Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76773 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Trusted Exchange Framework and 

Common Agreement Version 1.1 

AGENCY: Office of the National 

Coordinator for Health Information 

Technology (ONC), Department of 

Health and Human Services (HHS). 

ACTION: Notice. 

SUMMARY: This notice fulfills an 

obligation under the Public Health 

Service Act (PHSA), which requires the 

National Coordinator for Health 

Information Technology to publish on 

the Office of the National Coordinator 

for Health Information Technology’s 

public internet website, and in the 

Federal Register, the common 

agreement developed under the PHSA. 

This notice is for publishing an updated 

version of the Common Agreement, 

version 1.1. 

FOR FURTHER INFORMATION CONTACT: 

Mark Knee, Office of the National 

Coordinator for Health Information 

Technology, 202–664–2058. 

SUPPLEMENTARY INFORMATION: This 

notice fulfills the obligation under 

section 3001(c)(9)(C) of the Public 

Health Service Act (PHSA) to publish 

the common agreement, developed 

under section 3001(c)(9)(B) of the PHSA 

(42 U.S.C. 300jj–11(c)(9)(B)), in the 

Federal Register. 

BILLING CODE 4150–45–P 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.010</GPH>

:C:OMPJION AGllEEMEt41"S:Qlt 

... ,.:ATl()t4~~l>EJt~LTt[INS:(lltl\tlA.JlOt4• IN,J:£RQPEll4BILl1'Y 

;.;ri:~lr~ijl;t~-~~~riil~:~:r~~~[1t';a~r 

expense:. 

~~rti~t1t~t1⁄4tij~\fequijtt1~,W1~~tin.ai,o(t~it9jt¢1pfttie•~••~:~~~:: 

fort~eliaational ~rdina~rfor Heafthln!orrnationl"eclmulogy~ publishmrt~Office of the 

NatiooalCoordinatorforHealthlrifammoonTechnolo,r(:s pub~c Internet ~ifi!;·and inthe 

federaiRegiSter,.theeootmor1agreement (42U5,C300jf11(c)(9){C)). 
76774 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.011</GPH>

The CommonAgreement 

for Nationwide Health Information Interoperability 

This .CommorrAgreem1:mtfor Nc1tiom111ide HE!<llth !nforrnciJion lnteroperal)ility (the 

"Common Agreemenf!'or'!Agreernenf'') is entered intoas of the-· __ dayof 

------------" ____ (the ,;E.ffectlve oate't hyand betWeen:itie SequOia 

Project, Inc,, a Virginia nc>n~~tockcqrporatlon,act1T1ga$ the ctJrrenfRecognizecl Ccordin.ating 

