North Carolina 2025-2026 Regular Session

North Carolina Senate Bill S509 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1	1		GENERAL ASSEMBLY OF NORTH CAROLINA
2	2		SESSION 2025
3		-	S 1
4		-	SENATE BILL 509
	3	+	S D
	4	+	SENATE BILL DRS15195-MGfa-82
	5	+
5	6
6	7
7	8		Short Title: Health Information Exchange Act Revisions. (Public)
8	9		Sponsors: Senators Hise, Burgin, and Adcock (Primary Sponsors).
9		-	Referred to: ~~Rules and Operations of the Senate~~
10		-	~~March 26, 2025~~
11		-	~~S509 -v-1~~
	10	+	Referred to:
	11	+
	12	+	DRS15195 -MGfa-82
12	13		A BILL TO BE ENTITLED 1
13	14		AN ACT REVISING THE STATEWIDE HEALTH INFORMATION EXCHANGE ACT; 2
14	15		AND AUTHORIZING THE IMPOSITION OF NEW CIVIL PENALTIES FOR 3
15	16		VIOLATIONS OF THE ACT AND A NEW STATE HEALTH DATA ASSESSMENT FEE. 4
16	17		The General Assembly of North Carolina enacts: 5
17	18		SECTION 1. Article 29B of Chapter 90 of the General Statutes reads as rewritten: 6
18	19		"Article 29B. 7
19	20		"Statewide Health Information Exchange Act. 8
20	21		"§ 90-414.1. Title. 9
21	22		This act Article shall be known and may be cited as the "Statewide Health Information 10
22	23		Exchange Act." 11
23	24		"§ 90-414.2. Purpose. 12
24	25		This Article is intended to improve the quality of health care delivery within this State by 13
25	26		facilitating and regulating the use of a voluntary, statewide health information exchange network 14
26	27		for the secure electronic transmission of individually identifiable health information among 15
27	28		health care providers, health plans, and health care clearinghouses clearinghouses, and the State 16
28	29		in a manner that is consistent with the Health Insurance Portability and Accountability Act, 17
29	30		Privacy Rule and Security Rule, 45 C.F.R. §§ 160, 164. 18
30	31		"§ 90-414.3. Definitions. 19
31	32		The following definitions apply in this Article: 20
32	33		(1) Annual compliance report. – The annual report required by G.S. 90-414.13. 21
33	34		(1a) Business associate. – As defined in 45 C.F.R. § 160.103. 22
34	35		(2) Business associate contract. – The documentation required by 45 C.F.R. § 23
35	36		164.502(e)(2) that meets the applicable requirements of 45 C.F.R. § 24
36	37		164.504(e). 25
37	38		(3) Covered entity. – Any entity described in 45 C.F.R. § 160.103 or any other 26
38	39		facility or practitioner licensed by the State to provide health care services. 27
39	40		(3a) Data transfer systems. – Electronic systems or platforms that (i) facilitate the 28
40	41		submission of any combination of clinical, demographic, or claims data to the 29
41	42		HIE Network and (ii) are maintained, controlled, directed, or licensed by, or 30
42	43		on behalf of, a covered entity or hybrid entity subject to this Article. Data 31
43	44		transfer systems may be comprised of health information technology or claims 32
44	45		processing technology, or both, including hardware, software, integrated 33
45	46		technologies and related licenses, or packaged solutions sold as services. Data 34
46	47		transfer systems include, but are not limited to, electronic systems or platforms 35
47		-	related to electronic health records, pharmacy benefits and claims, claims 36 General Assembly Of North Carolina Session 2025
48		-	Page 2 Senate Bill 509-First Edition
	48	+	related to electronic health records, pharmacy benefits and claims, claims 36
	49	+	FILED SENATE
	50	+	Mar 25, 2025
	51	+	S.B. 509
	52	+	PRINCIPAL CLERK General Assembly Of North Carolina Session 2025
	53	+	Page 2 DRS15195-MGfa-82
49	54		processing, or care management. Data transfer systems do not include any 1
50	55		information technology systems that are directly maintained, controlled, or 2
51	56		licensed by the State Health Plan for Teachers and State Employees. 3
52	57		(4) Department. – North Carolina Department of Health and Human Services. 4
53	58		(5) Disclose or disclosure. – The release, transfer, provision of access to, or 5
54	59		divulging in any other manner an individual's protected health information 6
55	60		through the HIE Network. 7
56	61		(6) Repealed by Session Laws 2017-57, s. 11A.5(f), effective July 1, 2017. 8
57	62		(7) GDAC. – The North Carolina Government Data Analytics Center. 9
58	63		(8) HIE Network. – The voluntary, statewide health information exchange 10
59	64		network network, which is a health data utility overseen and administered by 11
60	65		the Authority. 12
61	66		(9) HIPAA. – Sections 261 through 264 of the federal Health Insurance 13
62	67		Portability and Accountability Act of 1996, P.L. 104-191, as amended, and 14
63	68		any federal regulations adopted to implement these sections, as amended. 15
64	69		(10) Individual. – As defined in 45 C.F.R. § 160.103. 16
65	70		(11) North Carolina Health Information Exchange Advisory Board or Advisory 17
66	71		Board. – The Advisory Board established under G.S. 90-414.8. 18
67	72		(12) North Carolina Health Information Exchange Authority or Authority. – The 19
68	73		entity established pursuant to G.S. 90-414.7. 20
69	74		(13) Opt out. – An individual's affirmative decision communicated to the Authority 21
70	75		in writing to disallow his or her protected health information from being 22
71	76		disclosed by the Authority to covered entities or other persons or entities 23
72	77		through the HIE Network. 24
73	78		(13a) Organization National Provider Identifier or Organization NPI. – The HIPAA 25
74	79		Administrative Simplification Standard that utilizes a 10-position all-numeric 26
75	80		identification number assigned by the federal National Provider System to 27
76	81		uniquely identify a health care provider that is an entity other than an 28
77	82		individual human being that furnishes health care. 29
78	83		(14) Protected health information. – As defined in 45 C.F.R. § 160.103. 30
79	84		(15) Public health purposes. – The public health activities and purposes described 31
80	85		in 45 C.F.R. § 164.512(b). 32
81	86		(16) Qualified organization. – An entity with which the Authority has contracted 33
82	87		for the sole purpose of facilitating the exchange of data with or through the 34
83	88		HIE Network. 35
84	89		(17) Research purposes. – Research purposes referenced in and subject to the 36
85	90		standards described in 45 C.F.R. § 164.512(i). 37
86	91		(18) State CIO. – The State Chief Information Officer. 38
87	92		(19) State-funded health care. – Means all of the following: 39
88	93		a. The North Carolina Medicaid program. 40
89	94		b. The State Health Plan for Teachers and State Employees. 41
90	95		c. Health care facilities and health care programs administered or 42
91	96		operated by the Department of Health and Human Services, the 43
92	97		Department of Public Safety, or the Department of Adult Correction, 44
93	98		and their employees, agents, or grantees. 45
94	99		(20) State health care funds. – Monies paid to providers or entities for the provision 46
95	100		of health care services to recipients of State-funded health care. The term 47
96	101		includes both (i) direct payments from the State to providers and entities and 48
97	102		(ii) payments that providers and entities receive from third parties, or the 49
98	103		agents of third parties, that are retained by the State for the administration or 50 General Assembly Of North Carolina Session 2025
99		-	~~Senate Bill 509-First Edition~~ Page 3
	104	+	DRS15195-MGfa-82 Page 3
100	105		delivery, or both, of State-funded health care, including prepaid health plans 1
101	106		as defined in G.S. 108D-1 and claims processors as defined in G.S. 135-48.1. 2
102	107		"§ 90-414.4. Required participation in HIE Network for some providers. 3
103	108		(a) Findings. – The General Assembly makes the following findings: 4
104	109		(1) That controlling escalating health care costs of the Medicaid program and 5
105	110		other State-funded health care services is of significant importance to the 6
106	111		State, its taxpayers, its Medicaid recipients, and other recipients beneficiaries 7
107	112		of State-funded health care services.care. 8
108	113		(2) That the State and covered entities in North Carolina need timely access to 9
109	114		certain demographic and clinical information pertaining to services rendered 10
110	115		to Medicaid and other beneficiaries of State-funded health care program 11
111	116		beneficiaries and paid for with Medicaid or other State-funded State health 12
112	117		care funds in order to assess performance, improve health care outcomes, 13
113	118		pinpoint medical expense trends, identify beneficiary health risks, and 14
114	119		evaluate how the State is spending money on Medicaid and other State-funded 15
115	120		health care services. The care. To that end, the Department of Information 16
116	121		Technology, the Department of State Treasurer, State Health Plan Division, 17
117	122		and the Department of Health and Human Services, Division of Health 18
118	123		Benefits, have an affirmative duty to facilitate and support participation by 19
119	124		covered entities in the statewide health information exchange network. 20
120	125		(3) That making demographic and clinical information available to the State and 21
121	126		covered entities in North Carolina by secure electronic means as set forth in 22
122	127		subsection (b) of this section will improve care coordination within and across 23
123	128		health systems, increase care quality for such beneficiaries, beneficiaries of 24
124	129		State-funded health care, enable more effective population health 25
125	130		management, reduce duplication of medical services, augment syndromic 26
