8702.1 An HIE entity wishing to participate in the DC HIE must apply for registration in a form and manner consistent with this section and policy guidance provided by DHCF. Application materials and guidance will be published by DHCF on its website at www.dhcf.dc.gov.

8702.2 HIE entities applying for registration shall comply with the requirements of the chapter and demonstrate they meet the following minimum criteria:

1. (a) The HIE entity or its managing business organization, is a business organization established under District or applicable state laws;
2. (b) The HIE entity or its managing business organization maintains a general business liability insurance and cyber liability insurance for the operation of the HIE entity;
3. (c) The HIE entity maintains a professional staff responsible to a governing body that has the capacity to ensure accountability to the organization's mission;
4. (d) The HIE entity can query health care consumer information in accordance with the requirements for accessing, using or disclosing health information through an HIE set forth under this chapter;
5. (e) The HIE entity submits the results of its latest third-party privacy and security audit;
6. (f) The HIE entity submits a policy that ensures reasonable notice will be provided to its participating organizations if the HIE entity ceases its operations or dissolves its services in the District of Columbia. The HIE entity's policy submission shall be consistent with requirements set forth in guidance provided by DHCF and published on DHCF's website at www.dhcf.dc.gov;
7. (g) The HIE entity shall provide a report for each of the past three (3) years, from a third-party auditor that expresses no doubt about the entity's ability to continue as a going concern and resulting in an unqualified opinion concerning the HIE entity's financial statements;
8. (h) The HIE entity attests that no disciplinary actions were taken by federal, District, or state agencies against the entity, its principals, or officers in the three (3) years prior to applying for registration;

(i) If the HIE entity is not domiciled in the District of Columbia, the HIE entity shall provide the contact information of registered resident agent who shall accept service in the District of Columbia on behalf of the HIE entity;

(j) The HIE entity provides DHCF with a copy of its user access control policy;

(k) The HIE entity provides DHCF with a copy of its Notice of Privacy Practices and consumer opt-out form;

(l) The HIE entity submits its Incident Response Plan to DHCF;

(m) At the time of application, an HIE entity operating in the District of Columbia that applies for registration, shall meet or exceed the access, use, and disclosure requirements set forth in this chapter; and

(n) The HIE entity complies with any other requirements or requests for information made by DHCF, either directly or through policy guidance published on its website at www.dhcf.dc.gov.

8702.3 DHCF retains the right to waive certain application requirements or exempt an HIE entity from certain application requirements set forth in § 8702.2 in accordance with the provisions set forth in § 8712.

8702.4 Within ninety (90) calendar days after receipt of complete information from an applicant seeking to register as an HIE entity in the District of Columbia, DHCF shall take one of the following actions:

(a) Approve the registration application;

(b) Deny the registration application for failure to meet requirements for registration set forth in § 8702.2 to the applicant in writing; or

(c) Request additional information from the applicant, in writing, to determine an HIE entity's eligibility for registration.

8702.5 HIE entities that are denied registration, in accordance with § 8702.4, shall have the opportunity to appeal DHCF's determination in accordance with the procedure for appeals and administrative review as set forth in § 8713.

8702.6 As a condition of participation in the DC HIE, registered HIE entities shall:

(a) Submit operational information, as requested by DHCF, and ensure it is publicly posted on a DC-registered HIE's website; and

(b) Comply with requirements for participation in the DC HIE set forth in this chapter or established by DHCF in policy guidance published on its website at www.dhcf.dc.gov.

8702.7 An HIE entity's registration shall be awarded in three (3) year terms. DHCF shall review an HIE entity's registration every three (3) years from the date of registration in accordance with requirements in § 8702.8 to determine whether the entity will be renewed for an additional three (3) year term.

8702.8 In order to renew their registration HIE entities shall demonstrate continued compliance with § 8702 by providing the following information no later than ninety (90) calendar days prior to the end of the three (3) year term and in a form and manner specified by DHCF:

(a) Any changes to information submitted with regard to the items set forth in § 8702.2 that affect the veracity of a prior submission; and

(b) Results of a scheduled audit performed in compliance with § 8704.

SOURCE: Final Rulemaking published at 66 DCR 8346 (July 19, 2019); as amended by Final Rulemaking published at 73 DCR 006876 (May 1, 2026).