House Human Services reviews H.293 to change health‑equity reporting cadence and registry disclosure rules

Members of the House Human Services committee on Friday received a first briefing on H.293, an administration-requested bill the Department of Health says makes technical changes to state reporting and registry disclosure rules.

Lauren Laymon, general counsel for the Department of Health, told the committee the bill has two main elements: changing the frequency of a statewide health‑equity compilation and adjusting who may approve requests to access protected registry data for research and surveillance purposes.

“We're asking that we move from annually reporting to every 3 years, beginning in 2028,” Laymon said, describing the department’s request to change the required consolidated health‑equity compilation from annual to triennial. She said the department’s Division of Health Statistics and Informatics will continue to produce the underlying reports that identify inequities; the bill seeks only to reduce the frequency of the additional compilation task.

Laymon also described proposed changes for two disease registries — the state cancer registry and an amyotrophic lateral sclerosis (ALS) registry — that store protected health information. “That data is protected by HIPAA,” she said. Under current state law, Laymon explained, registry data can be disclosed to certain entities only where there is a written agreement and, for research, approval from an Institutional Review Board (IRB).

She told the committee that a 2017 change in federal rules carved public‑health surveillance out of the definition of “research,” leaving some public‑health surveillance projects unable to obtain IRB waivers required by the current state statute. To address that gap, the bill would allow a HIPAA‑defined privacy board — which the federal rules created to play a role similar to IRBs for certain disclosures — to provide the necessary approval when an IRB will not.

“That's called a Privacy Board,” Laymon said, and she added that privacy boards “have the same requirements as an IRB to look at the study” and can review public‑health surveillance projects for appropriate privacy protections.

Members of the committee pressed for specifics on the language. Katie McGlenn of the Office of Legislative Council read the pertinent federal regulatory language aloud to the committee and confirmed the statute's citations cross‑reference 45 CFR requirements for IRBs and privacy boards. Committee members also urged the bill to preserve a requirement that assurances and approvals be provided in writing; Laymon and others agreed they would draft language clarifying that the commissioner should receive written evidence of approval or written assurances.

There was discussion about how often IRB review is still required and whether the IRB process is sufficiently rigorous; the committee did not adopt substantive restrictions on approvals but asked staff to return with draft strike‑outs showing the requested changes. The committee set a target to schedule the bill for a formal committee vote the following Wednesday morning.

The exchanges on H.293 focused on three discrete outcomes: (1) reducing the frequency of the consolidated health‑equity compilation from annually to once every three years beginning in 2028; (2) permitting HIPAA‑defined privacy boards, in addition to IRBs, to provide approvals permitting disclosure of cancer and ALS registry data when appropriate; and (3) clarifying that approvals or assurances must be received in writing and be acceptable to the commissioner before disclosure.

Officials and counsel repeatedly emphasized that the bill, as described, does not change HIPAA’s substantive privacy protections or expand who may receive identifiable protected health information beyond the limited categories already permitted under state law and federal rules. The committee requested revised statutory language and a strikeout draft for a subsequent meeting so members could review exact citations and wording before markup.