Trusted Exchange Framework and Common Agreement Version 1.1, 76773-76835 [2023-24536]
Download as PDF
<![CDATA[
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Trusted Exchange Framework and
Common Agreement Version 1.1
Office of the National
Coordinator for Health Information
Technology (ONC), Department of
Health and Human Services (HHS).
ACTION: Notice.
AGENCY:
This notice fulfills an
obligation under the Public Health
SUMMARY:
Service Act (PHSA), which requires the
National Coordinator for Health
Information Technology to publish on
the Office of the National Coordinator
for Health Information Technology’s
public internet website, and in the
Federal Register, the common
agreement developed under the PHSA.
This notice is for publishing an updated
version of the Common Agreement,
version 1.1.
FOR FURTHER INFORMATION CONTACT:
Mark Knee, Office of the National
76773
Coordinator for Health Information
Technology, 202–664–2058.
This
notice fulfills the obligation under
section 3001(c)(9)(C) of the Public
Health Service Act (PHSA) to publish
the common agreement, developed
under section 3001(c)(9)(B) of the PHSA
(42 U.S.C. 300jj–11(c)(9)(B)), in the
Federal Register.
SUPPLEMENTARY INFORMATION:
BILLING CODE 4150–45–P
:C:OMPJION AGllEEMEt41"S:Qlt
. .,.:ATl()t4~~l>EJt~LTt[INS:(lltl\tlA.JlOt4• IN,J:£RQPEll4BILl1'Y
;.;ri:~lr~ijl;t~-~~~riil~:~:r~~~[1t';a~r
expense:.
~~rti~t1t~t¼tij~\fequijtt1~,W1~~tin.ai,o(t~it9jt¢1pfttie•~••~:~~~::
fort~eliaational ~rdina~rfor Heafthln!orrnationl"eclmulogy~ publishmrt~Office of the
NatiooalCoordinatorforHealthlrifammoonTechnolo,r(:s pub~c Internet ~ifi!;·and inthe
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00055
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.010</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
federaiRegiSter,.theeootmor1agreement (42U5,C300jf11(c)(9){C)).
76774
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
The CommonAgreement
for Nationwide Health Information Interoperability
This .CommorrAgreem1:mtfor Nc1tiom111ide HE!<llth !nforrnciJion lnteroperal)ility (the
"Common Agreemenf!'or'!Agreernenf'') is entered intoas of the-·__ dayof
- - - - - - - - - - - - " ____ (the ,;E.ffectlve oate't hyand betWeen:itie SequOia
Project, Inc,, a Virginia nc>n~~tockcqrporatlon,act1T1ga$ the ctJrrenfRecognizecl Ccordin.ating
Entity as defined below(the "RCE"Jaiid _ _ _ _ _ _ _ _ _ _ _ _ _ _ _........, a
~~~---~~=~~===-("Signatory"). RCEand Signatory m11y also be reforre<J
to herein individually•as a "Party" or collectively as<the "J>artfes,·11
RECITALS
WHERl:As; Sectfon 4003ofthe 2Pt Century Cures.Act.directed the u:s:. Department of
Health and.Human.Se.rvices(HHS) National Coordinator to, "in collaborationwith the National
Institute .ofStandardsand Technology and other relevantagendes within theDepartment .pf
Health andiHuman.ServitEls;forthe purp()seofensuring·full network-fo-networlcexchang:eof
health inforrnatic>n, corw:ene pQbffc•ptivateand public-pubiic.partnersh1ps to build consensus
and develop·orsupport attusted exchange framework;. includfngacommon agreement among
health informatfon netWdrks nationally;"
WHEREAS,·this commonAgreement(lnc1ud1ngthedocuments:irn;orporated her:ein by
reference)is :the common agreement developed pursuant to section 4003 ofthe 21st Century
Cures Act;
WHERl:As, The Sequoia Projec:thas been selected by. the Office ofthe.·Natti:mal
Coordi.nator forHealth lnformationTechnology (ONC) to serve.as the RCE for purposes of
i1T1pte.rne1:rl:fngi·maintaining;.and updating this CommonAgr:eernent,ihcludingtheO.ualified
Health Information Network (O.HIN)Technitatframework,as INE!ll as managing the acthi:ities
associated;w1th the designatk)h oftnterested health infurrnatl()n l'ietwotks (HINs) as Q,l·UNs (as
defined and setforth In this C:6mmon Agreement);
WHEREAS, SignatoryWishes tobe desighated>as aQHIN ahd.hc1s c:Orrlple:ted the
application processtoward.suchdesignation:
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00056
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.011</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
WHEREAS, Signatory must; among other conditions>se:tforth in this Common
Agreement, agreeto be bound bythetermsofthis Common.Agreementbefore:Signatorymay
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76775
be designated as a QHIN and, upon signing this.Common Agreement, Signatory agrees to be.so
bo.und as,aSignaforyandas a QHJN, ifso designated, as the casemaybe;
fJOW, l'FIElti:FQRE, in cc>nsr!ie~tion ofthe muJ4al prQmisessefforih herefrt and other
gooda(lt( valuabie eoosideraticm, the reteiptand s•Jfflclency ofwhich is here~vacl<rtowl~dged,
the Parties,; interidingto b:e iegally bourid, mutually agree asset forth below.
AGREEMENT
1. Definitions and RelevanfTerminology
1.1.
Defined Terms, Capitalized terms used rn this CommonAgreementshaU have the
meaning set forth below, Wherea!ief!11ition i11cludesone Qr mqrecitatiqns to a
statute, regulatiQn, Qrstarid.ird,· thedef!nitionsh<ilFbeJnterpreted to·referto stn:11
stat4te, regulatron, orstan dc:1rcf asn:iay be amended from t1tne to~time;
0
Applleili,le lihA;: aitf¢deraf,state; Iot11i, ortrlbc:ilJaws arid teguJat,1:>M then in effect
and applicable tothesobJectma:tter hereiri. Fonhe avoh:Jance of doubt, f~derar
agencies are Only sut>jett tofederaUaw.
Business Associate: hasthe meaningassignedtostich term at45 CFR •~ 160.103.
Business Assodate Agreement(BAA): a contrad,.agreement, or other arrangement
thatsatisfies the implementation specifications described within 45 CFK§
164,5()4(:e), asapplicable,
C9mmQnAgreernent: unle$s otherWl$e expres~Iy iricii<:ated: thls dOl:Qtnent, the.
OJ-IIN Te1:hnfoa1 FrameW1:>rk (0.tF); all Standard Oper;atiM Prq1:edure$ (St!Ps), and an
other attachments; e1<tiibihi•l'lnci attlfacts:incorp◊t.ited herein by reference.
confidential lnformati6n:
Any in.rorr:nation that is designated as Conffilential infbrmatlon by the
persorior entit;ythat disdosa it {a "DistlQser"), orthafa reaso,nable person w(!uld
understand to be ofa corindentialnature,.inci isdisdosed to another perso11or
et1tity (a ;;Redpient") pursuant tQ this Common Agreement For the avoidance of
doubt, ''Confidential !nfurmation;' does not indude electrotlic ptdtectedhealth
information (ePHI}, as definedlnthis tommC)ti Agreement, that is'subjectto.a
Busii'H\ss Assoeiate Agreement and/or Other provisions of this comm6n Agreement.
Notwithstaf1!ilng.any labeltottie cor'ltr,ary,l(COnfidential lnformatron'fdQE!s
notin~l1.1de any information that: (i)is or becomes known p1.1b1tctythr(!ughnt1 fault
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00057
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.012</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
3
76776
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
of the Recipient; or (ii)is learned by the Recipientfrom.a third party thatthe
Recipient reasonably believes is entitled to disclose if without restriction; or (iii}.is
alrei:ldy knowrrto the Redpi~t befqre receiptf~()m the Disclq~er,as shq1Nn by the
Recipiet1t'.s VlltJttenrecc,rdsr()J (Mis indepen!fentlydevelC!Ped by Reeipie1it with.out
t&e use <>f()r referenceto the Di!>tlose('s Corrfidenttal lnf()ttnatiori, as shQWn PV thE!
Rei:ipient's writtetifE!tords;.andwas not supJE!ct toccmfidentlallty testtittiQns prior
tOrE!ceipt ofsud1 infotmationfrornthii! bisclbser;<>t (v) must be disdbsedunder
operatib:nof law, proVid,edthat, to the extent permitted by ApplkabJe Law, the
Recipietitgives the Discloser reasonable notice to alloWthe Discloseno obJectto
.sdch tedisdOsure, and such redisclosure.is made to the mioiliiurn extent necessary
to comply with Applicable Law.
Connectivity~tvices:the technical sendces prt1vided bya QHIN consistent with the
reqt.ifrementse)fthethen°applicabte a.HIN technical FrarneworkandpotsuannQ this
Common Agteement withtesp'ett toan Eicthange Purposes.
Corrtract:the contract bY and between The Sequoia Project and HHS, of, if
applicable, a successor agr.eementbetween The Sequoia Projectand HHS,or a
successor agreement b.etwe.en.a different RCE and HHS.
toviered Entity: has ttiemeani11gasslgnedtosuch term at-45 CFR § 160:to~.
Cvbersec:urify Cduneil: th~CC1tu1dl establishett bythe RCE to enhance eybetsecurify
commenso.ratewiththe ti.s'ksto dJiJN:.Cto:-0.HIN exthanM, asm6te full:y set forth in
an sop.;
oesignation•fineluding•·its~or~lative meanings"Desig~ate/•"Designatec:f;"'and
"l)esignating"): the RCE's written tonfirmatitm toONCand SignatorythatSignatoty
has.satisfied .aUthe requirements otthe eommohAgreernent, the QHIN Technical
Framework, and all applicab1eSOPs1 and is now a O,HIN.
Direct Rerationship: a relationship between (1) an lndiVidual and {ii}a ClHIN,
Participant, prSubparticiparit,thatarises wherrthe QHml; Participant, or
Subpartidpant, as applicable,:.Qf'f'~r:s servkestc; the ln!fividUi:11 ln conn~clion Withone
ot more of the Framework Agreements, and.the lndh1itlual.;igrees to rE!ceive$u.ch
services.
Oistie>si.lhf(in<:iudiriJ•tts•.torrelatlve meanings "Disc:lpsei"';Oi~eiosed;"•and
,.Diselosinl")= theteiease, transfer, provision ofactess to, or divulging1n any'
manner otnoutsidethe entity holdin1,rtheintorrnation.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00058
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.013</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
4
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76777
Discovery:for purposes of determining the date on which a TEFCASecurity Incident
was discoyered, the term Discovery shall.he determined consistent with45 CFR §
1M.404(a)I2)as if the fEFCASecyrity lncidentwere;a breach (as.defined in45. tFR §
164.402)except that this term shall also apply to NorH-IIPAA Entities:
Dispute: means (J) a disagreement about any ptoVisioll. of this Common Agreement,
indudilig any SOP, the QTF, and another attachments, exhibits, and artifacts
incorporated by referenc:e; or (ii) a concern or complaint about the actiohs, or any
failureto act, ofSlgnatory,.the RCE,oranyother QHINoranother QHIN's
Participant(s ).
Dispute Resolution Process: has the meaning assigned to such term in Section 15.1
of this Common Agreement.
[)()Wnstream Subpartidpant: aSubpartidpantthat has entered into a Dowrist:ream
Subparticipant Agreementto use the services ofanother.Subpartidpant (referred to
as. tile ''Upstream Subpartldpant") to send and/or recelveinformationas described
ill Section 9 of this tommon Agreement.
Downstream Subpan:iciparitAgreerrierrt: an agree:meritthatincorporates alN:ifthe
Retiuired Flow~Downs of this common.Agreement.and is between.a Subf)articipant
(referred to as the "Upstream Subparticipant") and one or more Subpartlcipants
(each a "DownstreamSubparticipant:"), which enables the Downstream
Subparticipant(sJ to use the services ofthe UpstreamSubpartieipant as described in
Section 9 of this Common Agreement to send and/or receive information for one or
more Exchange Purposes; provided;. however, that any provisions of said agreement
that permit or require activfties other than t'1ose required. dt permitted by the
Common Agreement shall not be deemed part ofthe .Downstream Subparticipant
Agreement as defined herein. For example, ihheagreement providesfor
transmission of information for reasons other than the Exchange Purposes, the
provisions goverllingsuchactiVlties.shall not be deemed part ofthe Downstream
Subparticipant Agreement as defined herein. Any Stibparticipant may enter into a
Downstream SubparticipantAgreement.
Electronic Protected Hearth Information (ePHIJ: has the meaning assigned to.such
term at45 CFR § 160.103.
Exchange Purpc>se{s): means the reason, as authorized by this tommon Agreement
including the. Exchange Purpos.es SOP, for a Request;. Use, Disclosure, or Response
transmitted via Cl.l·UN'-~b.HIN exd1angeas one step in the ttar1smlssion, Authorized
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00059
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.014</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
5
76778
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Exchange Purposes are:Treatment, Payment, Health CareOp.erations, Public Health,
Government Benefits Determination, Individual AccessServices1 andany·oth·er
pllrp<>se<!uth<>rizect as an Exchange Purpose.by the Excb<!nge Purposes S(JP, eac.h to
the extent permitted uncterApplical:>le laWic uncleraUappli<;able provisions of this
common Agreement, and,:ifappih:able, under the irnplementiltron $0Pfonhe
appilcl!lble EX'cha)'.ige Purpose, •
FtameWt>rkAgreement(sJ: anvoneor tombinatiori':ofthecommon Agreement,a
PartitipantcQHIN Agreement,. a Partitipant0subpart1c1pant Agreeml!nt,• or a
DoWnstr@am.subpartitipantAgreement, as.applicable.
FTC Rule: the Health Breach Notification Rule promulgated by the FederalTrade
Commissionsetforth at 16CFR Part.318.
Go.vernment~eneflts Determfnation: a deferminatiol'.l made by <!hY fed@ral; state,
l0t;al, or tribal agency, instrumen~lity, or other unit of g<>vernrnentas to:whether an
lndiVidual quatrfiesfor gpvernrr1ent henefltsfor.anypurpbs:e•otherthanhealtb care
(for exarnpie, Social Security d,sabO)tyberteflts)tb the extentpetrnitted by
Applkablefaw. blsdosureofTI forthis putposlHnay require an authbtization that
t<'>mplies With APPiicabie taw,
Government Health care Entlfyi any agency, instrumentality,. orothefuhitotthe.
federal, state, local, or tribal government to the extentthatit provides health care
services {e.g\, Treatment)to Individuals but only to the extentthat itis notacting as
a Covered Entity.
Hec11th Care C>peratlons} hiis themeaningassigned to such termat4~ CFl:C§
164,$01, exceptthat thiste.rrn shaffappJy tbthe applicable actlvities ofa HealthCare
Ptt>Vh:ier regardless of whether the Health Car,e.Provfrler Isa Covered Entfty,
Health Care PrQvfd'er: hasthe rr1ean1hgass,gnedto suchterm in the information
blot king regulations at 45 CFR §: 111.162 or irrthe H!PAA.Rules at 45 CFR § 160.103..
Health Information Network (HIN): hasthemeaningassignedto theterm "Health
Information Networkor Health Information.Exchange" in the information blocking
regulattonsat 45 CFRll71.102,
HfPAA! tbe l'iealth losuri!nce Portabifitya11d ,:\ccountabillty Act ofl,996 codified at42
u::s;c, §.aOOgg; 29 u.s.t. § llSletseq;,42 o.s.C.. § 132dd ft.s,eq.,.andtheHealth
tnforrnatie>n Technology for £tolie>tnJcand tnnltal Health (HITECH) Actbf 2009
codffied at42 u.s.c, § iJg:21 etseq.,ai'id 42
§ rzgatet seq;
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00060
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.015</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
o.s.c
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76779
HIPAARules: the regulations set forth at4S.CFR Parts 160,162, and 164.
HIPAAPrivacyRule:theregulations se(forth at45<:FR Parts iOOand 164, Subparts
AandE.
HIPAASe:currty Rule:the regulations set forth at45 c;FR Part 160 and Part 164,
Subpart c.
Individual: one cir rriore ofthe following:
{i)
An individual as defined by 4$ C:FR160.103;
{ill
Any other natural person who is the subject of the ihformatlon being
Requested, Used, or Disclosed;
(iii}
A petsonwho le~afly attsonbehalf ota person described in paralraphs
(i} or (ii) ofthis.definition in making decisions related to health care as a
peri;onal representative, in accordance with 45 CFR1(>4.S02(g};
(iV)
A personwho isa legal representative ofaQd canrnake healthcare
decisio.hs on behalf ofany person de.scribed in paragfaphs (i) or (ii} Of this
llE!finrt;ion; or
M
An e)(ect1tor, administrator, or other persoflhavingauthorltyto ad on
behalf of a. deceased person described in paragraphs (i) or {ii) of this
section ortbe individual's estate under Applicable Law.
IAS Provider: Each .QHIN, Participant, and subpartieipantthatoffers.lndividual
Access Services ..
Individual Access Services (IAS}:with respect to the Exchange Purposes definition,
the services provided utillzing the Connectivity Services,. to the extent consistent
with Applicable taw,to an lndJvidualwith whom the QHIN, Participant; or
Sub participant h<is a Direct Relationship to satisfy thatlhdividual' s ability to access,
insp'E!ct; or obtairra copy of that Individual's Required information that is tMn
maintatned by or for any. 0.HIN, Participant, orSubpartitipant,
lndMduafly Identifiable: refers to lnformatlonthat i:dentifies an Individual or with
respectto which there is a reasonable basis to believe .that thelnformation co1.1ld be
used to identify an lodividuat
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00061
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.016</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
i
76780
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Minimum Necessary: refers to the provision in theHIPAARules that, under certain
circumstances, requires a Covered Entity or a Business Asso.ciatefo make reasonable
efforts v.t!wnUsingorpisclosing PHl9rwtien FtequestJng PHlfroman9thei: C9ver~
Entrtyor Bus1nessAs59diilte:t:o limit PHI to theminlmurn netessarytQ act:omplish
theh1ten(fedrurnose11hheiJse, DisdQ$urej qr Ftequest. $ee4S¢Ft{ § tt'i4.5Q2(b)
and.§ i64514(d);
Nan~HIPAAEnti:ty (NHE):a QHtN, Paiticipant, orsuhpatucipanniiat is neither a
covered EntitY o6ra Business Associate under Ht PAA.with regard tP activittes.:uhder
this common Agreement.
Onboarding:the process Signatory,a Participant, or aSubparticipantmust undergo
to become a QHIN, Partitipant,or Subparticipantand operationalinthe production
environrnentunderthe Frarnev.t0r-k Agreementto 111/hicl'l it:Js.a party. for Signatory,
thet)nboardlngrequirements shall b.e setforthJnthe•.OHINOnboardirig &
Qesignation>SOPaddtessingtheprocess towardOesignat1011as a QfliN. Fon1
f>atticipam; the t>nboatdh1g tEi:qultementssl'laffbesetforth in the Partidpant~QHiN
Agreement, !=Qr a Subparticipant,the bnboatding requirernents shall beset forth in
the Subpatfidpant Agreement or the Downstream SubparticipantAgreement, as
applicable.
oNc:the u.s. Departmentof Health and Human.services Officeofthe National
Coordinator for Health Information Technology.
Organr:zed Health Care Arrangement: has the meaning assigned to suchtermat 45
CFR § 160.103.
Participant: 1:0 the extent permitted by applicable SOP(sJ, a U:S; Eridty regardless of
whether the entity fa a Covered Entity ora Business. !'S,ssodate, that has entered into
a Partidpant-t:iHIN Agreementwherebythe b}HN agrees totransmitand receive
ilifotmatibn via QHlN-to-tiHIN ex.c::hange on behalf ofthe party to the Partidpaht"
QHIN Agreementforthe Exchange Purposes::
Particlpant-QHIN Agreement!
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00062
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.017</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
An agreEirnentthatinci>tp◊rates alf.ofthe Required Fi6W~Downs ofthrs
CQmmonAgr¢ementand is between a o.H1N and pne or more ~artii,:lpants;
provided, ht!Wevet, that any pt6visior1s ofsaid a~reernentthatpermit.otr:eqilite
activities otherthan thosEl required or ()EirmittEld by the Common JWeementshall
not be deemed pan of the Patticipaht"-QHIN Agte.ement as defined herein. For
example,ifthe aijreementprovides tor tra11smissi6hofi11f0tmatio11 tot reasons
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76781
other than the Exchange Purposes, the provisions governing such activities shall not
be deemed part oHhe Partidpant-Q.HIN Agreement as defined herein.
