101 CMR 20.00 — Health Information Exchange

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

1

Section

20.01: Purpose 20.02: Citation 20.03: General Provisions 20.04: Definitions 20.05: Mass HIway Users and Mass HIway Access 20.06: Provider Organizations 20.07: Opt-in Opt-out Mechanism 20.08: Connecting to the Mass HIway 20.09: Timetable for Connecting to the Mass HIway 20.10: Interoperable Electronic Health Record Systems 20.11: Statewide Event Notification Service Framework 20.12: Right to Audit 20.13: Fees 20.14: Penalties 20.15: Penalty Schedules 20.16: Waivers 20.17: Reconsideration and Appeals Process 20.18: Severability

101 CMR 20.00 Health Information Exchange

20.01 Purpose

20.01: Purpose

101 CMR 20.00 contains the Executive Office of Health and Human Services’ regulations specific to health information technology and the state-sponsored, statewide health information exchange (HIE), which is known as the Mass HIway. The Secretariat also publishes other documents affecting health information technology and the Mass HIway, including, but not limited to, statements of policy and procedure, conditions of participation, guidelines, and bulletins.

20.02 Citation

20.02: Citation

101 CMR 20.00 shall be known, and may be cited, as the "Mass HIway Regulations."

20.03 General Provisions

20.03: General Provisions

(1) Scope. 101 CMR 20.00 governs participation in the Mass HIway and related health information technology.

(2) Administrative Bulletins. EOHHS may issue administrative bulletins to clarify its policy on substantive provisions of 101 CMR 20.00.

(3) Mass HIway Policies and Procedures. The Mass HIway Policies and Procedures, as updated from time to time, are applicable to all Mass HIway users. They include detailed policies and procedures, conditions for participation, and fees associated with the Mass HIway.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

2

20.04 Definitions

20.04: Definitions

As used in 101 CMR 20.00, unless the context requires otherwise, terms have the following meanings.

Admission Discharge and Transfer Messages (ADTs). Types of messages that can track a patient’s transitions in or out of a site of care such as admissions, discharges, or transfers. The focus of ADT messages is to convey data related to patient demographics and/or to health care encounters.

Business Associate. Has the meaning assigned to it in 45 CFR 160.103 (Health Insurance Portability and Accountability Act (HIPAA) regulations).

Certified Event Notification Service Vendor or Certified ENS Vendor. An ENS vendor that is certified by EOHHS.

Director the Direct Standard. Refers to the specifications developed by the direct project, a nationally recognized organization that develops specifications for a secure, scalable, standards- based way to establish universal health addressing and transport for participants (including providers, laboratories, hospitals, pharmacies, and patients) to send encrypted health information directly to cryptographically validated recipients over the Internet. For purposes of 101 CMR 20.00, references to direct, the direct standard, or the direct project will include any other national, open, industry standard supported by the Mass HIway.

Electronic Health Record (EHR). A digital version of a patient's paper chart. EHRs are real-time, patient-centered records that make information available instantly and securely to authorized users, often including a patient's medical history, diagnoses, medications, treatment plans, immunization dates, allergies, radiology images, and/or laboratory and test results. EHR systems are able to share patient information with other authorized health care providers and organizations.

ENS Recipient. A provider that has a contractual relationship, including, but not limited to, a business associate agreement, with a certified ENS vendor(s) for treatment or care coordination in accordance with 101 CMR 20.11.

EOHHS. The Executive Office of Health and Human Services established under M.G.L. c. 6A.

Event Notification Service (ENS). A service that provides real-time alerts about certain patient medical service encounters, for example, at the time of hospitalization, to a permitted recipient with an existing treatment relationship to the patient, such as a primary care provider.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

3 Health Information Exchange (HIE). The transmission of healthcare-related data among providers and payers of personal health records according to national standards; the reliable and secure transfer of data among diverse systems and access to and retrieval of data. HIE incorporates many forms of communication methods including, but not limited to: (a) directed exchanges, (b) queried exchanges, and (c) consumer exchanges. The Mass HIway operates a statewide health information exchange in accordance with M.G.L c. 118I and 101 CMR 20.00. More detailed information regarding the functions and services provided by the Mass HIway can be found in the Mass HIway Policies and Procedures.

