HIway Regulations FAQs

Version 3. Updated January 2020

In February 2017 the Massachusetts Executive Office of Health & Human Services (EOHHS) promulgated the original state regulation 101 CMR 20.00: Health Information Exchange, which is also known as the Mass HIway Regulations. These regulations implement key components of Massachusetts General Law (M.G.L.) Chapter 118I, pertaining to the Mass HIway, which is the state-sponsored, statewide health information exchange (HIE) for the Commonwealth of Massachusetts. In October 2019, the Mass HIway Regulations were updated to define the use of regulatory frameworks to promote market-based HIE initiatives.

Click here for a summary of the Mass HIway Regulations. Click here for the Mass HIway Policies and Procedures. Attestation Forms are used by Provider Organizations to attest how the have met the requirement to connect to the Mass HIway. The annual attestation forms can be found here.

Questions regarding the Mass HIway Regulations that are not answered by these FAQs may be sent via email to the Mass HIway at MassHIway@state.ma.us . Mass HIway Participants that have questions regarding technical support, can contact the Mass HIway via email at MassHIwaySupport@state.ma.us .

Click here for a printable version of these FAQs.

Frequently Asked Questions (FAQs)

1. Background about the Mass HIway Regulations and M.G.L. Chapter 118I

1.1 Q: How were the Mass HIway Regulations developed?

A: The regulations were developed through an open, transparent process, during which EOHHS gathered feedback from the state's Health Information Technology (HIT) Council, the Council's advisory groups, and other stakeholders from across the state. The process included a public comment period and public hearing held in the fall of 2016. The original regulations went into effect in February 2017. In October 2019, the Mass HIway Regulations were updated to define the use of regulatory frameworks to promote market-based HIE initiatives.

1.2 Q: What is the purpose of the Mass HIway Regulations?

A: The Mass HIway Regulations establish requirements relating to health information technology and the state-sponsored, statewide Health Information Exchange (HIE), the Mass HIway. Specifically, the Mass HIway Regulations do the following:

• Establish requirements for organizations that use the Mass HIway
• Implement the HIway connection requirement, which is the requirement for providers in the state of Massachusetts to connect to the Mass HIway, as set forth in M.G.L. Chapter 118I (Section 7)
• Establish the mechanism to allow patients to opt-in and opt-out of the Mass HIway

2. The HIway connection requirement: who and when

2.1 Q: What is the scope of the Mass HIway Regulations?

A: The Mass HIway Regulations govern participation in the Mass HIway and related health information technology.   This includes participation in the HIway by the following entities (which are defined in 101 CMR 20.05):

• HIway Participants (i.e., provider organizations or other entities approved by EOHHS that are granted access to the Mass HIway directly by the Mass HIway, and which must execute a Participation Agreement)
• Non-Participant Users (i.e., organizations that are granted access to the Mass HIway through a HIway Trusted HISP)
• HIway Trusted HISPs (i.e., a Health Information Service Provider (HISP) which has executed an agreement with the Mass HIway)

The Mass HIway Regulations apply to all provider organizations that participate in the Mass HIway, including those that do not yet have a required HIway connection date.

All Provider Organizations that are required to connect to the Mass HIway will do so either as a HIway Participant or Non-Participant User.

2.2 Q: What is the HIway connection requirement?

A: The HIway connection requirement is the requirement that all provider organizations within Massachusetts connect to the Mass HIway, as set forth in M.G.L. Chapter 118I, Section 7, and as detailed in the Mass HIway Regulations.

The Mass HIway Regulations specify required HIway connection dates for the following defined types of Provider Organizations: Acute Care Hospitals, Large and Medium Medical Ambulatory Practices, and Large and Small Community Health Centers.  EOHHS may define additional types of provider organizations and establish HIway connection dates for those organizations through administrative bulletins or other official issuances. In this case, affected provider organizations will be given at least one year to connect to the Mass HIway.

Having a technical connection to the Mass HIway without using that connection is not sufficient to meet the HIway connection requirement.  The regulations describe that fulfilling the HIway connection requirement involves sending and/or receiving HIway Direct Messages for Use Cases.

2.3 Q: Are individual providers, such as physicians, nurse practitioners, pharmacists and laboratory technicians required to connect to the Mass HIway?

A: No, not at this time. Under the regulations (101 CMR 20.08) specified Provider Organizations are required to connect to the Mass HIway, rather than individual health care providers.