In the event e>f any c6nflitt otlncon.sistency between Qtamcmg Applitahf e
Law, ·the Participant~QH IN Agreement~ and.any other termsand tonditions, the
followings.hall bethe orderof precedenteto the extentofst.ithconflittor
inconsistency: (i)Appticable Law1 (ii) the provisi.ons ofthe Partidpant-OHIN
Agreementthatare.Required FIOw•Downsunderthis.Common Agreement; {iii)fo
the extentapplicabte, the\QTF; (iv}to the extent applicable, the•SOPs;and (v}any
otherterms and.conditions agreedto•bythe parties.
Particip.ant-Subparncipa·nt.Agl"ffment:.
An c1greementthatincorporates aO'ofthe 8eqtlired Flow~Downs oftl'lis
Cornme>n Agreementa11~is between a Partlcipantarrdone ormon,tSubparticipants,
which enables fheS\:Jbpatticipant:(sJfo usetheservices oft:he Partidpantas
described In Sectt()n ~ ofthisCe>mmon ,IS;greementto send and/or receive
information for one or mt>re Exchange PurpC)ses, ptovided,however}thatany
provisions ofsaid agreementthat permit orrequ1re activities e>t:her than thooe
requited or permitted by the comtnQn Agreem.ent shallnotbe,deemed part ofthe
Participant~sobpatticipantAgreementas defined herein. For exattiple, if the
agreement provides fottrahsttiission.of information for reasons other than the
Exchange Purposes,.the provisions governing such activities shall n.ot be deemed
part of the Participant,,SubpartidpantAgreementas defined herein.
lnth!:!. event .of anyconfljct orinconsistehcy bl:!t~een. e>r amQngApplicable
Law, the f>artidpa~t-Sobpattici~ant,rel:!ment, and anyottier terms and
c~nditiQns, the foUo~ing shall be the prder ()f Precedencet<>th~. ej(tent bfsijch
t;C)nflictQr incohsistency; (i}Applicable Law; (ii) the p:tovisions e>fthe Participant:.
sobparticipantAgreementthatare Requlr:ed Flo~DbWns under this Comlnon
Agreement; (iii) tothe<extentapplicable, the QTF; (iv)tothe extentapplicabte,.the
SOPs;and (v) any other terms and conditions agreedto by.the parties.
Privacy anil Securlty:Notice: hasthe meaning assigned to suchtetm in sectio.n.10.3
ofthis common Agreement
Protected Health Information (PHI}: has the. meaning assigned to such term.at 45
CFR § 160;103.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00063
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.018</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
9
76782
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Public Health: with respectto:the definition of Exchange Purposes, a Request,. Use,
Disclosure, or Response permitted under the HIPAARUles and other.Applicable law
f<>r.pµblic health:<1ctiVitiesal'ld purp<>ses il'lv<>lvil'lg <! Pub.lie He<!lthAuthoritY,Where
sµchpublichealthac:tlVities al'ldpurpos:es are perrriitted l>yApplicable li:!W, including
a Use or Pisdpsure peti'l'iitte<em ynder 4$ C:fR §.164.$:ti(bl atid 4$ CFlf§- i64.$i4(e},
B:>rthe avoidat1ce ofd!)ubt;a Publi◊ Health Authority may Request, dse, and
o\sdoseilhet!:!Uhdertot the Exchange Purpose of Public Health to the:ex:tent
permitted byApplicablet.aw ahdthe Frarn~wotk Agreements.
Public HealthAuthority: has themean.1ngassignedto.such term at45 CFR§
164..501.
ClHlN Technical Framework ((lTF):the document described ih Sectron 5.2:ohhis
C<>111111on Agreem,ent andjnc<>.rporatedby referel'lce lntothisCo111m,on Agreem,ent,
as m,aybeam,ended, that may indude: (iJtechnkai requirernel'lts1fUnctionai
requirements, and privacy-andsectni'ty-re!i:!terlrequirementsfor the excha11ge-of Tl
betweenO}tiNs:(ii) intemal-d.HINJunctionalrequire1)'1entsr(iii}technkat, privacy,
and securityf1Qw-down.r:equirern:et1.tsfromth-e.·O.HINt6tl1ePartlcipants-and/or
subpartidpants {ifany) ,n add1tiontothe pr"iVacy andsecurity BequitedFloW-Downs
inthe c-ommon Agte'ernent; arid {i\i} qperational requirements that ettabte the
exchange oHI between and among QHINs,
Qualified Health Information Network (Q.HIN}:to.the extent permitted by
applicable SOP(s}, a Health Information Networkthat is a U.S. Entity that has been
Designated bythe RCE and isapartyto the.Common Agreement countersigned by
the.RCE.
RCE Dl~ctol'Y Service: a technical service provided by the RCE that enables d.HINs,
Participan:ts,and Subpartidpantsto sharedirl'!ttoryinfurmatiofi.•assodatedwith
other Qfl1Ns, Patticipants,.and $ubparticipantsfoordertoenabtetheexchangeofTI
untlerthetoromon.Agr:eement.. ThethM c.i:.irtenttechnitiil endpointSand other
identifying infotmatlonofQHINs, Participants, and subparticipantsare indudedand
maintained as.part ofthe RCE Directory.Ser.vice;
0
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00064
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.019</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
Recognized Coordinating Entity (RCE): the.entity<selected byONCthat will enter
into.the CommonAgreementwith OHINs.ln,orderto impose, at a minimum, the
requiremeJ1ts-oftl1e Co111mon Agreement, includingthe SOPsand the O:TF, on the
QHINsandadminister suchrequirementson an ongoir,gbasis, '(he RCEis a Partyto
this Common Agreement.
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76783
Request(s) (including its correlative uses/tenses-"Requested" and "Requesting"):
the.act of askingfor information inaccordancewith the applicable requirements of
the fra.rnew<>rk Agreements.
~~qutredFJpw-o~wnts); the rlghts 11nd Obligations:sJ~tfottb withl11thls Common
,reern~ntthatSrgnatory iS requited to irn:ot!)Orate in its Participant-QHI~
Agreements and that.Signatory is req.uired.to obligate.itsParticipantsto includ.e in
theifSubpatticipantAgreemertts and thatSigi'.iatOW musttequire Participants to
obligatesubpartitipantsto impose.Qli· their QOWiistreamsubpartieipants, if any;
through their Dow11stteam subpartitipant Agreements. Provisions ofthis common
Agreement containing.such rights and obligations are identified in the.section or
applicablesubsection·title as·"(Required.FlowcDown{s)):"
Required lnfe>rmatiom
Electmnic ihformati6i'.i mai11tafi'.ied by any QHIN, Participant, or
Subparttcipant priorto or during the termoftheappficable Framework Agreement:
(i}
thatwould be e.PHI if maintained. by.a Covered Entity or a Business
Associate; and
(ff)
regardless ofwht!ihertheinfcnmafi<>nis orJ1as.already f:>een
transrnitl:edviaQHIN•to QHIN exchange.
0
NOtwithstand.ingthe fotegoing;the followingtypesofinfotmatiOn ar:enot
Required Information:
(a) inforrnati<>n compiled ii'.i feas<>nableantltipatlon:ot otforuseln, a
civif,trimirial1 or administrative action.or proceedin~ or
(b) pwd1otherapy notes(as defined at45CFR 164.501}.
ResponseM(ineiudingitsc:orrelative uses/tenses "Respond~d"arid
~espondmg"): theactofproviding inforrilation orthe•intormation.pfolfided.·111
.aceo.rdance with the applicabler'equirements..ofthe Ftamewdrk Agreements.
Signatory: the entity that has satisfiedSection 4.1 and is a Partyfo this Common
Agreement
Standillrd OP~illttllg Protedµi:eM ◊fSOP(s):lwr:ft:ten pn~cedi.lre or other Pt6vlslon
thatfs ach.>pted porsvanlt(> the C<>rtirnon Agreement and lnc:orpotat~d byreferenc;e
intothi!f Common Agteement1op:rovide detailed informatioo or requirements
relatedtothe exchange activities undenhet:ommon Agreement, lodudingali
amehdments thereto and ahy newSQPsthatar:e adopted pmsuantto thecommOn
Agreement. SOPs will be adopted toaddtesstheapplicatibn process, the
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00065
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.020</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
11
76784
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Onboarding process,,and other operational processes. Each SOP identifies the
relevant group(sJto.which the S.OPappties,Jncluding whetherParticipants and/or
Subpart,cip.mts arerequirecl to comply witl'ta given SOP, Ar\S()P shall be deerried in
effe:ctwhen ad()pted pursuanttq$eritic>n ?,3ofthis Common,Agr.eernent~ncllisted
on the RCts pubHc website;
Sutipar:ticipal'it: tatheextentp:erm1tted hyappiitahleSOP(s)~a U.s. Entity regardiess
ofWhetherthe entity isa coveredEritityor Business}\ssociate,.thathas entetedinto
either: (i)a .Partitipant"SubpartitipantAgreementto use the services oh ParticJpant
as. described in section 9 ofthis common Agreementto,send and/or:receiVe
information;, or(ii) a DownstreamsubparticipantAgreementpursuantfo which the
servic.es ofaSUbpartidpantare used>as descr.ibed in Section 9 of this Common
Agreemeritto se.nd and/or receive information.
TEFCAlnforrn;1tion (Tl): any infQrmatlon that is exchanged betweel'.l.d.1-HNsJor one
ormor:e.of the Eltthange Purposes pursuant to any of the FrarneworkAgreernents,
Asarnattetofgeneri,d policy, oncetns receivecfbya QHll'-lj.f!:artkipant, or
Subpartfoipantthat ls a Covert!!d fntity orl3ush,ess Associate and ldncorp:otatedJnto
suchrecipient's system ofrecor:ds, the information is no i()nget Ti and is goverl'ied by
the HIPAA Rules ancl other Applicable Law.
TEFCA!Sec:Utity·lncid.ent(s)}
VerDate Sep<11>2014
16:30 Nov 06, 2023
{a)
Anyunintentional acqUisition,actess,or Use6fTI by a·workfo.tte
member or persott.actihg uhder·theauthotity ofaQHtN,
Participant(or Subparticipaht, if such ac.quisition, access, oruse
was.made in good.faithandWithinthe scope.ofauthority and
does notresultin.furtherUseor.Disdosure ina manner not
permitted ynder Applicable Lawar,d this Common Agreement.
{b)
Any inadvertent Disclosure: bya person who is authorized to
access Tlat a QHIN, Participant,orSubparticipantto.anoth.er
person authorized to access Tl atthe same QHIN, Participant,or
Subparticipant,orQrganizedJ-fealthCar.e.Arrangement in which a
QHIN, Participant; or Subp:articipant partidpates<>r serves asa
Bosiness.As:soclate:,andthE!'infotrna!lQnt:ecelved asaresult of
Jkt 262001
PO 00000
Frm 00066
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.021</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
(f) An unauthotiz"ed acquisltibn,atceSs, bfsdosute, or l..lse ofunencrypted ti h1
transitusing fhe ConnectiVity.S"etvicesor pursuant tocany Framework
Agr.~mentbetween Signatory a:nd its Participants, between Signatory's
Pattitipants and theirSubparticip:ants, or between:Subpatticipants, bot NOT
including the following:
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76785
such Disclosure is.notfurther Used or Disclosed in a manner not
permitted under Applicable lawandthis Common Agreement.
(cl
A Disclosure Of TI where a Q,HIN, Participant, or Subparticipant has
a goodfaith beliefthatanunauthorized person to whom the.
Disdosurewas marle,would not reasonably have been,ableto
retain such i:nfon:nation.
{d)
ADisdosure.ofTI that has b.een de-identified in accordance with
the standard at 45 CFR§ 164.514(a),
(iil other security events (e.g., ransomware attackst as set forth iitan SOP/that
preventthe affected QHIN, Participant1.or subparticipantftom resporidin!J to
requestsfodnformation auequired under this Common,Agreementor
otherwise adversely affectthelr. participation in QHIN-to-QHJN exchange.
Threat C~ndition: (i),a b{each ofa f1!ater:iat provisk:m ofthis Common Agreemellt
thathas 11ot beencured within fifteen (15f days tif receiving no't1ceofthernateriat
breach(orsuch Qther periQd of timetowhich the Parties have agreecU, which notice
shaU include such specific information about the. breach that the {tCE has awdlable at
thetitne of the r1()tlce;J1r(ii)a TEFq\Seturitylncicfont;ot.(iii)an•everrtthat
Signatory,Jts F>artitipant, ortheirSubpartidpant has reasonto believe will disrupt
ridtmal eRdiange undetthe FrameworkAgreements, eithetdue to actual.
compromisi:! of or the need to mitigatecdemQhstratedvulnE!l'abilities.rn. s:ystems or
data of the QHIN; Participant, or Subpatticipant! as: applicable, or could be replicated
in the.systems, networks, applications, or data ofanother QHIN, Participant,or
Subparticipant.
Treatment: hasthemeaningassiglledfasuch term at4SCF8 § 164.501;
Uh~d States: the SQ states, the bfstrkt ofColUmbfa,.andtheterritori~S and
po$se$sionsofthe United Statesinclutling;witMut limitation, all militai:y bases or
other .military installations, emblissies:, and consulates operated.by th¢ United Stl:ltes
government
unsecured: has theitieanihgassigr,edtosach tei:iti at45 CFR § 164AOZ regarding
PAias ifltapplied toTlthatis Individually Identifiable.
u;s. Entity/Entities: any corporation, limited liability company, partnership, or other
legakentitythat {neets all ofthe followingrequirernents:
(i} the entity iS orgaoiz¢cl ur1tl¢t the laws of a state or CO{nmonwealth of the
Vhit1:¥dStates onhe fe'tleral la:w ofthe United States and tssubjecttothe
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00067
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.022</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
i3
76786
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
jurisdiction of the United. States and the state or.commonwealth under which
it.was formed~
(ti) Theeritity'$ pl1ndpalplaceofbusiness,as deternjihed underfederal
common law; isiffthe L!oited.states; c1nd
(iii)!',ione ofthe. erititfs ditettors, officers, or executives, and none ohhe owners
with:a five percent (5%).or greater interestihthe entity, areJisted on the.
Specialty oesigrrated Nationals aMB/oC!kedPetsonstistpublishedbythe
united Statl:!s DepartmentottheTreast:rry's Office of Foreign Asset CMttOI or
on the Department of Health·amf Human Services, Office oflnspector
General(s List ofExcludedlndMduats/Entities.
Opstre.im Subpal"'l:ic:ipant: a S1Jbpa~icipantt)1at provfd'E!s ser*es toa DolNOsfream
Subpartkipant pursuant to a Downstream SubparticlpantAgreementto send and/or
receive h:1formatfon as described ln Sedibrf9•ofthi!i CommonAgre:eml:!nt
u~(sl{includihg~Qrrefattve uses/tenset sn¢h as "Uses," "Used/' and ..Osrng»):
with respecnotl, means.the shating,employment, application~ otilitation,
examlnauon,.or·aoalysis.ofsoch irtfurmationwithinahehtitythat·maihtains.such
intormattoh.
1..2;
Common Agreement Termfnology,
1.2.1.
References to Signatory and Q,HlNs, Assetforth In Its definition and ihthe
iritroductory paragraph ofthis Common J.\greement( theterrn ''Slgnatqry"
is usedtore.ferto the specifrc;entHy thatisa Party to thiS Common
Agreement with the RCE, }Xny 'and:allrights and obligations ofa Ci.HIN
stated herein are bihding upon Signatory upon signing t),eCc;mmon
Agreernentand are also binding upon all other Q.HINs. ftefl:!tences herein
to ''qther dHINs;;; "another UH IN/and similar such termsare used to refer
to any and all other 01:gantzations that have sigrted the common
J.\greementwiththe RCE.
1.2.2,
References to "(Required Flow~Down(sl)'!: Provisionsofth1s Common
J.\greement.containing Required Flow-Downs are.identified in the
applitabtesectionfsubsecti.ontitleas ~(Requiredflow-DoYlli(s))," •For
purpc;ses of impleme11tihgthe Required FJow.-Downs, referencesJ11such
sections/subsectibnsto ''$lgnatoty."shall be:interpreted·to.aisb mean
"Partidpat1t(srand "Subpattidpant($)/' asthe case may be •. Refetehtestq
"Cbmmon>Agteement" shall~ interpreted tQ mean the applic1.1bl:e
FrameworkJ.\gteement~ as thee case may be,
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00068
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.023</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
14
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
1.2.3.
76787
General Rule of Construction. For the avoidance of doubt, a reference to a
specific section of the Common Agreement in a.particular section does not
mean tht1t other sectkms ofthis CommonAgre.ement thatex:pressly apply
to a QHlN {or to a Participant ora Sub participant purswint to a Required
Flowe-Down) ate inapplitt1ble,
2. lru:orporaijoh (if Recitals,. The Recifals sM forth above are lncorporated into this Common
Agreement in their entirety an-cl shali be given foll forte and effect as ifsetfurth in the body
ofthis comm.on Agre.ement.
3. Governing Approach
3.1.
:a
Role of the RCEand bNt.. ONCwas directed ~y Congress in the st Century Cures
.l\ctto, "in collaboration with the National Institute of Standards and Technology.and
other relevant agencies Within the Department of Health and HumanSel'Vices, for
the. purposeofensuringfun network-to-network exchange of health information,
convene public-prlvateand publit-publicpartnerships to buildconsensus and.
develop or support a trusted exchange framework, includinga common agreement
am6nghealth information nMworks nationally;" ONC entered into the contract
With the RCE to implement, maintain, and update the Common Agreement
Under the Contract, the RCE is responsible for matters related to the
development and operation ofthe exchange of Tl.and related activities.
ONC provides oversight of tile RCE's work under the Contract. Under t:he
Contract,.ONC has the right to review the RCE's conduct, Including Designation,
corrective action; atrd/or termination decjslons regarding Q.HINs, the proper
execution. of nondistrlrnlnation and conflict ofinterest policies that de111onstrate a
commitment to transparent, fair,and nondiSctiminatory treatment by the RCE of
QHINS:,arid Whether the RCE has adhered to the requirements imposed upon it by
this cornmon Agreement. ONC may also address complaints made by a QHIN
against the. RCE as set forth in Section 15.6.1. QHINs havethetighttd appeal RCE
decisions as set forth in Section 16 of this Common Agreement.
3.2.
Partitipation in Governance. QHINs~ Participants, and Subpartlcipants shall have the
opportunity to engage in governance.under the Common Agreement.
3.2.1.
Role. the Transltionai CouncHandtheGoveming council, each as defined
belowlshallbe responsible for the following:
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00069
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.024</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
15
76788
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
(il
Serving as.a resourceto the RCE and a forum for orderly and civil
discussion of any issues affecting exchange activities or other issues
that may arise under tl)e Common Agreement;
(ii}
supporting the RCE ii:! itswotktomonitor the exchange ofti t1nd.
other activities under theCortnn<>n Agreement and serving~s a
resourceto the RtE tei identify possiblet:orrectiVe actionsJot
tottditions that disrupt exchange activities, inch.iding, but nqt firnited
to,the foltoWing:
(a)
Provide:advice on fssues related to the Onhoarding of
QHlNs;
(b)
Assist in E!Vafm,tingsuspecte<for allegedrt<:>n-cornpiiance
with requirements in this ComrnonAgreement,.the SOPs,
andthetl.TF;
(t)
Provide inpottegardingwhether to suspend ortetrninate
a QHIN's participation;
(d)
Provide advice regarding issues beforethey become
Disputes and are escalated to.the fotrnal Dispute
Resolution. Process;, and
(e)
Evaluate possible and actual TEFCA Security Incidents,
other Threat Cortditions, and information and/or
recQmrnendatlonsfromthe CybersecurityCouncil,
(iii}
Reviewing proposed amendments to the tornrnOil Agreement, the
QTF,and SOPs and providingfeedbacktothe RtE on the proposed
cnanges;
{iv)
Participating in the developmentofneWSOPs and provri:lingfeedback
to.the RCE on the proposedchangeS:;
fv)
Assistlngthe RCEwith the Dispute Resolution ProcesS:as set forth in
this Common Agreement and the Dtspt1te Resolution SOP;
(vi}
lnforrnlngthe RtEondeveleipmentand updatingqfthe strategic
roadmap for exchange aetivittes under the common Agreement: and
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00070
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.025</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
16
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
(vii).
fransitionartoundL fq prQmote a speedy 13nd effiden:tramp"UP ()fthe Goven:iing
Cpvncil, a "Tr13nsitio11al Q<>uncn" shall$ervef¢r atwet\fe'- (1.2-i month terrnhegi11ning
wlthi11;thirty(3b) days aftet the RCE 'i!r:m:ouneesthe first.group ofd.fitNs that the RCE
Designates.· lhetransitiCinaJ coondtshailsenteas thi(interlnt gover11lnghody tot
the actMUestc,ndUcte.d undertfie Ftan1ework Agreen1efits, 'i!s htC/tefullydescrihed
••
below and ihthe T(iinsitiOl'ial CC/tincilSOP.
