Pilot program for Indo-Pacific regional medical data sharing

(a) In general The Secretary of Defense shall develop a pilot health information technology platform (in this section referred to as the platform) that can function across military and civilian medical facilities in the United States and foreign countries in the area of operations of the United States Indo-Pacific Command in accordance with the medical readiness program established under section 735 of the Servicemember Quality of Life Improvement and National Defense Authorization Act for Fiscal Year 2025 (Public Law 118–159; 10 U.S.C. 1074 note). (b) Consultation In developing the platform, the Secretary shall consult with the respective stakeholders, including the Commander of United States Indo-Pacific Command, the Assistant Secretary of Defense of Health Affairs, the Director of the Defense Health Agency, the Secretary of Health and Human Services, the Secretary of State, health care providers of the Department of Defense, entities in the business of health data management or maintenance of electronic health records, and other relevant stakeholders in the United States. (c) Lessons learned In developing the platform, the Secretary should consider best practices developed by the European Union in refining the European Union Early Warning and Response System for medical data-sharing to support wounded Ukrainians during the Russian-Ukrainian War. (d) Available patient information The Secretary shall ensure elements of patient information included in the platform are appropriate to support timely medical care for members of the Armed Forces and citizens of the United States located in the Indo-Pacific region in the event of a crisis or conflict. (e) Compliance and security The Secretary will strive to ensure that the platform— (1) is developed with the goal of adhering to applicable privacy and security standards for health information, while establishing a clear framework for data handling that distinguishes between Armed Forces personnel and civilians to ensure appropriate data sharing for military operations and to protect civilian privacy; (2) promotes the secure, seamless, and accurate exchange of critical electronic health information by aligning with modern interoperability standards and discouraging information blocking; (3) incorporates a risk-based approach for health technologies to foster innovation while protecting patient safety; (4) utilizes certified health information technology where feasible to ensure robust privacy and security protections; (5) is usable by health care providers in multiple countries and facilitates the exchange of both structured and unstructured electronic health information in compliance with best cybersecurity practices with respect to maintaining patient privacy and confidentiality, maintaining system integrity, securing individual access through encryption and security, and enhancing data availability, including— (A) the ability to securely aggregate, secure, and exchange information developed and housed on partner systems that do not meet all Department of Defense cybersecurity requirements; and (B) the use of technologies that protect data at rest, in transit, and in use, such as confidential computing, to the maximum extent practicable; (6) establishes shared and documented rules, as part of a defined governance structure, for which and to what extent individuals and entities obtain and maintain access to the platform, which may include— (A) a federated identity, credentialing, and access management system to ensure appropriate personnel from Federal and mission partner entities can securely access information; and (B) a mechanism to adopt and integrate unique patient identifiers used by mission partners to ensure accurate patient tracking, identification, and matching; (7) provides a mechanism by which health data and information of patients are available in multiple languages relevant to the Indo-Pacific region in a timely manner for use in urgent medical care, utilizing structured and computable data formats where feasible; (8) is easily usable by health care providers in multiple countries and facilitates the exchange of both structured and unstructured electronic health information; and (9) can be used in multiple environments, such as across computers, laptops, mobile devices, instances where there is low internet bandwidth, and when in contested environments. (f) Plan (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary shall submit to the Committees on Armed Services of the Senate and the House of Representatives a plan for establishing the platform. (2) Elements The plan submitted under paragraph (1) shall include the following elements: (A) The proposed list of the medical facilities within the Indo-Pacific area of responsibility at which the first iteration of the platform may be used. (B) A working group, including key stakeholders, established to ensure the platform is in pursuit of compliance under subsection (e), and a strategy for managing any necessary exemptions from certain requirements that could otherwise impede patient care during a crisis. (C) A proposed timeline for development and deployment of the platform. (D) A working group established to enable strategy for establishing a data governance structure, a federated identity management system, and a potential unique patient identifier mechanism as described in subsection (e)(6). (g) Report Not later than one year after the deployment of the platform under subsection (f)(2)(C), the Secretary shall submit to the Committees on Armed Services of the Senate and the House of Representatives a report on the performance of the platform and recommendations on further refinement and utility of the platform. The report shall specifically assess the platform’s effectiveness in addressing known interoperability gaps, avoiding blocking information as mandated by the Cures Act, accommodating civilian partner integrations under HIPAA, and overcoming cybersecurity challenges identified in relevant Department of Defense studies.