State technology contracts would protect data and limit liability

The Department of Management may move money between state agencies when one has too little for legitimate expenses and another has more than it needs. A receiving agency must have a genuine shortage, and a donor agency must have money beyond its needs. Entitlement appropriations are limited to named public defense and family assistance programs. The governor must approve the transfer, and the money must come from the same funding source and fiscal year. Transfers are limited to one-tenth of one percent of all appropriations from that source; transfers to non-entitlement appropriations are barred during regular legislative sessions. The transfer must stay within the same fiscal year.

The Department of Management must use set standards to rank technology projects and report on funded work; Iowa law also sets contract rules for state technology purchases. The project rules concern proposed technology projects seeking money from the technology reinvestment fund. Contract rules cover agreements entered into by the Department of Management or a supported entity. Projects are ranked by factors including readiness, value, public service access, and long-term support. Contracts with the department or a supported entity must follow the stated rules; conflicting prohibited terms are void. The project list guides budget recommendations starting with the fiscal year beginning July 1, 2027. Contract rules apply to contracts entered into or renewed on or after July 1, 2026.

The Department of Management may access specified criminal justice and child welfare records for research and evaluation, and may build systems to share and track case information. The records include juvenile and adult justice, abuse, corrections, parole, probation, and child welfare information; intelligence data and certain police investigation reports are excluded. Federal law may bar access, and the department must follow the confidentiality rules that apply to the original records. If the department lacks money or resources, it may choose which parts, if any, to carry out.

The Department of Management must keep certain communications about security incidents confidential, and it must direct public record requests for stored records to the agency that owns them. These rules concern communications involving the chief information security officer and records the Department of Management stores or processes for another state agency. Security messages may be shared for listed safety, law enforcement, and government briefing purposes; court use requires a protective order. The department's decision that another agency owns a record can be challenged only with clear and convincing evidence.