Transition to the Governing Council:
3~3.1.
khammond on DSKJM1Z7X2PROD with NOTICES
3A
VerDate Sep<11>2014
16:30 Nov 06, 2023
Advocating forthe value ofthe exchange acti.vities under the
Common Agreement and. promoting,their success.
(i)
Transition Plan Development'-- iii addrtfon fothe responsibHitres
lii,ted·for particjpation·in governance generally, theTransitionl31
Cou11cil shall developthetransitipn plarrfo theGover11ingCbundl.
(ti)
F<>tmati6n◊f dautuses-- the RCE shaltweitkWiththetrar:rsiti6hal
toundl to form theti:iut:uses described In Section 3)ti as part ofthe
tr:ansltidn plan. The·caucusesare responsible-fodde-ntifying
individuaktoserve:ontheGovernihg Cqum:il that will bE! established
at the end ofthE! twelve (12) monthsfolloWingthe formation ofthe
Transitional C()Uncil.
(ili)
Transition Timing_. Atthe end ofthe twelve (121 monthsfoltowing
the.formation of the Transitional Council, the Governing Council shall
assume responsi~ility for particjpatingirrthe governanceofthe
exchange and relate.d activities under the Commol'l :Agreement witti
the f{C:E.
(iv)
C()ntinufty-Notwfthstandihgthe twelve;.. (fi-}nt()nthterm ofthe
Trahsitionaltoundl, thetepresentatives on the transitiohal tountil
willcontinueto sserve in their governance role:tintil the
re11resehtatives of.the Gei.Vel'ning council ate elected and instated.
GovemingiCouncil. A Governing Council shaUbe established through election of
individual members by each ofthe caucuses described below by the end of the first
twelve (12) mohths followingJhe date onwhichtheRCE a11nounces thefirstsetof
O,HINsthatffhas•Oesignated; The efedipn process and•constitutionofthe
Governingtouncills more ftillysetfQrth inthE1Governing Ci::mnclfSQ.P; fhe
•GoVE!rning touocilshall serve anhe l)ermanent govefhing h◊tl'/ for activities
Jkt 262001
PO 00000
Frm 00071
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.026</GPH>
3.3.
76789
76790
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
conducted.undertheFramework Agreements, as•morefully described inthe
Governing Co.unciLSOP.
3.4.1 Caucuses.
3.!L
(i)
QI-IIN.btucus-Every QHIN shailhavetheriglittgappolntone{l}
individual who is 11ffiliated with.thatQHIN,.as either an employee or
inclependentc6ntract6r, to serve as a member ofthe QHIN caucus.
The QHIN caucus will be facilitated by the RCE and shall serve as a
forum for QHINs.ta.meet and discuss.issues.of interest directly
related to the exchange of Tl. and related.activities underthe
Common Agreement.
(ii)
Partlcfpant/Subparticiparit Caucus~ Each Q.t-111\lshaH have the righfto
appoint up to three (3) indhtiduals.whoare affiliated witha
Participant or a Subpart:icipant; either as an employee or independent
(:Mtractor, tg serve as arnernbe.r of the Participant/Subpartldpant
Caucus, In appointing such individuals; QJIINs should consider the.
cornposltionofthefr Patticip.ants and $uijpartidpants and should
endeavor to select persons.who Wilf be representative of the various
p.erspectives ofthe QHIN's Participant/Subpartidpantpopulatic:m.
The Participant/Subparticipant caucuswill.befacilitated by the RCE
and shall provide a forum for Participantsto,meetand.discussdssues
ofinterest.directly related to the exchange Of Tl.and related activities
under the Common Agreement.
AdvisoryGroups, The RCE,in ccmsultationwiththeGoverning toundl and ONC, may
establish "Advisory Groups," fr()m tirnetotirne, for purposes.ofseekinginputfrom
distihctgroups ofs:takehold.ers thatare partiestoor affected by actMties underthe
Frame.work Agreements to better lhforn1the governance process, provide input Oh
certaintopks,.and promote intlusivity. Theprocess for establishingAdvisory Groups
and selecting members is setfotth in the applicable SOP.
4, (lHIN Designation
4,1.
Eligibilityto be Designated. Signatory.affirms that it meets the eligibility criteria
listed below and the requirements for demonstrating satisfaction of these criteria
thatare indudedJnthe On boarding& Designation SOP, Signatory must meet the
following criteria at thetirne Signatory submits an appllcation for Designation:
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00072
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.027</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
is
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
(lJ
Signatory must demonstratethatit meets the definition of a U.S. Entity
and is not owned or controlled byanynon~U.S. person(s} or entityHes).
The specific; requir~d rnec1ns tod~rno11stratetllis c1re set forthin c1nSQ~,
Ml
$lgnatqtY~ a.hie tq exchar1ge Required Ir:1¥ormati◊n, 11s· d'efined ih this
Ct!rnrrtott Agreement The spetlffo,.teq:ulred meat1s w demonstrate thjs
•
are set forth in ah SOP.
(iii)
Signatory.must demonsttatethant hastheabilityto plfrfbrmali ofthe
retfuired functions ofa QHIN in the manner retjoited bythis commM
Agreement,the SOPs,the QJF, and all otherapplicabteguldance from
the RCE, Signatorycandemonstrate this by having been in operation and
supportingthe.query functionality as outlined in the QTF,or other
funptionallycornpara~le e~llange rn~tllod,for at l~ast the tw~lve (12)
calendar 111onths immediately preceding itsapplication:to bE? Designated.
However,the· ~Cf Will cor1sider other evidencethatSignatory·n,ay riffer
tq dernqnstrate c;o01pliancewiththis eligibility criterion as rnqre foltyset
forth ir:1 the applicable sop, NOtWithstandingthetoregoingJlf Signatory
does notdemonsttate that it has been suppqrtihg query functionality as
outlined in the QTF, the RCE rnaydeettithii requirement.to be satisfied
on
interim basis and Designate Signatory under.a pro\iisioi:lal status,
subject to.additional monitoong asfuftherproVidedinthe onboatding&
Designation SOP, includingadditionat review during a provisional period.
Signatory must demonstratethatit hafln place, .at the time of its
application to be Designated, the,organizational infrastructure and legal
authority to cornply with the obligations ofthe Cornmon Agreernent and
aJunctkmirrgsysten,tq govern its Health Information Ne.twork; rr1
addition; Signatory must demonstrate it has the resoutces and
infrastructure to:supporta reliable and trusted network, •The specific,
t!:!ql.lited n,eans to demonstratethis\are set forth in an St)P,
76791
an
(lv)
VerDate Sep<11>2014
16:30 Nov 06, 2023
Affirmation 6fApptrcatiot1•. s1gnatoryrepresents'and warrants that theJnfutmation
in its application is accuraMand complete,to.the best<lfltsknowledge. Signatory
acknowledges thatthe RC.Eis relying upon the. inf.ormatton in its applicati.on to
evaluate whetherSignatory meets the criteria to be Designated and that violation of
this representation and warranty. is a material breach ofthis Common. Agreement If
the {{CE determines that material information in .the applicatiorris not accurate or
complete:, the RCE may r~fuseto DesJgnate Signatory and withdraw Signatory from
011Qqarding and tetminatethls C1>mmonAgreementfn.actordancewith 16;2.2,
Jkt 262001
PO 00000
Frm 00073
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.028</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
4.2,
76792
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
4;3.
QHIN Designation Process. RCE and.Signatory will work.cooperatively.and diligently
to allow Signatory to demonstrate thatit meets the QHIN eligibility requfrements
and can comply with the reql.lirements include<;! in this CC>mrnon Agreement; the
QTF, anti the.SOPS; however;.the burden ls 1.1ponSignatory to demC>nstrate that it
dqescornply with such requirements. Signc1tor:y expressly acknowledges thatthe
RCE is riot required to besignate Signatory in the everit that Signatory fails to meet
the requirements. Signatory agrees thatitWill not representthat itJs a QHIIII unless,
and until,the RCEformally De!>igrilltes signatory. The detailed pr«esidbrthe RCEto
review Signatory's applicatic>n shall be set out in ah SOP.
4A
FormafDesignationas a QHIN. LfSignatory·demonstrates to the RCE'that it meets
the requirements to be Designated, and affirms that itis a HIN, then theRCE will
inform Signatory of its QHlN Designation; The process for Signatory to be formally
Designated shallbesetoutln .an SOP.
VerDate Sep<11>2014
5.L
Change Management Framework, ihe RCE shaltcoordjnate all changes to the
Common Agreement, theQTF,and theSOPs ihCOl'ljunctronwith dNC. In addition to
theattivitiesdescribed below, ONCshalfbeavailabJe•inaconsultative role
throughout the change management process to review any proposed amendments
to the Common Agreernenti the QTF, and the. SOPs as well asthe adoption ofany
new SOP and therep.eal of any existingSOP. The RCE wlll workwith ONC,.the
Governing. Council, and the QHIN and Partidpant/Subparticipant Caucuses, as
outlined below, to consider amendments to the Common Agreement, the QTF~ or
theSOPs and the adoption of any newS()P o.r the repeal ofariy existing SOP,
Provided, however, thatthe actions described in Sections 5,1 throughS,:lofthis
Common Agreement by orwith respect to the Governing Council,the.QHiN. Caucus,
and the Part\cipant/SubparticipantCaucus, as applicable, shall hot be required until
the respective bodyhasheen established as describedln Sectron 3. Signatory
acknowledges that it.and the RCE do nothave the sole legalauthOtify to agree to
changes to this commonAgre.ement,the QTP,orthe SOPs becauseONC willbe
.available in a.consultative role throughoutthe process.and mustapprove all
changes,.additions, and deletions. The Common Agreement must bethe same for
allQHINs.
S,::t
Amending the Common Agreement or the QiF,Jhe RCEis tasked, under lts Contract
with ONC, with updatingthe. Common Agreementand QiF. Proposed amendments
to the Common Agreernent or Qii=may originate from multiple sources, including,
butnotilrnited to,oNC:, the RCE,the GoverningCouncil, theO.HINCauc:us,or the
Partidpant/Subparticipant c:aucus. The' RCE may consultWith the Governing Council,
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00074
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.029</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
S, Change Management
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76793
the.QHIN.Caucus, . or the Participant/SubparticipantCaucus priorto submittingthe
proposed amendment(s)to ONCforconsideration, The RCE.shall collect all proposed
an:rE?ndments an(f submit tl:lem t.o ClNC; who.shc1ll determine whether further c1ction
()n a proposeq amendment is wan:1:mted.
s.:t t
If bNC<tl!?terminestliat a ptbposed amendment.warrants further
considetatibn; tlienthe RC:E Will prt!sent the propos'ed amendment to the:
Governing Cburicil tot its feedback The Governing couneifWill evah.:t.ate the
p:r:oposedamendme:nta:nddetertnine Whethefit•,Mifseek feedback:from
the QHlN caucus, the Par:titipaht/Subpatticipantcaucus,.or both, as
deemed necessary and approprrate, The:Go.verning Coundlwill provide
the RCE Wi:th written feedback on the proposed.amendment, which will
include feedback from the QHIN and Participant/Subpartidpant Caucuses
as appJicable arid appropriate,.
5'.2.2,
The ~CE ~hall consult wtt:t1C>Nt about theGovernlng Councilfeedback"
bNc shall,aftet considatingthefeedb:ackj determine whe;thetthe
proposed.amendmentshould•ptoce:ed afterm1:1k1ng any changes to the
amendment. lfQNC: deddeno proceed with the amendment, itwiil
advance .the ptoposed amendment to th'!'!: QHJN caucus for approval bVa
wtittenvote. An amendment will be approved if at least twO:.thitds: (2/3) of
the votes .dist bytheQHIN caucus members within thetimeframe
established by.ONCfor the voting period are.Jn favor ofthe proposed
amendment. The requir.emenHo consultwith the Governing Cbuncffin
this pr.ovision shall be satisfied by ONC's approval of the proposed
amendment if; at.tile time ofst1ch approval; tile Governing C:ouncffandthe
d.Hlt\l caucus have notyet been estal:!lished,
s.:i.l
thetlme;pedocl fot oNtito tledtlewhethertopraceed or notwhh a
proposedametidmenttotheCommon.Agreement'pu.rsoant.tosectiqh
s::t2 above shall initially be three
months after ONCreceives from the
RCE feedbackfrom the Governingcouncil pursuant tosettib.h s:.2.2 above;:
provided, hoWevei:~that.ONC may, in its discretion, extendthistime for an
unlimited number ofadditional three-(3~). monthtime per1ods.
m
VerDate Sep<11>2014
16:30 Nov 06, 2023
The time.period for ONCtodecide.whetherto proceed or notwfth a
p~oposedarriendmentto tile QTF pursuant to section 5.2,2 above shall
initially·bethree (.3)months.after ONC receivesfrom the RCE feedback
n:om the .Governing Com·tdl pursuant to section S,,2,2 ab:ove; provided,
however; ~hat()J\J<: may; 1n its discretion, eic:tendthistime for one (j.)
additional.three~ (3imot1th•time period.
Jkt 262001
PO 00000
Frm 00075
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.030</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
5:2.4.
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
5;3,
5.2.S.
lfan amendmenuo the Common Agreement or .QTF is approved as
described above, the amendment shall become effective ori the effective
c:fate identified by ()NC.as partofthe amendment process and shall be
binding pn Signatory without anyfurthet action by Signatory or the RCE. If
Signatory is not willing.or able td cornply with the amendment, then
SrgnatorY shall, within fifteen (15)buSiness days of being notified hythe
RCEthat the amendment has been approved bythe QHIN caucus, provide
the RCE Written Mtice .of termination .ofthis Common Agreement effective
no later than the expiratibn of thirty (30}days from approval of the
amendment.
S.2.6.
Notwithstanding the foregoing, ifthe RtE determines that an amendment
to the Common Agreement or QTF is required in orderfor the IKEto
remain.in compliance with Applicable Law;the RCEis not required fo
provideQHINs withanopportuhitytovoteon the amendment However,
the RCE shall still be required to provide sixty (6()) days' adv.mce w!:itten
notice ofthe amertdmentand legal analysis ofthe need to use this
expedited process, unless the RCE would be materiaily harmedby being
out ofcompHance withApplicable Law if it provided the sixty(GO} days'
written notice, in which case it will provide as muth notice as practicable
underthe circumstances. Aliy such amendment to this Common
Agreement or the QTF shall be subject to ONC review and modification
prior to the. RCE providing advance written notice of the amendment to
Signatory. Only those.amendments that are approved by ONC will be
enacted.
Amending; Adopting, or Repealing an S.Ofi; Tile RCE is tasked, under its Contract with
QNC, with developing an initial set of SOPS thatwill be considered adopted when
initially made publicly available prlot to the initial QHIN application periOd (i.e., prior
to anyonesigningthe Common Agreement). The "anrendment;, process set forth
beiow shall also apply to amending the initial set ofSQPsthrough adopting one or
more new SOPs, repealingan SOP in its entitetyjOt amending oneohhe initialSOPs.
khammond on DSKJM1Z7X2PROD with NOTICES
5;3.1.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
Proposed amendments to the SOPs may originatefrom multiple sources
including, but not limited to, ONC, the RCE, the Governing Council, the
Q.HIN Caucus, or the Partitipant/SubparticipantCaucus. The RCE may
consultwith the Governing Council, the O,HIN Caucus, or the
Participant/Sub participant Caucus prior to submitting the. proposed
amendment(s) to ONCfor consideration; The RC:E shall collect all proposed
PO 00000
Frm 00076
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.031</GPH>
76794
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76795
VerDate Sep<11>2014
5,3:.2.
If ONCdetermines.thc1t aproposedameni:lment warrants further
cQr1si:!,iera:tion,thenthe RC(will present the ptpposedamendn:renttP the
Govetnifig toun.cil tot lts feedback, theGovetningCoiJndlwill evaluatethe
propose.d ametidmentand detli!tmine whethe:r'itWill seek feedbackfrom
the QH IN caut:1.$, the Pilrtit:ipant/Subpartit:ipantcauc:us,. or both, as:
deemed necessary and appri)priate. The Governing council Will evaluate
proposed amendments in. atimely manner and ptoVidetM RCE with
written feedback onlhe proposed amendme.nt,
5.3.3.
The RCE shalLconsult wlthONC about the Governing Cbuncilfeedback,
t:>NC shaJl,after considei:ingJhe feedbackdetermille whether the propo!i:ed
ar:nendme11t should proceed after maklngany ctiangestQ ti-re amendment.
If ONCcfecldes toproceed wi'i:hthe amendment; ltwilladvancejhe
propose'd arnendn,enttothe d.H 1NC!lUcQsandthe
l>attitipant/Subpatticlpant Caucus for apprQval byawritten vottt An
amendnient will be ai)pr<>ved lht leasnwo~thirds (2/3}Q'fthevotes cast
b•tthe QHIN caucus arid atleasnwo-thitds (2/3:)Qfttievotescastbythe
Participant/Subparticipant caucus within the tim:eframe established by
ONC fottMvoting period are intavoroftheproj)Osed amendment. The
requirementtoconsultation withtheGoverning Council in this provision
shall be satisfied by the ONCs approval ofthe proposed amendment if; at
the time.ofsuch approval, the QHIN Caucus and the
Partlcipant/Subpartidpant Caucus have not yetbeerrestab[ished,
s::tll
thetii'rieperi<tc:lfor dNCfodecld1,r11111'lethertoPr()Ceec:l or hOt:with a
proposedamertdmentto.ahSOPpmsuanttos.ection5,3.3abe>ve shall
inltially'bethree (:l)rnonthsarterdNt receh,estrom th!!! RCE feedback
from the Govetnihg Council; provided, however, that: (a)ONCmay, in its
discretion, extendthistirnefororte (l)additionalthree" (3~}monthtime
petiod;'ahd (b)ifONC; ina.ddition,determines in its reasoriabledisctetion
thatthe amendment•affects ormay be contrary to.can ONCrequired policy
or another policy of the Department of Health and Human Services,or any
Applicable Law, ONCmayexfend this time for an unlimited number of
additionatthree- (3s) month tirne period$.
5.3.5.
Notwiths(anding·t:herequlremehtfor a ·Parti.cipant/SUbparticipant vote set
forth in :1.3, if the proppsed amendment wiff notliave a mateflal impact
on.any Partidpant!{·ot·Sub1>articipants,dNtmayadvan~ethe propose<!
16:30 Nov 06, 2023
Jkt 262001
s,
PO 00000
Frm 00077
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.032</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
amendments.and submitthem to ONC, who shall determine.whether
furt:heractionon a proposed amendment iswarranfed.
76796
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
amendment to the QHIN Caucus only,..wherebythe amendment will be
approved if both of the followinghave occurred at teasttwo-thirds (2/3}of
the votes ~st by the Q:HINCaucuswithin the ti:mefrilrne establishe.<fby
◊Nt: for the v<>ting periOq are in f.ivqr oft he prop<>sed i:lmendme.nt. the
requiremerrttp.c,o11$UltwJththe QHfNC:autus tn·this ptovisit>h shl:!11 be
satisfiedbyONC'sap~foval·ofthe·1>tOp(>Sedamendment··1f,..atthetihi~Of
such appfQval, the Q!-IIN Catlcus has nQt yet been est'cit)lished. The RCEWill
determine an effec,tiVe date forthe approved antendment subject to
approval ofONC
5;4,
Voting Method. For purposes ofthevofing processsefforth in thisS.ection 51the
phrase "writtenvote" iricludes anyprocess by whic.hthere is a voting record,whkh
may include V91:ihghy eJecttQTlic means.,
6,1.
tooperatiott (Required Flow--Downt slgnatory utrderstanckand acl@:iwiedgesthat
numerous activiti:es with respect to this common Agreement will ilkely involve Other
QHINs and their respective Participants andSubpartlcipants, aswella:s employees,
agents, thitd-partycontractors, vendors,.or consultants of eachofthem. Tothe
extent notin.violation of Applicable Law, Signatory shall incorporate; and shall also
require that its Participants and their Subparticipants incorporate,the following
obligations into all Framework Agreernelltsto which theyare a party, ifany:
khammond on DSKJM1Z7X2PROD with NOTICES
(il
VerDate Sep<11>2014
Notwithstanding the foregoing;Jfthe RCE determines, based onadvice
fromlegaEcounsel,.thatanamendmentto.an SOP.is requiredJnorder for
the RCEto remain in compliance.withApp.lfcabletaw, the RCE is not
requirecl to provide the .QHIN Caucus onhe Participant/SubparticiPi:lnt
Caucus with an opportunity to. vote onlhe arnendmer:1t~ However,. the IRE
shall still be requi~ed to provide shd:y(60)days' advanc,e wr!ftennotice 9f
the amem;itnent and the legal analysis1>fthe need to use this expedited
process; uniesstheRCE wouldbe materially harmed by being out of
COhipliancewith Applicable Lawlflt provtded theslxty(60) days'writteh
notice, ih which case the RCEWill provide as much notice as practicable
under:the circumstances. Any such amendmentto. an,SOPshaU be subject
to ONCteview and modification prior to enactment.. Onlythose
amendments that are approved byONC will be enacted..
