Text of CA SB 660 (2025)

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Senate Bill No. 660 Introduced by Senator Menjivar February 20, 2025 An act to amend and renumber Section 130290 of, and to add Section 130213 to, the Health and Safety Code, relating to the California Health and Human Services Data Exchange Framework. LEGISLATIVE COUNSEL'S DIGEST SB 660, as introduced, Menjivar. California Health and Human Services Data Exchange Framework. Existing law establishes the Center for Data Insights and Innovation, within the California Health and Human Services Agency, to ensure the enforcement of state law mandating the confidentiality of medical information. The center is administered by a director who also serves as the California Health and Human Services Chief Data Officer. Existing law further establishes the California Health and Human Services Data Exchange Framework to require the exchange of health information among health care entities and government agencies in the state, among other things. Existing law requires the agency to convene a stakeholder advisory group to advise on the development of implementation of the California Health and Human Services Data Exchange Framework. This bill would require the center, on or before January 1, 2026, and subject to an appropriation in the annual Budget Act, to take over the establishment, implementation, and all of the functions related to the California Health and Human Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the agency. The bill would expand the California Health and Human Services Data Exchange Framework to include social services information. The bill would expand the entities that are specifically required to execute a data sharing agreement with the California Health and Human Services Data Exchange Framework and authorize the center to determine other categories of entities required to execute a data sharing agreement. The bill would require the center, no later than July 1, 2025, to establish a process to designate qualified health information organizations as data sharing intermediaries that have demonstrated their ability to meet requirements of the California Health and Human Services Data Exchange Framework. The bill would require the center to annually report to the Legislature on the California Health and Human Services Data Exchange Framework, including compliance with data sharing agreements. The bill would expand the membership of the stakeholder advisory group and also establish the CalHHS Data Exchange Board as a separate entity from the stakeholder advisory group. The board would be composed of 12 members who are appointed or serve ex officio. The board, among other things, would be required to review, modify, and approve modifications to the California Health and Human Services Data Exchange Framework data sharing agreement and any new policies and procedures developed by the center. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Section 130290 of the Health and Safety Code is amended and renumbered to read: 130290.130212. (a) On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California. On or before January 1, 2026, and subject to an appropriation in the annual Budget Act, the Center for Data Insights and Innovation shall take over the establishment, implementation, and all of the functions related to the California Health and Human Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the California Health and Human Services Agency. (1) The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health and social services information using national standards and a common set of policies and procedures in order to improve the health and social services-related outcomes of the individuals they serve. (2) The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health and social services information among health care providers and payers participants through any health information exchange network, health information organization, or technology that adheres to specified standards and policies. policies, which shall include any requirements as specified by the center, and approved by the board pursuant to subdivision (n), to send specified health and social services information to architecture that meets certain criteria, including, but not limited to, all of the following: (A) Reducing barriers and burdens for participants to have real-time access to this information as permitted or required under the data sharing agreement and policies and procedures, regardless of the exchange methods they may use. (B) Not using, processing, or retaining this information longer than is necessary to facilitate this real-time access across different exchange methods. (3) The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden. (4) For the purposes of this section, “health and social services information” means: (A)For hospitals, clinics, and physician practices, at a minimum, the United States Core Data for Interoperability Version 1, until October 6, 2022. After that date, it shall include all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity. (A) For hospitals, skilled nursing facilities, clinical laboratories, and physician organizations and medical groups, all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity. (B) For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510. (b) (1) On or before January 31, 2024, and except as provided in paragraphs (2) and (3), to (4), inclusive, the entities listed in subdivision (f) shall exchange health and social services information or provide access to health and social services information to and from every other entity in subdivision (f) in real time as specified by the California Health and Human Services Agency center pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations. (2) The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, state-run acute psychiatric hospitals, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026. (3) The requirement in paragraph (1) shall not apply to