31-53-49. Annual report.

The administrator shall prepare an annual report to include:#

1. (1)

   Any policies established or revised pursuant to state and federal medical privacy laws, including the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, as amended;#

2. (2)

   The number of requests for data and reports from the GAPCD, whether the request was submitted by a state agency or private entity, the purpose of the project, a list of the requests for which the administrator was advised that the release was consistent with rule and the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, as amended, and a list of the requests not recommended for release;#

3. (3)

   For each request recommended, the administrator must provide the federal regulation pursuant to which the use or disclosure was recommended, and whether a data use agreement or limited data set data use agreement was executed for the use or disclosure;#

4. (4)

   A description of any data breaches, actions taken to provide notifications, if applicable, and actions taken to prevent a recurrence;#

5. (5)

   The uses of the data in the GAPCD;#

6. (6)

   Public studies produced by the administrator;#

7. (7)

   The cost of administering the GAPCD, the sources of the funding, and the total revenue taken in by the GAPCD;#

8. (8)

   The recipients of the data, the purposes of the data requests, and whether a fee was charged for the data; and#

9. (9)

   A fee schedule displaying the fees for providing custom data reports from the GAPCD.#

Such annual report for the previous calendar year shall be provided no later than March 1 to the Governor, Lieutenant Governor, the Speaker of the House of Representatives, the chairperson of the House Committee on Health and Human Services, and the chairperson of the Senate Health and Human Services Committee.#