Overview

Health Information Exchange (HIE) aims to deliver the right information to the right place at the right time by enabling health care professionals to transfer patient data across disparate information systems.  Patient data available through an HIE can include lab results, radiology reports, discharge summaries, consultation notes, transcribed documents (i.e., clinical summaries), and secure clinical messaging and referrals.  

HIE Privacy and Security Regulations

The Maryland Health Care Commission (MHCC) was given authority under Maryland law in May 2011 to adopt regulations for the privacy and security of protected health information (PHI) obtained or released through an HIE [1].  The regulations set forth requirements for HIEs including:

• Procedural and technical controls (e.g., authorization and authentication) for the exchange of health information
• Protocols for health care consumers to opt-out from having their health information exchanged via the HIE and request information on who has accessed their health information
• How HIEs disclose sensitive health information, including obtaining additional authorization or consent
• Annual audits to review and test the implementation of controls, including appropriate/ permitted access, use and disclosure of PHI
• Processes to assess and respond to a breach or potential non-compliance with the regulations including investigations, remedial action plans, notifications, and suspension or termination of access, and notifications
• Protocols for the release of data for secondary use (e.g., population care management or research)
• Policies and procedures regarding access, use, and disclosure of data in emergency situations.

The regulations became effective March 17, 2014 can be found here.

HIE Registration

Code of Maryland Regulations (COMAR) 10.25.18.09, Registration and Enforcement, requires an HIE operating in the State to register with MHCC annually, which includes EHR developers whose systems offer data exchange capabilities.  Registration is valid for one year.

Who Must Register

Entities operating in Maryland that meet the definition of an HIE are required to register.  As of October 1, 2022, Chapter 718 of the 2022 laws of Maryland, Health Information Exchanges - Definition and Privacy Regulations, defines an HIE as:

(I) An individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that allows, enables, or requires the use of any technology or services for access, exchange, or use of electronic protected health care information:

1.  Among more than two unaffiliated individuals or entities that are enabled to exchange electronic protected health information with each other; and

2.  That is for a treatment, payment, or health care operations purpose, as those terms are defined in 45 C.F.R §164.501 regardless of whether the individuals or entities are subject to the requirements of 45 C.F.R. parts 160 and 164; or

(II) A health information technology developer of certified health information technology that develops or offers health information technology, as that term is defined in 42 U.S.C. 300JJ(5), and has one or more health information technology modules certified under a program for the voluntary certification of health information technology that is kept or recognized by the National Coordinator in accordance with 42 U.S.C. 300JJ-11(C)(5).

An HIE does not include, if the organizational and technical processes the entity provides or governs are for health care treatment, payment, or health care operations purposes (1) an entity composed of health care providers under common ownership; (2) a carrier; (3) an administrator; (4) a health care provider; (5) a carrier's business associate; and (6) a carrier exchanging information as required by federal law.

How to Register

To register as an HIE in Maryland, please complete the application below.  Please send the completed application and all supporting documents to HIE.Registration@Maryland.gov.

Application for registration to operate as an Electronic Health Information Exchange Services Provider in Maryland.

Registration Renewal

An HIE renewing its registration in Maryland must provide a completed application within 120 days of its fiscal year end date.

Registered HIEs 

Contact

If you have questions or need additional information regarding the HIE regulations and registration process, please contact hie.registration@maryland.gov, or call 410-764-3282. 

[1] Md. Code Ann., Health-Gen. §§4-301 and 4-302 (2011)