facilities described in subdivision (a) of Section 1180.2 until January 31, 2029. (3) (4) The requirement in paragraph (1) shall not apply to the exchange of health and social services information related to abortion and abortion-related services. (c) The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development and implementation of the California Health and Human Services Data Exchange Framework. (1) The members of the stakeholder advisory group shall be appointed by the Secretary of California Health and Human Services and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on. (2) The stakeholder advisory group shall be composed of health care stakeholders and experts, including representatives of all the following: (A) The State Department of Health Care Services. (B) The State Department of Social Services. (C) The Department of Managed Health Care. (D) The Department of Health Care Access and Information. (E) The State Department of Public Health. (F) The Department of Insurance. (G) The Public Employees’ Retirement System. (H) The California Health Benefit Exchange. (I) Health care service plans and health insurers. (J) Physicians, including those with small practices. (K) Hospitals, including public, private, rural, and critical access hospitals. (L) Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities. (M) Consumers. (N) Organized labor. (O) Privacy and security professionals. (P) Health information technology professionals. (Q) Community health information organizations. (R) County health, social services, and public health. (S) Community-based organizations providing social services. (T) The State Department of State Hospitals. (U) The State Department of Developmental Services. (V) The Emergency Medical Services Authority. (W) The Department of Corrections and Rehabilitation. (3) The stakeholder advisory group shall provide information and advice to the California Health and Human Services Agency on health and social services information technology issues, including all of the following: (A) Identify which data beyond health and social services information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f). (B) Identify gaps, and propose solutions to gaps, in the life cycle of health and social services information, including gaps in any of the following: (i) Health and social services information creation, including the use of national standards in clinical documentation, health plan records, and social services data. (ii) Translation, mapping, controlled vocabularies, coding, and data classification. (iii) Storage, maintenance, and management of health information. (iv) Linking, sharing, exchanging, and providing access to health information. (C) Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information. (D) Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity and racial and ethnic minorities. (E) Identify ways to incorporate relevant data on behavioral health health, developmental disabilities, and substance use disorder conditions. (F) Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack. (G) Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health information and ensure that health and social services information, including matters of consent, privacy, confidentiality, and security, and ensure that health and social services information sharing broadly implements national frameworks and agreements consistent with federal rules and programs. (H) Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards. (I) Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs. (J) Assess governance structures to help guide policy decisions and general oversight. (K)Identify federal, state, private, or philanthropic sources of funding that could support data access and exchange. (K) Identify federal, state, private, and philanthropic sources of funding that can support health and social services information exchange. (4) The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code). (5) The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group. (d) No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (3) of subdivision (c). (e) On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians. (f) On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a): (a), except that the health care organizations in paragraph (7) shall execute the data sharing agreement by July 1, 2025: (1) General acute care hospitals, as defined by Section 1250. (2)Physician organizations and medical groups. (2) Physician organizations and medical groups, which include any of the following: (A) A medical group practice, a professional medical corporation, a medical partnership, or any lawfully organized group of physicians and surgeons that provides, delivers, furnishes, or otherwise arranges for health care services. (B) An independent practice association, to the extent that it maintains electronic health information on behalf of their participating physicians. (C) A medical foundation exempt from licensure pursuant to subdivision (l) of Section 1206. (D) A clinic described in subdivision (a) of Section 1204. (E) A specialty clinic, as described in paragraphs (1) to (3), inclusive, of subdivision (b) of Section 1204. (F) An ambulatory surgical center or accredited outpatient setting. (3) Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic records. (4) Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance. (5) Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health. (6) Acute psychiatric hospitals, as defined by Section 1250. (g)The California Health and Human Services Agency shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f). (7) Emergency medical services, as defined by Section 1797.72. (g) Commencing January 1, 2026, compliance with subdivision (f) shall be required as a condition of amending or entering into a new contract or participation with the Department of Health Care Services, the Public Employees’ Retirement System, and the California Health Benefit Exchange. (h) The center shall have the authority to determine