This chapter provides for the certification of electronic health networks and medical care electronic claims clearinghouses that operate in Maryland. Payors that accept electronic health care transactions originating in Maryland may only accept electronic health care transactions from electronic health networks or medical care electronic claims clearinghouses that obtain certification pursuant to this chapter. This chapter applies to: An electronic health network, as defined in Regulation .02 of this chapter; and The State-designated health information exchange or State-designated HIE as designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth under Health-General Article, §19-143, Annotated Code of Maryland.. In this chapter, the following terms have the meanings indicated. Terms Defined. “Adjudication of claims” means the activities necessary for the adjudication or subrogation of a health benefit claim that has been filed or may be filed by a patient, or with the authorization of a patient on the patient’s behalf, including: Determinations of eligibility or coverage, including coordination of benefits or the determination of cost-sharing amounts; Reasonable prospective, concurrent, or retrospective utilization review or predetermination of benefit coverage; Review, audit, and investigation of a specific claim for payment of benefits with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; Billing, claims management, collection activities, obtaining payment under a contract for reinsurance, and related health care data processing; and Risk adjustments based on enrollee health status and demographic characteristics. “Commission” means the Maryland Health Care Commission. “Disclose” or “disclosure” means the release, redisclosure, transfer, provision, access, transmission, communication, or divulgence in any other manner of health information, including an acknowledgement that a health record on a particular patient or recipient exists outside the entity holding the information. “Electronic health care transactions” means health care transactions that have been approved by a nationally recognized health care standards development organization (SDO) to support health care informatics, information exchange, systems integration, and other health care applications. “Electronic Health Network (EHN)” means an entity involved in the exchange of electronic health care transactions between electronic health networks, payors, providers, vendors, or other entities. “Entity” means a partnership, firm, association, limited liability company, limited liability partnership, or a public or private corporation. “Grievance” means a written complaint or other information received by the Commission indicating that an MHCC-certified EHN may have violated one of the provisions of Regulation .09 of this chapter. “Health information” means any information, whether oral or recorded in any form or medium, including electronic health information, that: Is created or received by a health care provider, health plan, public health authority, employer, life insurer, or health care clearinghouse; and Relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual. “Improvement of patient safety” means actions, strategies, or protocols to prevent health care errors, enhance the quality of care, and ensure a safe health care environment. “Legally protected health information” means the health information with a date of service after May 31, 2022, that is subject to restrictions under Health-General Article, §4-302.5, Annotated Code of Maryland, and COMAR 10.11.08, including: Mifepristone data, as defined by the Secretary; and As specified by the Secretary, the diagnosis, procedure, medication, and other codes related to: Abortion care; and Sensitive health services, as defined by Health-General, §4-301, Annotated Code of Maryland. Medical Care Electronic Claims Clearinghouse. “Medical care electronic claims clearinghouse” is an entity that transmits electronic health care transactions. “Medical care electronic claims clearinghouse” includes an electronic health network. “MHCC” means the Maryland Health Care Commission. “MHCC-Certified Electronic Health Network” means an entity that has received certification from the Maryland Health Care Commission. “Mitigation of a public health emergency” means taking actions to lessen the impact of a public health emergency and reduce harm, including implementing preventive measures, managing resources, and coordinating responses to limit disease spread, minimize health risks, and support affected communities effectively. “Payor” means an entity that administers or provides reimbursement for health care benefits on an expense-incurred basis, including: A health maintenance organization issued a certificate of authority in accordance with Health-General Article, Title 19, Subtitle 7, Annotated Code of Maryland; A health insurer or nonprofit health service plan authorized to offer health insurance policies or contracts in this