2.4 Q: What Provider Organizations are required to connect to the Mass HIway?

A: All provider organizations in Massachusetts are required to connect to the Mass HIway (M.G.L. Ch. 118I, Section 7). However, under the regulations (101 CMR 20.08), only the following types of  Provider Organizations currently have specified required HIway connection dates: Acute Care Hospitals, Large and Medium Medical Ambulatory Practices, and Large and Small Community Health Centers.

EOHHS may define additional types of provider organizations and establish HIway connection dates for those organizations through administrative bulletins or other official issuances. In this case, affected provider organizations will be given at least one year to connect to the Mass HIway.

2.5 Q: Why do the Mass HIway Regulations set required HIway connection dates for certain Provider Organizations, and not others?

A: The regulations set HIway connection dates for three types of Provider Organizations (i.e., Acute Care Hospitals, Large and Medium Medical Ambulatory Practices, and Large and Small Community Health Centers) and not for other types of provider organizations (e.g., nursing homes, dental clinics, behavioral health entities, Small Medical Ambulatory Practices, solo practices). The regulations implement this approach because these three types of Provider Organizations are more likely to have adopted health information technology earlier than other provider organizations, as they may have had access to federal funding to adopt EHR systems, and have more resources than other organizations to implement regulatory requirements.
Also, connecting these three types of organizations to the Mass HIway will create stronger clinical and business reasons for other provider organization types to connect at a later time.

M.G.L. Chapter 118I, Section 7 requires that all providers in the state connect to the Mass HIway. EOHHS anticipates that Provider Organizations that are not specified in the regulations will be required to connect in the future. The regulations (101 CMR 20.08(1b)) specify that future guidance will provide at least one year notice for affected provider organizations to connect to the Mass HIway.

2.6 Q: How does a Medical Ambulatory Practice determine if it is large, medium, or small for the purposes of the Mass HIway Regulations?

A: The regulations (101 CMR 20.06) establish that Large and Medium Medical Ambulatory Practices have 10 or more licensed providers participating in providing health care. (Large Community Health Centers are similarly defined as having 10 or more licensed providers participating in providing health care.) The number of participating providers is the total number of licensed providers that provide health care services to patients on behalf of the Provider Organization, regardless of employment status (e.g., including licensed providers that are full-time and part-time, permanent and temporary, seasonal and non-seasonal, per-diem and non-per-diem, contractor and employee) in the month of June prior to that organization’s initial required HIway connection date.

If a single Medical Ambulatory Practice or Community Health Center has one or more satellite locations, then licensed providers at both the main location and the satellite location(s) should be included when determining the total number of licensed providers.  For example, if a Community Health Center has 8 licensed providers at its main location, and 4 licensed providers at its satellite location, then it would have a total of 12 licensed providers and would therefore be a Large Community Health Center for the purposes of the regulations.

2.7 Q: How do the Mass HIway Regulations define a licensed provider?

A: In the definition of a Medical Ambulatory Practice and a Community Health Center, licensed providers are limited to include medical doctors, doctors of osteopathy, nurse practitioners and physician assistants. For the purposes of the regulations, a licensed provider does not include other providers such as social workers, physical therapists and registered nurses.

2.8 Q: How does a health care organization with multiple Provider Organizations fulfill the HIway connection requirement?

A: If a health care organization, including a health care system, consists of multiple Provider Organizations that have required HIway connection dates as specified in the HIway Regulations, then each Provider Organization must meet the HIway connection requirement.
For example, if a health care system includes multiple Acute Care Hospitals and Medical Ambulatory Practices with 10 or more licensed providers participating in health care, then each of these Acute Care Hospitals and Medical Ambulatory Practices are required to connect to the HIway. For another example, if a health care organization includes multiple Medical Ambulatory Practices with 10 or more licensed providers participating in health care, then each Medical Ambulatory Practice is required to connect to the HIway.

There is flexibility in how Provider Organizations establish the technical connection to the Mass HIway. For example, one health care system may choose to connect to the Mass HIway via a single technical connection, whereas a different system may choose to have separate connections for each of its different hospitals or provider groups.

2.9 Q: If a health care organization consists of multiple Provider Organizations that each have a required HIway connection date, may the health care organization use a single Attestation Form for multiple Provider Organizations?

