HB 4037 — Records: health; health information exchange; establish certain requirements to operate a health data utility. Amends secs. 2501 & 2505 of 1978 PA 368 (MCL 333.2501 & 333.2505) & adds sec. 2508.

SUBSTITUTE FOR HOUSE BILL NO.

4037 JanuaryA 29,bill 2025,to Introducedamend 1978 PA 368, entitled "Public health code," by Reps.amending sections 2501 and 2505 (MCL 333.2501 and 333.2505), as added by 2006 PA 137, and by adding section 2508.

Rogers, VanderWall, Wooden, Roth, MacDonell, Morgan, Rheingans, Wozniak, Glanville, Miller, Beson, Young, McFall, Foreman, Skaggs, Arbit, Conlin, Wilson, B.

Carter, Andrews, Meerman, Schmaltz, BeGole, Green, Neeley, Frisbie, Neyer, Prestin, Borton and Farhat and referred to Committee on Health Policy.

A bill to amend 1978 PA 368, entitled "Public health code," by amending sections 2501 and 2505 (MCL 333.2501 and 333.2505), as added by 2006 PA 137, and by adding section 2508.

(b) "Department" means the department of community health and LEP H00858'25_HB4037_INTR_1 5h8dk2 1 human services.

(i) Combines,Combines enhances, and facilitates the exchange of disparate clinical LEP H00858'25 (H-2) 1zno9s 1 and other health data for treatment, care coordination, quality improvement, population health, public health emergencies, and other public health and community health purposes.

(ii) Provides trusted data sharing organizations identified under subparagraph (vi) with access to data in order to support care coordination among participants.

(1) The commission shall, in consultation with the LEP H00858'25_HB4037_INTR_1 5h8dk2 1 department, do each of the following:

(a) Develop and maintain a strategic plan in accordance with subsection (2) to guide the implementation of an interoperable health information technology system data utility that will reduce LEP H00858'25 (H-2) 1zno9s 1 reduces medical errors, improve improves quality of care, and produce produces greater value for health care expenditures.

(e) Promote more efficient and effective communication among multiple health care providers, including, but not limited to, hospitals, physicians, payers, employers, pharmacies, laboratories, and any other health care related entity.

(i) Perform any and all other activities in furtherance of the LEP H00858'25_HB4037_INTR_1 5h8dk2 1 above the actions under subdivisions (a) to (h) or as directed by the department or the department of information technology, technology, management, and budget, or both.

(2) The strategic plan developed pursuant to under subsection LEP H00858'25 (H-2) 1zno9s 1 (1)(a) shall must include, at a minimum, each of the following:

(1) In accordance with the management and budget LEP H00858'25_HB4037_INTR_1 5h8dk2 1 act, 1984 PA 431, MCL 18.1101 to 18.1594, and no later than March 1, 2026, a request for proposal must be issued to select aan established, Michigan-based health information exchange that operates throughout this state to operate a health data utility in LEP H00858'25 (H-2) 1zno9s 1 this state.

(a) Is able to route relevant real-time data.data throughout this state.

(b) Is able to allow ahealth-focused programprograms thataccess monitorsto anyrelevant ofdata theto followingimprove tohealth accesscare relevantservices data:in compliance with federal law and the laws of this state.

(i) Public safety or population health.

(ii) Adherence to another program's requirements.

(iii) Compliance with the laws of this state.

(d) Complies with all applicable federal laws and the laws of this state regarding standards-based health data exchangeexchange, including, but not limited to, byadherence adhering to cybersecurity and data protection requirements required by law.

(f) Maintains a high-level of cybersecurity standards, LEP H00858'25_HB4037_INTR_1 5h8dk2 1 including, but not limited to, a certification from HITRUST Alliance or a similar certification that, through a third-party assessment, requires an organization to demonstrate compliance with Common Security Framework (CSF) and requires adherence to industry LEP H00858'25 (H-2) 1zno9s 1 best practices and standards.

(g) Is a nonprofitnonprofit, Michigan-based health information exchange that operates inthroughout this state and has technical connections to a significant percentage of health care providers, public health agencies, and payors in this state.

(h) Has a technology infrastructure that includes all of the following to provide a high-level of protection of patient data:

(i) AdvanceAdvanced identity management.

(iv) Strict audit logs and role-based access controls that include, but are not limited to, both of the following protections for all patients:

(A) The ability to request an accounting of disclosures.

(B) Access to reporting mechanisms to review data access logs.

Final(j) PageOn LEPthe H00858'25_HB4037_INTR_1request 5h8dk2of a patient or, if a patient is unable to participate in medical treatment decisions, the patient's patient advocate, provides the patient or the patient advocate, at no cost, with a record of the disclosures of protected health information that were made during the 6 years preceding the request.

Final Page LEP H00858'25 (H-2) 1zno9s