HIway Regulations Summary

In October 2019 the Massachusetts Executive Office of Health & Human Services (EOHHS) updated 101 CMR 20.00: Health Information Exchange, also referred to as the Mass HIway Regulations. For the updated regulations, click here.

In this summary, terms that are defined in Section 20.04 of the regulations, such as HIway Direct Messaging, are capitalized. In addition, references to specific sections of the regulations are provided. For a detailed set of frequently asked questions, click here.

For the Mass HIway Policies and Procedures, click here.

Click here for a printable version of this summary.

Purpose of the Mass HIway Regulations

The main purpose of the Mass HIway Regulations is to establish requirements for organizations to use the Mass HIway to implement key requirements of M.G.L. Chapter 118I, which include: (1) the requirement for providers in Massachusetts to implement a fully interoperable electronic health record (EHR) system that connects to the Mass HIway; and (2) the establishment of a mechanism to allow patients to opt-in and opt-out of the Mass HIway.

The Mass HIway: mission and core functions

The mission of the Mass HIway is to enable health information exchange by healthcare providers and other Mass HIway Users regardless of affiliation, location, or differences in technology. The Mass HIway has two main functions to help achieve its mission:

• Function #1 – HIway Direct Messaging: The Mass HIway offers a secure method for transmitting a message containing patient health information, where the Mass HIway does not analyze, use, or share the contents of the message except as required to deliver it and to make it available for use by the intended recipient.
   
• Function #2 – HIway-Facilitated Services: The HIway may create frameworks for protected health information exchange through governance, promotion, certification, and/or contracts with a vendor or vendors to support treatment or care coordination. The HIway established the Statewide ENS Framework as a HIway-Facilitated Service to enable notifications to be sent to a patient's healthcare providers when that patient is admitted, discharged, or transferred to and from participating hospitals in the Commonwealth.
   
• Function #3 – HIway-Sponsored Services: The Mass HIway may create services for HIway participants whereby the Mass HIway operates and manages a technology platform that allows the HIway to use, analyze, and/or share protected health information and/or personally identifiable information on behalf of participants. There are currently no HIway-Sponsored Services.

The HIway connection requirement: Who must connect to the HIway, and when

• At this time, only those Provider Organizations that are specified in the regulations, as opposed to individual licensed professionals, are required to connect to the Mass HIway Direct Messaging System or another DirectTrust-accredited HISP to send/receive messages. (101 CMR 20.08)
• The regulations implement a phased-in approach, with the following three groups of Provider Organizations having an initial "Year 1" requirement to connect to the Mass HIway by the following dates:   (1) Acute Care Hospitals by February 10, 2017; (2) Large & Medium Medical Ambulatory Practices by January 1, 2018; (3) Large Community Health Centers by January 1, 2018, and Small Community Health Centers by January 1, 2019. (101 CMR 20.08 and 20.09)
• EOHHS anticipates that other types of Provider Organizations (e.g., behavioral health entities, dental clinics, and nursing homes) will be required to connect at a date that will be specified in the future. Future guidance will provide at least one year notice for affected provider organizations to connect to the Mass HIway. (101 CMR 20.08(1b))

How Provider Organizations fulfill the HIway connection requirement

• HIway Direct Messaging: Provider Organizations with connection dates specified in the regulations can meet the HIway connection requirement by sending and receiving HIway Direct Messages, following a phased-in approach over 4 years (101 CMR 20.08(3)). The methods by which organizations may implement Direct Messaging are listed in the last bullet point below.
   
• Acute Care Hospitals: Acute Care Hospitals can meet the HIway connection requirement by both: (a) sending and receiving HIway Direct Messages, and (b) sending Admission Discharge Transfer notifications (ADTs) to the Statewide ENS Framework. (101 CMR 20.08(4))

Penalties for not fulfilling the HIway connection requirement

• Penalties for Provider Organizations that do not fulfill the HIway connection requirement may be assessed in Year 4 of the requirement. No penalties will be assessed for failure to connect to the Mass HIway before January 2020. (101 CMR 20.13 and 20.14)
• EOHHS may grant a waiver to Provider Organizations regarding the requirement to connect to the Mass HIway under certain circumstances. (101 CMR 20.15)
• Provider Organizations can request that EOHHS reconsider a penalty notification, and appeal EOHHS' final determination to assess a penalty. (101 CMR 20.16)

The opt-in opt-out mechanism for the Mass HIway

• HIway Direct Messaging: Information may be transmitted via HIway Direct Messaging in compliance with applicable federal and state privacy laws and regulations (e.g., HIPAA, 42 CFR Part 2, M.G.L. Chapter 93H) (101 CMR 20.07(1)). This aligns the use of HIway Direct Messaging with other modes of transmission (e.g., sending information by fax or phone). Mass HIway Users have the option of implementing a local opt-in and/or opt-out process that applies to the use of HIway Direct Messaging by their organization.
   
• HIway-Facilitated Services: These services must be used in compliance with applicable federal and state privacy laws and implementing regulations. Provider organizations may implement local opt-in and/or opt-out processes that apply to the use of HIway-Facilitated Services by their organization, but are not required to do so. (101 CMR 20.07(2))
   
• HIway-Sponsored Services: A centralized opt-in opt-out mechanism for HIway-Sponsored Services will be implemented and operated by the Mass HIway once these services are launched by the Mass HIway. (101 CMR 20.07(3))
  • Opt-in by written notice: The opt-in mechanism will be fulfilled by HIway Participants informing patients through written notice how the HIway Participant intends to use HIway-Sponsored Services, and how the patient can opt-out of HIway-Sponsored Services.
  • Centralized opt-out: The Mass HIway or its designee will administer a centralized opt-out system for HIway-Sponsored Services that will implement a mechanism for individuals to choose not to participate in HIway-Sponsored Services.
  • Supplemental local processes: HIway Participants can elect to implement additional local opt-in and/or opt-out processes that apply to their organization's use of HIway-Sponsored Services; these additional processes must supplement and not replace the HIway's opt-in opt-out mechanism.

Establishing interoperable Electronic Health Record (EHR) Systems  

• Provider Organizations that have HIway connection dates specified in the regulations will fulfill the M.G.L. Chapter 118I requirement that providers establish interoperable EHR systems that connect to the Mass HIway by implementing HIway Direct Messaging. (101 CMR 20.10(1))
• Provider Organizations may implement HIway Direct Messaging by one of several methods, including: (a) an EHR's Direct XDR connection, (b) a Local Access for Network Distribution (LAND) appliance connection, (c) a Webmail connection, which does not require an EHR, (d) a DirectTrust-accredited HISP (See Section 5.1 of the Mass HIway Policies and Procedures).

Establishing a HIway Direct Messaging Use Case

Use cases fulfill the connection requirement when:

• The Provider Organization is using a HIway Direct address, or
• The other party listed in the Provider Organization’s use case is using a HIway Direct address, or
• Both parties listed in the Providers Organization’s use case are using DirectTrust-accredited HISPs to send/receive