TRUSTED EXCHANGE FRAMEWORK AND COMMON AGREEMENT

• Citation: 45 CFR Part 172
• Sections: 33

§ 172.100 Basis, purpose, and scope.

(a) Basis and authority. The provisions of this part implement section 3001(c)(9) of the Public Health Service Act.

(b) Purpose. The purpose of this part is to:

(1) Ensure full network-to-network exchange of health information; and

(2) Establish a voluntary process for a Qualified Health Information Network

TM (QHIN

TM ) to attest to adoption of the Trusted Exchange Framework and Common Agreement

TM (TEFCA

TM ).

(c) Scope. This part addresses:

(1) Minimum qualifications needed for a health information network to be Designated as a QHIN capable of trusted exchange under TEFCA.

(2) Procedures governing QHIN Onboarding and Designation, suspension, termination, and further administrative review.

(3) Attestation submission requirements for a QHIN to attest to its adoption of TEFCA.

(4) ASTP/ONC attestation acceptance and removal processes for publication of attesting QHINs in the QHIN Attestation Directory.

§ 172.101 Applicability.

(a) This part applies to Applicant QHINS, QHINs, terminated QHINs, and the Recognized Coordinating Entity.

(b) If any provision of this part is held to be invalid or unenforceable facially, or as applied to any person, plaintiff, or circumstance, it shall be construed to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which case the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances.

§ 172.102 Definitions.

For purposes of this part, the following definitions apply:

Applicable Law. All Federal, State, local, or Tribal laws and regulations then in effect and applicable to the subject matter in this part. For the avoidance of doubt, Federal agencies are subject only to Federal law.

Applicant QHIN. Any organization with a pending QHIN application before the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC).

Business Associate Agreement (BAA). A contract, agreement, or other arrangement that satisfies the implementation specifications described within 45 CFR parts 160 and subparts A, C, and E of 45 CFR part 164, as applicable.

Business day or business days. Monday through Friday, except the legal public holidays specified in 5 U.S.C. 6103 and any day declared to be a holiday by Federal statute or Executive order.

Common Agreement. The most recent version of the agreement referenced in section 3001(c)(9) of the Public Service Health Act as published in the Federal Register .

Confidential Information. Any information that is designated as Confidential Information by the person or entity that discloses it, or that a reasonable person would understand to be of a confidential nature and is disclosed to another person or entity pursuant to TEFCA Exchange. For the avoidance of doubt, “Confidential Information” does not include electronic protected health information (ePHI). Notwithstanding any label to the contrary, “Confidential Information” does not include any information that:

(1) Is or becomes known publicly through no fault of the recipient; or

(2) Is learned by the recipient from a third party that the recipient reasonably believes is entitled to disclose it without restriction; or

(3) Is already known to the recipient before receipt from the discloser, as shown by the recipient's written records; or

(4) Is independently developed by recipient without the use of or reference to the discloser's Confidential Information, as shown by the recipient's written records, and was not subject to confidentiality restrictions prior to receipt of such information from the discloser; or

(5) Must be disclosed under operation of law, provided that, to the extent permitted by Applicable Law, the recipient gives the discloser reasonable notice to allow the discloser to object to such redisclosure, and such redisclosure is made to the minimum extent necessary to comply with Applicable Law.

Connectivity Services. The technical services provided by a QHIN, Participant, or Subparticipant to its Participants and Subparticipants that facilitate TEFCA Exchange and are consistent with the technical requirements of the TEFCA framework.

Covered Entity. Has the meaning assigned to such term at 45 CFR 160.103.

Designated Network. The health information network that a QHIN uses to offer and provide Designated Network Services.

Designated Network Services. The Connectivity Services and/or Governance Services.

Designation (including its correlative meanings “Designate,” “Designated,” and “Designating”). The written determination that an Applicant QHIN has satisfied all requirements and is now a QHIN.

Disclosure (including its correlative meanings “Disclose,” “Disclosed,” and “Disclosing”). The release, transfer, provision of access to, or divulging in any manner of TEFCA Information (TI) outside the entity holding the information.

Electronic Protected Health Information (ePHI). Has the meaning assigned to such term at 45 CFR 160.103.

Exchange Purpose(s) or XP(s). The reason, as authorized by a Framework Agreement, including the applicable standard operating procedure(s) (SOP(s)), for a transmission, Query, Use, Disclosure, or Response transacted through TEFCA Exchange.

Exchange Purpose Code or XP Code. A code that identifies the Exchange Purpose being used for TEFCA Exchange.

