30:4D-69 Oversight of the iPHD project.

5. Oversight of the operations of the iPHD Project, established pursuant to section 4 of this act, shall be vested in the Governing Board. The iPHD Project shall receive, maintain, and transmit data only as permitted by this act and approved by the Governing Board and agency or department whose data is requested. The Governing Board's responsibilities shall include:

a. Identification of publicly supported programs data that has been created, received, or maintained by agencies that may be appropriate for receipt, maintenance, and transmission by the iPHD Project in furtherance of the purposes of this act;

b. Prior to the receipt of data by the iPHD Project, the review and approval of the appropriateness of such receipt, including consideration of the following factors:

(1) whether the transmitting department or agency has authority to collect the data proposed to be received by the iPHD Project, particularly if the data includes individually identifiable information;

(2) whether collection of the data proposed to be received by the iPHD Project is expected to further the purpose of this act, namely, the improvement of public health, safety, security, and well-being of New Jersey residents and the improvement of the overall cost-efficiency of government assistance programs; and

(3) whether reasonable efforts have been made to ensure that the iPHD Project will receive only the appropriate data needed to accomplish the purposes of this act;

c. Prior to the receipt or transmission of data by the iPHD Project, the review and approval of any necessary data use agreements or business associate agreements with any person or entity from which or to which information is received or transmitted in compliance with all applicable privacy and security standards, including, but not limited to, HIPAA, when such data includes individually identifiable information that is protected health information as defined under HIPAA; and

d. Adopting and publishing policies and procedures for the efficient and transparent operation of the iPHD Project, including, but not limited to, the following:

(1) Privacy and data security policies and procedures that comply with the applicable federal and State privacy and security statutes and regulations, including HIPAA;

(2) Data access policies and procedures that allow access by a public entity or a private entity, including a researcher, only when such access request meets the standards set forth in the data access policies and procedures and has been approved by the Governing Board and the appropriate agency or department. When data access is requested by any public or private entity, including a researcher, for the purpose of conducting research, the Governing Board shall only approve access to data after review and approval by an IRB, and such access shall be limited to data identified in approved IRB research protocols and only for the period of the approval. In no event shall the Governing Board approve access to health data that identifies, or that may be used to identify, rates of payment by a private entity for the provision of health care services to an individual unless the party seeking access agrees to keep such information confidential and to prevent public disclosure of such data or the rates of payment derived from such data;

(3) Data retention policies identifying that data shall be returned to sponsoring agencies or destroyed when it is no longer in the State's interest to promote analysis of the data and in accordance with applicable HIPAA regulations, data use agreements, and provisions of IRB approvals;

(4) Policies to require researchers to consult with subject matter experts in the datasets being linked on a specific project. The purpose of such consultation shall be to help researchers understand and interpret the data being linked for a specific project; and

(5) Policies that establish processes to engage researchers and academic institutions across New Jersey to help set research priorities and promote the use of the iPHD Project to accelerate population health research in this State.

L.2015, c.193, s.5.