State in accordance with Insurance Article, Title 14, Annotated Code of Maryland; A third-party administrator registered under Insurance Article, Title 8, Subtitle 3, Annotated Code of Maryland; An entity that subcontracts with a third-party payor to provide specialty health care services including, but not limited to, a dental benefit payor, a vision benefit payor, a mental health benefit payor, and a pharmacy benefit manager; or A managed care organization that contracts with the Maryland Medical Assistance program to provide health services to Maryland Medical Assistance recipients in accordance with Health-General Article, Title 15, Subtitle 1, Annotated Code of Maryland. “State-designated health information exchange” or “State-designated HIE” means a health information exchange designated by the Maryland Health Care Commission and the Health Services Cost Review Commission pursuant to the statutory authority set forth under Health-General Article, §19-143, Annotated Code of Maryland. “State health improvement program” means a State initiative designed to enhance public health through strategic planning, targeted interventions, and collaboration with stakeholders and the federal government, including State efforts in support of the Total Cost of Care model and successor models agreed to by the federal government and the State. “Qualified accreditation or certification organization” means a nationally recognized entity that has established privacy and security standards for electronic health networks and accredits or certifies networks that meet those standards. A certification is valid for a 2-year period from the date of certification unless withdrawn by the Commission prior to the end of the 2-year period. Application for Certification. An EHN seeking Commission certification shall: Complete and submit an application for MHCC Electronic Health Network Certification in the form and manner specified by the Commission; Provide evidence that it has been granted either candidacy status or full accreditation or certification status by a qualified accreditation or certification organization; and Meet all Commission certification requirements set forth in Regulation .05 of this chapter. Fees. An application fee shall be paid to the Commission within 30 days of receipt of an invoice from the Commission. For an electronic health network with one operational site, an application fee of $400 shall be paid within 30 days of receipt of an invoice from the Commission. For an electronic health network with more than one operational site, an application fee of $400, plus a $200 fee for each additional operational site, shall be paid within 30 days of receipt of an invoice from the Commission. In order to obtain certification, an applicant shall: Provide evidence that the applicant is accredited or certified by a qualified accreditation or certification organization; and Meet the following standards for certification: Demonstrate compliance with the HIPAA privacy standards set forth in 45 CFR Parts 160 and 164; Demonstrate compliance with HIPAA security standards set forth in 45 CFR Parts 160, 162, and 164; Provide an attestation signed by an officer of the applicant that to the extent required by Health-General Article, §4-302.5, Annotated Code of Maryland, the applicant: Possesses the technological capability to filter and restrict from disclosure legally protected health information; Is parsing restricted codes and conveying all other information in the health record that is not prohibited by law to exchange; and Possesses the technological capacity to allow a consumer to request and consent to the exchange of legally protected health information to a specific treating provider; Provide evidence of ability to measure technical performance and manage future capacity demands; Provide evidence of initial and ongoing employee training in HIPAA privacy and security requirements and customer communication procedures; and Provide additional information requested by the Commission as necessary to determine the applicant's compliance with the standards for certification. The Commission shall issue certification to an applicant that has met all the requirements of §A of this regulation. Subject to the provisions of this section, the Commission shall issue candidacy status to an applicant that: Has been granted candidacy status by a qualified accreditation or certification organization; Has submitted an application for certification to the Commission; Has paid the application fee; and Has submitted documentation satisfactory to the Commission demonstrating compliance with the requirements set forth in Regulation .05B of this chapter. The Commission shall issue candidacy status to an applicant that has met all the requirements of §A of this regulation. An applicant that has achieved candidacy status may transmit electronic health care transactions while completing the certification requirements of this chapter. Candidacy status expires on the expiration