126	131		surveillance, allow more accurate measurement of care services and 27
127	132		outcomes, increase strategic knowledge about the health of the population, 28
128	133		and facilitate health care cost containment. 29
129	134		(a1) Mandatory Connection to HIE Network. – Notwithstanding the voluntary nature of 30
130	135		the HIE Network under G.S. 90-414.2, the following providers and entities shall be connected to 31
131	136		the HIE Network and begin submitting data through the HIE Network pertaining to services 32
132	137		rendered to Medicaid beneficiaries and to other of State-funded health care program beneficiaries 33
133	138		and paid for with Medicaid or other State-funded State health care funds in accordance with the 34
134	139		following time line: 35
135	140		(1) The following providers of Medicaid services licensed to operate in the State 36
136	141		that have an electronic health record system shall begin submitting, at a 37
137	142		minimum, demographic and clinical data by June 1, 2018: 38
138	143		a. Hospitals as defined in G.S. 131E-176(13). 39
139	144		b. Physicians licensed to practice under Article 1 of Chapter 90 of the 40
140	145		General Statutes, this Chapter, except for licensed physicians whose 41
141	146		primary area of practice is psychiatry. 42
142	147		c. Physician assistants as defined in 21 NCAC 32S.0201. 43
143	148		d. Nurse practitioners as defined in 21 NCAC 36.0801. 44
144	149		(2) Except as provided in subdivisions (3), (4), and (5) of this subsection, all other 45
145	150		providers of Medicaid and State-funded health care services and their 46
146	151		affiliated entities shall begin submitting demographic and clinical data by 47
147	152		January 1, 2023. 48
148	153		(3) The following entities shall submit encounter and claims data, as appropriate, 49
149	154		in accordance with the following time line: 50 General Assembly Of North Carolina Session 2025
150		-	Page 4 ~~Senate Bill 509-First Edition~~
	155	+	Page 4 DRS15195-MGfa-82
151	156		a. Prepaid Health Plans, as defined in G.S. 108D-1, by the 1
152	157		commencement date of a capitated contract with the Division of 2
153	158		Health Benefits for the delivery of Medicaid services as specified in 3
154	159		Article 4 of Chapter 108D of the General Statutes. 4
155	160		b. Local management entities/managed care organizations, as defined in 5
156	161		G.S. 122C-3, by June 1, 2020. 6
157	162		If authorized by the Authority in accordance with this Article, the Department 7
158	163		of Health and Human Services may submit the data required by this subsection 8
159	164		on behalf of the entities specified in this subdivision. 9
160	165		(4) The following entities shall begin submitting demographic and clinical data 10
161	166		by January 1, 2023: 11
162	167		a. Physicians who perform procedures at ambulatory surgical centers as 12
163	168		defined in G.S. 131E-146. 13
164	169		b. Dentists licensed under Article 2 of Chapter 90 of the General Statutes. 14
165	170		c. Licensed physicians whose primary area of practice is psychiatry. 15
166	171		d. The State Laboratory of Public Health operated by the Department of 16
167	172		Health and Human Services. 17
168	173		(5) The following entities shall begin submitting claims data by January 1, 2023: 18
169	174		a. Pharmacies registered with the North Carolina Board of Pharmacy 19
170	175		under Article 4A of Chapter 90 of the General Statutes.this Chapter. 20
171	176		b. State health care facilities operated under the jurisdiction of the 21
172	177		Secretary of the Department of Health and Human Services, including 22
173	178		State psychiatric hospitals, developmental centers, alcohol and drug 23
174	179		treatment centers, neuro-medical treatment centers, and residential 24
175	180		programs for children such as the Wright School and the Whitaker 25
176	181		Psychiatric Residential Treatment Facility. 26
177	182		c. Dentists licensed under Article 2 of this Chapter. 27
178	183		(a2) Extensions of Time for Establishing Connection to the HIE Network. – The 28
179	184		Department of Information Technology, in consultation with the Department of Health and 29
180	185		Human Services and the State Health Plan for Teachers and State Employees, may establish a 30
181	186		process to grant limited extensions of the time for providers and entities to connect to the HIE 31
182	187		Network and begin submitting data as required by this section upon the request of a provider or 32
183	188		entity that demonstrates an ongoing good-faith effort to take necessary steps to establish such 33
184	189		connection and begin data submission as required by this section. The process for granting an 34
185	190		extension of time must include a presentation by the provider or entity to the Department of 35
186	191		Information Technology, the Department of Health and Human Services, and the State Health 36
187	192		Plan for Teachers and State Employees on the expected time line for connecting to the HIE 37
188	193		Network and commencing data submission as required by this section. Neither the Department 38
189	194		of Information Technology, the Department of Health and Human Services, nor the State Health 39
190	195		Plan for Teachers and State Employees shall grant an extension of time (i) to any provider or 40
191	196		entity that fails to provide this information to both Departments, and the State Health Plan for 41
192	197		Teachers and State Employees, (ii) that would result in the provider or entity connecting to the 42
193	198		HIE Network and commencing data submission as required by this section later than January 1, 43
194	199		2023. The Department of Information Technology shall consult with the Department of Health 44
195	200		and Human Services and the State Health Plan for Teachers and State Employees to review and 45
196	201		decide upon a request for an extension of time under this section within 30 days after receiving 46
197	202		a request for an extension. 47
198	203		(a3) Exemptions from Connecting to the HIE Network. – The Secretary of Health and 48
199	204		Human Services, or the Secretary's designee, shall have the authority to grant exemptions to 49
200	205		classes of providers of Medicaid and other State-funded health care services for whom acquiring 50
201	206		and implementing an electronic health record system and connecting to the HIE Network as 51 General Assembly Of North Carolina Session 2025
202		-	~~Senate Bill 509-First Edition~~ Page 5
	207	+	DRS15195-MGfa-82 Page 5
203	208		required by this section would constitute an undue hardship. The Secretary, or the Secretary's 1
204	209		designee, shall promptly notify the Department of Information Technology of classes of 2
205	210		providers granted hardship exemptions under this subsection. Neither the Secretary nor the 3
206	211		Secretary's designee shall grant any hardship exemption that would result in any class of provider 4
207	212		connecting to the HIE Network and submitting data later than December 31, 2022. 5
208	213		(a4) Connected Status. – A provider or entity identified in subsection (a1) of this section 6
209	214		is deemed connected to the HIE Network when the covered entity that provides, maintains, 7
210	215		controls, directs, or licenses that provider's or entity's data transfer system has done all of the 8
211	216		following: 9
212	217		(1) Established an operable technical connection with the HIE Network approved 10
213	218		by the Authority that supports the submission of required patient data 11
214	219		generated by the provider or entity. 12
215	220		(2) Provided its Organization NPI to the Authority. 13
216	221		(3) Executed with the Authority a valid, written participation agreement pursuant 14
217	222		to subdivision (b)(6) of G.S. 90-414.7. 15
218	223		(4) Communicated to the Authority, in writing, the identity of all providers and 16
219	224		entities on whose behalf it maintains a data transfer system. 17
220	225		(5) Either has met or is making reasonable efforts to meet data quality standards 18
221	226		established by the Authority that are published on its website. 19
222	227		(b) Mandatory Submission of Demographic and Clinical Data. – Notwithstanding the 20
223	228		voluntary nature of the HIE Network under G.S. 90-414.2 and, except as otherwise provided in 21
224	229		subsection subsections (c) and (c1) of this section, as a condition of receiving State funds, 22
225	230		including Medicaid funds, the following entities shall submit at least twice daily, through the 23
226	231		HIE network, demographic and clinical information pertaining to services rendered to Medicaid 24
227	232		and other beneficiaries of State-funded health care program beneficiaries and paid for with 25
228	233		Medicaid or other State-funded State health care funds, solely for the purposes set forth in 26
229	234		subsection (a) of this section: 27
230	235		(1) Each hospital, as defined in G.S. 131E-176(13) that has an electronic health 28
231	236		record system. 29
232	237		(2) Each Medicaid provider, unless the provider is an ambulatory surgical center 30
233	238		as defined in G.S. 131E-146; however, a physician who performs a procedure 31
234	239		at the ambulatory surgical center must be connected to the HIE Network. 32
235	240		(3) Each provider that receives State health care funds for the provision of health 33
236	241		services, State-funded health care, unless the provider is an ambulatory 34
237	242		surgical center as defined in G.S. 131E-146; however, a physician who 35
238	243		performs a procedure at the ambulatory surgical center must be connected to 36
239	244		the HIE Network. 37