Foreign Control. A non-U.S. Person(s) or non-U.S. Entity(ies) having the direct or indirect power, whether or not exercised, to direct or decide matters materially affecting the Applicant's ability to function as a QHIN in a manner that presents a national security risk.

Framework Agreement(s). With respect to QHINs, the Common Agreement; and with respect to a Participant or Subparticipant, the Participant/Subparticipant Terms of Participation (ToP).

Governance Services. The governance functions described in applicable SOP(s), which are performed by a QHIN's Designated Network Governance Body for its Participants and Subparticipants to facilitate TEFCA Exchange in compliance with the then-applicable requirements of the Framework Agreements.

Health information network or HIN. The meaning assigned to it in 45 CFR 171.102.

Individual has the meaning assigned to such term at 45 CFR 171.202(a)(2).

HIPAA. The Health Insurance Portability and Accountability Act of 1996.

HIPAA Privacy Rule. The regulations set forth in 45 CFR part 160 and subparts A and E of 45 CFR part 164.

HIPAA Rules. The regulations set forth at 45 CFR parts 160, 162, and 164.

HIPAA Security Rule. The regulations set forth in 45 CFR part 160 and subparts A and C of 45 CFR part 164.

Individual. Has the meaning assigned to such term at 45 CFR 171.202(a)(2).

Individual Access Services (IAS). The services provided to an Individual by a QHIN, Participant, or Subparticipant that has a direct contractual relationship with such Individual in which the QHIN, Participant or Subparticipant, as applicable, agrees to satisfy that Individual's ability to access, inspect, or obtain a copy of that Individual's Required Information using TEFCA Exchange.

Individually Identifiable Information. Refers to information that identifies an Individual or with respect to which there is a reasonable basis to believe that the information could be used to identify an Individual.

Node. A technical system that is controlled directly or indirectly by a QHIN, Participant, or Subparticipant and that is listed in the RCE Directory Service.

Non-U.S. Entity. Any entity that is not a U.S. Entity.

Non-U.S. Person. Any Individual who is not a U.S. Qualified Person.

Onboarding. The process a prospective QHIN must undergo to become a QHIN and become operational in the production environment.

Organized Health Care Arrangement. Has the meaning assigned to such term at 45 CFR 160.103.

Participant. A U.S. Entity that has entered into the Participant/Subparticipant Terms of Participation in a legally binding contract with a QHIN to use the QHIN's Designated Network Services to participate in TEFCA Exchange in compliance with the Participant/Subparticipant Terms of Participation.

Participant/Subparticipant Terms of Participation (ToP). The requirements to which QHINs must contractually obligate their Participants to agree; to which QHINs must contractually obligate their Participants to contractually obligate their Subparticipants and Subparticipants of the Subparticipants to agree, in order to participate in TEFCA Exchange including the QHIN Technical Framework (QTF), all applicable SOPs, and all other attachments, exhibits, and artifacts incorporated therein by reference.

Qualified Health Information Network ® or QHIN

TM . A Health Information Network that has been so Designated.

Query(s) (including its correlative uses/tenses “Queried” and “Querying”). The act of asking for information through TEFCA Exchange.

Recognized Coordinating Entity® (RCE®). The entity selected by ASTP/ONC that enters into the Common Agreement with QHINs in order to impose, at a minimum, the requirements of the Common Agreement, including the SOPs and the QTF, on the QHINs and administer such requirements on an ongoing basis. The RCE is a Party to the Common Agreement.

Required Information. The Electronic Health Information, as defined in 45 CFR 171.102, that is:

(1) Maintained in a Responding Node by any QHIN, Participant, or Subparticipant prior to or during the term of the applicable Framework Agreement; and

(2) Relevant for a required XP Code.

Responding Node. A Node through which the QHIN, Participant, or Subparticipant Responds to a received transaction for TEFCA Exchange.

Response(s) (including its correlative uses/tenses “Responds,” “Responded” and “Responding”). The act of providing the information that is the subject of a Query or otherwise transmitting a message in response to a Query through TEFCA Exchange.

Subparticipant: a U.S. Entity that has entered into the Participant/Subparticipant Terms of Participation in a legally binding contract with a Participant or another Subparticipant to use the Participant's or Subparticipant's Connectivity Services to participate in TEFCA Exchange in compliance with the Participant/Subparticipant Terms of Participation.

TEFCA Dispute Resolution Process. An informal, non-binding process under TEFCA through which QHINs can meet, confer, and seek to amicably resolve disputes.

TEFCA Exchange. The transaction of information between Nodes using an XP Code.