Entity as defined below(the "RCE"Jaiid _______________ ........, a 

~~~---~~=~~===-("Signatory"). RCEand Signatory m11y also be reforre<J 

to herein individually•as a "Party" or collectively as<the "J>artfes,·11 

RECITALS 

WHERl:As; Sectfon 4003ofthe 2Pt Century Cures.Act.directed the u:s:. Department of 

Health and.Human.Se.rvices(HHS) National Coordinator to, "in collaborationwith the National 

Institute .ofStandardsand Technology and other relevantagendes within theDepartment .pf 

Health andiHuman.ServitEls;forthe purp()seofensuring·full network-fo-networlcexchang:eof 

health inforrnatic>n, corw:ene pQbffc•ptivateand public-pubiic.partnersh1ps to build consensus 

and develop·orsupport attusted exchange framework;. includfngacommon agreement among 

health informatfon netWdrks nationally;" 

WHEREAS,·this commonAgreement(lnc1ud1ngthedocuments:irn;orporated her:ein by 

reference)is :the common agreement developed pursuant to section 4003 ofthe 21st Century 

Cures Act; 

WHERl:As, The Sequoia Projec:thas been selected by. the Office ofthe.·Natti:mal 

Coordi.nator forHealth lnformationTechnology (ONC) to serve.as the RCE for purposes of 

i1T1pte.rne1:rl:fngi·maintaining;.and updating this CommonAgr:eernent,ihcludingtheO.ualified 

Health Information Network (O.HIN)Technitatframework,as INE!ll as managing the acthi:ities 

associated;w1th the designatk)h oftnterested health infurrnatl()n l'ietwotks (HINs) as Q,l·UNs (as 

defined and setforth In this C:6mmon Agreement); 

WHEREAS, SignatoryWishes tobe desighated>as a QHIN ahd.hc1s c:Orrlple:ted the 

application processtoward.suchdesignation: 

WHEREAS, Signatory must; among other conditions>se:tforth in this Common 

Agreement, agreeto be bound bythetermsofthis Common.Agreementbefore:Signatorymay 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76775 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.012</GPH>

be designated as a QHIN and, upon signing this.Common Agreement, Signatory agrees to be.so 

bo.und as,aSignaforyandas a QHJN, ifso designated, as the casemaybe; 

fJOW, l'FIElti:FQRE, in cc>nsr!ie~tion ofthe muJ4al prQmisessefforih herefrt and other 

gooda(lt( valuabie eoosideraticm, the reteiptand s•Jfflclency of which is here~vacl<rtowl~dged, 

the Parties,; interidingto b:e iegally bourid, mutually agree asset forth below. 

AGREEMENT 

1. Definitions and RelevanfTerminology 

1.1. Defined Terms, Capitalized terms used rn this CommonAgreementshaU have the 

meaning set forth below, Wherea!ief!11ition i11cludesone Qr mqrecitatiqns to a 

statute, regulatiQn, Qrstarid.ird,· thedef!nitionsh<ilFbeJnterpreted to·referto stn:11 

stat4te, regulatron, orstan dc:1rcf asn:iay be amended from t1tne0 to~time; 

Applleili,le lihA;: aitf¢deraf,state; Iot11i, ortrlbc:ilJaws arid teguJat,1:>M then in effect 

and applicable tothesobJectma:tter hereiri. Fonhe avoh:Jance of doubt, f~derar 

agencies are Only sut>jett tofederaUaw. 

Business Associate: hasthe meaningassignedtostich term at45 CFR •~ 160.103. 

Business Assodate Agreement(BAA): a contrad,.agreement, or other arrangement 

thatsatisfies the implementation specifications described within 45 CFK§ 

164,5()4(:e), asapplicable, 

C9mmQnAgreernent: unle$s otherWl$e expres~Iy iricii<:ated: thls dOl:Qtnent, the. 

OJ-IIN Te1:hnfoa1 FrameW1:>rk (0.tF); all Standard Oper;atiM Prq1:edure$ (St!Ps), and an 

other attachments; e1<tiibihi•l'lnci attlfacts:incorp◊t.ited herein by reference. 

confidential lnformati6n: 

Any in.rorr:nation that is designated as Conffilential infbrmatlon by the 

persorior entit;ythat disdosa it {a "DistlQser"), orthafa reaso,nable person w(!uld 

understand to be ofa corindentialnature,.inci isdisdosed to another perso11or 

et1tity (a ;;Redpient") pursuant tQ this Common Agreement For the avoidance of 

doubt, ''Confidential !nfurmation;' does not indude electrotlic ptdtectedhealth 

information (ePHI}, as definedlnthis tommC)ti Agreement, that is'subjectto.a 

Busii'H\ss Assoeiate Agreement and/or Other provisions of this comm6n Agreement. 

Notwithstaf1!ilng.any labeltottie cor'ltr,ary,l(COnfidential lnformatron'fdQE!s 

notin~l1.1de any information that: (i)is or becomes known p1.1b1tctythr(!ughnt1 fault 

3 
76776 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.013</GPH>

of the Recipient; or (ii)is learned by the Recipientfrom.a third party thatthe 

Recipient reasonably believes is entitled to disclose if without restriction; or (iii}.is 

alrei:ldy knowrrto the Redpi~t befqre receiptf~()m the Disclq~er,as shq1Nn by the 

Recipiet1t'.s VlltJttenrecc,rdsr()J (Mis indepen!fentlydevelC!Ped by Reeipie1it with.out 

t&e use <>f()r referenceto the Di!>tlose('s Corrfidenttal lnf()ttnatiori, as shQWn PV thE! 

Rei:ipient's writtetifE!tords;.andwas not supJE!ct toccmfidentlallty testtittiQns prior 

tOrE!ceipt ofsud1 infotmationfrornthii! bisclbser;<>t (v) must be disdbsedunder 

operatib:nof law, proVid,edthat, to the extent permitted by ApplkabJe Law, the 

Recipietitgives the Discloser reasonable notice to alloWthe Discloseno obJectto 

.sdch tedisdOsure, and such redisclosure.is made to the mioiliiurn extent necessary 

to comply with Applicable Law. 

Connectivity~tvices:the technical sendces prt1vided bya QHIN consistent with the 

reqt.ifrementse)fthethen°applicabte a.HIN technical FrarneworkandpotsuannQ this 

Common Agteement withtesp'ett toan Eicthange Purposes. 

Corrtract:the contract bY and between The Sequoia Project and HHS, of, if 

applicable, a successor agr.eementbetween The Sequoia Projectand HHS,or a 

successor agreement b.etwe.en.a different RCE and HHS. 

toviered Entity: has ttiemeani11gasslgnedtosuch term at-45 CFR § 160:to~. 

Cvbersec:urify Cduneil: th~CC1tu1dl establishett bythe RCE to enhance eybetsecurify 

commenso.ratewiththe ti.s'ksto dJiJN:.Cto:-0.HIN exthanM, asm6te full:y set forth in 

an sop.; 

oesignation•fineluding•·its~or~lative meanings"Desig~ate/•"Designatec:f;"'and 

"l)esignating"): the RCE's written tonfirmatitm toONCand SignatorythatSignatoty 

has.satisfied .aUthe requirements otthe eommohAgreernent, the QHIN Technical 

Framework, and all applicab1eSOPs1 and is now a O,HIN. 

Direct Rerationship: a relationship between (1) an lndiVidual and {ii}a ClHIN, 

Participant, prSubparticiparit,thatarises wherrthe QHml; Participant, or 

Subpartidpant, as applicable,:.Qf'f'~r:s servkestc; the ln!fividUi:11 ln conn~clion Withone 

ot more of the Framework Agreements, and.the lndh1itlual.;igrees to rE!ceive$u.ch 

services. 

Oistie>si.lhf(in<:iudiriJ•tts•.torrelatlve meanings "Disc:lpsei"';Oi~eiosed;"•and 

,.Diselosinl")= theteiease, transfer, provision ofactess to, or divulging1n any' 

manner otnoutsidethe entity holdin1,rtheintorrnation. 

4 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76777 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.014</GPH>

Discovery:for purposes of determining the date on which a TEFCASecurity Incident 

was discoyered, the term Discovery shall.he determined consistent with45 CFR § 

1M.404(a)I2)as if the fEFCASecyrity lncidentwere;a breach (as.defined in45. tFR § 

164.402)except that this term shall also apply to NorH-IIPAA Entities: 

Dispute: means (J) a disagreement about any ptoVisioll. of this Common Agreement, 

indudilig any SOP, the QTF, and another attachments, exhibits, and artifacts 

incorporated by referenc:e; or (ii) a concern or complaint about the actiohs, or any 

failureto act, ofSlgnatory,.the RCE,oranyother QHINoranother QHIN's 

Participant(s ). 

Dispute Resolution Process: has the meaning assigned to such term in Section 15.1 

of this Common Agreement. 

[)()Wnstream Subpartidpant: aSubpartidpantthat has entered into a Dowrist:ream 

Subparticipant Agreementto use the services ofanother.Subpartidpant (referred to 

as. tile ''Upstream Subpartldpant") to send and/or recelveinformationas described 

ill Section 9 of this tommon Agreement. 

Downstream Subpan:iciparitAgreerrierrt: an agree:meritthatincorporates alN:ifthe 

Retiuired Flow~Downs of this common.Agreement.and is between.a Subf)articipant 

(referred to as the "Upstream Subparticipant") and one or more Subpartlcipants 

(each a "DownstreamSubparticipant:"), which enables the Downstream 

Subparticipant(sJ to use the services ofthe UpstreamSubpartieipant as described in 

Section 9 of this Common Agreement to send and/or receive information for one or 

more Exchange Purposes; provided;. however, that any provisions of said agreement 

that permit or require activfties other than t'1ose required. dt permitted by the 

Common Agreement shall not be deemed part ofthe .Downstream Subparticipant 

Agreement as defined herein. For example, ihheagreement providesfor 

transmission of information for reasons other than the Exchange Purposes, the 

provisions goverllingsuchactiVlties.shall not be deemed part ofthe Downstream 

Subparticipant Agreement as defined herein. Any Stibparticipant may enter into a 

Downstream SubparticipantAgreement. 

Electronic Protected Hearth Information (ePHIJ: has the meaning assigned to.such 

term at45 CFR § 160.103. 

Exchange Purpc>se{s): means the reason, as authorized by this tommon Agreement 

including the. Exchange Purpos.es SOP, for a Request;. Use, Disclosure, or Response 

transmitted via Cl.l·UN'-~b.HIN exd1angeas one step in the ttar1smlssion, Authorized 

5 
76778 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.015</GPH>

Exchange Purposes are:Treatment, Payment, Health CareOp.erations, Public Health, 

Government Benefits Determination, Individual AccessServices1 andany·oth·er 

pllrp<>se<!uth<>rizect as an Exchange Purpose.by the Excb<!nge Purposes S(JP, eac.h to 

the extent permitted uncterApplical:>le laWic uncleraUappli<;able provisions of this 

common Agreement, and,:ifappih:able, under the irnplementiltron $0Pfonhe 

appilcl!lble EX'cha)'.ige Purpose, • 

FtameWt>rkAgreement(sJ: anvoneor tombinatiori':ofthecommon Agreement,a 

PartitipantcQHIN Agreement,. a Partitipant0subpart1c1pant Agreeml!nt,• or a 

DoWnstr@am.subpartitipantAgreement, as.applicable. 

FTC Rule: the Health Breach Notification Rule promulgated by the FederalTrade 

Commissionsetforth at 16CFR Part.318. 

Go.vernment~eneflts Determfnation: a deferminatiol'.l made by <!hY fed@ral; state, 

l0t;al, or tribal agency, instrumen~lity, or other unit of g<>vernrnentas to:whether an 

lndiVidual quatrfiesfor gpvernrr1ent henefltsfor.anypurpbs:e•otherthanhealtb care 

(for exarnpie, Social Security d,sabO)tyberteflts)tb the extentpetrnitted by 

Applkablefaw. blsdosureofTI forthis putposlHnay require an authbtization that 

t<'>mplies With APPiicabie taw, 

Government Health care Entlfyi any agency, instrumentality,. orothefuhitotthe. 

federal, state, local, or tribal government to the extentthatit provides health care 

services {e.g\, Treatment)to Individuals but only to the extentthat itis notacting as 

a Covered Entity. 

Hec11th Care C>peratlons} hiis themeaningassigned to such termat4~ CFl:C§ 

164,$01, exceptthat thiste.rrn shaffappJy tbthe applicable actlvities ofa HealthCare 

Ptt>Vh:ier regardless of whether the Health Car,e.Provfrler Isa Covered Entfty, 

Health Care PrQvfd'er: hasthe rr1ean1hgass,gnedto suchterm in the information 

blot king regulations at 45 CFR §: 111.162 or irrthe H !PAA.Rules at 45 CFR § 160.103 .. 

Health Information Network (HIN): hasthemeaningassignedto theterm "Health 

Information Networkor Health Information.Exchange" in the information blocking 

regulattonsat 45 CFRll71.102, 

Hf PAA! tbe l'iealth losuri!nce Portabifitya11d ,:\ccountabillty Act ofl,996 codified at42 

u::s;c, §.aOOgg; 29 u.s.t. § llSletseq;,42 o.s.C .. § 132dd ft.s,eq.,.andtheHealth 

tnforrnatie>n Technology for £tolie>tnJcand tnnltal Health (HITECH) Actbf 2009 

codffied at42 u.s.c, § iJg:21 etseq.,ai'id 42 o.s.c § rzgatet seq; 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76779 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.016</GPH>

HIPAARules: the regulations set forth at4S.CFR Parts 160,162, and 164. 

HIPAAPrivacyRule:theregulations se(forth at45<:FR Parts iOOand 164, Subparts 

AandE. 

HIPAASe:currty Rule:the regulations set forth at45 c;FR Part 160 and Part 164, 

Subpart c. 

Individual: one cir rriore ofthe following: 

{i) An individual as defined by 4$ C:FR160.103; 

{ill Any other natural person who is the subject of the ihformatlon being 

Requested, Used, or Disclosed; 

(iii} A petsonwho le~afly attsonbehalf ota person described in paralraphs 

(i} or (ii) ofthis.definition in making decisions related to health care as a 

peri;onal representative, in accordance with 45 CFR1(>4.S02(g}; 

(iV) A personwho isa legal representative ofaQd canrnake healthcare 

decisio.hs on behalf ofany person de.scribed in paragfaphs (i) or (ii} Of this 

llE!finrt;ion; or 

M An e)(ect1tor, administrator, or other persoflhavingauthorltyto ad on 

behalf of a. deceased person described in paragraphs (i) or {ii) of this 

section ortbe individual's estate under Applicable Law. 

IAS Provider: Each .QHIN, Participant, and subpartieipantthatoffers.lndividual 

Access Services .. 

Individual Access Services (IAS}:with respect to the Exchange Purposes definition, 

the services provided utillzing the Connectivity Services,. to the extent consistent 

with Applicable taw,to an lndJvidualwith whom the QHIN, Participant; or 

Sub participant h<is a Direct Relationship to satisfy thatlhdividual' s ability to access, 

insp'E!ct; or obtairra copy of that Individual's Required information that is tMn 

maintatned by or for any. 0.HIN, Participant, orSubpartitipant, 

lndMduafly Identifiable: refers to lnformatlonthat i:dentifies an Individual or with 

respectto which there is a reasonable basis to believe .that thelnformation co1.1ld be 

used to identify an lodividuat 

i 
76780 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.017</GPH>

Minimum Necessary: refers to the provision in theHIPAARules that, under certain 

circumstances, requires a Covered Entity or a Business Asso.ciatefo make reasonable 

efforts v.t!wnUsingorpisclosing PHl9rwtien FtequestJng PHlfroman9thei: C9ver~ 

Entrtyor Bus1nessAs59diilte:t:o limit PHI to theminlmurn netessarytQ act:omplish 

theh1ten(fedrurnose11hheiJse, DisdQ$urej qr Ftequest. $ee4S¢Ft{ § tt'i4.5Q2(b) 

and.§ i64514(d); 

Nan~HIPAAEnti:ty (NHE):a QHtN, Paiticipant, orsuhpatucipanniiat is neither a 

covered EntitY o6ra Business Associate under Ht PAA.with regard tP activittes.:uhder 

this common Agreement. 

Onboarding:the process Signatory,a Participant, or aSubparticipantmust undergo 

to become a QHIN, Partitipant,or Subparticipantand operationalinthe production 

environrnentunderthe Frarnev.t0r-k Agreementto 111/hicl'l it:Js.a party. for Signatory, 

thet)nboardlngrequirements shall b.e setforthJnthe•.OHINOnboardirig & 

Qesignation>SOPaddtessingtheprocess towardOesignat1011as a QfliN. Fon1 

f>atticipam; the t>nboatdh1g tEi:qultementssl'laffbesetforth in the Partidpant~QHiN 

Agreement, !=Qr a Subparticipant,the bnboatding requirernents shall beset forth in 

the Subpatfidpant Agreement or the Downstream SubparticipantAgreement, as 

applicable. 

oNc:the u.s. Departmentof Health and Human.services Officeofthe National 

Coordinator for Health Information Technology. 

Organr:zed Health Care Arrangement: has the meaning assigned to suchtermat 45 

CFR § 160.103. 

Participant: 1:0 the extent permitted by applicable SOP(sJ, a U:S; Eridty regardless of 

whether the entity fa a Covered Entity ora Business. !'S,ssodate, that has entered into 

a Partidpant-t:iHIN Agreementwherebythe b}HN agrees totransmitand receive 

ilifotmatibn via QHlN-to-tiHIN ex.c::hange on behalf ofthe party to the Partidpaht" 

QHIN Agreementforthe Exchange Purposes:: 

Particlpant-QHIN Agreement! 

An agreEirnentthatinci>tp◊rates alf.ofthe Required Fi6W~Downs ofthrs 

CQmmonAgr¢ementand is between a o.H1N and pne or more ~artii,:lpants; 

provided, ht!Wevet, that any pt6visior1s ofsaid a~reernentthatpermit.otr:eqilite 

activities otherthan thosEl required or ()EirmittEld by the Common JWeementshall 

not be deemed pan of the Patticipaht"-QHIN Agte.ement as defined herein. For 

example,ifthe aijreementprovides tor tra11smissi6hofi11f0tmatio11 tot reasons 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76781 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.018</GPH>

other than the Exchange Purposes, the provisions governing such activities shall not 

be deemed part oHhe Partidpant-Q.HIN Agreement as defined herein. 

In the event e>f any c6nflitt otlncon.sistency between Qtamcmg Applitahf e 

Law, ·the Participant~QH IN Agreement~ and.any other termsand tonditions, the 

followings.hall bethe orderof precedenteto the extentofst.ithconflittor 

inconsistency: (i)Appticable Law1 (ii) the provisi.ons ofthe Partidpant-OHIN 

Agreementthatare.Required FIOw•Downsunderthis.Common Agreement; {iii)fo 

the extentapplicabte, the\QTF; (iv}to the extent applicable, the•SOPs;and (v}any 

otherterms and.conditions agreedto•bythe parties. 

Particip.ant-Subparncipa·nt.Agl"ffment:. 

An c1greementthatincorporates aO'ofthe 8eqtlired Flow~Downs oftl'lis 

Cornme>n Agreementa11~is between a Partlcipantarrdone ormon,tSubparticipants, 

which enables fheS\:Jbpatticipant:(sJfo usetheservices oft:he Partidpantas 

described In Sectt()n ~ ofthisCe>mmon ,IS;greementto send and/or receive 

information for one or mt>re Exchange PurpC)ses, ptovided,however}thatany 

provisions of said agreementthat permit orrequ1re activities e>t:her than thooe 

requited or permitted by the comtnQn Agreem.ent shallnotbe,deemed part ofthe 

Participant~sobpatticipantAgreementas defined herein. For exattiple, if the 

agreement provides fottrahsttiission.of information for reasons other than the 

Exchange Purposes,.the provisions governing such activities shall n.ot be deemed 

part of the Participant,,SubpartidpantAgreementas defined herein. 

lnth!:!. event .of anyconfljct orinconsistehcy bl:!t~een. e>r amQngApplicable 

Law, the f>artidpa~t-Sobpattici~ant,rel:!ment, and anyottier terms and 

c~nditiQns, the foUo~ing shall be the prder ()f Precedencet<>th~. ej(tent bfsijch 

t;C)nflictQr incohsistency; (i}Applicable Law; (ii) the p:tovisions e>fthe Participant:. 

sobparticipantAgreementthatare Requlr:ed Flo~DbWns under this Comlnon 

Agreement; (iii) tothe<extentapplicable, the QTF; (iv)tothe extentapplicabte,.the 

SOPs;and (v) any other terms and conditions agreedto by.the parties. 

Privacy a nil Securlty:Notice: hasthe meaning assigned to suchtetm in sectio.n.10.3 

ofthis common Agreement 

Protected Health Information (PHI}: has the. meaning assigned to such term.at 45 

CFR § 160;103. 

9 
76782 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.019</GPH>

Public Health: with respectto:the definition of Exchange Purposes, a Request,. Use, 

Disclosure, or Response permitted under the HIPAARUles and other.Applicable law 

f<>r.pμblic health:<1ctiVitiesal'ld purp<>ses il'lv<>lvil'lg <! Pub.lie He<!lthAuthoritY,Where 

sμchpublichealthac:tlVities al'ldpurpos:es are perrriitted l>yApplicable li:!W, including 

a Use or Pisdpsure peti'l'iitte<i ynder 4$ C:fR §.164.$:ti(bl atid 4$ CFlf§- i64.$i4(e}, 

B:>rthe avoidat1ce ofd!)ubt;a Publi◊ Health Authority may Request, dse, and 

o\sdoseilhet!:!Uhdertot the Exchange Purpose of Public Health to the:ex:tent 

permitted byApplicablet.aw ahdthe Frarn~wotk Agreements. 

Public HealthAuthority: has themean.1ngassignedto.such term at45 CFR§ 

164 .. 501. 

ClHlN Technical Framework ((lTF):the document described ih Sectron 5.2:ohhis 

C<>111111on Agreem,ent andjnc<>.rporatedby referel'lce lntothisCo111m,on Agreem,ent, 

as m,aybeam,ended, that may indude: (iJtechnkai requirernel'lts1fUnctionai 

requirements, and privacy-andsectni'ty-re!i:!terlrequirementsfor the excha11ge-of Tl 

betweenO}tiNs:(ii) intemal-d.HINJunctionalrequire1)'1entsr(iii}technkat, privacy, 

and securityf1Qw-down.r:equirern:et1.tsfromth-e.·O.HINt6tl1ePartlcipants-and/or 

subpartidpants {ifany) ,n add1tiontothe pr"iVacy andsecurity BequitedFloW-Downs 

inthe c-ommon Agte'ernent; arid {i\i} qperational requirements that ettabte the 

exchange oHI between and among QHINs, 

Qualified Health Information Network (Q.HIN}:to.the extent permitted by 

applicable SOP(s}, a Health Information Networkthat is a U.S. Entity that has been 

Designated bythe RCE and isapartyto the.Common Agreement countersigned by 

the.RCE. 

RCE Dl~ctol'Y Service: a technical service provided by the RCE that enables d.HINs, 

Participan:ts,and Subpartidpantsto sharedirl'!ttoryinfurmatiofi.•assodatedwith 

other Qfl1Ns, Patticipants,.and $ubparticipantsfoordertoenabtetheexchangeofTI 

untlerthetoromon.Agr:eement.. ThethM0 c.i:.irtenttechnitiil endpointSand other 

identifying infotmatlonofQHINs, Participants, and subparticipantsare indudedand 

maintained as.part ofthe RCE Directory.Ser.vice; 

Recognized Coordinating Entity (RCE): the.entity<selected byONCthat will enter 

into.the CommonAgreementwith OHINs.ln,orderto impose, at a minimum, the 

requiremeJ1ts-oftl1e Co111mon Agreement, includingthe SOPsand the O:TF, on the 

QHINsandadminister suchrequirementson an ongoir,gbasis, '(he RCEis a Partyto 

this Common Agreement. 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76783 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.020</GPH>

Request(s) (including its correlative uses/tenses-"Requested" and "Requesting"): 

the.act of askingfor information inaccordancewith the applicable requirements of 

