Official website of the State of California
Official website of the State of California
Health and Safety Code (HSC) § 130290, subdivision (b)(1), requires that mandatory signatories to the Data Sharing Agreement (DSA), which includes health insurers and health care service plans, exchange health information or provide access to health information to and from every other mandatory signatory. HSC § 130290(a)(4) defines “health information” for health insurers and health care service plans as, “at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510.” The referenced CMS final rule requires entities to share adjudicated claims, encounter information, and clinical data contained in the US Core Data for Interoperability. (42 C.F.R. § 422.119.)
Note, under the DxF, cost information may be excluded from adjudicated claims and encounter information except for Individual Access Services while retaining the requirement to share adjudicated claims, encounter information, and clinical data without cost information for DxF Participants. (Data Elements to Be Exchanged P&P, Section II.1.iii.)
The Centers for Medicare & Medicaid Services (CMS) rules, and other federal requirements, were considered when drafting the DxF P&Ps.
Both HSC § 130290 and the DxF Data Elements to Be Exchanged P&P require that health plans provide Access to or Exchange of claims, encounter, and clinical information that parallels the data required of plans by the CMS Interoperability and Patient Access Rule. Likewise, DxF requires that health care providers provide Access to or Exchange of the same data (that is, EHI) that is required by federal information blocking, which is in turn already more than that required by the CMS Interoperability and Prior Authorization Final Rule.
Further, the Data Elements to Be Exchanged P&P adopts the same definition of “Maintained” as found in the CMS Interoperability and Patient Access Rule. DxF does require the use of USCDI v2 rather than the USCDI version currently required by CMS rules and ONC.
However, both the CMS Interoperability and Patient Access Rule and the CMS Interoperability and Prior Authorization Final Rule focus on FHIR as the required transport, whereas the DxF Technical Requirements for Exchange P&P requires that all DxF Frequently Asked Questions 25 Last Updated: February 28, 2025 Participants support the same IHE profiles found in eHealth Exchange, Carequality, and TEFCA’s QHIN Technical Framework that are likely already available to many health systems. FHIR is optional, but encouraged, in the Technical Requirements for Exchange P&P.
A Participant is not permitted to Access HSSI for the purpose of selling the information it Accesses or Exchanges, whether the Participant uses its own technology, a QHIO, an Intermediary that has signed the DSA but is not a QHIO, or an Intermediary that has not signed the DSA:
Unless otherwise permitted by Applicable Law or a legally valid agreement, Participants shall not access Health and Social Services Information through the DSA in order to sell such information. (DxF Permitted, Required, and Prohibited Purposes P&P, Section II.3.a.)
Further, while a Participant may de-identify and use HSSI received from another Participant, they may not sell de-identified HSSI when it includes information received from another Participant.
Participant may de-identify and use Health and Social Services Information received from another Participant under the DSA and Use or Disclose such DeIdentified Health and Social Services Information so long as permitted by Applicable Law and consistent with this section…. Participants may not sell deidentified Health and Social Services Information when that de-identified Health and Social Services Information includes information received from another Participant. (DxF Privacy Standards and Security Safeguards P&P, Section III.1.a.ii)
Non-Intermediary Participants are not permitted to charge fees for the Exchange of HSSI for a Required Purpose under the DSA. This is true whether they use their own technology, a QHIO, an Intermediary that has signed the DSA but is not a QHIO, or an Intermediary that has not signed the DSA.
A Participant shall not charge fees to any other Participant for any Exchange of Health and Social Services Information under the Data Exchange Framework for a Required Purpose. (DxF Fees P&P, Section II.1.a.)
All Participants have a duty to respond to requests for HSSI and must fulfill that duty by providing the information in accordance with Applicable Law OR other appropriate response.
All Participants shall respond to requests for Health and Social Services Information made by other Participants and shall share Health and Social Services Information when required under the Permitted, Required, and Prohibited Purposes Policy and Procedure. A Participant shall fulfill its duty to respond by either providing the requested Health and Social Services Information it Maintains in accordance with the Data Sharing Agreement (the “DSA”) and Applicable Law; or… providing an appropriate error message or null response as specified by the technical standard in use and in accordance with the Technical Requirements for Exchange Policy and Procedure. (DxF Requirement to Exchange Health and Social Services Information P&P, Section III.1.a)
Non-Intermediary Participants that use an Intermediary that is not a QHIO to meet DxF requirements must obtain assurances that the Intermediary provides services in such a way as to allow the non-Intermediary Participant to comply with the DSA and its P&Ps, regardless of whether the Intermediary is a DxF Participant or not. This includes obtaining reasonable assurances that the Intermediary meets the non-Intermediary Participant’s duty to respond and does not charge fees to other Participants other than their own contracted client for the Exchange of their HSSI for Required Purpose
If a Participant elects not to execute an agreement with a Qualified HIO and instead elects to use its own technology or to execute an agreement with another entity that provides data exchange, the Participant must comply with or obtain reasonable assurances that the other entity enables the Participant to comply with, the minimum requirements for data exchange set forth in the Policies and Procedures or Specifications. (DxF DSA, Section 7(a).)
Non-Intermediary Participants that choose to execute a contract with an Intermediary to help them meet DxF requirements, however, may be charged fees by that Intermediary, in accordance with the DxF Fees P&P:
A Participant shall not charge fees to any other Participant for any Exchange of Health and Social Services Information under the Data Exchange Framework for a Required Purpose. However, a Participant that is an Intermediary may charge fees to another Participant if the Participant that is an Intermediary has executed a contract with the other Participant to provide services. For contracts to provide services to assist another Participant in meeting its obligations under the Data Sharing Agreement, the fees shall be consistent with Applicable Law, including but not limited to the Fees Exception in the Federal Information Blocking Regulations. (DxF Fees P&P, Section II.1.a.)
The DSA and its P&Ps require that Hospitals and Emergency Departments, and optionally skilled nursing facilities, that are signatories to the DSA send Notification of ADT Events, via a QHIO if they choose, to any authorized organization that is a signatory to the DSA as requested via a roster of Individuals. The QHIO Program requires that QHIOs share rosters of Individuals with the other QHIOs to help facilitate Notification of ADT Events.
The DSA and its P&Ps do not prohibit a QHIO from including the names of Individuals requested by non-signatories on their rosters for Notification of ADT Events.
The DSA and its P&Ps do not prohibit QHIOs from sharing Notifications of ADT Events for Individuals requested by non-signatories, so long as the Disclosure complies with Applicable Law and relevant agreements. The DSA and its P&Ps likewise do not require that a signatory to the DSA send Notifications of ADT Events to non-Participants, whether or not the notifications are facilitated by a QHIO.