TEFCA Information or TI. Any information that is transacted through TEFCA Exchange except to the extent that such information is received by a QHIN, Participant, or Subparticipant that is a Covered Entity, Business Associate, or non-HIPAA entity that is exempt from compliance with the Privacy section of the applicable Framework Agreement and is incorporated into such recipient's system of record, at which point the information is no longer TEFCA Information with respect to such recipient and is governed by the HIPAA Rules and other Applicable Law.

TEFCA Security Incident. (1) An unauthorized acquisition, access, Disclosure, or Use of unencrypted TEFCA Information using TEFCA Exchange, except any of the following:

(i) Any unintentional acquisition, access, Use, or Disclosure of TEFCA Information by a Workforce Member or person acting under the authority of a QHIN, Participant, or Subparticipant, if such acquisition, access, Use, or Disclosure:

(A) Was made in good faith;

(B) Was made by a person acting within their scope of authority;

(C) Was made to another Workforce Member or person acting under the authority of any QHIN, Participant, or Subparticipant; and

(D) Does not result in further acquisition, access, Use, or Disclosure in a manner not permitted under Applicable Law and the Framework Agreements.

(ii) A Disclosure of TI where a QHIN, Participant, or Subparticipant has a good faith belief that an unauthorized person to whom the Disclosure was made would not reasonably have been able to retain such information.

(iii) A Disclosure of TI that has been de-identified in accordance with the standard at 45 CFR 164.514.

(2) Other security events that adversely affect a QHIN's, Participant's, or Subparticipant's participation in TEFCA Exchange.

Threat Condition. (1) A breach of a material provision of a Framework Agreement that has not been cured within fifteen (15) calendar days of receiving notice of the material breach (or such other period of time to which the Parties have agreed), which notice shall include such specific information about the breach that the RCE has available at the time of the notice; or

(2) A TEFCA Security Incident; or

(3) An event that the RCE, a QHIN, its Participant, or their Subparticipant has reason to believe will disrupt normal TEFCA Exchange, either due to actual compromise of, or the need to mitigate demonstrated vulnerabilities in systems or data, of the QHIN, Participant, or Subparticipant, as applicable, or could be replicated in the systems, networks, applications, or data of another QHIN, Participant, or Subparticipant; or

(4) Any event that could pose a risk to the interests of national security as directed by an agency of the United States government.

Trusted Exchange Framework. The most recent version of the framework referenced in section 3001(c)(9) of the Public Service Health Act published in the Federal Register .

U.S. Entity/Entities. Any corporation, limited liability company, partnership, or other legal entity that meets all of the following requirements:

(1) The entity is organized under the laws of a state or commonwealth of the United States or the Federal law of the United States and is subject to the jurisdiction of the United States and the state or commonwealth under which it was formed;

(2) The entity's principal place of business, as determined under Federal common law, is in the United States; and

(3) None of the entity's directors, officers, or executives, and none of the owners with a five percent (5%) or greater interest in the entity, are listed on the Specially Designated Nationals and Blocked Persons List published by the United States Department of the Treasury's Office of Foreign Asset Control or on the United States Department of Health and Human Services, Office of Inspector General's List of Excluded Individuals/Entities.

U.S. Qualified Person. Those individuals who are U.S. nationals and citizens at birth as defined in 8 U.S.C. 1401, U.S. nationals but not citizens of the United States at birth as defined in 8 U.S.C. 1408, lawful permanent residents of the United States as defined in Immigration and Nationality Act, and non-immigrant aliens who are hired by a U.S. Entity as an employee in a specialty occupation pursuant to an H-1B Visa.

Use(s) (including correlative uses/tenses, such as “Uses,” “Used,” and “Using”). With respect to TI, means the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

§ 172.103 Responsibilities ASTP/ONC may delegate to the RCE.

(a) ASTP/ONC may delegate to the RCE the TEFCA implementation responsibilities specified in the following sections:

(1) Any section(s) of subpart C of this part;

(2) Any section(s) of subpart D of this part;

(3) Section 172.501; and

(4) Section 172.503.

(b) Notwithstanding any delegation, any authority exercised by the RCE under this section is subject to review under subpart F of this part and to any requirement in this part that the RCE receive ASTP/ONC's prior authorization before taking a specific action.

§ 172.200 Applicability.

This subpart establishes Designation qualifications.

(a) Applicant QHIN. An Applicant QHIN must meet all requirements in § 172.201 to be Designated. An Applicant QHIN that proposes to offer Individual Access Services must also meet all requirements in § 172.202 to be Designated.