A: Each Acute Care Hospital and each Community Health Center must complete a separate Attestation Form, even if the Hospital or Health Center is part of a larger organization.
However, if a health care organization includes multiple Medium or Large Medical Ambulatory Practices that have required HIway connection dates, then these Medium or Large Medical Ambulatory Practices can be included in a single Attestation Form if each of the practices (a) use the same instance of an EHR installation, and (b) use the same Direct address domain name.  If both criteria are met, then each of the Medium or Large Medical Ambulatory Practices that are being included in the Attestation Form should be listed as a “sub-organization” in Question 7 of the Attestation Form.

The Mass HIway may require Medical Ambulatory Practices to submit separate Attestation Forms as it deems necessary.  Health care organizations can contact the Mass HIway (via email, at MassHIwayAttestation@state.ma.us ) if they have questions regarding whether multiple practices can be included in a single Attestation Form.

2.10 Q: If a Provider Organization with a required HIway connection date is connected to the Mass HIway via a Mass HIway Integrator, may the Mass HIway Integrator submit a single Attestation Form on behalf of its member Provider Organizations or must each member Provider Organization attest for itself?

A: Each HIway Participant that is connected to the Mass HIway via a Mass HIway Integrator, and that is also a Provider Organization with a required HIway connection date, must attest for itself, as specified in FAQ #2.9.

A Mass HIway Integrator is defined (in Section 2.2.5 of the Mass HIway Policies and Procedures) as an organization that connects Mass HIway Participants to the Mass HIway. Integrators may include, but are not limited to, electronic health record (EHR) vendors, technical integrators, and regional health information organizations (RHIOs). Integrators use Mass HIway for HISP services.

2.11 Q: Are entities that facilitate the provision of telemedicine services required to meet the HIway connection requirement and submit an Attestation Form documenting compliance with the Mass HIway Regulations?

A: Entities that arrange for or contract with healthcare professionals for the provision of healthcare services remotely using telecommunications technology (also referred to as telemedicine) are not currently required to meet the HIway connection requirement and therefore are not required to submit an Attestation Form. At this time, the Mass HIway Regulations (101 CMR 20.08) specify required HIway connection dates for the following defined types of Provider Organizations: Acute Care Hospitals, Community Health Centers, and Large and Medium Medical Ambulatory Practices.

Entities that facilitate the provision of telemedicine services as described above are not classified as one of these types of Provider Organizations. However, the organizations that contract with or otherwise utilize such entities for telemedicine services may be one of these types of Provider Organizations; these organizations may be required to attest to meeting the connection requirement.

Entities that facilitate the provision of telemedicine services are welcome to become Mass HIway Participants, in order to exchange electronic health information with other Mass HIway Participants. M.G.L. Chapter 118I (Section 7) requires that all providers connect to the Mass HIway. EOHHS anticipates that Provider Organizations that do not yet have a date specified in the Regulations for their HIway connection requirement will be required to connect at a date that will be specified in the future. The Regulations (101 CMR 20.08(1b)) specify that future guidance will provide at least one year notice for affected provider organizations to connect to the Mass HIway.

2.12 Q: Is there help for Provider Organizations who want to connect to the Mass HIway?

A: Yes, the Mass HIway Account Management team can assist your organization through the process of enrollment, onboarding, and connection to the Mass HIway. Contact the team via email at MassHIway@state.ma.us or call 1-855-MA-HIway (624-4929) option 1 to get started.

3. The HIway connection requirement: how organizations fulfill the requirement

3.1 Q: What is the Mass HIway Connection Requirement?

A: The regulations implement the M.G.L. Chapter 118I's requirement that providers implement interoperable EHR systems that connect to the Mass HIway by using a phased-in approach:

• In Year 1, the connection requirement is fulfilled by sending or receiving HIway Direct Messages for at least one use case within any category of use cases. This includes public health and quality reporting.
• In Year 2, there must be at least one use case of sending or receiving within the category of provider-to-provider communications.
• In Year 3, Provider Organizations must both send and receive HIway Direct Messages for at least one use case in the provider-to-provider category.
• In Year 4, Provider Organizations that have not met the Year 3 requirement are subject to penalties by the HIway (see 101 CMR 20.14).
• For all years (Years 1 through 4), in order to attest to the HIway connection requirement, Provider Organizations must confirm that they have coordinated with the sending and/or receiving organization to establish that the organization is able to use the information sent/received. The goal is to use HIway Direct Messaging to replace less secure methods of sending and/or receiving information, such as fax or mail.