of the applicant's candidacy status with a qualified accreditation or certification organization, on the approval of certification by the Commission, or 2 years from the date that candidacy status was issued. Within 30 days after the closure, sale, lease, assignment, or transfer of an MHCC-certified EHN to any person or entity, the MHCC-certified EHN and the other party to the transaction shall notify the Commission of that event. Upon such notice, the Commission may seek further information to determine whether the certification should remain in effect notwithstanding the sale or other event. At least 60 days before changing its address, an MHCC-certified EHN shall notify the Commission of its intent and provide the Commission with the new address. At least 60 days before changing its name, an MHCC-certified EHN shall notify the Commission of its intent to change its name and provide the Commission with the new name. Application for renewal of certification shall be made at least 60 days before the expiration of the certification in a form and manner specified by the Commission. A recertification fee shall be paid to the Commission at the time the MHCC Electronic Health Network recertification application is filed. For an electronic health network with one operational site, a recertification fee of $250 shall be paid at the time the application is filed. For an electronic health network with more than one operational site, a recertification fee of $250, plus a $125 fee for each additional operational site, shall be paid at the time the application is filed. The Commission shall renew the certification of each renewal applicant that continues to meet the standards set forth in Regulation .05 of this chapter. The Commission shall issue a renewal of certification to an applicant that has met all the requirements of this regulation. An MHCC-certified EHN shall submit electronic health care transactions information in accordance with this regulation to the State-designated HIE for public health and clinical purposes to facilitate: A State health improvement program; Mitigation of a public health emergency; Improvement of patient safety; or The participation of the State in the Center for Medicare and Medicaid Innovation’s Achieving Healthcare Efficiency through Accountable Design (AHEAD) model and any successor models. Transactions to be Submitted. An MHCC-certified EHN shall submit electronic health care transactions information for services delivered in Maryland to the State-designated HIE that consist of the following transactions: Health care claim or equivalent encounter information (837P and 837I); and Health plan eligibility inquiry and response (270). Only the EHN that receives the transaction from or returns the transaction to the originating submitter directly is required to submit the transaction information to the State-designated HIE. The Commission may request the submission of other electronic administrative transactions adopted by the Department of Health and Human Services. An MHCC-certified EHN may include transactions related to pharmaceuticals covered by medical benefits with its submission under §B of this regulation if excluding that data would be burdensome. Electronic Health Care Transactions Technical Submission Guidance. In consultation with stakeholders, including Commission staff, the State-designated HIE shall develop an Electronic Health Care Transactions Technical Submission Guidance that: Contains detailed technical requirements for submitting electronic health care transaction information to the State-designated HIE; Provides an option for MHCC-certified EHNs to submit electronic health care transactions in a flat file; and To the extent possible, utilizes industry recognized standards. The State-designated HIE shall: Invite all MHCC-certified EHNs and Commission staff to at least one meeting to discuss the initial development of the Electronic Health Care Transactions Technical Submission Guidance; Invite all MHCC-certified EHNs and Commission staff to at least one meeting prior to making any material updates to the Electronic Health Care Transactions Technical Submission Guidance; Solicit public comments on a draft copy of the initial Electronic Health Care Transactions Technical Submission Guidance, and any material updates to the guidance, by: Publishing the draft guidance on its website; and Sending the draft guidance to MHCC-certified EHNs and the Commission by e-mail; Accept comments on the draft Electronic Health Care Transactions Technical Submission Guidance for at least 30 days; Publish a written response to any significant, substantive issues raised in comments; and Consider all stakeholder feedback prior to finalizing the Electronic Health Care Transactions Technical Submission Guidance. The State-designated HIE shall annually submit to Commission staff a final draft of the Electronic Health Care Transactions Technical Submission Guidance for approval, which shall not be unreasonably