240	245		(4) Each prepaid health plan, as defined in G.S. 58-93-5, that is under a capitated 38
241	246		contract with the Department for the delivery of Medicaid services, or a local 39
242	247		management entity/managed care organization, as defined in 40
243	248		G.S. 122C-3.G.S. 122C-3, that is under a capitated prepaid health plan 41
244	249		contract with the Department. 42
245	250		(b1) Balance Billing Prohibition. – An in-network provider or entity who that (i) renders 43
246	251		health care services, including prescription drugs and durable medical equipment, under a 44
247	252		contract with the State Health Plan for Teachers and State Employees and who (ii) is not 45
248	253		connected to the HIE Network in accordance with this Article, is prohibited from billing the State 46
249	254		Health Plan or a Plan member more than either party would be billed if the entity or provider was 47
250	255		connected to the HIE Network. Balance billing because the provider or entity did not connect to 48
251	256		the HIE Network is prohibited. 49
252	257		(c) Exemption for Certain Records. – Providers with patient records that are subject to 50
253	258		the disclosure restrictions of 42 C.F.R. § 2 are exempt from the requirements of subsection (b) 51 General Assembly Of North Carolina Session 2025
254		-	Page 6 ~~Senate Bill 509-First Edition~~
	259	+	Page 6 DRS15195-MGfa-82
255	260		of this section but only with respect to the patient records subject to these disclosure restrictions. 1
256	261		Providers shall comply with the requirements of subsection (b) of this section with respect to all 2
257	262		other patient records. A pharmacy shall only be Pharmacies registered with the North Carolina 3
258	263		Board of Pharmacy under Article 4A of this Chapter and dentists licensed under Article 2 of this 4
259	264		Chapter are only required to submit claims data pertaining to services rendered to Medicaid and 5
260	265		other State-funded health care program beneficiaries of State-funded health care and paid for 6
261	266		with Medicaid or other State-funded State health care funds. 7
262	267		(c1) Exemption from Twice Daily Submission. – A pharmacy shall only be The following 8
263	268		entities are required to submit claims data only once daily through the HIE Network Network: 9
264	269		(1) Pharmacies registered with the North Carolina Board of Pharmacy under 10
265	270		Article 4A of this Chapter, using pharmacy industry standardized formats. 11
266	271		(2) Dentists licensed under Article 2 of this Chapter. 12
267	272		(c2) 42 C.F.R. § 2 Records. – Notwithstanding subsection (b) of this section, patient 13
268	273		records protected by 42 C.F.R. § 2 shall be disclosed through the HIE Network only if the 14
269	274		Authority has provided written notice to the participating entity that data protected by 42 C.F.R. 15
270	275		§ 2 can be disclosed for a specific purpose. 16
271	276		(d) Method of Data Submissions. – The Any provider or entity required to submit data 17
272	277		submissions required under this section shall be make the submission by connection to the HIE 18
273	278		Network periodic asynchronous secure structured file transfer or any other secure electronic 19
274	279		means commonly used in the industry and consistent with document exchange and data 20
275	280		submission standards established by the Office Assistant Secretary for Technology Policy/Office 21
276	281		of the National Coordinator for Information Technology within the U.S. Department of Health 22
277	282		and Human Services. 23
278	283		(e) Voluntary Connection for Certain Providers. – Notwithstanding the mandatory 24
279	284		connection and data submission requirements in of subsections (a1) and (b) of this section, the 25
280	285		following providers of Medicaid services or other State-funded health care services are not 26
281	286		required to connect to the HIE Network or submit data but may connect to the HIE Network and 27
282	287		submit data voluntarily: 28
283	288		(1) Community-based long-term services and supports providers, including 29
284	289		personal care services, private duty nursing, home health, and hospice care 30
285	290		providers. 31
286	291		(2) Intellectual and developmental disability services and supports providers, 32
287	292		such as day supports and supported living providers. 33
288	293		(3) Community Alternatives Program waiver services (including CAP/DA, 34
289	294		CAP/C, and Innovations) providers. 35
290	295		(4) Eye and vision services providers. 36
291	296		(5) Speech, language, and hearing services providers. 37
292	297		(6) Occupational and physical therapy providers. 38
293	298		(7) Durable medical equipment providers. 39
294	299		(8) Nonemergency medical transportation service providers. 40
295	300		(9) Ambulance (emergency medical transportation service) providers. 41
296	301		(10) Local education agencies and agencies, school-based health 42
297	302		providers.providers, and student health centers that primarily serve students 43
298	303		matriculating at public or private institutions of higher education in this State. 44
299	304		(11) Chiropractors licensed under Article 8 of this Chapter. 45
300	305		(12) Dentists licensed under Article 2 of this Chapter. 46
301	306		Connection to the HIE Network by any other covered entities that are not required by 47
302	307		subsections (a1) and (b) of this section to connect to the HIE Network or submit data is voluntary. 48
303	308		(e1) Mandatory and Voluntary Connection and Submissions by the Same Covered Entity. 49
304	309		– A covered entity that provides, maintains, controls, directs, or licenses a data transfer system 50
305	310		on behalf of providers and entities that are required to connect to, and submit data through, the 51 General Assembly Of North Carolina Session 2025
306		-	~~Senate Bill 509-First Edition~~ Page 7
	311	+	DRS15195-MGfa-82 Page 7
307	312		HIE Network under this Article, as well as on behalf of providers and entities that voluntarily 1
308	313		connect to, and submit data through, the HIE Network may elect not to submit through the HIE 2
309	314		Network clinical, demographic, or claims data generated by the providers and entities that 3
310	315		voluntarily connect to, and submit data through, the HIE Network. However, the covered entity 4
311	316		is required to submit through the HIE Network clinical, demographic, or claims data generated 5
312	317		by providers and entities that are required to connect to, and submit data through, the HIE 6
313	318		Network. 7
314	319		(f) Confidentiality of Data. – All data submitted to or through the HIE Network 8
315	320		containing protected health information, personally identifying information, or a combination of 9
316	321		these, that are in the possession of the Department of Information Technology or any other 10
317	322		agency of the State are confidential and shall not be defined as public records under G.S. 132-1. 11
318	323		This subsection shall not be construed to prohibit the disclosure of any such data as otherwise 12
319	324		permitted under federal law. 13
320	325		(g) Time-Limited Exceptions for Connecting to, and Submitting Data Through, the HIE 14
321	326		Network. – All of the following apply to any exception granted by the Authority for connecting 15
322	327		to, and submitting data through, the HIE Network: 16
323	328		(1) A covered entity that provides, maintains, controls, directs, or licenses a data 17
324	329		transfer system on behalf of providers or entities identified in subsection (a1) 18
325	330		of this section may seek to obtain from the Authority a time-limited exception 19
326	331		for those providers or entities to connect to, and begin submitting required 20
327	332		data through, the HIE Network. 21
328	333		(2) The Authority shall administer the process by which a covered entity seeks a 22
329	334		time-limited exception for providers or entities to connect to, and begin 23
330	335		submitting required data through, the HIE Network. The Authority shall make 24
331	336		the final determination about whether to grant or deny requests for a 25
332	337		time-limited exception. Any exception authorized by the Authority may not 26
333	338		exceed a one-year period. However, a covered entity may seek to renew an 27
334	339		exception. 28
335	340		(3) In order for a covered entity to obtain a time-limited exception for the 29
336	341		providers and entities on whose behalf it provides, maintains, controls, directs, 30
337	342		or licenses a data transfer system, the covered entity must demonstrate 31
338	343		eligibility for the exception by meeting at least one of the following criteria: 32
339	344		a. During the previous year, the covered entity and the providers and 33
340	345		entities on whose behalf it maintained, controlled, directed, or licensed 34
341	346		a data transfer system received in the aggregate less than one million 35
342	347		dollars ($1,000,000) in State health care funds for providing health 36
343	348		care services to beneficiaries of State-funded health care. 37
344	349		b. The covered entity and the providers and entities on whose behalf it 38
345	350		provides, maintains, controls, directs, or licenses a data transfer system 39
346	351		operated in whole or in part in a geographic area with limited or 40
347	352		emergent broadband availability. The Department of Information 41
348	353		Technology, Division of Broadband, shall identify these geographic 42
349	354		areas and the Authority shall publish a list of the identified geographic 43