3.2 Q: What is the definition of a Use Case in the HIway connection requirement?

A: A Use Case is defined (101 CMR 20.04) as a narrative that describes how to accomplish a business goal that can be implemented between two or more organizations.  Categories of Use Cases include the following:

• Provider to Provider Communications (e.g., an Acute Care Hospital sending discharge summary to a primary care provider)
• Payer Case Management
• Quality Reporting
• Public Health Reporting (e.g., sending immunization information to the state Department of Public Health)

Having a technical connection to the Mass HIway without using that connection is not sufficient to meet the HIway connection requirement.  The regulations describe (101 CMR 20.08) that fulfilling the HIway connection requirement involves sending and/or receiving HIway Direct Messages for Use Cases.

EOHHS expects that the Provider Organization will use HIway Direct Messaging, to the extent feasible, for all instances of information sharing that are a part of the implemented Use Case, regardless of the number of HIway Direct Messages transmitted as part of the implemented Use Case.

Implementation of a Use Case involves using HIway Direct Messaging as part of an ongoing workflow, and therefore using HIway Direct Messaging for a pilot project, or being in a testing phase of using HIway Direct Messaging, is not considered to be a fully implemented a Use Case.

3.3 Q: Can a Provider Organization fulfill the HIway connection requirement if it sends or receives HIway Direct Messages as part of a pilot project or as part of the testing phase of implementing a Use Case?

A: No. To fulfill the HIway connection requirement of sending or receiving HIway Direct Messages, a Provider Organization must implement a Use Case that involves HIway Direct Messages as part of an ongoing workflow, and not just part of a pilot project or the testing phase of a use case.

3.4 Q: The Attestation Form states that “an authorized individual … should complete and submit this form.” Who is considered an authorized individual??

A: The “authorized individual” for your Provider Organization is a person authorized by the organization to act on its behalf on this matter. It is up to the organization to decide who that person is.

3.5 Q: Do the Mass HIway Regulations allow Provider Organizations to fulfill the HIway connection requirement with health information exchanges outside the Mass HIway?

A: All Provider Organizations with a HIway connection date that is specified in the regulations are required to connect to the Mass HIway even if they are connected to other health information exchanges. However, under the regulations (101 CMR 20.15(1d)) a Provider Organization may be granted a waiver if it successfully implements provider to  provider direct messaging outside of the Mass HIway (e.g., using a non-Mass HIway HISP) and does not have any trading partners on the Mass HIway to implement a provider to provider communications use case. In this case, the Provider Organization still must demonstrate the technical capability to send and receive HIway Direct Messages with a HIway Participant. This provision supports the Mass HIway's mission to provide interoperability across the state and provide health information exchange that is accessible to all eligible Provider Organizations statewide regardless of size, location or level of technology.

3.6 Q: Can the same Use Case be used in the Attestation Form of consecutive years?

A: A Provider Organization may rely on the same Use Case when completing an Attestation Form in consecutive years if that Use Case otherwise meets the Provider Organization’s HIway connection requirement for the applicable year.   For example, if a Provider Organization described a Use Case that is in the Provider to Provider Communications category of Use Cases in its Year 1 Attestation Form, then that Provider Organization could describe the same Use Case in its Year 2 Attestation Form, if that Use Case still was being utilized in Year 2. In this example, updated information (e.g., the estimated message volume for this Use Case) should be provided in the Year 2 Attestation Form.

3.7 Q: When should a Provider Organization submit its Attestation Form?

A: Provider Organizations must wait until the attestation period to submit webforms on the HIway's website. Click here to access these webforms. The HIway no longer accepts submitted PDF forms. In 2020, the attestation period is scheduled for Aug. 1-Dec. 31. To receive updates, please click here to subscribe to the HIway newsletter. 

3.8 Q: What must a Provider Organization do if it does not meet HIway connection requirement?

A: If a Provider Organization does not meet its annual HIway connection requirement, then instead of completing an Attestation Form, an authorized representative of the Provider Organization is required to submit an HIE Requirement Exception Form (accessible here) explaining why the Organization did not meet the connection requirement and summarizing its plans to meet the connection requirement going forward.:

Note: If an Organization did not meet its connection requirement this year, it is still expected to meet next year's connection requirement (e.g., if an Organization did not meet its Year 2 HIway connection requirement this year, it is still expected to meet the Year 3 requirement next year).

