11-188

DEPARTMENT OF 	HEALTH
Adoption 	of 	Chapter 	11-188 	(Interim)
Hawaii 	Administrative 	Rules
November 	1, 	2017
1. 	Chapter 	11-188, 	Hawaii 	Administrative
Rules, 	entitled 	"Submission of 	Administrative
Data 	to 	the 	State 	Health 	Planning 	and 	Development
Agency" 	is 	adopted 	as 	interim 	rules 	to 	read 	as
follows:
"HAWAII 	ADMINISTRATIVE 	RULES
TITLE 	11
DEPARTMENT OF 	HEALTH
STATE 	HEALTH 	PLANNING AND 	DEVELOPMENT AGENCY
CHAPTER 	188
SUBMISSION OF ADMINISTRATIVE 	DATA TO 	THE 	STATE HEALTH
PLANNING AND 	DEVELOPMENT AGENCY
Subchapter 	1 	General 	Provisions
§11-188-1 	Scope
§11-188-2 	Definitions
Subchapter 	2 	Data 	Governance
§11-188-3
§11-188-4
§11-188-5
§11-188-6
§11-188-7
Purpose
Goals
Scope
Steering 	committee
Conflicts 	of 	interest
1 1}25 5

Subchapter 	3 	Data 	Submission
§11-188-8 	Data 	submission 	schedule
§11-188-9 	Data 	submission 	requirements 	for 	mandatory
reporters
§11-188-10 	Protected 	health 	information 	identifiers
§11-188-11 	Data 	submission 	guide
§11-188-12 	Submission method
§11-188-13 	General 	requirements 	for 	data 	submission
§11-188-14 	Test 	data 	requirements
§11-188-15 	Data 	standards 	compliance 	review
§11-188-16 	Data 	submission 	for 	voluntary 	reporters
§11-188-17 	Extensions 	or 	waivers 	to 	data 	submission
requirements
Subchapter 	4 	Data Use 	and Reporting
§11-188-18 	Policy 	statement
§11-188-19 	Annual 	plan
§11-188-20 	Data 	use
§11-188-21 	Minimum 	reporting
§11-188-22 	Requests 	for 	reports
Subchapter 	5 Information 	Security, 	Data 	Privacy,
and 	Confidentiality 	Protection
§11-188-23 	Overview
§11-188-24 	Health 	insurance 	portability and
accountability 	act
§11-188-25 	Identifiers
§11-188-26 	Re-identification 	of 	personal 	information
§11-188-27 	Disclosure 	of 	data 	with 	personal
identifiers
Subchapter 	6 	Miscellaneous 	Provisions
§11-188-28 	Severability
2

§11-188-2
SUBCHAPTER 1
GENERAL 	PROVISIONS
§11-188-1 	Scope. 	The 	rules 	in 	this 	chapter 	govern
the 	submission 	of 	administrative 	data 	by providers 	of
health 	insurance 	that 	provide 	health 	benefit 	plans
funded 	by 	the 	Hawaii 	employer-union 	health 	benefits
trust 	fund 	and 	the 	state 	medicaid 	agency, 	to 	the 	state
health planning 	and 	development 	agency 	(SHPDA), 	or 	its
designee. 	The 	rules 	in 	this 	chapter 	are 	adopted by 	the
State 	pursuant 	to 	section 	323D-18.5, 	Hawaii 	Revised
Statutes 	(HRS), 	relating 	to 	information 	required 	of
heal th 	care 	providers. 	[Eff 	MAR f 7 ?.fftA
] 	(Auth: 	HRS 	§§32'.3Il-11', 	c!23D-18.5,
323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-2 	Definitions. 	As 	used 	in 	this 	chapter,
unless 	a 	different 	meaning 	clearly 	appears 	in 	the
context:
"Administrative 	data" 	or 	"data" 	means:
(1) 	Statistical 	and 	financial 	reports 	of
information;
(2) 	Provider 	invoices 	or 	similar 	patient
encounter 	data;
(3) 	Records 	of 	services 	used 	for 	or 	resulting
from 	administering 	delivery of 	health 	care,
pharmacy benefits, 	or 	dental 	care, 	including
health 	care 	claims 	data, 	records 	of 	services
provided under 	health 	benefits 	plans 	as
defined 	in 	section 	87A-1, 	HRS; 	and
(4) 	Any 	other 	records 	as 	established pursuant 	to
administrative 	rules 	adopted 	pursuant 	to
chapter 	91, 	HRS.
"Administrator" 	means 	the 	administrator 	of 	the
state 	health 	planning 	and 	development 	agency.
"Agency" 	means 	the 	state 	health planning 	and
development 	agency 	as 	established 	in 	section 	323D-11,
HRS.
3 1}255

§11-188-2
"Annual 	plan" 	means 	the 	plan 	developed by 	the
agency pursuant 	to 	section 	323D-18.5, 	HRS.
"Carrier" 	means 	any of 	the 	following:
(1) 	An 	insurer 	engaged 	in 	the 	business 	of 	health
care 	or 	dental 	insurance 	in 	the 	State;
(2) 	A business 	under 	an 	administrative 	services
organization 	or 	administrative 	services
contract 	arrangement;
(3) 	A third 	party 	administrator, 	licensed by 	the
State, 	that 	collects 	premiums 	or 	settles
claims 	of 	residents 	of 	the 	State, 	for 	health
care 	insurance 	policies 	or 	health benefit
plans;
(4) 	A governmental 	plan, 	as 	defined 	in 	section
414(d), 	Internal 	Revenue 	Code, 	that 	provides
"	health 	care 	benefits;
(5) 	A program 	funded 	or 	administered by 	the
State 	for 	the 	provision 	of 	health 	care
services, 	including 	medicaid;
(6) 	A licensed professional 	employer
organization 	acting 	as 	an 	administrator 	of 	a
health 	care 	insurance 	plan;
(7) 	A health 	benefit 	plan 	funded 	by 	a 	self-
insurance 	arrangement;
(8) 	The 	public 	employees' 	benefit 	and 	insurance
program 	or 	EUTF; 	or
(9) 	A pharmacy benefit 	manager, 	defined 	to 	be 	a
person 	that 	provides 	pharmacy benefit
management 	services 	on behalf 	of 	any 	other
carrier.
"Cell 	size" 	means 	the 	count 	of 	persons 	that 	share
a 	set 	of 	characteristics 	contained 	in 	a 	statistical
cell 	or 	table.
"Data 	element" 	means 	the 	specific 	information
collected and 	recorded 	for 	the 	purpose 	of 	health 	care
and 	health 	service 	delivery. 	Data 	elements 	include,
but 	are 	not 	limited 	to 	information 	to 	identify 	the
individual, 	health 	care 	provider, 	data 	supplier,
service 	provided, 	charge 	for 	service, 	payer 	source,
medical 	diagnosis, 	and medical 	treatment.
188-4 	,, 25 5 1,111!11

