Mass HIway Users and Mass HIway Access

(1) Users. (a) HIway Participants. 1. All HIway participants must sign a Participation Agreement and agree to the terms of the Mass HIway Policies and Procedures. 2. A HIway participant may connect to the Mass HIway with the help of a Mass HIway integrator. 3. A HIway participant is issued a domain and direct addresses by Mass HIway or by a HIway trusted HISP. 4. A HIway participant and its authorized personnel may be listed in the Mass HIway statewide provider directory. 5. A Mass HIway user must become a HIway participant to be able to connect directly to the Mass HIway and use the Mass HIway as its HISP. 6. HIway-sponsored services are restricted to HIway participants, regardless of whether the HIway participant connects directly to the Mass HIway or via a HIway trusted HISP. (b) Nonparticipant Users. 1. A nonparticipant user must sign a Business Associate Agreement and/or other agreement with a HIway trusted HISP, as required by the HISP to fulfill its obligations under its contractual agreement with the Mass HIway. 2. A nonparticipant user is issued a domain and direct addresses by the HIway trusted HISP. 3. A nonparticipant user is able to send messages to and receive messages from HIway participants via the HIway trusted HISP and the Mass HIway. 4. The Mass HIway does not perform message transformation on messages received from non-participant users. 5. Nonparticipant users do not have access to HIway-sponsored services. 6. Nonparticipant users are subject to the Mass HIway Policies and Procedures. (2) HIway Trusted HISPs. (a) To become a HIway trusted HISP, a HISP must execute a HISP-to-HISP agreement with the Mass HIway or must execute a direct contract with a third-party organization that acts as a trust framework aggregator with which the Mass HIway also has a direct contractual arrangement. (b) A HIway trusted HISP must process HIway Direct Messages between its non-participant users and HIway participants in accordance with its contractual agreements. (3) Access. (a) Provider organizations are required to meet the requirement to connect to the Mass HIway that is described in 101 CMR 20.08. (b) Other categories of eligible Mass HIway users may connect to the Mass HIway. (c) Use of the Mass HIway is limited to exchanges of health information that are allowed or required by law. Unauthorized access to or disclosure of individually identifiable patient health information by or through the Mass HIway is prohibited, and violators may be subject to any penalties established under applicable state or federal law regarding the protection and privacy of personal information. The obligations of HIway users in the case of a security breach involving the Mass HIway are further described in the Mass HIway Policies and Procedures.