Health Information Service Provider (HISP). (a) HISP. An entity that, as part of or all of its business, performs the following:

1. verifies participant identities;
2. issues and manages security keys;
3. issues direct addresses; and
4. processes messages to and from those addresses using the direct standard. (b) HIway Trusted HISP. A HISP with which the Mass HIway has a direct contractual arrangement, or a HISP that belongs to a third-party organization that acts as a trust framework aggregator with which the Mass HIway has a direct contractual arrangement, to securely exchange Direct Messages, through a means typically referred to as a HISP-to-HISP connection. (c) HISP-to-HISP Connection. A technical connection between two or more HISP systems for the purpose of delivering Direct Messages to and from authorized participants of the HISPs that contains clinical or administrative health information about a specific patient. Contractual agreements establish the HISP-to-HISP terms and may be between two HISPs or may be between a HISP and a third-party organization that acts as a trust framework aggregator.

HIway Direct Messaging. A secure method for Mass HIway users, including provider organizations, to transmit a message with information about a patient to other users, where the Mass HIway does not analyze, use, or share the contents of the message except as required to deliver it and to make it available for use by the intended recipient. HIway Direct Messaging follows the direct standard for encryption technology, or its successor standard, and provides a more secure method of transmitting information than other modes of transmission such as sending a fax, or sending information by postal mail.

HIway-facilitated Service. A service whereby the Mass HIway creates a framework for protected health information exchange through governance, promotion, certification, and/or contracts with a vendor or vendors to support treatment or care coordination.

HIway-sponsored Service. A service for HIway participants whereby the Mass HIway operates and manages a technology platform that allows the HIway to use, analyze, and/or share protected health information and/or personally identifiable information on behalf of participants.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

4 Mass HIway Integrator. An organization that connects HIway participants to the Mass HIway. Mass HIway integrators are business associates of participants and may include electronic health record (EHR) vendors, technical integrators, and regional health information organizations (RHIOs). Mass HIway integrators use Mass HIway for HISP services.

Mass HIway User. A user includes: (a) HIway Participant. A provider organization, a health plan, or a business associate of either a provider organization or health plan or other entity approved by EOHHS. HIway participants must execute a Participation Agreement. (b) Non-participant User. An organization that is granted access to the Mass HIway through a HIway trusted HISP.

Patient Matching Process. A certified ENS vendor’s proprietary algorithmic process(es) used to match ADTs with patients.

Reflection or Reflect. The process certified ENS vendors use to disclose ADTs with all other certified ENS vendors for treatment or care coordination.

Statewide Event Notification Service (ENS) Framework. An event notification service framework created as a HIway-facilitated service by the EOHHS under 101 CMR 20.11.

Trust Framework Aggregator. A trust framework aggregator manages a bundle of security certificates, or "Trust Anchors," to facilitate interoperable direct exchange between HISPs in a uniform and scalable manner that is consistent with industry best practices for security and trust, thereby avoiding the need for further one-off negotiations between relying parties who are participants in the bundle.

Use Case. A narrative that describes how to accomplish a business goal and sets forth the functional requirements including scope of the activity, people and organizations involved, expected inputs and data, processing steps, and anticipated results. The use case informs the technical and process planning for development of a solution, and can be implemented between two provider organizations or multiple provider organizations based on the business need, clinical workflows, and technical and operational readiness. Categories of use cases will be detailed in the Mass HIway Policies and Procedures as updated from time to time, and may include, but not be limited to, the following categories: (a) Provider-to-provider Communications; (b) Payer Case Management; (c) Quality Reporting; and (d) Public Health Reporting.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

5

20.05 Mass HIway Users and Mass HIway Access

20.05: Mass HIway Users and Mass HIway Access

(1) Users. (a) HIway Participants.