§11-188-2
"Data 	sharing 	agreement" 	means 	an agreement
between 	a 	data 	submitter 	and 	the 	agency 	that 	governs
the·provision 	and 	use 	of 	data 	by 	the 	agency.
"Data 	submission 	guide" 	means 	the 	document
referenced 	in 	section 	11-188-11 	for 	data 	submissions
to 	the 	agency 	or 	the 	agency's 	designee.
"De-identified 	test 	database" 	means 	the 	database
composed 	of 	de-identified 	test 	data 	for 	use 	by
authorized 	individuals 	to 	test 	analytic 	algorithms 	and
statistical 	methods.
"Dental 	claims 	file" 	means 	a 	data 	file 	composed
of 	dental 	service 	level 	remittance 	information 	for 	all
non-denied 	adjudicated 	claims 	for 	each billed 	dental
service, 	including 	but 	not 	limited 	to 	member
demographics, 	provider 	information, 	care 	and payment
information, 	and 	clinical 	diagnosis 	and 	procedure
codes.
"Designee" 	or 	"designees" 	means 	a 	governmental 	or
nonprofit 	entity with 	which 	the 	agency has 	entered
into 	an agreement 	pursuant 	to 	section 	323D-18.5, 	HRS,
to 	perform, 	on behalf 	of 	the 	agency, 	data 	collection
and 	management, 	data 	analysis, 	reporting, 	and
administrative 	functions. 	The 	pacific 	health
informatics 	and 	data 	center 	is 	the 	agency's 	designee.
"Direct 	personal 	identifiers" 	means 	health 	care
claims 	data 	relating 	to 	an 	individual 	patient, 	member,
or 	enrollee 	that 	contains 	primary, 	distinct, 	or
recognizable 	identifiers, 	including but 	not 	limited
to: 	names; 	date 	of 	birth; 	business 	names 	when 	that
name 	would 	serve 	to 	identify a 	person; 	postal 	address
information 	other 	than 	town 	or 	city, 	state, 	and 	five-
digit 	zip 	code; 	specific 	latitude 	and 	longitude 	or
other 	geographic 	information 	that 	would 	be 	used 	to
derive 	a 	postal 	address; 	telephone 	and 	fax 	numbers;
electronic 	mail 	addresses; 	social 	security 	numbers;
vehicle 	identifiers 	and 	serial 	numbers, 	including 	but
not 	limited 	to 	license 	plate 	numbers; 	medical 	record
numbers; 	health plan 	beneficiary numbers; 	certificate
and 	license 	numbers; 	internet 	protocol 	addresses 	and
uniform 	resource 	locators 	that 	identify a 	business
that 	would 	serve 	to 	identify a 	person; 	and 	personal
photographic 	images.
188-5 3255

§11-188-2
"Disclosure" 	or 	"disclose" 	means 	the 	release,
transfer, 	provision 	of 	access 	to, 	or 	divulging 	in 	any
other manne.r 	of 	information 	outside 	the 	entity holding
the 	information.
"Employer-union 	health 	benefits 	trust 	fund" 	or
"EUTF" 	means 	the 	Hawaii 	employer-union 	health 	benefits
trust 	fund 	established under 	chapter 	87A, 	HRS.
"Encrypted 	record 	identifier" 	means 	a 	code 	or
other means 	of 	record 	identification 	to 	allow
patients, 	members, 	or 	enrollees 	to 	be 	tracked 	across
the 	data 	without 	revealing 	their 	identity 	or 	personal
health. 	Encrypted 	identifiers 	are 	not 	direct 	personal
identifiers.
"Encryption" 	or 	"encrypted" 	means 	the 	use 	of 	an
algorithmic 	process 	to 	transform 	data 	into 	a 	form 	in
which 	the 	data 	is 	rendered 	unreadable 	or 	unusable
without 	the 	use 	of 	a 	confidential 	process 	or 	key 	as
defined 	in 	section 	487N-1, 	HRS.
"Health benefit 	plan" 	or 	"health benefits 	plan"
means 	a 	policy, 	contract, 	certificate, 	or 	agreement
entered 	into 	or 	offered by a 	provider 	of 	health
insurance 	to 	provide, 	deliver, 	arrange 	for, 	pay 	for,
or 	reimburse 	any of 	the 	costs 	of 	health 	care 	services,
as 	defined 	in 	section 	87A-1, 	HRS.
"Health care 	claims 	data" 	means 	any 	information
consisting 	of, 	or 	derived 	directly 	from, 	member
eligibility data, 	medical 	claims, 	pharmacy 	claims,
dental 	claims, 	vision 	claims, 	and 	other 	data 	submitted
by 	reporters 	to 	the 	agency 	or 	the 	agency's 	designee.
"Health care 	provider" 	means 	a 	health 	care
facility, 	physician 	licensed under 	chapter 	453,HRS,
dentist 	licensed under 	chapter 	448,HRS, 	chiropractor
licensed under 	chapter 	442,HRS, 	optometrist 	licensed
under 	chapter 	459,HRS, 	podiatrist 	licensed under
chapter 	463E,HRS, 	psychologist 	licensed under 	chapter
465,HRS, 	occupational 	therapist 	subject 	to 	chapter
457G,HRS, 	physical 	therapist 	licensed under 	chapter
461J,HRS, 	or 	any person, 	partnership, 	corporation,
facility, 	or 	institution 	licensed, 	certified, 	or
authorized by 	law 	to 	provide 	professional 	health 	care
188-6