As required by M.G.L. c. 118I, Section 8, the Mass HIway Regulations (101 CMR 20.13-20.16) establish penalties for not meeting the HIway connection requirement. These penalties may begin in Year 4 of a Provider Organization's HIway connection requirement.

3.9 Q: Does a Provider Organization with a Mass HIway connection requirement need to have a MassHIway.net direct address to meet the requirement?

A: No. A Provider Organization without a HIway direct address can meet the connection requirement by sending or receiving HIway Direct Messages using a HIway Trusted Health Information Service Provider (HISP) connection during the transmission of information. (See Section 2.2.4 of the Policies and Procedures for a definition of HIway Trusted HISP.) For a list of HIway Trusted HISPs, visit this page.”

If you are sending public health information (for example, immunization data to the Massachusetts DPH) via the HIway, then you are sending HIway Direct Messages. A HIway Trusted HISP connection is being used to send or receive HIway Direct Messages if either the sender or receiver of the transmission is using a HIway direct address for the transmission. If the Mass HIway is not utilized by the sender and/or receiver, the transmission does not satisfy the HIway connection requirement.

3.10 Q: Do use case transmissions need to feature “bidirectional” exchanges, where a Provider Organization sends a transmission and receives a reply (or vice versa)?

A: No, transmissions of HIway Direct Messages do not need to be bidirectional in order to meet the HIway connection requirement. The reasoning is different for Years 1 and 2 and Year 3.

For Years 1 and 2, transmissions do not need to be bidirectional because Provider Organizations can satisfy the HIway connection requirement by sending or receiving HIway Direct Messages, as explained in the Mass HIway Regulations (101 CMR 20.08(3)).

To meet the HIway connection requirement for Year 3, Provider Organizations must send and receive HIway Direct Messages for at least one provider-to-provider use case. However, Provider Organizations do not need to send a transmission and receive a reply (or vice versa) in order for that use case to meet the HIway connection requirement. Provider Organizations can fulfill the requirement to send and receive provider-to-provider transmissions with completely separate transmissions: one transmission can fulfill the requirement to send, and another can fulfill the requirement to receive.

EXAMPLE: Medical Ambulatory Practice X could fulfill the Year 3 HIway connection requirement by sending progress notes via HIway Direct Messaging to a primary care practice and by also receiving discharge summaries via HIway Direct Messaging from Acute Care Hospital Y. In this scenario, Medical Ambulatory Practice X would not be required to receive HIway Direct Messages from that primary care practice or to send HIway Direct Messages to Hospital Y in order to meet the Year 3 HIway connection requirement.

3.10 Q: Provider Organizations are required to provide a National Provider Identifier (NPI) on their Attestation Form. What should I do if my Provider Organization has multiple NPIs?

A: If your organization (and any sub-organizations that may be included on your attestation form) has multiple NPIs, then for answer 4 of the Attestation Form, enter any single NPI. If your organization does not have an NPI, then enter “9999999999” (i.e., ten nines).

3.12 Q: Can a Provider Organization fulfill the HIway connection requirement if it uses a third-party vendor, such as reporting software that connects to the HIway, to provide immunization records to the state Immunization Information System?

A: Yes. Such a use case would fulfill the Year 1 HIway connection requirement because the receiver (i.e., MIIS) is using a HIway Direct address, and therefore HIway Direct Messaging is being used. However, this would not fulfill a Provider Organization’s requirement for Year 2-4, when at least one provider-to-provider use case is required.

3.13 Q: The Attestation Form states that “an authorized individual … should complete and submit this form.” Who is considered an authorized individual?

A: The “authorized individual”/“authorized representative” for your Provider Organization is a person authorized by the organization to act on its behalf on this matter. It is up to the organization to decide who that person is.

4. Penalties for non-compliance with the HIway connection requirement

4.1 Q: When do the penalties for non-compliance with the HIway connection requirement take effect?

A: Under the phased-in approach implemented by the regulations (101 CMR 20.13 and 20.14), penalties for non-compliance with the HIway connection requirement do not take effect until Year 4 of the connection requirement (i.e., in January 2020, at the earliest)

4.2 Q: What are the penalties for not meeting the HIway connection requirement?

A: Under the regulations (101 CMR 20.14), penalties range from $1,000 to $30,000 per year based on Provider Organization type.

