Section 441.80.7. Health care data match program.

As a condition of doing business in Iowa, health insurers shall provide, upon the request of the state, information with respect to individuals who are eligible for or are provided medical assistance under the state’s medical assistance state plan to determine (1) during what period the member or the member’s spouse or dependents may be or may have been covered by a health insurer and (2) the nature of the coverage that is or was provided by the health insurer. This requirement applies to self-insured plans, group health plans as defined in the federal Employee Retirement Income Security Act of 1974 (Public Law 93-406), service benefit plans, managed care organizations, pharmacy benefits managers, and other parties that are, by statute, contract, or agreement, legally responsible for payment of a claim for a health care item or service.

       80.7(1) Agreement required. The parties shall sign a data use agreement for the purposes of this rule. The agreement shall prescribe the manner in which information shall be provided to the department of human services and the acceptable uses of the information provided.

        a.           The initial provision of data shall include the data necessary to enable the department to match covered persons and identify third-party payers for the two-year period before the initial provision of the data. The data shall include the name, address, and identifying number of the plan.

        b.           Ongoing monthly matches may be limited to changes in the data previously provided, including additional covered persons, with the effective dates of the changes.

       80.7(2) Agreement form.

        a.           An agreement with the department shall be in substantially the same form as Form 470-4415, Agreement for Use of Data.

        b.           An agreement with the department’s designee shall be in a form approved by the designee, which shall include privacy protections equivalent to those provided in Form 470-4415, Agreement for Use of Data.

       80.7(3) Confidentiality of data. The exchange of information carried out under this rule shall be consistent with all laws, regulations, and rules relating to the confidentiality or privacy of personal information or medical records, including but not limited to:

        a.           The federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191; and

        b.           Regulations promulgated in accordance with that Act and published in 45 CFR Parts 160 through 164.

[ARC 1070C, IAB 10/2/13, effective 10/1/13]