Regulation

HTI-2 Final Rule Fact Sheet: TEFCA and QHIN Designations, Governance and Appeal Rights

Key Insights and Information

TEFCA Common Agreement Updates (QHINs)

  • Critical Definitions Related to TEFCA and QHINs
     
    • Applicant QHIN. Any organization with a pending QHIN application before ASTP/ONC.
       
    • Business Associate Agreement (BAA). A contract, agreement, or other arrangement that satisfies the implementation specifications for TEFCA
       
    • Business day or business days. Monday through Friday, except the legal public holidays
       
    • Confidential Information. Any information that is designated as Confidential Information by the person or entity that discloses it, or that a reasonable person would understand to be of a confidential nature and is disclosed to another person or entity pursuant to TEFCA Exchange
       
    • Connectivity Services. The technical services provided by a QHIN, Participant, or Subparticipant to its Participants and Subparticipants that facilitate TEFCA Exchange consistent with the technical requirements of the TEFCA framework.
       
    • Designated Network. The health information network that a QHIN uses to offer and provide Designated Network Services.
       
    • Designated Network Services. The Connectivity Services and/or Governance Services provided by the QHIN
       
    • Disclosure The release, transfer, provision of access to, or divulging in any manner of TEFCA Information (TI) outside the entity holding the information.
       
    • Exchange Purpose(s) or XP(s). The reason, as authorized by a Framework Agreement, and applicable SOPs for a transmission, Query, Use, Disclosure, or Response transacted through TEFCA Exchange.
       
    • Exchange Purpose Code or XP Code. A code that identifies the Exchange Purpose being used for TEFCA Exchange.
       
    • Foreign Control. A non-U.S. Person(s) or non-U.S. Entity(ies) having the direct or indirect power, whether or not exercised, to direct or decide matters materially affecting the Applicant’s ability to function as a QHIN in a manner that presents a national security risk.
       
    • Framework Agreement(s) The Common Agreement for QHINs and the Terms of Paricipation for Participants and Subparticipants.
       
    • Governance Services. Governance functions described in applicable SOP(s), which are performed by a QHIN’s Designated Network Governance Body for Participants & Subparticipants to facilitate TEFCA Exchange in compliance with Framework Agreements.
       
    • Individual Access Services (IAS). Services provided to an Individual by a QHIN, Participant, or Subparticipant that has a direct contractual relationship to satisfy that Individual’s ability to access, inspect, or obtain a copy of that Individual’s Required Information using TEFCA Exchange.
       
    • Individually Identifiable Information. Refers to information that identifies an Individual or with respect to which there is a reasonable basis to believe that the information could be used to identify an Individual.
       
    • Node. A technical system that is controlled directly or indirectly by a QHIN, Participant, or Subparticipant and that is listed in the RCE Directory Service.
       
    • Onboarding. The process a prospective QHIN must undergo to become a QHIN and become operational in the production environment.
       
    • Participant. A U.S. Entity that enters into a legally binding contract with a QHIN to use Designated Network Services to participate in TEFCA Exchange in compliance with the Participant/Subparticipant Terms of Participation.
       
    • Participant/Subparticipant Terms of Participation. The requirements to which QHINs must contractually obligate their Participants/Subparticipants to agree to participate in TEFCA.
       
    • Query(s) The act of asking for information through TEFCA Exchange.
       
    • Recognized Coordinating Entity (REC). Entity selected by ASTP/ONC that enters into the Common Agreement with QHINs to impose the requirements of the Common Agreement.
       
    • Subparticipant: a U.S. Entity that has entered a legally binding contract to use Connectivity Services to participate in TEFCA Exchange in compliance with the Terms of Participation.
       
    • TEFCA Dispute Resolution Process. A non-binding process under TEFCA through which QHINs can resolve disputes.
       
    • TEFCA Exchange. The transaction of information between Nodes using an XP Code.
       
    • Threat Condition. A breach of a Framework Agreement that has not been cured within 15 calendar days of receiving notice of the material

Applying to be a QHIN

  • An Applicant QHIN must meet all requirements below to be Designated a QHIN.
     
  • A QHIN must continue to meet all requirements to maintain its Designation
     
  • Ownership requirements. An entity must:
     
    • Be a U.S. Entity;
       
    • Not be under Foreign Control.
       
