Handles health records, in Iowa

Iowa Code §§ 228.1 to 228.6 · Read the law's page

• As a mental health professional, a data collector, or an employee or agent of one or of a mental health facility, do not disclose or permit the disclosure of mental health information except as the chapter authorizes (Iowa Code 228.2(1)).
• When you disclose mental health information as the chapter permits, enter a notation with the individual's record stating the date of the disclosure and the name of the recipient, and give the recipient a statement that disclosures may be made only on written authorization or as the chapter provides, that unauthorized disclosure is unlawful, and that civil damages and criminal penalties may apply (228.2(2)).
• If you receive mental health information, do not disclose it further except as the chapter authorizes (228.2(3)).
• To disclose on an individual's consent, use a signed voluntary written authorization that specifies the nature of the information, who may disclose it and the purposes of use, advises of the right to inspect the disclosed information, states the conditions of revocation, specifies how long it is valid and is dated, and give the individual or the individual's legal representative a copy (228.3).
• Stop disclosing under an authorization once you receive the written revocation (228.4).

Iowa Code § 514F.8(2A), added by 2026 Iowa Acts, ch. 1087 (HF 2635) · Read the law's page

• If you are a utilization review organization deciding a prior authorization request for a health care service based on medical necessity, do not use an artificial intelligence-based algorithm or system as the sole basis for your decision to deny, delay, or downgrade the request.

Iowa Code § 228.7 · Read the law's page

• If you are a third-party payor or peer review organization receiving mental health information on the patient's prior written consent, first file with the commissioner of insurance a written statement agreeing to instruct your employees and agents to maintain confidentiality, to comply with the limits on use and disclosure, and to destroy the information when it is no longer needed (Iowa Code 228.7(1)).
• Do not allow an employee or agent to use or disclose mental health information except to administer claims, to conduct a utilization and quality control review, to audit claims paid, or as otherwise authorized by law (228.7(2)(a)).
• If you are a self-insured employer that has not filed the statement, do not grant your employees or agents routine or ongoing access to mental health information unless they have signed a statement that they are aware the information may not be used or disclosed except as the subsection provides and that they are aware of the penalty for unauthorized disclosure (228.7(2)(b)).