§11-188-2
services 	in 	the 	State 	to 	an 	individual 	during 	that
individual's 	medical 	care, 	treatment, 	or 	confinement.
"Health 	insurance• 	means 	insurance 	against 	bodily
injury, 	disablement, 	or 	death by 	accident, 	or
accidental 	means, 	or 	the 	expense 	thereof; 	against
disablement 	or 	expense 	resulting 	from 	sickness; 	and
every 	insurance 	appertaining 	thereto.
"Individually 	identifiable 	health 	information"
means 	information 	that 	is 	a 	subset 	of 	health
information, 	including 	demographic 	information
collected 	from 	an 	individual; 	and 	that:
(1) 	Is 	created 	or 	received by 	a 	health 	care
provider, 	health plan, 	employer, 	or 	health
care 	clearinghouse; 	and
(2) 	Relates 	to 	the 	past, 	present, 	or 	future
physical 	or 	mental 	health 	or 	condition 	of 	an
individual; 	the 	provision 	of 	health 	care 	to
an 	individual; 	or 	the 	past, 	present, 	or
future 	payment 	for 	the 	provision 	of 	health
care 	to 	an 	individual; 	and:
(A) 	That 	identifies 	an 	individual; 	or
(B) 	With 	respect 	to 	which 	there 	is 	a
reasonable 	basis 	to 	believe 	that 	the
information 	can 	be 	used 	to 	identify 	the
individual.
"Mandatory 	reporter• 	means 	providers 	of 	health
insurance 	that 	provide 	health 	benefit 	plans 	funded 	by
the 	Hawaii 	employer-union 	health 	benefits 	trust 	fund
and 	the 	state 	medicaid 	agency, 	which 	are 	required
under 	section 	323D-18.5, 	HRS, 	to 	submit 	data 	to 	the
agency 	or 	the 	agency's 	designee.
"Medical 	claims 	file" 	means 	a 	data 	file 	composed
of 	medical 	service 	level 	remittance 	information 	for
all 	non-denied 	adjudicated 	claims 	for 	each billed
service 	including 	but 	not 	limited 	to 	member
demographics, 	provider 	information, 	care 	and payment
information, 	and 	clinical 	diagnosis 	and procedure
codes, 	and 	shall 	include 	all 	claims 	related 	to
medical, 	vision, 	and 	behavioral 	health.
"Med-QUEST" 	means 	the 	Hawaii 	state 	medicaid
agency 	established 	to 	administer 	the 	medicaid program.
188-7

§11-188-2
"Member" 	means 	the 	insured 	subscriber 	and any
spouse 	or 	dependent 	covered by 	the 	subscriber's
policy. 	The 	member 	is 	the 	subject 	of 	the 	activities
of 	the 	claim or 	claim 	line 	performed by 	the 	health
care 	provider.
"Member 	eligibility 	file" 	means 	a 	data 	file
containing 	demographic 	information 	for 	each 	individual
member 	eligible 	for 	medical, 	vision, 	dental, 	or
pharmacy benefits 	for 	one 	or 	more 	days 	of 	coverage 	at
any 	time 	during 	the 	reporting 	period.
"Pacific 	health 	informatics 	and 	data 	center"
means 	the 	data 	center 	program 	of 	the 	University 	of
Hawaii 	telecommunications 	and 	social 	informatics
research program 	of 	the 	social 	science 	research
institute 	of 	the 	college 	of 	social 	sciences 	of 	the
University 	of 	Hawaii 	at 	Manoa.
"Personally 	identifiable 	information" 	means
information 	relating 	to 	an 	individual 	that 	contains
direct 	or 	indirect 	identifiers 	for 	which 	a 	reasonable
basis 	exists 	to 	believe 	that 	the 	information 	can be
used 	to 	identify 	an 	individual.
"Pharmacy benefit 	manager" 	means 	any person,
business, 	or 	entity 	that 	performs 	pharmacy benefit
management, 	including but 	not 	limited 	to 	a 	person 	or
entity under 	contract 	with 	a 	pharmacy benefit 	manager
to 	perform pharmacy 	benefit 	management 	on 	behalf 	of 	a
managed 	care 	company, 	nonprofit 	hospital 	or 	medical
service 	organization, 	insurance 	company, 	third-party
payer, 	or 	health program 	administered 	by 	the 	State,
pursuant 	to 	section 	431R-1, 	HRS.
"Pharmacy 	claims 	file" 	means 	a 	data 	file
containing 	service 	level 	remittance 	information 	from
all 	non-denied 	adjudicated 	claims 	for 	each
prescription, 	including 	but 	not 	limited 	to 	member
demographics, 	provider 	information, 	charge 	and payment
information, 	and 	national 	drug 	codes.
"Protected 	health 	information" 	means 	individually
identifiable 	health 	information:
(1) 	Except 	as 	provided 	in paragraph 	(2), 	that
is:
(A) 	Transmitted by 	electronic 	media;
(B) 	Maintained 	in 	electronic 	media; 	or
188-8