other categories of entities that shall sign the California Health and Human Services Data Exchange Framework data sharing agreement and the deadlines for those entities to execute the data sharing agreement pursuant to subdivision (a) and comply with the data sharing requirements of subdivision (b). (i) The center shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f). (h) (j) On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master patient person indices to be implemented by both private and public organizations in California. (i) (k) For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the California Health and Human Services Agency center may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. No A person hired or otherwise retained pursuant to this subdivision shall not be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or shall not be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term “person,” as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof. (l) (1) The center shall administer, manage, oversee, and enforce the California Health and Human Services Data Exchange Framework and its data sharing agreement, including its related policies and procedures, governance, and all other materials or initiatives related to the California Health and Human Services Data Exchange Framework. (2) The center shall have the authority to develop a framework for investigating and resolving disputes between California Health and Human Services Data Exchange Framework participants regarding the data sharing agreement and its policies and procedures. (3) The center shall report violations of subdivision (f) to state licensing and regulatory entities authorized to ensure compliance with execution of the data sharing agreement or with the data sharing agreement and its policies and procedures, and may report violations to other state entities authorized to ensure compliance with privacy and confidentiality requirements. (4) The center shall be responsible for oversight of the dispute resolution and grievance processes for the California Health and Human Services Data Exchange Framework, including tracking consumer complaints. (5) The center shall submit an annual report to the Legislature that includes required signatory execution of and compliance with the data sharing agreement, assessment of consumer experiences with health and social services information exchange, and evaluation of technical assistance and other grant programs. The report shall be submitted in compliance with Section 9795 of the Government Code. (m) (1) The center shall establish and administer the CalHHS Data Exchange Board. The board shall be separate and distinct from the stakeholder advisory group. (2) (A) The board shall be composed of five voting members and seven nonvoting members. (B) The voting members shall be as follows: (i) The Secretary of California Health and Human Services, or their designee, shall serve as the chair and as an ex officio member of the board. (ii) Two individuals appointed by the Governor, and at least one of whom shall be a consumer representative. (iii) One individual appointed by the Speaker of the Assembly. (iv) One individual appointed by the Senate Committee on Rules. (C) The nonvoting members shall be one representative from each of the following, who shall be ex officio members of the board: (i) The Public Employees’ Retirement System. (ii) The California Health Benefit Exchange. (iii) The State Department of Health Care Services. (iv) The State Department of Developmental Services. (v) The Emergency Medical Services Authority. (vi) The State Department of State Hospitals. (vii) The Department of Corrections and Rehabilitation. (3) Each individual appointed to the board shall have demonstrated and acknowledged expertise, as needed and relevant to data sharing, including but not limited to, health and social services information exchange, health and social services data privacy, health and social services data security, health information informatics, and the administration, financing, and delivery of public health, health care, and social services. The appointing authorities shall consider the expertise of the other board members and attempt to make appointments so that the board’s composition reflects a diversity of expertise and perspectives. The appointing authorities shall take into consideration the cultural, ethnic, and geographical diversity of the state so that the board’s composition reflects the communities of California. (4) Board members, other than ex officio members, shall serve up to two terms of four years per term, except that the initial appointment by the Speaker of the Assembly shall be for a term of five years, and the initial appointment by the Senate Committee on Rules shall be for a term of five years. Appointed board members shall be eligible for reappointment at the end of their first term. A board member may continue to serve until the appointment and qualification of their successor. Vacancies shall be filled by appointment for an unexpired term. (5) The board shall be subject to Article 3 (commencing with Section 87300) of Chapter 7 of Title 9 of the Government Code and the regulations promulgated thereunder. (6) Except for those who are board members pursuant to subparagraph (C) of paragraph (2), a board member shall not be employed by, a member of the board of directors of, affiliated with, a vendor to, or otherwise a representative of signatories of, the California Health and Human Services Data Exchange Framework data sharing agreement while serving as a board member. (7) Board members shall not have a conflict of interest and shall disclose all financial interests, investments, and positions in business entities or any signatories to the California Health and Human Services Data Exchange Framework data sharing agreement using the form as specified by the center’s conflict-of-interest code. (8) Board members shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as board