the fra.rnew<>rk Agreements. 

~~qutredFJpw-o~wnts); the rlghts 11nd Obligations:sJ~tfottb withl11thls Common 

,reern~ntthatSrgnatory iS requited to irn:ot!)Orate in its Participant-QHI~ 

Agreements and that.Signatory is req.uired.to obligate.itsParticipantsto includ.e in 

theifSubpatticipantAgreemertts and thatSigi'.iatOW musttequire Participants to 

obligatesubpartitipantsto impose.Qli· their QOWiistreamsubpartieipants, if any; 

through their Dow11stteam subpartitipant Agreements. Provisions ofthis common 

Agreement containing.such rights and obligations are identified in the.section or 

applicablesubsection·title as·"(Required.FlowcDown{s)):" 

Required lnfe>rmatiom 

Electmnic ihformati6i'.i mai11tafi'.ied by any QHIN, Participant, or 

Subparttcipant priorto or during the termoftheappficable Framework Agreement: 

(i} thatwould be e.PHI if maintained. by.a Covered Entity or a Business 

Associate; and 

(ff) regardless ofwht!ihertheinfcnmafi<>nis orJ1as.already f:>een 

transrnitl:edviaQHIN•to0QHIN exchange. 

NOtwithstand.ingthe fotegoing;the followingtypesofinfotmatiOn ar:enot 

Required Information: 

(a) inforrnati<>n compiled ii'.i feas<>nableantltipatlon:ot otforuseln, a 

civif,trimirial1 or administrative action.or proceedin~ or 

(b) pwd1otherapy notes(as defined at45CFR 164.501}. 

ResponseM(ineiudingitsc:orrelative uses/tenses "Respond~d"arid 

~espondmg"): theactofproviding inforrilation orthe•intormation.pfolfided.·111 

.aceo.rdance with the applicabler'equirements..ofthe Ftamewdrk Agreements. 

Signatory: the entity that has satisfiedSection 4.1 and is a Partyfo this Common 

Agreement 

Standillrd OP~illttllg Protedμi:eM ◊fSOP(s):lwr:ft:ten pn~cedi.lre or other Pt6vlslon 

thatfs ach.>pted porsvanlt(> the C<>rtirnon Agreement and lnc:orpotat~d byreferenc;e 

intothi!f Common Agteement1op:rovide detailed informatioo or requirements 

relatedtothe exchange activities undenhet:ommon Agreement, lodudingali 

amehdments thereto and ahy newSQPsthatar:e adopted pmsuantto thecommOn 

Agreement. SOPs will be adopted toaddtesstheapplicatibn process, the 

11 
76784 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.021</GPH>

Onboarding process,,and other operational processes. Each SOP identifies the 

relevant group(sJto.which the S.OPappties,Jncluding whetherParticipants and/or 

Subpart,cip.mts arerequirecl to comply witl'ta given SOP, Ar\S()P shall be deerried in 

effe:ctwhen ad()pted pursuanttq$eritic>n ?,3ofthis Common,Agr.eernent~ncllisted 

on the RCts pubHc website; 

Sutipar:ticipal'it: tatheextentp:erm1tted hyappiitahleSOP(s)~a U.s. Entity regardiess 

ofWhetherthe entity isa coveredEritityor Business}\ssociate,.thathas entetedinto 

either: (i)a .Partitipant"SubpartitipantAgreementto use the services oh ParticJpant 

as. described in section 9 ofthis common Agreementto,send and/or:receiVe 

information;, or(ii) a DownstreamsubparticipantAgreementpursuantfo which the 

servic.es ofaSUbpartidpantare used>as descr.ibed in Section 9 of this Common 

Agreemeritto se.nd and/or receive information. 

TEFCAlnforrn;1tion (Tl): any infQrmatlon that is exchanged betweel'.l.d.1-HNsJor one 

ormor:e.of the Eltthange Purposes pursuant to any of the FrarneworkAgreernents, 

Asarnattetofgeneri,d policy, oncetns receivecfbya QHll'-lj.f!:artkipant, or 

Subpartfoipantthat ls a Covert!!d fntity orl3ush,ess Associate and ldncorp:otatedJnto 

suchrecipient's system ofrecor:ds, the information is no i()nget Ti and is goverl'ied by 

the HIPAA Rules ancl other Applicable Law. 

TEFCA!Sec:Utity·lncid.ent(s)} 

(f) An unauthotiz"ed acquisltibn,atceSs, bfsdosute, or l..lse of unencrypted ti h1 

transitusing fhe ConnectiVity.S"etvicesor pursuant tocany Framework 

Agr.~mentbetween Signatory a:nd its Participants, between Signatory's 

Pattitipants and theirSubparticip:ants, or between:Subpatticipants, bot NOT 

including the following: 

{a) Anyunintentional acqUisition,actess,or Use6fTI by a·workfo.tte 

member or persott.actihg uhder·theauthotity ofaQHtN, 

Participant(or Subparticipaht, if such ac.quisition, access, oruse 

was.made in good.faithandWithinthe scope.ofauthority and 

does notresultin.furtherUseor.Disdosure ina manner not 

permitted ynder Applicable Lawar,d this Common Agreement. 

{b) Any inadvertent Disclosure: bya person who is authorized to 

access Tlat a QHIN, Participant,orSubparticipantto.anoth.er 

person authorized to access Tl atthe same QHIN, Participant,or 

Subparticipant,orQrganizedJ-fealthCar.e.Arrangement in which a 

QHIN, Participant; or Subp:articipant partidpates<>r serves asa 

Bosiness.As:soclate:,andthE!'infotrna!lQnt:ecelved asaresult of 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76785 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.022</GPH>

such Disclosure is.notfurther Used or Disclosed in a manner not 

permitted under Applicable lawandthis Common Agreement. 

(cl A Disclosure Of TI where a Q,HIN, Participant, or Sub participant has 

a goodfaith beliefthatanunauthorized person to whom the. 

Disdosurewas marle,would not reasonably have been,ableto 

retain such i:nfon:nation. 

{d) ADisdosure.ofTI that has b.een de-identified in accordance with 

the standard at 45 CFR§ 164.514(a), 

(iil other security events (e.g., ransomware attackst as set forth iitan SOP/that 

preventthe affected QHIN, Participant1.or subparticipantftom resporidin!J to 

requestsfodnformation auequired under this Common,Agreementor 

otherwise adversely affectthelr. participation in QHIN-to-QHJN exchange. 

Threat C~ndition: (i),a b{each ofa f1!ater:iat provisk:m ofthis Common Agreemellt 

thathas 11ot beencured within fifteen (15f days tif receiving no't1ceofthernateriat 

breach(orsuch Qther periQd of timetowhich the Parties have agreecU, which notice 

shaU include such specific information about the. breach that the {tCE has awdlable at 

thetitne of the r1()tlce;J1r(ii)a TEFq\Seturitylncicfont;ot.(iii)an•everrtthat 

Signatory,Jts F>artitipant, ortheirSubpartidpant has reasonto believe will disrupt 

ridtmal eRdiange undetthe FrameworkAgreements, eithetdue to actual. 

compromisi:! of or the need to mitigatecdemQhstratedvulnE!l'abilities.rn. s:ystems or 

data of the QHIN; Participant, or Subpatticipant! as: applicable, or could be replicated 

in the.systems, networks, applications, or data ofanother QHIN, Participant,or 

Subparticipant. 

Treatment: hasthemeaningassiglledfasuch term at4SCF8 § 164.501; 

Uh~d States: the SQ states, the bfstrkt ofColUmbfa,.andtheterritori~S and 

po$se$sionsofthe United Statesinclutling;witMut limitation, all militai:y bases or 

other .military installations, emblissies:, and consulates operated.by th¢ United Stl:ltes 

government 

unsecured: has theitieanihgassigr,edtosach tei:iti at45 CFR § 164AOZ regarding 

PAias ifltapplied toTlthatis Individually Identifiable. 

u;s. Entity/Entities: any corporation, limited liability company, partnership, or other 

legakentitythat {neets all ofthe followingrequirernents: 

(i} the entity iS orgaoiz¢cl ur1tl¢t the laws of a state or CO{nmonwealth of the 

Vhit1:¥dStates onhe fe'tleral la:w ofthe United States and tssubjecttothe 

i3 
76786 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.023</GPH>

jurisdiction of the United. States and the state or.commonwealth under which 

it.was formed~ 

(ti) Theeritity'$ pl1ndpalplaceofbusiness,as deternjihed underfederal 

common law; isiffthe L!oited.states; c1nd 

(iii)!',ione of the. erititfs ditettors, officers, or executives, and none ohhe owners 

with:a five percent (5%).or greater interestihthe entity, areJisted on the. 

Specialty oesigrrated Nationals aMB/oC!kedPetsonstistpublishedbythe 

united Statl:!s DepartmentottheTreast:rry's Office of Foreign Asset CMttOI or 

on the Department of Health·amf Human Services, Office oflnspector 

General(s List ofExcludedlndMduats/Entities. 

Opstre.im Subpal"'l:ic:ipant: a S1Jbpa~icipantt)1at provfd'E!s ser*es toa DolNOsfream 

Subpartkipant pursuant to a Downstream SubparticlpantAgreementto send and/or 

receive h:1formatfon as described ln Sedibrf9•ofthi!i CommonAgre:eml:!nt 

u~(sl{includihg~Qrrefattve uses/tenset sn¢h as "Uses," "Used/' and .. Osrng»): 

with respecnotl, means.the shating,employment, application~ otilitation, 

examlnauon,.or·aoalysis.ofsoch irtfurmationwithinahehtitythat·maihtains.such 

intormattoh. 

1..2; Common Agreement Termfnology, 

1.2.1. References to Signatory and Q,HlNs, Assetforth In Its definition and ihthe 

iritroductory paragraph ofthis Common J.\greement( theterrn ''Slgnatqry" 

is usedtore.ferto the specifrc;entHy thatisa Party to thiS Common 

Agreement with the RCE, }Xny 'and:allrights and obligations ofa Ci.HIN 

stated herein are bihding upon Signatory upon signing t),eCc;mmon 

Agreernentand are also binding upon all other Q.HINs. ftefl:!tences herein 

to ''qther dHINs;;; "another UH IN/and similar such termsare used to refer 

to any and all other 01:gantzations that have sigrted the common 

J.\greementwiththe RCE. 

1.2.2, References to "(Required Flow~Down(sl)'!: Provisionsofth1s Common 

J.\greement.containing Required Flow-Downs are.identified in the 

applitabtesectionfsubsecti.ontitleas ~(Requiredflow-DoYlli(s))," •For 

purpc;ses of impleme11tihgthe Required FJow.-Downs, referencesJ11such 

sections/subsectibnsto ''$lgnatoty."shall be:interpreted·to.aisb mean 

"Partidpat1t(srand "Subpattidpant($)/' asthe case may be •. Refetehtestq 

"Cbmmon>Agteement" shall~ interpreted tQ mean the applic1.1bl:e 

FrameworkJ.\gteement~ as thee case may be, 

14 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76787 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.024</GPH>

1.2.3. General Rule of Construction. For the avoidance of doubt, a reference to a 

specific section of the Common Agreement in a.particular section does not 

mean tht1t other sectkms ofthis CommonAgre.ement thatex:pressly apply 

to a QHlN {or to a Participant ora Sub participant purswint to a Required 

Flowe-Down) ate inapplitt1ble, 

2. lru:orporaijoh (if Recitals,. The Recifals sM forth above are lncorporated into this Common 

Agreement in their entirety an-cl shali be given foll forte and effect as ifsetfurth in the body 

ofthis comm.on Agre.ement. 

3. Governing Approach 

3.1. Role of the RCEand bNt .. ONCwas directed ~y Congress in the :ast Century Cures 

.l\ctto, "in collaboration with the National Institute of Standards and Technology.and 

other relevant agencies Within the Department of Health and HumanSel'Vices, for 

the. purposeofensuringfun network-to-network exchange of health information, 

convene public-prlvateand publit-publicpartnerships to buildconsensus and. 

develop or support a trusted exchange framework, includinga common agreement 

am6nghealth information nMworks nationally;" ONC entered into the contract 

With the RCE to implement, maintain, and update the Common Agreement 

Under the Contract, the RCE is responsible for matters related to the 

development and operation ofthe exchange of Tl.and related activities. 

ONC provides oversight of tile RCE's work under the Contract. Under t:he 

Contract,.ONC has the right to review the RCE's conduct, Including Designation, 

corrective action; atrd/or termination decjslons regarding Q.HINs, the proper 

execution. of nondistrlrnlnation and conflict ofinterest policies that de111onstrate a 

commitment to transparent, fair,and nondiSctiminatory treatment by the RCE of 

QHINS:,arid Whether the RCE has adhered to the requirements imposed upon it by 

this cornmon Agreement. ONC may also address complaints made by a QHIN 

against the. RCE as set forth in Section 15.6.1. QHINs havethetighttd appeal RCE 

decisions as set forth in Section 16 of this Common Agreement. 

3.2. Partitipation in Governance. QHINs~ Participants, and Subpartlcipants shall have the 

opportunity to engage in governance.under the Common Agreement. 

3.2.1. Role. the Transltionai CouncHandtheGoveming council, each as defined 

belowlshallbe responsible for the following: 

15 
76788 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.025</GPH>

(il 

(ii} 

Serving as.a resourceto the RCE and a forum for orderly and civil 

discussion of any issues affecting exchange activities or other issues 

that may arise under tl)e Common Agreement; 

supporting the RCE ii:! itswotktomonitor the exchange ofti t1nd. 

other activities under theCortnn<>n Agreement and serving~s a 

resourceto the RtE tei identify possiblet:orrectiVe actionsJot 

tottditions that disrupt exchange activities, inch.iding, but nqt firnited 

to,the foltoWing: 

(a) Provide:advice on fssues related to the Onhoarding of 

QHlNs; 

(b) Assist in E!Vafm,tingsuspecte<for allegedrt<:>n-cornpiiance 

with requirements in this ComrnonAgreement,.the SOPs, 

andthetl.TF; 

(t) Provide inpottegardingwhether to suspend ortetrninate 

a QHIN's participation; 

(d) Provide advice regarding issues beforethey become 

Disputes and are escalated to.the fotrnal Dispute 

Resolution. Process;, and 

(e) Evaluate possible and actual TEFCA Security Incidents, 

other Threat Cortditions, and information and/or 

recQmrnendatlonsfromthe CybersecurityCouncil, 

(iii} Reviewing proposed amendments to the tornrnOil Agreement, the 

QTF,and SOPs and providingfeedbacktothe RtE on the proposed 

cnanges; 

{iv) Participating in the developmentofneWSOPs and provri:lingfeedback 

to.the RCE on the proposedchangeS:; 

fv) Assistlngthe RCEwith the Dispute Resolution ProcesS:as set forth in 

this Common Agreement and the Dtspt1te Resolution SOP; 

(vi} lnforrnlngthe RtEondeveleipmentand updatingqfthe strategic 

roadmap for exchange aetivittes under the common Agreement: and 

16 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76789 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.026</GPH>

(vii). Advocating forthe value ofthe exchange acti.vities under the 

Common Agreement and. promoting,their success. 

3.3. fransitionartoundL fq prQmote a speedy 13nd effiden:tramp"UP ()fthe Goven:iing 

Cpvncil, a "Tr13nsitio11al Q<>uncn" shall$ervef¢r atwet\fe'- (1.2-i month terrnhegi11ning 

wlthi11;thirty(3b) days aftet the RCE 'i!r:m:ouneesthe first.group ofd.fitNs that the RCE 

Designates.· lhetransitiCinaJ coondtshailsenteas thi(interlnt gover11lnghody tot 

the actMUestc,ndUcte.d undertfie Ftan1ework Agreen1efits, 'i!s htC/tefullydescrihed 

below and ihthe T(iinsitiOl'ial CC/tincilSOP. • • 

3~3.1. Transition to the Governing Council: 

(i) Transition Plan Development'-- iii addrtfon fothe responsibHitres 

lii,ted·for particjpation·in governance generally, theTransitionl31 

Cou11cil shall developthetransitipn plarrfo theGover11ingCbundl. 

(ti) F<>tmati6n◊f dautuses--the RCE shaltweitkWiththetrar:rsiti6hal 

toundl to form theti:iut:uses described In Section 3)ti as part of the 

tr:ansltidn plan. The·caucusesare responsible-fodde-ntifying 

individuaktoserve:ontheGovernihg Cqum:il that will bE! established 

at the end ofthE! twelve (12) monthsfolloWingthe formation ofthe 

Transitional C()Uncil. 

(ili) Transition Timing_. Atthe end ofthe twelve (121 monthsfoltowing 

the.formation of the Transitional Council, the Governing Council shall 

assume responsi~ility for particjpatingirrthe governanceofthe 

exchange and relate.d activities under the Commol'l :Agreement witti 

the f{C:E. 

(iv) C()ntinufty-Notwfthstandihgthe twelve;.. (fi-}nt()nthterm ofthe 

Trahsitionaltoundl, thetepresentatives on the transitiohal tountil 

willcontinueto sserve in their governance role:tintil the 

re11resehtatives of.the Gei.Vel'ning council ate elected and instated. 

3A GovemingiCouncil. A Governing Council shaUbe established through election of 

individual members by each ofthe caucuses described below by the end of the first 

twelve (12) mohths followingJhe date onwhichtheRCE a11nounces thefirstsetof 

O,HINsthatffhas•Oesignated; The efedipn process and•constitutionofthe 

Governingtouncills more ftillysetfQrth inthE1Governing Ci::mnclfSQ.P; fhe 

• GoVE!rning touocilshall serve anhe l)ermanent govefhing h◊tl'/ for activities 
76790 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.027</GPH>

conducted.undertheFramework Agreements, as•morefully described inthe 

Governing Co.unciLSOP. 

3.4.1 Caucuses. 

(i) QI-IIN.btucus-Every QHIN shailhavetheriglittgappolntone{l} 

individual who is 11ffiliated with.thatQHIN,.as either an employee or 

inclependentc6ntract6r, to serve as a member ofthe QHIN caucus. 

The QHIN caucus will be facilitated by the RCE and shall serve as a 

forum for QHINs.ta.meet and discuss.issues.of interest directly 

related to the exchange of Tl. and related.activities underthe 

Common Agreement. 

(ii) Partlcfpant/Subparticiparit Caucus~ Each Q.t-111\lshaH have the righfto 

appoint up to three (3) indhtiduals.whoare affiliated witha 

Participant or a Subpart:icipant; either as an employee or independent 

(:Mtractor, tg serve as arnernbe.r of the Participant/Subpartldpant 

Caucus, In appointing such individuals; QJIINs should consider the. 

cornposltionofthefr Patticip.ants and $uijpartidpants and should 

endeavor to select persons.who Wilf be representative of the various 

p.erspectives ofthe QHIN's Participant/Subpartidpantpopulatic:m. 

The Participant/Subparticipant caucuswill.befacilitated by the RCE 

and shall provide a forum for Participantsto,meetand.discussdssues 

ofinterest.directly related to the exchange Of Tl.and related activities 

under the Common Agreement. 

3.!L AdvisoryGroups, The RCE,in ccmsultationwiththeGoverning toundl and ONC, may 

establish "Advisory Groups," fr()m tirnetotirne, for purposes.ofseekinginputfrom 

distihctgroups ofs:takehold.ers thatare partiestoor affected by actMties underthe 

Frame.work Agreements to better lhforn1the governance process, provide input Oh 

certaintopks,.and promote intlusivity. Theprocess for establishingAdvisory Groups 

and selecting members is setfotth in the applicable SOP. 

4, (lHIN Designation 

4,1. Eligibilityto be Designated. Signatory.affirms that it meets the eligibility criteria 

listed below and the requirements for demonstrating satisfaction of these criteria 

thatare indudedJnthe On boarding& Designation SOP, Signatory must meet the 

following criteria at thetirne Signatory submits an appllcation for Designation: 

is 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76791 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.028</GPH>

(lJ Signatory must demonstratethatit meets the definition of a U.S. Entity 

and is not owned or controlled byanynon~U.S. person(s} or entityHes). 

The specific; requir~d rnec1ns tod~rno11stratetllis c1re set forthin c1nSQ~, 

Ml $lgnatqtY~ a.hie tq exchar1ge Required Ir:1¥ormati◊n, 11s· d'efined ih this 

Ct!rnrrtott Agreement The spetlffo,.teq:ulred meat1s w demonstrate thjs 

are set forth in ah SOP. • 

(iii) Signatory.must demonsttatethant hastheabilityto plfrfbrmali ofthe 

retfuired functions ofa QHIN in the manner retjoited bythis commM 

Agreement,the SOPs,the QJF, and all otherapplicabteguldance from 

the RCE, Signatorycandemonstrate this by having been in operation and 

supportingthe.query functionality as outlined in the QTF,or other 

funptionallycornpara~le e~llange rn~tllod,for at l~ast the tw~lve (12) 

calendar 111onths immediately preceding itsapplication:to bE? Designated. 

However,the· ~Cf Will cor1sider other evidencethatSignatory·n,ay riff er 

tq dernqnstrate c;o01pliancewiththis eligibility criterion as rnqre foltyset 

forth ir:1 the applicable sop, NOtWithstandingthetoregoingJlf Signatory 

does notdemonsttate that it has been suppqrtihg query functionality as 

outlined in the QTF, the RCE rnaydeettithii requirement.to be satisfied 

on an interim basis and Designate Signatory under.a pro\iisioi:lal status, 

subject to.additional monitoong asfuftherproVidedinthe onboatding& 

Designation SOP, includingadditionat review during a provisional period. 

(lv) Signatory must demonstratethatit hafln place, .at the time of its 

application to be Designated, the,organizational infrastructure and legal 

authority to cornply with the obligations ofthe Cornmon Agreernent and 

aJunctkmirrgsysten,tq govern its Health Information Ne.twork; rr1 

addition; Signatory must demonstrate it has the resoutces and 

infrastructure to:supporta reliable and trusted network, • The specific, 

t!:!ql.lited n,eans to demonstratethis\are set forth in an St)P, 

4.2, Affirmation 6fApptrcatiot1 •. s1gnatoryrepresents'and warrants that theJnfutmation 

in its application is accuraMand complete,to.the best<lfltsknowledge. Signatory 

acknowledges thatthe RC.Eis relying upon the. inf.ormatton in its applicati.on to 

evaluate whetherSignatory meets the criteria to be Designated and that violation of 

this representation and warranty. is a material breach ofthis Common .. Agreement If 

the {{CE determines that material information in .the applicatiorris not accurate or 

complete:, the RCE may r~fuseto DesJgnate Signatory and withdraw Signatory from 

011Qqarding and tetminatethls C1>mmonAgreementfn.actordancewith 16;2.2, 
76792 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.029</GPH>

4;3. QHIN Designation Process. RCE and.Signatory will work.cooperatively.and diligently 

to allow Signatory to demonstrate thatit meets the QHIN eligibility requfrements 

and can comply with the reql.lirements include<;! in this CC>mrnon Agreement; the 

QTF, anti the.SOPS; however;.the burden ls 1.1ponSignatory to demC>nstrate that it 