§11-188-2
(C) 	Transmitted 	or maintained 	in 	any other
form 	or 	medium.·
(2) 	Protected 	health 	information 	excludes
individually 	identifiable 	health
information, 	pursuant 	to 	45 	C.F.R. 	section
160.103:
(A) 	In 	education 	records 	covered 	by 	the
family 	educational 	rights 	and 	privacy
act, 	as 	amended, 	title 	20 	U.S.C.
section 	1232g;
(B) 	In 	records 	described 	at 	title 	20 	U.S.C.
section 	1232g(a) (4) (B) (iv);
(C) 	In 	employment 	records 	held by a 	covered
entity 	in 	its 	role 	as 	employer; 	and
(D) 	Regarding 	a 	person 	who 	has 	been
deceased 	for 	more 	than 	fifty 	years.
"Provider 	file" 	means 	a 	data 	file 	containing
information 	on 	every health 	care 	provider 	contracted
by 	the 	provider 	of 	health 	insurance 	during 	the
reporting 	period.
"Provider 	of 	health 	insurance" 	means 	a 	group
health 	insurance 	contract 	or 	service 	agreement 	that
may 	include 	medical, 	hospital, 	surgical, 	prescription
drug, 	vision, 	or 	dental 	services, 	in 	which 	a 	carrier
agrees 	to 	provide, 	pay 	for, 	arrange 	for, 	or 	reimburse
the 	cost 	of 	the 	services, 	including 	third 	party
administrators.
"Report" 	means 	a 	combination 	of 	data 	or
information 	collected and 	produced 	by 	the 	agency 	or
its 	designee(s), 	including 	but 	not 	limited 	to 	a
compilation, 	study, 	or 	analysis 	designed 	to 	meet 	the
needs 	of 	specific 	audiences, 	without 	personally
identifiable 	information.
"Social 	security number" 	means 	the 	social
security 	number 	of 	a 	member 	or 	subscriber.
"Subscriber" 	means 	the 	individual 	responsible 	for
payment 	of 	premiums 	or 	whose 	employment 	is 	the 	basis
for 	eligibility 	for 	membership 	in 	a 	health 	benefit
plan.
"Third party 	administrator" 	means 	any 	person 	who,
on 	behalf 	of 	a 	health 	insurer 	or 	purchaser 	of 	health
188-9

§11-188-2
benefits, 	receives 	or 	collects 	charges, 	contributions,
or premiums 	for, 	or 	adjusts 	or 	settles 	claims 	on 	or
for 	residents 	of 	the 	State 	of 	Hawaii, 	health 	care
providers 	and 	facilities.
"Voluntary 	reporter" 	means 	a 	provider 	of 	health
insurance 	or 	other 	data 	source 	provider 	that 	is 	not
required 	to 	provide 	data 	but 	agrees 	to 	provide 	data 	in
accordance 	with 	a 	data 	use 	agreement. 	[Eff 	MAR 1 7 2tl18
] 	(Auth: 	HRS 	§§87A, 	323D-12, 	323D-18.5, 	323D-62,
487N-1; 	45 	C.F.R. 	§160.103, 	45 	C.F.R. 	§164.502) 	(Imp:
HRS 	§§323D-12, 	323D-18.5)
SUBCHAPTER 	2
DATA GOVERNANCE
§11-188-3 	Purpose. 	Data 	governance 	is 	the 	exercise
of 	authority 	and management 	planning, 	oversight,
monitoring, 	and 	securing 	the 	health 	care 	claims 	data
entrusted 	to 	the 	agency 	and 	its 	designee(s). 	Data
governance 	at 	the 	agency 	fosters 	a 	culture 	of 	shared
responsibility, 	accountability and 	active
participation 	among 	state 	agencies 	and 	the 	health 	care
community 	in 	the 	use 	of 	health 	care 	claims
entrusted 	to 	the 	agency. 	[Eff 	MAR 1 7 2618
HRS 	§§323D-12, 	323D-18.5, 	323D-61)' 	(Imp:
12, 	323D-18.5)
data
] 	(Auth:
HRS 	§§323D-
§11-188-4 	Goals. 	The 	goals 	of 	data 	governance 	at 	the
agency 	are 	to:
(1) 	Promote 	the 	use 	of 	claims 	data 	to 	enable
studies 	on 	the 	cost 	and 	quality 	of 	care,
population 	health, 	health 	disparities,
consumer 	transparency 	in 	the 	cost 	and
quality 	of 	health 	care, 	health 	care
planning, 	and 	to 	inform public 	policy;
188-10

§11-188-4
(2) 	Protect 	the 	privacy 	and 	security of 	data 	and
information under 	the 	stewardship 	of 	the
agency;
(3) 	Support 	a 	culture 	of 	responsible 	data 	use
for 	informed 	and 	actionable 	decision 	making;
(4) 	Promote 	the 	use 	of 	resources 	to 	meet 	the
data 	and 	information 	needs 	of 	the 	community;
(5) 	Increase 	transparency 	and 	accountability 	to
the 	public 	and 	policymakers 	by providing
access 	to 	relevant 	information;
(6) 	Establish 	reasonable 	and 	cost-effective
methods 	of 	data 	collection 	for 	providers 	of
health 	insurance; 	and
(7) 	Ensure 	compliance 	with 	all 	applicable
federal, 	state, 	and 	county 	statutes, 	rules,
and 	policies 	with 	regard 	to 	data 	that 	falls
within 	the 	purview 	of 	this 	chapter, 	and
subject 	to 	the 	confidentiality and 	privacy
laws 	that 	govern 	the 	reporter 	that 	supplied
the 	data, 	including 	allowable 	uses 	and
disclosures 	required 	by 	law, 	public 	health
activities, 	and 	health 	oversight 	activities,
which 	shall 	include 	but 	not 	be 	limited 	to:
(A) 	The 	Patient 	Protection 	and Affordable
Care 	Act, 	Pub. 	L. 	No. 	111-148, 	124
Stat. 	119 	(2010);
(B) 	Section 	2794 	of 	the 	Public 	Health
Service 	Act, 	including 	but 	not 	limited
to 	prohibitions 	on 	conflicts 	of
interest 	in 	the 	governance 	of 	data
centers;
(C) 	The 	Health 	Insurance 	Portability 	and
Accountability Act 	of 	1996 	(HIPAA,)
Pub. 	L. 	No. 	104-191, 	110 	Stat. 	1936
(1996), 	and 	its 	regulations 	at 	45
C.F.R. 	parts 	160, 	160, 	and 	164;
(D) 	Heath 	Information 	Technology 	for
Economic 	and 	Clinical 	Health Act
(HITECH), 	Pub. 	L. 	No. 	111-5, 	123 	Stat.
2 2 6 	( 2 0 0 9 ) ; 	and
(E) 	Protection 	of 	Human
section 	46. 	[Eff
188-11
Subjects, 	45
MAR 1 7 2818
C.F.R.
l