4.3 Q: What is the appeals process related to penalty determinations made by EOHHS?

A: Under the regulations (101 CMR 20.16), there is a "Reconsideration and Appeals Process" which includes the method by which: (a) EOHHS will notify Provider Organizations that fail to comply with the HIway connection requirement, (b) Provider Organizations can request EOHHS to review and reconsider their penalty determination, and (c) Provider Organizations can appeal EOHHS' final determination to assess a penalty for not meeting the HIway connection requirement.

5. The opt-in opt-out mechanism for the Mass HIway

5.1 Q: How does the opt-in / opt-out mechanism impact HIway Direct Messaging?

A: The Mass HIway’s centralized opt-in/opt-out mechanism does not apply to HIway Direct Messaging Mass HIway Users may transmit information via HIway Direct Messaging in compliance with applicable federal privacy laws and regulations (such as HIPAA and 42 CFR Part 2) and state privacy laws and regulations (such as M.G.L. Chapter 93H), similar to sending such information via fax message.

HIway Participants may elect to implement local opt-in and/or opt-out mechanisms that apply to their organization's use of HIway Direct Messaging. This option was provided in recognition of stakeholder input that some organizations wanted to implement a local process.

5.2 Q: How does the opt-in/opt-out mechanism impact HIway-Facilitated Services?

A: The Mass HIway’s centralized opt-in/opt-out mechanism does not apply to HIway-Facilitated Services. Mass HIway Users may transmit information via HIway-Facilitated Services in compliance with applicable state and federal privacy laws and regulations (such as HIPAA and 42 CFR Part 2) and state privacy laws and regulations, similar to sending such information via fax message.

HIway Participants may elect to implement local opt-in and/or opt-out mechanisms that apply to their organization’s use of HIway-Facilitated Services.

5.3 Q: What is the opt-in component of the Mass HIway’s centralized opt-in/opt-out mechanism for HIway-Sponsored Services?

A: Under the regulations (101 CMR 20.07(3a)), all HIway Participants must provide each patient and/or their legal representative with written notice of how the organization uses HIway-Sponsored Services, and that written notice must be provided by at least one of the following methods: (a) inclusion in the HIway Participant’s privacy notice; (b) patient handout; or (c) letter, email, or other personal electronic communication to patients. However, because there are currently no HIway-Sponsored Services, this provision is not currently applicable.

5.4 Q: What information for patients is available about HIway Direct Messaging?

A: : A Mass HIway Fact Sheet for Patients is available here. Provider Organizations that use HIway Direct Messaging are not required to give this document to each patient, but Provider Organizations can make the document available to patients if they chose to do so. For more information, patients can also visit the “Patients and Families” section on the Mass HIway website.

Patients can contact the Mass HIway directly by calling 1-855-MA-HIway (624-4929) Option 3 or emailing MassHIway@state.ma.us with questions about the Mass HIway.

5.5 Q: Will EOHHS provide a sample written notice?

A: EOHHS intends to provide a sample written notice closer to the time that HIway- Sponsored Services are launched.

5.6 Q: What is the EOHHS Market-Based ENS Initiative?

A: The EOHHS Market-Based ENS Initiative is a HIway-facilitated Service that will create a statewide event notification service (ENS) framework to increase ENS availability to providers throughout the Commonwealth. The statewide ENS framework will allow providers (e.g., a primary care physician) to receive notifications about certain patient medical service encounters, such as when a patient is admitted to or discharged from a hospital (101 CMR 20.04).

To support the EOHHS Market-Based ENS Initiative, Acute Care Hospitals are required to send Admission, Discharge, and Transfer notifications (ADTs) to a Certified ENS Vendor by April 1, 2020, as set forth in 101 CMR 20.08(4). For more information, please see the HIway’s Administrative Bulletin 19-20 issued on November 25, 2019.

5.7 Q: Are Provider Organizations allowed to implement local opt-in or opt-out processes?

A: Yes. HIway Participants may elect to implement additional local opt-in and/or opt-out processes that apply to their organization's use of HIway-Sponsored Services (101 CMR 20.07(2c)). If a Mass HIway Participant chooses to implement a local process, then it must supplement, and not replace the HIway's opt-in and opt-out mechanism.

5.8 Q: Do the opt-in opt-out provisions of the regulations apply to local or regional health information exchanges?

A: No. The opt-in opt-out provisions of the regulations (101 CMR 20.07) apply to use of the Mass HIway. Local, regional, or private health information exchanges may develop their own policies and procedures regarding opt-in and opt-out that comply with all applicable laws and regulations. These policies and procedures may be similar to the opt-in opt-out provisions in the Mass HIway Regulations.

