August 31, 2023

The California Health and Human Services Agency (CalHHS) Center for Data Insights and Innovation (CDII) has released two amended Policies and Procedures (P&Ps) for the Data Exchange Framework’s (DxF) Data Sharing Agreement for public comment. Public comment on these two amended P&Ps will be accepted until Monday, September 18, 2023, at 8:00 a.m.

This first P&P topic, Requirement to Exchange Health and Social Services Information, includes proposed revisions to:

• Clarify timelines by which Voluntary Signatories are required to Exchange data under the DSA
• Remove language that allowed a participant engaging in Exchange to require Health and Social Services Information (HSSI) without any corresponding obligation to disclose HHSI for a limited period of time
• Clarify the means by which a participant shall fulfill its duty to respond to requests for HSSI
• Clarify the scenarios when an error message or null response is required

The second P&P topic, Privacy Standards and Security Safeguards, includes proposed revisions to:

• Require non-covered entities to comply with specified provisions of HIPAA with respect to Personally Identifiable Information and Protected Health Information
• Further specify the obligations of business associates under the P&Ps
• Clarify the requirements for the de-identification of HSSI
• Require participants to store records of privacy and security training for 6 years
• Add three new defined terms (Destruction, Disruption, and Loss) and one revised definition (Securely Destroy)

CDII’s preferred method for creating and submitting public comment is through the DxF Comment Template. Additional information with guidance on how to prepare and transmit comments can be found under the “Public Comment” header on the DxF website.