Iowa 2025-2026 Regular Session

Iowa House Bill HF1028 Compare Versions

OldNewDifferences
1-House File 1028 - Reprinted HOUSE FILE 1028 BY COMMITTEE ON APPROPRIATIONS (SUCCESSOR TO HF 756) (SUCCESSOR TO HSB 72) (As Amended and Passed by the House April 24, 2025 ) A BILL FOR An Act relating to matters under the purview of the department 1 of management, making appropriations, and including 2 applicability provisions. 3 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: 4 HF 1028 (4) 91 sc/ns/md
1+House File 1028 - Introduced HOUSE FILE 1028 BY COMMITTEE ON APPROPRIATIONS (SUCCESSOR TO HF 756) (SUCCESSOR TO HSB 72) A BILL FOR An Act relating to matters under the purview of the department 1 of management, making appropriations, and including 2 applicability provisions. 3 BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA: 4 TLSB 1362HZ (3) 91 sc/ns
22
3-H.F. 1028 Section 1. Section 2.42, Code 2025, is amended by adding the 1 following new subsection: 2 NEW SUBSECTION . 17. To review and disapprove 3 interdepartmental transfers described in section 8.39, 4 subsection 4, paragraph c , as the council may determine. 5 Sec. 2. Section 8.39, subsections 2 and 4, Code 2025, are 6 amended to read as follows: 7 2. If the appropriation of a department, institution, 8 or agency is insufficient to properly meet the legitimate 9 expenses of the department, institution, or agency, the 10 director of the department of management , with the approval 11 of the governor, may make an interdepartmental transfer from 12 any other department, institution, or agency of the state 13 having an appropriation in excess of its needs, of sufficient 14 funds moneys to meet that deficiency. Such transfer shall 15 be to an appropriation made from the same funding source and 16 within the same fiscal year. The amount of a transfer made 17 from an appropriation under this subsection shall be limited 18 to not more than one-tenth of one percent of the total of all 19 appropriations made from the funding source of the transferred 20 appropriation for the fiscal year in which the transfer is 21 made. An interdepartmental transfer to an appropriation which 22 is not an entitlement appropriation is not authorized when 23 the general assembly is in regular session and, in addition, 24 the sum of interdepartmental transfers in a fiscal year to an 25 appropriation which is not an entitlement appropriation shall 26 not exceed fifty percent of the amount of the appropriation 27 as enacted by the general assembly. For the purposes of this 28 subsection , an entitlement appropriation is : 29 a. Appropriation in excess of its needs means that the 30 amount appropriated by the general assembly for a purpose is 31 determined by the department, institution, or agency receiving 32 the appropriation to be more than the amount necessary to carry 33 out that purpose. An appropriation for an unspecified dollar 34 amount, whether the appropriation is limited to be sufficient 35 -1- HF 1028 (4) 91 sc/ns/md 1/ 15
3+H.F. 1028 Section 1. Section 8.57C, subsections 2, 3, and 4, Code 1 2025, are amended to read as follows: 2 2. Moneys in the fund in a fiscal year shall be used as 3 appropriated by the general assembly for the acquisition 4 of computer hardware and software, software development, 5 telecommunications equipment, and maintenance and lease 6 agreements associated with technology components and for the 7 purchase of equipment intended to provide an uninterruptible 8 power supply are appropriated to the department of management 9 to provide a stable funding source for implementation costs 10 of state information technology projects that enhance the 11 states technology infrastructure, improve government services, 12 and promote innovation and economic development, including 13 but not limited to new information technology projects 14 and infrastructure replacement efforts of a department or 15 establishment . 16 a. The department shall prioritize proposed projects based 17 on all of the following considerations: 18 (1) Whether the project aligns with the states strategic 19 priorities. 20 (2) Whether the project promotes or introduces new 21 technology or significantly improves an existing system. 22 (3) Whether the project is feasible and whether the 23 department or establishment has established readiness for the 24 project to proceed, including a clear assessment of timelines, 25 budgets, and measurable outcomes. 26 (4) Whether the project includes a clear change management 27 strategy to support user adoption and aligns with lean 28 enterprise principles to maximize value, minimize waste, and 29 ensure continuous improvement. 30 (5) Whether the project provides a positive return on 31 investment, considering both financial returns and nonfinancial 32 benefits such as improved public safety, education, or health 33 care. 34 (6) Whether the project results in infrastructure that is 35 -1- LSB 1362HZ (3) 91 sc/ns 1/ 14
44
5-H.F. 1028 to carry out a particular purpose or is unlimited, shall not 1 be considered an appropriation in excess of a departments, 2 institutions, or agencys needs. 3 b. Entitlement appropriation means a line item 4 appropriation to the state public defender for indigent defense 5 or to the department of health and human services for foster 6 care, state supplementary assistance, medical assistance, or 7 for the family investment program. 8 4. a. Prior to any transfer of funds moneys pursuant 9 to subsection 1 or 2 of this section , or a transfer of an 10 allocation from a subunit of a department which statutorily has 11 independent budgeting authority, the director of the department 12 of management shall notify the chairpersons of the standing 13 committees on appropriations of the senate and the house of 14 representatives and the chairpersons of subcommittees of such 15 committees of the proposed transfer. The notice from the 16 director shall include information concerning the amount of the 17 proposed transfer, the departments, institutions, or agencies 18 affected by the proposed transfer , and the reasons for the 19 proposed transfer. Chairpersons 20 b. Unless a transfer is governed under paragraph c , 21 chairpersons notified shall be given at least two weeks to 22 review and comment on the proposed transfer before the transfer 23 of funds is made. 24 c. (1) This paragraph applies to any transfer made for a 25 fiscal year under subsection 2 between July 1 of that fiscal 26 year and the subsequent first day of the regular session of the 27 general assembly occurring in that fiscal year. 28 (2) The director shall submit the notice required by this 29 subsection to the chairpersons at least three weeks before the 30 proposed transfer is made. 31 (3) In addition to the information otherwise required, the 32 notice required by this subsection and submitted under this 33 paragraph must also include all of the following: 34 (a) Information demonstrating that the appropriation from 35 -2- HF 1028 (4) 91 sc/ns/md 2/ 15