1. All HIway participants must sign a Participation Agreement and agree to the terms of the Mass HIway Policies and Procedures.
2. A HIway participant may connect to the Mass HIway with the help of a Mass HIway integrator.
3. A HIway participant is issued a domain and direct addresses by Mass HIway or by a HIway trusted HISP.
4. A HIway participant and its authorized personnel may be listed in the Mass HIway statewide provider directory.
5. A Mass HIway user must become a HIway participant to be able to connect directly to the Mass HIway and use the Mass HIway as its HISP.
6. HIway-sponsored services are restricted to HIway participants, regardless of whether the HIway participant connects directly to the Mass HIway or via a HIway trusted HISP. (b) Nonparticipant Users.
7. A nonparticipant user must sign a Business Associate Agreement and/or other agreement with a HIway trusted HISP, as required by the HISP to fulfill its obligations under its contractual agreement with the Mass HIway.
8. A nonparticipant user is issued a domain and direct addresses by the HIway trusted HISP.
9. A nonparticipant user is able to send messages to and receive messages from HIway participants via the HIway trusted HISP and the Mass HIway.
10. The Mass HIway does not perform message transformation on messages received from non-participant users.
11. Nonparticipant users do not have access to HIway-sponsored services.
12. Nonparticipant users are subject to the Mass HIway Policies and Procedures.

(2) HIway Trusted HISPs. (a) To become a HIway trusted HISP, a HISP must execute a HISP-to-HISP agreement with the Mass HIway or must execute a direct contract with a third-party organization that acts as a trust framework aggregator with which the Mass HIway also has a direct contractual arrangement. (b) A HIway trusted HISP must process HIway Direct Messages between its non-participant users and HIway participants in accordance with its contractual agreements.

(3) Access. (a) Provider organizations are required to meet the requirement to connect to the Mass HIway that is described in 101 CMR 20.08. (b) Other categories of eligible Mass HIway users may connect to the Mass HIway. (c) Use of the Mass HIway is limited to exchanges of health information that are allowed or required by law. Unauthorized access to or disclosure of individually identifiable patient health information by or through the Mass HIway is prohibited, and violators may be subject to any penalties established under applicable state or federal law regarding the protection and privacy of personal information. The obligations of HIway users in the case of a security breach involving the Mass HIway are further described in the Mass HIway Policies and Procedures.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

6

20.06 Provider Organizations

20.06: Provider Organizations

The requirement that all providers must connect to the Mass HIway applies to provider organizations. Provider organizations include, but are not limited to, acute care hospitals, community health centers, and medical ambulatory practices, which are defined as:

(1) Acute Care Hospital. A hospital licensed under M.G.L. c. 111, § 51, and the teaching hospital of the University of Massachusetts Medical School, which contains a majority of medical-surgical, pediatric, obstetric, and maternity beds, as defined by the department. Hospitals that meet this definition of acute care hospital can be found in the Massachusetts Licensed or Certified Health Care Facility/Agency Listing, which is maintained by the Department of Public Health and is publicly available on the Department of Public Health's website.

(2) Community Health Center. (a) An organization that is either:

1. A "Federally Qualified Health Center" or a "Federally Qualified Health Center look- alike" as defined by the federal Department of Health and Human Services Health Resources and Services Administration (HRSA) and operating in conformance with Section 330 of United States Public Law 95-626; or
2. An organization that files cost reports as a community health center, as requested by the Health Policy Commission within the Executive Office for Administration and Finance. (b) For the purposes of 101 CMR 20.00, the following definitions of large and small community health centers apply:
3. Large Community Health Center: A community health center where ten or more licensed providers participate in providing health care for patients.
4. Small Community Health Center: A community health center where fewer than ten licensed providers participate in providing health care for patients. (c) In Community Health Center, licensed providers are limited to include medical doctors, doctors of osteopathy, nurse practitioners, or physician assistants.

