Cal. Health and Safety Code - HSC § 130290. Section 130290.
(a)
On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California. On or before January 1, 2026, the Department of Health Care Access and Information shall take over the establishment, implementation, and all of the functions related to the California Health and Human
Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the California Health and Human Services Agency.
(1)
The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using a common set of policies and procedures in order to improve the health outcomes of the individuals they serve.
(2)
The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among participants through any health information exchange network, health information organization, or technology that adheres to specified standards and policies.
(3)
The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), Sections 827, 10850, and 14100.2 of the Welfare and Institutions Code, and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden.
(4)
For the purposes of this section, “health information” means:
(A)
For hospitals, skilled nursing facilities, clinical laboratories, and physician organizations and medical groups, all electronic health information
as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity. The information pursuant to this subparagraph shall be at a minimum the information included in Section 171.102 of Title 45 of the Code of Federal Regulations as of April 15, 2025. In accordance with the California Health and Human Services Data Exchange Framework data sharing agreement and policies and procedures, a signatory to the data sharing agreement is not required to share information that is not maintained by the entity.
(B)
For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510 as of April 15, 2025.
(b)
(1)
On or before January 31, 2024, and except as provided in paragraphs (2) to (4), inclusive, the entities listed in subdivision (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the department pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations, except that the health care organizations in subparagraph (C) of paragraph (2) of subdivision (f) and paragraph (7) of subdivision (f) shall exchange or provide access to health information by July 1, 2026.
(2)
The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access
hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026.
(3)
The requirement in paragraph (1) shall not apply to facilities described in subdivision (a) of Section 1180.2 until January 31, 2029.
(4)
The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion, abortion-related services, gender-affirming care, immigration or citizenship status, or place of birth.
(c)
The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development, implementation, and administration of the California Health and Human Services Data Exchange Framework. On or before January 1, 2026, the
department shall take over the responsibilities of the stakeholder advisory group.
(1)
The members of the stakeholder advisory group shall be appointed by the director and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on. The stakeholder advisory group may consider and vote on recommendations for updates to the data sharing agreement and its policies and procedures that the department may, but is not obligated to, enact.
(2)
The director shall appoint to the stakeholder advisory group representatives from health care stakeholders and experts with representation of the following groups:
(A)
State departments and other state entities, including signatories of the California Data Exchange Framework data sharing agreement that
shall serve as ex officio nonvoting members.
(B)
Health care service plans and health insurers.
(C)
Physicians, including those with small practices.
(D)
Hospitals, including public, private, rural, and critical access hospitals.
(E)
Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities.
(F)
Consumers.
(G)
Organized labor.
(H)
Privacy and security professionals.
(I)
Health information technology professionals.
(J)
Community health information organizations.
(K)
County health, social services, and public health.
(L)
Community-based organizations providing social services.
(M)
Skilled nursing facilities.
(N)
Physician organizations and medical groups.
(O)
Management services organizations.
(3)
The stakeholder advisory group shall not exceed 17 voting members and shall maintain a balance of perspectives with not more than 50 percent of voting members who are signatories of the data sharing agreement.
(4)
The
director shall select a chair from amongst the members.
(5)
The stakeholder advisory group shall provide information and advice to the department on health and social services information technology issues, including all of the following:
(A)
Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f).
(B)
Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following:
(i)
Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data.
(ii)
Translation, mapping, controlled vocabularies, coding, and data classification.
(iii)
Storage, maintenance, and management of health information.
(iv)
Linking, sharing, exchanging, and providing access to health information.
(C)
Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information.
(D)
Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity, language, race, and ethnicity.
(E)
Identify ways to incorporate relevant data
on behavioral health, developmental disabilities, and substance use disorder conditions.
(F)
Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack.
(G)
Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health and social services information, including matters of meaningful and informed consent, privacy, confidentiality, identity management, liability and security, and ensure that health and social services information sharing broadly implements national frameworks and agreements.
(H)
Develop definitions of complete clinical, administrative, and
claims data consistent with federal policies and national standards.
(I)
Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs.
(J)
Assess governance structures to help guide policy decisions and general oversight.
(K)
Identify federal, state, private, and philanthropic sources of funding that can support health and social services information exchange.
(6)
On or before January 1, 2027, the stakeholder advisory group shall develop recommendations in consultation with signatories, consumer advocates, and racial equity experts for statutory changes, training and technical assistance, and best practices to require the entities listed in
subdivision (f) to collect individual-level demographic and health-related social needs data about Californians served.
(7)
The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code).
(8)
The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group.
(d)
No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature
based on input from the stakeholder advisory group on the issues identified in paragraph (5) of subdivision (c).
(e)
On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians.