5+H.F. 1028 scalable across the state enterprise. 1 (7) Whether the department or establishment has identified 2 how the completed project will be sustained beyond the initial 3 funding period. 4 (8) Whether the project improves access to governmental 5 services, particularly in rural communities. 6 (9) Whether the project involves an infrastructure project 7 as opposed to maintenance or standard upgrades of existing 8 technology. 9 b. The department shall provide a prioritized list of 10 proposed projects for funding to the governor, who shall use 11 the list in developing a budgetary recommendation for the 12 general assembly pursuant to section 8.21. 13 3. a. There is appropriated from the general fund of the 14 state to the technology reinvestment fund for the fiscal year 15 beginning July 1, 2025, and for each subsequent fiscal year 16 thereafter, the sum of seventeen million five hundred thousand 17 dollars. 18 b. There is appropriated from the rebuild Iowa 19 infrastructure fund for the fiscal year beginning July 1, 2023, 20 and ending June 30, 2024, the sum of eighteen million three 21 hundred ninety thousand two hundred ninety dollars to the 22 technology reinvestment fund, notwithstanding section 8.57, 23 subsection 3 , paragraph c . 24 c. There is appropriated from the rebuild Iowa 25 infrastructure fund for the fiscal year beginning July 1, 2024, 26 and ending June 30, 2025, the sum of twenty-one million one 27 hundred thirty-one thousand eight hundred seventy-three dollars 28 to the technology reinvestment fund, notwithstanding section 29 8.57, subsection 3 , paragraph c . 30 b. Notwithstanding section 8.33, moneys in the fund 31 that remain unencumbered or unobligated at the close of a 32 fiscal year shall not revert but shall remain available for 33 expenditure for the purposes designated. Notwithstanding 34 section 12C.7, subsection 2, interest or earnings on moneys in 35 -2- LSB 1362HZ (3) 91 sc/ns 2/ 14
66
7-H.F. 1028 which the transfer will be made is in excess of the entitys 1 needs taking into account the date on which the transfer will 2 occur within the fiscal year, and the reason the excess was not 3 anticipated. 4 (b) Information demonstrating that the appropriation to 5 which the transfer will be made is insufficient to properly 6 meet the legitimate expenses of the entity taking into account 7 the date on which the transfer will occur within the fiscal 8 year, and the reason the deficiency was not anticipated. 9 (c) Information demonstrating that sufficient state moneys 10 are available in the single funding source involved in the 11 transfer, and citations to the law under which all entities 12 affected by the transfer were appropriated moneys from that 13 funding source for the applicable fiscal year. 14 (4) Prior to the date the proposed transfer will be made, 15 the legislative council may meet to consider the transfer. At 16 the meeting, the legislative council may vote to disapprove the 17 transfer. If the legislative council disapproves the transfer, 18 the transfer shall not occur. 19 Sec. 3. Section 8.57C, subsections 2, 3, and 4, Code 2025, 20 are amended to read as follows: 21 2. Moneys in the fund in a fiscal year shall be used as 22 appropriated by the general assembly for the acquisition 23 of computer hardware and software, software development, 24 telecommunications equipment, and maintenance and lease 25 agreements associated with technology components and for the 26 purchase of equipment intended to provide an uninterruptible 27 power supply are appropriated to the department of management 28 to provide a stable funding source for implementation costs 29 of state information technology projects that enhance the 30 states technology infrastructure, improve government services, 31 and promote innovation and economic development, including 32 but not limited to new information technology projects 33 and infrastructure replacement efforts of a department or 34 establishment . 35 -3- HF 1028 (4) 91 sc/ns/md 3/ 15
7+H.F. 1028 the fund shall be credited to the fund. 1 4. Annually, on On or before January 15 of each year, a 2 state agency that received an appropriation from this fund 3 the department of management shall report to the legislative 4 services agency and the department of management general 5 assembly the status of all projects funded under this section 6 that have been completed since the previous report was 7 submitted or that are in progress. The report shall must 8 include a description of the project, the progress of work 9 completed, the total estimated cost of the project, a list of 10 all revenue sources being used to fund the project, the amount 11 of funds moneys expended, the amount of funds moneys obligated, 12 and the date the project was completed or an estimated 13 completion date of the project, where applicable. 14 Sec. 2. Section 8.78, Code 2025, is amended to read as 15 follows: 16 8.78 Background checks. 17 An applicant for employment with the department, or 18 an applicant for employment with a supported entity for a 19 position as information technology staff, may be subject to a 20 background investigation by the department. The background 21 investigation may include, without limitation, a work history, 22 financial review, request for criminal history data, and 23 national criminal history check through the federal bureau of 24 investigation. In addition, a contractor, vendor, employee, or 25 any other individual performing work for the department, or an 26 individual on the information technology staff of a supported 27 entity, may be subject to a national criminal history check 28 through the federal bureau of investigation at least once 29 every ten five years, including, without limitation, any time 30 the department or supported entity has reason to believe an 31 individual has been convicted of a crime. The department may 32 request the national criminal history check and, if requested, 33 shall provide the individuals fingerprints to the department 34 of public safety for submission through the state criminal 35 -3- LSB 1362HZ (3) 91 sc/ns 3/ 14
88
9-H.F. 1028 a. The department shall prioritize proposed projects based 1 on all of the following considerations: 2 (1) Whether the project aligns with the states strategic 3 priorities. 4 (2) Whether the project promotes or introduces new 5 technology or significantly improves an existing system. 6 (3) Whether the project is feasible and whether the 7 department or establishment has established readiness for the 8 project to proceed, including a clear assessment of timelines, 9 budgets, and measurable outcomes. 10 (4) Whether the project includes a clear change management 11 strategy to support user adoption and aligns with lean 12 enterprise principles to maximize value, minimize waste, and 13 ensure continuous improvement. 14 (5) Whether the project provides a positive return on 15 investment, considering both financial returns and nonfinancial 16 benefits such as improved public safety, education, or health 17 care. 18 (6) Whether the project results in infrastructure that is 19 scalable across the state enterprise. 20 (7) Whether the department or establishment has identified 21 how the completed project will be sustained beyond the initial 22 funding period. 23 (8) Whether the project improves access to governmental 24 services, particularly in rural communities. 25 (9) Whether the project involves an infrastructure project 26 as opposed to maintenance or standard upgrades of existing 27 technology. 28 b. The department shall provide a prioritized list of 29 proposed projects for funding to the governor, who shall use 30 the list in developing a budgetary recommendation for the 31 general assembly pursuant to section 8.21. 32 3. a. There is appropriated from the general fund of the 33 state to the technology reinvestment fund for the fiscal year 34 beginning July 1, 2025, and for each subsequent fiscal year 35 -4- HF 1028 (4) 91 sc/ns/md 4/ 15