§11-188-4
(F) 	(Auth: 	HRS 	§§323D-12, 	323D-18.5, 	323D-
62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-5 	Scope. 	Data 	governance 	applies 	to 	the
following:
(1) 	State 	employees, 	contractors, 	or 	any 	of 	the
agency's 	designees 	including 	their
employees, 	and 	agents 	(including 	out 	of
state 	governmental 	entities 	or 	nonprofits
and 	private 	firms 	or 	entities 	and
individuals, 	third 	party 	administrators)
with 	authorized 	access 	to 	health 	care 	claims
data 	entrusted 	to 	the 	agency;
(2) 	All 	health 	care 	claims 	data 	collected,
analyzed, 	and 	reported 	on by 	the 	agency 	or
any 	of 	the 	agency's 	designees, 	regardless 	of
where 	the 	data 	is 	located 	and 	in 	what 	medium
it 	is 	stored 	(e.g., 	physical 	or 	electronic),
how 	it 	is 	accessed, 	and 	how 	it 	is
transmitted; 	and
(3) 	Sensitive 	information 	that 	is 	subject 	to
privacy 	considerations 	or 	is 	classified 	as
confidential 	and 	is 	therefore 	subject 	to
protection 	from 	public 	access 	or
inappropriate 	disclosure. 	[Eff 	MAR 1 7 2018
] 	(Auth: 	HRS 	§§323D-12,
323D-18.5, 	323D-62) 	(Imp: 	HRS 	§§323D-12,
323D-18.5)
§11-188-6 	Steering 	committee. 	(a) 	The 	steering
committee's 	responsibilities 	include:
(1) 	Providing 	project 	direction 	and 	executive
leadership;
(2) 	Reviewing, 	requiring 	changes, 	and 	approving
the 	annual 	plan 	developed 	by 	the 	agency;
(3) 	Defining 	clear 	and 	consistent 	structures,
models, 	and 	processes 	that 	promote 	efficient
188-12

§11-188-7
use 	of 	resources 	to 	meet 	the 	information 	and
analytical 	needs 	of 	the 	agency's 	community;
(4) 	Providing 	guidance 	and 	recommendations
concerning 	health 	care 	claims 	data,
including 	expanding 	access, 	improving
quality, 	assuring 	data 	privacy 	and 	security,
and 	improving 	performance;
(5) 	Providing 	final 	approval 	of 	all 	requests 	for
data ,and 	reports; 	and
(6) 	Facilitating 	the 	identification,
prioritization, 	and 	methods 	of 	analysis 	and
evaluation 	for 	health 	care 	costs, 	programs,
disparities, 	and medical 	loss 	ratios 	with
other 	stakeholders.
(b) 	The 	steering 	committee 	shall 	consist 	of 	the
administrator 	of 	the 	agency, 	directors 	or 	designees 	of
the 	departments 	of 	health, 	budget 	and 	finance,
commerce 	and 	consumer 	affairs 	and 	the 	insurance
commissioner, 	human 	services, 	EUTF, 	the 	office 	of
enterprise 	technology 	services, 	and 	the 	University 	of
Hawaii. 	Oversight 	and 	final 	approval 	of 	work 	products
are 	the 	responsibility 	of 	the 	steering 	committee.
[Eff 	MAR 1 7 2018 	l 	(Auth: 	HRS 	§§323D-12, 	323D-
18. 5, 	323D-52) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-7 	Conflicts 	of 	interest. 	All 	members 	of 	the
steering 	committee 	shall 	meet 	the 	conflicts 	of
interest 	requirements 	of 	title 	42 	U.S.C. 	section
300gg-94 (d) (2). 	Members 	of 	the 	steering 	committee
shall 	not 	be 	controlled 	or 	influenced by, 	and 	may not
have 	any 	corporate 	relation 	to, 	any 	individual 	or
entity 	that 	may make 	or 	receive 	payments 	for 	health
care 	services 	based 	on 	the 	agency's 	analysis 	of 	health
care 	costs. 	[Eff 	MAR 1 7 2018 	J 	(Auth: 	HRS
§§323D-12, 	323D-18.5, 	323D-62; 	42 	U.S.C. 	section
300gg-94(d) 	(2)) 	(Imp: 	HRS 	323D-12, 	323D-18.5)
188-13