(3) Medical Ambulatory Practice. (a) An organization in Massachusetts that includes licensed providers who provide primary or specialty outpatient health care services to patients. In a medical ambulatory practice, licensed providers are limited to include medical doctors, doctors of osteopathy, nurse practitioners, or physician assistants. Medical Ambulatory Practice does not include Community Health Center, as defined in 101 CMR 20.06(2), and does not include ambulatory practices whose primary purpose is to provide behavioral health services. In a medical ambulatory practice, "outpatient health care services" are defined as health care services that do not require an overnight stay. (b) For the purposes of 101 CMR 20.00, the following definitions of large and medium medical ambulatory practices apply:

1. Large Medical Ambulatory Practice. A medical ambulatory practice where more than 50 licensed providers participate in providing health care for patients.
2. Medium Medical Ambulatory Practice. A medical ambulatory practice where ten to 50 licensed providers participate in providing health care for patients.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

7 3. Small Medical Ambulatory Practice. A medical ambulatory practice where fewer than ten licensed providers participate in providing health care for patients. Small medical ambulatory practices includes medical ambulatory practices where only one licensed provider participates in providing health care for patients.

(4) For the purposes of 101 CMR 20.00, the applicability of the provider organization definitions shall be determined by calculating the number of licensed providers that provide health care services to patients on behalf of the provider organization in the month of June prior to that organization’s initial required connection date to the Mass HIway, regardless of employment status.

(5) EOHHS may issue administrative bulletins or other issuances to define and describe additional types of provider organizations.

20.07 Opt-in Opt-out Mechanism

20.07: Opt-in Opt-out Mechanism

(1) HIway Direct Messaging. Mass HIway users may transmit information via HIway Direct Messaging provided that all such transmissions shall be in compliance with applicable federal and state privacy laws and implementing regulations. Mass HIway users may implement local opt-in and/or opt-out process that applies to the use of HIway Direct Messaging by their organization, but are not required to do so.

(2) HIway-facilitated Services. HIway-facilitated services must be used in compliance with applicable federal and state privacy laws and implementing regulations. Provider organizations may implement local opt-in and/or opt-out processes that apply to the use of HIway-facilitated services by their organization, but are not required to do so.

(3) HIway-sponsored Services. (a) Opt-in. HIway participants must provide each patient and/or their legal representatives with written notice of how the organization uses HIway-sponsored services.

1. Written notice shall be provided by at least one of the following methods:
   1. inclusion in the HIway participant's privacy notice;
   2. patient handout; or
   3. letter, email, or other personal electronic communication to patients.
2. Written notice must be available in languages as established by EOHHS and described in the Mass HIway Policies and Procedures.
3. The written notice must describe the manner and means that the patient can opt-out of HIway-sponsored services. (b) Opt-out. The Mass HIway or its designee administers a centralized opt out system. Patients and/or their authorized designees may notify the Mass HIway or its designee directly if they choose to opt-out. A HIway participant that has an established relationship with a patient must notify the Mass HIway that the patient has decided to opt-out and/or provide written instructions to its patients on how a patient or their authorized designees can notify the Mass HIway or its designee of the patient’s choice to opt-out. Such notifications shall be made in the form and format determined by the Mass HIway and detailed in the Mass HIway Policies and Procedures.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

8 (c) Local Opt-in Opt-out. In addition to the opt-in opt-out provisions described in 101 CMR 20.07(2)(a) and (b), HIway participants may choose to implement their own local opt-in and/or opt-out process that applies to the use of HIway-sponsored services by their organization, but are not required to do so. If a HIway participant does implement a local process that applies to HIway-sponsored services, it must supplement the opt-in opt-out provisions described in 101 CMR 20.07(2)(a) and (b), and shall not replace 101 CMR 20.07(2).

20.08 Connecting to the Mass HIway

20.08: Connecting to the Mass HIway

(1) Provider Organizations. (a) The requirement that all providers shall connect to the Mass HIway applies to the following provider organizations.

1. Acute care hospitals
2. Community health centers (large and small)
3. Medical ambulatory practices (large and medium) (b) EOHHS may issue administrative bulletins or other issuances establishing Mass HIway connection dates for additional provider organizations. Such guidance will provide at least one year for affected provider organizations to connect to the Mass HIway.