denied. The State-designated HIE and the Commission shall publish the final, approved Electronic Health Care Transactions Technical Submission Guidance on their websites. An MHCC-certified EHN shall submit electronic health care transaction information to the State-designated HIE in a manner detailed in the most recent version of the Electronic Health Care Transactions Technical Submission Guidance. Submission Schedule. No later than the last business day of each month, an MHCC-certified EHN shall submit electronic health care transactions information from the preceding month to the State-designated HIE. An MHCC-certified EHN shall submit electronic health transaction information at least once per month, but may submit data more often. An EHN may not charge a fee to a health care provider, health care payor, or the State-designated HIE for providing the information required under this regulation. Exemptions. An MHCC-certified EHN may request a 1-year exemption from certain reporting requirements in this regulation. An exemption request shall: Be in writing; Identify each specific requirement of this regulation from which the EHN is requesting an exemption; Identify the time period of the exemption, if any; State the reason for each exemption request; and Include information that justifies the exemption request. Within 45 days after receipt of complete information from an EHN requesting an exemption, the Commission shall take one of the following actions: Grant the exemption by providing written notification; or Deny the exemption request by providing written notification that enumerates the reasons for the denial to the EHN. The Commission may not exempt an MHCC-certified EHN from any requirement within this regulation that is otherwise required by federal or other State law. The Commission may grant an exemption on the following grounds: The absence of functionality in the infrastructure of the EHN that prevents the EHN from complying with the requirement; The requirement would hinder the ability of the EHN to comply with other requirements of this chapter or federal or other State laws; or The requirement would cause an undue burden or hardship on the EHN, such that the EHN would no longer be able to provide EHN services in the State. For good cause shown, the Commission may renew a 1-year exemption for an additional 1-year period. Effective Date. The State-designated HIE shall publish the Electronic Health Care Transactions Technical Submission Guidance within 12 months of the final effective date of this regulation. An MHCC-certified EHN shall begin submitting electronic health care transaction information based on the most recent version of the Electronic Health Care Transactions Technical Submission Guidance within 18 months following the initial publication of the Electronic Health Care Transactions Technical Submission Guidance. Implementation Reporting. Upon request, the State-designated HIE shall submit to the Commission updates on: Its status of developing the Electronic Health Care Transactions Technical Submission Guidance; Its progress in supporting MHCC-certified EHN implementation of the Electronic Health Care Transactions Technical Submission Guidance; and Any disruptions or technology failures that delay implementation and associated impacts, if any. An MHCC-certified EHN shall submit to the Commission at least quarterly: An implementation plan and timeline detailing progress the MHCC-certified EHN has made towards submitting electronic health care transaction information to the State-designated HIE; and Any other information requested by the Commission related to the implementation of this regulation. The Commission may withdraw certification from an MHCC-certified EHN if the Commission finds that: The MHCC-certified EHN fails to meet the certification standards set forth in Regulation .05 of this chapter; A principal or owner of the MHCC-certified EHN, or the entity itself, is convicted of, or pleads guilty or nolo contendere to, a crime related to the operation of the EHN or to a crime involving financial improprieties; A principal or owner of the MHCC-certified EHN, or the entity itself, is notified by a qualified accreditation or certification organization or the Commission of a violation of HIPAA privacy or security standards and fails to take action to remedy the violation within the period of time specified by a qualified accreditation or certification organization or by the Commission; The MHCC-certified EHN disclosed legally protected health information in violation of Health-General Article, §4-302.5, Annotated Code of Maryland; or The MHCC-certified EHN fails to submit electronic health care transactions information to the State-designated HIE in accordance with Regulation .09 of this chapter. Beginning June 1, 2024, a person who knowingly violates Health-General Article, §4-302.5, Annotated Code of Maryland, shall be guilty of a misdemeanor and on conviction is subject to a fine not to exceed $10,000 per