§ 45-12-152 — Oversight

Georgia § 45-12-152

• Jurisdiction: Georgia
• Title: 45

Text

Oversight of the operation of the GDAC Project established pursuant to this part shall be vested in the office. The GDAC Project shall receive, maintain, and transmit data only as permitted by this part and as approved by the office and the state agency or department whose data are requested. The office's responsibilities with respect to this part shall include: (1) Identification of data that have been created, received, or maintained by state agencies or departments that may be appropriate for receipt, maintenance, and transmission by the GDAC Project in furtherance of the purposes of this part; (2) Prior to the receipt of data by the GDAC Project, review and approval of the appropriateness of such receipt, including consideration of the following factors: (A) Whether the transmitting agency or department has authority to collect the data proposed to be received by the GDAC Project, particularly if the data include individually identifiable information; (B) Whether collection of the data proposed to be received by the GDAC Project is expected to further the purposes of this part, namely, the improvement of public health and the safety, security, and well-being of Georgia residents; and (C) Whether reasonable efforts have been made to ensure that the GDAC Project will receive only the appropriate data needed to accomplish the purposes of this part; (3) Prior to the receipt or transmission of data by the GDAC Project, review and approval of any necessary data use agreements or business associate agreements with any person or entity from which or to which information is received or transmitted in compliance with all applicable privacy and security standards, including, but not limited to, HIPAA, when such data include individually identifiable information that is protected health information; (4) Adopting and publishing policies and procedures for the efficient and transparent operation of the GDAC Project, including, but not limited to, the following: (A) Privacy and data security policies and procedures that comply with the applicable federal and state privacy and security statutes and regulations, including HIPAA; (B) Data access policies and procedures that allow access by a public or private entity, including a researcher, only when such access request meets the standards set forth in the data access policies and procedures and has been approved by the office and the appropriate state agency or department. When data access is requested by any public or private entity, including a researcher, for the purpose of conducting research, the office shall only approve access to data after review and approval by an IRB, and such access shall be limited to data identified in approved IRB research protocols and only for the period of the approval. In no event shall the office approve access to health data that identifies, or that may be used to identify, rates of payment by a private entity for the provision of health care services to an individual unless the entity seeking access agrees to keep such information confidential and to prevent public disclosure of such data or the rates of payment derived from such data; (C) Data retention policies requiring that data be returned to transmitting state agencies or departments or destroyed when it is no longer in the state's interest to promote analysis of such data and in accordance with applicable HIPAA regulations, data use agreements, and provisions of IRB approvals; (D) Policies to require researchers to consult with subject matter experts in the data sets being linked on a specific project. The purpose of such consultation shall be to help researchers understand and interpret the data being linked to a specific project; and (E) Policies that establish processes to engage researchers and academic institutions across Georgia to help set research priorities and promote the use of the GDAC Project to accelerate population health research in this state; (5) Communicating to all state agencies and departments that each state agency or department shall, upon request of the office, make available to the office through the GDAC Project all data housed within its respective office pursuant to policies established pursuant to this Code section; (6) (A) Establishing the process by which each state agency or department is required, in consultation with the office, to identify and submit to the office a minimum of two distinct policy concerns that may be studied in an integrated information environment in order to identify evidence based solutions to such policy concerns; and (B) Establishing procedures for ranking the submission and selection of such policy concerns considered by the office to be of greatest concern to the health, safety, security, and well-being of Georgia's citizens; and (7) Establishing a process to set research priorities that utilize the GDAC Project to provide effective and efficient policy management for the state.

Legislative History

Added by 2019 Ga. Laws 154,§ 1, eff. 7/1/2019.