(2) Health Care Systems with Multiple Provider Organizations. For health care systems that comprise multiple provider organizations, the requirements in 101 CMR 20.00 apply to provider organizations as they are defined in 101 CMR 20.04. For example, if a health care system is comprised of multiple acute care hospitals and multiple medical ambulatory practices, then each acute care hospital within that health care system is required to meet the Mass HIway connection requirements for acute care hospitals described in 101 CMR 20.08(3) and (4), and each medical ambulatory practice within that health care system is required to meet the Mass HIway connection requirement for medical ambulatory practices described in 101 CMR 20.08(3).

(3) Connection Requirement for All Provider Organizations. (a) All provider organizations that have required Mass HIway connection dates specified in 101 CMR 20.09 or in a subsequent administrative bulletin or other issuance, shall meet the M.G.L. c. 118I, § 7 requirement to connect to the Mass HIway by sending and receiving HIway Direct Messages. (b) The requirement to connect to the Mass HIway by sending and receiving HIway Direct Messages shall be under the following phased-in timeline.

1. Year 1. The provider organization shall send or receive HIway Direct Messages for at least one use case. The use case may be within any category of use cases.
2. Year 2. The provider organization shall send or receive HIway Direct Messages for at least one use case that is within the provider-to-provider communications category of use cases.
3. Year 3. The provider organization shall send HIway Direct Messages for at least one use case that is within the provider-to-provider communications category of use cases. The provider organization shall also receive HIway Direct Messages for at least one use case that is within the provider-to-provider communications category of use cases. One of these two use cases may be the use case that was used to meet the Year 2 requirement.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

9 4. Year 4. The provider organization may be subject to penalties, as described in 101 CMR 20.13, if that organization has not met the requirements established in 101 CMR 20.08(3). (c) Sending or receiving HIway Direct Messages for any category of use case in Years 1, 2, and 3 is fulfilled by a provider organization consistently using HIway Direct Messaging for that use case when it is appropriate to do so. (d) Provider organizations must submit to EOHHS a use case narrative outlining how the Year 1, Year 2, and Year 3 requirements have been fulfilled in accordance with 101 CMR 20.08(3)(b)through (c). Use case examples and submission requirements are established in the Mass HIway Policies and Procedures. (e) 101 CMR 20.09 provides the dates for Year 1, Year 2, Year 3, and Year 4, for different provider organizations.

(4) Connection Requirement for Acute Care Hospitals. (a) In addition to the requirement to connect to the Mass HIway by sending and receiving HIway Direct Messaging, as described in 101 CMR 20.08(3), acute care hospitals must disclose all, consistent with their obligations under 101 CMR 20.07, and federal and state privacy laws including, but not limited to HIPAA, 42 CFR Part 2, Human Immunodeficiency Virus, and genetic testing, ADTs or equivalent messages regarding emergency department visits and hospital admissions, discharges and transfers to at least one certified ENS vendor within the statewide event notification service framework; the recipient certified ENS vendor(s) must then reflect ADTs to all certified ENS vendors for purposes of treatment or care coordination by ENS recipients. (b) Acute care hospitals must meet the requirement in 101 CMR 20.08(4)(a) by January 1, 2020. (c) If an acute care hospital implements a local opt-in or local opt-out process that limits ADTs that are sent to the statewide event notification service, that provider organization must actively educate staff and inform patients about the purpose of utilizing an event notification service, and report metrics in form and format required in the Mass HIway Policies and Procedures. (d) Penalties for not complying with 101 CMR 20.08(4)(a) through (c) take effect on July 1, 2020.

20.09 Timetable for Connecting to the Mass HIway

20.09: Timetable for Connecting to the Mass HIway

Schedule A: Timetable for Connecting to the Mass HIway by sending and receiving HIway Direct Messages Provider Organization Year 1 Year 2 Year 3 Year 4 Acute Care Hospitals February 10, 2017 January 1, 2018 January 1, 2019 January 1, 2020

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

10 Large and Medium Medical Ambulatory Practices January 1, 2018 January 1, 2019 January 1, 2020 January 1, 2021 Large Community Health Centers January 1, 2018 January 1, 2019 January 1, 2020 January 1, 2021 Small Community Health Centers January 1, 2019 January 1, 2020 January 1, 2021 January 1, 2022

(1) The definition of acute care hospitals is provided in 101 CMR 20.06(1).

