A bill for an act relating to matters under the purview of the department of management, making appropriations, and including applicability provisions.(See HF 756, HF 1028.)
HSB72 is a Department of Management bill that makes a series of changes to Iowa law governing state technology funding, information security, criminal justice data coordination, and state contracting. It updates confidentiality rules for budget-related transmittals to the department, revises how money in the technology reinvestment fund may be used, and requires the department to prioritize technology projects based on strategic alignment, feasibility, return on investment, scalability, rural access, and long-term sustainability. The bill also requires annual reporting to the legislature on funded projects.
The bill strengthens oversight of information technology personnel and contractors by increasing the frequency of FBI national criminal history checks from at least once every 10 years to once every 5 years. It also creates detailed rules for state IT contracts, including voiding a long list of prohibited terms, requiring Iowa law and Polk County venue, and allowing but limiting vendor liability caps. In addition, it makes communications with the chief information security officer about cybersecurity incidents confidential, with narrow exceptions for threat response, law enforcement, and confidential briefings to elected officials.
A major structural change in the bill is the transfer of Iowa statistical analysis center functions from the Department of Health and Human Services to the Department of Management. The bill authorizes the department to access and analyze a wide range of criminal justice, juvenile, child welfare, corrections, and related records for research, evaluation, forecasting, and multiagency tracking purposes, while preserving applicable confidentiality rules. It also repeals several existing statutory provisions tied to the former arrangement and updates multiple cross-references in the juvenile justice code.
The bill’s impact on state law is broad but concentrated in administrative governance: it expands the Department of Management’s authority over technology procurement, cybersecurity confidentiality, and criminal justice data analysis, while also limiting how open-records requests and subpoenas may reach records held by the department in a storage or processing role for other agencies. It appropriates substantial recurring funding to the technology reinvestment fund and sets out applicability rules for the new contract provisions to contracts entered into or renewed after the effective date.
The general sentiment appears strongly favorable in committee, as reflected by the House Committee on State Government report passing 23-0. There is no recorded committee transcript in the provided materials, so no specific debate is available, but the bill’s structure suggests support for tighter state control over IT contracting, cybersecurity, and data governance. Likely points of contention include the expansion of confidentiality, the transfer of sensitive data functions to a different agency, and the limits placed on public access, litigation terms, and vendor contract provisions.
HSB72 amends multiple sections of the Iowa Code to expand the Department of Management’s role in state technology funding, cybersecurity, and criminal justice data analysis. It creates new statutory rules governing IT contracts, vendor liability limits, confidentiality of cybersecurity communications, and the department’s handling of records for other agencies under open-records law. It also transfers Iowa statistical analysis center responsibilities from the Department of Health and Human Services to the Department of Management, repeals related provisions, updates juvenile justice cross-references, and appropriates recurring money to the technology reinvestment fund.
The available voting history indicates unanimous support in the House Committee on State Government, with a 23-0 vote. No committee transcript is provided, so the record does not show detailed debate, but the bill’s broad administrative and technology-management focus suggests it was viewed as a governance and modernization measure. The absence of recorded opposition in the committee vote points to generally favorable sentiment, at least at that stage of consideration.
The most likely areas of contention are the bill’s confidentiality provisions and its expansion of Department of Management authority over sensitive data. Critics could object to limiting public access to cybersecurity communications, narrowing subpoena and open-records access for records held by the department, and shifting statistical analysis center functions away from the Department of Health and Human Services. The contract provisions may also draw scrutiny because they void or prohibit many common vendor terms, require Iowa law and Polk County venue, and constrain how vendors can limit liability.