350	355		areas to its website. Alternatively, the Authority, after consultation 44
351	356		with the Department of Information Technology, Division of 45
352	357		Broadband, may, in its discretion, grant a time-limited exception after 46
353	358		evaluating materials provided by a covered entity regarding its level 47
354	359		of broadband connectivity. 48
355	360		c. The covered entity will close, dissolve, or be acquired by another 49
356	361		entity within the next 12 months. 50 General Assembly Of North Carolina Session 2025
357		-	Page 8 ~~Senate Bill 509-First Edition~~
	362	+	Page 8 DRS15195-MGfa-82
358	363		d. The provider or entity has not yet implemented or is in the process of 1
359	364		implementing a data transfer system. 2
360	365		(4) To request a time-limited exception under this subsection, the covered entity 3
361	366		shall submit to the Authority an application and attestation form, which shall 4
362	367		both be created by the Authority and made available on its website, containing 5
363	368		at least all of the following information: 6
364	369		a. Date of request and application period. 7
365	370		b. Name, Organization NPI, and location. 8
366	371		c. Names of providers and entities on whose behalf the covered entity is 9
367	372		applying, as well as their respective Organization NPIs. 10
368	373		d. Technical information regarding its data transfer system and vendor, 11
369	374		if applicable. 12
370	375		e. Provider network information for the State Health Plan for Teachers 13
371	376		and State Employees and the North Carolina Medicaid program, as 14
372	377		applicable. 15
373	378		f. Identification of the bases criterion, or criteria, in subdivision (g)(3) of 16
374	379		this section for which the covered entity seeks a time-limited 17
375	380		exception. 18
376	381		g. Supporting documents and materials determined by the Authority to 19
377	382		be necessary to substantiate the covered entity's eligibility for the 20
378	383		exception. 21
379	384		h. An attestation executed by an authorized representative of the covered 22
380	385		entity regarding the validity, truth, and completeness of the application 23
381	386		and attestation form submitted by the covered entity to the Authority. 24
382	387		"§ 90-414.5. State agency and legislative access to HIE Network data. 25
383	388		(a) The Authority shall provide the Department and the State Health Plan for Teachers 26
384	389		and State Employees secure, real-time access to data and information disclosed through the HIE 27
385	390		Network, solely for the purposes set forth in G.S. 90-414.4(a) and in G.S. 90-414.2. The 28
386	391		Authority shall limit access granted to the State Health Plan for Teachers and State Employees 29
387	392		pursuant to this section to data and information disclosed through the HIE Network that pertains 30
388	393		to services (i) rendered to teachers and State employees and (ii) paid for by the State Health Plan. 31
389	394		(b) At the written request of the Director of the Fiscal Research, Legislative Drafting, or 32
390	395		Legislative Analysis Division of the General Assembly for an aggregate analysis of the data and 33
391	396		information disclosed through the HIE Network, the Authority shall provide the professional 34
392	397		staff of these Divisions with the aggregated analysis responsive to the Director's request. Prior to 35
393	398		providing the Director or General Assembly's staff with any aggregate data or information 36
394	399		submitted through the HIE Network or with any analysis of this aggregate data or information, 37
395	400		the Authority shall redact any personal identifying information in a manner consistent with the 38
396	401		standards specified for de-identification of health information under the HIPAA Privacy Rule, 39
397	402		45 C.F.R. § 164.514, as amended. 40
398	403		"§ 90-414.6. State ownership of HIE Network data. 41
399	404		Any data pertaining to services rendered to Medicaid and other beneficiaries of State-funded 42
400	405		health care program beneficiaries that is submitted through and stored by the HIE Network 43
401	406		pursuant to G.S. 90-414.4 or any other provision of this Article shall be and will remain the sole 44
402	407		property of the State. Any data or product derived from the aggregated, de-identified data 45
403	408		submitted to and stored by the HIE Network pursuant to G.S. 90-414.4 or any other provision of 46
404	409		this Article, shall be and will remain the sole property of the State. The Authority shall not allow 47
405	410		data it receives pursuant to G.S. 90-414.4 or any other provision of this Article to be used or 48
406	411		disclosed by or to any person or entity for commercial purposes or for any other purpose other 49
407	412		than those set forth in G.S. 90-414.4(a) or G.S. 90-414.2. To the extent the Authority receives 50
408	413		requests for electronic health information as the term is defined in 45 C.F.R. § 171.102, or other 51 General Assembly Of North Carolina Session 2025
409		-	~~Senate Bill 509-First Edition~~ Page 9
	414	+	DRS15195-MGfa-82 Page 9
410	415		medical records from an individual, an individual's personal representative, or an individual or 1
411	416		entity purporting to act on an individual's behalf, the Authority (i) shall not fulfill the request and 2
412	417		(ii) shall make available to the requester and the public, via the Authority's website, educational 3
413	418		materials about how to access such information from other sources. If the Authority participates 4
414	419		in the Trusted Exchange Framework and Common Agreement, then it may provide individual 5
415	420		access services through the Trusted Exchange Framework and Common Agreement. Patient 6
416	421		identifiers created and utilized by the Authority to integrate identity data in the HIE Network, 7
417	422		along with the minimum necessary required demographic information related to those patients, 8
418	423		shall be released to the GDAC and the Department by the Authority for purposes of entity 9
419	424		resolution and master data management. These identifiers shall not be considered public records 10
420	425		pursuant to Chapter 132 of the General Statutes. 11
421	426		"§ 90-414.7. North Carolina Health Information Exchange Authority. 12
422	427		(a) Creation. – There is hereby established the North Carolina Health Information 13
423	428		Exchange Authority to oversee and administer the HIE Network in accordance with this Article. 14
424	429		The Authority shall be located within the Department of Information Technology and shall be 15
425	430		under the supervision, direction, and control of the State CIO. The State CIO shall employ an 16
426	431		Authority Director and may delegate to the Authority Director all powers and duties associated 17
427	432		with the daily operation of the Authority, its staff, and the performance of the powers and duties 18
428	433		set forth in subsection (b) of this section. In making this delegation, however, the State CIO 19
429	434		maintains the responsibility for the performance of these powers and duties. 20
430	435		(b) Powers and Duties. – The Authority has the following powers and duties: 21
431	436		(1) Oversee and administer the HIE Network in a manner that ensures all of the 22
432	437		following: 23
433	438		a. Compliance with this Article. 24
434	439		b. Compliance with HIPAA and any rules adopted under HIPAA, 25
435	440		including the Privacy Rule and Security Rule. 26
436	441		c. Compliance with the terms of any participation agreement, business 27
437	442		associate agreement, or other agreement the Authority or qualified 28
438	443		organization or other person or entity enters into with a covered entity 29
439	444		participating in submission of data through or accessing the HIE 30
440	445		Network. 31
441	446		d. Notice to the patient by the healthcare provider or other person or 32
442	447		entity about the HIE Network, including information and education 33
443	448		about the right of individuals on a continuing basis to opt out or rescind 34
444	449		a decision to opt out. 35
445	450		e. Opportunity for all individuals whose data has been submitted to the 36
446	451		HIE Network to exercise on a continuing basis the right to opt out or 37
447	452		rescind a decision to opt out. 38
448	453		f. Nondiscriminatory treatment by covered entities of individuals who 39
449	454		exercise the right to opt out. 40
450	455		g. Facilitation of HIE Network interoperability with electronic health 41
451	456		record systems of all covered entities listed in G.S. 90-414.4(b). 42
452	457		h. Minimization of the amount of data required to be submitted under 43
453	458		G.S. 90-414.4(b) and any use or disclosure of such data to what is 44
454	459		determined by the Authority to be required in order to advance the 45
455	460		purposes set forth in G.S. 90-414.2 and G.S. 90-414.4(a). 46
456	461		(2) In consultation with the Advisory Board, set guiding principles for the 47
457	462		development, implementation, and operation of the HIE Network. 48
458	463		(3) Employ staff necessary to carry out the provisions of this Article and 49
459	464		determine the compensation, duties, and other terms and conditions of 50
460	465		employment of hired staff. 51 General Assembly Of North Carolina Session 2025
461		-	Page 10 ~~Senate Bill 509-First Edition~~
	466	+	Page 10 DRS15195-MGfa-82
462	467		(4) Enter into contracts pertaining to the oversight and administration of the HIE 1
463	468		Network, including contracts of a consulting or advisory nature. 2
464	469		G.S. 143-64.20 does not apply to this subdivision. 3