dqescornply with such requirements. Signc1tor:y expressly acknowledges thatthe 

RCE is riot required to besignate Signatory in the everit that Signatory fails to meet 

the requirements. Signatory agrees thatitWill not representthat itJs a QHIIII unless, 

and until,the RCEformally De!>igrilltes signatory. The detailed pr«esidbrthe RCEto 

review Signatory's applicatic>n shall be set out in ah SOP. 

4A FormafDesignationas a QHIN. LfSignatory·demonstrates to the RCE'that it meets 

the requirements to be Designated, and affirms that itis a HIN, then theRCE will 

inform Signatory of its QHlN Designation; The process for Signatory to be formally 

Designated shallbesetoutln .an SOP. 

S, Change Management 

5.L Change Management Framework, ihe RCE shaltcoordjnate all changes to the 

Common Agreement, theQTF,and theSOPs ihCOl'ljunctronwith dNC. In addition to 

theattivitiesdescribed below, ONCshalfbeavailabJe•inaconsultative role 

throughout the change management process to review any proposed amendments 

to the Common Agreernenti the QTF, and the. SOPs as well asthe adoption ofany 

new SOP and therep.eal of any existingSOP. The RCE wlll workwith ONC,.the 

Governing. Council, and the QHIN and Partidpant/Subparticipant Caucuses, as 

outlined below, to consider amendments to the Common Agreement, the QTF~ or 

theSOPs and the adoption of any newS()P o.r the repeal ofariy existing SOP, 

Provided, however, thatthe actions described in Sections 5,1 throughS,:lofthis 

Common Agreement by orwith respect to the Governing Council,the.QHiN. Caucus, 

and the Part\cipant/SubparticipantCaucus, as applicable, shall hot be required until 

the respective bodyhasheen established as describedln Sectron 3. Signatory 

acknowledges that it.and the RCE do nothave the sole legalauthOtify to agree to 

changes to this commonAgre.ement,the QTP,orthe SOPs becauseONC willbe 

.available in a.consultative role throughoutthe process.and mustapprove all 

changes,.additions, and deletions. The Common Agreement must bethe same for 

allQHINs. 

S,::t Amending the Common Agreement or the QiF,Jhe RCEis tasked, under lts Contract 

with ONC, with updatingthe. Common Agreementand QiF. Proposed amendments 

to the Common Agreernent or Qii=may originate from multiple sources, including, 

butnotilrnited to,oNC:, the RCE,the GoverningCouncil, theO.HINCauc:us,or the 

Partidpant/Subparticipant c:aucus. The' RCE may consultWith the Governing Council, 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76793 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.030</GPH>

the.QHIN.Caucus, .. or the Participant/SubparticipantCaucus priorto submittingthe 

proposed amendment(s)to ONCforconsideration, The RCE.shall collect all proposed 

an:rE?ndments an(f submit tl:lem t.o ClNC; who.shc1ll determine whether further c1ction 

()n a proposeq amendment is wan:1:mted. 

s.:t t If bNC<tl!?terminestliat a ptbposed amendment.warrants further 

considetatibn; tlienthe RC:E Will prt!sent the propos'ed amendment to the: 

Governing Cburicil tot its feedback The Governing couneifWill evah.:t.ate the 

p:r:oposedamendme:nta:nddetertnine Whethefit•,Mifseek feedback:from 

the QHlN caucus, the Par:titipaht/Subpatticipantcaucus,.or both, as 

deemed necessary and approprrate, The:Go.verning Coundlwill provide 

the RCE Wi:th written feedback on the proposed.amendment, which will 

include feedback from the QHIN and Participant/Subpartidpant Caucuses 

as appJicable arid appropriate,. 

5'.2.2, The ~CE ~hall consult wtt:t1C>Nt about theGovernlng Councilfeedback" 

bNc shall,aftet considatingthefeedb:ackj determine whe;thetthe 

proposed.amendmentshould•ptoce:ed afterm1:1k1ng any changes to the 

amendment. lfQNC: deddeno proceed with the amendment, itwiil 

advance .the ptoposed amendment to th'!'!: QHJN caucus for approval bVa 

wtittenvote. An amendment will be approved if at least twO:.thitds: (2/3) of 

the votes .dist bytheQHIN caucus members within thetimeframe 

established by.ONCfor the voting period are.Jn favor ofthe proposed 

amendment. The requir.emenHo consultwith the Governing Cbuncffin 

this pr.ovision shall be satisfied by ONC's approval of the proposed 

amendment if; at.tile time ofst1ch approval; tile Governing C:ouncffandthe 

d.Hlt\l caucus have notyet been estal:!lished, 

s.:i.l thetlme;pedocl fot oNtito tledtlewhethertopraceed or notwhh a 

proposedametidmenttotheCommon.Agreement'pu.rsoant.tosectiqh 

s::t2 above shall initially be three m months after ONCreceives from the 

RCE feedbackfrom the Governingcouncil pursuant tosettib.h s:.2.2 above;: 

provided, hoWevei:~that.ONC may, in its discretion, extendthistime for an 

unlimited number ofadditional three-(3~). monthtime per1ods. 

5:2.4. The time.period for ONCtodecide.whetherto proceed or notwfth a 

p~oposedarriendmentto tile QTF pursuant to section 5.2,2 above shall 

initially·bethree (.3)months.after ONC receivesfrom the RCE feedback 

n:om the .Governing Com·tdl pursuant to section S,,2,2 ab:ove; provided, 

however; ~hat()J\J<: may; 1n its discretion, eic:tendthistime for one (j.) 

additional.three~ (3imot1th•time period. 
76794 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.031</GPH>

5.2.S. lfan amendmenuo the Common Agreement or .QTF is approved as 

described above, the amendment shall become effective ori the effective 

c:fate identified by ()NC.as partofthe amendment process and shall be 

binding pn Signatory without anyfurthet action by Signatory or the RCE. If 

Signatory is not willing.or able td cornply with the amendment, then 

SrgnatorY shall, within fifteen (15)buSiness days of being notified hythe 

RCEthat the amendment has been approved bythe QHIN caucus, provide 

the RCE Written Mtice .of termination .ofthis Common Agreement effective 

no later than the expiratibn of thirty (30}days from approval of the 

amendment. 

S.2.6. Notwithstanding the foregoing, ifthe RtE determines that an amendment 

to the Common Agreement or QTF is required in orderfor the IKEto 

remain.in compliance with Applicable Law;the RCEis not required fo 

provideQHINs withanopportuhitytovoteon the amendment However, 

the RCE shall still be required to provide sixty (6()) days' adv.mce w!:itten 

notice ofthe amertdmentand legal analysis ofthe need to use this 

expedited process, unless the RCE would be materiaily harmedby being 

out ofcompHance withApplicable Law if it provided the sixty(GO} days' 

written notice, in which case it will provide as muth notice as practicable 

underthe circumstances. Aliy such amendment to this Common 

Agreement or the QTF shall be subject to ONC review and modification 

prior to the. RCE providing advance written notice of the amendment to 

Signatory. Only those.amendments that are approved by ONC will be 

enacted. 

5;3, Amending; Adopting, or Repealing an S.Ofi; Tile RCE is tasked, under its Contract with 

QNC, with developing an initial set of SOPS thatwill be considered adopted when 

initially made publicly available prlot to the initial QHIN application periOd (i.e., prior 

to anyonesigningthe Common Agreement). The "anrendment;, process set forth 

beiow shall also apply to amending the initial set ofSQPsthrough adopting one or 

more new SOPs, repealingan SOP in its entitetyjOt amending oneohhe initialSOPs. 

5;3.1. Proposed amendments to the SOPs may originatefrom multiple sources 

including, but not limited to, ONC, the RCE, the Governing Council, the 

Q.HIN Caucus, or the Partitipant/SubparticipantCaucus. The RCE may 

consultwith the Governing Council, the O,HIN Caucus, or the 

Participant/Sub participant Caucus prior to submitting the. proposed 

amendment(s) to ONCfor consideration; The RC:E shall collect all proposed 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76795 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.032</GPH>

amendments.and submitthem to ONC, who shall determine.whether 

furt:heractionon a proposed amendment iswarranfed. 

5,3:.2. If ONCdetermines.thc1t aproposedameni:lment warrants further 

cQr1si:!,iera:tion,thenthe RC(will present the ptpposedamendn:renttP the 

Govetnifig toun.cil tot lts feedback, theGovetningCoiJndlwill evaluatethe 

propose.d ametidmentand detli!tmine whethe:r'itWill seek feedbackfrom 

the QH IN caut:1.$, the Pilrtit:ipant/Subpartit:ipantcauc:us,. or both, as: 

deemed necessary and appri)priate. The Governing council Will evaluate 

proposed amendments in. a timely manner and ptoVidetM RCE with 

written feedback onlhe proposed amendme.nt, 

5.3.3. The RCE shalLconsult wlthONC about the Governing Cbuncilfeedback, 

t:>NC shaJl,after considei:ingJhe feedbackdetermille whether the propo!i:ed 

ar:nendme11t should proceed after maklngany ctiangestQ ti-re amendment. 

If ONCcfecldes toproceed wi'i:hthe amendment; ltwilladvancejhe 

propose'd arnendn,enttothe d.H 1NC!lUcQsandthe 

l>attitipant/Subpatticlpant Caucus for apprQval byawritten vottt An 

amendnient will be ai)pr<>ved lht leasnwo~thirds (2/3}Q'fthevotes cast 

b•tthe QHIN caucus arid atleasnwo-thitds (2/3:)Qfttievotescastbythe 

Participant/Subparticipant caucus within the tim:eframe established by 

ONC fottMvoting period are intavoroftheproj)Osed amendment. The 

requirementtoconsultation withtheGoverning Council in this provision 

shall be satisfied by the ONCs approval ofthe proposed amendment if; at 

the time.ofsuch approval, the QHIN Caucus and the 

Partlcipant/Subpartidpant Caucus have not yetbeerrestab[ished, 

s::tll thetii'rieperi<tc:lfor dNCfodecld1,r11111'lethertoPr()Ceec:l or hOt:with a 

proposedamertdmentto.ahSOPpmsuanttos.ection5,3.3abe>ve shall 

inltially'bethree (:l)rnonthsarterdNt receh,estrom th!!! RCE feedback 

from the Govetnihg Council; provided, however, that: (a)ONCmay, in its 

discretion, extendthistirnefororte (l)additionalthree" (3~}monthtime 

petiod;'ahd (b)ifONC; ina.ddition,determines in its reasoriabledisctetion 

thatthe amendment•affects ormay be contrary to.can ONCrequired policy 

or another policy of the Department of Health and Human Services,or any 

Applicable Law, ONCmayexfend this time for an unlimited number of 

additionatthree- (3s) month tirne period$. 

5.3.5. Notwiths(anding·t:herequlremehtfor a ·Parti.cipant/SUbparticipant vote set 

forth in s, :1.3, if the proppsed amendment wiff notliave a mateflal impact 

on.any Partidpant!{·ot·Sub1>articipants,dNtmayadvan~ethe propose<! 
76796 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.033</GPH>

amendment to the QHIN Caucus only, . .wherebythe amendment will be 

approved if both of the followinghave occurred at teasttwo-thirds (2/3}of 

the votes ~st by the Q:HINCaucuswithin the ti:mefrilrne establishe.<fby 

◊Nt: for the v<>ting periOq are in f.ivqr oft he prop<>sed i:lmendme.nt. the 

requiremerrttp.c,o11$UltwJththe QHfNC:autus tn·this ptovisit>h shl:!11 be 

satisfiedbyONC'sap~foval·ofthe·1>tOp(>Sedamendment··1f, .. atthetihi~Of 

such appfQval, the Q!-IIN Catlcus has nQt yet been est'cit)lished. The RCEWill 

determine an effec,tiVe date forthe approved antendment subject to 

approval ofONC 

5;3,6,. Notwithstanding the foregoing;Jfthe RCE determines, based onadvice 

fromlegaEcounsel,.thatanamendmentto.an SOP.is requiredJnorder for 

the RCEto remain in compliance.withApp.lfcabletaw, the RCE is not 

requirecl to provide the .QHIN Caucus onhe Participant/SubparticiPi:lnt 

Caucus with an opportunity to. vote onlhe arnendmer:1t~ However,. the IRE 

shall still be requi~ed to provide shd:y(60)days' advanc,e wr!ftennotice 9f 

the amem;itnent and the legal analysis1>fthe need to use this expedited 

process; uniesstheRCE wouldbe materially harmed by being out of 

COhipliancewith Applicable Lawlflt provtded theslxty(60) days'writteh 

notice, ih which case the RCEWill provide as much notice as practicable 

under:the circumstances. Any such amendmentto. an,SOPshaU be subject 

to ONCteview and modification prior to enactment.. Onlythose 

amendments that are approved byONC will be enacted .. 

5;4, Voting Method. For purposes ofthevofing processsefforth in thisS.ection 51the 

phrase "writtenvote" iricludes a nyprocess by whic.hthere is a voting record,whkh 

may include V91:ihghy eJecttQTlic means., 

6,1. tooperatiott (Required Flow--Downt slgnatory utrderstanckand acl@:iwiedgesthat 

numerous activiti:es with respect to this common Agreement will ilkely involve Other 

QHINs and their respective Participants andSubpartlcipants, aswella:s employees, 

agents, thitd-partycontractors, vendors,.or consultants of eachofthem. Tothe 

extent notin.violation of Applicable Law, Signatory shall incorporate; and shall also 

require that its Participants and their Subparticipants incorporate,the following 

obligations into all Framework Agreernelltsto which theyare a party, ifany: 

(il ~espQnd In a timely manner, as may be further provided in an sm;to 

h:iquiries ftqm the JltE.ot other d.HINsahoUt poSsiblei:ssuesteiatedto 

their exchange 9finforrnation under the Common Agreement; 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76797 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.034</GPH>

(ii) Participate collaboratively in discussions coordinated by the RCE to 

address differing interpretations of requirements in this Common 

Agreement, the QTF, or any SOP prior to pursuing the Dispute Resolution 

Process; 

(iii) Make reasonable efforts to notify the RCE and other QHINs, as 

appropriate, when persistent and widespread connectivity failures are 

occurring with Signatory or its Participants or their Subparticipants, so 

that all those affected can investigate the problems and identify the root 

cause(s) of the connectivity failures; 

(iv) Work cooperatively, including, without limitation, facilitating contact 

between other QHINs or their Participants or their Subparticipants and 

Signatory's Participants or their Subparticipants, to address the root 

cause(s) of persistent and widespread connectivity failures; 

(v) Provide information (or require its Participants to provide information or 

to require their Subparticipants to do so) to other QHINs in support of 

collaborative efforts to resolve issues or Disputes, provided that such 

information is subject to Signatory's right to restrict or condition its 

cooperation or disclosure of information in the interest of preserving 

privileges in any reasonably foreseeable litigation or protecting 

Confidential Information; 

(vi) Provide information to aid the efforts of other QHINs or their respective 

Participants or Subparticipants to understand, contain, and mitigate a 

TEFCA Security Incident at the request of such other QHINs or their 

respective Participants or Subpartieipants, provided that such 

information is subjectto Signatory's right to restrict or condition its 

cooperation or disclosure of information in the interest of preserving 

privileges in any reasonably foreseeable litigation or protecting 

Confidential Information; and 

(vii) Subject to Signatory's right to restrict or condition its cooperation or 

disclosure of information in the interest of preserving privileges in any 

reasonably foreseeable litigation or protecting Confidential 

Information, disclose to the RCE information that Signatory, or its 

Participants or their Subparticipants, may have that relates to the 

following: 

25 
76798 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.035</GPH>

(a) cybersecurity risk information sharingprograms;.or 

(b.l $pec.Hic1 i<ientified security flaws in tlli:! c:rpe,atlor1 of the QH 1111 

or it:$ Participant!> orthE!tr S1.1t)padil:Jpants thatmay requite 

thE! QFflN <>ri~.Participantsor their $ubpattJdpantstotake 

specificstepsto plotectthe securityohheh- rnforrt1ati(>n: 

tethnol<>gy systems ahd would riot otherwise fa[I into 

stJbsettron (a). 

111 no case:.shall Signatory be fequiiedto:<fiscfose nor otheflnforrnation 

in violation of Applicable Law. ln seeking cooperation, Signatory shall make all 

reasonableeffortstoaccommodatethe otherQHIN'sC)schedulesand 

reasonable operational concerns .. The costs of cooperation to.Signatory.,shall be. 

b()rne by Signatory an:(! shall n()tbe charged:to ttie RCE orother QHll',Js. N.othing 

In this Section 6.1 shall motlifyor repfacethe TEFCASecurity lnddent notification 

obligath:msunderli'ectf6n f2.,3and; if applkable; Section10.5,3 oHhiS"Common 

AgreE!ment, 

Non-Distrirninatioh;. 

6.2.1. Prohibition Against Exd1.1siyffy {Required Flow:oown) .. Neither Signatory 

nor the RCE shall prohibitor attemptto prohibitany QHIN, Participant, or 

Subparticipant from joining, exchangingwith, conducting other 

transactions with,or supportlnganyother networks or exchange 

frameworks,usingservices other thon·theConnectivityServices, 

concurrently with th:e QHIN's, Participat1t's, or Subpartidpant's 

participation in exchange acti.vlties conducted under the.framework 

Agreements, 

6.2.2. NC) bisttfrninatory Limits.on Exchange offl(Reauired Flow:. 

Down).Signatory shall not impede the exchange.of informatitiii as 

permitted or: requrtedundtkthe applicable FrameworkAgteements or]tmlt 

intetoperabilityWith any other QHIN, Partieipant, Subparticipant, or 

Individual in a discriminatory manner, As used inthis$ection 6.2.2,.a 

"discriminatory manner'" means:action that is. inconsistently taken or not 

taken withrespecttoanysimilarlysituated QHIN, Participant, 

Subpartidparit, lndivldual, or group qf themtwhethet itisa.competitor;.or 

whether it is affiliated with or has a conti-actuahelationship with any other 

entity; or in response to an event. Nbt1Nithstan:cllngtheforegolng, 

limitations; load balancing ofnetWtirktraffic,or other activities, protocols, 

or rules shaU not be deemr:!d cllseritninatory toth:e exterit thanhey: (iJ 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76799 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.036</GPH>

satisfy the requirements of the exception setforth in 45 CFR 171;205; 

and/or (ii}are based on a rea!>onableand good'-faithbeliefthattheother 

entity<>r group has not satisfied or lllillnotbeablet<>saJisfy ttieapplicable 

tE!l'l'l'lS hereof(int::fuding c9mpliant::E! Wri:h..A.pplftable taw}in ,mymc:1terial 

respect, including, i-fapplicabte,any 6equirE!d :Flow-bown(s): one b.HlN 

s11spending~exchangeactivittes.withanotherdfll N in accordanc;e With 

section )6.4,:ishall not be d1:?erned dist:rimlnci:toty. 

6.2,3. updatesto connectivity Services~ In revising and updatingJts connectivity 

serviees from time to.time, Signatory wm uset:ommerdaltyreasonable 

efforts to do:soin accordance With generall.yaccepted industry. practices 

and implemented inanon•discriminatorymanner;. provided, howevertthis 

provision shallnotapp.lyto limit modifications or updatestothe extent 

that such revisil>Jls orupdates arere.quiret:I by .Applicable Lawor 

irnpJemented to respond prC)lllptly to n~ly discovered ptlvacy or set::urity 

threats, 

6.2A. Notice of Uodatestotonnecti\tlwsehlfoes, Sigi,citoty shall irnpJen\enta 

reporting protocol t~ provide reasonable 1>riorwritten notice of all 

modifieations9t updatesofits connectiVl'ty serVicesto all otherQHIN!i if 

:such revisions or updates are\expet:ted toadvetsely affectthe ext:hai"(ge of 

Tl betwe.en: QH INs orrequite changesJn:the conn:ettMtyServices ohny 

other QHIN, regardless whether they arenecessary dueto Applicable Law 

or newly discovered privacy·or security threats. 

7, tonftdent:raltfy and Accot1irtabi1ity 

1.'.L Confidential informadon:(Requlred Flow-Downl!iignatory and RCE each agree to 

use•all .• confidential Information received pursuantto this. Common.Agreem~mtonly 

as authori:tedirnhis Common Agreement and·any applicable sbP(s)and:soletyfor 

thepurpos·es of performing its ol>jfgations· ondenhis common Agteementor the 

ptoperext:hange ofitiforrnation under the commonAgreementand for no other 

purpose; Each Partytnayacus a DisdoserandaRecipientjaccordingly .. A. Recipient 

wilLdisdosethe.Confidential Information itreceivesonlyto its employees, 

subcontractors, and agents Who require such knowledge and use in the ordinary 

cour!>E! and scope oftheir •employment or retention.and are obligated to protect the 

confidentiality of the t>iscloser's Confidential lnformatiol'.l.il'.lamanner .. substantialJy 

equivaleritto thetermsrequired hereinforthetreatmentofConfidential 

information. Qtherwise* a·Recipientagrees ·not to disclose theConfidentlal 

lnforrnati<>n received tQ anyQne except as permitted under this Common 

Agreement. 

27 
76800 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.037</GPH>

7.2. Disclosure of Confidential Information. Nothing herein shall be interpreted to 

prohibitthe R~E from disclosing any Cpnfldel)tial Information to ONC, Signatory 

acknowledges that ONt, as a Federal government agency; is subject tq the FJf!edom 

oflnfonn,3tionAct (''FOJA"}. AnydisclosoreQf Signatory's. Confidential Information 

to dNC or anyoNt contractor: wil(be subject toApplicable Law; aswenasthe 

limitations, pr:ocedu~, and other relevant provisions ineluded in ahy applicable 

SOP(sJ. 

7.3. ONC's ahdJ:he RCE's Approach wheh Requesting Confidential lhforrriation. As.a 

matter of general policy, ONC will onl.y request the limited setof Confidential 

Information that ONC believes is necessary to inform the specific facts and 

circumstances of a matter. The RCE will only requestthe limited set of Confidential 

Information that theRCE believes is necessary to ioform the spedfic fac::ts and 

circumstances ofa matter. 

7k QHIN Accountability. 