members. (n) (1) The board shall review, modify, and approve modifications to the California Health and Human Services Data Exchange Framework data sharing agreement and its policies and procedures and any new policies and procedures developed by the center. (2) The board shall review, modify, and approve new data sharing requirements for signatories to the California Health and Human Services Data Exchange Framework data sharing agreement developed by the center. (3) The board may advance recommendations on criteria and procedures on health and social services information exchange technical assistance, onboarding, and other grant programs established by the center. (4) The board shall develop recommendations to the Legislature and the Governor on statutory amendments to align state law with federal law, the California Health and Human Services Data Exchange Framework, and other policies to advance health and social services information exchange as identified by the board, center, and stakeholder advisory group. (5) The board shall review, modify, and approve changes to the California Health and Human Services Data Exchange Framework priorities and principles as developed by the center and shall advise the center on the advancement of those priorities and principles. (6) Subject to appropriation by the Legislature and in partnership with the center, the board shall develop a consumer outreach and education program that informs individuals of their rights, as well as the benefits of health and social services information exchange, and provides a forum for members of the public to provide ongoing input related to health and social services information exchange. (7) (A) On or before January 1, 2026, the board shall convene stakeholders, including signatories to the California Health and Human Services Data Exchange Framework data sharing agreement, consumer advocates, and racial equity experts, to develop recommendations for statutory changes, training and technical assistance, and best practices to require the entities listed in subdivision (f) to collect individual-level demographic and health-related social needs data about Californians served, using the demographic and social needs data categories in the latest version of the United States Core Data for Interoperability adopted through the Health IT Certification Program finalized by the United States Department of Health and Human Services. (B) The board may establish advisory committees composed of health and social services stakeholders, as identified in paragraph (2) of subdivision (c), to advise the board on the duties described in subparagraph (A). (8) On or before July 1, 2026, the center shall publish a policy proposal to adopt or modify the recommendations developed pursuant to paragraph (7). (9) The board shall review the annual report submitted to the Legislature by the center pursuant to paragraph (5) of subdivision (l). (j) (o) (1) All actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The California Health and Human Services Agency, center, or a designee department or office under its jurisdiction, shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework. (2) The center may, but is not obligated to, enact recommendations advanced by the board in accordance with the law and its rulemaking authority. (3) The center may adopt reasonable rules and regulations to implement, administer, and oversee its duties under this section in accordance with Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code. (4) The center may adopt emergency regulations to consolidate, clarify, or make consistent regulations, including emergency regulations adopted to implement this section. (5) A rule, action, or regulation adopted pursuant to this section shall be discussed by the board during at least one properly noticed board meeting before the center adopts the rule or regulation. (6) The board may call emergency meetings with at least five business days’ notice for the purpose of discussing regulation changes for purposes of federal regulatory compliance or to discuss emergency regulations. Once the board is established, the center shall bring each proposed regulation to the board to be discussed at least at one board meeting before adoption. (7) The center may readopt any emergency regulation authorized by this section that is the same as, or substantially equivalent to, an emergency regulation previously adopted as authorized by this section. A readoption shall be limited to one time for each regulation. (8) Once the board has been established, an emergency regulation adopted pursuant to this section shall be repealed by operation of law, unless the adoption of the regulation is discussed by the board within six months of the establishment of the board, or the regulation shall be repealed pursuant to the timeline described in paragraph (9), whichever date is earlier. (9) Notwithstanding any other law, the adoption of emergency regulations and the readoption of emergency regulations authorized by this section, if done on or before December 31, 2026, shall be deemed an emergency and necessary for the immediate preservation of the public peace, health, safety, or general welfare. The emergency regulations and the readopted emergency regulations authorized by this section shall each be submitted to the Office of Administrative Law for filing with the Secretary of State and shall remain in effect for no more than 180 days, by which time final regulations may be adopted. (p) For purposes of this section, all of the following definitions shall apply: (1) “Architecture” means any coordinating structure, including a combination of platforms and rules, designed to provide enabling functions such as streamlining users’ ability to request, access, and receive specified health and social services information. (2) “Board” means the CalHHS Data Exchange Board established pursuant to subdivision (m). (3) “Center” means the Center for Data Insights and Innovation. (4) “Qualified health information organization” means an entity that has applied for, and satisfied, the process and criteria described in Section 130213. SEC. 2. Section 130213 is added to the Health and Safety Code, to read: 130213. No later than July 1, 2025, the center shall establish a process to designate qualified health information organizations as data-sharing intermediaries that have demonstrated their ability to meet requirements of the California Health and Human Services Data Exchange Framework. Health and social service organizations may comply with the data exchange framework by participating in and sharing information with a qualified health information organization.