§11-188-8
SUBCHAPTER 	3
DATA SUBMISSION
§11-188-8 	Data 	submission 	schedule. 	All 	data 	shall
be 	submitted 	in 	the 	form 	and manner 	compliant 	with 	the
data 	submission 	guide. 	[Eff 	MAR 1 7 2318 	l 	(Auth:
HRS 	§§323D-12, 	323D-18.5, 	323D-62) 	(Imp: 	HRS 	§§323D-
12, 	323D-18. 5)
§11-188-9 	Data 	submission 	requirements 	for mandatory
reporters. 	Mandatory 	reporters 	or 	their 	designees
shall 	regularly 	submit 	health 	care 	claims 	data 	to 	the
agency 	or 	the 	agency's 	designee, 	for 	each 	applicable
health 	line 	of 	business, 	including but 	not 	limited 	to,
comprehensive 	major medical 	plans, 	third 	party
administrator 	plans, 	administrative 	services 	only
plans, 	medicare 	supplemental 	plans, 	medicare 	part 	C,
medicare 	part 	D, 	pharmacy, 	dental, 	and 	vision. 	[Eff
MAR 1 7 2018 	] 	(Auth: 	HRS 	§§323D-12, 	323D-18. 5,
323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-10 	Protected health 	information 	identifiers.
To 	minimize 	the 	risk 	of 	data 	breaches 	and 	re-
identification of 	data, 	the 	data 	and 	information
submitted 	to 	the 	agency 	shall 	include 	only 	the 	minimum
protected health 	information 	identifiers 	according 	to
the 	data 	submission 	guide 	necessary 	to 	link 	the 	public
and 	private 	data 	sources 	and 	the 	geographic 	and
services 	data 	to 	undertake 	studies. 	[Eff 	MAR 1 7 2-018
] 	(Auth: 	HRS 	§§323D-12, 	323D-18.5, 	323D-62) 	(tmp:
HRS 	§§323D-12, 	323D-18.5)
188-14

§11-188-13
§11-188-11 	Data 	submission 	guide. 	Mandatory 	and
voluntary 	reporters 	shall 	comply with 	the 	data
submission 	guide. 	The 	data 	submission 	guide 	may be
amended 	annually. 	[Eff 	MAR 1 7 2118 	l 	(Auth: 	HRS
§§323D-12, 	323D-18.5, 	323D-62) 	(Imp: 	HRS 	§§323D-12,
323D-18.5)
§11-188-12 	Submission method. 	All 	data 	shall 	be
submitted 	through 	secure 	file 	transfer 	protocol 	or
media 	that 	is 	properly 	encrypted 	in 	accordance 	with
the 	data 	submission 	guide. 	No 	data 	shall 	be 	sent 	to
the 	agency 	or 	any 	of 	the 	agency's 	designees 	without
proper 	encryption. 	[Eff 	MAR 1 7 2018 	) 	(Auth: 	HRS
§§323D-12, 	323D-18.5, 	323D-62, 	487N-1) 	(Imp: 	HRS
§§323D-12, 	323D-18.5)
§11-188-13 	General 	requirements 	for 	data 	submission.
(a) 	All 	data 	shall 	be 	submitted 	to 	the 	agency or 	the
agency's 	designee, 	as 	separate 	files 	in 	the 	format
described 	in 	the 	data 	submission 	guide.
(b) 	Files 	shall 	be 	encrypted 	and 	submitted 	in
the 	method 	specified by 	the 	data 	submission 	guide.
(c) 	All 	submissions 	shall 	include 	the 	following:
(1) 	Adjustment 	records 	with 	the 	appropriate
positive 	or 	negative 	fields 	with 	the
medical, 	pharmacy, 	and 	dental 	claims 	file
submissions;
(2) 	Claims 	for 	services 	under 	capitation 	or
other 	alternative 	payment 	arrangement 	shall
be 	reported 	with 	claims 	file 	submissions;
(3) 	Records 	for 	the 	medical, 	pharmacy, 	and
dental 	claims 	file 	submissions 	shall 	be
reported pursuant 	to 	the 	data 	submission
guide;
(4) 	Claims 	where 	multiple 	parties 	have 	financial
responsibility 	shall 	be 	included with 	all
medical, 	p~armacy, 	and 	dental 	claims 	file
submissions; 	and
188-15

§11-188-13
(5) 	Wholly denied 	claims 	shall 	be 	excluded 	from
all 	medical, 	pharmacy, 	and 	dental 	claims
file 	submissions. 	However, 	when 	a 	claim
contains 	both 	fully 	processed 	and 	paid
service 	lines 	and 	partially processed 	or
partially denied 	service 	lines, 	all 	lines
shall 	be 	included 	as 	part 	of 	the 	health 	care
claims 	data 	submission.
(d) 	Records 	within medical, 	pharmacy, 	and 	dental
claims 	files 	shall 	be 	selected and 	submitted 	according
to 	the 	data 	submission 	guide. 	[Eff 	MAR 1 7 2@18 	l
(Auth: 	HRS 	§§323D-12, 	323D-18.5, 	323D-!;''.:!) 	(Imp: 	HRS
§§323D-12, 	323D-18.5)
§11-188-14 	Test 	data 	requirements. 	Mandatory and
voluntary 	reporters 	shall 	submit 	test 	data 	as
specified 	in 	the 	data 	submission 	guide 	to 	the 	agency
or 	the 	agency's 	designee. 	The 	agency may 	request
additional 	submissions 	of 	test 	data 	as 	needed. 	[Eff
MAR 172618 	J 	(Auth: 	HRS 	§§323D-12, 	323D-18.5,
323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-15 	Data 	standards 	compliance 	review. 	Upon
submission, 	the 	agency 	or 	the 	agency's 	designee 	shall
evaluate 	each 	submitted 	file 	against 	thresholds 	and
standards 	pursuant 	to 	the 	data 	submission 	guide.
Reporters 	with 	nonconforming 	files 	shall 	be 	notified
of 	the 	noncompliance. 	Reporters 	shall 	correct 	and
resubmit 	nonconforming 	files 	within 	fifteen 	business
days 	of 	notification. 	Failure 	to 	resubmit 	conforming
data 	may 	result 	in 	compliance 	actions. 	[Eff
MAR 1 7 2018 	] 	(Auth: 	HRS 	§§323D-12, 	323D-18. 5,
323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-16 	Data 	submission 	for 	voluntary 	reporters.
Voluntary 	reporters, 	with 	approval 	of 	the
188-16

