposes and is very valuable to policy makers. A most recent example was recently we had a bill discussing, uh, the value of fluoridation in public water. And the question was, well, what difference does it make? And we were able to go to this data source because it existed and pull out data that showed, um, exactly the impact of fluoridation in the water and help inform public policy. And as a body, we were able to make a much better decision because the data existed. And I sent out an email recently that, that has a very long list of other uses of this data that show that it's value, but it really is helpful for any type of decision making related to, to healthcare, whether that's insurance regulation, whether that's plan design, whether that's a hospital strategic planning for future development of particular types of services in rural areas, et cetera. So the goal of this particular bill is to strengthen the operational aspects of that program. And, uh, two, two years ago we had a discussion, he about the, about the particular program. And the conclusion was let's give it two more years and come back and reevaluate to see if, if additional improvements are needed. Uh, this last fall, OLA did a performance audit and suggested that the legislature make additional operational improvements through legislation. So in particular, this, uh, eliminates some antiquated language and requires the department to have a very well-defined strategic plan that covers both data collection or all, all of the above. All of the following, data collection, data management, data analysis, data dissemination, and data security and privacy. So, um, this also clarifies how sensitive data should not be accessed only except in very limited circumstances. So those were some of the recommendations that came from the OLA audit. So in a nutshell, um, this has been a two year process culminating with an audit by ola. And this incorporates the recommendations of OLA for that program. And I would appreciate your support. Thank you, Mr. Speaker.

I'll waive. Thank you. Summation has been wad voting.

You Mr. Speaker. Uh, the Utah, the Utah Health Data Authority was established in 1990 as the entity responsible for collecting data to inform the public policy makers and others, other decision makers about the quality and cost of their healthcare. Uh, this information is used for a lot of different purposes and is very valuable to policy makers. A most recent example was recently we had a bill discussing, uh, the value of fluoridation in public water. And the question was, well, what difference does it make? And we were able to go to this data source because it existed and pull out data that showed, um, exactly the impact of fluoridation in the water and help inform public policy. And as a body, we were able to make a much better decision because the data existed. And I sent out an email recently that, that has a very long list of other uses of this data that show that it's value, but it really is helpful for any type of decision making related to, to healthcare, whether that's insurance regulation, whether that's plan design, whether that's a hospital strategic planning for future development of particular types of services in rural areas, et cetera. So the goal of this particular bill is to strengthen the operational aspects of that program. And, uh, two, two years ago we had a discussion, he about the, about the particular program. And the conclusion was let's give it two more years and come back and reevaluate to see if, if additional improvements are needed. Uh, this last fall, OLA did a performance audit and suggested that the legislature make additional operational improvements through legislation. So in particular, this, uh, eliminates some antiquated language and requires the department to have a very well-defined strategic plan that covers both data collection or all, all of the above. All of the following, data collection, data management, data analysis, data dissemination, and data security and privacy. So, um, this also clarifies how sensitive data should not be accessed only except in very limited circumstances. So those were some of the recommendations that came from the OLA audit. So in a nutshell, um, this has been a two year process culminating with an audit by ola. And this incorporates the recommendations of OLA for that program. And I would appreciate your support. Thank you, Mr. Speaker.

I'll waive. Thank you. Summation has been wad voting.

established in 1990 as the entity responsible for collecting data to inform the public policy makers and other decision makers about the quality and cost of healthcare in the state of Utah. The goal of 1 99 is to strengthen the operational aspects of the health of the health data authority. And this is largely in response to an OA performance audit from last year. That audit concluded that there is value in the data program, but some operational aspects need improvement. So what it does is it eliminates outdated language and requires the department to have publicly available plans that cover all aspects of the data data program. It clarifies how sensitive data can be used within the department and by the local health entity and strengthens those provisions. Uh, finally in the sub it adds more items to the list of direct identifiers. Strengthens language to prohibit re-identification. Strengthens language relating to security policies requires reporting on privacy and security. As part of the department's privacy program report and specifies downstream user users are potentially liable for damages. And with that, I'm open to any questions.

A motion is that we read first substitute House Bill 1 99 for a third time.

Motion encircle. Uh, first substitute Senate bill 1 55. Motion encircle First substitute Senate

Thank you President. Um, the goal of this bill is to strengthen the operational aspects of the health data authority. Uh, and this is largely in response to an OAG performance audit. The audit concluded that there is value in this data program, but some operational aspects need improvement. So this provides some of those technical improvements and it eliminated eliminates outdated language, clarifies how sensitive data can be used within the department and by local health entities. Um, and then it also adds more items to the list of direct identifiers. Strengthen language to prohibit re-identification. Strengthens language relating to security policies requires reporting on privacy and security as part of the department's privacy program, uh, requires users to delete data when is no longer needed or at a specified time and ensures the opt-out requests are on by downstream users of the data. So this is largely in line with a lot of the government data privacy stuff that we're doing and it's just bringing this into conformity. With that, Thank you for the presentation.

Motion is that we pass First substitute house Bill 1 99.