8712.1 DHCF may exempt a registered or designated HIE entity from certain requirements if such an exemption does not pose substantial risks to the privacy or security of health care consumers and:

1. (a) The HIE entity's infrastructure does not allow the registered or designated HIE entity to maintain compliance with this chapter; or
2. (b) The requirements of this chapter would cause an undue burden or hardship on the registered or designated HIE entity.

8712.2 A registered or designated HIE entity may request a one (1) year exemption from specific requirements set forth in this rule. An exemption request must:

1. (a) Be made in writing;
2. (b) Identify each specific requirement of this chapter from which the HIE entity is requesting an exemption;
3. (c) Identify the requested time period of the exemption;
4. (d) State the reason for each exemption request; and
5. (e) Include information that justifies the exemption request.

8712.3 Within forty-five (45) calendar days after receipt of complete information from a registered or designated HIE entity requesting an exemption, DHCF shall take one of the following actions:

1. (a) Grant the exemption by providing written notification;
2. (b) Request additional documentation from the HIE entity regarding the need for an exemption; or
3. (c) Deny the exemption request by providing written notification that enumerates the reasons for the denial to the registered or designated HIE entity.

8712.4 An exemption may not be made for any requirement within this rule that is required of a registered or designated HIE entity by federal or other District law.

8712.5 For good cause shown, DHCF may renew a one (1)-year exemption for up to an additional one (1) year period, upon request by the registered or designated HIE

entity.

SOURCE: Final Rulemaking published at 66 DCR 8346 (July 19, 2019); as amended by Final Rulemaking published at 73 DCR 006876 (May 1, 2026).