7.4.1. Statement Of General Prlndple. to the extent not prohihitedby Applicable 

Law, Signatory shallbe responsible for its acts and ornissiohs,and theatts 

or omissions otits Participants and their Subparticipants, but not for the 

acts or omissions of any other QHINs.or their Partieipants ot 

Subparticipants. For the av.oidance of doubt, a Signatory that is.also a 

governmental agency or instrumentality shall not be liable to the extent 

that the Applicable Law that governs Signatory does not expressly waive 

Signatory's sovereign immunity, Notwithstanding any prQvi5ion in this 

Common Agreement to the contrary, Signatory shall not beJiablefor any 

act or omission if a cause ofadi()n for such act ()r omission is otherwise 

prohibited by Applicable Law, This section shall not be construed as a holdharmlessor indemnification provision. 

7;4.2. Harm to RCE. SUbjecno sections 7.3 and 7'4ofthis Common Agreement 

that exclude certain types of damages or limit overall damages, Signatory 

sha.11 be responsible for harm suffered by the RCEto the extentthatthe 

harm was caused bySignatory's breach,of this Common Agreement and/or 

any applicable SOP~ 

7.4.3. Harm to Other QHINs. Subject to Section 1,4 of this Common Agreement, 

whichexcludes certaintypes ofdarnagesor limits overalldamages, 

Slgnatory shall be responsibJefor ha rn:r suffered by another O.HIN to the 

28 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76801 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.038</GPH>

extentthatthe harm was caused by Signatory's breach of this Common 

Agreementand/or any applicable SOP. 

7;5, RCE Accountability,Signat'9rywiH not hold the RCE,or anyoneactjng.on its behalf, 

including but notlirniteil tq members ofthe Gc>verningtouncil Transitional Council, 

caucusesi Cybersecurity CounCil, and anyAdyisory Groupi work group, or 

subcommittee, .its contractors~ employees, ocagents liabh!: forany damages, losses, 

liabilities, or injuries arising from ()trelated to this common Agteement, excepttb 

the extent that st:rch damages, losses, liabilities, or injurie!i atethe direct result.of 

theRCE's breach ofthiscomrnor1 Agreement. This section shall notbeconstrued as 

ahold-harmless or indemnification provision; 

1:f:J: LIMITATION ON LIABlLITY. NOTWITHSTANDrNG ANYTHING.IN THIS.COMMON 

AGREEMENTTOTHEC:QNTRARY, 11\J NO EVENT St:IALL EITHEffTHERCE'S OR 

SIGNATORY'S TO"l'ALLIABILIT)' TO EAC:H OTHER AND ~(LOTHER QHINS ARISING 

FROM OR RElATIN~TO THIS COMMON AGREEMENT EXCEED AMOUNTS EQUAl TO 

TWOMllLION DOLLARS ($2.>0()0,00CIJPER INCIDEN'TAf,IDFIVE MILLION DOLi.A.RS 

($:S,000,000)AGGREGATE PER ANNUM OR SQCH OTHER AIVIOONTS AS STATED IN A 

TFIEN-iN-EFFECTSOi>; JN.()ROERTO ALLOW FOR THE PERIODIC ADJUSTMENT OF 

THIS LIABILITY LIMIT OVER TI.MEWITHOUT THE NEED TOAMENDTHIS COMMON 

AGREEMENT~ THISAND ANY$UCH ADJUSTED LIMITATION ON.UABILITYSHALl 

APPLY REGARDLESS Of WHETHER A CLAIM FOR ANY SUCH LIABILITY OR DAMAGES 

IS PREMISED UPON BREACH OF CONTRACT, BREACH OFWARRANTY, NEGLIGENCE, 

STRICT LIABILITY, OR ANY OTHER THEORIES OF LIABILITY, EVEN lF SUCH PARTY HAS 

BEEN APPRISED OFTHE POSSIBILITY OR LIKELIHOOD OF SUCH DAMAGES 

OCCURRING. IF SIGNATORY ISA GOVERNMENT AGENCY ORA GOVERNMENT 

INSTRUMENTALITY UNOER FEDERAL LAW, STATE LAW, lOCAL LAW, OR TRIBAL 

LAW AND rt IS PROHIBITED FROM LIMtnNG ITS RECQVER'{OF DAMAGES FROMA 

THIRD.PARTY UNDER APPLICABLE LAW, THEN THIS SECTION SHALL NOT APPLY TO 

EITHER SIGNATORVORTHE RCE. NOTHING IN Tl·HSSEctlON 7,4 OFTl:USCOMNION 

.AGREEIVIENTSHALI.BEC()NSTRUED TO CREATE LIABILITY' FO.R AGOVERNMENTAL 

AGENCY OR INSTRUMENTALITY OR OTHERWISE WAIVESOVEREIGN IMMUNITY. 

8. RCE Directory 

8.1, Access to the RCE Directory Servke, The RCE shall provide Signatory. with access to 

the RCE Directory Service once Signatory has been.approvedfor.suchaccess by the 

f{CE, Thetimeframes and requirements for accesstot:he RCEDirectory Service and 

use Qfthe RCE biredoryService are set qut in the 0.TFand the OnbQardlng& 

Designation $OP, 

29 
76802 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.039</GPH>

8 .. 2. Utilization of the RCE Directory Service (Required Flow.Down). The RCE .Directory 

Service.shall be. used bySignatoryand its Participants and their Subpartkipantsto 

create ii!nd maint{linoperati()n,ll .c()Onectlyity uodt,t'tl'te.Cornmon Agre~rnent, The 

RtE i$•· providing $1gnatQry .1.>,dth a;c;cess tQ;: and 1:he rigli0q use; the RCE Oiret:tory 

$ervlc~on the eitpres!ttooditlonthat$ignat()rycooly·useand di$¢lose irttc1rmation 

eont{line<fihthe RCE Dlrette>ry setvlceas necessary to advance the h'1tended use of 

the RC'E: Oirectory Service or as retj_Uired byApplftable la'\i\/, .. Fbr ekample, Signatory 

is petmitted to diSdQ'Se information contained ih the RCE mrector:v Service tQthe 

wt$tk'forc:e members of its Participant's ot subparticipant's health inforrnatidn 

tethhOlogyvendofWho.are engagedih.asSistihgtheiPatticipaot orsubpattidpant 

with establishing.and maintaihingconnectivity via this CommonAgreementand 

other FrameworkAgreements .. Further,Signatoryshall notusethe information 

contained'in the RCE DirectoryService.for marketing.or anyform of promotion oflts 

0,1Nfl prqducts and servic~, 1Jnl~s such u~"' Qr disclosure is priffiarily part of.in effort 

bySignaforyto e1<pandtor Otherwise impro~, co11nectivityvia.:the CQrnmon 

Agreernent,ana any promotion ofSignatQrts QWllprodudsor servlces.isl)nly 

inddenta(to:that primary pqrpose. In noevl:\n:t shallSignatoryuseot tliscloset:he 

information cQntained in the RCE Directory Service in a mannerthatshOuld be 

reasonably e)tp.ectedtO have a detth'nental effect on bNt, the RC:E, other QHlNs 

and/orth'eir Participants or subpattitipants, or an.y other individiralor organitatiOh. 

Forthe avoidance otdoubt,1n.f0tmationcontainedin.theRCE Directory is 

confidential Information ex:ceptto the e.xten:tsuthihforrnatiol\ meets one ofthe 

exceptions tothe definition·of Confidentiallnformation. 

8.3. Nb OuplicaUve Entries. Before fisting any entity inthe RCE Dfr.ectory Service under 

Signatory as the QHIN for that Participant orSubparticipant,Sig11atory musteonfirm 

that the f>artlcipanfor Subparticipant, as the ~ase may be, isnotalready listed 1n the 

RCE Direci:Qry Service asa Partkipant of, or a Subparticipan:tunder;anqther QHlllt 

Slgnatoryshall not list in the RC'E Directory Ser.viCe any suchdllplkative entry as a 

Pattidpant <>f Sub1>articipantof S1gfiatoty; Signatory shall not prevent a f>attlcipl'int 

orSubpartiCipant from changin~the QHIN throughwhichthe Participantor 

subpartitlpant.engagesine)tthai-igeundera.Frarne:workAgreernent. 

lt4. Maintenance ofRCE Directory Ser.vice~. The RCEshall provide and maintain the RCE 

Directory Service on a continuous basis, taking:all necessary steps to maintain 

norninallevels ofperformance•and responsiveness,.no less than 99.9% ofthe time. 

Commu11ication regarding planned and unplann~d dow11tim~ should be published to 

all Participants•and Subpartidpants.prornptly, ih accordance with generally accepted 

industry ser\iice levels:, to ensure that:there will be no lapses in servfr:ethat will 

materially dlsruptthe operations of SignatOtY•and other QHll'k 

30 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76803 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.040</GPH>

9. TEFCA Exchange Activities 

In adl:litiontq thereqtJirementsbelow, a QHIN, Par:ticipant,or Subparticipantmayonly 

Re'QUest inform1:1ti◊n under the applicable Frc:1mewor~ Agreen:lerrt: for c:1 spe<:ific Exchange 

Pumose (Hhe a.i-hN; Par:tieipant,.or su~pc:1ttlcipant ls thetYPifQf persQn ◊r entity that is 

ctescribed in the ffefinition ciftheappllcable Exchange ptJrp®e, $ucha QHiN, Partidpant, or 

subparticipant may use, a ausinessAssodate, agent, orc:onttactorto make such a Request, 

use; or DisdosureJb(the appUfable Excttange Purpose. For example, only a Health Care 

Provider as described. ih the definitiortof Treatment (ota Business Associate, agent, or 

contractor acting.or'lthatHealth Care Provider~s behalf} mayReqUest information torthe 

Exchange Purpose ofTreatment. 

This Common.Agreementspecifies, amongotherthings, thereasons:for,whithihformation 

may be Requested andtransmi.ttedfrom oneQHINte> anotherQHIN, f>artlcipan~and. 

Subpartldpantsshould understandt~at, despite their paxt:idpaflon undera Framework 

AgreemEmt, P.AlNs are prohibited from engagihginCiHIN-to-QHIN exchange for any 

putpos¢ ()then~an an Exchange Pumose L!Ylder this Common Agteen1ent. The R~E 

recogt\12.es that Signatory may participate in other healthinf~rrnationexchange networks 

and.·Signatory's Patti:ctpants and,their.St.ibparticipantsalsolikely patti:cipate ln other 

networks, asweltas non-network inforrnation exchange. This common Agreementtfoes 

not affectthese other activities orthe r-easonsJorwhich Participants andsubpatticipants 

rnayrequestahdexchange·1nformation.Within their-networks and/or.subjectto.other 

agreements. Such activities are not in anyway limited bythe Framework Agreements. 

9;1. utiltzation ofConnectlvityServices. Signatory maynot utilize theConnectMty 

Services for any purpose(s)other than the Exchange Purposes. Signatory is 

reponsi~lefor verifying t:he cqnformatlce ofalltransactiOns.ihitlatedbySignafory'.s 

Participants and their Subparticipants prior to transmission via o.Hll\J.to•CiH mi 

exchange;assetfotth intheQTF. FQrtheavordaneeofdqubt; a QH!N may<>nlymie 

the Cont\ectivity Services tolnitiateattansactiorras directed by ,ts i>artrcipants or 

their Subpattlcipants or ihhe Q.HIN itself is>authori:zed iJnderthe ass¢rted Exchange 

Purpose. 

9~2;. Uses(Reguired Flow-DownkSignatorymay Use Tl in anymannerthah(iJ is not 

prohibited by Applicable law; (ii).isconsistentwith Srgnatory's Privacy andSecurity 

Notice, if applicable; and (iii) isln accordance withSections.11 and 12 ofthis 

Ce>mrnon Agreement, ifapp.Jicable, 

9,3, Disdosures (Required Flowcbown). $ignatory may Disdose Tl provided such 

Disclosure: (i)is not prohibitedbyAppllcablelaw; (H)is consistentWith$ignatcJr'{'s 
76804 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.041</GPH>

Privacy and Security Notice, if applicable; and{iii) isinaccordance with Sections 11 

and 12 of this Common Agreement, if applicable, 

9;4, Responses (Required Flow.Downs). Signa~ory must SVPP:Q"ri an Exchange Purposes 

and rnustRespom:t to au Exchange Purposes thiat at~Jderrtifiedas "requited" in the 

Ei<changef>1Jrposes S~P, Signatory rt11.1stprovide.all Requirtidlnf'ot!'nationJhatis 

televantfor a required Exchange Purpose, asmaybefurtherspec:ified: in an 

illlplementatlon SOP for the applicable Excl'ia'nge Purpo.se, in Response,to a Reqμest 

transmittetlViaQHIN°to~QHIN exchange, unlessptovidingthe Required Information 

is.pr{)hibited by Applicable: Lali\l otthis cornmonAgreementot ifnot pfovidihg the 

Required Information is consistent withaU:Applicable Lawand this Common 

.Agreement. 

9.4,.1,, Excep,tlonsfo ReguiredResponses. N<>t\A/lth~tandihgthe f'or,egoin:g, 

Sigr1ato!)' is permitted but not required to. Respondtol;IRequest 

transrnitledyia QfllN~to0QH IN exchange in the drcurnstat1¢es setfhdhih 

9Jhi(iHvi) below; provided the. Res~onse: la) is not prohibited hy 

Applica~le Lav,,; (b}is c~nsist~ntwithSignator•lsPrivacyandSecuritr 

Notice.; if applicable; and (c)is in accordahce with this Common Agr~rnent. 

{i} lfSignatotycisa Public. Health Authority/ 

{ii} lfSignatory utilizes the Government Benefrts. Determ.ihation 

Exchange Purpose, indudingsuch an agency's 

agent{s)/contractor(s); 

(ijf) lfthe reaso11assertedforttie Request lslr1dividual Access $ervfoes 

and the information would not be required to he provided to an 

lndividualJji.lt$Uantto 45 C::F!i § 1fi4,524-{a)(2);regatdles!. of 

whethers\gnatory is:a NHE, a covered Ehtlty, ora Busirre!.s 

Associate; 

(iv} ff the Requested information is hotReqmtedtnformati6n~ 

proVided such response would not otherwise Violate the terms of 

this CommonAgreement; 

M lfSignatory is a federalagency,fo the eictenUtiatthe Requested 

0iscfosureQf Required Information is nt1tperrnittedunder 

ft.ppltcable tawfe,g.,Jt: is.Controlled Unclasslfiedlnforrnaiionas 

denned atl2. CfR Par:t2®2, andthe party requesting itd~s not 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76805 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.042</GPH>

comply with the applicable policies and controls that the federal 

agency adopled to satisfy its requirements}; or 

M) lfth~ Ex:change PurpOSifis i:iuthorized but not requiredliftthetirne 

<>fJhe Request; eitMr qnderthis CbmrntinAgreementorthe 

Exc~nge PurptisesSOlt 

9;5:. speciaftegal Reatiirerrfehts (Reauired Flow"oown). lfancito the extentApplicahle 

Law requires that an.Individual either consent to, apprcwe! br ptovidean 

authorization·forthe use or Disclosure ofthat· 1ndividual'sinforfnattont6<Signatofy, 

such as a more stringent stateJaw.relatingto sensitivehealthJnformation,then 

Stgnatory;shall refriiinfromthe Use or Disclosure.ofsuch information in connection 

with this Common Agreementunless such Individual's consent,approval1 or 

authe>riz~tio.nhas been obtained·consistent vviththe requirements ofApplkable law 

and Sectionllofthjs C6mmonAgreementi.including'l.lithout llrnltatie>n 

communicated pursuanttotheprocess cfesc:ribedintheQTF. Copleso(such 

consent, approval, or'authoti;mfon shall be ma,ntained aocf ttansrnitted pursuantte> 

the process described irtthe.oJF by wilid:teverparty'iS requiredtt'.> obtain 1tunder: 

A15piicabtet:aw, ands1gnatorymaymakesuch·Ct>pies olthe c:onsent,·approval,or 

auth0ritatior1:avaitahre efoctronicailyto anyQH IN, Partifipaht, orsubpatticipaot in 

ac.cordance With the QTF ahd toth.e extent permitted byApplicable Law, Signatory 

shall maintain Written policies and procedatesto. allow ah tndividual tb . .tevoke such 

consent, approval, or.authorization on a prospective basis .. If Signatory isanJAS 

Provider, the foregoing shaU not beinterpretedto modify; replace,ordiminish the 

requirements set forth in Section 10 of th is Common AgreementfoLobtainfng an 

lndlvidual's express written consent. 

iei. lndi'tidualAcl:HSS'el'Vici!s (Requltt!lf Flo:W~Downs, ifOfferJnqlndivldualAccess Seriitces) 

Nothlhginthe Pri\iacy·and Sec:utlty N0tic:e or it\the•fndivlduarswritten consentconected by 

Signatory who lsan fAS Provider pursuant to Section 10.2 and Sectibn 10.3 may contradict pr be 

incoosistent With any appticable provisibn<>fSections 1oor 11. 

10:1. Individual Access Services (JAS} Offeriog(s) (Required FloW-:Down}. Signatory may 

elect to offer Individual AccessServices to any. Individual in accordance,with the, 

re.quirements,ofthis section and in accordance with all other provisions ofthis. 

Cqrnrnon Agreement. Nothingi11 this Section 10shall modify, terminateior in any 

wayaffect:anlndill:fdual'srightof accessundertheHIPAA J>ri.vac,y f{u1e•at4S CFR 

164,514 wlth respectto any Q.lilf',l, t>artklpant, or subpar::tkipanhhat is a Covered 

Entityor a 13usinessA'ssodate. Nothing ln this Sec:tic:m io of this Common 

33 
76806 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.043</GPH>

-Agreement shall be construed as an exception or excuse for any conduct by the 

Signatory 1:hatmeets the.definition ofinformation blocking in 45 CFR 171.103. 

tttt. lndi.vidual Consent (Required Flow~Oown}. The lrn:lividual reql.i~tihg lndivitlt1al 

Access Servicesshall l:>e ~espc>nsible for completit1g Signatory'$ own supplied form 

for<>btii."ining Individual express C:biisertt ih tPnhect:iOh Withthe lndhtiduaf Ac:cess 

setvices/as set forth hefow. Slghatory mav implernehtseeute eiec:tr::onit means 

(e.g., sec:uree~mail, seel.ir.e web portal}byWhichan 111dMdual may submit slith 

Written tonseht. 

10.3. Written Privacy and Security Notice and lndi.vidualConsentfRequired Ffo.w .. oowns). 

10.3.1. lfSignatory offers. Individual Access Services, it must develop and make 

publidyavailablea writter:rprivacyand SE!CU[ity rioth;e (the "Privacy.arid 

Security Notice"}. The PrivacyantfSecurity Notice must: 

(iiiJ 

Bepubli¢fyactessibleahdkept currentat alltlm.es, including 

updated versfons; • 

Be shared with anJndi-vrdual prior to the 111ti1wtiuails use/receipt 

ofservitesfrorti Signatory: 

Be written in plain languageandJna manner calculated to inform 

the lndivfdual ofsuch privacy practices; 

lndude,a statement regarding w!tether andhowthelndlvidual's 

tr maybeaccess-ed~exchanged, tls~d, and/or Disdose:d ~y 

Signatorv or byother persons or entities fowhom/whtch 

Signatory Olscfoses or providesaccess tQ'theinfdt.rnatitfri; 

includingwhetherthe .lndfVidual1sttrnaybesoldat ahy time 

(includ,ngthe future); 

Ind Ude a statem:entthatSignatorf is required to act in 

conformance.with the Privacy and Security ·Noth::.e·andmust 

protectthe se.curity of the information it holds in accordance with 

SectionlOofthis CommonAgreement; 

Include informationregarding whQl11 the Individual may contact 

within Sfg_naforyfor further informationregardirtglhe Privacyand 

sewrity I\JQticeand/or witfipr1va1:y-related complafnts; 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76807 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.044</GPH>

;{vii} Include a requirement bySignatoryto obtain express written 

consenttotheterms.ofthe·Privacy•andSecurityNotlcefromthe 

lntlividual prior to th:e access"; ei<.<:ha:nge, Use1 or DiscJosu~ 

(including $ale )ofth:e lndMdua:1'$ ti, othe:r thc:1n Qi$¢fosuresthc:1t 

are required t,y A11Plitc:1ijle i.aw; 

•fix) Include. anexpllinatianotthelndi:vidual'Srights, induding, atir 

minimum, the. rightssetforth in Settion.10.4, below; 

(x.} Include-a disclosur.eofanyapplicable fees or costs related to IAS 

includi:ngthe exerclse.ofrights•underSection 10.4ofthis Common 

Agreement; anti 

(xi) lm:ludean.effettilre date. 

thedmplementatian of such PtiVaty and Security Noticrr requfrements shall 

be set.forth ih the fAS SOPc. If Signatory is a Coveted Entlty; then a Notice of 

Ptiva.tyPracticesthat meets the requirements of ·45 CFR §164.520 and 

meetsthereqUirementof 10;3,l(hi) above can satisfy the Privacy and 

Security Notice requirements. NothingJnthis:SectiM 10.3 reduces a 

Covered Entity's obligations under the HIPAARules. 

10.3.2. lfSignatoryis an IASProvider, it mush:ollettthelndlvidual'swritten 

consent as required under Section 10.3,l(vii) of this Common Agre.ement at 

the outsefofthe Individual's firsiuseofthelndiVidual Access Services and 

with any material change in the applicable Privacy and $:ecurity f,Jofrce. 

io,,t ltidjvldual Rights (Reauirec:fi::low-Downl. Individuals have, and mustbe dearly 

informed of,. thefollowing rights: 

(iJ The rightto requir:ethataHofthe.r lridividuauy ldei'itifiableJriformatiori 

maintained by.Slgnatory,as an 1AS Provider be deleted unless such 

tleletion is prohibited by .. Appli.table2.law; provided, however, that the 

foregoing shall not apply to lndividuaUy Identifiable information 

-0011tainedina4dit logs. 

(ii) The right to an exportoftheir Individually Identifiable inforrnatlonJn.~ 

tomputablefqnnattlntludingthe means to ihtetpret $Ud, ihfarrna:tioh .. 
76808 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.045</GPH>

The rights,described in this Section 10.4 shall control over any'inconsistent 

provisions in Section.11. 

10:s, Additional Security Begultements.fotlAS Provi:d~rs.(Requlred Flgw-Downs}, In 

addition t9 meeting the appli~able s~urity rli!quirernents !ietf~:th in Sectioh '12,i:f 

Sig11atoryis an iAs Provlder itmusrforthersatisfvthe reqtJirements ohhis 

subsection. 

10.s.1. scope of security Requirements. lfSignatory'is ah IAS Provider it must 

comply:with the applicable seciitityi'equir:eme11ts set forthinlhis Common 

Agreementandthe security.SOPs for all Individually Identifiable 

informationthey hold, regardless of whether such information is Tl. 

10,5.2, Encryption:, If $ignatQrY is an\lAS Provider it is required]o e111:rypt a.II 

lndi11idually lde11tlfiable infQrr.nation ttetd by Signatory\, both in trans1ta11d 

at rest; regardlessofwhethersuch data are TL 

i<ts,g, lEJcA secotityihddent NoticetoAffected individuals, Each slgnatorythat 

is an IAS Providermust notify each lndivicjual whoseTlha:s beenoris 

rMsonabty believed to have been atfected bya TEFCA.seturity lneident 

involvingthe TASProvider. such notification must be made without 

unreasonabledelayand iri nocaselatetthan sild:y (60)days folloWing 

Discovery oftheTEFCA.Security Incident The notification required under 

this section must be.written in plain language and shall indude,to the 

extent possible: 

(i} A btiefdescriptron ofwhat happened, indQdinglhe date of the 

tEl=tASecudty lnddel'lt and the date.of its Discovery, ffknoWll; 

(ill J\cfosctiptit>n ofthetype(sJ t>fOnsecuredTrfnVolved ihtheTEFCA 

Security lnddent(such as whether fultname, Social .Security 

number, date ofhirth,homeaddress, account number, diagnosis, 

disability code; ot. other types otrnformatiohwere involved); 

(iii) Any steps lndMdualsshouldtake to J>rotect themselves from 

potential harm resulting from the TEFCASecurity Incident; 

(iv-) A brief description of what theSignatoryJnvolved is doing to 

investrgatethe tEFCASet:utity Incident, tomttigateharmt6 

individuals, an'dtc, protectagainstanyJurther tEFCA Security 

lntidents;and 

36 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76809 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.046</GPH>

