(a) The DHIN shall provide Delaware health-care payers, providers, and purchasers with access to the Delaware Health Care Claims Database for the purpose of facilitating the design and evaluation of alternative delivery and payment models, including population health research and provider risk-sharing arrangements.

(1) Claims data provided to the Delaware Health Care Claims Database shall only be provided to a requesting party when a majority of the DHIN Board of Directors, or of a subcommittee established under the DHIN’s bylaws for purposes of administering the Health Care Claims Database, determines that the claims data should be provided to the requesting party to facilitate the purposes of this subchapter or to the Delaware Health Care Commission.

a. The determination under this paragraph (a)(1) shall be reduced to writing and provided to the requesting party.

b. The determination under this paragraph (a)(1) shall be final and not subject to appeal, and there is no private right of action to a requesting party against the DHIN or any other party to enforce the requirements of this section.

(2) The DHIN shall, in consultation with the Delaware Health Care Commission, promulgate rules and regulations regarding the appropriate form and content of an application to receive claims data, providing examples of requests for claims data that will generally be deemed consistent with the purposes of this subchapter.

(b) Claims data provided to a requesting party under this section shall be provided under the DHIN’s existing confidentiality and data security protocols and in compliance with all applicable state and federal laws relating to the privacy and security of protected health information, including compliance, to the fullest extent practicable consistent with the purposes under this subchapter, with guidance found in Statement 6 of the Department of Justice and Federal Trade Commission Enforcement Policy regarding the exchange of price and cost information. Individually identifiable patient health information shall be maintained by providers and purchasers in accordance with all applicable state and federal laws relating to the confidentiality and security of protected health information and any additional privacy and security requirements set forth in regulations promulgated under this chapter.

(c) The Office of Management and Budget, State Employee Benefits Committee, Division of Public Health, State Council for Persons with Disabilities, and Division of Medicaid and Medical Assistance shall have access to all claims data reported by the Delaware Health Care Claims Database under this subchapter at no cost for the purposes of public health improvement research and activities. These entities are authorized to enter into appropriate agreements with the DHIN to allow the Delaware Health Care Claims Database to perform data warehousing and analytics functions that have been performed pursuant to the existing statutory authority of the Office of Management and Budget, the State Employee Benefits Committee, State Council for Persons with Disabilities, or the Department of Health and Social Services.

(d) The DHIN may promulgate regulations to make available to the public certain nonindividually identifiable data extracts and analyses, as the DHIN determines is consistent with, and necessary to, achieve the goals and policies of this subchapter. Prior to the release of such data extracts and analyses, the same processes identified in subsection (e) of this section shall be completed.

(e) The DHIN shall promulgate regulations to notify a mandatory reporting entity or voluntary reporting entity when claims data submitted by the mandatory reporting entity or voluntary reporting entity may be released for a purpose permitted under this subchapter and provide the mandatory reporting entity or voluntary reporting entity with an opportunity to comment on the data release request prior to its release. Any comments received from a mandatory reporting entity or voluntary reporting entity during the comment period shall be reviewed, considered, and responded to by DHIN prior to the data release. If a party requesting the release of data is identified by a mandatory reporting entity or voluntary reporting entity as a potential competitor of the reporting entity, the DHIN shall limit disclosure of any pricing information that includes postadjudicated claims data, to the fullest extent practicable and consistent with the purposes of this subchapter, to a summary format that allows for analysis without revealing contracted pricing information.

(f) The DHIN shall promulgate regulations to ensure confidentiality, privacy, and security protections of health-care data and all other information collected, stored, or released by DHIN, subject to all applicable state and federal health-care privacy, confidentiality, and data security laws.

80 Del. Laws, c. 329, § 5; 81 Del. Laws, c. 392, § 4; 82 Del. Laws, c. 156, § 1.