MA H1404

Establishes a statewide health information exchange system under the Executive Office of Health and Human Services, requiring all health care entities in Massachusetts to participate and implement fully interoperable electronic health records systems

Creates a 21-member Health Information Technology Council to advise on design, implementation, and operation of the exchange, including representatives from hospitals, physician practices, insurers, nursing, behavioral health, and health IT experts

Guarantees every patient secure electronic access to their health records and provides patients the right to opt-out of having their health data disclosed through the state-operated exchange

Requires compliance with HIPAA and other federal privacy laws, with mandatory breach notification to affected individuals within 10 business days of unauthorized access or disclosure

Authorizes the executive office to collect participant fees from health care entities, prescribe penalties for non-compliance, and exempts cybersecurity documentation from public records disclosure