(v) Contact procedures for Individuals to ask questions or learn 

additional information related tothe TEFCASecurity.lncident, 

which shall include il telephone number (toll-free), e-h'lail addre.ss, 

and website with contact information .and/or a contattforh'l for 

the IAS Pro.Videt. 

To the extent Signatory is aiready required by Applicable Law to 

notify an Individual bf an ih(;ident that wcmld also be a TEFCASeturity 

Incident, this section does not require duplicative notification to that 

Individual. 

IO.ft Survlvalfor IAS Providers {ltequired Flow-t>own). Thefollowing minimum provisions 

a net their respective minimum time periods shall continue to apply to Signatory to 

the extentfhat itjs an IAS Provider and survive expiration or termination ofthe 

applicable Framework Agreement under which Individual Access Services were 

provided for the tirne periods andtothe extent described beiow. 

10.6.1. i'hefoUowing section 10 provisions shall survive the expitation or 

termination of the applicable Framework Agreement until expiration of the 

time period specified in the definition of PHI at45 CFR § 160.103 under 

Subsection 2(tv) ofsuth definition, i.e., fiftt(SO) years afterthe death.of 

the Individual for whom Individual Access Services were provided, even if 

the information to whichthe provisions apply is not ePHl: 

(i) The terms of the conserit under Section 10.2, Individual Consent, 

and the terms.of the Privacy and Security Notice under Section 

1(t3.l,whichsets forth requirements thaUpplytothe Privacy 

and security Notiee; 

(iil Section 10.3.2., which requires Signatory to tollectthe litdivktual's 

written. consent with respectto any rnateriaLchange in the 

applicable Privacy and.Security Notice; 

{iii) SectionlOA, Individual Rights; and 

{iv) SecUon lCl.5, Additional :Security Requirements.for IAS Provitjers. 

10,6.2. Sed:fon lCLS.3, TEFtA Security lncidentNotiteio Affected Individuals, shall 

survive fot a period of six (6)yearsfollowing the etprration ortermination 

ofthe·applicable Framework Agreement.. 

37 
76810 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.047</GPH>

10. 7. Provisfons that Apply to Subcontractors and Agents of IAS. Providers (Required FlowDownt Tothe extent that Signatory isan IAS Provider 1.111dusessubcontractors or 

agents with respect to the provision ofsuch Individual Acc.ess Service$; it ~hall 

include in a written agreement with each such subcontractor or agent a requirement 

to comply with the following: 

(i} To act hi at<Wdance With each Of the applicable consents required of 

Signatory under section 10.2; 

(ii} To act In accordance with each of Signatory's applicable Written .Privacy 

and.Security Notices pursuantto Section 10.3;. 

(iii) To actin accordance with Section 10.4 when directed todoso by Signatory; 

(iv)· Withrespecttothe informatlonf.or which :the subcontractor or agent 

provides se:rvicesto Signatory rn its role as an IAS Provirler,theagent or 

subcontractor shall implementthe applicable security requirements set 

forth in this Common Agreement (other: than Sections 12.1.5, 12:urand 

12.3) andthe securitySOPsforaUsuch Individually Identifiable 

information,regardless ofwhether.stith information is Tl, to the same 

extent as they appty to Signatory; provided, however, that for purposes 

of the Flow-Down Provisions of this Section 10 . .7, if the IAS Provider is a 

Participant or Subpartlcipant, only Sections 12.1'4 and 12.2 shall apply; 

M To encryptall h1diviuually Identifiable information both in transit and at 

rest; regardless nfwhet:her such data are fl pursuant to Section 10.5.2; 

and 

{vi) To notify Signatorythat is an IAS l'rovldetfor Which it ptovtdes services 

with tespect to each tndividualWhose Tl has been oris t.easonably 

believed to have been affected by a TEFCA Security Incident involving the 

subcontractor or agent in the manner and within thethneframespecified 

pursuantto Section 10.5.3. 

Each agreement betweenSignafory and a subcontractor or agent with respectto 

the provision of Individual Access Services shall also providethatsubsections (il 

through M above shall continue in effect. after termination ()r expiration of such 

agreement at least unt:11 expiration ofthetirne period specified.in the definition 

of PHI at 45 tFR § i60,103 undetsubsection 2(iv) ofsuch definition, i.e,, fifty (50) 

years after the death of the Individual towhom the information relates. Each 

38 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76811 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.048</GPH>

11.Privaey 

such agreement shall also providethatsubsection {vi) above shall .survive for at 

least six(6) yearsfollowingthe termination or expiration ofsuch agreement. 

1'.1"1' COrnpliance whh the HIPAA:Privaty RUle(ReqUiredl=lo:w~Down); If Signatory is'a 

Nff E (but nottot:he extentthatit isactin~as an entityehtitled t<i make a 

uovethment Benefits DeterminatiMundei'AppJicabie 1.aw, a Public Health 

Authotlty,dr a Government Health careEhtity), thehlt.shalltomplywith the 

pr.ovisiohs ofthe HIPAAPriVacy RUie listed belowwith respectto all lndiVidualfy 

Identifiable information that Signatory reasonab[y believes is TLas ifsuch 

information is.Protected Health Information anctSignatory is a Covered Entity. Such 

compliance shall be consistentwithSettion 13,2(Compliancewith Sp.ecific 

ObJigati()n~} and e11fo.rced a~ part o{lts@ligatior1s pursuantto this i;:!Jmmon 

Agreement. 

11.1.L From 4stFR § i64.S021Gerieral Rules (Required Ftow-Oown)': 

• Subsection fa)(1)- Dealing with p.ermitted Uses. and Disclosures) but 

onlyto:the.extent Signatory is authorized to engage in,the activities 

described inthJs subsection of the HIPJ.\A Ptfv'aey Ruie for the 

applleable;~xchange Purpose, 

• Subsection (a)(2)(il'"' Requiring Disclosures tolndfviduals 

• Subsectioh (a)!3 )- Business Associates 

• Sub.sectio(i {al($)-Dealing with prohibiti:1d Us!i!s and bfsc:l◊sYtes 

• Subsed:lon (bl= Oe~tihg,11V!ff1 ~heMinimmn l'Jec::es$al'.Ystandarcl 

• subsection (Cl- Dealing with agreed~upon restiittions 

• SUbsecti◊h ldl- Deatinlfw°ith dliidentificaticinand te~idElntific~tion of 

information 

• subserction (Ei)- Qealingwith 13ys1ness)1⁄4spdat:econ1:tacts 

• Subsectfon (f)- Dealihgwith dec:eas:e.d persons'informatlon 

~ Subsection (g)- Dealing:witft petsonaLrepresentatives 

• Subsecti(in (it)- Dealingwith col'ifidential c.ommunkations 

•• Subsection (il- Oealingwith Usesand Disclosures consist:entwlt:h 

notice 

•• Subsection{))- Dealingwith Disclosures bywhistleblowers 

U.f.2, 45CFR § 164.5041 Organizational Requirements (Required Flow-Down). 
76812 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.049</GPH>

11.1.3. 45 CFR § 164.508, Authorization Required (Required Flow-Down). 

Notwithstanding the foregoing, the provisions of Sections 10.2 and 10.3 

shall control and this Section 11.1.3 shall not apply with respect to an IAS 

Provider that is a NHE. 

11.1.4. 45 CFR § 164.510, Uses and Disclosures Requiring Opportunity to Agree or 

Object (Required Flow-Down). Notwithstanding the foregoing, an IAS 

Provider that is a NHE but is not a Health Care Provider shall not have the 

right to make the permissive Disclosures described in§ 164.510(3) -

Emergency circumstances; provided, however, that an IAS Provider is not 

prohibited from making such a Disclosure if the Individual has consented to 

the Disclosure pursuant to Section 10 of this Common Agreement. 

11.1.5. 45 CFR § 164.512, Authorization or Opportunity to Object Not Required 

(Required Flow-Down). Notwithstanding the foregoing, an IAS Provider 

that is a NHE but is not a Health Care Provider shall not have the right to 

make the permissive Disclosures described in§ 164.512(,cj- Standard: 

Disclosures about victims of abuse, neglect or domestic violence;§ 164.512 

Subsection {d) - Standard: Uses and disclosures for health oversight 

activities; and § 164.512 Subsection (H- Standard: Uses and disclosures to 

avert a serious threat to health or safety; provided, however, that an IAS 

Provider is not prohibited from making such a Disc\osure(s) if the Individual 

has consented to the Disclosure(s) pursuant to Section 10 of this Common 

Agreement. 

11.1.6. From 45 CFR § 164,514, Other Requirements Relatingto Uses and 

Disclosures (Required Flow-Down}: 

• Subsections (a)-(c)- Dealing with de-identification requirements that 

render information not Individually Identifiable for purposes of this 

Section 11 and TEFCA Security Incidents 

• Subsection (d) Dealing with Minimum Necessary requirements 

• Subsection (e) Dealing with Limited Data Sets 

11.1.7. 45 CFR § 164.522, Rights to Request Privacy Protections (Required FlowDown). 

11.1.8. 45 CFR § 164.524, Access of Individuals {Required Flow-Down}, except that 

an IAS Provider that is a NHE shall be subject to the requirements of 

40 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76813 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.050</GPH>

Section 10 with respect to access by Individuals.for purposes.of Individual 

AccessService.s andnotthisSection 11.1.8. 

11..1.9. 4SC:FR § 164,.528,AccountingofDisclosures IRiffluir¢d Flow"l:iowri). 

i:l.,:Lio, From 45CFR §;.164,53.0, Administrative . .Requirements (Required Flow• 

Down): 

• Subsection {a)--- Dealingwith personneLdesignatlons 

• Subsection (bJ- Dealing with training 

• Subsection (c)- Dealing with safeguards. 

• Subsectiqn {dl- OeaHngwith cornplaints 

•• Subsection fel= Dealing with sanctions 

• subsection th- oealingwith mitigation 

• subsection {g)...,. Qealiogwiih refrainJngfrornJntim1datingtn retaliatory 

acts 

• Stlbs~eti'cin lhl""' [jealingWith Vllaiverqfrlghts 

• Subsection (i)~ DeaUngJ.vith policies and procedUres 

• S.ubsection (n- ttealingv,,ith dQcumentatfon 

n.2. Written Pffvaty Policy lReauired Flow-oown)..Signatobi mustdevelop, implement, 

make publicly available, and act in accordance with a written j:frivafy polity 

describing its privacy practices with respectto Individually Identifiable information 

thatis Used or Disclosed pursuant.to this CommonAgr.eement. Sign.atorycan satisfy 

the written privacy policy requirement by includingapplicable contentconsistent 

with the 1'.HPAARulesirito its existing Pfi\tacy policyi exceptasotherwisestated 

herefrrwith respect to IA$ PrcNiders. This written privacy po Irey requirement doe~ 

notsupplant the. HIPAA Ptivacv••Rufe.obiigatio11s.ofactH1N, Participant,. or a 

Subpartidpant that is a Covered Entity. to postand distribute a NQtic.e of l>rivaty 

Practices that meets the requirements of45 CFR § 164.520: lfS1gnatQryis a covered 

Entity, then.this written ptivac'y j)ractices reqiliternent tan be satisfied by its.Notice 

.of PrivacyPtactices. lfSignatotyis an .IAS Provider, then the writtenptivaty 

practices l"eqOirementmust be in theform oh PrivatyandsecurityNoticethat 

meets the. requirements of Section 10.3 ofthis•Common Agreement. 

12. Security 
76814 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.051</GPH>

12;1. General Security Requirements. Signatory shall comply with the HIPAA Security Rule 

as if ttie HIPAA Security Rule applied to lndividu,dly Identifiable information that is Tl 

reganfless of whether Signatory is a CovE!red Entity or a Business Associate. 

Signatory !illall also tomplywi1:h the security requirements stated in Section 14 of 

this common AgreE:?ment andspetific i:idditional requiremetrts as describe" in ttie 

Q!Fand applicable SOPs, totheextennhat sutti requkements are Mt already 

included in the HIPAASeturity Rule; with tespetno all Individually Identifiable 

inforrnatiorrthat is Tl as ihuth information were Pfotetted Health Information and 

Signatory were a Covered Entity or Business Associate. Notwithstandingariything 

else in this Section 12, none of these requirements shall apply to any federal agency 

or Public Health Authority. 

1:u.1, CybersecurityCoverage. lnaccotdance with the Cybersecurity Coverage 

SOP, Signatory shall maintaln;.throughout the term ofthlsCommon 

Agreement: (i) a pqlicy. or polities ofinsurance for cyber risk and 

technology errors and omissions; {ii) intern.al financial reserves to selfinsure against a cybet~im::icient; or (iii) some combination: of(i) and (ii} 

12~1.2. CybetseCUtityCertifitatibh.Signatol:y shall achieve and mairitaih thirdcparty 

certification to.an industry-recognized cyberseturityfrarnework 

demonstratingtornpliantewith all relevant securitytohtrols, as setforth in 

the applicable SOP. 

12.1.3. Annual Security Assessments.Signatory must obtain athird•party security 

assessment and tectmicaJ audit no iess often than amwaUy and as further 

described intheapplicable.SOp;. $lgnatorymust also provide evidence of 

compliance with this.section and, if applicable, ofapptopriate mitigation 

efforts in response to the fitidirigs • of the si'1turity assessment and/or 

technlcal audit within thirty (30} daystothe RCE as specified in the SOP. 

12.l.4. ParticipantsandSubparticipahts (Required Flow-Down). Sigl'latb(',' shall 

require in its Participant-QHIN.Agreements that its Participants implement 

and maintain, and require their Subparticipants to implement.and 

maintain, .. appropria:te security controls for Tl that are commensurate with 

risks to the confidentiality, integrity, and/or availability of the Tl. lfany 

Participant or Subpartidpant is a NHE, it shall be required to complywith 

the HIPAA Security fMe provisions with respect to an Individually 

ldentifiable'information that the Participant or Subpart:idpant reasonably 

believes iSTlas ffsuch information were Protected Health Information.and 

the Partidpantor Subparticipantwere a Covered Entity or Business 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76815 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.052</GPH>

Associate. Signatory shall further r.equire that its Participants implement 

and maintalh,.and that its Participants require their Subparticipahtsto 

ir:nplernentaryd maintain, any acldfti()nal security requirements that.maybe 

setfqrth it1 an SQP applkiible to Patfidpcints:ar:11:f Subpartidpants.. Such 

cornpI,aneesh;illbeenft>rce<1.i:i$:. p11tt of the Partkff)antf 11nd 

Subparticipants'obligatiqris.·pursuantto the Frarnework Agreements. 

12..1.s. setufity Resoutces@port to Participants. Si@atoryshall make.available to 

itsParticipants:(i) security resourcesandgliidahce r-egatdingthe 

ptdtection tiHlapplicabJetothe Participants' participation lnthe O.HIN 

under the applicable Framework Agreement; and (ii) information and 

resources.thatthe RCEor Security Council makes available toSignatory 

related to promotion and enhancementofthesecurity of Tl underthe 

Frarne1N()rk.Agreernents, 

i:Li.6. Ghiefiriforrnatlon Securlty Officer, the RCE shall designate a penmn to: 

serveas the·Ghieftnforrnation.Secμtity Qfflcet·(CISQ)·foracti.vities 

coriducted underthe Framewa:tk Ag(eernents: This maybe either an 

eropl()yee ol'indepem:lentcontractQr t>fthe Rtt. The RCE's tiSOWill be 

responsible for monitOrihffand maintairiihgtheoverall security posture Of 

activities conducted under the Framework Agreerneots\and making 

recommendations to all·QHINs.regardlngchaflgesto baseline security 

practices required toaddress,changes.to the threat landscape. Signatory 

agreesthaUt, and not the RCE, is.ultimately responsible forthesecurity 

posture-0f Signatory.'snetworkandtheacti\lltiesconducted bySignatory 

underthe Participant0 QHINJ\greemer1tsto which Signatory isa party, as 

well astt:re Pafticipant-Subpartidpant Agreements its Participants.enter 

into and all Downstream SubpartidpantA~eerneots that its Participarits' 

Subpartlcipants enter ii'ito, Si~natoryshi!!Halso des,nat~ a. person to serve 

as its GISQforpurposes of Signatory's participatkmJr1 QHJN-to-QHIN 

exthange. the RCE shall establishaCyb:ersecuiitV Council to enhance 

c;ybetsecurlty commehsurate With the risks of the activities conducted 

undefthe FrameworkAgreements.as more. fully setforth in an SOP. 

12.,L Tl Outside the. United States(Reguired Flow-Down}. Signatory shall not Use Tl 

outside the United States or Disclos.e Tl to any person or entity·outsidethe United 

States exceptto tl:i.e extent such Use or Disclosure is permitted or required by 

Applkabletaw and exceptto t~e extentthe .Use or Oisc!9sureTs conducted in 

conformance wlththe l·IIPJS.A.$ecurltylfole, regardless of whether Signatory is a 

Covered EntitY:<>( Business Associate, sfgnatory shall evaluate the risks ()f any 

extraterritorial Qsesand/orOisd()sures c;ftl,if.applieable, as{lartofan annual 

43 
76816 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.053</GPH>

security assessmentand prior to any new.or .substantially-.differenttype of non,U.S. 

Use(s) or Oisdosur.e{s), Such security assessment shall include a risk assessmentfo 

evc1luc1:tewl:tetherthe Uses C>r Disc;losuresoflnd(vidyc1lly.•ldentifiableinfqrm1Jtion 

thafis rec1sonal:)ly believect totJeTl l>y<:>rlo persons 9r entitlesoutsidf:! the Or\'itect 

Stiiites sc1tisfie~ the re:quirements of the HIPl(A$ecurityRuie, Thefbregc>ingdpes not 

rn(!difyor elirninate any pto.visioflc>fApplici!!hle tawthat<foes not permit a signatory 

to bisdose lndiv\duallylclentifiabl~iinfotmationto a per$Pn orentityou:tsidetht! 

united states or that impc,ses cb.ridltioh!i or limitations on such msdosure~ 

12:3. TEFCASeturity Incident Notification. As soon. as reasonably ptacticabl~. butn6t 

morethanfive (5) calendar days. after determining that an TEFCASecurity lncidt!nt 

has occurred,Signatory shall provide notificationfo the RCE and to all QHINsthat 

are.likely impacted,w.hether directly or bynature.ofone.oftheother.QHIWs 

Participantsor·Subparticipants,9f•theT~Fc:ASecutity Incident. Sucttno.tifkation 

musfindude.sufficient information for the RCE andothersa1'fected to understand 

tht! natyreand llkelys-copeoltheTEFtA Security incident: Signatqry shall 

supplernentthe informatjoncontai nedlnthe notitkatlon_as it becomes ayailable 

and coc>peratewiththe RCE; and w1thothet: Ql-ill\l!l; Partkipahts"and Sabparticipants 

thatare likely impacted bythe'rl:F:tAsecur1ty'inddent. 

12.3.1. ReceiviqgTEFCA securitvlhcidentNotification._Signatbryshall implementa 

reportingprotocolby which. other QHINs can provide Signatory with 

notification-of.a TE FCASecurity Incident. In the eventthatthe. TEFCA 

Security lncidentinvolves. Tlthat.is de"identifiedinaccordance w.iththe des. 

identification standard provided at45:CFR §'. 164 . .514(a), then no such 

reporting obligatiol'I shall. exist. 

12.~.2., Vertical Reporting of'rEFCA Securftyfrlcldent(s). Slgnatoryshall re:qulrethat 

each l'articipant with w.hicll it has entered into a Parti'dpaht-dHIN 

Agreement: 

{i) NbtifySignatoty>ancll'articipant'ssubparticipants otanyTEFCA 

security. tncidentthe Patticipantexp.eri.ences in .accordance with 

thetimingand•content requirementsstatedinSection 12.3; 

{H) Require that .each Subparticipant with which the Participant 

enters into a f>articipant-Subparticipant Agreement report.any 

TEfCASecurity lnddent experienced byor reported tothe 

$ubpartlcipanttothe Partidpantandto the subpatticipant'.s 

Oownstream.$obpartjcipat1ts in accordance:withthetimingand 

contentreqμirements stated in.Section 1ii~; 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76817 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.054</GPH>

(iii) Require that each Subparticipant with which the Participant 

enters into a Participant-S11bparticipant Agreement require that 

its QownstreamSubparticipatJis report any TEFcii.Securify 

Incident experienced bye>r reported to the Downstream 

Subpartidpant to the Upstream Stibpartic,pantandto lts own 

OoWnstream Subparticipants, in accordance With thetirtlingand 

content requirements stated in section 12.3~ 

(iv) Notify Signatory of.any TEFCA.Security Incident reportedt.o the 

Participant by one ofits Subparticipants; 

123.3, Compliance with Notification Under Applicable law. Nothing in this Section 

1.2,3 shall bedeemedto modify or replace any breach riotification 

requirements.thatSignatory may have under the HlPAA Rules~ the FTC 

Rule, and/or other Applicable law, Tl:) the extehtSigt)at()ry is already 

rE!'quired by Applicable law to notify it Partidpaht, SubpartJcip!'lnt, and/or 

another Q.HtN ofan ihcideht that would also be.a TEFCA Security lhddent; 

this section does not require duplicative notification. 

13. General Obligations 

13;1.. Compliance with Applicable law and the Framework Agreements (Required Flow~ 

Down). Signatory shall comply with all Applicable law and shalHmplement and act 

in accordance with .any provision requ·ired by this Common Agreement, includihgall 

applicable SOPsand provisions ofthe QTF, 

13.2, Compliance with Specific Obligations. 

13..2, 1 Responsibility of the RCE. The RCE shall. be respohSible for taking reas<>nable 

steps to confirm that Signatory is abiding by the obligations under this 

common Agreement and all applicable SOPs, In.the evehtthatthe RCE 

becomes aware ofa material non-compliance with any of the obligatiOhS 

stated in the Common Agreement or any ofthe appficable SOPs by Signatory, 

then the RCE shall promptly notify Signatory in writing. Such notice shall 

inform Signatory that its failure to correct any such deficiencies within the 

timeframe established by the RCEshall constitute a material breach of this 