465	470		(5) Establish fees for participation in the HIE Network and report the established 4
466	471		fees to the General Assembly, with an explanation of the fee determination 5
467	472		process. 6
468	473		(6) Following consultation with the Advisory Board, develop, approve, and enter 7
469	474		into, directly or through qualified organizations acting under the authority of 8
470	475		the Authority, written participation agreements with persons or entities that 9
471	476		participate in or are granted access or user rights to the HIE Network. The 10
472	477		participation agreements shall set forth terms and conditions governing 11
473	478		participation in, access to, or use of the HIE Network not less than those set 12
474	479		forth in agreements already governing covered entities' participation in the 13
475	480		federal eHealth Exchange. The agreement shall also require compliance with 14
476	481		policies developed by the Authority pursuant to this Article or pursuant to 15
477	482		applicable laws of the state of residence for entities located outside of North 16
478	483		Carolina. 17
479	484		(7) Receive, access, add, and remove data submitted through and stored by the 18
480	485		HIE Network in accordance with this Article. 19
481	486		(8) Following consultation with the Advisory Board, enter into, directly or 20
482	487		through qualified organizations acting under the authority of the Authority, a 21
483	488		HIPAA compliant business associate agreement with each of the persons or 22
484	489		entities participating in or granted access or user rights to the HIE 23
485	490		Network.Network, except for federal agencies that access the HIE Network 24
486	491		solely to review patient data for treatment purposes and exchanges made 25
487	492		through eHealth Exchange or the Trusted Exchange Framework and Common 26
488	493		Agreement so long as the Authority enters into the agreements that are 27
489	494		required to participate in each of these respective national networks. 28
490	495		(9) Following consultation with the Advisory Board, grant user rights to the HIE 29
491	496		Network to business associates of covered entities participating in the HIE 30
492	497		Network (i) at the request of the covered entities and (ii) at the discretion of 31
493	498		and subject to contractual, policy, and other requirements of the Authority 32
494	499		upon consideration of and consistent with the business associates' legitimate 33
495	500		need for utilizing the HIE Network and privacy and security concerns. 34
496	501		(10) Facilitate and promote use of the HIE Network by covered entities.entities and 35
497	502		business associates acting on their behalf. 36
498	503		(11) Actively monitor compliance with this Article by the Department, covered 37
499	504		entities, and any other persons or entities participating in or granted access or 38
500	505		user rights to the HIE Network or any data submitted through or stored by the 39
501	506		HIE Network. 40
502	507		(12) Collaborate with the State CIO to ensure that resources available through the 41
503	508		GDAC are properly leveraged, assigned, or deployed to support the work of 42
504	509		the Authority. The duty to collaborate under this subdivision includes 43
505	510		collaboration on data hosting and development, implementation, operation, 44
506	511		and maintenance of the HIE Network. 45
507	512		(13) Initiate or direct expansion of existing public-private partnerships within the 46
508	513		GDAC as necessary to meet the requirements, duties, and obligations of the 47
509	514		Authority. Notwithstanding any other provision of law and subject to the 48
510	515		availability of funds, the State CIO, at the request of the Authority, shall assist 49
511	516		and facilitate expansion of existing contracts related to the HIE Network, 50 General Assembly Of North Carolina Session 2025
512		-	~~Senate Bill 509-First Edition~~ Page 11
	517	+	DRS15195-MGfa-82 Page 11
513	518		provided that such request is made in writing by the Authority to the State 1
514	519		CIO with reference to specific requirements set forth in this Article. 2
515	520		(14) In consultation with the Advisory Board, develop a strategic plan for 3
516	521		achieving statewide participation in the HIE Network by all hospitals and 4
517	522		health care providers licensed in this State. 5
518	523		(15) In consultation with the Advisory Board, define the following with respect to 6
519	524		operation of the HIE Network: 7
520	525		a. Business policy. 8
521	526		b. Protocols for data integrity, data sharing, data security, HIPAA 9
522	527		compliance, and business intelligence as defined in G.S. 143B-1381. 10
523	528		To the extent permitted by HIPAA, protocols for data sharing shall 11
524	529		allow for the disclosure of data for academic research. 12
525	530		c. Qualitative and quantitative performance measures. 13
526	531		d. An operational budget and assumptions. 14
527	532		(16) Annually report to the Joint Legislative Oversight Committee on Health and 15
528	533		Human Services and the Joint Legislative Oversight Committee on 16
529	534		Information Technology on the following: 17
530	535		a. The operation of the HIE Network. 18
531	536		b. Any efforts or progress in expanding participation in the HIE Network. 19
532	537		c. Health care trends based on information disclosed through the HIE 20
533	538		Network. 21
534	539		(17) Ensure that the HIE Network interfaces with the federal level HIE, the eHealth 22
535	540		Exchange. 23
536	541		(18) Enforce the provisions of this Article. 24
537	542		(19) Provide data related services, as allowed by G.S. 90-414.16. 25
538	543		(20) Adopt rules as needed to implement the appeal process established by 26
539	544		G.S. 90-414.15. 27
540	545		"§ 90-414.8. North Carolina Health Information Exchange Advisory Board. 28
541	546		(a) Creation and Membership. – There is hereby established the North Carolina Health 29
542	547		Information Exchange Advisory Board within the Department of Information Technology. The 30
543	548		Advisory Board shall consist of the following 12 13 members: 31
544	549		(1) The following four members appointed by the President Pro Tempore of the 32
545	550		Senate: 33
546	551		a. A licensed physician in good standing and actively practicing in this 34
547	552		State. 35
548	553		b. A patient representative. 36
549	554		c. An individual with technical expertise in health data analytics. 37
550	555		d. A representative of a behavioral health provider. 38
551	556		(2) The following four members appointed by the Speaker of the House of 39
552	557		Representatives: 40
553	558		a. A representative of a critical access hospital. 41
554	559		b. A representative of a federally qualified health center. 42
555	560		c. An individual with technical expertise in health information 43
556	561		technology. 44
557	562		d. A representative of a health system or integrated delivery network. 45
558	563		(3) The following three ex officio, nonvoting members: 46
559	564		a. The State Chief Information Officer or a designee. 47
560	565		b. The Director of GDAC or a designee. 48
561	566		c. The Secretary of Health and Human Services, or a designee. 49
562	567		(4) The following ex officio, voting member:members: 50 General Assembly Of North Carolina Session 2025
563		-	Page 12 ~~Senate Bill 509-First Edition~~
	568	+	Page 12 DRS15195-MGfa-82
564	569		a. The Executive Administrator of the State Health Plan for Teachers and 1
565	570		State Employees, or a designee. 2
566	571		b. The Deputy Secretary for the State's Medicaid program, or a designee. 3
567	572		(b) Chairperson. – A chairperson shall be elected from among the members. The 4
568	573		chairperson shall organize and direct the work of the Advisory Board. 5
569	574		(c) Administrative Support. – The Department of Information Technology shall provide 6
570	575		necessary clerical and administrative support to the Advisory Board. 7
571	576		(d) Meetings. – The Advisory Board shall meet at least quarterly and at the call of the 8
572	577		chairperson. A majority of the Advisory Board constitutes a quorum for the transaction of 9
573	578		business. 10
574	579		(e) Terms. – In order to stagger terms, in making initial appointments, the President Pro 11
575	580		Tempore of the Senate shall designate two of the members appointed under subdivision (1) of 12
576	581		subsection (a) of this section to serve for a one-year period from the date of appointment and, the 13
577	582		Speaker of the House of Representatives shall designate two members appointed under 14
578	583		subdivision (2) of subsection (a) of this section to serve for a one-year period from the date of 15
579	584		appointment. The remaining appointed voting members shall serve two-year periods. Future 16
580	585		appointees who are voting members shall serve terms of two years, with staggered terms based 17
581	586		on this subsection. Appointed voting members may serve up to two consecutive terms, not 18
582	587		including the abbreviated two-year terms that establish staggered terms or terms of less than two 19
583	588		years that result from the filling of a vacancy. Ex officio, nonvoting and voting members are not 20
584	589		subject to these term limits. A vacancy other than by expiration of a term shall be filled by the 21
585	590		appointing authority. 22
586	591		(f) Expenses. – Members of the Advisory Board who are State officers or employees 23
587	592		shall receive no compensation for serving on the Advisory Board but may be reimbursed for their 24