  • Exchange requirements. An entity must, beginning at the time of application, either directly or through the experience of its parent entity:
     
    • Be capable of exchanging information among more than two unaffiliated organizations;
       
    • Be capable of exchanging all Required Information;
       
    • Be exchanging information for at least one Exchange Purpose authorized under TEFCA;
       
    • Be capable of receiving and responding to transactions from other QHINs for all Exchange Purposes authorized under TEFCA
       
    • Be capable of initiating transactions authorized under TEFCA that such entity will permit its Participants and Subparticipants to use through TEFCA Exchange
       
  • Designated Network Services An entity must:
     
    • Maintain infrastructure and legal authority to operate/govern its Designated Network;
       
    • Maintain adequate written policies and procedures to support meaningful TEFCA Exchange
       
    • Maintain a Designated Network capable of supporting transaction volume that keeps pace with the demands of network users
       
    • Maintain capacity to support secure technical connectivity and exchange with other QHINs
       
    • Maintain an enforceable dispute resolution policy governing Participants
       
    • Maintain an enforceable change management policy consistent with QHIN responsibilities
       
    • Maintain a representative and participatory groups to approve governance processes
       
    • Maintain privacy and security policies that permit the entity to support TEFCA Exchange
       
    • Maintain data breach response and management policies that support TEFCA Exchange
       
    • Maintain adequate financial and personnel resources to support all its responsibilities as a QHIN, including sufficient financial reserves or insurance-based cybersecurity coverage, or a combination of both.
       
  • QHINs that offer Individual Access Services must:
     
    • Obtain express consent from any individual before providing Individual Access Services.
       
    • Make public a privacy and security notice that meets minimum TEFCA standards
       
    • Delete individual’s Identifiable Information upon request except as prohibited by Applicable Law or where it is contained in audit logs
       
    • Permit any Individual to export in a computable format all of the Individual’s Individually Identifiable Information maintained by the QHIN as an Individual Access Services provider.
       
  • All Individually Identifiable Information the QHIN maintains must:
     
    • Be encrypted
       
    • Without unreasonable delay (no later than 60 calendar days following discovery of the unauthorized acquisition, access, Disclosure, or Use of Individually Identifiable Information, the QHIN must notify in plain language each everyone whose Identifiable Information has been or is reasonably believed to have been affected
       
    • Have an agreement with a qualified, independent 3rd-party credential service provider
       
    • Verify via credential service provider identities of Individuals seeking IAS prior to first use of such services and upon expiration of their credentials.

QHIN Application, Review, Onboarding, Withdraw, and Redetermination

  • An entity seeking to be Designated as a QHIN must submit all of the following information:
     
    • Completed QHIN application, with supporting documentation
       
    • A signed copy of the Common Agreement.
       
  • ASTP/ONC (or an RCE) will review a QHIN application to determine if all information and documentation has been provided.
     
    • If the application is not complete, the applicant will be notified in writing within thirty (30) calendar days of receipt of the application.
       
  • ASTP/ONC or an RCE will complete its review within 60 calendar days of completion of the application and documentation.
     
  • Additional information may be requested by ASTP/ONC (or an RCE) for review.
     
  • Failure to respond to a request is a basis for a QHIN Application to be deemed withdrawn.
     
  • If any information submitted by the Applicant QHIN materially changes after submission, the Applicant QHIN must notify ASTP/ONC or an RCE of the changes within 5 business days.
     
  • If ASTP/ONC or an RCE determines that an Applicant QHIN meets the requirements they will notify the applicant in writing Applicant may proceed with Onboarding.
     
  • Approved Applicant QHIN must submit a signed version of the Common Agreement to be countersigned by ASTP/ONC (or an RCE.)
     
  • An approved Applicant QHIN must complete the Onboarding process, including any tests required to ensure the Applicant QHIN’s network can connect to those of other QHINs and other Applicant QHINs, within twelve (12) months of approval
     
  • Within 30 calendar days of receiving Designation, each QHIN must demonstrate that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange.
     
    • If a QHIN is unable to successfully transmit by the deadline, they must provide a written explanation and a detailed plan timeline for completion of a successful transaction.
       
    • ASTP/ONC (or an RCE) will review and approve or reject the QHIN’s plan within 5 business days of receipt.
       
    • If the QHIN fails to provide its plan or the plan is rejected, ASTP/ONC (or an RCE) will rescind the QHIN Designation.
       
  • An Applicant QHIN may withdraw its QHIN application by providing written notice prior to Designation.
     
  • A QHIN application may be deemed withdrawn by ASTP/ONC (or an RCE) as result of the Applicant QHIN’s failure to respond to requests for information.
     
  • If an Applicant QHIN’s application is denied, they will receive written notice with basis for denial.
     
  • An Applicant QHIN may reapply at any time after withdrawing an application.
     
  • If the rejection is the result of not responding to requests for information or if the application is denied, the Applicant QHIN must wait 6 months before re-applying.

Suspension of QHIN Designation

  • ASTP/ONC (or an RCE) may take the following actions if it is determined that the QHIN is responsible for a Threat Condition.
     