Common Agreemeht, which may result in termination ofthis Common 

Agreement. 

45 
76818 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.055</GPH>

13.2.2 ResponsibilityofSignatory (Required Flow•Do.wnl. Signatory shall be 

responsible for taking reasonable steps to confirm that all ofits Participants 

areabi<Jtngt>y the ~e.quire<J Flow~oowns a.nd all ;:ipplic:ableSOPs'. ln:the 

eventthat Sigrraic?ry bet(?me$ a.wanrof arnateriaf l'lQll.;tompliance by one of 

itsJ>,:ntit;Ipants, ttlen $fgnati:iry shall pri:irnpt1y \'l()til'y the f>ardcipantih 

writing. such riotit.eshall ir:iform the Partidpantthat ibfailute to correct any 

.such deficiencies Within the timefrttme establisheiJ by signatory shall 

t6nstitutea matetialbreach ofthe Partitipant-QHIN.Agteernent,·which may 

result in eaif.ytetminatiOhofsaitlagreement. 

l3i3; Flow.:Down Rights.to.Suspend (Required Flow•Downsl 

13.3.1. Sus.pension Rights Granted to RCE. Each Partidpant-'.QHINAgreement;, 

Partic;ipant-Subpc1rticipant}\greement,and Downstream Subpartic:iParrt 

Agreementshall inclt1de a graTlt ofauthorfty toth.e R¢ito suspend each 

party's r!ghtto engagelhany QHIN~to.;QfON exchange ac.ti\llties if: (l}there 

is an aileged vlolation ofsuch agreement or ofApplical:ile Law by the 

party/partles;Of).there.is·acogoizabhn~teatt~the securlty.·ofthe 

infotmationthanhe RCEreasonably believes is Tl transmitted Pllrstlantto 

stic:h agreementor to the infrastructuteottheQlilN; or(iii).suc:h 

suspension is in the. intergts otnat1ona1 secutityas directed byal'iagency 

of'th.e un.ited.States government. 

13.3.2, Suspension Rights Granted toSignatory. Each oflhe aforementioned 

Framework Agreements shall afso,grant.Signatorythe same authority.as 

the RCEto suspend a party's righttg engage in any activities under the 

FfameworkAgreementifar1yoft!lecirc;umstances described ih subsections 

13.3,l (lHHi) above occurw-ith respectto any Participantand/oJ 

subpatticip.ant otslgnatorv, 

(il Signatory may exercise suihrightto suspend based on its own 

determination that any of the titcomstances described in 

subsections 13.3.l{i}(ijj) aboveoccotred With respectto any 

Participant and/or Subparticipant of Signatory. 

(Hl Signatory mustexercisesuch right:to:suspendifdirectedto doso 

bY the RCE based on the ~CEs determination:thatsuspen~ion is 

warranted based on any ofthe cifcurnstances described in 

sub~ections 13.3.l (tf-(lli)abovewith respect tt, any Partidpant 

andjor·•Sobpart1dpant•.ofSrgnatory, .. 1f·thesuspen$lon ofany 

Partkipant and/6r SubparticipantofSignatory ifatthedirection 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76819 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.056</GPH>

of the RCE,Signatory must effectuate such suspension as soon as 

practicableand not longer than within twenty.four (24) hours of 

the RCE having directed thesusperislot1,μnle!.sthe RCEspecifi~ a 

lprnter perind oflime lsp~rfiiitt~lQ effectuatethe sμspensiott. 

13 •. 4. Survivalfor Parti'cipantsand Subpartidpants'.(ltequiredFieiw~oowns), t:hef0Howir1g 

are the minitnum sut\11val ptQvisiOn!. andre!.pective minimtrm time p.etilidS.thatshall 

be ilidudedir1e11:hofthe.Fram!iiworkAgteeme11ts otherthan this.comrno.n 

Agreement.. s,gnatoryshall ihtludeat leastthefcdlowihg survival provisions 10 all of 

its Partitipant.:QHIN Agreements artd shall reqUir-e its Participants to include the 

following minimumsurvival provisions,and minimum survival time p.ertods in all their 

Partidj>ant•SubparticipantAgreementsas Required Flow•Downsso that such 

provisions willalso,be included as minimum survival provisions and minimum 

survilfilltirne periods in all DownstreamSubpc1rtidp.rntAgreeme11ts. 

i3)hi, $:ed:ion 1,i. tonfidentiaJ infbtn,atibri; shall survivefQt a period tilslx ('Ii) 

year5followlr1g theexpiratiorior termlnatiorroftheapplicable Framework 

Agreemertt, 

13.4.2. Section 10.6, survival tor: IAS Providers.,to theextentthanhe Participantor 

SUbparticipant isa:n rAs Providet~shall survhre folloWihgtheexpirationot 

tertnihation.of the applicable Framework p.greemeritforthe respectilte 

time periods set forth in Section 10.6. 

13.4.3, Sed:ion 111 Privacy, tothe extent that the Participant or Subpartfdpanfls 

SL!bjectto Sectlo111l, saidS~tion shallsurvivethe expiration qr 

termina1:ionofthe:applkal:>1e Framework Agreement untilthe expiration of 

the tlrneperiod specified in thedefinltio11 of PHI at45CFR§. fli0,109. under 

Subsection ~(iv) ofsuchrlefirtlt:i6n., i.e,, fifty{SO) years afterthe death of 

the lrtdlvidu<1ho Whom the fofotmation covered by Sectiort fl relates. 

13.4.4. Section 12.1..4, .. Participants.artdSubpaiticiparits, to the extent t:hat the 

Patticiparttotsubparticipant iBubJecttQSec:tiort 12.1.4, said S'Eictior1.shall 

surVive0the expiration ortermination•oftheapplicable Framework 

Agreement until the expiration .. ofthe time period specified in.the definition 

of PHI at 45 CFK§ 160,103 under Subsection2(iv) ofsuch definition,te., 

fifty (SO)years ij~er tlle death o,H~e lndividuaJtowhom theinformati.on 

covered by Section12,fA relates, 
76820 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.057</GPH>

13.4.5. The requirementsofSection12.3.2, Vertical Reporting of TEFCASecurity 

lnclctentls),.shall survive fur a period ofsix {6) years fullowlngthe 

explratignor teT1T1inati9n <>fth~ !'IPPli<:able FtamewprkAgree!'l'lent, 

:i:4;1. fransoaret1cV-c•Accessto Partkipant-ClHtN lnfurmatlon. 1f ~itlier ONCottlie•'.Rci: has 

a reasonable basis to believe that one or more of the·foliowing sitUatiOos exist with 

respecttt>.Stgnatory,thensrgrtatoryshall makeavailabte, qpon Writtenrequest; 

copies of its Partidpant~QH.IN Agreements and infQrmattoi'l relating to the. e)(Chahge. 

of Tl andthe circumstances giving rise to the basis,for such request. The foregoing 

shall be subject to Signatory's right to restrict or condition Its cooperation or 

disclosure of information in the interest of preserving privileges but only tothe 

extenqhatsuch i11furmationis material tothe tlefense.of a slibsta.nUat!!d c:laim 

asserted bya third party. Such situatio11sTnclude: (i)•anaJlegedviolation olthis 

Common Agreement or>\pplic:ablelaw; or(ir) a thre:atto thesecurity c>flnformadon 

thatthf RC:E oroNC teasonably believes ~ fl transmitted pursuanttothe 

Framework Agteements:or tothelnftasttuctute.supporting Ql-llN-to~b.HlN exchange. 

The right ofSignatoryto restrict orconditionitscoo:peration orifisdosureof its: 

Parth::ipaht0QHINAgreement(s)ahd ihfonnatiOh relatihgtathe exihange of'TUhthe 

interest Ofpreserving pr'Mleges shall riotapplytoa distlosut:e that is. requested in. 

the interest of natiOhalsecority. 

14;1~ Compliance with Standard Operating.Procedures. The RCE shall adopt Standard 

Operating Proc.edures (SOPs) to provide detailed guidance on specific aspectsofthe 

excllange.activities under this Common Agreement that are bi11ding on the BCE, 

Signatory and, as:appUcabfe, Partkipants and Subparticlp.tnts,. theSOPS anI 

rntorporated by reference into this Common Agreement, and Signatory shall c~mply 

with all $0Ps thatare applicable to it and shall teqoire that its Panidpants a:ndtheir 

subpartldpants.agree inwritihgtn c.Omplywithallapplitable SOPs. If Signatory or 

its Partil::ipants:orSubparticipants fail to comJ)lywith any ai,plicable SQP, the RtE 

may take tortectiVe action, whichWillJnclode• requiring steps tobtir1gthe 

organization into compliance with the SOPahd may intlode reqoirihgSigna:toryto 

suspend the ability. ofa Partidpantor SubparticipanHo exchange information under 

the Framework Agreement(sl until the non-compliance is corrected to the 

satisfaction ofthe RCE,. suspending Signatory's righHo: exchange information under 

the CommonAgree~nt or Signatory may have its rightto exchange information 

under·the<ComrnotlAgreementterminatedor·be·required toe11sur~ thetermi11atio11 

ofits Participant's or aSubpartkipant's tighttoeiechangeir1formationunderone of 

the other Framework Agreements. RCE shal}adoptan SOP that provides detaite:d 

infotrnaticmabout sanctions.for n<>rt-tt,rnplfancewith an SOP. NgthfrigJn·this.Section 

48 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76821 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.058</GPH>

14.2 ofthis,.Common Agreement limits the. RCE's rights.toterminate.this Common 

AgreementunderSection 16.3'.2or 16';3'.3ofthis Common Agreement. 

14.3~ Incorporation ofRequited Ffow,Downs in Framewgrk:Agreement:s, lri.addltiorlt:o the 

Q1:!ligatic:msqf,S.igm1:torywith res:pectto i~ Participa11ts stated throughout ih thi's 

C0l'i'lh'\0'fl Agreement: 

!il Signatory shall 1:te responsible fur ihcOrpofatingthe Reqrnreil FIOW0Downs 

into all Participant-QHIN Agteements, 

(ii} Signatory shall requirefhateach of its Partidpanfs.be responsible for 

incorporatingthe Required Flow-Downs into.all Participant• 

SllbparticipantAgreements. 

{iii} Signatory shall further require that each qflts f>artldpants he responsible 

tor requiringthat eachoftheir subpartidpahtsincorporat-e the R~qufred 

Flow-Downs into all Downstream SubpartkipantAgre-ements; ff any, 

14;4: tompiiancewitli theQ,f;llNTed1nltal·•i:ram·ework; sighatorvshaltmeett:he 

requirements ofthethen-applicable QTF. Signatory is required to cornpiVWitli ahY 

updates. to the. QTF bythe applicable date established by the RCE and approved by 

ONC 

1S~ DlsputeResofution 

1$1. Acknowledgementand ConsenHo Dispute Resolution Process. Signatory 

ackoo.wledges that it may be .in its bestinterestto r!'lsolveOisputes ~elatedt:othe 

€()mm on Agreement through a coflaborative}cqllegial process rather thanJhrough 

ch,il litigation, Signatory has reachedth~condusion based.Upon thefacuhat the 

legal.and fam1a( issuesrelatedto the exchange and related activities under the 

Common Agreement are unique, nover,.and complex, and limited caselaw'exlsts 

thataddressesthe legal issues that could aris~Hnconnec:tion with this C6mmon 

Agreement. Therefote,.Signatotyshall submit Disputes tothe RCEto be addressed 

bythenon.,binding Dispute resolution process·setforth in.an'SO.P(the "Dispute 

Resolution Process"). Notwithstanding, Signatory understands thatthe Dispute 

Resolution Process-does- notsupersede-orreplace any oversight,, investigatoryj 

enforcement, or other administrative actions or processes that may betaken bythe 

relevant .. authodty,vvhether or not arising qufofor relc1tedtothe circumstances 

givihgriseto the Dispute, RCE andSignatoryare committed to prompdyandtalr:ly 

resolving bisputes. 
76822 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.059</GPH>

To·that.end, Signatory shall use its besteffortsto resolve Disputes that may 

arise with otherQHINs, their respective Participants, or the RCE.through informal 

discussions before see~ingto invo~eJhe Dispute ~ei;oh:.itioll Process., lftheOispute 

tannotberesohled thr9ugh co:operation betwe~n Sign1:ftory and the other QJI ll'J(s}; 

Signawrv rtllJY, on its own behalf oro.n. behaWofits Partitit1ant($t cht)t;>setq submit 

the ()isputeto the DisputeResolutiorLProtess, Ukev.rise,Signatory} on its own 

behatfa:ridon behalf.ofits Participant(s),wili seektoresolve DillPUtes tnvoh,ingthe 

RCE tlm:11.Jgh.good-faith infotmaldistussioosw.rththe RCE ptiOt to ihvoklngthe 

Dispute Resolutfo:n Process, 

Under no circumstances will the Dispute Resolution Processglve the RCE any 

power to assess,monetary damages againstany party to the Dispute Resolution 

Process including, without limitation,:Signatory or its Participants or any.other Q,HIN 

orits Participants. Except iri acGordc1nce v,,ithSection 15.i, ifSignatoryrefus~sto 

participate Jr, the Dispute Resol4tion Processc; such refusal shaHconstitutea ll1ateric1I 

breachofthis CommO'n Agreernentandmaybe groundsfortermfnationof 

.si'gMtory'spartiCipation i!'l UHll'HO·UHINexchange. 

15.2.1. NotwtthstandihgSettion 1s.1,SighatorVshalf berenevedofits obligation 

to participate ih the Dispute Resolution ProcessifSighatory: (i) makes a 

goodfaithdeterminationthat is basedupon available Information or other 

evidence.thatanother. Q,HIN's•or·its Participants' acts or omissions will 

cause irreparable harmfo Signatory or another organization or person 

(e.g,, another QfllN or its Particip~nt or an lndividual}tand fii}pursues 

immediateinjunctive relief against suchQ.lflN orlts Part1cipantin.a:courtof 

'Competent Jurisdictio11 in accordance wit:hSection 18.3. Signaforymust 

inform RtE of such actionwithintwo (2.)buslness daysoffilingfor the 

injunctive reHehnd ofthe resultoftheaction wlthintweht\f"foUr (24) 

hours ofa court of cornpetentjurisdfotion granting or denying in1unctiVe 

relief; 

15.2.2, lfthelnjumitive reliefsought in Section15,2.1 is notgrantedand Signatory 

chooses to pursue the Dispute, the Dispute must be submitted to the 

Dispute Resolution Process inaccordancewith Section15.1. 

15;3, Activities during Dispute Resolution Pro:cess,Th~ p.endency·ofa Dispute under this 

Common Agreement has no effect on eitherParty's obligations hereunder; unless 

Signatoryterrni11ates its ctghtsln accorda·nce with Sec:tion. 16.2 or 16.3.1 or is 

suspended in actotdancewith S«tionl6)t2, 

50 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76823 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.060</GPH>

15.4. Implementation of Agreed Upon Resolution. If, at any point duringthe Dispute 

flesol.ution Process, Signatory and all other parties to the Disputt;? a:ccept a proposed 

r1;!$Qlution of the Dispute; ?ignatory and R€E each agret;? to implemeT1t the terms of 

the resolution within the agreeclsupontimeframe to the e'.!{tent applicable to each of 

·them~ 

15.5. ReservafiOJlOf Rights. If, toilowingthe completion of the Dispute Resolution Process, 

in the opinion of.Signatory, the Dispute Resolution Process failedto adequately 

resolve the Dispute,.Signatorymay.pursueanyremedies available.to it in a com:tof 

competent jurisdiction in accordance with Section 18.3. 

15,6; Escalation and Reporting of Disputes to ONC. 

15.6.1. Escalation of Certain Disputes to ONC. Except for RCE suspension or 

termination decisions subject to Section 16 c>f this Cornmqn Agreement, if 

Signatory has reas.M.to believe that: (i) the RCE is acti0gin adiscrlminatory 

maMeror in violation of the RCE's conflict of interest policies; or (ii)the 

RCE hasnotactedJn accordance with its obligations stated in this Common 

Agreement, then Signatory sha:il have the right, on its.own behalfand on 

behalf of its Participants, to make a corn plaint to ONC. The complaintshall 

identify the parties to the Dispute, a description Of the Dlspute;a summary 

of each party's position on the issues included in the Dispute, the final 

disposition of the Dispute, and the basis for the RCE's alleged misconduct 

The RCE and Signatory shall each also promptly provide such.additional 

information as may be reasonably requested by ONC inorder to consider 

and resolve the issues raised for review. Sincethis complaint may include 

PHI and may include Confrderitiallnfurmation; the RCE wjll work with QJIJC 

to develop mechanisms to protect the confidentia1ityofthis information. 

Such protective med,anisms and the ptocessfor escalatlnga tompfaint to 

ONC are settorth in an SOP, 

15.6.2. Reportlng ofAnOr:iymized Dispute Information.to ONC.As partofthe RCE's 

communications.with ONC, within fifteen (15) business days after the end 

of each.calendar quarter, the RCE reports the following information 

relatlngto each Dispute that has been submitted through the Dispute 

Resolution Process in ananonyrniz.ed format to ONC: (i) identification of 

whether the parties to the Dispute are QHIN(s).only, or whether the 

Dispute also involves Participantfs);(ii) a description of the Dispute with 

reasonable specificity; and (iiiJthe final disposition ofthe Dispute. 

si 
76824 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.061</GPH>

16 . .Appeals to.ONC 

16.L Signatoryrm1y appeal the following decisions of the RCE tq 01\JC: 

(i) Suspcensionc>fa.Signatoryor S1,1spensioh ofaSignatbry!s Participant or 

subparticipaht; and 

(ii) Termiriation ofa Signatory's common Agreement by the RCE. 

16.2, ONCahticipates publishing regulations to addressthe.appe.als of arif ofthe RCE'.s 

decisions listed in Section 16.1. ONC anticipates issuing sub-regulatory guidance to 

address thoseappeals while formulating regulations . .Unti.1 ON C's regulations 

governing those appeals are finalized and effective,thesub-regulatory guidance 

QNCJssuesshaJI be binding under this CommoriAgr.ee111ent. 

i'i.StablltiyoftheQHlN Network 

1%1. Term, this common Agteemehtshalltommence orrthe Effective Date and shall 

remain in effect until ltJs terminated by either Party iii ac:tor:dance with the terms of 

this common Agreement. 

11;2~ Withdrawal and Termination Piforto QHIN Designation; 

17.2.1. By Signatory, Signatory may withdraw from Onboardihg.and terminate this 

CommonAgreementat any time before itis Designated if it determines 

thatitcarinot meet the requirements of being.a QHINor if!tchooses riot to 

conHnuet<> seekstafos as a QHll'J. Signatory must provide,at leasi:flfteen 

(15) calendardays'Writtennotice to RCE of its intention to withdrawfro111 

Ohboardingand terminate this Cqmmnn Agreement 

11.2.2. By the RCE. If SignatotyfailsJo compfote the 6nhoardingFeqUiremeots 

within the titneframe spt:!tffied irrthe On boarding& Designation SOP, the 

RCE may withdraw Signatory from Onboarding and terminate this Common 

Agreementupon fifteen {15} calendar da.ys' written notice toSignatorythat 

Signatory has faHed,to meet the Onboarding requirements and, therefore, 

cannot be Designated. The foregoing shall not be. interpreted as precluding 

Signatory fromreapplying for Designation ata future time, 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76825 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.062</GPH>

17.3.1. Termination by Signatory.Signatory may terminate this Common 

Agreement atany time without cause by providing ninety (!39)days' prior 

written notice to RtE. Signatory may also tt':!rrninatE! fon:aus.eifthe RCE 

commits a material breach pfthe Common Agreement; and the RtE fails to 

tare its material breach within thirty {30) days of Signatory providing 

written notke to RCE ofthe material btea.ch; pto.vided, however, that if 

RCE is dlligentiy working to cureJts. matetlalbreach at the end of thisthirty-

(3~) day period, then Signatory mustproVide the RCE With up to another 

thirty {30) daystotompletec its cute. 

17.3.2. Termination by the RCE. RCEmay notterminate this common Agreement 

.Without.c;ause as described inthisSection 16.3.2 or Section.16.3.3 ofthis 

CommonAgreement. RCE may terminate this COmrnonAgreernentwith 

immediate. effect by giving notice to.Signatory if, (i) Signatory is in. material 

breach ofanyofthe terms and conditions of this Common Agreement and 

fails to remedy such breach within thirty (30)days aftetrecelvingnotice of 

such breach; provided; however, that if Signatory is diligently working to 

cure its material breach at the end of this thirty- (3~) day period, then RCE 

must provide Signatory With up to arrotherthitty (30) days to complete its 

cure; ot (ii) Signatory breaches a material provision ofthis Common 

Agreementwhere such breach is not capable of remedy. 

17.3.3. Termination by RCEifthe RCE Ceases fo be Funded. The Parties 

acknowledge thatthe RCE's activities under this Common Agreement are 

supported by ONC funding. tfthis funding ceases, there a.re no guarantees 

that the RCE will ccmtinue unless a financial sustainability model has been 

put in place. lffederal funding ceases, or ifl:he available funding is not 

sufficient to pJ6vide the necessaryfundfngt6 supp6rt opetatron ofthe RCE 

and there istm,successor RCE;.. then the RCE may terminate this common 

Agreement by pr6Viding one hundred and eighty (180) clays' prfor wtitteh 

notice to Signatory. 

17.3.4. Termination by Mutual Agreement The Parties may terminate this 

Common Agreement at any time and for any reason by mutual,wriften 

agreement. 

17.3.5. Effect of Termination of the. Common Agreement 

{il Up.on termination of this ComrnonAgreementfor any reason, RCEshall 

promptly remove Signatory and its Partl!;ipants and Sub participants from 

53 
76826 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.063</GPH>

the RCE Directory Service and .any. other lists of QHINsthat RCE 

mainta'ins. 

M lJpQn terrni.hatiiln Qft:his CommoriAgreernent f9ranyreasQh., Signatc,ry 

shall; Withoutun(Jue •delaY/(~l retne>ye:affteferencii!sthat1dent1fy itas a 

QHINftoma11.media1 ahd.(b) cease:al(use:Qtarwmatetial, intfu(Jingbut 

notlirrifte:cJ tOJitaduct mant.1ats, marketingliterature, and web content 

that identifies itas a QHIN. Within t'1Vehty (2Qt business days of 

termination of this CommonAttreement,.Si:gnatory shall confirm to RCE, 

ih Wl'iting~ that it has complied with<this Subsection. 

(lii)Tothe extent Signatory stores Tl, such TI may not be distinguishable from 

other information maintained by Signatory. When the.Tris not 

distinguishable.from otherlnforrnation;it is not pc,ssibleforSJ:gn~toryto 

r:eturn or dest:royTIJt maintains upon termination or explrafion e>fthts 

Common Agreement. Upon terminatkm or e)(JliraHon oft:his Common 

)\greeme.nt;ifSt:gnatoryis sl.!bje:cttt:iSettion i:tofthis Common 

)\greement,such sections. shaffcontlnueto applyso longasthe 

