Section 1–133. A. As used in this section:

1. “Health information exchange” means the electronic movement of health-related information among organizations according to nationally recognized standards for purposes including, but not limited to, payment, treatment, and administration; and

2. “Health information exchange organization” means an entity whose primary business activity is health information exchange and which is governed by its stakeholders.

B. The State of Oklahoma:

1. Shall designate a health information exchange organization as the state-designated entity for health information exchange;

2. Shall establish a transition plan to ensure continued operation of the health information exchange; and

3. May temporarily serve as the state-designated entity as part of the transition plan described in paragraph 2 of this subsection.

C. Beginning July 1, 2023, all health care providers as defined by the rules promulgated by the Oklahoma Health Care Authority Board and who are licensed by and located in this state shall may report data to and utilize the state-designated entity. The Office of the State Coordinator for Health Information Exchange may, as provided by rules promulgated by the Board, allow exemptions from the requirement provided by this subsection on the basis of financial hardship, size, or technological capability of a health care provider or such other bases as may be provided by rules promulgated by the Board.

D. 1. A person who participates in the services or information provided by the state-designated entity shall not be liable in any action for damages or costs of any nature that result solely from the person's use or failure to use information or data from the state-designated entity that was entered or retrieved under relevant state or federal privacy laws, rules, regulations, or policies including, but not limited to, the Health Insurance Portability and Accountability Act of 1996.

2. A person shall not be subject to antitrust or unfair competition liability based on participation with the state-designated entity as long as the participation provides an essential governmental function for the public health and safety and enjoys state action immunity.

E. A person who provides information and data to the state-designated entity retains a property right in the information or data, but grants to the other participants or subscribers a nonexclusive license to retrieve and use that information or data under relevant state or federal privacy laws, rules, regulations, or policies including, but not limited to, the Health Insurance Portability and Accountability Act of 1996.

F. Patient-specific protected health information shall only be disclosed in compliance with relevant state or federal privacy laws, rules, regulations, or policies including, but not limited to, the Health Insurance Portability and Accountability Act of 1996.

G. The Oklahoma Health Care Authority Board shall promulgate rules to implement the provisions of this section.