Senate Bill 509 revises North Carolina’s Statewide Health Information Exchange Act to move the state’s health information exchange network from a largely voluntary framework to a more mandatory one for many providers that serve Medicaid and other state-funded health care populations. The bill requires specified hospitals, physicians, pharmacies, dentists, prepaid health plans, local management entities/managed care organizations, and other covered entities to connect to the HIE Network and submit demographic, clinical, and in some cases claims data, generally on a twice-daily basis, with certain categories limited to once-daily claims submission. It also creates procedures for limited time extensions, hardship exemptions, and time-limited exceptions for smaller entities, rural/broadband-limited providers, entities in transition, or those with low levels of state-funded revenue.
The bill also expands the administrative structure around the HIE Network by strengthening the North Carolina Health Information Exchange Authority, clarifying the role of the advisory board, and requiring participation agreements and HIPAA-compliant business associate agreements. It preserves an individual’s right to opt out, restricts disclosure of records protected by federal substance use confidentiality rules, and makes data submitted through the network confidential and state-owned. The bill further authorizes the Authority to provide data-related services, directs state agencies and legislative staff to receive access to certain data or aggregate analyses, and bars commercial use of network data.
A major policy change in the bill is the creation of new compliance mechanisms and financial consequences. Covered entities that are not connected or not submitting required data may owe an annual State health data assessment fee, with initial fee schedules set for reporting periods beginning in 2028 through 2030. The bill also authorizes civil penalties for false records submitted to avoid the fee or evade reporting obligations, and it establishes an annual compliance report requirement with a May 1 deadline. The first report and any associated fee would not be due until May 1, 2028, and the act would take effect December 1, 2025.
Because there are no committee transcripts or recorded votes in the provided material, the general sentiment cannot be measured from debate or roll call history. Based on the bill text alone, the measure appears to be framed as a health care cost-containment and data-integration initiative, with an emphasis on improving care coordination, population health management, and state oversight of Medicaid and other state-funded health spending. The bill’s structure suggests support for stronger data infrastructure and accountability, but it also imposes significant operational and financial obligations on providers and entities that must connect to the network.
The main points of contention likely center on the shift from voluntary participation to mandatory connection and data submission, the scope of entities covered, the privacy and confidentiality implications of broader data sharing, and the new fee and penalty regime. Providers with limited resources, rural broadband constraints, or existing system-transition challenges are given some relief, indicating likely concern about implementation burden. Another potential area of dispute is the state’s access to health data and ownership of derived data products, especially where providers, patients, or privacy advocates may be wary of expanded state control over sensitive health information.
The bill would substantially amend Article 29B of Chapter 90 of the North Carolina General Statutes by converting the Statewide Health Information Exchange Act into a more enforceable statewide data-sharing framework. It adds mandatory connection and submission requirements for many Medicaid and state-funded health care providers, creates new reporting and fee obligations, authorizes civil penalties, and establishes the HIE Network Data and Participation Fund. It also clarifies confidentiality, opt-out rights, state access to data, and the Authority’s powers to administer, enforce, and expand the HIE Network.
No committee discussion or vote history was provided, so there is no recorded legislative sentiment to summarize from debate or roll call. From the bill text, the measure is presented as a modernization and cost-control effort aimed at improving care coordination, data analytics, and oversight of state health spending, but it also clearly imposes new compliance duties, fees, and penalties that could draw concern from affected providers and entities.
The most likely areas of contention are the bill’s mandatory participation requirements, the new State health data assessment fee, and the civil penalties for noncompliance or false reporting. Providers may object to the cost and technical burden of connecting to the HIE Network, especially smaller entities, rural providers, and organizations with limited broadband or in the middle of system transitions. Privacy and data-governance concerns may also arise over state ownership of submitted data, the breadth of state access, and the handling of protected health information, even though the bill preserves opt-out rights and federal confidentiality protections.