(b) QHIN. A QHIN must continue to meet all requirements in § 172.201 to maintain its Designation. A QHIN that offers Individual Access Services must also continue to meet all requirements in § 172.202 to maintain its Designation.

(c) Performance of TEFCA Exchange. The Designation qualifications in §§ 172.201 and 172.202 describe certain requirements for Designation.

§ 172.201 QHIN Designation requirements.

(a) Ownership requirements. An entity must:

(1) Be a U.S. Entity;

(2) Not be under Foreign Control.

(b) Exchange requirements. An entity must, beginning at the time of application, either directly or through the experience of its parent entity:

(1) Be capable of exchanging information among more than two unaffiliated organizations;

(2) Be capable of exchanging all Required Information;

(3) Be exchanging information for at least one Exchange Purpose authorized under TEFCA;

(4) Be capable of receiving and responding to transactions from other QHINs for all Exchange Purposes authorized under TEFCA; and

(5) Be capable of initiating transactions for the Exchange Purposes authorized under TEFCA that such entity will permit its Participants and Subparticipants to use through TEFCA Exchange.

(c) Designated Network Services requirements. An entity must:

(1) Maintain the organizational infrastructure and legal authority to operate and govern its Designated Network;

(2) Maintain adequate written policies and procedures to support meaningful TEFCA Exchange and fulfill all responsibilities of a QHIN in this part;

(3) Maintain a Designated Network that can support a transaction volume that keeps pace with the demands of network users;

(4) Maintain the capacity to support secure technical connectivity and data exchange with other QHINs;

(5) Maintain an enforceable dispute resolution policy governing Participants in the Designated Network that permits Participants to reasonably, timely, and fairly adjudicate disputes that arise between each other, the QHIN, or other QHINs;

(6) Maintain an enforceable change management policy consistent with the responsibilities of a QHIN;

(7) Maintain a representative and participatory group or groups with the authority to approve processes for governing the Designated Network;

(8) Maintain privacy and security policies that permit the entity to support TEFCA Exchange;

(9) Maintain data breach response and management policies that support meaningful TEFCA Exchange; and

(10) Maintain adequate financial and personnel resources to support all its responsibilities as a QHIN, including sufficient financial reserves or insurance-based cybersecurity coverage, or a combination of both.

§ 172.202 QHINs that offer Individual Access Services.

The following requirements apply to QHINs that offer Individual Access Services:

(a) A QHIN must obtain express consent from any individual before providing Individual Access Services.

(b) A QHIN must make publicly available a privacy and security notice that meets minimum TEFCA standards.

(c) A QHIN, that is the IAS provider for an Individual, must delete the individual's Individually Identifiable Information maintained by the QHIN upon request by the individual except as prohibited by Applicable Law or where such information is contained in audit logs.

(d) A QHIN must permit any Individual to export in a computable format all of the Individual's Individually Identifiable Information maintained by the QHIN as an Individual Access Services provider.

(e) All Individually Identifiable Information the QHIN maintains must satisfy the following criteria:

(1) All Individually Identifiable Information must be encrypted.

(2) Without unreasonable delay and in no case later than sixty (60) calendar days following discovery of the unauthorized acquisition, access, Disclosure, or Use of Individually Identifiable Information, the QHIN must notify in plain language each Individual whose Individually Identifiable Information has been or is reasonably believed to have been affected by unauthorized acquisition, access, Disclosure, or Use involving the QHIN.

(3) A QHIN must have an agreement with a qualified, independent third-party credential service provider and must verify, through the credential service provider, the identities of Individuals seeking Individual Access Services prior to the Individuals' first use of such services and upon expiration of their credentials.

§ 172.300 Applicability.

This subpart establishes, as to QHINs, the application, review, Onboarding, withdrawal, and redetermination processes for Designation.

§ 172.301 Submission of QHIN application.

An entity seeking to be Designated as a QHIN must submit all of the following information in a manner specified by ASTP/ONC:

(a) Completed QHIN application, with supporting documentation, in a form specified by ASTP/ONC; and

(b) A signed copy of the Common Agreement.

§ 172.302 Review of QHIN application.

(a) ASTP/ONC (or an RCE) will review a QHIN application to determine if the Applicant QHIN has completed all parts of the application and provided the necessary supporting documentation. If the QHIN application is not complete, the applicant will be notified in writing of the missing information within thirty (30) calendar days of receipt of the application. This timeframe may be extended by providing written notice to the Applicant QHIN.