588	593		expenses in accordance with G.S. 138-6. Members of the Advisory Board who are full-time 25
589	594		salaried public officers or employees other than State officers or employees shall receive no 26
590	595		compensation for serving on the Advisory Board but may be reimbursed for their expenses in 27
591	596		accordance with G.S. 138-5(b). All other members of the Advisory Board may receive 28
592	597		compensation and reimbursement for expenses in accordance with G.S. 138-5. 29
593	598		(g) Duties. – The Advisory Board shall provide consultation to the Authority with respect 30
594	599		to the advancement, administration, and operation of the HIE Network and on matters pertaining 31
595	600		to health information technology and exchange, generally. In carrying out its responsibilities, the 32
596	601		Advisory Board may form committees of the Advisory Board to examine particular issues related 33
597	602		to the advancement, administration, or operation of the HIE Network. 34
598	603		"§ 90-414.9. Participation by covered entities. 35
599	604		(a) Each Except for federal agencies that access the HIE Network solely to review patient 36
600	605		data for treatment purposes, all covered entity that participates entities that participate in the HIE 37
601	606		Network shall enter into a HIPAA compliant business associate agreement described in 38
602	607		G.S. 90-414.7(b)(8) and a written participation agreement described in G.S. 90-414.7(b)(6) with 39
603	608		the Authority or qualified organization prior to submitting data through or in the HIE Network. 40
604	609		Notwithstanding this subsection, the Authority may exchange data in the HIE Network through 41
605	610		the national eHealth Exchange and the Trusted Exchange Framework and Common Agreement 42
606	611		so long as the Authority enters into the agreements that are necessary to participate in each of 43
607	612		these national networks. 44
608	613		(b) Each covered entity that participates in the HIE Network may authorize its business 45
609	614		associates on behalf of the covered entity to submit data through, or access data stored in, the 46
610	615		HIE Network in accordance with this Article and at the discretion of the Authority, as provided 47
611	616		in G.S. 90-414.7(b)(8). 48
612	617		(c) Notwithstanding any federal or State law or regulation to the contrary, each covered 49
613	618		entity that participates in the HIE Network may disclose an individual's protected health 50 General Assembly Of North Carolina Session 2025
614		-	~~Senate Bill 509-First Edition~~ Page 13
	619	+	DRS15195-MGfa-82 Page 13
615	620		information through the HIE Network to other covered entities for any purpose permitted by 1
616	621		HIPAA. 2
617	622		"§ 90-414.10. Continuing right to opt out; effect of opt out. 3
618	623		(a) Each individual has the right on a continuing basis to opt out or rescind a decision to 4
619	624		opt out. 5
620	625		(b) The Authority or its designee shall enforce an individual's decision to opt out or 6
621	626		rescind an opt out prospectively from the date the Authority or its designee receives written notice 7
622	627		of the individual's decision to opt out or rescind an opt out in the manner prescribed by the 8
623	628		Authority. An individual's decision to opt out or rescind an opt out does not affect any disclosures 9
624	629		made by the Authority or covered entities through the HIE Network prior to receipt by the 10
625	630		Authority or its designee of the individual's written notice to opt out or rescind an opt out. 11
626	631		(c) A covered entity shall not deny treatment, coverage, or benefits to an individual 12
627	632		because of the individual's decision to opt out. However, nothing in this Article is intended to 13
628	633		restrict a health care provider from otherwise appropriately terminating a relationship with an 14
629	634		individual in accordance with applicable law and professional ethical standards. 15
630	635		(d) Except as otherwise permitted in G.S. 90-414.11(a)(3), or as required by law, the 16
631	636		protected health information of an individual who has exercised the right to opt out may not be 17
632	637		made accessible or disclosed to covered entities or any other person or entity through the HIE 18
633	638		Network for any purpose. 19
634	639		(e) Repealed by Session Laws 2017-57, s. 11A.5(e), effective July 1, 2017. 20
635	640		"§ 90-414.11. Construction and applicability. 21
636	641		(a) Nothing in this Article shall be construed to do any of the following: 22
637	642		(1) Impair any rights conferred upon an individual under HIPAA, including all of 23
638	643		the following rights related to an individual's protected health information: 24
639	644		a. The right to receive a notice of privacy practices. 25
640	645		b. The right to request restriction of use and disclosure. 26
641	646		c. The right of access to inspect and obtain copies. 27
642	647		d. The right to request amendment. 28
643	648		e. The right to request confidential forms of communication. 29
644	649		f. The right to receive an accounting of disclosures. 30
645	650		(2) Authorize the disclosure of protected health information through the HIE 31
646	651		Network to the extent that the disclosure is restricted by federal laws or 32
647	652		regulations, including the federal drug and alcohol confidentiality regulations 33
648	653		set forth in 42 C.F.R. Part 2. 34
649	654		(3) Restrict the disclosure of protected health information through the HIE 35
650	655		Network for public health purposes or research purposes, so long as disclosure 36
651	656		is permitted by both HIPAA and State law. 37
652	657		(4) Prohibit the Authority or any covered entity participating in the HIE Network 38
653	658		from maintaining in the Authority's or qualified organization's computer 39
654	659		system a copy of the protected health information of an individual who has 40
655	660		exercised the right to opt out, as long as the Authority or the qualified 41
656	661		organization does not access, use, or disclose the individual's protected health 42
657	662		information for any purpose other than for necessary system maintenance or 43
658	663		as required by federal or State law. 44
659	664		(b) This Article applies only to disclosures of protected health information made through 45
660	665		the HIE Network, including disclosures made within qualified organizations. It does not apply to 46
661	666		the use or disclosure of protected health information in any context outside of the HIE Network, 47
662	667		including the redisclosure of protected health information obtained through the HIE Network. 48
663	668		"§ 90-414.12. Penalties and remedies; immunity for covered entities and business associates 49
664	669		for good faith participation. 50 General Assembly Of North Carolina Session 2025
665		-	Page 14 ~~Senate Bill 509-First Edition~~
	670	+	Page 14 DRS15195-MGfa-82
666	671		(a) Except as provided in subsection (b) of this section, a covered entity that discloses 1
667	672		protected health information in violation of this Article is subject to the following: 2
668	673		(1) Any civil penalty or criminal penalty, or both, that may be imposed on the 3
669	674		covered entity pursuant to the Health Information Technology for Economic 4
670	675		and Clinical Health (HITECH) Act, P.L. 111-5, Div. A, Title XIII, section 5
671	676		13001, as amended, and any regulations adopted under the HITECH 6
672	677		Act.federal law or regulation. 7
673	678		(2) Any civil remedy available under the HITECH Act or any regulations adopted 8
674	679		under the HITECH Act that is available to the Attorney General or to an 9
675	680		individual who has been harmed by a violation of this Article, including 10
676	681		damages, penalties, attorneys' fees, and costs.federal law or regulation. 11
677	682		(3) Disciplinary action by the respective licensing board or regulatory agency 12
678	683		with jurisdiction over the covered entity. 13
679	684		(4) Any penalty authorized under Article 2A of Chapter 75 of the General Statutes 14
680	685		if the violation of this Article is also a violation of Article 2A of Chapter 75 15
681	686		of the General Statutes. 16
682	687		(5) Any other civil or administrative remedy available to a plaintiff by State or 17
683	688		federal law or equity. 18
684	689		(a1) In connection with the submission of the annual compliance report required by 19
685	690		G.S. 90-414.13, it is unlawful for any person or entity to knowingly present or cause to be 20
686	691		presented to the Authority a false record to avoid full payment of the State health data assessment 21
687	692		under G.S. 90-414.4. The Authority may assess against any person or entity that violates this 22
688	693		subsection a civil penalty of not less than five thousand dollars ($5,000) and not more than ten 23
689	694		thousand dollars ($10,000), plus three times the amount of damages sustained by the Authority 24
690	695		as a result of that person's or entity's actions. The clear proceeds of civil penalties provided for 25
691	696		in this subsection shall be remitted to the Civil Penalty and Forfeiture Fund in accordance with 26
692	697		G.S. 115C-457.2. 27
693	698		(a2) The Authority may assess a civil penalty not to exceed fifty dollars ($50.00) for each 28
694	699		day after the required reporting period or deadline that the annual compliance report remains out 29
695	700		of compliance with the requirements prescribed by G.S. 90-414.13. 30
696	701		(b) To the extent permitted under or consistent with federal law, a covered entity or its 31