§11-188-17
administrator, 	may 	submit 	health 	care 	claims 	data 	to
the 	agency 	or 	the 	agency's 	designee. 	Voluntary
reporters ·shall 	enter 	into 	an 	agreement 	with 	the
agency 	or 	the 	agency's 	designee 	prior 	to 	submitting
health 	care 	claims 	data, 	in 	a 	format 	defined 	in
accordance 	with 	the 	standards 	identified 	in 	the 	data
submission 	guide. 	[Eff 	J 	(Auth: 	HRS
§§323D-12, 	323D-18.5, 	323~A~2~ 7 W!p: 	HRS 	§§323D-12,
323D-18.5)
§11-188-17 	Extensions 	or waivers 	to 	data 	submission
requirements. 	(a) 	Reporters 	who 	temporarily 	cannot
meet 	the 	terms 	and 	conditions 	of 	this 	chapter 	shall
submit 	a 	written 	request 	to 	the 	administrator 	as 	soon
as 	the 	reporter 	has 	determined 	that 	an 	extension 	or
waiver 	is 	required. 	Reporters 	shall 	follow 	procedures
identified 	in 	the 	data 	submission 	guide, 	and 	each
written 	request 	shall 	include:
(1) 	The 	specific 	requirement 	to 	be 	extended 	or
waived;
(2) 	The 	specific 	reason 	the 	extension 	or 	waiver
is 	being 	requested;
(3) 	The 	methodology 	and 	timeframe 	proposed 	to
eliminate 	the 	necessity of 	the 	extension 	or
waiver; 	and
(4) 	The 	time 	frame 	required 	to 	come 	into
compliance.
(b) 	The 	administrator 	will 	review 	the 	extension
or 	waiver 	request 	and 	respond 	within 	thirty 	days 	of
receipt 	of 	written 	request. 	[Eff 	MAR 1 7 2fl18 	l
(Auth: 	HRS 	§§323D-12, 	323D-18.5, 	323D-62) 	(Imp: 	HRS
§§323D-12, 	323D-18. 5)
188-17

§11-188-18
SUBCHAPTER 4
DATA USE AND 	REPORTING
§11-188-18 	Policy 	statement. 	It 	is 	the 	policy 	of 	the
agency 	to 	hold 	itself 	accountable 	for 	the 	privacy 	and
security 	of 	the 	data 	entrusted 	to 	it 	while
keeping 	that 	data 	accessible 	for 	appropriate 	use.
[Eff 	MAR 1 7 2318 	] 	(Auth: 	HRS 	§§323D-12, 	323D-
18. 5, 	323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-19 	Annual 	plan. 	The 	agency 	shall 	develop 	an
annual 	plan 	for 	the 	protection, 	collection per 	the
parameters 	specified 	in 	the 	data 	submission 	guide,
analysis, 	maintenance, 	and 	publication 	of 	data
collected. 	The 	agency 	shall 	seek 	approval 	for 	the
annual 	plan 	from 	the 	director 	of 	health, 	administrator
of 	the 	Med-QUEST 	division 	of 	the 	department 	of 	human
services, 	and 	the 	chief 	information 	officer 	of 	the
State. 	[Eff 	] 	(Auth: 	HRS 	§§323D-12,
323D-18.5, 	323D-~~ 1 lil!1~ 	HRS 	§§323D-12, 	323D-18.5)
§11-188-20 	Data 	use. 	The 	agency 	and 	the 	agency's
designees 	shall 	use 	the 	data 	for 	studies 	on 	the 	cost
and 	quality 	of 	care, 	population 	health, 	health
disparities, 	consumer 	transparency 	in 	the 	cost 	and
quality 	of 	health 	care, 	health 	care 	planning, 	and 	to
inform public 	policy. 	Initial 	studies 	will 	be
conducted 	for 	the 	EUTF, 	state 	medicaid 	agency,
department 	of 	health, 	state 	legislature, 	department 	of
commerce 	and 	consumer 	affairs, 	state 	health planning
and 	development 	agency, 	and P,Ublicly 	accessible
reporting. 	[Eff 	MAR 1 7 2018 	] 	(Auth: 	HRS 	§§323D-
12, 	323D-18.5, 	323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-
18.5)
188-18

§11-188-22
§11-188-21 	Minimum 	reporting. 	(a) 	The 	agency 	shall,
at 	a 	minimum, 	issue 	reports 	from 	the 	health 	care
claims 	data 	at 	an 	aggregate 	level 	to 	describe 	patterns
of 	incidence 	and 	variation 	of 	targeted 	medical
conditions, 	state 	and 	regional 	cost 	patterns, 	and
utilization 	of 	services.
(b) 	The 	health 	care 	claims 	data 	reports 	will 	be
available 	to 	the 	public 	and 	shall 	be 	de-identified,
aggregated, 	and 	summarized 	in 	reports 	to 	achieve 	the
purposes 	of 	the 	agency. 	All 	reports 	shall 	protect
patient 	privacy 	and 	confidentiality 	in 	accordance 	with
the 	Health 	Insurance 	Portability 	and Accountability
Act, 	including 	standards 	for 	the 	de-identification 	of
protected 	health 	information. 	[Eff 	J
(Auth: 	HRS 	§§323D-12, 	323D-18.5, 	32MAAdJ JM1fb.F.R.
§160.103, 	45 	C.F.R. 	§164.502) 	(Imp: 	HRS 	§§323D-12,
323D-18.5)
§11-188-22 	Requests 	for 	reports. 	A government 	agency
engaged 	in 	efforts 	to 	improve 	health 	care 	or 	public
health 	outcomes 	for 	members 	under 	health 	benefits
plans 	funded 	by 	the 	EUTF 	or 	the 	state 	medicaid 	agency
may 	request 	a 	specialized 	report, 	excluding 	personally
identifiable 	information, 	from 	the 	agency by
submitting 	to 	the 	administrator 	a 	written 	request
detailing 	the 	purpose 	of 	the 	project, 	the 	data
elements 	required 	for 	analysis, 	the 	specific 	analysis
requested 	to 	be 	undertaken, 	and 	other 	information 	as
required 	by 	the 	administrator. 	[Eff 	MAR 1 7 2-018
] 	(Auth: 	HRS 	§§323D-12, 	323D-12.6,
323D-18.5, 	323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
188-19 	,25 5