(b) Once the QHIN application is complete, ASTP/ONC (or an RCE) will review the application to determine whether the Applicant QHIN satisfies the requirements for Designation set forth in § 172.201 and, if the Applicant QHIN proposes to provide IAS, the requirements set forth in § 172.202. ASTP/ONC (or an RCE) will complete its review within sixty (60) calendar days of the Applicant QHIN being provided with written notice that its application is complete. This timeframe may be extended by providing written notice to the Applicant QHIN.

(c) Additional information may be requested from the Applicant QHIN while ASTP/ONC (or an RCE) is reviewing the application. The timeframe for responding to the request and the manner to submit additional information will be provided to the applicant and may be extended on written notice to the Applicant QHIN.

(d) Failure to respond to a request within the proposed timeframe or in the manner specified is a basis for a QHIN Application to be deemed withdrawn, as set forth in § 172.305(c). In such situations, the Applicant QHIN will be provided with written notice that the application has been deemed withdrawn.

(e) If, following submission of the application, any information submitted by the Applicant QHIN becomes untrue or materially changes, the Applicant QHIN must notify ASTP/ONC (or an RCE) in the manner specified by ASTP/ONC (or an RCE) of such changes in writing within five (5) business days of the submitted material becoming untrue or materially changing.

§ 172.303 QHIN approval and Onboarding.

(a) An Applicant QHIN has the burden of demonstrating its compliance with all qualifications for Designation in § 172.201 and, if the Applicant QHIN proposes to provide IAS, the qualifications in § 172.202.

(b) If ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) determines that an Applicant QHIN meets the requirements for Designation set forth in § 172.201, and if the Applicant QHIN proposes to provide IAS, the qualifications set forth in § 172.202, then ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will notify the applicant in writing that its application has been approved, and the Applicant QHIN may proceed with Onboarding.

(c) An approved Applicant QHIN must submit a signed version of the Common Agreement within a timeframe set by ASTP/ONC (or an RCE).

(d) An approved Applicant QHIN must complete the Onboarding process, including any tests required to ensure the Applicant QHIN's network can connect to those of other QHINs and other Applicant QHINs, within twelve (12) months of approval of its QHIN application, unless that timeframe is extended in ASTP/ONC's (or an RCE's) sole discretion by up to twelve (12) months.

§ 172.304 QHIN Designation.

(a) If all requirements of the Onboarding process specified in § 172.303 have been satisfied:

(1) The Common Agreement will be countersigned; and

(2) The Applicant QHIN will be provided with a written determination indicating that the applicant has been Designated as a QHIN, along with a copy of the countersigned Common Agreement.

(b) Within thirty (30) calendar days of receiving its Designation, each QHIN must demonstrate in a manner specified by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange.

(c) If a QHIN is unable to complete the requirement in paragraph (b) of this section within the thirty (30)-day period provided, the QHIN must provide ASTP/ONC (or an RCE) with a written explanation of why the QHIN has been unable to complete a successful transaction with all other in-production QHINs within the allotted time and include a detailed plan and timeline for completion of a successful transaction with all other in-production QHINs. ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will review and either approve or reject the QHIN's plan based on the reasonableness of the explanation and the specific facts and circumstances, within five (5) business days of receipt. If the QHIN fails to provide its plan or the plan is rejected, ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will rescind its approval of the application, rescind the QHIN Designation, and deny the application. Within thirty (30) calendar days of end of the term of the plan, each QHIN must demonstrate in a manner specified by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange.

(d) A QHIN Designation will become final sixty (60) days after a Designated QHIN has submitted its documentation that it has completed a successful transaction with all other in-production QHINs.

§ 172.305 Withdrawal of QHIN application.

(a) An Applicant QHIN may voluntarily withdraw its QHIN application by providing written notice in a manner specified by ASTP/ONC (or an RCE).

(b) An Applicant QHIN may withdraw its QHIN application at any point prior to Designation.

(c) Upon written notice to the Applicant QHIN, a QHIN application may be deemed withdrawn by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) as a result of the Applicant QHIN's failure to respond to requests for information from ASTP/ONC (or an RCE).

§ 172.306 Denial of QHIN application.

If an Applicant QHIN's application is denied, the Applicant QHIN will be provided with written notice that includes the basis for the denial.

§ 172.307 Re-application.

(a) Subject to paragraphs (b) through (d) of this section, applications may be resubmitted by Applicant QHINs by complying with the provisions of § 172.301 in the event that an application is denied or withdrawn.

(b) The Applicant QHIN may reapply at any time after it has voluntarily withdrawn its application as specified in § 172.305(a).