697	702		business associate that in good faith submits data through, accesses, uses, discloses, or relies 32
698	703		upon data submitted through the HIE Network shall not be subject to criminal prosecution or 33
699	704		civil liability for damages caused by such submission, access, use, disclosure, or reliance. 34
700	705		"§ 90-414.13. Annual compliance report. 35
701	706		(a) Reporting Requirement. – Each covered entity that provides, maintains, controls, 36
702	707		directs, or licenses the data transfer system of a provider or entity subject to G.S. 90-414.4(a1) 37
703	708		that provides health care services to beneficiaries of State-funded health care shall submit an 38
704	709		annual compliance report to the Authority on a form created by the Authority that meets the 39
705	710		requirements of this section. 40
706	711		(b) The Authority shall develop and make available to covered entities an annual 41
707	712		compliance report form, which the Authority may update from time to time after consultation 42
708	713		with the Advisory Board. The annual compliance report form shall include fields for at least all 43
709	714		of the following information: 44
710	715		(1) Name of the covered entity, its location, and the Organization NPI. 45
711	716		(2) Names of providers and entities on whose behalf the covered entity is 46
712	717		submitting the annual compliance report, as well as their respective 47
713	718		Organization NPIs. 48
714	719		(3) Acknowledgment of the provision of health care services to beneficiaries of 49
715	720		State-funded health care. 50 General Assembly Of North Carolina Session 2025
716		-	~~Senate Bill 509-First Edition~~ Page 15
	721	+	DRS15195-MGfa-82 Page 15
717	722		(4) Status of technical connection to the HIE Network, as determined under 1
718	723		G.S. 90-414.4(a4). 2
719	724		(5) The status of data submission through the HIE Network that is in compliance 3
720	725		with G.S. 90-414.4. 4
721	726		(6) Representations regarding each of the following, as applicable: 5
722	727		a. For a covered entity that has executed an agreement with the 6
723	728		Authority, a representation regarding that entity's compliance with 7
724	729		such agreement. 8
725	730		b. For a covered entity that has received a time-limited exception from 9
726	731		the Authority, a representation regarding its present intent to connect 10
727	732		to, and begin submitting data through, the HIE Network. 11
728	733		c. For a covered entity that is required to pay the State health data 12
729	734		assessment fee authorized by G.S. 90-414.14, a representation 13
730	735		regarding the amount of the fee owed to the State, an explanation of 14
731	736		how the fee amount was calculated, and whether the fee was submitted 15
732	737		contemporaneously with the annual compliance report as required by 16
733	738		G.S. 90-414.14. 17
734	739		d. For a covered entity that asserts it is exempt from paying the annual 18
735	740		State health data assessment fee, representations regarding why it is 19
736	741		eligible to claim the exemption allowed by G.S. 90-414.14(e). 20
737	742		(7) Attestation to the completeness and validity of the annual compliance report 21
738	743		form and all representations contained on the form. 22
739	744		(c) Covered entities shall submit to the Authority all reports and related statements, 23
740	745		documents, and payments required by this section by the first of May each year. Covered entities 24
741	746		shall be deemed to have submitted timely annual compliance reports if complete reports are 25
742	747		postmarked or digitally time-stamped on or before the day the reports are due to the Authority. 26
743	748		If an annual compliance report or any related statements, documents, or payments are submitted 27
744	749		in a manner that does not comply with this section, the Authority may assess a civil penalty not 28
745	750		to exceed fifty dollars ($50.00) for each day after the first of May that the report remains out of 29
746	751		compliance with the requirements of this section. The clear proceeds of civil penalties provided 30
747	752		for in this subsection shall be remitted to the Civil Penalty and Forfeiture Fund in accordance 31
748	753		with G.S. 115C-457.2. 32
749	754		(d) A covered entity that provides, maintains, controls, directs, or licenses a data transfer 33
750	755		system solely on behalf of a provider or entity that voluntarily connects to the HIE Network 34
751	756		pursuant to G.S. 90-414.4(e) is not required to submit an annual compliance report. 35
752	757		(e) State agencies are required to submit an abbreviated annual compliance report, on a 36
753	758		form provided by the Authority, that shall be made available only to State agencies. 37
754	759		(f) At the request of a covered entity, the Authority may waive any requirement in this 38
755	760		section for good cause if the covered entity demonstrates to the satisfaction of the Authority that 39
756	761		complying with a requirement in this section would cause an undue hardship. 40
757	762		(g) The Department's Division of Health Benefits shall assist in administering the annual 41
758	763		compliance report process as it pertains to the State's Medicaid providers, as determined 42
759	764		necessary by the Authority. At a minimum, the Division of Health Benefits shall annually provide 43
760	765		the Authority with a current list of enrolled Medicaid providers, assist with notifying those 44
761	766		Medicaid providers about the annual compliance report requirement and reporting deadline 45
762	767		established by this section, and provide available information requested by the Authority that is 46
763	768		necessary for the Authority to audit or verify the completeness and accuracy of an enrolled 47
764	769		Medicaid provider's annual compliance report and related materials submitted to the Authority 48
765	770		by or on behalf of that provider. 49
766	771		"§ 90-414.14. Annual State health data assessment fee. 50 General Assembly Of North Carolina Session 2025
767		-	Page 16 ~~Senate Bill 509-First Edition~~
	772	+	Page 16 DRS15195-MGfa-82
768	773		(a) Annual Fee Requirement. – Each covered entity that provides, maintains, controls, 1
769	774		directs, or licenses a data transfer system on behalf of a provider or entity subject to the 2
770	775		mandatory connection and data submission requirements of G.S. 90-414.4 shall pay an annual 3
771	776		State health data assessment fee each year if the covered entity meets any of the following 4
772	777		criteria: 5
773	778		(1) Is not connected to the HIE Network, as determined pursuant to subsection 6
774	779		(a4) of G.S. 90-414.4. 7
775	780		(2) Is connected to the HIE Network, as determined pursuant to subsection (a4) 8
776	781		of G.S. 90-414.4 but is not submitting required data through the HIE Network. 9
777	782		(b) Amount of Annual Fee. – The General Assembly shall determine the State health data 10
778	783		assessment fee schedules for annual compliance report periods. 11
779	784		(c) Fee Due Date. – A covered entity shall pay any required State health data assessment 12
780	785		fee contemporaneously with the submission of the annual compliance report required by 13
781	786		G.S. 90-414.13. 14
782	787		(d) HIE Network Data and Participation Fund; Use of Proceeds. – The HIE Network Data 15
783	788		and Participation Fund (Fund) is established as a special fund in the Department of Information 16
784	789		Technology under the management and control of the Authority. The Fund shall consist of the 17
785	790		fees collected by the Authority pursuant to this section and all other funds received by the 18
786	791		Authority pursuant to this Article, except for the clear proceeds of civil penalties collected 19
787	792		pursuant to G.S. 90-414.12, 90-414.13, 90-414.16, and subsection (g) of this section. The Fund 20
788	793		shall be placed in an interest-bearing account, and any interest or other income derived from the 21
789	794		Fund shall be credited to the Fund. The Authority shall not use monies in this Fund for any 22
790	795		purpose other than to pay for expenses incurred by the Authority in carrying out its powers and 23
791	796		duties as set forth in this Article. Monies in the Fund shall only be available for expenditure upon 24
792	797		an act of appropriation of the General Assembly. The Fund is subject to the provisions of the 25
793	798		State Budget Act, except that no unexpended surplus of the Fund shall revert to the General Fund. 26
794	799		(e) Fee Exemption. – A covered entity that provides, maintains, controls, directs, or 27
795	800		licenses a data transfer system for providers or entities subject to the HIE Network connection 28
796	801		and data submission requirements of this Article may claim an exemption from the State health 29
797	802		data assessment fee during a reporting period by demonstrating to the satisfaction of the 30
798	803		Authority that one or more of the following is true: 31
799	804		(1) The covered entity has secured a time-limited exception from the Authority 32
800	805		under G.S. 90-414.4(g) for the applicable State health data assessment fee 33
801	806		reporting period. 34
802	807		(2) The covered entity attests, in writing, that it and the providers and entities on 35
803	808		whose behalf it provides, maintains, controls, directs, or licenses a data 36
804	809		transfer system received less than five hundred thousand dollars ($500,000) 37
805	810		in State health care funds for providing health care services to beneficiaries of 38
806	811		State-funded health care. 39
