§ 12 — Collection, storage and maintenance of data collected under Secs. 8 to 10A; payer and provider claims database; access to data

[ First paragraph of subsection (a) effective until April 8, 2025. For text effective April 8, 2025, see below.]Section 12. (a) The center shall be the sole repository for health care data collected under sections 8, 9 and 10. The center shall collect, store and maintain such data in a payer and provider claims database. The center shall acquire, retain and oversee all information technology, infrastructure, hardware, components, servers and employees necessary to carry out this section. All other agencies, authorities, councils, boards and commissions of the commonwealth seeking health care data that is collected under this section shall, whenever feasible, utilize the data before requesting data directly from health care providers and payers. In order to ensure patient data confidentiality, the center shall not contract or transfer the operation of the database or its functions to a third-party entity, nonprofit organization or governmental entity; provided, however, that the center may enter into interagency services agreements for transfer and use of the data.[ First paragraph of subsection (a) as amended by 2024, 342, Sec. 24 effective April 8, 2025. For text effective until April 8, 2025, see above.](a) The center shall be the sole repository for health care data collected under sections 8 to 10A, inclusive. The center shall collect, store and maintain such data in a payer and provider claims database. The center shall acquire, retain and oversee all information technology, infrastructure, hardware, components, servers and employees necessary to carry out this section. All other agencies, authorities, councils, boards and commissions of the commonwealth seeking health care data that is collected under this section shall, whenever feasible, utilize the data before requesting data directly from health care providers and payers. In order to ensure patient data confidentiality, the center shall not contract or transfer the operation of the database or its functions to a third-party entity, nonprofit organization or governmental entity; provided, however, that the center may enter into interagency services agreements for transfer and use of the data.The center shall, to the extent feasible, make data in the payer and provider claims database available to payers and providers in real-time; provided, however, that all data-sharing complies with applicable state and federal privacy laws The center may charge a fee for access to the data.To the maximum extent feasible, the center shall also make data available to health care consumers, on a timely basis and in an easily readable and understandable format, data on health care services they have personally received.(b) The center shall permit providers, provider organizations, public and private health care payers, government agencies and authorities and researchers access to de-identified data collected by the center for the purposes of lowering total medical expenses, coordinating care, benchmarking, quality analysis and other research, administrative or planning purposes, provided, however, that the data shall not include information that would allow the identification of the health information of an individual patient, except to the extent necessary for a government agency or authority to accomplish the public purposes for which access was given. The center shall also permit providers, provider organizations, and public and private health care payers access to data with patient identifiers solely for the purpose of carrying out treatment and coordinating care among providers. Access to data authorized under this section shall be deemed to comply with the requirements of chapter 66A. The center shall charge user fees sufficient to defray the center's cost of providing such access to non-governmental entities.