(c) If ASTP/ONC (or an RCE) deems a QHIN application to be withdrawn as a result of the Applicant QHIN's failure to respond to requests for information, then the Applicant QHIN may reapply by submitting a new QHIN application no sooner than six (6) months after the date on which its previous application was submitted. The Applicant QHIN must respond to the prior request for information and must include an explanation as to why no response was previously provided within the required timeframe.

(d) If ASTP/ONC (or an RCE) denies a QHIN application, the Applicant QHIN may reapply by submitting a new application consistent with the requirements in § 172.301 no sooner than six (6) months after the date shown on the written notice of denial. The application must specifically address the deficiencies that constituted the basis for denying the Applicant QHIN's previous application.

§ 172.400 Applicability.

This subpart describes suspension responsibilities, notice requirements for suspension, and the effect of suspension.

§ 172.401 QHIN suspensions.

(a) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) may suspend a QHIN after determining that the QHIN is responsible for a Threat Condition.

(b) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) may direct the QHIN to suspend that Participant's or Subparticipant's authority to engage in TEFCA Exchange on determining that one of a QHIN's Participants or Subparticipants has done something or failed to do something that resulted in a Threat Condition.

(c) ASTP/ONC (or an RCE) will make a reasonable effort to notify a QHIN in writing in advance of an intent to suspend the QHIN or to provide direction to the QHIN to suspend one of the QHIN's Participants or Subparticipants, and to give the QHIN an opportunity to respond. Such notice will identify the Threat Condition giving rise to such suspension.

(d) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) shall lift a suspension of the QHIN, or provide direction to the QHIN to lift the suspension of one of the QHIN's Participants or Subparticipants, once the Threat Condition is resolved.

§ 172.402 Selective suspension of exchange between QHINs.

(a) A QHIN may, in good faith and to the extent permitted by Applicable Law, suspend TEFCA Exchange with another QHIN because of reasonable concerns related to the privacy and security of information that is exchanged.

(b) If a QHIN decides to suspend TEFCA Exchange with another QHIN, it is required to promptly notify, in writing, ASTP/ONC (or an RCE) and the QHIN with which it is suspending exchange of its decision and the reason(s) for making the decision.

(c) If a QHIN suspends TEFCA Exchange with another QHIN under paragraph (a) of this section, it must, within thirty (30) calendar days, initiate the TEFCA Dispute Resolution Process in order to resolve the issues that led to the decision to suspend, or the QHIN may end its suspension and resume TEFCA Exchange with the other QHIN within thirty (30) calendar days of suspending TEFCA Exchange with the QHIN.

(d) Provided that a QHIN suspends TEFCA Exchange with another QHIN in accordance with this section and in accordance with Applicable Law, such suspension will not be deemed a violation of the Common Agreement.

§ 172.500 Applicability.

This subpart establishes QHIN termination responsibilities, notice requirements for termination, and the effect of termination.

§ 172.501 QHIN self-termination.

A QHIN may terminate its own Designation at any time without cause by providing ninety (90) calendar days prior written notice.

§ 172.502 QHIN termination.

A QHIN's Designation will be terminated with immediate effect by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) giving written notice of termination to the QHIN if the QHIN:

(a) Fails to comply with any of the regulations of this part and fails to remedy such material breach within thirty (30) calendar days after receiving written notice of such failure; provided, however, that if a QHIN is diligently working to remedy its material breach at the end of this thirty- (30-) day period, then ASTP/ONC (or an RCE) must provide the QHIN with up to another thirty (30) calendar days to remedy its material breach; or

(b) A QHIN breaches a material provision of the Common Agreement where such breach is not capable of remedy.

§ 172.503 Termination by mutual agreement.

A QHIN's Designation may be terminated at any time and for any reason by mutual, written agreement between the QHIN and ASTP/ONC (or an RCE).

§ 172.600 Applicability.

This subpart establishes processes for review of RCE or ASTP/ONC actions, including QHIN appeal rights and the process for filing an appeal.

§ 172.601 ASTP/ONC review.

(a) ASTP/ONC may, in its sole discretion, review all or any part of any RCE determination, policy, or action. If ASTP/ONC reviews an RCE determination that required ASTP/ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on its review of that determination.

(b) ASTP/ONC may, in its sole discretion and on notice to affected QHINs or Applicant QHINs, stay any RCE determination, policy, or other action pending ASTP/ONC review. If ASTP/ONC stays an RCE determination that required ASTP/ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on whether it should stay that determination.

(c) ASTP/ONC may, in its sole discretion and on written notice, request that a QHIN, Applicant QHIN, or the RCE provide ASTP/ONC additional information regarding any RCE determination, policy, or other action.