9+H.F. 1028 history repository to the federal bureau of investigation. 1 The individual shall authorize release of the results of the 2 national criminal history check to the department and the 3 applicable supported entity. The department shall pay the 4 actual cost of the fingerprinting and national criminal history 5 check, if any, unless otherwise agreed as part of a contract 6 between the department or supported entity and a vendor or 7 contractor performing work for the department or supported 8 entity. The results of a criminal history check conducted 9 pursuant to this section shall not be considered a public 10 record under chapter 22 . 11 Sec. 3. NEW SECTION . 8.94 Contracts prohibited terms. 12 Provisions included in a contract entered into pursuant to 13 this subchapter that impose terms or conditions prohibited by 14 this section are void as contrary to public policy. Such a 15 contract shall be interpreted and enforced as if the contract 16 did not include the prohibited terms or conditions. Prohibited 17 terms and conditions include all of the following: 18 1. A provision requiring the department or a supported 19 entity to defend, indemnify, hold harmless another person, or 20 otherwise assume the debt or liability of another person in 21 violation of Article VII, section 1, of the Constitution of the 22 State of Iowa. 23 2. A provision that seeks to impose a term that is unknown 24 to the department or supported entity at the time of signing 25 the contract or that can be unilaterally changed by an entity 26 other than the department or a supported entity. 27 3. A provision that violates chapter 13 by not allowing 28 the department or a supported entity to participate in its own 29 defense through representation by the attorney general. 30 4. A provision that grants to a person other than the 31 attorney general the authority to convey to a court or litigant 32 the states consent to any settlement of a suit involving the 33 contract when such settlement could impose liability on the 34 state. 35 -4- LSB 1362HZ (3) 91 sc/ns 4/ 14
1010
11-H.F. 1028 thereafter, the sum of seventeen million five hundred thousand 1 dollars. 2 b. There is appropriated from the rebuild Iowa 3 infrastructure fund for the fiscal year beginning July 1, 2023, 4 and ending June 30, 2024, the sum of eighteen million three 5 hundred ninety thousand two hundred ninety dollars to the 6 technology reinvestment fund, notwithstanding section 8.57, 7 subsection 3 , paragraph c . 8 c. There is appropriated from the rebuild Iowa 9 infrastructure fund for the fiscal year beginning July 1, 2024, 10 and ending June 30, 2025, the sum of twenty-one million one 11 hundred thirty-one thousand eight hundred seventy-three dollars 12 to the technology reinvestment fund, notwithstanding section 13 8.57, subsection 3 , paragraph c . 14 b. Notwithstanding section 8.33, moneys in the fund 15 that remain unencumbered or unobligated at the close of a 16 fiscal year shall not revert but shall remain available for 17 expenditure for the purposes designated. Notwithstanding 18 section 12C.7, subsection 2, interest or earnings on moneys in 19 the fund shall be credited to the fund. 20 4. Annually, on On or before January 15 of each year, a 21 state agency that received an appropriation from this fund 22 the department of management shall report to the legislative 23 services agency and the department of management general 24 assembly the status of all projects funded under this section 25 that have been completed since the previous report was 26 submitted or that are in progress. The report shall must 27 include a description of the project, the progress of work 28 completed, the total estimated cost of the project, a list of 29 all revenue sources being used to fund the project, the amount 30 of funds moneys expended, the amount of funds moneys obligated, 31 and the date the project was completed or an estimated 32 completion date of the project, where applicable. 33 Sec. 4. Section 8.78, Code 2025, is amended to read as 34 follows: 35 -5- HF 1028 (4) 91 sc/ns/md 5/ 15
11+H.F. 1028 5. A provision that specifies that the contract is governed 1 by the laws of a foreign state or nation. 2 6. A provision that claims blanket confidentiality of the 3 contracts terms. 4 7. A provision that claims that payment terms, including but 5 not limited to cost proposals or other pricing information, of 6 the contract are confidential. 7 8. A provision that authorizes or requires a venue for 8 litigation other than an appropriate state or federal court 9 sitting in Iowa. 10 9. A provision that requires the department or a supported 11 entity to pay attorney fees, court costs, or other litigation 12 expenses in the event of a contractual dispute. 13 10. A provision that imposes on the department or a 14 supported entity binding arbitration or any other binding 15 extrajudicial dispute resolution process in which the final 16 resolution is not determined by the state. 17 11. A provision that waives the departments or a supported 18 entitys right to a jury trial. 19 12. A provision that obligates the department or a supported 20 entity to pay late payment charges not consistent with section 21 8A.514, interest greater than allowed under section 8A.514 or 22 other applicable law, or any cancellation charges, as such 23 charges constitute pledges of the states credit. 24 13. A provision that obligates the department or a supported 25 entity to pay a tax. 26 14. A provision that imposes a prior notice obligation 27 on the department or a supported entity as a condition for 28 the automatic renewal of a software license. The department 29 or a supported entity may provide notice of its intent to 30 terminate a software license at any time before the renewal 31 date established in the contract. 32 15. A provision that obligates the department or a supported 33 entity to accept risk of loss before the receipt of items or 34 goods. 35 -5- LSB 1362HZ (3) 91 sc/ns 5/ 14
1212