    • May suspend the QHIN’s designation
       
    • May direct the QHIN to suspend the Participant or Subparticipants authority to engage in TEFCA exchange as result of actions resulting in a Threat Condition
       
  • ASTP/ONC (or an RCE) can lift a suspension of the QHIN or provide direction to lift the suspension of the responsible Participants or Subparticipants once the Threat Condition is resolved.
     
  • A QHIN may, to the extent permitted by Applicable Law, suspend TEFCA Exchange with another QHIN because of reasonable privacy and security concerns.

Termination of a QHIN Designation

  • A QHIN may terminate its own Designation at any time without cause by providing 90-calendar days prior written notice.
     
  • A QHIN’s Designation will be terminated with immediate effect by ASTP/ONC (or an RCE) giving written notice of termination to the QHIN if the QHIN:
     
    • Fails to comply with QHIN requirements (material breach) within 30 days of receiving notice of a failure to comply
       
    • If the QHIN breaches a material provision of the Common Agreement beyond remedy
       
  • A QHIN’s Designation may be terminated at any time and for any reason by mutual, written agreement between the QHIN and ASTP/ONC (or an RCE)

Review of RCE or ASTP/ONC Decisions

  • ASTP/ONC may review all or any part of any RCE determination, policy, or action.
     
  • No ASTP/ONC staff or agent who was engaged with evaluating the prior authorization may participate in ASTP/ONC’s review.
     
  • ASTP/ONC may, in its sole discretion and on notice to affected QHINs or Applicant QHINs, stay any RCE determination, policy, or other action pending ASTP/ONC review.
     
  • ASTP/ONC may request that a QHIN, Applicant QHIN, or the RCE provide additional information regarding any RCE determination, policy, or other action.

QHIN Appeal of Designation Determination

  • Applicant QHIN or QHIN may appeal the following decisions to ASTP/ONC or a hearing officer:
     
    • An Applicant QHIN may appeal a denial of its QHIN application.
       
    • A QHIN may appeal:
       
    • A decision to suspend the QHIN
       
    • A decision instructing the QHIN to suspend a Participant or Subparticipant.
       
    • A decision to terminate the QHIN’s Common Agreement.
       
  • To initiate an appeal, the Applicant QHIN/QHIN must submit electronically a notice of appeal to ASTP/ONC withing 15 calendar days of the receipt of the notice for:
     
    • Denial of a QHIN application
       
    • Suspension or instruction to suspend its Participant or Subparticipant
       
    • Termination of a QHIN designation
       
    • An authorized representative of an Applicant QHIN or QHIN must submit electronically to ASTP/ONC, within thirty (30) calendar days of filing the intent to appeal, the following:
       
  • Within 30 days, the Applicant QHIN or QHIN must submit:
     
    • A statement of the basis for appeal, with a description of the facts supporting the appeal
       
    • Any documentation the QHIN would like considered during the appeal.
       
  • An appeal does not stay the suspension or termination, unless otherwise ordered by ASTP/ONC or the hearing officer.
     
  • The hearing officer will decide issues of law and fact applying a preponderance of the evidence standard when deciding appeals, considering;
     
    • The written record (the RCE/ASTP determination and appeals materials submitted by the QHIN/Applicant QHIN
       
    • Any information from a hearing
       
  • The hearing officer will issue a written determination, which will serve as HHS final decision unless within 10 business days the Secretary of HHS chooses to review the determination.

QHIN Attestation for the Adoption of the Trusted Exchange Framework and Common Agreement

  • Information required for QHIN TEFCA Attestation
     
    • Attestation affirming its adoption of the Common Agreement and Trusted Exchange Framework.
       
    • Name, address, city, state, zip code, and a hyperlink to its website
       
    • Designation of an authorized representative, including the representative’s name, title, phone number, and email address.
       
    • Documentation confirming Designation as a QHIN.
       
  • QHIN must provide ASTP/ONC with written notice of any changes to its identifying information provided within 30 business days of the change.
     
  • QHINs must electronically submit its attestation & documentation either via email or via a submission on the ASTP/ ONC website. ASTP/ONC will accept or reject the attestation within 30 business days.
     
  • TEFCA Attestation acceptance is not subject to further review unless the Secretary of HHS elects to review the determination.
     
  • If accepted, ASTP/ONC will publish the QHIN’s name in the QHIN Attestation Directory on the ASTP/ONC website within 15 days.
     
  • The ASTP/ONC web registry will also list QHINs that are suspended under the Common Agreement. QHINs whose Common Agreement has been terminated will be removed from the Directory.
Tags: Regulation, Public Policy
Published on December 17, 2024

Related