(d) On completion of its review, ASTP/ONC may affirm, modify, or reverse the determination, policy, or other action under review. ASTP/ONC will provide notice to affected QHINs or Applicant QHINs that includes the basis for ASTP/ONC's decision.

(e) ASTP/ONC will provide written notice under this section to affected QHINs or Applicant QHINs in the same manner as the original RCE determination, policy, or other action under review.

(f) ASTP/ONC will issue a decision under this section within a timeframe agreed to by the affected Applicant QHIN or QHIN, as applicable, the RCE, and ASTP/ONC. ASTP/ONC may, at its sole discretion, extend the timeframe for a decision as circumstances necessitate.

§ 172.602 Basis for appeal by QHIN or Applicant QHIN.

(a) An Applicant QHIN or QHIN may appeal the following decisions to ASTP/ONC or a hearing officer, as appropriate:

(1) Applicant QHIN. An Applicant QHIN may appeal a denial of its QHIN application.

(2) QHIN. A QHIN may appeal:

(i) A decision to suspend the QHIN or to instruct the QHIN to suspend its Participant or Subparticipant.

(ii) A decision to terminate the QHIN's Common Agreement.

(b) [Reserved]

§ 172.603 Method and timing for filing an appeal.

(a) To initiate an appeal, an authorized representative of the Applicant QHIN or QHIN must submit electronically, in writing to ASTP/ONC, a notice of appeal that includes the date of the notice of appeal, the date of the decision being appealed, the Applicant QHIN or QHIN that is appealing, and the decision being appealed within fifteen (15) calendar days of the Applicant QHIN's or QHIN's receipt of the notice of:

(1) Denial of a QHIN application;

(2) Suspension or instruction to suspend its Participant or Subparticipant; or

(3) Termination. With regard to an appeal of a termination, the 15-calendar day timeframe may be extended by ASTP/ONC up to another fifteen (15) calendar days if the QHIN has been granted an extension for completing its remedy under § 172.502(a).

(b) An authorized representative of an Applicant QHIN or QHIN must submit electronically to ASTP/ONC, within thirty (30) calendar days of filing the intent to appeal, the following:

(1) A statement of the basis for appeal, including a description of the facts supporting the appeal with citations to documentation submitted by the QHIN or Applicant QHIN; and

(2) Any documentation the QHIN would like considered during the appeal.

(c) The Applicant QHIN or QHIN filing the appeal may not submit on appeal any evidence that it did not submit prior to the appeal except evidence permitted by the hearing officer under § 172.606.

§ 172.604 Effect of appeal on suspension and termination.

An appeal does not stay the suspension or termination, unless otherwise ordered by ASTP/ONC or the hearing officer assigned under § 172.605(b).

§ 172.605 Assignment of a hearing officer.

(a) On receipt of an appeal under § 172.603, ASTP/ONC may exercise its authority under § 172.601 to review an RCE determination being appealed. If ASTP/ONC exercises its authority under § 172.601 to review an RCE determination that required ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on its review of that determination. An appealing QHIN or Applicant QHIN that is not satisfied with ASTP/ONC's subsequent determination may appeal that determination to a hearing officer by filing a new notice of appeal and other appeal documents that comply with § 172.603.

(b) If ASTP/ONC declines review under paragraph (a) of this section, or if ASTP/ONC made the determination under review, ASTP/ONC will arrange for assignment of the case to a hearing officer to adjudicate the appeal.

(c) The hearing officer must be an officer appointed by the Secretary of Health and Human Services.

(d) The hearing officer may not be responsible to, or subject to the supervision or direction of, personnel engaged in the performance of investigative or prosecutorial functions for ASTP/ONC, nor may any officer, employee, or agent of ASTP/ONC engaged in investigative or prosecutorial functions in connection with any adjudication, in that adjudication or one that is factually related, participate or advise in the decision of the hearing officer, except as a counsel to ASTP/ONC or as a witness.

§ 172.606 Adjudication.

(a) The hearing officer will decide issues of law and fact de novo and will apply a preponderance of the evidence standard when deciding appeals.

(b) In making a determination, the hearing officer may consider:

(1) The written record, which includes:

(i) The RCE's or ASTP/ONC's determination and supporting information; and

(ii) Appeal materials submitted by the Applicant QHIN or QHIN under § 172.603.

(2) Any information from a hearing conducted in-person, via telephone, or otherwise. The hearing officer has sole discretion to conduct a hearing:

(i) To require either party to clarify the written record under paragraph (b)(1) of this section; or

(ii) If the hearing officer otherwise determines a hearing is necessary.

