(a) The department shall establish and revise, as appropriate, standards for the approval and operation of statewide and regional health information organizations operating in the state as approved health information organizations including, but not limited to, the following:

(1) Adherence to nationally recognized standards for interoperability, that is, the capacity of two or more information systems to share information or data in an accurate, effective, secure and consistent manner;

(2) adoption and adherence to rules promulgated by the department regarding access to and use and disclosure of protected health information maintained by or on an approved health information organization;

(3) demonstration of adequate financial resources to sustain continued operations in compliance with the standards;

(4) participation in outreach activities for individuals and covered entities;

(5) conduct of operations in a transparent manner to promote consumer confidence;

(6) implementation of security breach notification procedures; and

(7) development of procedures for entering into and enforcing the terms of participation agreements with covered entities which satisfy the requirements established by the department pursuant to Kan. Stat. Ann. § 65-6832, and amendments thereto.

(b) The department shall ensure that approved health information organizations operate within the state in a manner consistent with the protection of the security and privacy of health information of the citizens of Kansas.

(c) No expenditure shall be made from the state general fund for the purposes of administration, operation or oversight of the health information organizations defined in Kan. Stat. Ann. § 65-6821, and amendments thereto, except that the secretary of health and environment may make operational expenditures for the purpose of adopting and administering the rules and regulations necessary to implement the Kansas health information technology act.