Senate Bill No. 660 CHAPTER 325 An act to amend Section 130290 of, and to add Section 130291 to, the Health and Safety Code, relating to the California Health and Human Services Data Exchange Framework. [ Approved by Governor October 03, 2025. Filed with Secretary of State October 03, 2025. ] LEGISLATIVE COUNSEL'S DIGEST SB 660, Menjivar. California Health and Human Services Data Exchange Framework. Existing law establishes the Department of Health Care Access and Information to oversee and administer various health programs related to health care infrastructure, such as health policy and planning, health professions development, and facilities design review and construction, among others. Existing law requires the California Health and Human Services Agency to establish the California Health and Human Services Data Exchange Framework to require the exchange of health information among health care entities and government agencies in the state, among other things. Existing law requires the agency to convene a stakeholder advisory group to advise on the development, implementation, and administration of the California Health and Human Services Data Exchange Framework. This bill would require the Department of Health Care Access and Information, on or before January 1, 2026, to take over the establishment, implementation, and all of the functions related to the California Health and Human Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the agency. The bill would expand the entities that are specifically required to execute a data sharing agreement with the California Health and Human Services Data Exchange Framework. The bill would require the department, no later than July 1, 2026, to establish a process to designate qualified health information organizations as data sharing intermediaries that have demonstrated their ability to meet requirements of the California Health and Human Services Data Exchange Framework. The bill would require the department, by July 1, 2027, and in collaboration with the stakeholder advisory group, to develop and submit a report to the Legislature on the California Health and Human Services Data Exchange Framework, including compliance with data sharing agreements. The bill would expand the membership of the stakeholder advisory group, as specified. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Section 130290 of the Health and Safety Code is amended to read: 130290. (a) On or before July 1, 2022, and subject to an appropriation in the annual Budget Act, the California Health and Human Services Agency, along with its departments and offices and in consultation with stakeholders and local partners, shall establish the California Health and Human Services Data Exchange Framework that shall include a single data sharing agreement and common set of policies and procedures that will leverage and advance national standards for information exchange and data content, and that will govern and require the exchange of health information among health care entities and government agencies in California. On or before January 1, 2026, the Department of Health Care Access and Information shall take over the establishment, implementation, and all of the functions related to the California Health and Human Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the California Health and Human Services Agency. (1) The California Health and Human Services Data Exchange Framework is not intended to be an information technology system or single repository of data, rather it is technology agnostic and is a collection of organizations that are required to share health information using a common set of policies and procedures in order to improve the health outcomes of the individuals they serve. (2) The California Health and Human Services Data Exchange Framework will be designed to enable and require real-time access to, or exchange of, health information among participants through any health information exchange network, health information organization, or technology that adheres to specified standards and policies. (3) The California Health and Human Services Data Exchange Framework shall align with state and federal data requirements, including the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191), the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1 of the Civil Code), Sections 827, 10850, and 14100.2 of the Welfare and Institutions Code, and other applicable state and federal privacy laws related to the sharing of data among and between providers, payers, and the government, while also streamlining and reducing reporting burden. (4) For the purposes of this section, “health information” means: (A) For hospitals, skilled nursing facilities, clinical laboratories, and physician organizations and medical groups, all electronic health information as defined under federal regulation in Section 171.102 of Title 45 of the Code of Federal Regulations and held by the entity. The information pursuant to this subparagraph shall be at a minimum the information included in Section 171.102 of Title 45 of the Code of Federal Regulations as of April 15, 2025. In accordance with the California Health and Human Services Data Exchange Framework data sharing agreement and policies and procedures, a signatory to the data sharing agreement is not required to share information that is not