(2) The definition of large, medium, and small medical ambulatory practices is provided in 101 CMR 20.06(3).

(3) The definition of large and small community health centers is provided in 101 CMR 20.06(2).

(4) As described in 101 CMR 20.08(4)(b), acute care hospitals must meet the requirement of 101 CMR 20.08(4)(a) by January 1, 2020.

20.10 Interoperable Electronic Health Record Systems

20.10: Interoperable Electronic Health Record Systems

(1) Achieving Interoperability via Implementing HIway Direct Messaging. As of February 10, 2017, provider organizations that have dates for connecting to the Mass HIway must establish interoperability by implementing HIway Direct Messaging. The methods by which provider organizations may implement HIway Direct Messaging are specified in the Mass HIway Policies and Procedures.

(2) Reporting Implementation of an EHR. (a) As of February 10, 2017, provider organizations that have dates for connecting to the Mass HIway must submit information regarding:

1. whether or not they have an EHR; and
2. how their EHR, if any, connects to the Mass HIway. (b) The submission must be in the form and format required, and in accordance with the schedule established in the Mass HIway Policies and Procedures.

20.11 Statewide Event Notification Service Framework.

20.11: Statewide Event Notification Service Framework.

(1) General. The statewide event notification service framework is a HIway-facilitated service composed of EOHHS-certified ENS vendors. Certified ENS vendors must: (a) collect ADT feeds from required submitters, (b) reflect ADT feeds to all other certified ENS vendors;

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

11 (c) conduct a patient matching process with the ADT feeds; and (d) produce notifications to their respective ENS subscribers in a secure method that protects patient privacy in accordance with applicable state and federal law.

(2) ENS Certification Process. EOHHS sets reasonable objective criteria, including applicable privacy and security standards for certified ENS vendors. The certification will be for a term as specified in the certification process but in no event for more than three years, at which time the term may be renewed upon successful recertification.

(3) Reflect ADTs. A certified ENS vendor must reflect ADTs to all other certified ENS vendors for the purposes of treatment or care coordination by ENS recipients. (a) Certified ENS vendors must match all inbound reflected ADTs using their patient matching process to determine positive or negative matches. (b) All inbound reflected ADTs that achieve a positive result in the patient matching process must be routed to the appropriate ENS recipients in accordance with the contract between the ENS vendor and ENS recipient. (c) All inbound reflected ADTs that achieve a negative result in the patient matching process must be destroyed in accordance with the requirements of the certification process; however, a record of the transaction must be kept, as required, to meet minimal audit standards and retention periods for audit purposes consistent with 45 CFR § 164.312(b). Certified ENS vendors must keep a log of inbound reflected ADTs in auditable information.

(4) Data Security. Data shall be transmitted and held in accordance with industry-accepted practices, which at a minimum shall include the Health Insurance Portability and Accountability Act (HIPAA) Rules, and any other requirements EOHHS may deem necessary for certification.

(5) Audit Rights. EOHHS retains the right to conduct data integrity, privacy, and security audits of certified ENS vendors to comply with the framework of 101 CMR 20.12. EOHHS, upon finding unauthorized access or disclosure of data, may suspend the certification until corrective action is taken, and/or rescind the certification.

20.12 Right to Audit

20.12: Right to Audit

(1) EOHHS may audit provider organizations on a periodic basis in order to confirm compliance with the requirements set forth in 101 CMR 20.00.

(2) Audits will be limited only to such records, personnel, and other resources as EOHHS determines are necessary to assure compliance with the requirements set forth in 101 CMR 20.00.

(3) Audits will take place during normal business hours and at mutually agreeable times.

20.13 Fees

20.13: Fees

(1) Fees for using the Mass HIway apply to HIway participants and are defined in the "Participation Fees" section of the Mass HIway Policies and Procedures, as updated from time to time.