16:30 Nov 06, 2023
Jkt 262001
~espQnd In a timely manner, as may be further provided in an sm;to
h:iquiries ftqm the JltE.ot other d.HINsahoUt poSsiblei:ssuesteiatedto
their exchange 9finforrnation under the Common Agreement;
PO 00000
Frm 00078
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.033</GPH>
5;3,6,.
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
(ii)
Participate collaboratively in discussions coordinated by the RCE to
address differing interpretations of requirements in this Common
Agreement, the QTF, or any SOP prior to pursuing the Dispute Resolution
Process;
(iii)
Make reasonable efforts to notify the RCE and other QHINs, as
appropriate, when persistent and widespread connectivity failures are
occurring with Signatory or its Participants or their Subparticipants, so
that all those affected can investigate the problems and identify the root
cause(s) of the connectivity failures;
(iv)
Work cooperatively, including, without limitation, facilitating contact
between other QHINs or their Participants or their Subparticipants and
Signatory's Participants or their Subparticipants, to address the root
cause(s) of persistent and widespread connectivity failures;
(v)
Provide information (or require its Participants to provide information or
to require their Subparticipants to do so) to other QHINs in support of
collaborative efforts to resolve issues or Disputes, provided that such
information is subject to Signatory's right to restrict or condition its
cooperation or disclosure of information in the interest of preserving
privileges in any reasonably foreseeable litigation or protecting
Confidential Information;
(vi)
Provide information to aid the efforts of other QHINs or their respective
Participants or Subparticipants to understand, contain, and mitigate a
TEFCA Security Incident at the request of such other QHINs or their
respective Participants or Subpartieipants, provided that such
information is subjectto Signatory's right to restrict or condition its
cooperation or disclosure of information in the interest of preserving
privileges in any reasonably foreseeable litigation or protecting
Confidential Information; and
(vii)
Subject to Signatory's right to restrict or condition its cooperation or
disclosure of information in the interest of preserving privileges in any
reasonably foreseeable litigation or protecting Confidential
Information, disclose to the RCE information that Signatory, or its
Participants or their Subparticipants, may have that relates to the
following:
76797
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00079
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.034</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
25
76798
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
(a)
cybersecurity risk information sharingprograms;.or
(b.l
$pec.Hic1 i<ientified security flaws in tlli:! c:rpe,atlor1 of the QH 1111
or it:$ Participant!> orthE!tr S1.1t)padil:Jpants thatmay requite
thE! QFflN <>ri~.Participantsor their $ubpattJdpantstotake
specificstepsto plotectthe securityohheh- rnforrt1ati(>n:
tethnol<>gy systems ahd would riot otherwise fa[I into
stJbsettron (a).
111 no case:.shall Signatory be fequiiedto:<fiscfose nor otheflnforrnation
in violation of Applicable Law. ln seeking cooperation, Signatory shall make all
reasonableeffortstoaccommodatethe otherQHIN'sC)schedulesand
reasonable operational concerns.. The costs of cooperation to.Signatory.,shall be.
b()rne by Signatory an:(! shall n()tbe charged:to ttie RCE orother QHll',Js. N.othing
In this Section 6.1 shall motlifyor repfacethe TEFCASecurity lnddent notification
obligath:msunderli'ectf6n f2.,3and; if applkable; Section10.5,3 oHhiS"Common
AgreE!ment,
VerDate Sep<11>2014
16:30 Nov 06, 2023
6.2.1.
Prohibition Against Exd1.1siyffy {Required Flow:oown).. Neither Signatory
nor the RCE shall prohibitor attemptto prohibitany QHIN, Participant, or
Subparticipant from joining, exchangingwith, conducting other
transactions with,or supportlnganyother networks or exchange
frameworks,usingservices other thon·theConnectivityServices,
concurrently with th:e QHIN's, Participat1t's, or Subpartidpant's
participation in exchange acti.vlties conducted under the.framework
Agreements,
6.2.2.
NC) bisttfrninatory Limits.on Exchange offl(Reauired Flow:.
Down).Signatory shall not impede the exchange.of informatitiii as
permitted or: requrtedundtkthe applicable FrameworkAgteements or]tmlt
intetoperabilityWith any other QHIN, Partieipant, Subparticipant, or
Individual in a discriminatory manner, As used inthis$ection 6.2.2,.a
"discriminatory manner'" means:action that is. inconsistently taken or not
taken withrespecttoanysimilarlysituated QHIN, Participant,
Subpartidparit, lndivldual, or group qf themtwhethet itisa.competitor;.or
whether it is affiliated with or has a conti-actuahelationship with any other
entity; or in response to an event. Nbt1Nithstan:cllngtheforegolng,
limitations; load balancing ofnetWtirktraffic,or other activities, protocols,
or rules shaU not be deemr:!d cllseritninatory toth:e exterit thanhey: (iJ
Jkt 262001
PO 00000
Frm 00080
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.035</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
Non-Distrirninatioh;.
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76799
satisfy the requirements of the exception setforth in 45 CFR 171;205;
and/or (ii}are based on a rea!>onableand good'-faithbeliefthattheother
entity<>r group has not satisfied or lllillnotbeablet<>saJisfy ttieapplicable
tE!l'l'l'lS hereof(int::fuding c9mpliant::E! Wri:h..A.pplftable taw}in ,mymc:1terial
respect, including, i-fapplicabte,any 6equirE!d :Flow-bown(s): one b.HlN
s11spending~exchangeactivittes.withanotherdfll Nin accordanc;e With
section )6.4,:ishall not be d1:?erned dist:rimlnci:toty.
6.2,3.
updatesto connectivity Services~ In revising and updatingJts connectivity
serviees from time to.time, Signatory wm uset:ommerdaltyreasonable
efforts to do:soin accordance With generall.yaccepted industry. practices
and implemented inanon•discriminatorymanner;. provided, howevertthis
provision shallnotapp.lyto limit modifications or updatestothe extent
that such revisil>Jls orupdates arere.quiret:I by .Applicable Lawor
irnpJemented to respond prC)lllptly to n~ly discovered ptlvacy or set::urity
threats,
6.2A.
Notice of Uodatestotonnecti\tlwsehlfoes, Sigi,citoty shall irnpJen\enta
reporting protocol t~ provide reasonable 1>riorwritten notice of all
modifieations9t updatesofits connectiVl'ty serVicesto all otherQHIN!i if
:such revisions or updates are\expet:ted toadvetsely affectthe ext:hai"(ge of
Tl betwe.en: QH INs orrequite changesJn:the conn:ettMtyServices ohny
other QHIN, regardless whether they arenecessary dueto Applicable Law
or newly discovered privacy·or security threats.
7, tonftdent:raltfy and Accot1irtabi1ity
1.'.L
Confidential informadon:(Requlred Flow-Downl!iignatory and RCE each agree to
use•all .• confidential Information received pursuantto this. Common.Agreem~mtonly
as authori:tedirnhis Common Agreement and·any applicable sbP(s)and:soletyfor
thepurpos·es ofperforming its ol>jfgations· ondenhis common Agteementor the
ptoperext:hange ofitiforrnation under the commonAgreementand for no other
purpose; Each Partytnayacus a DisdoserandaRecipientjaccordingly.. A. Recipient
wilLdisdosethe.Confidential Information itreceivesonlyto its employees,
subcontractors, and agents Who require such knowledge and use in the ordinary
cour!>E! and scope oftheir •employment or retention.and are obligated to protect the
confidentiality of the t>iscloser's Confidential lnformatiol'.l.il'.lamanner. substantialJy
equivaleritto thetermsrequired hereinforthetreatmentofConfidential
information. Qtherwise* a·Recipientagrees ·not to disclose theConfidentlal
lnforrnati<>n received tQ anyQne except as permitted under this Common
Agreement.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00081
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.036</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
27
76800
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
7.2.
Disclosure of Confidential Information. Nothing herein shall be interpreted to
prohibitthe R~E from disclosing any Cpnfldel)tial Information to ONC, Signatory
acknowledges that ONt, as a Federal government agency; is subject tq the FJf!edom
oflnfonn,3tionAct (''FOJA"}. AnydisclosoreQf Signatory's. Confidential Information
to dNC or anyoNt contractor: wil(be subject toApplicable Law; aswenasthe
limitations, pr:ocedu~, and other relevant provisions ineluded in ahy applicable
SOP(sJ.
7.3.
ONC's ahdJ:he RCE's Approach wheh Requesting Confidential lhforrriation. As.a
matter of general policy, ONC will onl.y request the limited setof Confidential
Information that ONC believes is necessary to inform the specific facts and
circumstances of a matter. The RCE will only requestthe limited set of Confidential
Information that theRCE believes is necessary to ioform the spedfic fac::ts and
circumstances ofa matter.
7k
QHIN Accountability.
7.4.1.
Statement OfGeneral Prlndple. to the extent not prohihitedby Applicable
Law, Signatory shallbe responsible for its acts and ornissiohs,and theatts
or omissions otits Participants and their Subparticipants, but not for the
acts or omissions of any other QHINs.or their Partieipants ot
Subparticipants. For the av.oidance of doubt, a Signatory that is.also a
governmental agency or instrumentality shall not be liable to the extent
that the Applicable Law that governs Signatory does not expressly waive
Signatory's sovereign immunity, Notwithstanding any prQvi5ion in this
Common Agreement to the contrary, Signatory shall not beJiablefor any
act or omission if a cause ofadi()n for such act ()r omission is otherwise
prohibited by Applicable Law, This section shall not be construed as a holdharmlessor indemnification provision.
7;4.2.
Harm to RCE. SUbjecno sections 7.3 and 7'4ofthis Common Agreement
that exclude certain types of damages or limit overall damages, Signatory
sha.11 be responsible for harm suffered by the RCEto the extentthatthe
harm was caused bySignatory's breach,of this Common Agreement and/or
any applicable SOP~
7.4.3.
Harm to Other QHINs. Subject to Section 1,4 of this Common Agreement,
whichexcludes certaintypes ofdarnagesor limits overalldamages,
Slgnatory shall be responsibJefor ha rn:r suffered by another O.HIN to the
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00082
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.037</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
28
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76801
extentthatthe harm was caused by Signatory's breach of this Common
Agreementand/or any applicable SOP.
7;5,
RCE Accountability,Signat'9rywiH not hold the RCE,or anyoneactjng.on its behalf,
including but notlirniteil tq members ofthe Gc>verningtouncil Transitional Council,
caucusesi Cybersecurity CounCil, and anyAdyisory Groupi work group, or
subcommittee, .its contractors~ employees, ocagents liabh!: forany damages, losses,
liabilities, or injuries arising from ()trelated to this common Agteement, excepttb
the extent that st:rch damages, losses, liabilities, or injurie!i atethe direct result.of
theRCE's breach ofthiscomrnor1 Agreement. This section shall notbeconstrued as
ahold-harmless or indemnification provision;
1:f:J:
LIMITATION ON LIABlLITY. NOTWITHSTANDrNG ANYTHING.IN THIS.COMMON
AGREEMENTTOTHEC:QNTRARY, 11\J NO EVENT St:IALL EITHEffTHERCE'S OR
SIGNATORY'S TO"l'ALLIABILIT)' TO EAC:H OTHER AND ~(LOTHER QHINS ARISING
FROM OR RElATIN~TO THIS COMMON AGREEMENT EXCEED AMOUNTS EQUAl TO
TWOMllLION DOLLARS ($2.>0()0,00CIJPER INCIDEN'TAf,IDFIVE MILLION DOLi.A.RS
($:S,000,000)AGGREGATE PER ANNUM OR SQCH OTHER AIVIOONTS AS STATED IN A
TFIEN-iN-EFFECTSOi>; JN.()ROERTO ALLOW FOR THE PERIODIC ADJUSTMENT OF
THIS LIABILITY LIMIT OVER TI.MEWITHOUT THE NEED TOAMENDTHIS COMMON
AGREEMENT~ THISAND ANY$UCH ADJUSTED LIMITATION ON.UABILITYSHALl
APPLY REGARDLESS Of WHETHER A CLAIM FOR ANY SUCH LIABILITY OR DAMAGES
IS PREMISED UPON BREACH OF CONTRACT, BREACH OFWARRANTY, NEGLIGENCE,
STRICT LIABILITY, OR ANY OTHER THEORIES OF LIABILITY, EVEN lF SUCH PARTY HAS
BEEN APPRISED OFTHE POSSIBILITY OR LIKELIHOOD OF SUCH DAMAGES
OCCURRING. IF SIGNATORY ISA GOVERNMENT AGENCY ORA GOVERNMENT
INSTRUMENTALITY UNOER FEDERAL LAW, STATE LAW, lOCAL LAW, OR TRIBAL
LAW AND rt IS PROHIBITED FROM LIMtnNG ITS RECQVER'{OF DAMAGES FROMA
THIRD.PARTY UNDER APPLICABLE LAW, THEN THIS SECTION SHALL NOT APPLY TO
EITHER SIGNATORVORTHE RCE. NOTHING IN Tl·HSSEctlON 7,4 OFTl:USCOMNION
.AGREEIVIENTSHALI.BEC()NSTRUED TO CREATE LIABILITY' FO.R AGOVERNMENTAL
AGENCY OR INSTRUMENTALITY OR OTHERWISE WAIVESOVEREIGN IMMUNITY.
8. RCE Directory
8.1,
Access to the RCE Directory Servke, The RCE shall provide Signatory. with access to
the RCE Directory Service once Signatory has been.approvedfor.suchaccess by the
f{CE, Thetimeframes and requirements for accesstot:he RCEDirectory Service and
use Qfthe RCE biredoryService are set qut in the 0.TFand the OnbQardlng&
Designation $OP,
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00083
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.038</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
29
76802
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
8..2.
Utilization of the RCE Directory Service (Required Flow.Down). The RCE .Directory
Service.shall be. used bySignatoryand its Participants and their Subpartkipantsto
create ii!nd maint{linoperati()n,ll .c()Onectlyity uodt,t'tl'te.Cornmon Agre~rnent, The
RtE i$•· providing $1gnatQry .1.>,dth a;c;cess tQ;: and 1:he rigli0q use; the RCE Oiret:tory
$ervlc~on the eitpres!ttooditlonthat$ignat()rycooly·useand di$¢lose irttc1rmation
eont{line<fihthe RCE Dlrette>ry setvlceas necessary to advance the h'1tended use of
the RC'E: Oirectory Service or as retj_Uired byApplftable la'\i\/, ..Fbr ekample, Signatory
is petmitted to diSdQ'Se information contained ih the RCE mrector:v Service tQthe
wt$tk'forc:e members of its Participant's ot subparticipant's health inforrnatidn
tethhOlogyvendofWho.are engagedih.asSistihgtheiPatticipaot orsubpattidpant
with establishing.and maintaihingconnectivity via this CommonAgreementand
other FrameworkAgreements .. Further,Signatoryshall notusethe information
contained'in the RCE DirectoryService.for marketing.or anyform of promotion oflts
0,1Nfl prqducts and servic~, 1Jnl~s such u~"' Qr disclosure is priffiarily part of.in effort
bySignaforyto e1<pandtor Otherwise impro~, co11nectivityvia.:the CQrnmon
Agreernent,ana any promotion ofSignatQrts QWllprodudsor servlces.isl)nly
inddenta(to:that primary pqrpose. In noevl:\n:t shallSignatoryuseot tliscloset:he
information cQntained in the RCE Directory Service in a mannerthatshOuld be
reasonably e)tp.ectedtO have a detth'nental effect on bNt, the RC:E, other QHlNs
and/orth'eir Participants or subpattitipants, or an.y other individiralor organitatiOh.
Forthe avoidance otdoubt,1n.f0tmationcontainedin.theRCE Directory is
confidential Information ex:ceptto the e.xten:tsuthihforrnatiol\ meets one ofthe
exceptions tothe definition·of Confidentiallnformation.
8.3.
Nb OuplicaUve Entries. Before fisting any entity inthe RCE Dfr.ectory Service under
Signatory as the QHIN for that Participant orSubparticipant,Sig11atory musteonfirm
that the f>artlcipanfor Subparticipant, as the ~ase may be, isnotalready listed 1n the
RCE Direci:Qry Service asa Partkipant of, or a Subparticipan:tunder;anqther QHlllt
Slgnatoryshall not list in the RC'E Directory Ser.viCe any suchdllplkative entry as a
Pattidpant <>f Sub1>articipantof S1gfiatoty; Signatory shall not prevent a f>attlcipl'int
orSubpartiCipant from changin~the QHIN throughwhichthe Participantor
subpartitlpant.engagesine)tthai-igeundera.Frarne:workAgreernent.
lt4.
Maintenance ofRCE Directory Ser.vice~. The RCEshall provide and maintain the RCE
Directory Service on a continuous basis, taking:all necessary steps to maintain
norninallevels ofperformance•and responsiveness,.no less than 99.9% ofthe time.
Commu11ication regarding planned and unplann~d dow11tim~ should be published to
all Participants•and Subpartidpants.prornptly, ih accordance with generally accepted
industry ser\iice levels:, to ensure that:there will be no lapses in servfr:ethat will
materially dlsruptthe operations of SignatOtY•and other QHll'k
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00084
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.039</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
30
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76803
9. TEFCA Exchange Activities
In adl:litiontq thereqtJirementsbelow, a QHIN, Par:ticipant,or Subparticipantmayonly
Re'QUest inform1:1ti◊n under the applicable Frc:1mewor~ Agreen:lerrt: for c:1 spe<:ific Exchange
Pumose (Hhe a.i-hN; Par:tieipant,.or su~pc:1ttlcipant ls thetYPifQf persQn ◊r entity that is
ctescribed in the ffefinition ciftheappllcable Exchange ptJrp®e, $ucha QHiN, Partidpant, or
subparticipant may use, a ausinessAssodate, agent, orc:onttactorto make such a Request,
use; or DisdosureJb(the appUfable Excttange Purpose. For example, only a Health Care
Provider as described. ih the definitiortof Treatment (ota Business Associate, agent, or
contractor acting.or'lthatHealth Care Provider~s behalf} mayReqUest information torthe
Exchange Purpose ofTreatment.
VerDate Sep<11>2014
9;1.
utiltzation ofConnectlvityServices. Signatory maynot utilize theConnectMty
Services for any purpose(s)other than the Exchange Purposes. Signatory is
reponsi~lefor verifying t:he cqnformatlce ofalltransactiOns.ihitlatedbySignafory'.s
Participants and their Subparticipants prior to transmission via o.Hll\J.to•CiH mi
exchange;assetfotth intheQTF. FQrtheavordaneeofdqubt; a QH!N may<>nlymie
the Cont\ectivity Services tolnitiateattansactiorras directed by ,ts i>artrcipants or
their Subpattlcipants or ihhe Q.HIN itself is>authori:zed iJnderthe ass¢rted Exchange
Purpose.
9~2;.
Uses(Reguired Flow-DownkSignatorymay Use Tl in anymannerthah(iJ is not
prohibited by Applicable law; (ii).isconsistentwith Srgnatory's Privacy andSecurity
Notice, if applicable; and (iii) isln accordance withSections.11 and 12 ofthis
Ce>mrnon Agreement, ifapp.Jicable,
9,3,
Disdosures (Required Flowcbown). $ignatory may Disdose Tl provided such
Disclosure: (i)is not prohibitedbyAppllcablelaw; (H)is consistentWith$ignatcJr'{'s
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00085
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.040</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
This Common.Agreementspecifies, amongotherthings, thereasons:for,whithihformation
may be Requested andtransmi.ttedfrom oneQHINte> anotherQHIN, f>artlcipan~and.
Subpartldpantsshould understandt~at, despite their paxt:idpaflon undera Framework
AgreemEmt, P.AlNs are prohibited from engagihginCiHIN-to-QHIN exchange for any
putpos¢ ()then~an an Exchange Pumose L!Ylder this Common Agteen1ent. The R~E
recogt\12.es that Signatory may participate in other healthinf~rrnationexchange networks
and.·Signatory's Patti:ctpants and,their.St.ibparticipantsalsolikely patti:cipate ln other
networks, asweltas non-network inforrnation exchange. This common Agreementtfoes
not affectthese other activities orthe r-easonsJorwhich Participants andsubpatticipants
rnayrequestahdexchange·1nformation.Within their-networks and/or.subjectto.other
agreements. Such activities are not in anyway limited bythe Framework Agreements.