(f)
On or before January 31, 2023, and in alignment with existing federal standards and policies, the
following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a), except that the health care organizations in subparagraph (C) of paragraph (2) and paragraph (7) shall execute the data sharing agreement by July 1, 2026:
(1)
General acute care hospitals, as defined by Section 1250.
(2)
Physician organizations and medical groups, which include any of the following:
(A)
A medical group practice, a professional medical corporation, a medical partnership, or any lawfully organized group of physicians and surgeons that provides, delivers, furnishes, or otherwise arranges for health care services.
(B)
An independent practice association, to the extent that it
maintains electronic health information on behalf of their participating physicians.
(C)
A medical foundation exempt from licensure pursuant to subdivision (l) of Section 1206.
(D)
A community clinic licensed under subdivision (a) of Section 1204, an intermittent clinic exempt from licensure under subdivision (h) of Section 1206, or a rural health clinic, as defined in paragraph (1) of subdivision (l) of Section 1396d of Title 42 of the United States Code.
(E)
A specialty clinic, as described in paragraphs (1) to (3), inclusive, of subdivision (b) of Section 1204.
(F)
An ambulatory surgical center or accredited outpatient setting.
(3)
Skilled nursing facilities, as defined by Section 1250,
that currently maintain electronic health records.
(4)
Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance.
(5)
Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health.
(6)
Acute psychiatric hospitals, as defined by Section 1250.
(7)
Emergency medical services, as defined by Section 1797.72.
(g)
Commencing July 1, 2026, unless already required by an existing contract requirement, including any existing contract requirement that extends to subcontractors and delegates, compliance with subdivision (f) shall be required as a condition of continuing, amending, or entering into a new or existing contract for the coverage of or provision of health care services with the Department of Health Care Services, the Public Employees’ Retirement System, and the California Health Benefit Exchange. This subdivision shall not be construed to prevent any future contract requirement that extends this provision to subcontractors and delegates.
(h)
The department shall work with experienced
nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f).
(i)
On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master person indices to be implemented by both private and public organizations in California.
(j)
For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the department may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section
shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. A person hired or otherwise retained pursuant to this subdivision shall not be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or shall not be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term “person,” as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof.
(k)
(1)
The
department shall administer, manage, oversee, and enforce the California Health and Human Services Data Exchange Framework and its data sharing agreement, including its related policies and procedures, governance, and all other materials or initiatives related to the California Health and Human Services Data Exchange Framework. The department shall propose and publish updates to the framework and new policies and procedures of the framework that are necessary to advance the goals of this section. There shall be at least a forty-five-calendar-day public review period to review updates to the framework and new policies and procedures. The department shall publish approved updates in a publicly accessible format 180 calendar days before the effective date of the amendment, except when a shorter time period is necessary to comply with applicable law.
(2)
Commencing January 1, 2027, the department shall publish and keep current on its internet
website the names of any known entities the department deems not to be in compliance with the requirement to execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (f). Entities may submit to the department a statement of extenuating circumstances which may impact an entity’s ability to come into compliance. The department shall publish these statements on its internet website. The department may submit information regarding compliance with the requirement in subdivision (f) to relevant state licensing entities.
(3)
Upon appropriation and after submission of the report described in paragraph (4), the department may develop enforcement actions subject to the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code).
(4)
In collaboration with
the stakeholder advisory group, the department shall develop and submit a report to the Legislature by July 1, 2027, in compliance with Section 9795 of the Government Code that includes all of the following:
(A)
A list of all entities in paragraphs (1), (3), and (4) of subdivision (f) deemed to be required signatories to the California Health and Human Services Data Exchange Framework data sharing agreement per subdivision (f).
(B)
The status of each entity’s execution of the data sharing agreement.
(C)
The compliance pathway or pathways utilized to meet its contractual requirements under the data sharing agreement, and, where applicable, if the signatory has a contract in place pursuant to subdivision (g).
(D)
An evaluation as to the need for an
independent governing board for the California Health and Human Services Data Exchange Framework.
(E)
An evaluation of the need for technical assistance and other grant programs to support signatories’ legal requirements under the data sharing requirement.
(F)
An evaluation of other categories of entities for participation in the California Health and Human Services Data Exchange Framework.
(G)
An evaluation of the need for a framework for enforcement and investigation and resolution of disputes between California Health and Human Services Data Exchange Framework participants regarding the data sharing agreement and its policies and procedures.
(H)
An assessment of consumer experiences with health and social services information exchange.
(
l
)
Except where otherwise indicated in this section, all actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The department shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework.
(m)
For purposes of this section, both of the following definitions shall apply:
(1)
“Department” means the Department of Health Care Access and Information.
(2)
“Director” means the Director of the Department of Health Care Access and Information.