(2) Participant fees are established at different tiers for different categories of HIway participants.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

12

(3) The Mass HIway does not charge any fees to HISPs for providing HISP-to-HISP connections, and does not pay any fees to HISPs for providing HISP-to-HISP connections.

(4) The Mass HIway does not charge any fees to nonparticipant users for their use of HIway Direct Messaging.

20.14 Penalties

20.14: Penalties

As required by M.G.L. c. 118I, § 8, penalties for noncompliance with the requirement to connect to the Mass HIway may be assessed by EOHHS. If a provider organization does not connect to the Mass HIway by the dates stated in 101 CMR 20.09, then the provider organization may be subject to penalty. The penalty schedules are found in 101 CMR 20.15.

20.15 Penalty Schedules

20.15: Penalty Schedules

Schedule B: Penalties for not connecting to the Mass HIway via exchanging HIway Direct Messaging Provider Organization* Penalty Acute Care Hospital • At the Year 1 required connection date: $0 • At the Year 2 and Year 3 dates: $0 • At the Year 4 date (i.e., January 2020): $30,000 per year Large Medical Ambulatory Practice • At the Year 1 required connection date (i.e., January 2018): $0 • At the Year 2 and Year 3 dates: $0 • At the Year 4 date (i.e., January 2021): $20,000 per year Medium Medical Ambulatory Practice • At the Year 1 required connection date (i.e., January 2018): $0 • At the Year 2 and Year 3 dates: $0 • At the Year 4 date (i.e., January 2021): $5,000 per year Large Community Health Center • At the Year 1 required connection date (i.e., January 2018): $0 • At the Year 2 and Year 3 dates: $0 • At the Year 4 date (i.e., January 2021): $5,000 per year Small Community Health Center • At the Year 1 required connection date (i.e., January 2019): $0 • At the Year 2 and Year 3 dates: $0 • At the Year 4 date (i.e., January 2022): $1,000 per year

• Definitions of provider organizations are provided in 101 CMR 20.06.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

13 Schedule C: Penalties for Acute Care Hospitals that do not meet the ADT submission requirement Provider Organization Penalty Acute Care Hospital • July 1, 2020: $30,000 per year

20.16 Waivers

20.16: Waivers

(1) Waiver Criteria. EOHHS may grant a waiver of the requirement to connect to the Mass HIway for the following situations. (a) The provider organization does not have internet access or a computer. (b) The provider organization does not have broadband internet access. (c) The provider organization is unable to meet the requirement to connect to the Mass HIway due to a catastrophic event (such as a natural disaster that damages the organization's health information technology infrastructure), or due to an extenuating circumstance. (d) The provider organization is unable to meet the requirement to fully implement a use case of sending and receiving HIway Direct Messages within the use case category of provider-to- provider communications, but the provider organization does meet the following criteria.

1. The provider organization must be able to demonstrate the technical capability to send and receive HIway Direct Messages with a HIway participant in order to demonstrate achieving a basic level of interoperability with provider organizations that use the Mass HIway as their HISP;
2. The provider organization successfully implements provider-to-provider Direct Messaging outside of the Mass HIway (e.g., using a non-Mass HIway HISP); and
3. The provider organization does not have any trading partners on the Mass HIway to implement a use case within the use case category of provider-to-provider communications. (e) The provider organization does not have the capability to send ADT feeds. (f) The provider organization has presented a compelling rationale for a waiver that EOHHS, in its discretion, may consider.

(2) Waiver Duration. An approved waiver is valid for 24 months from the date of issue. Provider organizations that continue to experience circumstances that require a waiver must apply for another waiver at least 30 days before the expiration of their current waiver in order to avoid a penalty.

(3) Waiver Request Review Process. After review of a provider organization’s request for a waiver, the Mass HIway will notify the provider organization in writing of its decision. If the waiver request is incomplete, the Mass HIway will ask the provider organization for more information. If the provider organization does not submit the requested information to the Mass HIway within 60 days of the request, then the Mass HIway will deny the waiver request. Denial of a waiver request is not subject to appeal, but a provider organization may reapply for a waiver with new or additional information.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

14

20.17 Reconsideration and Appeals Process

20.17: Reconsideration and Appeals Process

(1) Applicability. The provisions set forth in 101 CMR 20.17 establish EOHHS’s review process for provider organization disputes concerning penalties associated with the requirement to connect to the Mass HIway as established by M.G.L c. 118I and 101 CMR 20.08.