76804
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Privacy and Security Notice, if applicable; and{iii) isinaccordance with Sections 11
and 12 of this Common Agreement, if applicable,
9;4,
Responses (Required Flow.Downs). Signa~ory must SVPP:Q"ri an Exchange Purposes
and rnustRespom:t to au Exchange Purposes thiat at~Jderrtifiedas "requited" in the
Ei<changef>1Jrposes S~P, Signatory rt11.1stprovide.all Requirtidlnf'ot!'nationJhatis
televantfor a required Exchange Purpose, asmaybefurtherspec:ified: in an
illlplementatlon SOP for the applicable Excl'ia'nge Purpo.se, in Response,to a Reqµest
transmittetlViaQHIN°to~QHIN exchange, unlessptovidingthe Required Information
is.pr{)hibited by Applicable: Lali\l otthis cornmonAgreementot ifnot pfovidihg the
Required Information is consistent withaU:Applicable Lawand this Common
.Agreement.
9.4,.1,,
Excep,tlonsfo ReguiredResponses. N<>t\A/lth~tandihgthe f'or,egoin:g,
Sigr1ato!)' is permitted but not required to. Respondtol;IRequest
transrnitledyia QfllN~to 0 QH IN exchange in the drcurnstat1¢es setfhdhih
9Jhi(iHvi) below; provided the. Res~onse: la) is not prohibited
Applica~le Lav,,; (b}is c~nsist~ntwithSignator•lsPrivacyandSecuritr
Notice.; if applicable; and (c)is in accordahce with this Common Agr~rnent.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
{i}
lfSignatotycisa Public. Health Authority/
{ii}
lfSignatory utilizes the Government Benefrts. Determ.ihation
Exchange Purpose, indudingsuch an agency's
agent{s)/contractor(s);
(ijf)
lfthe reaso11assertedforttie Request lslr1dividual Access $ervfoes
and the information would not be required to he provided to an
lndividualJji.lt$Uantto 45 C::F!i § 1fi4,524-{a)(2);regatdles!. of
whethers\gnatory is:a NHE, a covered Ehtlty, ora Busirre!.s
Associate;
(iv}
ff the Requested information is hotReqmtedtnformati6n~
proVided such response would not otherwise Violate the terms of
this CommonAgreement;
M
lfSignatory is a federalagency,fo the eictenUtiatthe Requested
0iscfosureQf Required Information is nt1tperrnittedunder
ft.ppltcable tawfe,g.,Jt: is.Controlled Unclasslfiedlnforrnaiionas
denned atl2. CfR Par:t2®2, andthe party requesting itd~s not
PO 00000
Frm 00086
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.041</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
hy
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76805
comply with the applicable policies and controls that the federal
agency adopled to satisfy its requirements}; or
M)
9;5:.
lfth~ Ex:change PurpOSifis i:iuthorized but not requiredliftthetirne
<>fJhe Request; eitMr qnderthis CbmrntinAgreementorthe
Exc~nge PurptisesSOlt
speciaftegal Reatiirerrfehts (Reauired Flow"oown). lfancito the extentApplicahle
Law requires that an.Individual either consent to, apprcwe! br ptovidean
authorization·forthe use or Disclosure ofthat· 1ndividual'sinforfnattont6<Signatofy,
such as a more stringent stateJaw.relatingto sensitivehealthJnformation,then
Stgnatory;shall refriiinfromthe Use or Disclosure.ofsuch information in connection
with this Common Agreementunless such Individual's consent,approval 1 or
authe>riz~tio.nhas been obtained·consistent vviththe requirements ofApplkable law
and Sectionllofthjs C6mmonAgreementi.including'l.lithout llrnltatie>n
communicated pursuanttotheprocess cfesc:ribedintheQTF. Copleso(such
consent, approval, or'authoti;mfon shall be ma,ntained aocf ttansrnitted pursuantte>
the process described irtthe.oJF by wilid:teverparty'iS requiredtt'.> obtain 1tunder:
A15piicabtet:aw, ands1gnatorymaymakesuch·Ct>pies olthe c:onsent,·approval,or
auth0ritatior1:avaitahre efoctronicailyto anyQH IN, Partifipaht, orsubpatticipaot in
ac.cordance With the QTF ahd toth.e extent permitted byApplicable Law, Signatory
shall maintain Written policies and procedatesto. allow ah tndividual tb..tevoke such
consent, approval, or.authorization on a prospective basis .. If Signatory isanJAS
Provider, the foregoing shaU not beinterpretedto modify; replace,ordiminish the
requirements set forth in Section 10 of th is Common AgreementfoLobtainfng an
lndlvidual's express written consent.
iei. lndi'tidualAcl:HSS'el'Vici!s (Requltt!lf Flo:W~Downs, ifOfferJnqlndivldualAccess Seriitces)
by
Nothlhginthe Pri\iacy·and Sec:utlty N0tic:e or it\the•fndivlduarswritten consentconected
Signatory who lsan fAS Provider pursuant to Section 10.2 and Sectibn 10.3 may contradict pr be
incoosistent With any appticable provisibn<>fSections 1oor 11.
10:1.
Individual Access Services (JAS} Offeriog(s) (Required FloW-:Down}. Signatory may
elect to offer Individual AccessServices to any. Individual in accordance,with the,
re.quirements,ofthis section and in accordance with all other provisions ofthis.
Cqrnrnon Agreement. Nothingi11 this Section 10shall modify, terminateior in any
wayaffect:anlndill:fdual'srightof accessundertheHIPAA J>ri.vac,y f{u1e•at4S CFR
164,514 wlth respectto any Q.lilf',l, t>artklpant, or subpar::tkipanhhat is a Covered
Entityor a 13usinessA'ssodate. Nothing ln this Sec:tic:m io of this Common
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00087
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.042</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
33
76806
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
-Agreement shall be construed as an exception or excuse for any conduct by the
Signatory 1:hatmeets the.definition ofinformation blocking in 45 CFR 171.103.
tttt.
lndi.vidual Consent (Required Flow~Oown}. The lrn:lividual reql.i~tihg lndivitlt1al
Access Servicesshall l:>e ~espc>nsible for completit1g Signatory'$ own supplied form
for<>btii."ining Individual express C:biisertt ih tPnhect:iOh Withthe lndhtiduaf Ac:cess
setvices/as set forth hefow. Slghatory mav implernehtseeute eiec:tr::onit means
(e.g., sec:uree~mail, seel.ir.e web portal}byWhichan 111dMdual may submit slith
Written tonseht.
10.3.
Written Privacy and Security Notice and lndi.vidualConsentfRequired Ffo.w..oowns).
10.3.1.
lfSignatory offers. Individual Access Services, it must develop and make
publidyavailablea writter:rprivacyand SE!CU[ity rioth;e (the "Privacy.arid
Security Notice"}. The PrivacyantfSecurity Notice must:
Bepubli¢fyactessibleahdkept currentat alltlm.es, including
updated versfons;
•
Be shared with anJndi-vrdual prior to the 111ti1wtiuails use/receipt
ofservitesfrorti Signatory:
(iiiJ
Be written in plain languageandJna manner calculated to inform
the lndivfdual ofsuch privacy practices;
lndude,a statement regarding w!tether andhowthelndlvidual's
tr maybeaccess-ed~exchanged, tls~d, and/or Disdose:d ~y
Signatorv or byother persons or entities fowhom/whtch
Signatory Olscfoses or providesaccess tQ'theinfdt.rnatitfri;
includingwhetherthe .lndfVidual 1sttrnaybesoldat ahy time
(includ,ngthe future);
Ind Ude a statem:entthatSignatorf is required to act in
conformance.with the Privacy and Security ·Noth::.e·andmust
protectthe se.curity of the information it holds in accordance with
SectionlOofthis CommonAgreement;
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00088
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.043</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
Include informationregarding whQl11 the Individual may contact
within Sfg_naforyfor further informationregardirtglhe Privacyand
sewrity I\JQticeand/or witfipr1va1:y-related complafnts;
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
;{vii}
Include a requirement bySignatoryto obtain express written
consenttotheterms.ofthe·Privacy•andSecurityNotlcefromthe
lntlividual prior to th:e access"; ei<.<:ha:nge, Use1 or DiscJosu~
(including $ale )ofth:e lndMdua:1'$ ti, othe:r thc:1n Qi$¢fosuresthc:1t
are required t,y A11Plitc:1ijle i.aw;
•fix)
Include. anexpllinatianotthelndi:vidual'Srights, induding, atir
minimum, the. rightssetforth in Settion.10.4, below;
(x.}
Include-a disclosur.eofanyapplicable fees or costs related to IAS
includi:ngthe exerclse.ofrights•underSection 10.4ofthis Common
Agreement; anti
(xi)
lm:ludean.effettilre date.
76807
thedmplementatian of such PtiVaty and Security Noticrr requfrements shall
be set.forth ih the fAS SOPc. If Signatory is a Coveted Entlty; then a Notice of
Ptiva.tyPracticesthat meets the requirements of ·45 CFR §164.520 and
meetsthereqUirementof 10;3,l(hi) above can satisfy the Privacy and
Security Notice requirements. NothingJnthis:SectiM 10.3 reduces a
Covered Entity's obligations under the HIPAARules.
10.3.2.
VerDate Sep<11>2014
16:30 Nov 06, 2023
ltidjvldual Rights (Reauirec:fi::low-Downl. Individuals have, and mustbe dearly
informed of,. thefollowing rights:
(iJ
The rightto requir:ethataHofthe.r lridividuauy ldei'itifiableJriformatiori
maintained by.Slgnatory,as an 1AS Provider be deleted unless such
tleletion is prohibited by. Appli.table2.law; provided, however, that the
foregoing shall not apply to lndividuaUy Identifiable information
-0011tainedina4dit logs.
(ii)
The right to an exportoftheir Individually Identifiable inforrnatlonJn.~
tomputablefqnnattlntludingthe means to ihtetpret $Ud, ihfarrna:tioh ..
Jkt 262001
PO 00000
Frm 00089
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.044</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
io,,t
lfSignatoryis an IASProvider, it mush:ollettthelndlvidual'swritten
consent as required under Section 10.3,l(vii) of this Common Agre.ement at
the outsefofthe Individual's firsiuseofthelndiVidual Access Services and
with any material change in the applicable Privacy and $:ecurity f,Jofrce.
76808
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
The rights,described in this Section 10.4 shall control over any'inconsistent
provisions in Section.11.
10:s, Additional Security Begultements.fotlAS Provi:d~rs.(Requlred Flgw-Downs}, In
addition t9 meeting the appli~able s~urity rli!quirernents !ietf~:th in Sectioh '12,i:f
Sig11atoryis an iAs Provlder itmusrforthersatisfvthe reqtJirements ohhis
subsection.
10.s.1.
scope of security Requirements. lfSignatory'is ah IAS Provider it must
comply:with the applicable seciitityi'equir:eme11ts set forthinlhis Common
Agreementandthe security.SOPs for all Individually Identifiable
informationthey hold, regardless of whether such information is Tl.
10,5.2, Encryption:, If $ignatQrY is an\lAS Provider it is required]o e111:rypt a.II
lndi11idually lde11tlfiable infQrr.nation ttetd by Signatory\, both in trans1ta11d
at rest; regardlessofwhethersuch data are TL
i<ts,g,
lEJcA secotityihddent NoticetoAffected individuals, Each slgnatorythat
is an IAS Providermust notify each lndivicjual whoseTlha:s beenoris
rMsonabty believed to have been atfected bya TEFCA.seturity lneident
involvingthe TASProvider. such notification must be made without
unreasonabledelayand iri nocaselatetthan sild:y (60)days folloWing
Discovery oftheTEFCA.Security Incident The notification required under
this section must be.written in plain language and shall indude,to the
extent possible:
(i}
A btiefdescriptron ofwhat happened, indQdinglhe date of the
tEl=tASecudty lnddel'lt and the date.of its Discovery, ffknoWll;
(ill
J\cfosctiptit>n ofthetype(sJ t>fOnsecuredTrfnVolved ihtheTEFCA
Security lnddent(such as whether fultname, Social .Security
number, date ofhirth,homeaddress, account number, diagnosis,
disability code; ot. other types otrnformatiohwere involved);
(iii)
Any steps lndMdualsshouldtake to J>rotect themselves from
potential harm resulting from the TEFCASecurity Incident;
(iv-)
A brief description of what theSignatoryJnvolved is doing to
investrgatethe tEFCASet:utity Incident, tomttigateharmt6
individuals, an'dtc, protectagainstanyJurther tEFCA Security
lntidents;and
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00090
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.045</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
36
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
(v)
76809
Contact procedures for Individuals to ask questions or learn
additional information related tothe TEFCASecurity.lncident,
which shall include il telephone number (toll-free), e-h'lail addre.ss,
and website with contact information .and/or a contattforh'l for
the IAS Pro.Videt.
To the extent Signatory is aiready required by Applicable Law to
notify an Individual bf an ih(;ident that wcmld also be a TEFCASeturity
Incident, this section does not require duplicative notification to that
Individual.
IO.ft
Survlvalfor IAS Providers {ltequired Flow-t>own). Thefollowing minimum provisions
anet their respective minimum time periods shall continue to apply to Signatory to
the extentfhat itjs an IAS Provider and survive expiration or termination ofthe
applicable Framework Agreement under which Individual Access Services were
provided for the tirne periods andtothe extent described beiow.
10.6.1.
10,6.2.
i'hefoUowing section 10 provisions shall survive the expitation or
termination of the applicable Framework Agreement until expiration of the
time period specified in the definition of PHI at45 CFR § 160.103 under
Subsection 2(tv) ofsuth definition, i.e., fiftt(SO) years afterthe death.of
the Individual for whom Individual Access Services were provided, even if
the information to whichthe provisions apply is not ePHl:
(i)
The terms of the conserit under Section 10.2, Individual Consent,
and the terms.of the Privacy and Security Notice under Section
1(t3.l,whichsets forth requirements thaUpplytothe Privacy
and security Notiee;
(iil
Section 10.3.2., which requires Signatory to tollectthe litdivktual's
written. consent with respectto any rnateriaLchange in the
applicable Privacy and.Security Notice;
{iii)
SectionlOA, Individual Rights; and
{iv)
SecUon lCl.5, Additional :Security Requirements.for IAS Provitjers.
Sed:fon lCLS.3, TEFtA Security lncidentNotiteio Affected Individuals, shall
survive fot a period of six (6)yearsfollowing the etprration ortermination
ofthe·applicable Framework Agreement..
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00091
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.046</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
37
76810
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
10. 7.
Provisfons that Apply to Subcontractors and Agents of IAS. Providers (Required FlowDownt Tothe extent that Signatory isan IAS Provider 1.111dusessubcontractors or
agents with respect to the provision ofsuch Individual Acc.ess Service$; it ~hall
include in a written agreement with each such subcontractor or agent a requirement
to comply with the following:
(i}
To act hi at<Wdance With each Of the applicable consents required of
Signatory under section 10.2;
(ii}
To act In accordance with each of Signatory's applicable Written .Privacy
and.Security Notices pursuantto Section 10.3;.
(iii)
To actin accordance with Section 10.4 when directed todoso by Signatory;
(iv)·
Withrespecttothe informatlonf.or which :the subcontractor or agent
provides se:rvicesto Signatory rn its role as an IAS Provirler,theagent or
subcontractor shall implementthe applicable security requirements set
forth in this Common Agreement (other: than Sections 12.1.5, 12:urand
12.3) andthe securitySOPsforaUsuch Individually Identifiable
information,regardless ofwhether.stith information is Tl, to the same
extent as they appty to Signatory; provided, however, that for purposes
of the Flow-Down Provisions of this Section 10..7, if the IAS Provider is a
Participant or Subpartlcipant, only Sections 12.1'4 and 12.2 shall apply;
M
To encryptall h1diviuually Identifiable information both in transit and at
rest; regardless nfwhet:her such data are fl pursuant to Section 10.5.2;
and
{vi)
To notify Signatorythat is an IAS l'rovldetfor Which it ptovtdes services
with tespect to each tndividualWhose Tl has been oris t.easonably
believed to have been affected by a TEFCA Security Incident involving the
subcontractor or agent in the manner and within thethneframespecified
pursuantto Section 10.5.3.
Each agreement betweenSignafory and a subcontractor or agent with respectto
the provision of Individual Access Services shall also providethatsubsections (il
through M above shall continue in effect. after termination ()r expiration of such
agreement at least unt:11 expiration ofthetirne period specified.in the definition
of PHI at 45 tFR § i60,103 undetsubsection 2(iv) ofsuch definition, i.e,, fifty (50)
years after the death of the Individual towhom the information relates. Each
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00092
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.047</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
38
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76811
such agreement shall also providethatsubsection {vi) above shall .survive for at
least six(6) yearsfollowingthe termination or expiration ofsuch agreement.
11.Privaey
1'.1"1' COrnpliance whh the HIPAA:Privaty RUle(ReqUiredl=lo:w~Down); If Signatory is'a
NffE(but nottot:he extentthatit isactin~as an entityehtitled t<em make a
uovethment Benefits DeterminatiMundei'AppJicabie 1.aw, a Public Health
Authotlty,dr a Government Health careEhtity), thehlt.shalltomplywith the
pr.ovisiohs ofthe HIPAAPriVacy RUie listed belowwith respectto all lndiVidualfy
Identifiable information that Signatory reasonab[y believes is TLas ifsuch
information is.Protected Health Information anctSignatory is a Covered Entity. Such
compliance shall be consistentwithSettion 13,2(Compliancewith Sp.ecific
ObJigati()n~} and e11fo.rced part o{lts@ligatior1s pursuantto this i;:!Jmmon
Agreement.
a~
11.1.L
From 4stFR § i64.S021 Gerieral Rules (Required Ftow-Oown)':
•
Subsection fa)(1)- Dealing with p.ermitted Uses. and Disclosures) but
onlyto:the.extent Signatory is authorized to engage in,the activities
described inthJs subsection of the HIPJ.\A Ptfv'aey Ruie for the
applleable;~xchange Purpose,
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
Subsection (a)(2)(il'"' Requiring Disclosures tolndfviduals
•
Subsectioh (a)!3)- Business Associates
•
Sub.sectio(i {al($)- Dealing with prohibiti:1d Us!i!s and bfsc:l◊sYtes
•
Subsed:lon (bl= Oe~tihg,11V!ff1 ~heMinimmn l'Jec::es$al'.Ystandarcl
•
subsection (Cl- Dealing with agreed~upon restiittions
•
SUbsecti◊h ldl- Deatinlfw°ith dliidentificaticinand te~idElntific~tion of
information
•
subserction (Ei)- Qealingwith 13ys1ness)¼spdat:econ1:tacts
•
Subsectfon (f)- Dealihgwith dec:eas:e.d persons'informatlon
~
Subsection (g)- Dealing:witft petsonaLrepresentatives
•
Subsecti(in (it)- Dealingwith col'ifidential c.ommunkations
••
Subsection (il- Oealingwith Usesand Disclosures consist:entwlt:h
notice
••
Subsection{))- Dealingwith Disclosures bywhistleblowers
45CFR § 164.5041 Organizational Requirements (Required Flow-Down).
PO 00000
Frm 00093
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.048</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
U.f.2,
•
76812
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
11.1.3.
45 CFR § 164.508, Authorization Required (Required Flow-Down).
Notwithstanding the foregoing, the provisions of Sections 10.2 and 10.3
shall control and this Section 11.1.3 shall not apply with respect to an IAS
Provider that is a NHE.
11.1.4.
45 CFR § 164.510, Uses and Disclosures Requiring Opportunity to Agree or
Object (Required Flow-Down). Notwithstanding the foregoing, an IAS
Provider that is a NHE but is not a Health Care Provider shall not have the
right to make the permissive Disclosures described in§ 164.510(3) Emergency circumstances; provided, however, that an IAS Provider is not
prohibited from making such a Disclosure if the Individual has consented to
the Disclosure pursuant to Section 10 of this Common Agreement.
11.1.5.
45 CFR § 164.512, Authorization or Opportunity to Object Not Required
(Required Flow-Down). Notwithstanding the foregoing, an IAS Provider
that is a NHE but is not a Health Care Provider shall not have the right to
make the permissive Disclosures described in§ 164.512(,cj- Standard:
Disclosures about victims of abuse, neglect or domestic violence;§ 164.512
Subsection {d) - Standard: Uses and disclosures for health oversight
activities; and § 164.512 Subsection (H- Standard: Uses and disclosures to
avert a serious threat to health or safety; provided, however, that an IAS
Provider is not prohibited from making such a Disc\osure(s) if the Individual
has consented to the Disclosure(s) pursuant to Section 10 of this Common
Agreement.
11.1.6.
From 45 CFR § 164,514, Other Requirements Relatingto Uses and
Disclosures (Required Flow-Down}:
•
Subsections (a)-(c)- Dealing with de-identification requirements that
render information not Individually Identifiable for purposes of this
Section 11 and TEFCA Security Incidents
•
Subsection (d)
Dealing with Minimum Necessary requirements
•
Subsection (e)
Dealing with Limited Data Sets
11.1.7.