13-H.F. 1028 8.78 Background checks. 1 An applicant for employment with the department, or 2 an applicant for employment with a supported entity for a 3 position as information technology staff, may be subject to a 4 background investigation by the department. The background 5 investigation may include, without limitation, a work history, 6 financial review, request for criminal history data, and 7 national criminal history check through the federal bureau of 8 investigation. In addition, a contractor, vendor, employee, or 9 any other individual performing work for the department, or an 10 individual on the information technology staff of a supported 11 entity, may be subject to a national criminal history check 12 through the federal bureau of investigation at least once 13 every ten five years, including, without limitation, any time 14 the department or supported entity has reason to believe an 15 individual has been convicted of a crime. The department may 16 request the national criminal history check and, if requested, 17 shall provide the individuals fingerprints to the department 18 of public safety for submission through the state criminal 19 history repository to the federal bureau of investigation. 20 The individual shall authorize release of the results of the 21 national criminal history check to the department and the 22 applicable supported entity. The department shall pay the 23 actual cost of the fingerprinting and national criminal history 24 check, if any, unless otherwise agreed as part of a contract 25 between the department or supported entity and a vendor or 26 contractor performing work for the department or supported 27 entity. The results of a criminal history check conducted 28 pursuant to this section shall not be considered a public 29 record under chapter 22 . 30 Sec. 5. NEW SECTION . 8.94 Contracts prohibited terms. 31 Provisions included in a contract entered into pursuant to 32 this subchapter that impose terms or conditions prohibited by 33 this section are void as contrary to public policy. Such a 34 contract shall be interpreted and enforced as if the contract 35 -6- HF 1028 (4) 91 sc/ns/md 6/ 15
13+H.F. 1028 16. A provision that obligates the department or a supported 1 entity to have commercial insurance. 2 17. A provision that obligates the department or a supported 3 entity to grant to a nongovernmental entity full or partial 4 ownership of intellectual property developed pursuant to the 5 contract when the intellectual property is developed in whole 6 or in part using federal funding. 7 18. A provision that limits the time in which the department 8 or a supported entity may bring a legal claim under the 9 contract to a period shorter than that provided in Iowa law. 10 19. A boilerplate provision included in transactional 11 documents received by the department or a supported entity that 12 seeks to alter the terms of the contract or to impose new terms 13 in the contract. 14 Sec. 4. NEW SECTION . 8.95 Contracts required terms. 15 All of the following provisions shall be deemed to be 16 included in a contract entered into by the department or a 17 supported entity under this subchapter: 18 1. Governing law. The contract shall be governed by 19 the laws of the state of Iowa, without giving effect to any 20 conflicts of law principles of Iowa law that may require the 21 application of another jurisdictions law. 22 2. Venue. Any litigation commenced in connection with the 23 contract shall be brought and maintained in an appropriate 24 state or federal court sitting in Iowa. 25 Sec. 5. NEW SECTION . 8.96 Contracts limitation of 26 liability prohibited terms. 27 Notwithstanding section 8A.311, subsection 22, and rules 28 adopted pursuant to that subsection, the director may include 29 a contractual limitation of vendor liability in information 30 technology goods and services contracts. A contractual 31 limitation of vendor liability must take into consideration the 32 public interest and the mitigation of risks associated with the 33 use of information technology goods or services. Any portion 34 of a contractual limitation of vendor liability that includes 35 -6- LSB 1362HZ (3) 91 sc/ns 6/ 14
1414
15-H.F. 1028 did not include the prohibited terms or conditions. Prohibited 1 terms and conditions include all of the following: 2 1. A provision requiring the department or a supported 3 entity to defend, indemnify, hold harmless another person, or 4 otherwise assume the debt or liability of another person in 5 violation of Article VII, section 1, of the Constitution of the 6 State of Iowa. 7 2. A provision that seeks to impose a term that is unknown 8 to the department or supported entity at the time of signing 9 the contract or that can be unilaterally changed by an entity 10 other than the department or a supported entity. 11 3. A provision that violates chapter 13 by not allowing 12 the department or a supported entity to participate in its own 13 defense through representation by the attorney general. 14 4. A provision that grants to a person other than the 15 attorney general the authority to convey to a court or litigant 16 the states consent to any settlement of a suit involving the 17 contract when such settlement could impose liability on the 18 state. 19 5. A provision that specifies that the contract is governed 20 by the laws of a foreign state or nation. 21 6. A provision that claims blanket confidentiality of the 22 contracts terms. 23 7. A provision that claims that payment terms, including but 24 not limited to cost proposals or other pricing information, of 25 the contract are confidential. 26 8. A provision that authorizes or requires a venue for 27 litigation other than an appropriate state or federal court 28 sitting in Iowa. 29 9. A provision that requires the department or a supported 30 entity to pay attorney fees, court costs, or other litigation 31 expenses in the event of a contractual dispute. 32 10. A provision that imposes on the department or a 33 supported entity binding arbitration or any other binding 34 extrajudicial dispute resolution process in which the final 35 -7- HF 1028 (4) 91 sc/ns/md 7/ 15
15+H.F. 1028 a repudiation of all liability for cybersecurity incidents or 1 a limitation on the vendors liability for intentional torts, 2 criminal acts, fraudulent conduct, intentional or willful 3 misconduct, gross negligence, death, bodily injury, damage to 4 real or personal property, intellectual property violations, 5 liquidated damages, compliance with applicable laws, violations 6 of confidential information obligations, or contractual 7 obligations of the vendor pertaining to indemnification shall 8 be void as a matter of law as contrary to public policy. A 9 contractual limit of vendor liability that does not apply 10 equally to the contracted parties or that limits a vendors 11 liability to less than the contract value inclusive of all 12 possible extensions is void as a matter of law as contrary to 13 public policy. 14 Sec. 6. NEW SECTION . 8.97 Confidentiality of communications 15 with chief information security officer. 16 In the interest of facilitating communication between 17 the chief information security officer and other entities 18 concerning security incidents and security breaches, all such 19 communications and any documents generated based in whole or in 20 part on such communications are confidential. Notwithstanding 21 chapter 22 or any other provision of law to the contrary, the 22 department shall not release such communications pursuant to 23 state open records laws, and such communications shall not be 24 received into evidence, subject to discovery, or otherwise 25 used in a trial, hearing, or other proceeding in or before any 26 court, regulatory body, or other authority of the state or a 27 political subdivision of the state, unless the communications 28 are subject to a protective order that prohibits further 29 disclosure of such communications and requires any court 30 filings of such communications to be made under seal. It is 31 the intent of the general assembly that these prohibitions and 32 restrictions also apply to federal courts, regulatory bodies, 33 and other authorities and for purposes of federal open records 34 laws, to the extent allowed by federal law and court rules. 35 -7- LSB 1362HZ (3) 91 sc/ns 7/ 14