(c) The hearing officer will neither receive witness testimony nor accept any new information beyond what was provided in accordance with paragraph (b) of this section, except for good cause shown by the party seeking to submit new information.

§ 172.607 Determination by the hearing officer.

(a) The hearing officer will issue a written determination within a timeframe agreed to by the affected Applicant QHIN or QHIN, as applicable, and ASTP/ONC and approved by the hearing officer. The hearing officer may, at their sole discretion, extend the timeframe for a written determination as circumstances necessitate.

(b) The hearing officer's determination on appeal is the final decision of HHS unless within ten (10) business days, the Secretary, in the Secretary's sole discretion, chooses to review the determination. ASTP/ONC will notify the appealing party if the Secretary chooses to review the determination and will provide notice of the Secretary's final determination.

§ 172.700 Applicability.

This subpart applies to QHINs.

§ 172.701 Attestation submission and acceptance.

(a) Applicability. This subpart establishes:

(1) The attestation submission requirements for QHINs.

(2) The review and acceptance processes that ASTP/ONC will follow for TEFCA attestations.

(b) Submission of QHIN attestation. (1) In order to be listed in the QHIN Attestation Directory described in § 172.702, a QHIN must submit all of the following information to ASTP/ONC:

(i) Attestation affirming its adoption of the Common Agreement and Trusted Exchange Framework.

(ii) General identifying information, including:

(A) Name, address, city, state, zip code, and a hyperlink to its website.

(B) Designation of an authorized representative, including the representative's name, title, phone number, and email address.

(iii) Documentation confirming its Designation as a QHIN.

(2) A QHIN must provide ASTP/ONC with written notice of any changes to its identifying information provided in accordance with this paragraph (b) within thirty (30) business days of the change(s) to its identifying information.

(c) Submission method. A QHIN must electronically submit its attestation and documentation either via an email address identified by ASTP/ONC or via a submission on the ASTP/ONC website, if available.

(d) Review and acceptance. (1) Within thirty (30) business days, ASTP/ONC will either accept or reject an attestation submission.

(2) ASTP/ONC will accept an attestation if it determines that the QHIN has satisfied the requirements of paragraphs (b) and (c) of this section. ASTP/ONC will provide written notice to the applicable QHIN's authorized representative that the attestation has been accepted.

(3) ASTP/ONC will reject an attestation if it determines that the requirements of paragraph (b) or (c) of this section, or both, have not been satisfied.

(4) ASTP/ONC will provide written notice to the QHIN's authorized representative of the determination along with the basis for the determination.

(5) An ASTP/ONC determination under this section is final agency action and not subject to further administrative review, except the Secretary may choose to review the determination as provided in § 172.607(b). However, a QHIN may, at any time, resubmit an attestation in accordance with paragraphs (b) and (c) of this section.

§ 172.702 QHIN Attestation Directory.

(a) Applicability. This subpart establishes processes for publishing a directory on the ASTP/ONC website of QHINs that voluntarily elect to adopt the Common Agreement and Trusted Exchange Framework and attest to such adoption.

(b) Publication. (1) Within fifteen (15) calendar days of notifying a QHIN that its QHIN submission has been accepted, ASTP/ONC will publish, at a minimum, the QHIN's name in the QHIN Attestation Directory on the ASTP/ONC website.

(2) ASTP/ONC will identify within the QHIN Attestation Directory those QHINs that are suspended under the Common Agreement.

(c) Removal from the QHIN Attestation Directory. (1) A QHIN whose Common Agreement has been terminated no longer qualifies to be included in the QHIN Attestation Directory as it is no longer considered a QHIN and will be removed from the QHIN Attestation Directory.

(2) Upon termination of a QHIN's Common Agreement, ASTP/ONC (or an RCE) will send a written a statement of intent to remove the QHIN from the QHIN Attestation Directory to the authorized representative of the QHIN.

(3) Any written statement given under paragraph (c)(2) of this section shall consist of the following, as appropriate:

(i) The name of the terminated QHIN and the name and contact information of the authorized representative of the QHIN.

(ii) A short statement setting forth findings of fact with respect to any violation of the Common Agreement or other basis for the QHIN's termination under the Common Agreement and justifying the termination on the basis of those findings of facts.

(iii) Other materials as ASTP/ONC (or the RCE) may deem relevant.

(d) Duration. A QHIN that is removed from the QHIN Attestation Directory will remain removed until a new attestation is accepted by ASTP/ONC in accordance with the processes specified in this subpart.

(e) Final agency action. An ASTP/ONC determination under this section is final agency action and not subject to further administrative review, except the Secretary may choose to review the determination as provided in § 172.607(b).