807	812		(3) The covered entity is acting in good faith to comply with the Statewide Health 40
808	813		Information Exchange Act as evidenced by all of the following: 41
809	814		a. Has entered into a participation agreement with the Authority. 42
810	815		b. Maintains contact with the Authority. 43
811	816		c. Timely responds to direct communications from the Authority 44
812	817		regarding matters such as connection status, onboarding, training, and 45
813	818		data submission. 46
814	819		(4) The covered entity is in its first year of existence, as evidenced by filings with 47
815	820		the Office of the Secretary of State. 48
816	821		(5) The covered entity attests, in writing, that it is actively transitioning between 49
817	822		data transfer systems. 50 General Assembly Of North Carolina Session 2025
818		-	~~Senate Bill 509-First Edition~~ Page 17
	823	+	DRS15195-MGfa-82 Page 17
819	824		(f) Revocation of Exempt Status. – The Authority may revoke a covered entity's 1
820	825		exemption from payment of the State health data assessment fee if the covered entity is 2
821	826		unresponsive to communications from the Authority or if the covered entity fails to maintain 3
822	827		contact with the Authority. The Authority may revoke an exemption from the payment of the 4
823	828		State health data assessment fee for good cause after giving the covered entity 30 days' written 5
824	829		notice and an opportunity to cure any unresponsiveness to, or failure to maintain contact with, 6
825	830		the Authority. 7
826	831		(g) Civil Penalty for Submitting a False Record to Avoid the Fee. – It is unlawful for any 8
827	832		person or entity to knowingly present or cause to be presented to the Authority a false record to 9
828	833		avoid full payment of the State health data assessment fee due under this section. The Authority 10
829	834		shall assess against any person or entity that violates this section a civil penalty of not less than 11
830	835		five thousand dollars ($5,000) and not more than ten thousand dollars ($10,000), plus three times 12
831	836		the amount of damages sustained by the Authority as a result of that person's or entity's actions. 13
832	837		The clear proceeds of civil penalties provided for in this subsection shall be remitted to the Civil 14
833	838		Penalty and Forfeiture Fund in accordance with G.S. 115C-457.2. 15
834	839		"§ 90-414.15. Appeal of Authority's determinations. 16
835	840		(a) Determinations and Appeals. – The Authority shall make the following 17
836	841		determinations regarding providers' and entities' obligations: (i) grant or deny requests for 18
837	842		time-limited exceptions under G.S. 90-414.4 and (ii) assess penalties under G.S. 90-414.14. The 19
838	843		Authority shall send these determinations, in writing, to providers and entities via certified mail, 20
839	844		return receipt requested, and via email, if known to the Authority. If a provider or entity disagrees 21
840	845		with the Authority's determination, it shall deliver a petition for appeal to the Department of 22
841	846		Information Technology's registered agent via certified mail, return receipt requested, within 30 23
842	847		calendar days after receipt of the Authority's written determination. The petition for appeal shall 24
843	848		include an explanation of the specific reasons the provider or entity disagrees with the Authority's 25
844	849		determination and shall be supported by documentation and affidavits regarding the petitioner's 26
845	850		compliance with this Article along with any other supporting documentation the petitioner deems 27
846	851		relevant to the appeal. The Authority shall develop and make available on its website the form to 28
847	852		be used by any provider or entity seeking to appeal the Authority's determination. 29
848	853		(b) Untimely Appeals. – A petitioner's failure to submit a timely petition for appeal shall 30
849	854		result in the dismissal of the appeal with prejudice. The Department of Information Technology 31
850	855		shall notify the provider or entity of such dismissal in writing. 32
851	856		(c) Review by the State CIO or the State CIO's Designee. – The State CIO or the State 33
852	857		CIO's designee shall review all timely petitions for appeal under this section. The State CIO or 34
853	858		the State CIO's designee may render a decision on the petition without meeting with the 35
854	859		petitioner. If the State CIO or State CIO's designee renders a decision without meeting with the 36
855	860		petitioner, then the State CIO or the State CIO's designee shall notify the petitioner of his or her 37
856	861		decision, in writing, within 30 calendar days after the date the petition was received by the 38
857	862		Department of Information Technology. If the State CIO or the State CIO's designee determines 39
858	863		it is necessary to meet with the petitioner prior to rendering a decision, the State CIO or the State 40
859	864		CIO's designee and petitioner shall schedule a meeting within 30 calendar days after the date the 41
860	865		petition was received by the Department of Information Technology, or as soon as reasonably 42
861	866		practical thereafter, or as agreed upon by the parties. Within 30 calendar days after the date of 43
862	867		the meeting, the State CIO or the State CIO's designee shall submit a decision, in writing, to the 44
863	868		petitioner by certified mail, return receipt requested, and via email, if known. 45
864	869		(d) Administrative Review. – If the petitioner disagrees with the decision of the State 46
865	870		CIO or the State CIO's designee, the petitioner may commence a contested case under Article 3A 47
866	871		of Chapter 150B of the General Statutes. A petition for a contested case shall be filed within 30 48
867	872		calendar days after the earlier of either the date the decision of the State CIO or the State CIO's 49
868	873		designee is mailed to the petitioner or the date the decision of the State CIO or the State CIO's 50
869	874		designee is emailed to the petitioner. Except as otherwise provided by this Article, no other 51 General Assembly Of North Carolina Session 2025
870		-	Page 18 ~~Senate Bill 509-First Edition~~
	875	+	Page 18 DRS15195-MGfa-82
871	876		disputes between the Authority and providers or entities, including disputes involving the terms 1
872	877		or conditions of any agreement described in G.S. 90-414.7(b), or a party's performance under 2
873	878		any such agreement, are subject to the contested case provisions of Chapter 150B of the General 3
874	879		Statutes. 4
875	880		"§ 90‑414.16. Data related services. 5
876	881		(a) Data Related Services. – The Authority may provide data related services to a covered 6
877	882		entity participating in the HIE Network or to a business associate of the participating covered 7
878	883		entity that is using the service to perform a function for the participating covered entity. Only 8
879	884		covered entities participating in the HIE Network may make a request to the Authority for data 9
880	885		related services. Nothing in this section shall be construed to require the Authority to provide 10
881	886		data related services to covered entities or their business associates. Data disclosed or used in the 11
882	887		Authority's provision of these services to any person or entity shall not be used for commercial 12
883	888		purposes. 13
884	889		(b) Cost Recovery. – If the Authority voluntarily elects to provide a data related service 14
885	890		to a covered entity, then it may charge a reasonable fee that may not exceed the actual cost 15
886	891		incurred for the service. The cost recovery shall be based on generally accepted accounting 16
887	892		principles and may include labor costs of the personnel providing the service, any information 17
888	893		technology expense, and any other administrative expense." 18
889	894		SECTION 2. The deadline for submitting the first report due under G.S. 90-414.13 19
890	895		and the accompanying State health data assessment fee, if applicable, is May 1, 2028. 20
891	896		SECTION 3. Pursuant to G.S. 90-414.14(b), the initial State health data assessment 21
892	897		fee schedules for annual compliance report periods beginning in 2028, 2029, and 2030 are as 22
893	898		follows: 23
894	899		(1) For the annual compliance report period beginning in 2028: 24
895	900		Amount of State Health Care Funds State Health Data Assessment Fee: Amount 25
896	901		received in 2024 Due 26
897	902		$1,000,000 + 1.6% of State health care funds received in 2027 27
898	903		$750,001 – $1,000,000 $9,000 28
899	904		$500,001 – $750,000 $6,000 29
900	905		$250,001 – $500,000 $3,000 30
901	906		Less than $250,000 (No fee) 31
902	907		(2) For the annual compliance report period beginning in 2029: 32
903	908		Amount of State Health Care Funds State Health Data Assessment Fee: Amount 33
904	909		received in 2025 Due 34
905	910		$1,000,000 + 1.6% of State health care funds received in 2028 35
906	911		$750,001 – $1,000,000 $12,000 36
907	912		$500,001 – $750,000 $8,000 37
908	913		$250,001 – $500,000 $4,000 38
909	914		Less than $250,000 (No fee) 39
910	915		(3) For the annual compliance report period beginning in 2030: 40
911	916		Amount of State Health Care Funds State Health Data Assessment Fee: Amount 41
912	917		received in 2026 Due 42
913	918		$1,000,000 + 1.6% of State health care funds received in 2029 43
914	919		$750,001 – $1,000,000 $15,000 44
915	920		$500,001 – $750,000 $9,000 45
916	921		$250,001 – $500,000 $4,500 46
917	922		Less than $250,000 (No fee) 47
918	923		SECTION 4. This act becomes effective December 1, 2025. 48