1616
17-H.F. 1028 resolution is not determined by the state. 1 11. A provision that waives the departments or a supported 2 entitys right to a jury trial. 3 12. A provision that obligates the department or a supported 4 entity to pay late payment charges not consistent with section 5 8A.514, interest greater than allowed under section 8A.514 or 6 other applicable law, or any cancellation charges, as such 7 charges constitute pledges of the states credit. 8 13. A provision that obligates the department or a supported 9 entity to pay a tax. 10 14. A provision that imposes a prior notice obligation 11 on the department or a supported entity as a condition for 12 the automatic renewal of a software license. The department 13 or a supported entity may provide notice of its intent to 14 terminate a software license at any time before the renewal 15 date established in the contract. 16 15. A provision that obligates the department or a supported 17 entity to accept risk of loss before the receipt of items or 18 goods. 19 16. A provision that obligates the department or a supported 20 entity to have commercial insurance. 21 17. A provision that obligates the department or a supported 22 entity to grant to a nongovernmental entity full or partial 23 ownership of intellectual property developed pursuant to the 24 contract when the intellectual property is developed in whole 25 or in part using federal funding. 26 18. A provision that limits the time in which the department 27 or a supported entity may bring a legal claim under the 28 contract to a period shorter than that provided in Iowa law. 29 19. A boilerplate provision included in transactional 30 documents received by the department or a supported entity that 31 seeks to alter the terms of the contract or to impose new terms 32 in the contract. 33 Sec. 6. NEW SECTION . 8.95 Contracts required terms. 34 All of the following provisions shall be deemed to be 35 -8- HF 1028 (4) 91 sc/ns/md 8/ 15
17+H.F. 1028 The chief information security officer shall not release such 1 communications other than for any of the following purposes: 2 1. Identifying a cybersecurity threat, including the source 3 of the cybersecurity threat, or a security vulnerability, and 4 then only to government officials for purposes of addressing 5 the threat. 6 2. Responding to, or otherwise preventing or mitigating, 7 a specific threat of death, serious bodily harm, or serious 8 economic harm. 9 3. Responding to, investigating, prosecuting, or otherwise 10 preventing or mitigating a serious threat to a minor, including 11 sexual exploitation and threats to physical safety. 12 4. Preventing, investigating, disrupting, or prosecuting an 13 offense under state or federal law. 14 5. Providing a confidential cybersecurity briefing to the 15 governor or a member of the general assembly. 16 Sec. 7. NEW SECTION . 8.98 Criminal justice information. 17 1. The department is authorized to maintain an integrated 18 information system that enables automated data sharing among 19 the executive branch, judicial branch, and local agencies. 20 2. The department is designated as the Iowa statistical 21 analysis center for the purpose of coordinating with data 22 resource agencies to provide data and analytical information 23 to federal, state, and local governments. Notwithstanding any 24 other provision of state law to the contrary, unless prohibited 25 by federal law or regulation, the department shall be granted 26 access, for purposes of research and evaluation, to all of 27 the data listed in this subsection, except that intelligence 28 data and peace officer investigative reports maintained 29 by the department of public safety shall not be considered 30 data for the purposes of this section. The department of 31 management and any record, data, or information obtained by the 32 department under this subsection is subject to the federal and 33 state confidentiality laws and rules, including as described 34 in chapter 22, applicable to the original record, data, or 35 -8- LSB 1362HZ (3) 91 sc/ns 8/ 14
1818
19-H.F. 1028 included in a contract entered into by the department or a 1 supported entity under this subchapter: 2 1. Governing law. The contract shall be governed by 3 the laws of the state of Iowa, without giving effect to any 4 conflicts of law principles of Iowa law that may require the 5 application of another jurisdictions law. 6 2. Venue. Any litigation commenced in connection with the 7 contract shall be brought and maintained in an appropriate 8 state or federal court sitting in Iowa. 9 Sec. 7. NEW SECTION . 8.96 Contracts limitation of 10 liability prohibited terms. 11 Notwithstanding section 8A.311, subsection 22, and rules 12 adopted pursuant to that subsection, the director may include 13 a contractual limitation of vendor liability in information 14 technology goods and services contracts. A contractual 15 limitation of vendor liability must take into consideration the 16 public interest and the mitigation of risks associated with the 17 use of information technology goods or services. Any portion 18 of a contractual limitation of vendor liability that includes 19 a repudiation of all liability for cybersecurity incidents or 20 a limitation on the vendors liability for intentional torts, 21 criminal acts, fraudulent conduct, intentional or willful 22 misconduct, gross negligence, death, bodily injury, damage to 23 real or personal property, intellectual property violations, 24 liquidated damages, compliance with applicable laws, violations 25 of confidential information obligations, or contractual 26 obligations of the vendor pertaining to indemnification shall 27 be void as a matter of law as contrary to public policy. A 28 contractual limit of vendor liability that does not apply 29 equally to the contracted parties or that limits a vendors 30 liability to less than the contract value inclusive of all 31 possible extensions is void as a matter of law as contrary to 32 public policy. 33 Sec. 8. NEW SECTION . 8.97 Confidentiality of communications 34 with chief information security officer. 35 -9- HF 1028 (4) 91 sc/ns/md 9/ 15