day based on: The extent of actual or potential public harm caused by the violation; The cost of investigating the violation; and The person’s prior record of compliance. A MHCC-certified EHN that fails to submit electronic health transactions information to the State-designated HIE in accordance with Regulation .09 of this chapter may be subject to a financial penalty not to exceed $10,000 per day based on: The extent of actual or potential public harm caused by the violation; The cost of investigating the violation; and Whether the MHCC-certified EHN committed previous violations. Before withdrawal of certification on one of the bases provided in Regulation .10 of this chapter, the Executive Director shall inform the MHCC-certified EHN, setting forth in writing the reasons for withdrawal. The notice of withdrawal shall set forth the right of the MHCC-certified EHN to an evidentiary hearing, conducted in accordance with Regulation .12 of this chapter, to show cause why the certification should not be withdrawn. Within 15 days of receipt of the notice of withdrawal, the MHCC-certified EHN may make a written filing that details the EHN's position and provides supporting documentation, before the Commission takes final action to withdraw the EHN's certification. Reviewer as Presiding Officer. If an evidentiary hearing is requested, the Executive Director shall appoint a single commissioner to act as reviewer and preside at the hearing. The reviewer shall hold a prehearing conference, at which the reviewer shall: Summarize the rules of procedure governing the evidentiary hearing; Determine the date, time, and place of the evidentiary hearing; Determine the form and manner of the presentation of evidence; Rule on any pending motions; and Make other decisions as appropriate. Hearing. The reviewer is empowered to: Make all rulings as to evidence, testimony, and the conduct of the evidentiary hearing; and Take other actions consistent with the duties of a reviewer. Proposed Decision. The reviewer shall prepare a proposed decision and order which shall state the reviewer's determination as to whether the allegations that formed the basis for the hearing are substantiated or not, and if substantiated, include a proposed sanction. Exceptions. If the proposed decision is adverse to the MHCC-certified EHN, the EHN may submit written exceptions to the proposed decision and order by submitting written argument with citation to supporting documentation from the record. Exceptions shall be filed according to a schedule set by the reviewer, with a party filing exceptions having at least 7 days to file exceptions, and a party filing a response to exceptions having at least 5 days to file a response, unless this period is shortened by agreement of the parties. Final Decision. The Commission shall issue a final decision based on the record of the proceeding including findings of fact and conclusions of law, that: Finds the allegations to be substantiated and withdraws the MHCC-certified EHN status of the entity; Finds the allegations to be substantiated, but permits the entity to retain MHCC-certified EHN status, with appropriate conditions; or Finds the allegations to be unsubstantiated and continues the entity's MHCC-certified EHN status. An MHCC-certified EHN aggrieved by the Commission's final decision may seek judicial review pursuant to State Government Article, Title 10, Annotated Code of Maryland. Health-General Article, §§4-302.1, 4-302, 4-302.2—.3, 4-302.5, 19-103(c)(2), (9) and (10), 19-109(a)(1) and (8), 19-133(d), 19-134, and 19-135(a) and (b), Annotated Code of Maryland Effective date: July 15, 1996 (23:14 Md. R. 1008) Regulation .01 amended effective July 23, 2001 (28:14 Md. R. 1322) Regulation .02 amended effective April 3, 2000 (27:6 Md. R. 641) Regulation .03 amended effective July 23, 2001 (28:14 Md. R. 1322) Regulation .05 amended effective April 15, 2002 (29:7 Md. R. 620) Regulation .10 amended effective July 23, 2001 (28:14 Md. R. 1322) Regulation .11 amended effective April 3, 2000 (27:6 Md. R. 641); December 23, 2002 (29:25 Md. R. 1983) Regulations .01—.11 repealed and new Regulations .01—.11 adopted effective March 24, 2008 (35:6 Md. R. 698) Regulation .02B amended effective December 15, 2008 (35:25 Md. R. 2150) Regulation .02B amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) Regulation .04A amended effective December 15, 2008 (35:25 Md. R. 2150) Regulation .04B amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) Regulation .05A amended effective December 15, 2008 (35:25 Md. R. 2150) Regulation .05A amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) Regulation .06A, D amended effective December 15, 2008 (35:25 Md. R. 2150) Regulation .09 amended as an emergency provision effective January 11, 2024 (51:3 Md. R. 152); amended permanently effective May 13, 2024 (51:9 Md. R. 440) Regulation .09C amended effective December 15, 2008 (35:25 Md. R. 2150) Chapter revised effective November 10, 2025 (52:22 Md. R. 1095)