maintained by the entity. (B) For health insurers and health care service plans, at a minimum, the data required to be shared under the federal Centers for Medicare and Medicaid Services Interoperability and Patient Access regulations for public programs as contained in United States Department of Health and Human Services final rule CMS-9115-F, 85 FR 25510 as of April 15, 2025. (b) (1) On or before January 31, 2024, and except as provided in paragraphs (2) to (4), inclusive, the entities listed in subdivision (f) shall exchange health information or provide access to health information to and from every other entity in subdivision (f) in real time as specified by the department pursuant to the California Health and Human Services Data Exchange Framework data sharing agreement for treatment, payment, or health care operations, except that the health care organizations in subparagraph (C) of paragraph (2) of subdivision (f) and paragraph (7) of subdivision (f) shall exchange or provide access to health information by July 1, 2026. (2) The requirement in paragraph (1) shall not apply to physician practices of fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, and rural general acute care hospitals with fewer than 100 acute care beds, and any nonprofit clinic with fewer than 10 health care providers until January 31, 2026. (3) The requirement in paragraph (1) shall not apply to facilities described in subdivision (a) of Section 1180.2 until January 31, 2029. (4) The requirement in paragraph (1) shall not apply to the exchange of health information related to abortion, abortion-related services, gender-affirming care, immigration or citizenship status, or place of birth. (c) The California Health and Human Services Agency shall convene a stakeholder advisory group no later than September 1, 2021, to advise on the development, implementation, and administration of the California Health and Human Services Data Exchange Framework. On or before January 1, 2026, the department shall take over the responsibilities of the stakeholder advisory group. (1) The members of the stakeholder advisory group shall be appointed by the director and shall not have a financial interest, individually or through a family member, related to issues the stakeholder advisory group will advise on. The stakeholder advisory group may consider and vote on recommendations for updates to the data sharing agreement and its policies and procedures that the department may, but is not obligated to, enact. (2) The director shall appoint to the stakeholder advisory group representatives from health care stakeholders and experts with representation of the following groups: (A) State departments and other state entities, including signatories of the California Data Exchange Framework data sharing agreement that shall serve as ex officio nonvoting members. (B) Health care service plans and health insurers. (C) Physicians, including those with small practices. (D) Hospitals, including public, private, rural, and critical access hospitals. (E) Clinics, long-term care facilities, behavioral health facilities, or substance use disorder facilities. (F) Consumers. (G) Organized labor. (H) Privacy and security professionals. (I) Health information technology professionals. (J) Community health information organizations. (K) County health, social services, and public health. (L) Community-based organizations providing social services. (M) Skilled nursing facilities. (N) Physician organizations and medical groups. (O) Management services organizations. (3) The stakeholder advisory group shall not exceed 17 voting members and shall maintain a balance of perspectives with not more than 50 percent of voting members who are signatories of the data sharing agreement. (4) The director shall select a chair from amongst the members. (5) The stakeholder advisory group shall provide information and advice to the department on health and social services information technology issues, including all of the following: (A) Identify which data beyond health information as defined in paragraph (4) of subdivision (a), at minimum, should be shared for specified purposes between the entities outlined in this subdivision and subdivision (f). (B) Identify gaps, and propose solutions to gaps, in the life cycle of health information, including gaps in any of the following: (i) Health information creation, including the use of national standards in clinical documentation, health plan records, and social services data. (ii) Translation, mapping, controlled vocabularies, coding, and data classification. (iii) Storage, maintenance, and management of health information. (iv) Linking, sharing, exchanging, and providing access to health information. (C) Identify ways to incorporate data related to social determinants of health, such as housing and food insecurity, into shared health information. (D) Identify ways to incorporate data related to underserved or underrepresented populations, including, but not limited to, data regarding sexual orientation and gender identity, language, race, and ethnicity. (E) Identify ways to incorporate relevant data on behavioral health, developmental disabilities, and substance use disorder conditions. (F) Address the privacy, security, and equity risks of expanding care coordination, health information exchange, access, and telehealth in a dynamic technological, and entrepreneurial environment, where data and network security are under constant threat of attack. (G) Develop policies and procedures consistent with national standards and federally adopted standards in the exchange of health and social services information, including matters of meaningful and informed consent, privacy, confidentiality, identity management, liability and security, and ensure that health and social services information sharing broadly implements national frameworks and agreements. (H) Develop definitions of complete clinical, administrative, and claims data consistent with federal policies and national