19+H.F. 1028 information, and to the original custodian of the record, 1 data, or information. Authorized access under this subsection 2 includes but is not limited to all of the following: 3 a. Juvenile court records and all other information 4 maintained under sections 232.147 through 232.151. 5 b. Child abuse information under sections 235A.15 through 6 235A.19. 7 c. Dependent adult abuse records maintained under chapter 8 235B. 9 d. Criminal history data maintained under chapter 692. 10 e. Sex offender registry information maintained under 11 chapter 692A. 12 f. Presentence investigation reports maintained under 13 section 901.4. 14 g. Corrections records maintained under sections 904.601 and 15 904.602. 16 h. Community-based correctional program records maintained 17 under chapter 904. 18 i. Parole records maintained under chapter 906. 19 j. Deferred judgment, deferred or suspended sentence, and 20 probation records maintained under chapter 907. 21 k. Violation of parole or probation records maintained under 22 chapter 908. 23 l. Fine and victim restitution records maintained under 24 chapters 909 and 910. 25 m. Child welfare records maintained under chapter 235. 26 3. The department is authorized to provide data analysis and 27 reporting on issues that may affect the states correctional 28 population and various subgroups of the population. This 29 reporting may include the review of filed, public legislative 30 bills, joint resolutions, and amendments, and compiling 31 criminal justice data for completion of correctional impact 32 statements under section 2.56, racial impact statements, and an 33 annual prison population forecast. 34 4. The department is authorized to maintain a multiagency 35 -9- LSB 1362HZ (3) 91 sc/ns 9/ 14
2020
21-H.F. 1028 In the interest of facilitating communication between 1 the chief information security officer and other entities 2 concerning security incidents and security breaches, all such 3 communications and any documents generated based in whole or in 4 part on such communications are confidential. Notwithstanding 5 chapter 22 or any other provision of law to the contrary, the 6 department shall not release such communications pursuant to 7 state open records laws, and such communications shall not be 8 received into evidence, subject to discovery, or otherwise 9 used in a trial, hearing, or other proceeding in or before any 10 court, regulatory body, or other authority of the state or a 11 political subdivision of the state, unless the communications 12 are subject to a protective order that prohibits further 13 disclosure of such communications and requires any court 14 filings of such communications to be made under seal. It is 15 the intent of the general assembly that these prohibitions and 16 restrictions also apply to federal courts, regulatory bodies, 17 and other authorities and for purposes of federal open records 18 laws, to the extent allowed by federal law and court rules. 19 The chief information security officer shall not release such 20 communications other than for any of the following purposes: 21 1. Identifying a cybersecurity threat, including the source 22 of the cybersecurity threat, or a security vulnerability, and 23 then only to government officials for purposes of addressing 24 the threat. 25 2. Responding to, or otherwise preventing or mitigating, 26 a specific threat of death, serious bodily harm, or serious 27 economic harm. 28 3. Responding to, investigating, prosecuting, or otherwise 29 preventing or mitigating a serious threat to a minor, including 30 sexual exploitation and threats to physical safety. 31 4. Preventing, investigating, disrupting, or prosecuting an 32 offense under state or federal law. 33 5. Providing a confidential cybersecurity briefing to the 34 governor or a member of the general assembly. 35 -10- HF 1028 (4) 91 sc/ns/md 10/ 15
21+H.F. 1028 information system to track the progress of juveniles and 1 adults who have been charged with a criminal offense in 2 the court system through various state and local agencies 3 and programs. This system must utilize existing databases, 4 including the Iowa court information system, the Iowa 5 corrections offender network, the child welfare information 6 system of the department of health and human services, 7 the federally mandated national adoption and foster care 8 information system, and other state and local databases 9 pertaining to juveniles and to adults who have been charged 10 with a criminal offense in the court system, to the extent 11 practicable. 12 5. The multiagency information system is authorized to 13 count and track decision points for juveniles in the juvenile 14 justice system and minors in the child welfare system, evaluate 15 the experiences of the juveniles and minors, and evaluate 16 the success of the services provided. The system is also 17 authorized to count and track decision points for adults who 18 have been charged with a criminal offense in the court system, 19 including but not limited to dismissed charges, convictions, 20 deferred judgments, and sentence information. 21 6. If the department has insufficient moneys or resources 22 to implement this section, the department is authorized to 23 determine which portion of this section may be implemented, if 24 any, and the remainder of this section shall not apply. 25 Sec. 8. NEW SECTION . 8.99 Confidentiality of data. 26 1. For purposes of chapter 22, the department shall not be 27 deemed to be the lawful custodian of records the department 28 maintains for another department or establishment under this 29 subchapter, to the extent the records in question are held 30 by the department as an automated data processing unit of 31 government or held by the department solely for storage for 32 another department or establishment. Such records include but 33 are not limited to all of the following: 34 a. Electronic messaging system data. 35 -10- LSB 1362HZ (3) 91 sc/ns 10/ 14
2222
23-H.F. 1028 Sec. 9. NEW SECTION . 8.98 Criminal justice information. 1 1. The department is authorized to maintain an integrated 2 information system that enables automated data sharing among 3 the executive branch, judicial branch, and local agencies. 4 2. The department is designated as the Iowa statistical 5 analysis center for the purpose of coordinating with data 6 resource agencies to provide data and analytical information 7 to federal, state, and local governments. Notwithstanding any 8 other provision of state law to the contrary, unless prohibited 9 by federal law or regulation, the department shall be granted 10 access, for purposes of research and evaluation, to all of 11 the data listed in this subsection, except that intelligence 12 data and peace officer investigative reports maintained 13 by the department of public safety shall not be considered 14 data for the purposes of this section. The department of 15 management and any record, data, or information obtained by the 16 department under this subsection is subject to the federal and 17 state confidentiality laws and rules, including as described 18 in chapter 22, applicable to the original record, data, or 19 information, and to the original custodian of the record, 20 data, or information. Authorized access under this subsection 21 includes but is not limited to all of the following: 22 a. Juvenile court records and all other information 23 maintained under sections 232.147 through 232.151. 24 b. Child abuse information under sections 235A.15 through 25 235A.19. 26 c. Dependent adult abuse records maintained under chapter 27 235B. 28 d. Criminal history data maintained under chapter 692. 29 e. Sex offender registry information maintained under 30 chapter 692A. 31 f. Presentence investigation reports maintained under 32 section 901.4. 33 g. Corrections records maintained under sections 904.601 and 34 904.602. 35 -11- HF 1028 (4) 91 sc/ns/md 11/ 15
