14. Does the Data Exchange Framework (DxF) require Disclosure of Personal Health Information (PHI), as defined under Health Insurance Portability and Accountability Act (HIPAA), beyond what was already permitted under HIPAA and the California Confidentiality of Medical Information Act (CMIA)?

No, the DxF does not require any Access, Use, or Disclosure of Health and Social Services Information (HSSI) that would be unlawful. The DxF Data Sharing Agreement (DSA) requires Participants to share HSSI, which includes PHI and medical information, for Required Purposes, which can be found in the Permitted, Required, and Prohibited Purposes Policy and Procedure, and subject to Applicable Law. If sharing HSSI is not permitted under Applicable Law, a Participant must respond to the requestor in accordance with the Requirement to Exchange Health and Social Services Information Policy and Procedure, Section III.1. Refusing to share HSSI because it is unlawful under Applicable Law is not Information Blocking under the California Information Blocking Prohibitions Policy and Procedure.

HCAI encourages Participants to request patient Authorization to share HSSI when possible when Applicable Law does not permit sharing for a Required Purpose in the Permitted, Required, and Prohibited Purposes Policy and Procedure. Nothing in the DxF, DSA, or the Policies and Procedures (P&Ps) limits a patient’s right to decline to sign an Authorization to share their information. When it is unlawful to share information without patient Authorization and the patient did not sign an Authorization, the Participant must not share HSSI under the DxF DSA. In such instances, the DxF Participant would respond to the request for HSSI consistent with Requirement to Exchange Health and Social Services Information Policy and Procedure, Section III.1. All P&Ps listed above can be found on the Policies and Procedures section of the DxF website