standards. (I) Identify how all payers will be required to provide enrollees with electronic access to their health information, consistent with rules applicable to federal payer programs. (J) Assess governance structures to help guide policy decisions and general oversight. (K) Identify federal, state, private, and philanthropic sources of funding that can support health and social services information exchange. (6) On or before January 1, 2027, the stakeholder advisory group shall develop recommendations in consultation with signatories, consumer advocates, and racial equity experts for statutory changes, training and technical assistance, and best practices to require the entities listed in subdivision (f) to collect individual-level demographic and health-related social needs data about Californians served. (7) The stakeholder advisory group shall hold public meetings with stakeholders, solicit input, and set its own meeting agendas. Meetings of the stakeholder advisory group are subject to the Bagley-Keene Open Meeting Act (Article 9 (commencing with Section 11120) of Chapter 1 of Part 1 of Division 3 of Title 2 of the Government Code). (8) The members of the stakeholder advisory group shall serve without compensation, but shall be reimbursed for any actual and necessary expenses incurred in connection with their duties as members of the group. (d) No later than April 1, 2022, the California Health and Human Services Agency shall submit an update, including written recommendations, to the Legislature based on input from the stakeholder advisory group on the issues identified in paragraph (5) of subdivision (c). (e) On or before January 31, 2023, the California Health and Human Services Agency shall work with the California State Association of Counties to encourage the inclusion of county health, public health, and social services, to the extent possible, as part of the California Health and Human Services Data Exchange Framework in order to assist both public and private entities to connect through uniform standards and policies. It is the intent of the Legislature that all state and local public health agencies will exchange electronic health information in real time with participating health care entities to protect and improve the health and well-being of Californians. (f) On or before January 31, 2023, and in alignment with existing federal standards and policies, the following health care organizations shall execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (a), except that the health care organizations in subparagraph (C) of paragraph (2) and paragraph (7) shall execute the data sharing agreement by July 1, 2026: (1) General acute care hospitals, as defined by Section 1250. (2) Physician organizations and medical groups, which include any of the following: (A) A medical group practice, a professional medical corporation, a medical partnership, or any lawfully organized group of physicians and surgeons that provides, delivers, furnishes, or otherwise arranges for health care services. (B) An independent practice association, to the extent that it maintains electronic health information on behalf of their participating physicians. (C) A medical foundation exempt from licensure pursuant to subdivision (l) of Section 1206. (D) A community clinic licensed under subdivision (a) of Section 1204, an intermittent clinic exempt from licensure under subdivision (h) of Section 1206, or a rural health clinic, as defined in paragraph (1) of subdivision (l) of Section 1396d of Title 42 of the United States Code. (E) A specialty clinic, as described in paragraphs (1) to (3), inclusive, of subdivision (b) of Section 1204. (F) An ambulatory surgical center or accredited outpatient setting. (3) Skilled nursing facilities, as defined by Section 1250, that currently maintain electronic health records. (4) Health care service plans and disability insurers that provide hospital, medical, or surgical coverage that are regulated by the Department of Managed Health Care or the Department of Insurance. This section shall also apply to a Medi-Cal managed care plan under a comprehensive risk contract with the State Department of Health Care Services pursuant to Chapter 7 (commencing with Section 14000) or Chapter 8 (commencing with Section 14200) of Part 3 of Division 9 of the Welfare and Institutions Code that is not regulated by the Department of Managed Health Care or the Department of Insurance. (5) Clinical laboratories, as that term is used in Section 1265 of the Business and Professions Code, and that are regulated by the State Department of Public Health. (6) Acute psychiatric hospitals, as defined by Section 1250. (7) Emergency medical services, as defined by Section 1797.72. (g) Commencing July 1, 2026, unless already required by an existing contract requirement, including any existing contract requirement that extends to subcontractors and delegates, compliance with subdivision (f) shall be required as a condition of continuing, amending, or entering into a new or existing contract for the coverage of or provision of health care services with the Department of Health Care Services, the Public Employees’ Retirement System, and the California Health Benefit Exchange. This subdivision shall not be construed to prevent any future contract requirement that extends this provision to subcontractors and delegates. (h) The department shall work with experienced nonprofit organizations and entities represented in the stakeholder advisory group in subdivision (c) to provide technical assistance to the entities outlined in subdivisions (e) and (f). (i) On or before July 31, 2022, the California Health and Human Services Agency shall develop in consultation with the stakeholder advisory group in subdivision (c) a strategy for unique, secure digital identities capable of supporting master person indices to be implemented by both private and public organizations in California. (j) For purposes of implementing this section, including, but not