Official website of the State of California
Official website of the State of California
The DxF requires electronic Exchange of health information. All Participants should review the DxF DSA and its Policies and Procedures to determine what Health and Social Services Information (HSSI) is required to be shared. A Participant may use any health information exchange network, health information organization, or technology to share the HSSI which they Maintain, so long as they are able to comply with the requirements of the DxF DSA and its Policies and Procedures. Participants should consider whether to seek services from a Qualified Health Information Organization, another Intermediary, or another vendor to support electronic Exchange of health information.
The Implementation Toolkit provides step-by-step guidance for health and Social Services entities in California to become active Participants in the Data Exchange Framework.
The Data Exchange Framework (DxF) is not a technology, but instead rules of the road for how organizations will provide Access to and Exchange Health and Social Services information (HSSI). HSSI will not reside on any state DxF system. The Privacy Standards and Security Safeguards Policy and Procedure describes the minimum privacy and security safeguards required by the DxF for Participants to implement. These Policies and Procedures can be found on the Policies and Procedures section of the DxF website.
The DSA permits sharing PHI between a Covered Entity and non-Covered Entity when you have a valid Authorization from the patient or patient’s representative or the Disclosure is otherwise permitted or required by Applicable Law. (See DSA, Section 6(a); Privacy Standards and Security Safeguards Policy and Procedure). For more information on how Covered Entities can share PHI with non-Covered Entities, please see the State Health Information Guidance (SHIG), particularly SHIG Vol. 1.1: Sharing Behavioral Health Information in California, especially Scenario 4, the scenarios in SHIG Vol. 2.0: Sharing Health Information to Address Food and Nutrition Insecurity in California, and the Data Sharing Authorization Guidance (DSAG) Toolkits.
The Privacy Standards and Security Safeguards Policy and Procedure defines a set of requirements for Participants for maintaining and safeguarding data, including:
The Technical Requirements for Exchange Policy and Procedure defines a set of person attributes that must not be included among person attributes for Person Matching unless required by the technical exchange standard or by the Nationwide Network or Framework in use. It further specifies that if Participants use Nationwide Networks or Frameworks or other intermediaries to Exchange HSSI, Participants must follow all applicable law, and conform to the security model and security standards for exchanging information established by that Nationwide Network or Framework.