(2) Notice of Penalties. EOHHS will notify the provider organization in writing of EOHHS's determination of the provider organization’s failure to comply with the requirements to connect to the Mass HIway as established by 101 CMR 20.08. The notice will identify the penalty a provider organization must pay and identify the provider organization’s right to review. EOHHS will notify the provider organization by letter, report, computer printout, electronic transmission, or other format. This notification is the Mass HIway Notice of Penalties.

(3) Requesting EOHHS Review of Penalties for Failure to Connect to the Mass HIway. (a) To preserve its right to an adjudicatory hearing and judicial review, a provider organization must request EOHHS’s review of the determination of a penalty as specified in the notice. A provider organization's request for review may be based on an alleged error in EOHHS’s determination of the provider organization's ability to connect to the Mass HIway as required under 101 CMR 20.08. The provider organization's request for review must be made in writing and be received by EOHHS within 30 calendar days of the date appearing on the Mass HIway Notice of Penalties. (b) A provider organization's request for review may request reconsideration of the provider organization's compliance with its selected use case(s) and penalty amounts. (c) Any request for agency review submitted pursuant to 101 CMR 20.17 must

1. identify with specificity all determinations with which the provider organization disagrees;
2. specify in sufficient detail the basis for the provider organization's disagreement with those determinations;
3. identify and address all issues in the Mass HIway Notice of Penalties with which the provider organization disagrees; and
4. include any documentary evidence and information that the provider organization wants EOHHS to consider.

(4) EOHHS's Final Determination. (a) EOHHS will review a provider organization's request for agency review only if it is submitted in compliance with the requirements of 101 CMR 20.17. EOHHS is not obligated to consider any information or documents that the provider organization failed to timely submit in writing with the request for agency review and received by EOHHS within 30 calendar days of the date appearing on the Mass HIway Notice of Penalties. EOHHS will issue a final written determination of contested penalty assessments based on its review, which will state the reasons for the determination, and inform the provider organization of the provider organization’s right to file a claim for an adjudicatory hearing with the Board of Hearings established under M.G.L. 118E § 48.

Final Adoption October 4, 2019

101 CMR: EXECUTIVE OFFICE OF HEALTH AND HUMAN SERVICES 101 CMR 20.00: Health Information Exchange

15 (b) Any findings specified in the Mass HIway Notice of Penalties that are not specifically identified as in dispute in a provider organization's request for agency review will, without further notice, constitute EOHHS’s final determination. The provider organization has no right to an adjudicatory hearing or judicial review of such findings because of the failure to exhaust its administrative remedies. (c) If the provider organization does not submit a request for agency review, the Mass HIway Notice of Penalties constitutes EOHHS’s final determination. If a provider organization requests agency review but fails to timely comply with the requirements of 101 CMR 20.17, the request for agency review may be denied. In either case, the Mass HIway Notice of Penalties constitutes EOHHS’s final determination, and the provider organization has no right to an adjudicatory hearing pursuant or judicial review because of the failure to exhaust its administrative remedies.

(5) Appeal of EOHHS’s final agency action pursuant to 101 CMR 20.17(4)(a) will be permitted by filing a claim for an adjudicatory hearing with the Board of Hearings and EOHHS within 30 calendar days of the date on the final determination. A claim is considered to be filed on the date that it is actually received by both the Board of Hearings and EOHHS. Failure to file a timely claim will result in implementation of the action identified in the final determination.

20.18 Severability

20.18: Severability

The provisions of 101 CMR 20.00 are severable. If any provision of 101 CMR 20.00 is held invalid or unconstitutional, such determination will not affect the validity or constitutionality of any remaining provisions of 101 CMR 20.00.

REGULATORY AUTHORITY

101 CMR 20.00: M.G.L. c. 118I.