45 CFR § 164.522, Rights to Request Privacy Protections (Required FlowDown).
11.1.8.
45 CFR § 164.524, Access of Individuals {Required Flow-Down}, except that
an IAS Provider that is a NHE shall be subject to the requirements of
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00094
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.049</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
40
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76813
Section 10 with respect to access by Individuals.for purposes.of Individual
AccessService.s andnotthisSection 11.1.8.
11..1.9. 4SC:FR § 164,.528,AccountingofDisclosures IRiffluir¢d Flow"l:iowri).
i:l.,:Lio, From 45CFR §;.164,53.0, Administrative..Requirements (Required Flow•
Down):
•
Subsection {a)--- Dealingwith personneLdesignatlons
•
Subsection (bJ- Dealing with training
•
Subsection (c)- Dealing with safeguards.
•
Subsectiqn {dl- OeaHngwith cornplaints
•• Subsection fel= Dealing with sanctions
•
subsection th- oealingwith mitigation
•
subsection {g)...,. Qealiogwiih refrainJngfrornJntim1datingtn retaliatory
acts
•
Stlbs~eti'cin lhl""' [jealingWith Vllaiverqfrlghts
•
Subsection (i)~ DeaUngJ.vith policies and procedUres
•
S.ubsection (n- ttealingv,,ith dQcumentatfon
n.2. Written Pffvaty Policy lReauired Flow-oown)..Signatobi mustdevelop, implement,
make publicly available, and act in accordance with a written j:frivafy polity
describing its privacy practices with respectto Individually Identifiable information
thatis Used or Disclosed pursuant.to this CommonAgr.eement. Sign.atorycan satisfy
the written privacy policy requirement by includingapplicable contentconsistent
with the 1'.HPAARulesirito its existing Pfi\tacy policyi exceptasotherwisestated
herefrrwith respect to IA$ PrcNiders. This written privacy poIrey requirement doe~
notsupplant the. HIPAA Ptivacv••Rufe.obiigatio11s.ofactH1N, Participant,. or a
Subpartidpant that is a Covered Entity. to postand distribute a NQtic.e of l>rivaty
Practices that meets the requirements of45 CFR § 164.520: lfS1gnatQryis a covered
Entity, then.this written ptivac'y j)ractices reqiliternent tan be satisfied by its.Notice
.of PrivacyPtactices. lfSignatotyis an .IAS Provider, then the writtenptivaty
practices l"eqOirementmust be in theform oh PrivatyandsecurityNoticethat
meets the. requirements of Section 10.3 ofthis•Common Agreement.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00095
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.050</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
12. Security
76814
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
12;1.
General Security Requirements. Signatory shall comply with the HIPAA Security Rule
as if ttie HIPAA Security Rule applied to lndividu,dly Identifiable information that is Tl
reganfless of whether Signatory is a CovE!red Entity or a Business Associate.
Signatory !illall also tomplywi1:h the security requirements stated in Section 14 of
this common AgreE:?ment andspetific i:idditional requiremetrts as describe" in ttie
Q!Fand applicable SOPs, totheextennhat sutti requkements are Mt already
included in the HIPAASeturity Rule; with tespetno all Individually Identifiable
inforrnatiorrthat is Tl as ihuth information were Pfotetted Health Information and
Signatory were a Covered Entity or Business Associate. Notwithstandingariything
else in this Section 12, none of these requirements shall apply to any federal agency
or Public Health Authority.
1:u.1,
CybersecurityCoverage. lnaccotdance with the Cybersecurity Coverage
SOP, Signatory shall maintaln;.throughout the term ofthlsCommon
Agreement: (i) a pqlicy. or polities ofinsurance for cyber risk and
technology errors and omissions; {ii) intern.al financial reserves to selfinsure against a cybet~im::icient; or (iii) some combination: of(i) and (ii}
12~1.2.
CybetseCUtityCertifitatibh.Signatol:y shall achieve and mairitaih thirdcparty
certification to.an industry-recognized cyberseturityfrarnework
demonstratingtornpliantewith all relevant securitytohtrols, as setforth in
the applicable SOP.
12.1.3. Annual Security Assessments.Signatory must obtain athird•party security
assessment and tectmicaJ audit no iess often than amwaUy and as further
described intheapplicable.SOp;. $lgnatorymust also provide evidence of
compliance with this.section and, if applicable, ofapptopriate mitigation
efforts in response to the fitidirigs •of the si'1turity assessment and/or
technlcal audit within thirty (30} daystothe RCE as specified in the SOP.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
ParticipantsandSubparticipahts (Required Flow-Down). Sigl'latb(',' shall
require in its Participant-QHIN.Agreements that its Participants implement
and maintain, and require their Subparticipants to implement.and
maintain,. appropria:te security controls for Tl that are commensurate with
risks to the confidentiality, integrity, and/or availability of the Tl. lfany
Participant or Subpartidpant is a NHE, it shall be required to complywith
the HIPAA Security fMe provisions with respect to an Individually
ldentifiable'information that the Participant or Subpart:idpant reasonably
believes iSTlas ffsuch information were Protected Health Information.and
the Partidpantor Subparticipantwere a Covered Entity or Business
PO 00000
Frm 00096
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.051</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
12.l.4.
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76815
Associate. Signatory shall further r.equire that its Participants implement
and maintalh,.and that its Participants require their Subparticipahtsto
ir:nplernentaryd maintain, any acldfti()nal security requirements that.maybe
setfqrth it1 an SQP applkiible to Patfidpcints:ar:11:f Subpartidpants.. Such
cornpI,aneesh;illbeenft>rce<1.i:i$:. p11tt of the Partkff)antf 11nd
Subparticipants'obligatiqris.·pursuantto the Frarnework Agreements.
12..1.s.
setufity Resoutces@port to Participants. Si@atoryshall make.available to
itsParticipants:(i) security resourcesandgliidahce r-egatdingthe
ptdtection tiHlapplicabJetothe Participants' participation lnthe O.HIN
under the applicable Framework Agreement; and (ii) information and
resources.thatthe RCEor Security Council makes available toSignatory
related to promotion and enhancementofthesecurity of Tl underthe
Frarne1N()rk.Agreernents,
i:Li.6.
Ghiefiriforrnatlon Securlty Officer, the RCE shall designate a penmn to:
serveas the·Ghieftnforrnation.Secµtity Qfflcet·(CISQ)·foracti.vities
coriducted underthe Framewa:tk Ag(eernents: This maybe either an
eropl()yee ol'indepem:lentcontractQr t>fthe Rtt. The RCE's tiSOWill be
responsible for monitOrihffand maintairiihgtheoverall security posture Of
activities conducted under the Framework Agreerneots\and making
recommendations to all·QHINs.regardlngchaflgesto baseline security
practices required toaddress,changes.to the threat landscape. Signatory
agreesthaUt, and not the RCE, is.ultimately responsible forthesecurity
posture-0f Signatory.'snetworkandtheacti\lltiesconducted bySignatory
underthe Participant QHINJ\greemer1tsto which Signatory isa party, as
well astt:re Pafticipant-Subpartidpant Agreements its Participants.enter
into and all Downstream SubpartidpantA~eerneots that its Participarits'
Subpartlcipants enter ii'ito, Si~natoryshi!!Halso des,nat~ person to serve
as its GISQforpurposes of Signatory's participatkmJr1 QHJN-to-QHIN
exthange. the RCE shall establishaCyb:ersecuiitV Council to enhance
c;ybetsecurlty commehsurate With the risks of the activities conducted
undefthe FrameworkAgreements.as more. fully setforth in an SOP.
0
a.
12.,L Tl Outside the. United States(Reguired Flow-Down}. Signatory shall not Use Tl
outside the United States or Disclos.e Tl to any person or entity·outsidethe United
States exceptto tl:i.e extent such Use or Disclosure is permitted or required by
Applkabletaw and exceptto t~e extentthe .Use or Oisc!9sureTs conducted in
conformance wlththe l·IIPJS.A.$ecurltylfole, regardless of whether Signatory is a
Covered EntitY:<>( Business Associate, sfgnatory shall evaluate the risks ()f any
extraterritorial Qsesand/orOisd()sures c;ftl,if.applieable, as{lartofan annual
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00097
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.052</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
43
76816
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
security assessmentand prior to any new.or .substantially-.differenttype of non,U.S.
Use(s) or Oisdosur.e{s), Such security assessment shall include a risk assessmentfo
evc1luc1:tewl:tetherthe Uses C>r Disc;losuresoflnd(vidyc1lly.•ldentifiableinfqrm1Jtion
thafis rec1sonal:)ly believect totJeTl l>y<:>rlo persons 9r entitlesoutsidf:! the Or\'itect
Stiiites sc1tisfie~ the re:quirements of the HIPl(A$ecurityRuie, Thefbregc>ingdpes not
rn(!difyor elirninate any pto.visioflc>fApplici!!hle tawthat<foes not permit a signatory
to bisdose lndiv\duallylclentifiabl~iinfotmationto a per$Pn orentityou:tsidetht!
united states or that impc,ses cb.ridltioh!i or limitations on such msdosure~
VerDate Sep<11>2014
16:30 Nov 06, 2023
12.3.1.
ReceiviqgTEFCA securitvlhcidentNotification._Signatbryshall implementa
reportingprotocolby which. other QHINs can provide Signatory with
notification- of.a TE FCASecurity Incident. In the eventthatthe. TEFCA
Security lncidentinvolves. Tlthat.is de"identifiedinaccordance w.iththe des.
identification standard provided at45:CFR §'. 164..514(a), then no such
reporting obligatiol'I shall. exist.
12.~.2.,
Vertical Reporting of'rEFCA Securftyfrlcldent(s). Slgnatoryshall re:qulrethat
each l'articipant with w.hicll it has entered into a Parti'dpaht-dHIN
Agreement:
Jkt 262001
{i)
NbtifySignatoty>ancll'articipant'ssubparticipants otanyTEFCA
security. tncidentthe Patticipantexp.eri.ences in .accordance with
thetimingand•content requirementsstatedinSection 12.3;
{H)
Require that .each Subparticipant with which the Participant
enters into a f>articipant-Subparticipant Agreement report.any
TEfCASecurity lnddent experienced byor reported tothe
$ubpartlcipanttothe Partidpantandto the subpatticipant'.s
Oownstream.$obpartjcipat1ts in accordance:withthetimingand
contentreqµirements stated in.Section 1ii~;
PO 00000
Frm 00098
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.053</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
12:3. TEFCASeturity Incident Notification. As soon. as reasonably ptacticabl~. butn6t
morethanfive (5) calendar days. after determining that an TEFCASecurity lncidt!nt
has occurred,Signatory shall provide notificationfo the RCE and to all QHINsthat
are.likely impacted,w.hether directly or bynature.ofone.oftheother.QHIWs
Participantsor·Subparticipants,9f•theT~Fc:ASecutity Incident. Sucttno.tifkation
musfindude.sufficient information for the RCE andothersa1'fected to understand
tht! natyreand llkelys-copeoltheTEFtA Security incident: Signatqry shall
supplernentthe informatjoncontai nedlnthe notitkatlon_as it becomes ayailable
and coc>peratewiththe RCE; and w1thothet: Ql-ill\l!l; Partkipahts"and Sabparticipants
thatare likely impacted bythe'rl:F:tAsecur1ty'inddent.
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
123.3,
(iii)
Require that each Subparticipant with which the Participant
enters into a Participant-S11bparticipant Agreement require that
its QownstreamSubparticipatJis report any TEFcii.Securify
Incident experienced bye>r reported to the Downstream
Subpartidpant to the Upstream Stibpartic,pantandto lts own
OoWnstream Subparticipants, in accordance With thetirtlingand
content requirements stated in section 12.3~
(iv)
Notify Signatory of.any TEFCA.Security Incident reportedt.o the
Participant by one ofits Subparticipants;
76817
Compliance with Notification Under Applicable law. Nothing in this Section
1.2,3 shall bedeemedto modify or replace any breach riotification
requirements.thatSignatory may have under the HlPAA Rules~ the FTC
Rule, and/or other Applicable law, Tl:) the extehtSigt)at()ry is already
rE!'quired by Applicable law to notify it Partidpaht, SubpartJcip!'lnt, and/or
another Q.HtN ofan ihcideht that would also be.a TEFCA Security lhddent;
this section does not require duplicative notification.
13. General Obligations
13;1.. Compliance with Applicable law and the Framework Agreements (Required Flow~
Down). Signatory shall comply with all Applicable law and shalHmplement and act
in accordance with .any provision requ·ired by this Common Agreement, includihgall
applicable SOPsand provisions ofthe QTF,
13.2, Compliance with Specific Obligations.
13..2, 1 Responsibility of the RCE. The RCE shall. be respohSible for taking reas<>nable
steps to confirm that Signatory is abiding by the obligations under this
common Agreement and all applicable SOPs, In.the evehtthatthe RCE
becomes aware ofa material non-compliance with any of the obligatiOhS
stated in the Common Agreement or any ofthe appficable SOPs by Signatory,
then the RCE shall promptly notify Signatory in writing. Such notice shall
inform Signatory that its failure to correct any such deficiencies within the
timeframe established by the RCEshall constitute a material breach of this
Common Agreemeht, which may result in termination ofthis Common
Agreement.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00099
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.054</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
45
76818
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
13.2.2 ResponsibilityofSignatory (Required Flow•Do.wnl. Signatory shall be
responsible for taking reasonable steps to confirm that all ofits Participants
areabi<Jtngt>y the ~e.quire<J Flow~oowns a.nd all ;:ipplic:ableSOPs'. ln:the
eventthat Sigrraic?ry bet(?me$ a.wanrof arnateriaf l'lQll.;tompliance by one of
itsJ>,:ntit;Ipants, ttlen $fgnati:iry
pri:irnpt1y \'l()til'y the f>ardcipantih
writing. such riotit.eshall ir:iform the Partidpantthat ibfailute to correct any
.such deficiencies Within the timefrttme establisheiJ by signatory shall
t6nstitutea matetialbreach ofthe Partitipant-QHIN.Agteernent,·which may
result in eaif.ytetminatiOhofsaitlagreement.
shall
VerDate Sep<11>2014
16:30 Nov 06, 2023
Flow.:Down Rights.to.Suspend (Required Flow•Downsl
13.3.1.
Sus.pension Rights Granted to RCE. Each Partidpant-'.QHINAgreement;,
Partic;ipant-Subpc1rticipant}\greement,and Downstream Subpartic:iParrt
Agreementshall inclt1de a graTlt ofauthorfty toth.e R¢ito suspend each
party's r!ghtto engagelhany QHIN~to.;QfON exchange ac.ti\llties if: (l}there
is an aileged vlolation ofsuch agreement or ofApplical:ile Law by the
party/partles;Of).there.is·acogoizabhn~teatt~the securlty.·ofthe
infotmationthanhe RCEreasonably believes is Tl transmitted Pllrstlantto
stic:h agreementor to the infrastructuteottheQlilN; or(iii).suc:h
suspension is in the. intergts otnat1ona1 secutityas directed byal'iagency
of'th.e un.ited.States government.
13.3.2,
Suspension Rights Granted toSignatory. Each oflhe aforementioned
Framework Agreements shall afso,grant.Signatorythe same authority.as
the RCEto suspend a party's righttg engage in any activities under the
FfameworkAgreementifar1yoft!lecirc;umstances described ih subsections
13.3,l (lHHi) above occurw-ith respectto any Participantand/oJ
subpatticip.ant otslgnatorv,
Jkt 262001
(il
Signatory may exercise suihrightto suspend based on its own
determination that any of the titcomstances described in
subsections 13.3.l{i}(ijj) aboveoccotred With respectto any
Participant and/or Subparticipant ofSignatory.
(Hl
Signatory mustexercisesuch right:to:suspendifdirectedto doso
bY the RCE based on the ~CEs determination:thatsuspen~ion is
warranted based on any ofthe cifcurnstances described in
sub~ections 13.3.l (tf-(lli)abovewith respect tt, any Partidpant
andjor·•Sobpart1dpant•.ofSrgnatory,. 1f·thesuspen$lon ofany
Partkipant and/6r SubparticipantofSignatory ifatthedirection
PO 00000
Frm 00100
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.055</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
l3i3;
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76819
of the RCE,Signatory must effectuate such suspension as soon as
practicableand not longer than within twenty.four (24) hours of
the RCE having directed thesusperislot1,µnle!.sthe RCEspecifi~ a
lprnter perind oflime lsp~rfiiitt~lQ effectuatethe sµspensiott.
13•.4.
Survivalfor Parti'cipantsand Subpartidpants'.(ltequiredFieiw~oowns), t:hef0Howir1g
are the minitnum sut\11val ptQvisiOn!. andre!.pective minimtrm time p.etilidS.thatshall
be ilidudedir1e11:hofthe.Fram!iiworkAgteeme11ts otherthan this.comrno.n
Agreement.. s,gnatoryshall ihtludeat leastthefcdlowihg survival provisions 10 all of
its Partitipant.:QHIN Agreements artd shall reqUir-e its Participants to include the
following minimumsurvival provisions,and minimum survival time p.ertods in all their
Partidj>ant•SubparticipantAgreementsas Required Flow•Downsso that such
provisions willalso,be included as minimum survival provisions and minimum
survilfilltirne periods in all DownstreamSubpc1rtidp.rntAgreeme11ts.
i3)hi, $:ed:ion 1,i. tonfidentiaJ infbtn,atibri; shall survivefQt a period tilslx ('Ii)
year5followlr1g theexpiratiorior termlnatiorroftheapplicable Framework
Agreemertt,
13.4.2.
Section 10.6, survival tor: IAS Providers.,to theextentthanhe Participantor
SUbparticipant isa:n rAs Providet~shall survhre folloWihgtheexpirationot
tertnihation.of the applicable Framework p.greemeritforthe respectilte
time periods set forth in Section 10.6.
13.4.3, Sed:ion 111 Privacy, tothe extent that the Participant or Subpartfdpanfls
SL!bjectto Sectlo111l, saidS~tion shallsurvivethe expiration qr
termina1:ionofthe:applkal:>1e Framework Agreement untilthe expiration of
the tlrneperiod specified in thedefinltio11 ofPHI at45CFR§. fli0,109. under
Subsection ~(iv) ofsuchrlefirtlt:i6n., i.e,, fifty{SO) years afterthe death of
the lrtdlvidu<1ho Whom the fofotmation covered by Sectiort fl relates.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Section 12.1..4,..Participants.artdSubpaiticiparits, to the extent t:hat the
Patticiparttotsubparticipant iBubJecttQSec:tiort 12.1.4, said S'Eictior1.shall
surVive0the expiration ortermination•oftheapplicable Framework
Agreement until the expiration . ofthe time period specified in.the definition
of PHI at 45 CFK§ 160,103 under Subsection2(iv) ofsuch definition,te.,
fifty (SO)years ij~er tlle death o,H~e lndividuaJtowhom theinformati.on
covered by Section12,fA relates,
Jkt 262001
PO 00000
Frm 00101
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.056</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
13.4.4.
76820
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
13.4.5.
:i:4;1.
The requirementsofSection12.3.2, Vertical Reporting of TEFCASecurity
lnclctentls),.shall survive fur a period ofsix {6) years fullowlngthe
explratignor teT1T1inati9n <>fth~ !'IPPli<:able FtamewprkAgree!'l'lent,
fransoaret1cV-c•Accessto Partkipant-ClHtN lnfurmatlon. 1f ~itlier ONCottlie•'.Rci: has
a reasonable basis to believe that one or more of the·foliowing sitUatiOos exist with
respecttt>.Stgnatory,thensrgrtatoryshall makeavailabte, qpon Writtenrequest;
copies of its Partidpant~QH.IN Agreements and infQrmattoi'l relating to the. e)(Chahge.
of Tl andthe circumstances giving rise to the basis,for such request. The foregoing
shall be subject to Signatory's right to restrict or condition Its cooperation or
disclosure of information in the interest of preserving privileges but only tothe
extenqhatsuch i11furmationis material tothe tlefense.of a slibsta.nUat!!d c:laim
asserted bya third party. Such situatio11sTnclude: (i)•anaJlegedviolation olthis
Common Agreement or>\pplic:ablelaw; or(ir) a thre:atto thesecurity c>flnformadon
thatthf RC:E oroNC teasonably believes ~ fl transmitted pursuanttothe
Framework Agteements:or tothelnftasttuctute.supporting Ql-llN-to~b.HlN exchange.
The right ofSignatoryto restrict orconditionitscoo:peration orifisdosureof its:
Parth::ipaht0 QHINAgreement(s)ahd ihfonnatiOh relatihgtathe exihange of'TUhthe
interest Ofpreserving pr'Mleges shall riotapplytoa distlosut:e that is. requested in.
the interest of natiOhalsecority.