23+H.F. 1028 b. Mainframe data. 1 c. Storage solutions or other electronic information, such 2 as on-premises server data storage and cloud data storage. 3 2. If the department receives a request pursuant to chapter 4 22 for records over which the department has determined it is 5 not the lawful custodian, the department shall deny the request 6 and inform the requester to seek the information from the 7 lawful custodian as provided in chapter 22. The departments 8 determination that it is not the lawful custodian of records is 9 presumed valid. The presumption may be rebutted by clear and 10 convincing evidence to the contrary. 11 3. The department shall provide assistance to the lawful 12 custodian of records held by the department so that the lawful 13 custodian can comply with the production obligations of chapter 14 22. 15 4. If the department receives a subpoena in an 16 administrative, civil, or criminal case for records for which 17 the department is not the lawful custodian, the department 18 shall notify the lawful custodian and the attorney generals 19 office and cooperate in any efforts to resist the subpoena. 20 Sec. 9. Section 216A.131A, Code 2025, is amended to read as 21 follows: 22 216A.131A Criminal and juvenile justice planning. 23 The department shall fulfill the responsibilities of 24 this subchapter , including the duties specified in sections 25 216A.133, 216A.135 , 216A.136 , 216A.137 , 216A.138 , and 216A.140 . 26 Sec. 10. Section 216A.133, subsection 1, paragraphs d, e, f, 27 l, and t, Code 2025, are amended by striking the paragraphs. 28 Sec. 11. Section 216A.133, subsection 1, paragraph q, 29 subparagraphs (1) and (6), Code 2025, are amended by striking 30 the subparagraphs. 31 Sec. 12. Section 216A.133, subsection 1, paragraph s, Code 32 2025, is amended to read as follows: 33 s. Provide expertise and advice to the legislative 34 services agency, the department of management, the department 35 -11- LSB 1362HZ (3) 91 sc/ns 11/ 14
2424
25-H.F. 1028 h. Community-based correctional program records maintained 1 under chapter 904. 2 i. Parole records maintained under chapter 906. 3 j. Deferred judgment, deferred or suspended sentence, and 4 probation records maintained under chapter 907. 5 k. Violation of parole or probation records maintained under 6 chapter 908. 7 l. Fine and victim restitution records maintained under 8 chapters 909 and 910. 9 m. Child welfare records maintained under chapter 235. 10 3. The department is authorized to provide data analysis and 11 reporting on issues that may affect the states correctional 12 population and various subgroups of the population. This 13 reporting may include the review of filed, public legislative 14 bills, joint resolutions, and amendments, and compiling 15 criminal justice data for completion of correctional impact 16 statements under section 2.56, racial impact statements, and an 17 annual prison population forecast. 18 4. The department is authorized to maintain a multiagency 19 information system to track the progress of juveniles and 20 adults who have been charged with a criminal offense in 21 the court system through various state and local agencies 22 and programs. This system must utilize existing databases, 23 including the Iowa court information system, the Iowa 24 corrections offender network, the child welfare information 25 system of the department of health and human services, 26 the federally mandated national adoption and foster care 27 information system, and other state and local databases 28 pertaining to juveniles and to adults who have been charged 29 with a criminal offense in the court system, to the extent 30 practicable. 31 5. The multiagency information system is authorized to 32 count and track decision points for juveniles in the juvenile 33 justice system and minors in the child welfare system, evaluate 34 the experiences of the juveniles and minors, and evaluate 35 -12- HF 1028 (4) 91 sc/ns/md 12/ 15
25+H.F. 1028 of corrections, the judicial branch, and others charged 1 with formulating fiscal, correctional, or minority impact 2 statements. 3 Sec. 13. Section 216A.135, subsection 2, paragraph e, Code 4 2025, is amended by striking the paragraph. 5 Sec. 14. Section 232.147, subsection 2, paragraph i, Code 6 2025, is amended to read as follows: 7 i. The statistical analysis center for the purposes stated 8 in section 216A.136 8.98 . 9 Sec. 15. Section 232.147, subsection 3, paragraph n, Code 10 2025, is amended to read as follows: 11 n. The statistical analysis center for the purposes stated 12 in section 216A.136 8.98 . 13 Sec. 16. Section 232.147, subsection 4, paragraph i, Code 14 2025, is amended to read as follows: 15 i. The statistical analysis center for the purposes stated 16 in section 216A.136 8.98 . 17 Sec. 17. Section 232.149, subsection 5, paragraph f, Code 18 2025, is amended to read as follows: 19 f. The statistical analysis center for the purposes stated 20 in section 216A.136 8.98 . 21 Sec. 18. Section 232.149A, subsection 3, paragraph m, Code 22 2025, is amended to read as follows: 23 m. The statistical analysis center for the purposes stated 24 in section 216A.136 8.98 . 25 Sec. 19. REPEAL. Sections 216A.136, 216A.137, and 26 216A.138, Code 2025, are repealed. 27 Sec. 20. APPLICABILITY. The following apply to contracts 28 entered into or renewed on or after the effective date of this 29 Act: 30 1. The section of this Act enacting section 8.94. 31 2. The section of this Act enacting section 8.95. 32 3. The section of this Act enacting section 8.96. 33 EXPLANATION 34 The inclusion of this explanation does not constitute agreement with 35 -12- LSB 1362HZ (3) 91 sc/ns 12/ 14
2626
27-H.F. 1028 the success of the services provided. The system is also 1 authorized to count and track decision points for adults who 2 have been charged with a criminal offense in the court system, 3 including but not limited to dismissed charges, convictions, 4 deferred judgments, and sentence information. 5 6. If the department has insufficient moneys or resources 6 to implement this section, the department is authorized to 7 determine which portion of this section may be implemented, if 8 any, and the remainder of this section shall not apply. 9 Sec. 10. NEW SECTION . 8.99 Confidentiality of data. 10 1. For purposes of chapter 22, the department shall not be 11 deemed to be the lawful custodian of records the department 12 maintains for another department or establishment under this 13 subchapter, to the extent the records in question are held 14 by the department as an automated data processing unit of 15 government or held by the department solely for storage for 16 another department or establishment. Such records include but 17 are not limited to all of the following: 18 a. Electronic messaging system data. 19 b. Mainframe data. 20 c. Storage solutions or other electronic information, such 21 as on-premises server data storage and cloud data storage. 22 2. If the department receives a request pursuant to chapter 23 22 for records over which the department has determined it is 24 not the lawful custodian, the department shall deny the request 25 and inform the requester to seek the information from the 26 lawful custodian as provided in chapter 22. The departments 27 determination that it is not the lawful custodian of records is 28 presumed valid. The presumption may be rebutted by clear and 29 convincing evidence to the contrary. 30 3. The department shall provide assistance to the lawful 31 custodian of records held by the department so that the lawful 32 custodian can comply with the production obligations of chapter 33 22. 34 4. If the department receives a subpoena in an 35 -13- HF 1028 (4) 91 sc/ns/md 13/ 15