§11-188-23
SUBCHAPTER 	5
INFORMATION SECURITY, 	DATA 	PRIVACY, 	AND
CONFIDENTIALITY 	PROTECTION
§11-188-23 	Overview. 	This 	subchapter 	addresses 	the
information 	security, 	data 	privacy, 	and
confidentiality concerns 	for 	health 	care 	claims 	data.
[Eff 	MAR 1 7 2618 	J 	(Auth: 	HRS 	§§323D-12, 	323D-
18 .5, 	323D-62, 	487N-1; 	45 	C.F.R. 	part 	164) 	(Imp: 	HRS
§§323D-12, 	323D-18. 5)
§11-188-24 	Health 	Insurance 	Portability 	and
Accountability Act. 	The 	agency, 	the 	agency's
designees, 	and 	any 	recipient 	of 	data, 	such 	as
subcontractors 	and 	business 	associates, 	shall 	comply
with 	the 	applicable 	Health 	Insurance 	Portability and
Accountability Act's 	security, 	privacy, 	and
confidentiality 	rules, 	including 	uses 	and 	disclosures
required 	by 	law, 	public 	health 	activities, 	and 	health
oversight 	activities, 	and 	shall 	not 	disclose 	any
individual 	patient's 	personal 	health 	information 	or
personal 	identifiers 	in violation 	of 	state 	or 	federal
law. 	[Eff 	MAR 1 7 2818 	J 	(Auth: 	HRS 	§§323D-12,
323D-18.5, 	323D-62; 	45 	C.F.R. 	Part 	160, 	45 	C.F.R. 	Part
164) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
§11-188-25 	Identifiers. 	The 	agency, 	the 	agency's
designees, 	such 	as 	subcontractors 	and 	business
associates 	of 	the 	agency or 	the 	agency's 	designee,
shall 	maintain 	the 	original 	direct 	personal
identifiers 	in 	a 	separate 	database 	that 	is 	not 	linked
with 	any 	other 	data 	and 	shall 	use 	a 	proxy 	or 	encrypted
record 	identifier 	for 	data 	analysis. 	[Eff 	MAR 1 7 ?618
] 	(Auth: 	HRS 	§§323D-12, 	323D-18.5, 	323D-62) 	(Im~:
HRS 	§§323D-12, 	323D-18. 5)
188-20

§11-188-28
§11-188-26 	Re-identification 	of personal 	information.
The 	agency 	and 	the 	agency's 	designees, 	shall 	not
attempt 	to 	re-identify 	subjects 	of 	protected 	health
information 	submitted 	to 	the 	agency 	or 	its 	designee.
[Eff 	MAR 1 7 ~18 	] 	(Auth: 	HRS 	§§323D-12, 	323D-
18. 5, 	32'.3'D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18. 5)
§11-188-27 	Disclosure 	of 	data with 	direct personal
identifiers. 	No 	person 	or 	entity 	shall 	disclose 	data
that 	contain 	direct 	personal 	identifiers. 	No 	report
shall 	include 	a 	cell 	size 	of 	ten 	or 	less 	to 	prevent
the 	re-identification 	of 	individuals. 	[Eff 	MAR 1 7 2018
] 	(Auth: 	HRS 	§§323D-12, 	323D-18. 5, 	323D-62) 	(Imp:
HRS 	§§323D-12, 	323D-18.5)
SUBCHAPTER 	6
MISCELLANEOUS 	PROVISIONS
§11-188-28 	Severability. 	If 	any 	provision 	of 	this
chapter, 	or 	the 	application 	thereof 	to 	any 	person 	or
circumstance 	is 	held 	invalid, 	the 	invalidity 	does 	not
affect 	other 	provisions 	or 	applications 	of 	the 	chapter
which 	can 	be 	given 	effect 	without 	the 	invalid
provision 	or 	application, 	and 	to 	this 	end 	the
provisions 	of 	this 	chapter 	are 	severable." 	[Eff 	MAR 1 7 2018
] 	(Auth: 	HRS 	§§323D-12, 	323D-18.5,
323D-62) 	(Imp: 	HRS 	§§323D-12, 	323D-18.5)
2. 	The 	adoption 	of 	chapter 	11-188, 	Hawaii
Administrative 	Rules, 	shall 	take 	effect 	upon 	the
filing 	with 	the 	Office 	of 	the 	Lieutenant 	Governor;
188-21

provided 	th at 	pursuant 	to 	Sess io n 	Laws 	of 	Hawa ii , 	SLH
2016 , 	Act 	139, 	§3 , 	these 	interim 	rules 	shall 	be
effective 	until 	rules 	are 	adopted 	pursuant 	to 	32 3D-
18.5(e), 	HRS , 	to 	replace 	the 	in ter i m rules .
I 	certify 	that 	the 	adoption 	of 	chapter 	11-188
rules 	shall 	take 	effect 	upon 	fil i ng 	with 	the 	Office 	of
the 	Lieutenant 	Governor .
APPROVED AS 	TO 	FORM:
Atto r ney 	General
Director 	of 	Health
State 	of 	Hawaii
APPROVED :
Governor
State 	of 	Hawai i
Dated : 	D?l-01-~lf:,
Fi l e d
~
CD
..- :J
I
'-
..'
r-
. ,..
--1
..,.
..::
-i
,)
,a
<'"'l
.1:)
,..
u.,;
(/)
188 - 22 	3 25 5