14;1~ Compliance with Standard Operating.Procedures. The RCE shall adopt Standard
Operating Proc.edures (SOPs) to provide detailed guidance on specific aspectsofthe
excllange.activities under this Common Agreement that are bi11ding on the BCE,
Signatory and, as:appUcabfe, Partkipants and Subparticlp.tnts,. theSOPS anI
rntorporated by reference into this Common Agreement, and Signatory shall c~mply
with all $0Ps thatare applicable to it and shall teqoire that its Panidpants a:ndtheir
subpartldpants.agree inwritihgtn c.Omplywithallapplitable SOPs. If Signatory or
its Partil::ipants:orSubparticipants fail to comJ)lywith any ai,plicable SQP, the RtE
may take tortectiVe action, whichWillJnclode• requiring steps tobtir1gthe
organization into compliance with the SOPahd may intlode reqoirihgSigna:toryto
suspend the ability. ofa Partidpantor SubparticipanHo exchange information under
the Framework Agreement(sl until the non-compliance is corrected to the
satisfaction ofthe RCE,. suspending Signatory's righHo: exchange information under
the CommonAgree~nt or Signatory may have its rightto exchange information
under·the<ComrnotlAgreementterminatedor·be·required toe11sur~ thetermi11atio11
ofits Participant's or aSubpartkipant's tighttoeiechangeir1formationunderone of
the other Framework Agreements. RCE shal}adoptan SOP that provides detaite:d
infotrnaticmabout sanctions.for n<>rt-tt,rnplfancewith an SOP. NgthfrigJn·this.Section
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00102
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.057</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
48
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76821
14.2 ofthis,.Common Agreement limits the. RCE's rights.toterminate.this Common
AgreementunderSection 16.3'.2or 16';3'.3ofthis Common Agreement.
14.3~ Incorporation ofRequited Ffow,Downs in Framewgrk:Agreement:s, lri.addltiorlt:o the
Q1:!ligatic:msqf,S.igm1:torywith res:pectto i~ Participa11ts stated throughout ih thi's
C0l'i'lh'\0'fl Agreement:
!il
Signatory shall 1:te responsible fur ihcOrpofatingthe Reqrnreil FIOW0 Downs
into all Participant-QHIN Agteements,
(ii}
Signatory shall requirefhateach of its Partidpanfs.be responsible for
incorporatingthe Required Flow-Downs into.all Participant•
SllbparticipantAgreements.
{iii}
14;4:
Signatory shall further require that each qflts f>artldpants he responsible
tor requiringthat eachoftheir subpartidpahtsincorporat-e the R~qufred
Flow-Downs into all Downstream SubpartkipantAgre-ements; ff any,
tompiiancewitli theQ,f;llNTed1nltal·•i:ram·ework; sighatorvshaltmeett:he
requirements ofthethen-applicable QTF. Signatory is required to cornpiVWitli ahY
updates. to the. QTF bythe applicable date established by the RCE and approved by
ONC
1S~ DlsputeResofution
VerDate Sep<11>2014
16:30 Nov 06, 2023
Acknowledgementand ConsenHo Dispute Resolution Process. Signatory
ackoo.wledges that it may be .in its bestinterestto r!'lsolveOisputes ~elatedt:othe
€()mm on Agreement through a coflaborative}cqllegial process rather thanJhrough
ch,il litigation, Signatory has reachedth~condusion based.Upon thefacuhat the
legal.and fam1a( issuesrelatedto the exchange and related activities under the
Common Agreement are unique, nover,.and complex, and limited caselaw'exlsts
thataddressesthe legal issues that could aris~Hnconnec:tion with this C6mmon
Agreement. Therefote,.Signatotyshall submit Disputes tothe RCEto be addressed
bythenon.,binding Dispute resolution process·setforth in.an'SO.P(the "Dispute
Resolution Process"). Notwithstanding, Signatory understands thatthe Dispute
Resolution Process-does- notsupersede-orreplace any oversight,, investigatoryj
enforcement, or other administrative actions or processes that may betaken bythe
relevant.. authodty,vvhether or not arising qufofor relc1tedtothe circumstances
givihgriseto the Dispute, RCE andSignatoryare committed to prompdyandtalr:ly
resolving bisputes.
Jkt 262001
PO 00000
Frm 00103
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.058</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
1$1.
76822
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
To·that.end, Signatory shall use its besteffortsto resolve Disputes that may
arise with otherQHINs, their respective Participants, or the RCE.through informal
discussions before see~ingto invo~eJhe Dispute ~ei;oh:.itioll Process., lftheOispute
tannotberesohled thr9ugh co:operation betwe~n Sign1:ftory and the other QJI ll'J(s};
Signawrv rtllJY, on its own behalf oro.n. behaWofits Partitit1ant($t cht)t;>setq submit
the ()isputeto the DisputeResolutiorLProtess, Ukev.rise,Signatory} on its own
behatfa:ridon behalf.ofits Participant(s),wili seektoresolve DillPUtes tnvoh,ingthe
RCE tlm:11.Jgh.good-faith infotmaldistussioosw.rththe RCE ptiOt to ihvoklngthe
Dispute Resolutfo:n Process,
Under no circumstances will the Dispute Resolution Processglve the RCE any
power to assess,monetary damages againstany party to the Dispute Resolution
Process including, without limitation,:Signatory or its Participants or any.other Q,HIN
orits Participants. Except iri acGordc1nce v,,ithSection 15.i, ifSignatoryrefus~sto
participate Jr, the Dispute Resol4tion Processc; such refusal shaHconstitutea ll1ateric1I
breachofthis CommO'n Agreernentandmaybe groundsfortermfnationof
.si'gMtory'spartiCipation i!'l UHll'HO·UHINexchange.
15.2.1.
NotwtthstandihgSettion 1s.1,SighatorVshalf berenevedofits obligation
to participate ih the Dispute Resolution ProcessifSighatory: (i) makes a
goodfaithdeterminationthat is basedupon available Information or other
evidence.thatanother. Q,HIN's•or·its Participants' acts or omissions will
cause irreparable harmfo Signatory or another organization or person
(e.g,, another QfllN or its Particip~nt or an lndividual}tand fii}pursues
immediateinjunctive relief against suchQ.lflN orlts Part1cipantin.a:courtof
'Competent Jurisdictio11 in accordance wit:hSection 18.3. Signaforymust
inform RtE ofsuch actionwithintwo (2.)buslness daysoffilingfor the
injunctive reHehnd ofthe resultoftheaction wlthintweht\f"foUr (24)
hours ofa court of cornpetentjurisdfotion granting or denying in1unctiVe
relief;
15.2.2,
lfthelnjumitive reliefsought in Section15,2.1 is notgrantedand Signatory
chooses to pursue the Dispute, the Dispute must be submitted to the
Dispute Resolution Process inaccordancewith Section15.1.
15;3, Activities during Dispute Resolution Pro:cess,Th~ p.endency·ofa Dispute under this
Common Agreement has no effect on eitherParty's obligations hereunder; unless
Signatoryterrni11ates its ctghtsln accorda·nce with Sec:tion. 16.2 or 16.3.1 or is
suspended in actotdancewith S«tionl6)t2,
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00104
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.059</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
50
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
15.4.
Implementation of Agreed Upon Resolution. If, at any point duringthe Dispute
flesol.ution Process, Signatory and all other parties to the Disputt;? a:ccept a proposed
r1;!$Qlution of the Dispute; ?ignatory and R€E each agret;? to implemeT1t the terms of
the resolution within the agreeclsupontimeframe to the e'.!{tent applicable to each of
·them~
15.5.
ReservafiOJlOf Rights. If, toilowingthe completion of the Dispute Resolution Process,
in the opinion of.Signatory, the Dispute Resolution Process failedto adequately
resolve the Dispute,.Signatorymay.pursueanyremedies available.to it in a com:tof
competent jurisdiction in accordance with Section 18.3.
15,6;
Escalation and Reporting of Disputes to ONC.
15.6.1.
Escalation of Certain Disputes to ONC. Except for RCE suspension or
termination decisions subject to Section 16 c>f this Cornmqn Agreement, if
Signatory has reas.M.to believe that: (i) the RCE is acti0gin adiscrlminatory
maMeror in violation of the RCE's conflict of interest policies; or (ii)the
RCE hasnotactedJn accordance with its obligations stated in this Common
Agreement, then Signatory sha:il have the right, on its.own behalfand on
behalf of its Participants, to make a corn plaint to ONC. The complaintshall
identify the parties to the Dispute, a description Of the Dlspute;a summary
of each party's position on the issues included in the Dispute, the final
disposition of the Dispute, and the basis for the RCE's alleged misconduct
The RCE and Signatory shall each also promptly provide such.additional
information as may be reasonably requested by ONC inorder to consider
and resolve the issues raised for review. Sincethis complaint may include
PHI and may include Confrderitiallnfurmation; the RCE wjll work with QJIJC
to develop mechanisms to protect the confidentia1ityofthis information.
Such protective med,anisms and the ptocessfor escalatlnga tompfaint to
ONC are settorth in an SOP,
15.6.2.
Reportlng ofAnOr:iymized Dispute Information.to ONC.As partofthe RCE's
communications.with ONC, within fifteen (15) business days after the end
of each.calendar quarter, the RCE reports the following information
relatlngto each Dispute that has been submitted through the Dispute
Resolution Process in ananonyrniz.ed format to ONC: (i) identification of
whether the parties to the Dispute are QHIN(s).only, or whether the
Dispute also involves Participantfs);(ii) a description of the Dispute with
reasonable specificity; and (iiiJthe final disposition ofthe Dispute.
76823
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00105
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.060</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
si
76824
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
16. .Appeals to.ONC
16.L
16.2,
Signatoryrm1y appeal the following decisions of the RCE tq 01\JC:
(i)
Suspcensionc>fa.Signatoryor S1,1spensioh ofaSignatbry!s Participant or
subparticipaht; and
(ii)
Termiriation ofa Signatory's common Agreement by the RCE.
ONCahticipates publishing regulations to addressthe.appe.als of arif ofthe RCE'.s
decisions listed in Section 16.1. ONC anticipates issuing sub-regulatory guidance to
address thoseappeals while formulating regulations . .Unti.1 ON C's regulations
governing those appeals are finalized and effective,thesub-regulatory guidance
QNCJssuesshaJI be binding under this CommoriAgr.ee111ent.
i'i.StablltiyoftheQHlN Network
1%1.
Term, this common Agteemehtshalltommence orrthe Effective Date and shall
remain in effect until ltJs terminated by either Party iii ac:tor:dance with the terms of
this common Agreement.
VerDate Sep<11>2014
16:30 Nov 06, 2023
17.2.1.
By Signatory, Signatory may withdraw from Onboardihg.and terminate this
CommonAgreementat any time before itis Designated if it determines
thatitcarinot meet the requirements of being.a QHINor if!tchooses riot to
conHnuet<> seekstafos as a QHll'J. Signatory must provide,at leasi:flfteen
(15) calendardays'Writtennotice to RCE of its intention to withdrawfro111
Ohboardingand terminate this Cqmmnn Agreement
11.2.2.
By the RCE. If SignatotyfailsJo compfote the 6nhoardingFeqUiremeots
within the titneframe spt:!tffied irrthe Onboarding& Designation SOP, the
RCE may withdraw Signatory from Onboarding and terminate this Common
Agreementupon fifteen {15} calendar da.ys' written notice toSignatorythat
Signatory has faHed,to meet the Onboarding requirements and, therefore,
cannot be Designated. The foregoing shall not be. interpreted as precluding
Signatory fromreapplying for Designation ata future time,
Jkt 262001
PO 00000
Frm 00106
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.061</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
11;2~ Withdrawal and Termination Piforto QHIN Designation;
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
17.3.1.
Termination by Signatory.Signatory may terminate this Common
Agreement atany time without cause by providing ninety (!39)days' prior
written notice to RtE. Signatory may also tt':!rrninatE! fon:aus.eifthe RCE
commits a material breach pfthe Common Agreement; and the RtE fails to
tare its material breach within thirty {30) days of Signatory providing
written notke to RCE ofthe material btea.ch; pto.vided, however, that if
RCE is dlligentiy working to cureJts. matetlalbreach at the end of thisthirty(3~) day period, then Signatory mustproVide the RCE With up to another
thirty {30) daystotompletec its cute.
17.3.2.
Termination by the RCE. RCEmay notterminate this common Agreement
.Without.c;ause as described inthisSection 16.3.2 or Section.16.3.3 ofthis
CommonAgreement. RCE may terminate this COmrnonAgreernentwith
immediate. effect by giving notice to.Signatory if, (i) Signatory is in. material
breach ofanyofthe terms and conditions of this Common Agreement and
fails to remedy such breach within thirty (30)days aftetrecelvingnotice of
such breach; provided; however, that if Signatory is diligently working to
cure its material breach at the end of this thirty- (3~) day period, then RCE
must provide Signatory With up to arrotherthitty (30) days to complete its
cure; ot (ii) Signatory breaches a material provision ofthis Common
Agreementwhere such breach is not capable of remedy.
17.3.3.
Termination by RCEifthe RCE Ceases fo be Funded. The Parties
acknowledge thatthe RCE's activities under this Common Agreement are
supported by ONC funding. tfthis funding ceases, there a.re no guarantees
that the RCE will ccmtinue unless a financial sustainability model has been
put in place. lffederal funding ceases, or ifl:he available funding is not
sufficient to pJ6vide the necessaryfundfngt6 supp6rt opetatron ofthe RCE
and there istm,successor RCE;.. then the RCE may terminate this common
Agreement by pr6Viding one hundred and eighty (180) clays' prfor wtitteh
notice to Signatory.
17.3.4.
Termination by Mutual Agreement The Parties may terminate this
Common Agreement at any time and for any reason by mutual,wriften
agreement.
76825
17.3.5. Effect of Termination of the. Common Agreement
{il Up.on termination of this ComrnonAgreementfor any reason, RCEshall
promptly remove Signatory and its Partl!;ipants and Sub participants from
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00107
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.062</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
53
76826
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
the RCE Directory Service and .any. other lists of QHINsthat RCE
mainta'ins.
M lJpQn terrni.hatiiln Qft:his CommoriAgreernent f9ranyreasQh., Signatc,ry
shall; Withoutun(Jue •delaY/(~l retne>ye:affteferencii!sthat1dent1fy itas a
QHINftoma11.media1 ahd.(b) cease:al(use:Qtarwmatetial, intfu(Jingbut
notlirrifte:cJ tOJitaduct mant.1ats, marketingliterature, and web content
that identifies itas a QHIN. Within t'1Vehty (2Qt business days of
termination of this CommonAttreement,.Si:gnatory shall confirm to RCE,
ih Wl'iting~ that it has complied with<this Subsection.
(lii)Tothe extent Signatory stores Tl, such TI may not be distinguishable from
other information maintained by Signatory. When the.Tris not
distinguishable.from otherlnforrnation;it is not pc,ssibleforSJ:gn~toryto
r:eturn or dest:royTIJt maintains upon termination or explrafion e>fthts
Common Agreement. Upon terminatkm or e)(JliraHon oft:his Common
)\greeme.nt;ifSt:gnatoryis sl.!bje:cttt:iSettion i:tofthis Common
)\greement,such sections. shaffcontlnueto applyso longasthe
informatiortwould bee:PHI ifmaintalMdbya t:overedEntltyor Busfr1ess
Ass◊ciate: The: prOtl!ctions required undenhe HIPAA se:curity Rule shalt
alsotontlhUe toapplytoall Tl that is'ePHl,regardtess otwhether
Signatory is a co11ered Entitljor Business Associate;
flv)ln.no eventshall Signatory be entitledfo any refund of any fees t:hafit
has paid the RCE prior totermination.
17.4.1.
Su'Spenslon by RCE,. ~CE maysuspendSignatoty!s .ahllityto engage in
exchange.a.cti.vltiesunder the Common Agreement.lf RCE determines,
following completron ◊fa prl:!liminary investigatiort, thadignatoryis
responsibteforaThreat Condition. To the extennhat RCE detettninescthat
one.ofSignat6r'(s Participants•.otsubparticip.ants haSdone something or
failedtodosomething:thatresultsin.aThr:eat Condition, RCE may suspend,
or the RCE may direct that Signatory suspend, that Participant's or
Subparticipant's ability to engage In exchange activities under the Common
Agreement. RCE will m.c1ke a reasonable.effort to 11otifySignatory in
advarrceof RtE~s inten.t tosuspendSig11atoryor one ofSignatory's
Partidpants or Subpart:icipants, indudingnotice i;if the threat Condition
giyjngrlsetosuchsuspension, tfadvanceh'Qtke is not·reas<'.>nably
practieabfe under. the:clrcumsta!'ices, thi:r RCE Will nqtify Signatoryof the
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00108
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.063</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
54
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76827
suspension, andthe Threat Condition.giving rise.thereto, as soon as
practicable followingthesuspension. Upon suspension ofeitherSignatory
or pne ofSignatory's .f>articipants ()r $ubpartidpants; RtEwillworl<
1:1;>llaborativelywithSig11atoryi;c; re5Qi1teihe ,ssueleadihgtl;:! ttte
suspensibf'i; .RCfshaO aclopta11·~qp toaddreSS$petiflt::irequlrements al'ld
tiri'\'eiihes related tosuspension,
17.4.2. :selectivesus:pension by Signati::fry. Signatory mav~ln good faith and to the
extent permitted by Applicable taw, deterli'iihethatitmust suspend
exthangihgWith anothefQHINWith which it rsothetwiserequired to
exchange in accordance with an SOP because of reasonable and legitih'late
concerns• related to the privacy and security of information that is
exchanged .. lfSignatory makes.this determination, it is required to
pi::ornptly notify the ft.CE and t~e ctH!N that.Signatory is 5uspe11dingofits
decision and the reason(s}for makingthe decision,. lfSignat:ory makes the
decislon to 1msp.e11d, it is required; within thfrt;y (30) days,Ao iniHate the:
Disputeflesolut,011 Process in order to resolvewhateverlssues led to the
dedsro11 to suspend, or end lts:ruspensiorrand resume exchanging with the
otherQHIN. Providedthat.Slgnatory selectively sus11ends exchanging with
another QHIN in atcotdancewrththis section and in.accc>rdante With
Applicable Law,suchselettive suspension shall hc>t be deemed a violation
of SettiOri 6,2.2.
11,4.3. Additional Suspension Rights of RCE. Notwithstandlnganythingtothe
contrary set forth herein, the RCE retains the.rightto,suspend any
ex.changeacthtity under the C'Qrnrnon..Agreement(i) upon ten (10) days'
prihrl1otice ihhe lt(:fdeterminesthatSignaforyhas create<:! a sJ'l:uat:ihn In
whic~Jhe RC:fmaysuffermaier1al.hat:m•andsuspensionis '1:heo11ly
reasonable step ~hatthe RCEcan taket() profi!ctitseif; or(nJ immediately if
the RCE.determines that the safety or security ofany perso.n or the privacy
or secutityofrtand/or Coitfidential Information is threatened. ln the case
c>f ah irrtmediate suspension under this section, th'!! RCEWUI provide nottce
as soon aspracticablefollowing thesuspensibh.
17.4.4.
Effect ofSuspension. The suspension of Signatory's.ability to. participate in
any activity under this Common Agre.ement pursuantto this section has no
effectonSignatory's otherobligations hereunder, including, without
limitatioll,obligations with respectto privacy and securjty, Durlngarw
SU$pension pursuant to:thls section, Signatory's inabllifyto ex.change
infc>nnationundenhis common Agreement or comply with thc>se terms: of
this common Agreementthattequke information exchange shall not be
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00109
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.064</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
55
76828
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
deemed a breach ofthis Common Agreement. In the .event ofsusp.ension
of Signatory's.ability to participateln exchange activities.under this
ComrnqnP,greern,eot, Signat9rys.ha!I i:omrnunrcate to its Partidpants1 an.d
requlr¢thatthey cornrnunicatetlltheirSubparticipan'r.>, that QHIN~t<>.Q.HIN exchange<>n behalf Signatorts Participtjnf$ andSU~particil)ili')~
will also be sµspendedduringanyperlQd ofSignatory's suspension,
an
of
ms~
su¢tessbtRCEand Transition.
17.5..1.
selection llfRCE.arid successor RCEM ahdContirii:iirig Obligations.
Signatory agreesthatONC had the right to select the initial RCEand that
ONC shallhave the righttoselectany successor RCEand/orto act as an
interim RCE untiLsuchsuccessor RCE has beenselected .. Signatoryfurther
agreesto 11119t~c9oper:ativeJywiththet:tCE aJ1d anyinterirnor successor
RCE selected b.y ONC:lnac.cordance withthtsCpmmo11 Agreement.