informatiortwould bee:PHI ifmaintalMdbya t:overedEntltyor Busfr1ess 

Ass◊ciate: The: prOtl!ctions required undenhe HIPAA se:curity Rule shalt 

alsotontlhUe toapplytoall Tl that is'ePHl,regardtess otwhether 

Signatory is a co11ered Entitljor Business Associate; 

flv)ln.no eventshall Signatory be entitledfo any refund of any fees t:hafit 

has paid the RCE prior totermination. 

17.4.1. Su'Spenslon by RCE,. ~CE maysuspendSignatoty!s .ahllityto engage in 

exchange.a.cti.vltiesunder the Common Agreement.lf RCE determines, 

following completron ◊fa prl:!liminary investigatiort, thadignatoryis 

responsibteforaThreat Condition. To the extennhat RCE detettninescthat 

one.ofSignat6r'(s Participants•.otsubparticip.ants haSdone something or 

failedtodosomething:thatresultsin.aThr:eat Condition, RCE may suspend, 

or the RCE may direct that Signatory suspend, that Participant's or 

Subparticipant's ability to engage In exchange activities under the Common 

Agreement. RCE will m.c1ke a reasonable.effort to 11otifySignatory in 

advarrceof RtE~s inten.t tosuspendSig11atoryor one ofSignatory's 

Partidpants or Subpart:icipants, indudingnotice i;if the threat Condition 

giyjngrlsetosuchsuspension, tfadvanceh'Qtke is not·reas<'.>nably 

practieabfe under. the:clrcumsta!'ices, thi:r RCE Will nqtify Signatoryof the 

54 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76827 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.064</GPH>

suspension, andthe Threat Condition.giving rise.thereto, as soon as 

practicable followingthesuspension. Upon suspension ofeitherSignatory 

or pne ofSignatory's .f>articipants ()r $ubpartidpants; RtEwillworl< 

1:1;>llaborativelywithSig11atoryi;c; re5Qi1teihe ,ssueleadihgtl;:! ttte 

suspensibf'i; .RCfshaO aclopta11·~qp toaddreSS$petiflt::irequlrements al'ld 

tiri'\'eiihes related tosuspension, 

17.4.2. :selectivesus:pension by Signati::fry. Signatory mav~ln good faith and to the 

extent permitted by Applicable taw, deterli'iihethatitmust suspend 

exthangihgWith anothefQHINWith which it rsothetwiserequired to 

exchange in accordance with an SOP because of reasonable and legitih'late 

concerns• related to the privacy and security of information that is 

exchanged .. lfSignatory makes.this determination, it is required to 

pi::ornptly notify the ft.CE and t~e ctH!N that.Signatory is 5uspe11dingofits 

decision and the reason(s}for makingthe decision,. lfSignat:ory makes the 

decislon to 1msp.e11d, it is required; within thfrt;y (30) days,Ao iniHate the: 

Disputeflesolut,011 Process in order to resolvewhateverlssues led to the 

dedsro11 to suspend, or end lts:ruspensiorrand resume exchanging with the 

otherQHIN. Providedthat.Slgnatory selectively sus11ends exchanging with 

another QHIN in atcotdancewrththis section and in.accc>rdante With 

Applicable Law,suchselettive suspension shall hc>t be deemed a violation 

of SettiOri 6,2.2. 

11,4.3. Additional Suspension Rights of RCE. Notwithstandlnganythingtothe 

contrary set forth herein, the RCE retains the.rightto,suspend any 

ex.changeacthtity under the C'Qrnrnon .. Agreement(i) upon ten (10) days' 

prihrl1otice ihhe lt(:fdeterminesthatSignaforyhas create<:! a sJ'l:uat:ihn In 

whic~Jhe RC:fmaysuffermaier1al.hat:m•andsuspensionis '1:heo11ly 

reasonable step ~hatthe RCEcan taket() profi!ctitseif; or(nJ immediately if 

the RCE.determines that the safety or security ofany perso.n or the privacy 

or secutityofrtand/or Coitfidential Information is threatened. ln the case 

c>f ah irrtmediate suspension under this section, th'!! RCEWUI provide nottce 

as soon aspracticablefollowing thesuspensibh. 

17.4.4. Effect ofSuspension. The suspension of Signatory's.ability to. participate in 

any activity under this Common Agre.ement pursuantto this section has no 

effectonSignatory's otherobligations hereunder, including, without 

limitatioll,obligations with respectto privacy and securjty, Durlngarw 

SU$pension pursuant to:thls section, Signatory's inabllifyto ex.change 

infc>nnationundenhis common Agreement or comply with thc>se terms: of 

this common Agreementthattequke information exchange shall not be 

55 
76828 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.065</GPH>

deemed a breach ofthis Common Agreement. In the .event ofsusp.ension 

of Signatory's.ability to participateln exchange activities.under this 

ComrnqnP,greern,eot, Signat9rys.ha!I i:omrnunrcate to its Partidpants1 an.d 

requlr¢thatthey cornrnunicatetlltheirSubparticipan'r.>, that an QHIN~t<>-

.Q.HIN exchange<>n behalf of Signatorts Participtjnf$ andSU~particil)ili')~ 

will also be sμspendedduringanyperlQd ofSignatory's suspension, 

ms~ su¢tessbtRCEand Transition. 

18.Fees 

17.5 . .1. selection llfRCE.arid successor RCEM ahdContirii:iirig Obligations. 

Signatory agreesthatONC had the right to select the initial RCEand that 

ONC shallhave the righttoselectany successor RCEand/orto act as an 

interim RCE untiLsuchsuccessor RCE has beenselected .. Signatoryfurther 

agreesto 11119t~c9oper:ativeJywiththet:tCE aJ1d anyinterirnor successor 

RCE selected b.y ONC:lnac.cordance withthtsCpmmo11 Agreement. 

Addi1:fonahy~ Signatl:>ryshall continue 1:0Jibide by the provis1onsqfthi~ 

Common Agreernentduringthe transitiontq any interfrn ot succe!;.sor RC;E, 

ii. s.2. RCE Transitibn setviees, lri tlie evennhat ONC selects a. successor RCE, the 

then-current RCEwill berequired tocontinuesuppOrtingfunttions 

throughouta>riinet'f .(90-).daydoseout period. lfONc.actsas an interim 

RCE prior tothe appointment1>fa successor RCE>the references to 

successor RCE shall apply to ONC as the interim RCE. 

.18A, Fees l'aidbyOHINs fo the RCE, Signa~Qt:Y shall pay the fees setfortfro11 Sihedule1 

attached hereto (the "QHlN Fees"); RCE shalnnvofoe,Signafor,yf<>t all Feestn 

ac:cordat)ce 11111th Schedule i. Unless otherwise setforth in.Schedule 1; invokes shall 

be due and payable by Signatory within sbtty (601 days i:lfterteceipt thereof unless 

Sl~atory notin~ RCE ih\,\trlting that it is c~ntesting the accuracy ctf thel~~oke and 

identifiesthe speeifictnaccuracies that itasserts, QHIN Fees contested under this 

section shall be resolvedbetween.Signato,yandRCE as stated in the appli.cable SOP. 

Other than with regard to invoiced amounts thatare contested in'.good faith, any 

:collection costs, attorneys' fees or other expenses reasonably incurred by RCE in 

collecting amounts due under this Common. Agreement are the responsibility of 

Signatory, If Signatoryfailsto pay any undisputed Q.1-1.11\1 Fees when due hereunder, 

~CE has the rrght:to suspend Signatory's ahiJityfo partidpatefoany exchange 

activity 11nder thts Common:Agreement PtiQr tQ takinganyadion: against Signatory 

fornon-payrnent, indu~rngsuspension; R:CE shall provideSfgnatQryten (to) days.> 

prior written htitipe, JfSignatQtY makes payrnentw.ithhtten (10) days Qf receiving 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76829 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.066</GPH>

written notice, RCE will notsuspend Signatorts.abilityto participate: in any 

exchange activity under this Common Agreement. lfSignatoryfails to make 

pa.ymentwithinten (10) dc:1ys 9f receh,ing 11otice, the11 the RCE r:nc:1y ir:nplell1e11t the 

suspens,ortor m1,1yterrni11ate Signatgry!s.abilifyto participate in any excha11ge 

activity onti¢t this (:()mmpn,Agreemimt. 

Ut:i.i. changes to UHIN Fees·, Schedule i may be updated bythe,RCEfrom timet~-tirrie inrelation tQOperatiOnal c~sts, availability ofONCf(lrtding" and 

Qther marketfactotsin order to ensure the sustainability df the activities 

c6hducted uhderthe Ftarnework Agreements. lri light<>ftheforegoih!t 

changes to-Schedule 1 are not subjectfothe change management .process 

setforth in Sections; The RC£ shall provideSignatorynotless .. than .ninety 

(90) days' advance written noticeofany adjustments to the QHIN Fees set 

forth in Schedule l, 

18.2., Fees'Pah:lby@1Ns to other qHINs, Signatory is prohibited from charging fees to, 

other Q.HI Ns for any exchange of information Usirigthe Connectivity Servic~s. 

19:1. Ailthoritv,to Execute. SighatorYwartantsahd represents that it has the full power 

and authorJty to executethis common Agreement ahd that any representative of 

Signatory who executes this Common Agreement has fultpower and authority to:do 

soon behalf of Signatory. 

1§ .. '2.. Notices,.AU notfces to be made under this Comll1011 Agreel'l'lenl:stial I be given in 

writing to Signatory andRCE c1t tile addresses set forth folloWihgeachJ:>arfy'.s 

:signature,and shaffbe deemed given: (i) uppn delivery, ifpersonaHy delivered; (ii) 

up<>n delivery by overnight delivery service such as UPS tir FE DEX or another 

rec()golzed cornrnetdal c::artler: {iii) upon the date:Jndicated on the tetmn receipt, 

when sent by the lJhited States P6stal Service Certified Man, return receipt 

requested; and (iV)lf byfacslmile:telecommunitatit1n ,o:r othettotm ot'et.ec:trOnit 

transmlssion, 1.1poh teceiptwheh thesendingfacsimile machine or electro.niflhail 

address receives confirmation oheceipt bythe.receMng facsimile machine or 

electronic mail address. 

SIGNATORY~-------------

Name/Title: 
76830 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.067</GPH>

Address: 

Facsimile: 

tHESEQOOIAPROJECT; INC. 

NOtlCEtO: 

Name/title: 

Address; 

Facsimile: 

E-mail: 

19.3, Governing Law, Forum, and Jurisdiction. 

19.3.1. Conflicts of Law and Governing Law. In the event of a Dispute between 

Signatory and the RCE, the applicable federal and state conflicts of law 

provisions that govern the operations ofthe Parties shall determine 

governing law. 

19.3.:t Jurisdictionanrl Venue. The RCE, currently. aVirginia non-profit 

corporation,and Signatory each hereby subm1tsto ttie exclusive 

Jurisdiction ofanystate orfederal court sitting in the Commonwealth of 

Virginia within twenty0five (25) miles of Alexandria, Virginia in any legal 

proceedingarisingoutofor relating to this Common Agreement unless 

58 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76831 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.068</GPH>

otherwise required by Applicable law. The. RCEand Signatory each agrees 

that all claims and matters arising out ofthis Common Agreement may be 

tieard and deten:ninec! insucl:i court, arTdeach Party hereby 'A/<1ives any 

righttq obl~tJo suchfifing cm grounds ofi11mroper venue;,ft!rf.//Jl nan.-

c¢nvenil{ns, Pri:itht!t venue:"telated groands, 

Ht3.3, Participantand .subpatticipant.Agreements,. Fortheavotdanceofdoubt; 

Signatory's Participant•QHIN.Agreements, andthe Participant's PartictpahtSilbpartldparn Agteemertts/as well as any Downstream Subpartitipant 

Agreements, shall besubJect tMhe governing law,torum, andJtitisdic:titin 

provisionsofthoseagreements. 

19.3.4. Sovereign Immunity, No prnvisionwithinthis.Common Agreement many 

way coni.titutes a waiver bytl:ie United StatesD!:!partl1lentof}lea~th.a11c! 

Hurna11Ser:vlces or: any ()ther part ofthe federal governrnentohovereigo 

immuhityor any other.applfoabtelmmunify from sui't orfrorn lic1bUity fllat 

the United States Department of' Health atid Human services orather part 

C)f the fec!eral government may have by operation oflaw: 

19:4, Assignment .. Noneott:his contmonAgteement,induding but notfimited toanYof 

the rights crl'!ated by this common Agreement) can be transferred by.either Party~ 

whether: by assignment, mergert other operation of laW, change ofconttolofthe 

Party or otherwise, withoutthe prior written approval oftheother Party. 

Notwithstanding theforegoing, if ONC selects another organization to serve as the 

RCE, then RCE shaH assignthis Common Agreement to.the successorRCE.or an 

interim RCE as directed by 01\IC,.Slgnatory understands and agrees that no interll'll'Or 

successor ~<:tshall haveanypbligatron or liability fur any act e>romissloncfthe 

Sequoia ProjectJn connectio.n with this Common Agreement oranyc/f'theother 

Framework Agreements:priorto· the termination of The Sequoia 'P(l:)je¢t'sstatusas 

theRCE. 

19.s. Fotce Maleute. Neither Party shaff be responsihlefor any•,fei~vs or-failures in 

performanc.e.caasedbythe occurrence of•eventsor other<iitcumstancesthatate 

beyond its.reasonable control after the exercise ofcommercially reasonable efforts 

to.either prevent.or mitigate the effect of any such occurrence or event. 

19:6\ Severability, lfany provisiort:ofthis Commc)ll Agreernentshall be adjudged by a11y 

oourt·of cornp.etentjurrsqictionto be urvmfOrceableor·•invalid,thatprovision shall 

be modified to the minimum extentnetessatyto atl:ileveJhe purpose ot1gil')ally 

fntended; ffppssible, and the remaining provisions ohhis ¢ommon Agreement shall 

rerrraih in full fotte am:I effect and eriforceable, lfiS~th provish:m tan®t be modified 
76832 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.069</GPH>

to achieve the purposeoriginaUy intended, it shall be.severed from the agreement 

and the remaining provisions ofthis Common Agreement shall remaininfullforce 

and effect and enforceable, 

1~.7, Coo11terparts, This <;:Qlilmon Agreementmaybeexecuted in one Qr mgre 

cou11terparts, each ofwhlch shall be tt!nsicleredan original tou1tt:erpa11,tmd shalf 

beeome<a btrtdingagr:ee-rrrentwhert each Pattyshall tuive executedtJne cQi,Jnterpatt. 

19,8; Captions, captions appearing 10 this common Agreemeotare for convenieoceooly 

and shall. Mt be.deemedto explain, limit, or amptifYthe provisions ofthis Common 

Agreement. 

19;9; Independent Parties. Nothingeonta1nedlhthis Common Agreement shall be 

deernedorcon.strued ascre1:1tingajotnt yenttJreor part11ershipJ>et1NeenSigllj:ltory 

and RCE, 

~9;1{), Acts oftontrattots and Agents, to the extentthanhe acts or omissions ofa !>artfs 

agent(s)or contractor(s), or theirsobconttactt!r(s)> result in thatParty'sbtea-ch of 

and HafH!ltyunderthis Ce>mrnM Agreement, saicl breach shall be deemed tb bea 

breath b:ythatParty. 

19:11. Entire Agreement; waiver. This common Agreement, together with the OJF, soPs, 

and all other attachments,.exhibits,and artifacts incorporated by reference, 

contains the entire understandingoftheParties with regard,tothesubjectmatter 

contained.herein. The failure·ofeither Party to.enforce, at anytime,,any provision of 

this Common Agreement shall not.be construed to:beawaiver of such pro11ision,.nor 

shallit l11any1N~yaffectthe validity ofthisComm<>n Agreement Qr anypartheteof 

orthe right: ofsuch Party thereafter tb enforceeachand every such provisle>n;No 

waiver ofanybre1:1ch bhl'i!sCmt1mon Agreement shalLbe held tc>constftuteawafoer 

ohny bther (>t subsequent breach, n()r shalt.arw delay by either Partytb exerdse 

any rightundenhts Comm~h Agreement operate as a w1:1iver bfanysuchright 

19.12. EffettofAgteement, Except as provided in.Sections 7.4 and.Section 1s~ nothing rn 

this Common Agreement shall be construed to.restrict either Partts right to,pursue 

all remedies available under law for damages or other relief arising from acts or 

omissions of RCE or other 0,HINs or their Participants or Sub participants r.elatedto 

the Cornmort Agreementi orto Urnitanyrights, immunities, or defenses to which 

Stgnato.ry may be entitleq under Applicable law, 

i9d.3; PrioriM.ln•tbe eventbhny ~ortfHct or int()nsistency between Applicable Law, a 

pr()vision()fthiS Common Agreement, the QTF,a11SQJ>;and/or any implerrrentation 

60 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76833 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.070</GPH>

plans,guidance documents, or.other materials or documentation the RCE makes 

available toO.HINs, Participants, and/orSUbparticipants regarding the operations or 

actiyitiE!5cortdt1cted urtdE!rtl')eFrarrtework.Agr.eerrtents, thef<>Howingshall b.e the 

<>rder ofp(e<:edence f<>r this t()mrnoo AgrecernenHe> the E!xtentof suchconfUct Qr 

mc()nsistet1cy: {i) Applic.1i~je 41w:(2) this document, lncll,lditig R~qμked Fl<>w~t>l)wns 

that are to f)e iocorporated iota Framewc:itk Agreements;(~) the QTF; (4) the 

o)spute Resolution Process, as set fotthheteii:tantl further detailedtn an SOP; (5) il!II 

otherSOPs;(Eil all oth~r attachtnents,exhibits,ahd.artifacts ihtorpdtated heteih hy 

rcl'er:ence, a11d (7) othefRCE plans, dotument5, or materials made available 

regardiog actMties conducted Under the Fr:amework.Agreements, 

19.14. QHIN Time Periods, Any ofthe Ume periods relatingfo the Parties herefolhatare 

specified in this Common Agreement may be changed on a case--by,case basis 

pursuant tothE! mutu.al writlert.consertt ofthe Pc!rties,< providecfthatthesechartges 

.arenot unde(takent<> adversely affect anotherO,HINandpfovidedthatthese 

ihangeswould n()t•unfairlybenefiteither Party:to thedetrlment()fothers 

paJtii;ipating in allthli1:ies urtder the Framework Agre:em:eots.. Time peri~ds•that 

pertain t() 01\lC may not be changed, :extept by bNC, ihdudingthetime periQds for 

ONCreview ofpr6pOsed changes to the tommo:n Agreement, the a;f'F; 6£ 56Ps that 

ate setfc:irth: in section s. 

19.15. Remedles.cumU1at1ve. The fights arid.femedies ofthe Parties pr.oVided in this 

Common Agreement are.cumulative and are in addition to any other rights,and 

remediespro.videdbyApplicable Law. 

19.11:>. Survival of Rights and Obligations. The respective rights, obligations( and liabilities of 

the Parties w1th respecttoact; or omissionsthatoccurby either Part:ypriort()the 

datecof expiration or termination ofll:lis Common Agreemen'l:shaH survive such 

expfration or termination, F()IIQWing any expiration orterminationohfils Common 

Agteement,the Partles shallthereafi:et cooperate fuUyandwork diligently in good 

faitht() achieve. an orderlyresoluti6n.ofallmatters resultltlgfrt)m s.uch:expi(ationor 

terrninatic:m. 

19~16.1. Thefollowingsections shallsurvive expitatkm ortermiriationofthis 

Common:Agr.eementas moresp.ecificallyprovidedbelow: 

(i) The fQllowingsecti()ns shall survive in perpetuity following the 

expiration orterrninatior1.ofthis ComrnonAgreement:iSectfons7-.4 

Umitatibn of liability; 1lk2 Nof1ces;t8..3 Governiogtaw, Forum and 

Jurisdidibn; 18,oSeverability; 1$.sJm:fep:ehdent Parties; :ia.toAtts of 

61 
76834 Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.071</GPH>

Contractors and Agents; 18.11 Entire Agreement; Waiver; 18.12 Effect 

of Agreement; 18:13 Priority; and 18.15 Remedies Cumulative. 

(ii) The following sections shall survive for a period of six (6) years 

following the expiration or termination of this Common Agreement: 

Sections 7.1 Confidential Information; 7.2.1 Statement of General 

Principle; 12.3 TEFCA Security Incident Notification; and 14.1 

Transparency- Access to Participant·QHIN Information. 

(iii) The following section shall survive for the p.eriod specifically stated in 

such section following the expiration or termination of this Common 

Agreement: Section 16:3.5 Effect.of Termination of Common 

Agreement. 

(iv) To the extent that Signatory is an IAS Provider, the provisions set 

forth in Section 10.6 shall survive following the termination or 

expiration of this Common Agreement for the respective periods set 

forth therein. 

62 
Federal Register / Vol. 88, No. 214 / Tuesday, November 7, 2023 / Notices 76835 

Dated: October 24, 2023. 

Suhas Tripathi, 

National Coordinator for Health Information 

Technology, Office of the National 

Coordinator for Health Information 

Technology. 

[FR Doc. 2023–24536 Filed 11–3–23; 8:45 am] 

BILLING CODE 4150–45–C 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Office of the Secretary 

Notice of Interest Rate on Overdue 

Debts 

Section 30.18 of the Department of 

Health and Human Services’ claims 

collection regulations (45 CFR part 30) 

provides that the Secretary shall charge 

an annual rate of interest, which is 

determined and fixed by the Secretary 

of the Treasury after considering private 

consumer rates of interest on the date 

that the Department of Health and 

Human Services becomes entitled to 

recovery. The rate cannot be lower than 

the Department of Treasury’s current 

value of funds rate or the applicable rate 

determined from the ‘‘Schedule of 

Certified Interest Rates with Range of 

Maturities’’ unless the Secretary waives 

interest in whole or part, or a different 

rate is prescribed by statute, contract, or 

repayment agreement. The Secretary of 

the Treasury may revise this rate 

quarterly. The Department of Health and 

Human Services publishes this rate in 

the Federal Register. 

The current rate of 12 1/8%, as fixed 

by the Secretary of the Treasury, is 

certified for the quarter ended 

September 30, 2023. This rate is based 

on the Interest Rates for Specific 

Legislation, ‘‘National Health Services 

Corps Scholarship Program (42 U.S.C. 

254o(b)(1)(A))’’ and ‘‘National Research 

Service Award Program (42 U.S.C. 

288(c)(4)(B)).’’ This interest rate will be 

applied to overdue debt until the 

Department of Health and Human 

Services publishes a revision. 

David C. Horn, 

Director, Office of Financial Policy and 

Reporting. 

[FR Doc. 2023–24568 Filed 11–6–23; 8:45 am] 

BILLING CODE 4150–04–P 


khammond on DSKJM1Z7X2PROD with NOTICESEN07NO23.072</GPH>

IN WITNESS WHEREOF, the Parties hereto, intending legally to be bound hereby, have executed 

and delfvered this CommonAgreement as .ofthe date first abovewrltten. 

R<;E: THE.SEQUbl,\PRb~E(:T, INC. Signl!tory: ------,-------

Signature Signature 

By: By: 

Title: Title: 

Date: Date: 

63