HIway Regulations Overview
In February 2017, EOHHS, the Massachusetts Executive Office of Health & Human Services, promulgated 101 CMR 20.00: Health Information Exchange, also known as the Mass HIway Regulations. These regulations implement key components of Chapter 118I of the Massachusetts General Laws, which pertain to the Mass HIway.
The regulations codify the HIway Connection Requirement, which requires certain healthcare organizations to connect to and use the HIway Direct Messaging System or another DirectTrust-accredited HISP to send Direct Messages. These organizations must implement increasingly rigorous clinical use cases by sending/receiving HIway Direct messages over a four-year cycle. For a summary of the regulations, click here.
In October 2019, EOHHS updated 101 CMR 20.00 : Health Information Exchange, also referred to as the Mass HIway Regulations. For the updated regulations, click here. In the updated regulations, defined terms such as HIway Direct Messaging are capitalized. In addition, references to specific sections of the regulations are provided. For a detailed set of frequently asked questions, click here.
For the Mass HIway Policies and Procedures, click here.
Click here for a printable version of summary.
The HIway Connection Requirement
The regulations stipulate that the HIway Connection Requirement is phased in by type of organization, and currently applies to the following Provider Organizations:
- Acute Care Hospitals
- Medium and Large Medical Ambulatory Practices
- Community Health Centers
The HIway Regulations align HIway Direct Messaging with other modes of transmission, e.g. fax or phone, and require these organizations to:
- Transmit health information via HIway Direct Messaging
- Comply with federal and state privacy laws and implementation regulations
- Meet specific HIE Use Case requirements when using the Mass HIway
If the HIway Regulations apply to your Provider Organization, you will need to connect to the HIway Direct Messaging System or another DirectTrust-accredited HISP to send Direct Messages.
How Provider Organizations fulfill the HIway connection requirement
- HIway Direct Messaging: Provider Organizations with connection dates specified in the regulations can meet the HIway connection requirement by sending and receiving HIway Direct Messages, following a phased-in approach over 4 years (101 CMR 20.08(3)). The methods by which organizations may implement Direct Messaging are listed in the last bullet point below.
- Acute Care Hospitals: Acute Care Hospitals can meet the HIway connection requirement by both: (a) sending and receiving HIway Direct Messages, and (b) sending Admission Discharge Transfer notifications (ADTs) to the Statewide ENS Framework. (101 CMR 20.08(4)).
Penalties for not fulfilling the HIway connection requirement
- Penalties for Provider Organizations that do not fulfill the HIway connection requirement may be assessed in Year 4 of the requirement. No penalties will be assessed for failure to connect to the Mass HIway before January 2020. (101 CMR 20.13 and 20.14)
- EOHHS may grant a waiver to Provider Organizations regarding the requirement to connect to the Mass HIway under certain circumstances. (101 CMR 20.15).
- Provider Organizations can request that EOHHS reconsider a penalty notification, and appeal EOHHS' final determination to assess a penalty. (101 CMR 20.16).
The opt-in opt-out mechanism for the Mass HIway
- HIway Direct Messaging: Information may be transmitted via HIway Direct Messaging in compliance with applicable federal and state privacy laws and regulations (e.g., HIPAA, 42 CFR Part 2, M.G.L. Chapter 93H) (101 CMR 20.07(1)). This aligns the use of HIway Direct Messaging with other modes of transmission (e.g., sending information by fax or phone). Mass HIway Users have the option of implementing a local opt-in and/or opt-out process that applies to the use of HIway Direct Messaging by their organization.
- HIway-Facilitated Services: These services must be used in compliance with applicable federal and state privacy laws and implementing regulations. Provider organizations may implement local opt-in and/or opt-out processes that apply to the use of HIway-Facilitated Services by their organization, but are not required to do so. (101 CMR 20.07(2))
- HIway-Sponsored Services: A centralized opt-in opt-out mechanism for HIway-Sponsored Services will be implemented and operated by the Mass HIway once these services are launched by the Mass HIway. (101 CMR 20.07(3)). Currently there are no HIway-Sponsored Services.
Four Year Phase-In Period
How provider organizations must fulfill the HIway Connection Requirement is phased in over 4 years:
- The connection requirement gets progressively stricter in each year of implementation
- Organizations that don’t meet the requirement may be subject to penalties starting in Year 4
- The 4 year phase-in period is based on when an organization must be connected
| Provider Organization | Year 1 | Year 4 |
| Acute Care Hospitals | 2017 | 2020 |
| Large and Medium Medical Ambulatory Practices | 2018 | 2021 |
| Large Community Health Centers | ||
| Small Community Health Centers | 2019 | 2022 |
Note: Provider types not yet specified in the regulations are anticipated to be required to connect at a future date.
○ Guidance to the affected providers will be provided with at least one year notice.
HIE Use Case Requirements
The table below lists the HIE Use Case categories allowed to be implemented to meet the Year 1 to Year 4 Requirements. Year 1 and 2 no longer apply to any providers. Providers in Year 3 and beyond need to implement a Provider-to-Provider Communications Use Case.
The use case examples listed in the table are for reference only, as other use cases may be suitable as well, provided these fit the categories allowed to satisfy the requirements. Note that the requirements are the minimum a provider must implement. To take advantage of the benefits of HIE, providers are encouraged to implement additional HIE use cases beyond the requirements.
The graphic below shows an example of a Provider-to-Provider Communications use case. You can use our HIE Use Case Toolkit to implement this use case or any other HIE Use Cases.
ESTABLISHING INTEROPERABLE ELECTRONIC HEALTH RECORD (EHR) SYSTEMS
- Provider Organizations that have HIway connection dates specified in the regulations will fulfill the M.G.L. Chapter 118I requirement that providers establish interoperable EHR systems that connect to the Mass HIway by implementing HIway Direct Messaging. (101 CMR 20.10(1))
- Provider Organizations may implement HIway Direct Messaging by one of several methods, including: (a) an EHR's Direct XDR connection, (b) a Local Access for Network Distribution (LAND) appliance connection, (c) a Webmail connection, which does not require an EHR, (d) a DirectTrust-accredited HISP (See Section 5.1 of the Mass HIway Policies and Procedures).
Statewide ENS Framework Requirement
There is an additional ENS Requirement that applies only to Acute Care Hospitals. These organizations must connect to the Statewide ENS Framework to submit Admission Discharge Transfer notifications (ADTs).
To learn more about the Statewide ENS Framework and this requirement for Acute Care Hospitals, click here.
Frequently Asked Questions
Mass HIway Regulations FAQs provide Questions & Answers related to the Mass HIway Regulations, and the attestation process. To access the FAQs, click here.