6. The requirements regarding Electronic Health Records (EHRs)

6.1 Q: Do the Mass HIway Regulations require that all providers in the Commonwealth have an interoperable EHR that connects to the HIway?

A: The regulations give Provider Organizations flexibility to connect to the Mass HIway via an EHR or other means presented in Section 5.1 of the Mass HIway Policies & Procedures. These include: (a) an EHR’s Direct XDR connection, (b) a (Mass HIway-supplied “Connect Device” (formerly known as a “LAND) device”) connection, (c) a Webmail connection, (which does not require an EHR), (d) a HIway Trusted HISP, or (e) any other method approved by the Mass HIway.

Currently, only Acute Care Hospitals, Large and Medium Medical Ambulatory Practices, and Large and Small Community Health Centers are required to connect to the Mass HIway.

7. The Mass HIway Policies & Procedures 

7.1 Q: What are the Mass HIway Policies & Procedures?

A: The Mass HIway Policies & Procedures is the document that details the rules that govern access to and use of the Mass HIway. Under the regulations (101 CMR 20.05), all Mass HIway Users are required to comply with the Mass HIway Policies & Procedures. The current version of the Mass HIway Policies & Procedures is Version 4, updated December 1, 2017 and is available here .

7.2 Q: What fees are associated with the use of the Mass HIway?

A: The fee schedule for using the Mass HIway is provided in the Mass HIway Policies & Procedures. This fee schedule establishes different tiers of HIway Participants, with larger participants (e.g., a large hospital) having higher fees than smaller ones (e.g., a small ambulatory practice). The current fees for using the Mass HIway are less than typical fees for health information exchange services, in order to achieve the HIway's mission of enabling health information exchange by all health care providers in the state, regardless of affiliation, location, or differences in technology.

8. FAQs regarding Community Health Centers

8.1 Q: How does a Community Health Center determine if it is large or small for the purposes of the Mass HIway Regulations?

A: The answer to this question is provided in FAQ #2.6.

8.2 Q: If a single Community Health Center has one or more satellite locations or school-based satellite clinics, does each of these satellite locations need to submit a separate Attestation Form?

A: As discussed in FAQ #2.6, if a Community Health Center has a satellite location or a school-based satellite clinic, then the satellite does not need to submit a separate Attestation Form.

8.3 Q: If a Community Health Center uses both a primary EHR system and additional EHR systems for separate departments of the Health Center, are multiple Attestation Forms required?

A: Multiple Attestation Forms are not necessary for separate departments. The Community Health Center can complete and submit a single Attestation Form. The form should provide information regarding the Community Health Center’s primary EHR system.

9. FAQs regarding Medical Ambulatory Practices

9.1 Q: Is a Limited Services Clinic or a Freestanding Urgent Care Facility a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations?

A: Limited Services Clinics (as defined in 105 CMR 140.000 et seq.) and Freestanding Urgent Care Facilities (as defined by the Massachusetts Department of Public Health) are not Medical Ambulatory Practices for the purposes of the Mass HIway Regulations. Therefore, these provider organizations do not yet have a required HIway connection date. However, these provider organizations are welcome to become Mass HIway Participants, in order to exchange electronic health information with other Mass HIway Participants.

M.G.L. Chapter 118I (Section 7) requires that all providers connect to the Mass HIway. EOHHS anticipates that additional Provider Organizations will be required to connect under the regulations (101 CMR 20.08(1b)), affected provider organizations will be given at least one year notice before they must connect to the Mass HIway.

9.2 Q: Is a behavioral health practice a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations?

A: A provider organization that exclusively delivers behavioral health services is not a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations. However, an ambulatory practice that provides both primary care and behavioral health services is a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations.

Although provider organizations that exclusively deliver behavioral health services do not yet have a required HIway connection date specified in the regulations, these provider organizations are welcome to become Mass HIway Participants, in order to exchange electronic health information with other Mass HIway Participants.

M.G.L. Chapter 118I (Section 7) requires that all providers connect to the Mass HIway. EOHHS anticipates that additional Provider Organizations will be required to connect under the regulations (101 CMR 20.08(1b)) affected provider organizations will be given at least one year notice before they must connect to the Mass HIway.

9.3 Q: Is an out-of-hospital dialysis clinic a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations?

A: An out-of-hospital dialysis clinic (as defined by 105 CMR 145.000 ) is not a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations.