Addi1:fonahy~ Signatl:>ryshall continue 1:0Jibide by the provis1onsqfthi~
Common Agreernentduringthe transitiontq any interfrn ot succe!;.sor RC;E,
ii. s.2. RCE Transitibn setviees, lri tlie evennhat ONC selects a. successor RCE, the
then-current RCEwill berequired tocontinuesuppOrtingfunttions
throughouta>riinet'f .(90-).daydoseout period. lfONc.actsas an interim
RCE prior tothe appointment1>fa successor RCE>the references to
successor RCE shall apply to ONC as the interim RCE.
18.Fees
VerDate Sep<11>2014
16:30 Nov 06, 2023
Fees l'aidbyOHINs fo the RCE, Signa~Qt:Y shall pay the fees setfortfro11 Sihedule1
attached hereto (the "QHlN Fees"); RCE shalnnvofoe,Signafor,yf<>t all Feestn
ac:cordat)ce 11111th Schedule i. Unless otherwise setforth in.Schedule 1; invokes shall
be due and payable by Signatory within sbtty (601 days i:lfterteceipt thereof unless
Sl~atory notin~ RCE ih\,\trlting thatit is c~ntesting the accuracy ctf thel~~oke and
identifiesthe speeifictnaccuracies that itasserts, QHIN Fees contested under this
section shall be resolvedbetween.Signato,yandRCE as stated in the appli.cable SOP.
Other than with regard to invoiced amounts thatare contested in'.good faith, any
:collection costs, attorneys' fees or other expenses reasonably incurred by RCE in
collecting amounts due under this Common. Agreement are the responsibility of
Signatory, If Signatoryfailsto pay any undisputed Q.1-1.11\1 Fees when due hereunder,
~CE has the rrght:to suspend Signatory's ahiJityfo partidpatefoany exchange
activity 11nder thts Common:Agreement PtiQr tQ takinganyadion: against Signatory
fornon-payrnent, indu~rngsuspension; R:CE shall provideSfgnatQryten (to) days.>
prior written htitipe, JfSignatQtY makes payrnentw.ithhtten (10) days Qf receiving
Jkt 262001
PO 00000
Frm 00110
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.065</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
.18A,
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76829
written notice, RCE will notsuspend Signatorts.abilityto participate: in any
exchange activity under this Common Agreement. lfSignatoryfails to make
pa.ymentwithinten (10) dc:1ys 9f receh,ing 11otice, the11 the RCE r:nc:1y ir:nplell1e11t the
suspens,ortor m1,1yterrni11ate Signatgry!s.abilifyto participate in any excha11ge
activity onti¢t this (:()mmpn,Agreemimt.
Ut:i.i.
changes to UHIN Fees·, Schedule i may be updated bythe,RCEfrom timet~-tirrie inrelation tQOperatiOnal c~sts, availability ofONCf(lrtding" and
Qther marketfactotsin order to ensure the sustainability df the activities
c6hducted uhderthe Ftarnework Agreements. lri light<>ftheforegoih!t
changes to-Schedule 1 are not subjectfothe change management .process
setforth in Sections; The RC£ shall provideSignatorynotless. than .ninety
(90) days' advance written noticeofany adjustments to the QHIN Fees set
forth in Schedule l,
18.2.,
Fees'Pah:lby@1Ns to other qHINs, Signatory is prohibited from charging fees to,
other Q.HI Ns for any exchange of information Usirigthe Connectivity Servic~s.
19:1.
Ailthoritv,to Execute. SighatorYwartantsahd represents that it has the full power
and authorJty to executethis common Agreement ahd that any representative of
Signatory who executes this Common Agreement has fultpower and authority to:do
soon behalf of Signatory.
1§ ..'2..
Notices,.AU notfces to be made under this Comll1011 Agreel'l'lenl:stial I be given in
writing to Signatory andRCE c1t tile addresses set forth folloWihgeachJ:>arfy'.s
:signature,and shaffbe deemed given: (i) uppn delivery, ifpersonaHy delivered; (ii)
up<>n delivery by overnight delivery service such as UPS tir FE DEX or another
rec()golzed cornrnetdal c::artler: {iii) upon the date:Jndicated on the tetmn receipt,
when sent by the lJhited States P6stal Service Certified Man, return receipt
requested; and (iV)lf byfacslmile:telecommunitatit1n ,o:r othettotm ot'et.ec:trOnit
transmlssion, 1.1poh teceiptwheh thesendingfacsimile machine or electro.niflhail
address receives confirmation oheceipt bythe.receMng facsimile machine or
electronic mail address.
SIGNATORY~-------------
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00111
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.066</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
Name/Title:
76830
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Address:
Facsimile:
tHESEQOOIAPROJECT; INC.
NOtlCEtO:
Name/title:
Address;
Facsimile:
E-mail:
19.3,
Governing Law, Forum, and Jurisdiction.
19.3.1.
Conflicts of Law and Governing Law. In the event of a Dispute between
Signatory and the RCE, the applicable federal and state conflicts of law
provisions that govern the operations ofthe Parties shall determine
governing law.
19.3.:t Jurisdictionanrl Venue. The RCE, currently. aVirginia non-profit
corporation,and Signatory each hereby subm1tsto ttie exclusive
Jurisdiction ofanystate orfederal court sitting in the Commonwealth of
Virginia within twenty0 five (25) miles of Alexandria, Virginia in any legal
proceedingarisingoutofor relating to this Common Agreement unless
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00112
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.067</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
58
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76831
otherwise required by Applicable law. The. RCEand Signatory each agrees
that all claims and matters arising out ofthis Common Agreement may be
tieard and deten:ninec! insucl:i court, arTdeach Party hereby 'A/<1ives any
righttq obl~tJo suchfifing cm grounds ofi11mroper venue;,ft!rf.//Jl nan.c¢nvenil{ns, Pri:itht!t venue:"telated groands,
Ht3.3, Participantand .subpatticipant.Agreements,. Fortheavotdanceofdoubt;
Signatory's Participant•QHIN.Agreements, andthe Participant's PartictpahtSilbpartldparn Agteemertts/as well as any Downstream Subpartitipant
Agreements, shall besubJect tMhe governing law,torum, andJtitisdic:titin
provisionsofthoseagreements.
19.3.4. Sovereign Immunity, No prnvisionwithinthis.Common Agreement many
way coni.titutes a waiver bytl:ie United StatesD!:!partl1lentof}lea~th.a11c!
Hurna11Ser:vlces or: any ()ther part ofthe federal governrnentohovereigo
immuhityor any other.applfoabtelmmunify from sui't orfrorn lic1bUity fllat
the United States Department of' Health atid Human services orather part
C)f the fec!eral government may have by operation oflaw:
19:4,
Assignment .. Noneott:his contmonAgteement,induding but notfimited toanYof
the rights crl'!ated by this common Agreement) can be transferred by.either Party~
whether: by assignment, mergert other operation of laW, change ofconttolofthe
Party or otherwise, withoutthe prior written approval oftheother Party.
Notwithstanding theforegoing, if ONC selects another organization to serve as the
RCE, then RCE shaH assignthis Common Agreement to.the successorRCE.or an
interim RCE as directed by 01\IC,.Slgnatory understands and agrees that no interll'll'Or
successor ~<:tshall haveanypbligatron or liability fur any act e>romissloncfthe
Sequoia ProjectJn connectio.n with this Common Agreement oranyc/f'theother
Framework Agreements:priorto· the termination of The Sequoia 'P(l:)je¢t'sstatusas
theRCE.
19.s.
Fotce Maleute. Neither Party shaff be responsihlefor any•,fei~vs or-failures in
performanc.e.caasedbythe occurrence of•eventsor other<iitcumstancesthatate
beyond its.reasonable control after the exercise ofcommercially reasonable efforts
to.either prevent.or mitigate the effect of any such occurrence or event.
19:6\ Severability, lfany provisiort:ofthis Commc)ll Agreernentshall be adjudged by a11y
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00113
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.068</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
oourt·of cornp.etentjurrsqictionto be urvmfOrceableor·•invalid,thatprovision shall
be modified to the minimum extentnetessatyto atl:ileveJhe purpose ot1gil')ally
fntended; ffppssible, and the remaining provisions ohhis ¢ommon Agreement shall
rerrraih in full fotte am:I effect and eriforceable, lfiS~th provish:m tan®t be modified
76832
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
to achieve the purposeoriginaUy intended, it shall be.severed from the agreement
and the remaining provisions ofthis Common Agreement shall remaininfullforce
and effect and enforceable,
1~.7,
Coo11terparts, This <;:Qlilmon Agreementmaybeexecuted in one Qr mgre
cou11terparts, each ofwhlch shall be tt!nsicleredan original tou1tt:erpa11,tmd shalf
beeome<a btrtdingagr:ee-rrrentwhert each Pattyshall tuive executedtJne cQi,Jnterpatt.
19,8;
Captions, captions appearing 10 this common Agreemeotare for convenieoceooly
and shall. Mt be.deemedto explain, limit, or amptifYthe provisions ofthis Common
Agreement.
19;9; Independent Parties. Nothingeonta1nedlhthis Common Agreement shall be
deernedorcon.strued ascre1:1tingajotnt yenttJreor part11ershipJ>et1NeenSigllj:ltory
and RCE,
~9;1{), Acts oftontrattots and Agents, to the extentthanhe acts or omissions ofa !>artfs
agent(s)or contractor(s), or theirsobconttactt!r(s)> result in thatParty'sbtea-ch of
and HafH!ltyunderthis Ce>mrnM Agreement, saicl breach shall be deemed tb bea
breath b:ythatParty.
19:11. Entire Agreement; waiver. This common Agreement, together with the OJF, soPs,
and all other attachments,.exhibits,and artifacts incorporated by reference,
contains the entire understandingoftheParties with regard,tothesubjectmatter
contained.herein. The failure·ofeither Party to.enforce, at anytime,,any provision of
this Common Agreement shall not.be construed to:beawaiver of such pro11ision,.nor
shallit l11any1N~yaffectthe validity ofthisComm<>n Agreement Qr anypartheteof
orthe right: ofsuch Party thereafter tb enforceeachand every such provisle>n;No
waiver ofanybre1:1ch bhl'i!sCmt1mon Agreement shalLbe held tc>constftuteawafoer
ohny bther (>t subsequent breach, n()r shalt.arw delay by either Partytb exerdse
any rightundenhts Comm~h Agreement operate as a w1:1iver bfanysuchright
19.12. EffettofAgteement, Except as provided in.Sections 7.4 and.Section 1s~ nothing rn
this Common Agreement shall be construed to.restrict either Partts right to,pursue
all remedies available under law for damages or other relief arising from acts or
omissions of RCE or other 0,HINs or their Participants or Sub participants r.elatedto
the Cornmort Agreementi orto Urnitanyrights, immunities, or defenses to which
Stgnato.ry may be entitleq under Applicable law,
i9d.3;
PrioriM.ln•tbe eventbhny ~ortfHct or int()nsistency between Applicable Law, a
pr()vision()fthiS Common Agreement, the QTF,a11SQJ>;and/or any implerrrentation
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00114
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.069</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
60
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76833
plans,guidance documents, or.other materials or documentation the RCE makes
available toO.HINs, Participants, and/orSUbparticipants regarding the operations or
actiyitiE!5cortdt1cted urtdE!rtl')eFrarrtework.Agr.eerrtents, thef<>Howingshall b.e the
<>rder ofp(e<:edence f<>r this t()mrnoo AgrecernenHe> the E!xtentof suchconfUct Qr
mc()nsistet1cy: {i) Applic.1i~je 41w:(2) this document, lncll,lditig R~qµked Fl<>w~t>l)wns
that are to f)e iocorporated iota Framewc:itk Agreements;(~) the QTF; (4) the
o)spute Resolution Process, as set fotthheteii:tantl further detailedtn an SOP; (5) il!II
otherSOPs;(Eil all oth~r attachtnents,exhibits,ahd.artifacts ihtorpdtated heteih hy
rcl'er:ence, a11d (7) othefRCE plans, dotument5, or materials made available
regardiog actMties conducted Under the Fr:amework.Agreements,
19.14. QHIN Time Periods, Any ofthe Ume periods relatingfo the Parties herefolhatare
specified in this Common Agreement may be changed on a case--by,case basis
pursuant tothE! mutu.al writlert.consertt ofthe Pc!rties,< providecfthatthesechartges
.arenot unde(takent<> adversely affect anotherO,HINandpfovidedthatthese
ihangeswould n()t•unfairlybenefiteither Party:to thedetrlment()fothers
paJtii;ipating in allthli1:ies urtder the Framework Agre:em:eots.. Time peri~ds•that
pertain t() 01\lC may not be changed, :extept by bNC, ihdudingthetime periQds for
ONCreview ofpr6pOsed changes to the tommo:n Agreement, the a;f'F; 6£ 56Ps that
ate setfc:irth: in section s.
19.15. Remedles.cumU1at1ve. The fights arid.femedies ofthe Parties pr.oVided in this
Common Agreement are.cumulative and are in addition to any other rights,and
remediespro.videdbyApplicable Law.
19.11:>. Survival of Rights and Obligations. The respective rights, obligations( and liabilities of
the Parties w1th respecttoact; or omissionsthatoccurby either Part:ypriort()the
datecof expiration or termination ofll:lis Common Agreemen'l:shaH survive such
expfration or termination, F()IIQWing any expiration orterminationohfils Common
Agteement,the Partles shallthereafi:et cooperate fuUyandwork diligently in good
faitht() achieve. an orderlyresoluti6n.ofallmatters resultltlgfrt)m s.uch:expi(ationor
terrninatic:m.
19~16.1. Thefollowingsections shallsurvive expitatkm ortermiriationofthis
Common:Agr.eementas moresp.ecificallyprovidedbelow:
(i) The fQllowingsecti()ns shall survive in perpetuity following the
expiration orterrninatior1.ofthis ComrnonAgreement:iSectfons7-.4
Umitatibn of liability; 1lk2 Nof1ces;t8..3 Governiogtaw, Forum and
Jurisdidibn; 18,oSeverability; 1$.sJm:fep:ehdent Parties; :ia.toAtts of
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00115
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.070</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
61
76834
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
Contractors and Agents; 18.11 Entire Agreement; Waiver; 18.12 Effect
of Agreement; 18:13 Priority; and 18.15 Remedies Cumulative.
(ii) The following sections shall survive for a period of six (6) years
following the expiration or termination of this Common Agreement:
Sections 7.1 Confidential Information; 7.2.1 Statement of General
Principle; 12.3 TEFCA Security Incident Notification; and 14.1
Transparency- Access to Participant·QHIN Information.
(iii) The following section shall survive for the p.eriod specifically stated in
such section following the expiration or termination of this Common
Agreement: Section 16:3.5 Effect.of Termination of Common
Agreement.
(iv) To the extent that Signatory is an IAS Provider, the provisions set
forth in Section 10.6 shall survive following the termination or
expiration of this Common Agreement for the respective periods set
forth therein.
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
PO 00000
Frm 00116
Fmt 4703
Sfmt 4725
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.071</GPH>
khammond on DSKJM1Z7X2PROD with NOTICES
62
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices
76835
IN WITNESS WHEREOF, the Parties hereto, intending legally to be bound hereby, have executed
and delfvered this CommonAgreement as .ofthe date first abovewrltten.
R<;E: THE.SEQUbl,\PRb~E(:T, INC.
Signl!tory: - - - - - - , - - - - - - -
Signature
Signature
By:
By:
Title:
Title:
Date:
Date:
63
[FR Doc. 2023–24536 Filed 11–3–23; 8:45 am]
BILLING CODE 4150–45–C
khammond on DSKJM1Z7X2PROD with NOTICES
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Office of the Secretary
Notice of Interest Rate on Overdue
Debts
Section 30.18 of the Department of
Health and Human Services’ claims
collection regulations (45 CFR part 30)
VerDate Sep<11>2014
16:30 Nov 06, 2023
Jkt 262001
provides that the Secretary shall charge
an annual rate of interest, which is
determined and fixed by the Secretary
of the Treasury after considering private
consumer rates of interest on the date
that the Department of Health and
Human Services becomes entitled to
recovery. The rate cannot be lower than
the Department of Treasury’s current
value of funds rate or the applicable rate
determined from the ‘‘Schedule of
Certified Interest Rates with Range of
Maturities’’ unless the Secretary waives
interest in whole or part, or a different
rate is prescribed by statute, contract, or
repayment agreement. The Secretary of
the Treasury may revise this rate
quarterly. The Department of Health and
Human Services publishes this rate in
the Federal Register.
PO 00000
Frm 00117
Fmt 4703
Sfmt 4703
The current rate of 12 1/8%, as fixed
by the Secretary of the Treasury, is
certified for the quarter ended
September 30, 2023. This rate is based
on the Interest Rates for Specific
Legislation, ‘‘National Health Services
Corps Scholarship Program (42 U.S.C.
254o(b)(1)(A))’’ and ‘‘National Research
Service Award Program (42 U.S.C.
288(c)(4)(B)).’’ This interest rate will be
applied to overdue debt until the
Department of Health and Human
Services publishes a revision.
David C. Horn,
Director, Office of Financial Policy and
Reporting.
[FR Doc. 2023–24568 Filed 11–6–23; 8:45 am]
BILLING CODE 4150–04–P
E:\FR\FM\07NON1.SGM
07NON1
EN07NO23.072</GPH>
Dated: October 24, 2023.
Suhas Tripathi,
National Coordinator for Health Information
Technology, Office of the National
Coordinator for Health Information
Technology.
]]>Agencies
[Federal Register Volume 88, Number 214 (Tuesday, November 7, 2023)]
[Notices]
[Pages 76773-76835]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-24536]
[[Page 76773]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Trusted Exchange Framework and Common Agreement Version 1.1
AGENCY: Office of the National Coordinator for Health Information
Technology (ONC), Department of Health and Human Services (HHS).
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: This notice fulfills an obligation under the Public Health
Service Act (PHSA), which requires the National Coordinator for Health
Information Technology to publish on the Office of the National
Coordinator for Health Information Technology's public internet
website, and in the Federal Register, the common agreement developed
under the PHSA. This notice is for publishing an updated version of the
Common Agreement, version 1.1.
FOR FURTHER INFORMATION CONTACT: Mark Knee, Office of the National
Coordinator for Health Information Technology, 202-664-2058.
SUPPLEMENTARY INFORMATION: This notice fulfills the obligation under
section 3001(c)(9)(C) of the Public Health Service Act (PHSA) to
publish the common agreement, developed under section 3001(c)(9)(B) of
the PHSA (42 U.S.C. 300jj-11(c)(9)(B)), in the Federal Register.
BILLING CODE 4150-45-P
[GRAPHIC] [TIFF OMITTED] TN07NO23.010
[[Page 76774]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.011
[[Page 76775]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.012
[[Page 76776]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.013
[[Page 76777]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.014
[[Page 76778]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.015
[[Page 76779]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.016
[[Page 76780]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.017
[[Page 76781]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.018
[[Page 76782]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.019
[[Page 76783]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.020
[[Page 76784]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.021
[[Page 76785]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.022
[[Page 76786]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.023
[[Page 76787]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.024
[[Page 76788]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.025
[[Page 76789]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.026
[[Page 76790]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.027
[[Page 76791]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.028
[[Page 76792]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.029
[[Page 76793]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.030
[[Page 76794]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.031
[[Page 76795]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.032
[[Page 76796]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.033
[[Page 76797]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.034
[[Page 76798]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.035
[[Page 76799]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.036
[[Page 76800]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.037
[[Page 76801]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.038
[[Page 76802]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.039
[[Page 76803]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.040
[[Page 76804]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.041
[[Page 76805]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.042
[[Page 76806]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.043
[[Page 76807]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.044
[[Page 76808]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.045
[[Page 76809]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.046
[[Page 76810]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.047
[[Page 76811]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.048
[[Page 76812]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.049
[[Page 76813]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.050
[[Page 76814]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.051
[[Page 76815]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.052
[[Page 76816]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.053
[[Page 76817]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.054
[[Page 76818]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.055
[[Page 76819]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.056
[[Page 76820]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.057
[[Page 76821]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.058
[[Page 76822]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.059
[[Page 76823]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.060
[[Page 76824]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.061
[[Page 76825]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.062
[[Page 76826]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.063
[[Page 76827]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.064
[[Page 76828]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.065
[[Page 76829]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.066
[[Page 76830]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.067
[[Page 76831]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.068
[[Page 76832]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.069
[[Page 76833]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.070
[[Page 76834]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.071
[[Page 76835]]
[GRAPHIC] [TIFF OMITTED] TN07NO23.072
Dated: October 24, 2023.
Suhas Tripathi,
National Coordinator for Health Information Technology, Office of the
National Coordinator for Health Information Technology.
[FR Doc. 2023-24536 Filed 11-3-23; 8:45 am]
BILLING CODE 4150-45-C
