§ 9410. Health care database

(a)(1) The Board shall establish and maintain a unified health care database to enable the Board to carry out its duties under this chapter, chapter 220 of this title, and Title 8, including:

(A) determining the capacity and distribution of existing resources;

(B) identifying health care needs and informing health care policy;

(C) evaluating the effectiveness of intervention programs on improving patient outcomes;

(D) comparing costs between various treatment settings and approaches;

(E) providing information to consumers and purchasers of health care; and

(F) improving the quality and affordability of patient health care and health care coverage.

(2) [Repealed.]

(b) The database shall contain unique patient and provider identifiers and a uniform coding system, and shall reflect all health care utilization, costs, and resources in this State, and health care utilization and costs for services provided to Vermont residents in another state.

(c) Health insurers, health care providers, health care facilities, and governmental agencies shall file reports, data, schedules, statistics, or other information determined by the Board to be necessary to carry out the purposes of this section. Such information may include:

(1) health insurance claims and enrollment information used by health insurers;

(2) information relating to hospitals filed under subchapter 7 of this chapter (hospital budget reviews); and

(3) any other information relating to health care costs, prices, quality, utilization, or resources required by the Board to be filed.

(d) The Board may by rule establish the types of information to be filed under this section, and the time and place and the manner in which such information shall be filed.

(e) Records or information protected by the provisions of the physician-patient privilege under 12 V.S.A. § 1612(a), or otherwise required by law to be held confidential, shall be filed in a manner that does not disclose the identity of the protected person.

(f) The Board shall adopt a confidentiality code to ensure that information obtained under this section is handled in an ethical manner.

(g) Any person who knowingly fails to comply with the requirements of this section or rules adopted pursuant to this section shall be subject to an administrative penalty of not more than $1,000.00 per violation. The Board may impose an administrative penalty of not more than $10,000.00 each for those violations the Board finds were willful. In addition, any person who knowingly fails to comply with the confidentiality requirements of this section or confidentiality rules adopted pursuant to this section and uses, sells, or transfers the data or information for commercial advantage, pecuniary gain, personal gain, or malicious harm shall be subject to an administrative penalty of not more than $50,000.00 per violation. The powers vested in the Board by this subsection shall be in addition to any other powers to enforce any penalties, fines, or forfeitures authorized by law.

(h)(1) All health insurers shall electronically provide to the Board in accordance with standards and procedures adopted by the Board by rule:

(A) their health insurance claims data, provided that the Board may exempt from all or a portion of the filing requirements of this subsection data reflecting utilization and costs for services provided in this State to residents of other states;

(B) cross-matched claims data on requested members, subscribers, or policyholders; and

(C) member, subscriber, or policyholder information necessary to determine third party liability for benefits provided.

(2) The collection, storage, and release of health care data and statistical information that are subject to the federal requirements of the Health Insurance Portability and Accountability Act (HIPAA) shall be governed exclusively by the regulations adopted thereunder in 45 C.F.R. Parts 160 and 164.

(A) All health insurers that collect the Health Employer Data and Information Set (HEDIS) shall annually submit the HEDIS information to the Board in a form and in a manner prescribed by the Board.

(B) All health insurers shall accept electronic claims submitted in Centers for Medicare and Medicaid Services format for UB-92 or HCFA-1500 records, or as amended by the Centers for Medicare and Medicaid Services.

(3)(A) The Board shall collaborate with the Agency of Human Services and participants in the Agency's initiatives in the development of a comprehensive health care information system. The collaboration is intended to address the formulation of a description of the data sets that will be included in the comprehensive health care information system, the criteria and procedures for the development of limited-use data sets, the criteria and procedures to ensure that HIPAA compliant limited-use data sets are accessible, and a proposed time frame for the creation of a comprehensive health care information system.

(B) To the extent allowed by HIPAA, the data shall be available as a resource for insurers, employers, providers, purchasers of health care, and State agencies to continuously review health care utilization, expenditures, and performance in Vermont. In presenting data for public access, comparative considerations shall be made regarding geography, demographics, general economic factors, and institutional size.

(C) Consistent with the dictates of HIPAA, and subject to such terms and conditions as the Board may prescribe by rule, the Vermont Program for Quality in Health Care shall have access to the unified health care database for use in improving the quality of health care services in Vermont. In using the database, the Vermont Program for Quality in Health Care shall agree to abide by the rules and procedures established by the Board for access to the data. The Board's rules may limit access to the database to limited-use sets of data as necessary to carry out the purposes of this section.

(D) Notwithstanding HIPAA or any other provision of law, the comprehensive health care information system shall not publicly disclose any data that contain direct personal identifiers. For the purposes of this section, "direct personal identifiers" include information relating to an individual that contains primary or obvious identifiers, such as the individual's name, street address, e-mail address, telephone number, and Social Security number.

(i) On or before January 15, 2018 and every three years thereafter, the Commissioner of Health shall submit a recommendation to the General Assembly for conducting a survey of the health insurance status of Vermont residents. The provisions of 2 V.S.A. § 20(d)(expiration of required reports) shall not apply to the report to be made under this subsection.

(j)(1) As used in this section, and without limiting the meaning of subdivision 9402(8) of this title, the term "health insurer" includes:

(A) any entity defined in subdivision 9402(8) of this title;

(B) any third party administrator, any pharmacy benefit manager, any entity conducting administrative services for business, and any other similar entity with claims data, eligibility data, provider files, and other information relating to health care provided to a Vermont resident, and health care provided by Vermont health care providers and facilities required to be filed by a health insurer under this section;

(C) any health benefit plan offered or administered by or on behalf of the State of Vermont or an agency or instrumentality of the State; and

(D) any health benefit plan offered or administered by or on behalf of the federal government with the agreement of the federal government.

(2) The Board may adopt rules to carry out the provisions of this subsection, including criteria for the required filing of such claims data, eligibility data, provider files, and other information as the Board determines to be necessary to carry out the purposes of this section and this chapter. (Added 1991, No. 160 (Adj. Sess.), § 1, eff. May 11, 1992; amended 1995, No. 180 (Adj. Sess.), §§ 16, 38(a); 2005, No. 71, § 312; 2005, No. 122 (Adj. Sess.), § 14; 2005, No. 191 (Adj. Sess.), § 57; 2007, No. 15, § 22; 2007, No. 70, § 25; 2007, No. 80, § 19; 2009, No. 42, § 33; 2009, No. 61, § 3; 2009, No. 156 (Adj. Sess.), § I.27; 2011, No. 48, § 27, eff. Oct. 1, 2011; 2013, No. 79, § 40, eff. June 7, 2013; 2013, No. 142 (Adj. Sess.), § 35; 2015, No. 54, § 35.)