Although out-of-hospital dialysis clinics do not yet have a required HIway connection date that is specified in the regulations, these provider organizations are welcome to become Mass HIway Participants, in order to exchange electronic health information with other Mass HIway Participants.

M.G.L. Chapter 118I (Section 7) requires that all providers connect to the Mass HIway. EOHHS anticipates that additional Provider Organizations will be required to connect under the regulations (101 CMR 20.08(1b)) affected provider organizations will be given at least one year notice before they must the Mass HIway.

9.4 Q: If a medical practice is providing both specialty inpatient and specialty outpatient health care services within the facilities of an Acute Care Hospital, then is this medical practice considered a Medical Ambulatory Practice?

A: A medical practice that provides both specialty inpatient and specialty outpatient health care services within the facilities of an Acute Care Hospital is not considered a Medical Ambulatory Practice under the Mass HIway Regulations if the following two criteria are met:

1. a majority of patients that the Provider Organization delivers services to are receiving services within an Acute Care Hospital’s facilities, and
2. the Provider Organization uses the same instance of an EHR system installation that the Acute Care Hospital uses.

In the second criterion, if the medical practice and the Acute Care Hospital both use an EHR system that is made by the same vendor, but they use different instances of an EHR system installation, then this criterion has not been met.

For example, consider the case of a medical practice that consists of a group of emergency room physicians that exclusively cares for patients within the facilities of an Acute Care Hospital’s emergency department, and this medical practice uses the same instance of the Acute Care Hospital’s EHR system. In this case the medical practice of emergency room physicians is not considered a Medical Ambulatory Practice for the purpose of the regulations because: (1) all the patients they care for are receiving services within the Acute Care Hospital’s facilities, and (2) the physicians in this medical practice use the same instance of an EHR system implementation as the Acute Care Hospital. Since this medical practice of emergency room physicians is not considered to be a Medical Ambulatory Practice for the purposes of the regulations, then at this time, it does not have a required HIway connection date and it is not required to submit an Attestation Form.

9.5 Q: Is an optometry practice a Medical Ambulatory Practice for the purposes of the Mass HIway Regulations?

A: It depends. Per section 20.06(3) of the Mass HIway Regulations, licensed providers are limited to include medical doctors, doctors of osteopathy, nurse practitioners, and physician assistants. Under the Regulations, optometrists are not included in the definition of licensed providers. Therefore, if an optometry practice includes not just optometrists, but also 10 or more licensed providers participating in providing patient care, then the practice would meet the definition of a Medium or Large Medical Ambulatory Practice under the Mass HIway Regulations, and would have a HIway connection requirement.

As per Section 20.08(1) of the Mass HIway Regulations, Provider Organizations that do not yet have required HIway connection dates specified in the Regulations may in the future have a required HIway connection date, and if so, this requirement would be made at least one year in advance.

10. Other FAQs

10.1 Q: Can patients access their electronic health records via the Mass HIway?

A: No. At this time, the Mass HIway does not include a function for patients to access their electronic health records via the Mass HIway. The Mass HIway does not currently function as a clinical data repository that holds electronic medical records for individuals. Patient electronic health record(s) are held by specific provider organizations, and these records are not made available to the Mass HIway. Therefore, as provided in Mass HIway Policies & Procedures (Section 9.1.1), patients may request a copy of their medical record from the healthcare provider that holds the record.

10.2 Q: How do the Mass Regulations protect patient privacy?

A: The regulations maintain protection of patient privacy in several important ways. Any disclosure made over the Mass HIway must comply with state and federal privacy rules. Impermissible use or disclosure of individually identifiable patient health information by or through the Mass HIway is prohibited, and violators may be subject to penalties established under applicable state or federal law regarding the protection and privacy of personal information. The Mass HIway Policies & Procedures (Section 12.4.6) authorize the Mass HIway to suspend a HIway Participant's access to the Mass HIway as required to prevent impermissible uses of the Mass HIway. In addition, under the regulations (101 CMR 20.07) the opt-in opt-out mechanism for the Mass HIway ensures that each patient receives written notice describing how a Provider Organization uses HIway-Sponsored Services, and also provides a mechanism by which patients can opt-out of participating in these services.

10.3 Q: How can stakeholders keep up to date regarding the Mass HIway Regulations and forthcoming updates from the Mass HIway?