27+H.F. 1028 the explanations substance by the members of the general assembly. 1 This bill relates to matters under the purview of the 2 department of management (DOM). 3 The bill strikes current law providing for the use of moneys 4 in the technology reinvestment fund for certain technology 5 projects and instead appropriates moneys in the fund to DOM for 6 technology projects using factors set forth in the bill. The 7 bill requires DOM to provide a prioritized list of proposed 8 projects to the governor, who must use the list to develop 9 a budgetary recommendation to the general assembly, and to 10 report completed and ongoing projects to the general assembly 11 annually. 12 The bill increases the frequency at which a person 13 performing work for DOM or an individual on the information 14 technology staff of a supported entity may be subject to a 15 national criminal history check through the federal bureau of 16 investigation from at least once every 10 years to every 5 17 years. 18 The bill prohibits the inclusion of certain provisions in 19 information technology contracts and declares those provisions 20 void if present in such contracts. The bill also provides that 21 such contracts are deemed to include provisions requiring the 22 contract to be governed by Iowa law and litigation related to 23 the contract to be brought and maintained in an appropriate 24 state or federal court sitting in Iowa. The bill authorizes 25 the director of DOM to include limitations of vendor liability 26 in information technology goods and services contracts, but 27 sets forth prohibited terms in such limitations of liability. 28 The bill makes all communication concerning cybersecurity 29 between the chief information security officer and other 30 entities confidential and allows the communications to be 31 released only for specific purposes. 32 Under current law, the department of health and human 33 services serves as the Iowa statistical analysis center and 34 maintains an integrated information system for data sharing 35 -13- LSB 1362HZ (3) 91 sc/ns 13/ 14
2828
29-H.F. 1028 administrative, civil, or criminal case for records for which 1 the department is not the lawful custodian, the department 2 shall notify the lawful custodian and the attorney generals 3 office and cooperate in any efforts to resist the subpoena. 4 Sec. 11. Section 216A.131A, Code 2025, is amended to read 5 as follows: 6 216A.131A Criminal and juvenile justice planning. 7 The department shall fulfill the responsibilities of 8 this subchapter , including the duties specified in sections 9 216A.133, 216A.135 , 216A.136 , 216A.137 , 216A.138 , and 216A.140 . 10 Sec. 12. Section 216A.133, subsection 1, paragraphs d, e, f, 11 l, and t, Code 2025, are amended by striking the paragraphs. 12 Sec. 13. Section 216A.133, subsection 1, paragraph q, 13 subparagraphs (1) and (6), Code 2025, are amended by striking 14 the subparagraphs. 15 Sec. 14. Section 216A.133, subsection 1, paragraph s, Code 16 2025, is amended to read as follows: 17 s. Provide expertise and advice to the legislative 18 services agency, the department of management, the department 19 of corrections, the judicial branch, and others charged 20 with formulating fiscal, correctional, or minority impact 21 statements. 22 Sec. 15. Section 216A.135, subsection 2, paragraph e, Code 23 2025, is amended by striking the paragraph. 24 Sec. 16. Section 232.147, subsection 2, paragraph i, Code 25 2025, is amended to read as follows: 26 i. The statistical analysis center for the purposes stated 27 in section 216A.136 8.98 . 28 Sec. 17. Section 232.147, subsection 3, paragraph n, Code 29 2025, is amended to read as follows: 30 n. The statistical analysis center for the purposes stated 31 in section 216A.136 8.98 . 32 Sec. 18. Section 232.147, subsection 4, paragraph i, Code 33 2025, is amended to read as follows: 34 i. The statistical analysis center for the purposes stated 35 -14- HF 1028 (4) 91 sc/ns/md 14/ 15
30-
31-H.F. 1028 in section 216A.136 8.98 . 1 Sec. 19. Section 232.149, subsection 5, paragraph f, Code 2 2025, is amended to read as follows: 3 f. The statistical analysis center for the purposes stated 4 in section 216A.136 8.98 . 5 Sec. 20. Section 232.149A, subsection 3, paragraph m, Code 6 2025, is amended to read as follows: 7 m. The statistical analysis center for the purposes stated 8 in section 216A.136 8.98 . 9 Sec. 21. REPEAL. Sections 216A.136, 216A.137, and 10 216A.138, Code 2025, are repealed. 11 Sec. 22. APPLICABILITY. The following apply to contracts 12 entered into or renewed on or after the effective date of this 13 Act: 14 1. The section of this Act enacting section 8.94. 15 2. The section of this Act enacting section 8.95. 16 3. The section of this Act enacting section 8.96. 17 -15- HF 1028 (4) 91 sc/ns/md 15/ 15
29+H.F. 1028 among federal, state, and local governments. The bill 1 transfers these powers and duties to DOM and grants DOM access 2 to criminal justice information other than intelligence data 3 and peace officer investigative reports maintained by the 4 department of public safety. DOM is authorized to provide 5 data analysis and reporting on issues that may affect the 6 states correctional population and various subgroups of the 7 population, to maintain a multiagency information system to 8 track the progress of juveniles and adults charged with a 9 criminal offense through state and local agencies and programs, 10 and to count and track decision points for individuals in 11 the juvenile justice system, child welfare system, and 12 court system. If DOM lacks sufficient moneys to perform the 13 authorized tasks of the Iowa statistical analysis center, the 14 bill allows DOM to determine which, if any, to implement. 15 The bill states that DOM is not the lawful custodian under 16 Code chapter 22 (open records) for records DOM maintains in 17 DOMs information technology capacity for other state entities 18 as an automated data processing unit of government or when 19 held by DOM solely for storage for another department or 20 establishment. The bill requires DOM to deny requests for 21 information for which DOM is not the lawful custodian, to 22 provide assistance to the lawful custodian to comply with 23 production obligations, and to cooperate in any efforts to 24 resist associated subpoenas. 25 -14- LSB 1362HZ (3) 91 sc/ns 14/ 14