limited to, hiring staff and consultants, facilitating and conducting meetings, conducting research and analysis, and developing the required reports, the department may enter into exclusive or nonexclusive contracts on a bid or negotiated basis. Contracts entered into or amended pursuant to this section shall be exempt from Chapter 6 (commencing with Section 14825) of Part 5.5 of Division 3 of Title 2 of the Government Code, Section 19130 of the Government Code, and Part 2 (commencing with Section 10100) of Division 2 of the Public Contract Code, and shall be exempt from the review or approval of any division of the Department of General Services. A person hired or otherwise retained pursuant to this subdivision shall not be permitted to have any financial interest in the California Health and Human Services Data Exchange Framework or shall be, or shall not be affiliated with, any health care organization required to participate in the California Health and Human Services Data Exchange Framework pursuant to subdivisions (b) and (f). The term “person,” as used in this subdivision, means any individual, partnership, joint venture, association, corporation, or any other organization or any combination thereof. (k) (1) The department shall administer, manage, oversee, and enforce the California Health and Human Services Data Exchange Framework and its data sharing agreement, including its related policies and procedures, governance, and all other materials or initiatives related to the California Health and Human Services Data Exchange Framework. The department shall propose and publish updates to the framework and new policies and procedures of the framework that are necessary to advance the goals of this section. There shall be at least a forty-five-calendar-day public review period to review updates to the framework and new policies and procedures. The department shall publish approved updates in a publicly accessible format 180 calendar days before the effective date of the amendment, except when a shorter time period is necessary to comply with applicable law. (2) Commencing January 1, 2027, the department shall publish and keep current on its internet website the names of any known entities the department deems not to be in compliance with the requirement to execute the California Health and Human Services Data Exchange Framework data sharing agreement pursuant to subdivision (f). Entities may submit to the department a statement of extenuating circumstances which may impact an entity’s ability to come into compliance. The department shall publish these statements on its internet website. The department may submit information regarding compliance with the requirement in subdivision (f) to relevant state licensing entities. (3) Upon appropriation and after submission of the report described in paragraph (4), the department may develop enforcement actions subject to the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). (4) In collaboration with the stakeholder advisory group, the department shall develop and submit a report to the Legislature by July 1, 2027, in compliance with Section 9795 of the Government Code that includes all of the following: (A) A list of all entities in paragraphs (1), (3), and (4) of subdivision (f) deemed to be required signatories to the California Health and Human Services Data Exchange Framework data sharing agreement per subdivision (f). (B) The status of each entity’s execution of the data sharing agreement. (C) The compliance pathway or pathways utilized to meet its contractual requirements under the data sharing agreement, and, where applicable, if the signatory has a contract in place pursuant to subdivision (g). (D) An evaluation as to the need for an independent governing board for the California Health and Human Services Data Exchange Framework. (E) An evaluation of the need for technical assistance and other grant programs to support signatories’ legal requirements under the data sharing requirement. (F) An evaluation of other categories of entities for participation in the California Health and Human Services Data Exchange Framework. (G) An evaluation of the need for a framework for enforcement and investigation and resolution of disputes between California Health and Human Services Data Exchange Framework participants regarding the data sharing agreement and its policies and procedures. (H) An assessment of consumer experiences with health and social services information exchange. (l) Except where otherwise indicated in this section, all actions to implement the California Health and Human Services Data Exchange Framework, including the adoption or development of any data sharing agreement, requirements, policies and procedures, guidelines, subgrantee contract provisions, or reporting requirements, shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code). The department shall release program notices that detail the requirements of the California Health and Human Services Data Exchange Framework. (m) For purposes of this section, both of the following definitions shall apply: (1) “Department” means the Department of Health Care Access and Information. (2) “Director” means the Director of the Department of Health Care Access and Information. SEC. 2. Section 130291 is added to the Health and Safety Code, immediately following 130290, to read: 130291. (a) No later than July 1, 2026, the department shall establish a process to designate qualified health information organizations as data-sharing intermediaries that have demonstrated their ability to meet requirements of the California Health and Human Services Data Exchange Framework. Health and social service organizations may comply with the data exchange framework by participating in and sharing information with a qualified health information organization. (b) For purposes of this section, “qualified health information organization” means an entity that has applied for, and satisfied, the process and criteria described in subdivision (a).