8707.1 A registered HIE entity shall require its enrolled participating organization to comply with the consumer participation, access, and education requirements set forth in this section.

8707.2 A participating organization shall provide written notice to each health care consumer no later than the first medical encounter following enrollment of the organization in a registered HIE entity, of:

(a) Such organization's participation with a registered HIE entity, including in such organization's Notice of Privacy Practices under HIPAA. DHCF will provide further policy guidance on Notice of Privacy Practices on its website at www.dhcf.dc.gov;

(b) Information concerning the health care consumer's ability to opt out from participation in the registered HIE entity and the process of opting out; and

(c) The types of information the participating organization shall disclose to the registered HIE entity and the extent that information accessed through the HIE entity may be used for treatment, payment, health care operations, and Secondary Use, as defined in § 8703.4.

8707.3 A registered HIE entity shall provide written information to health care consumers concerning the process, means, and methods of accessing their PHI as follows:

(a) If the health care consumer's PHI is directly available electronically to the health care consumer, the registered HIE entity shall advise the health care consumer how to obtain the PHI electronically; and

(b) If the health care consumer's PHI is not directly available electronically to the health care consumer, the registered HIE entity shall, within nine (9) calendar days of receipt of a health care consumer's written notice or request, provide the health care consumer with the contact information for each participating organization that has access to the consumer's PHI, so that the health care consumer may gain access to the health care consumer's health information directly from each participating organization.

SOURCE: Final Rulemaking published at 66 DCR 8346 (July 19, 2019); as amended by Final Rulemaking published at 73 DCR 006876 (May 1, 2026).