Transforming Care Starts with a Connected California

Entities required to sign the DxF DSA, as set forth in Health and Safety Code section 130290(f), are listed below.

• General Acute Care Hospitals, as defined by Health and Safety Code section 1250
• [CLARIFIED] Physician Organizations and Medical Groups, which include:
  • Medical group practices, professional medical corporations, medical partnerships, or any lawfully organized groups of physicians and surgeons that provide, deliver, furnish, or otherwise arrange for health care services.
  • Independent practice associations, to the extent that they Maintain Electronic Health Information on behalf of participating physicians.
  • Medical foundations exempt from licensure pursuant to Health and Safety Code section 1206(l).
  • Community clinics licensed under Health and Safety Code section 1204(a), intermittent clinics exempt from licensure under Health and Safety Code section 1206(h), and rural health clinics as defined in Title 42, United States Code section 1396d(l)(1).
  • Specialty clinics, as described in Health and Safety Code section 1204(b)(1), (b)(2), or (b)(3).
  • Ambulatory surgical centers and accredited outpatient settings.
• Skilled Nursing Facilities (SNFs), as defined in Health and Safety Code section 1250, that Maintain electronic health records.
  • For purposes of this section, “electronic health records” means a System that contains an electronic record of health-related information on an Individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff.
• Health Plans, as follows:
  • Health Care Service Plans and Disability Insurers providing hospital, medical, or surgical coverage that are regulated by the California Department of Managed Health Care (DMHC) or the California Department of Insurance (CDI).
  • Medi-Cal Managed Care Plans that have signed a comprehensive risk contract with the Department of Health Care Services pursuant to the Medi-Cal Act1 or the Waxman-Duffy Prepaid Health Plan Act, 2 and that are not regulated by DMHC or CDI.
• Clinical Laboratories, as described in Business and Professions Code Section 1265, and those that are regulated by the California Department of Public Health (CDPH)
  • Both registered laboratories and licensed laboratories that are regulated by CDPH are required to sign the DxF DSA.
• Acute Psychiatric Hospitals, as defined in Health and Safety Code section 1250.
• [NEW] Emergency Medical Services, as defined by Health and Safety Code section 1797.72.

[NEW] Beginning January 1, 2027, Department of Health Care Access and Information (HCAI) will publish and keep current on its website the names of any known entities it deems not to be in compliance with the requirement to execute the Data Exchange Framework (DxF) Data Sharing Agreement (DSA).

Entities that are encouraged, but not required, to sign the DxF DSA include:

• Government public health and human services agencies, unless they otherwise are required to execute the DxF DSA by Health and Safety Code section 130290(f).
  • For example, a county-operated general acute care hospital which meets the definition of a general acute care hospital in Health and Safety Code section 1250 would be required to sign;
• Social services organizations, including organizations providing housing services and nutrition assistance;
• Specialized health plans that are not full-service plans, such as Employee Assistance Program (EAP) Plans;
• Electronic health record (EHR) vendors;
• Health information exchanges (HIEs) and other intermediaries, unless they have been qualified as a Qualified Health Information Organization (QHIO);
• Non-physician health providers, so long as they are not otherwise part of a medical group practice, a professional medical corporation, or a medical partnership, including but not limited to:
  • Dentists;
  • Licensed clinical social workers;
  • Licensed marriage and family therapists;
  • Podiatrists
  • Psychologists
  • Registered nurses
  • Optometrists
  • Marriage and family therapists
  • Clinical social workers
  • Physician assistants
  • Chiropractors
  • Acupuncturists
  • Professional clinical counselors
  • Physical therapists
  • Pharmacists
  • Licensed midwives
  • Naturopathic doctors

1 Cal. Welfare and Institutions Code section 14000, et seq.
2 Cal. Welfare and Institutions Code section 14200, et seq.

• The Emergency Medical Services Authority;
• A fire agency, as defined by Health and Safety Code section 1797.230, who provides advanced life support, as defined by Health and Safety Code section 1797.52;
• A local EMS agency, as defined by Health and Safety Code section 1797.94, to the extent that they Maintain Health and Social Services Information; and
• Any organization who has a written contractual agreement with a local EMS agency for the provision of emergency medical services.

Please see the EMS provider and LEMSA support FAQ for information about how EMS providers’ participation in the Data Exchange Framework (DxF) may be supported.

Deadlines for signing the DxF DSA and beginning Exchange of Health and Social Services Information, as set forth in the Requirement to Exchange Health and Social Services Information Policy and Procedure and Health and Safety Code section 130290, subdivisions (b) and (f), are listed below.

Hospitals

[CLARIFIED] Physician organizations and medical groups

3 Signatory types are simplified. For more information on the signatory types, please refer to question 1.

[NEW] Yes, if you are required to sign the DxF DSA. Beginning July 1, 2026, unless already required by an existing contract requirement, signing the DxF DSA will be required as a condition of continuing, amending, or entering into a new or existing contract for the coverage of or provision of health care services with DHCS, CalPERS, and the California Health Benefit Exchange. DHCS, CalPERS, and California Health Benefit Exchange may require subcontractors and delegates to sign the DxF DSA as a condition of their contracts.

Yes. Health and Safety Code section 130290 does not differentiate between a “restricted health care service plan” and a “full service health care service plan.” Both a “restricted health care service plan” and a “full service health care service plan” are required to sign the DxF DSA.

When the DxF was first established under AB 133 (2021), the statute did not include enforcement or accountability mechanisms. Recently under SB 660 (2025), the legislature provided for some accountability measures, including public transparency, state purchasing levers, coordination with licensing entities, and contractual obligations among participants. SB 660 also directed the DxF Advisory Committee to evaluate and recommend potential future enforcement and dispute‑resolution approaches, ensuring that any additional authority is informed, deliberate, and appropriately resourced. More information on DxF Accountability Measures can be found on the Governance section of the DxF website.

Participants must follow all applicable state and federal law when sharing Health and Social Services Information (HSSI) in accordance with the Data Exchange Framework Data Sharing Agreement. What laws apply during an Exchange may depend on the organization providing the HSSI, the organization receiving the information, the type of HSSI being Exchanged, the purpose for Exchange, and where the organization providing the HSSI obtained the information from. Please consult with your legal counsel to better understand what laws apply to the HSSI your organization is Exchanging. For more guidance on state and federal laws that affect Disclosure and sharing of health information, please see HCAI’s Data Exchange Framework Policies and Procedures, DHCS’ Data Sharing Authorization Guidance, and CalHHS’ State Health Information Guidance (SHIG).

The Data Exchange Framework (DxF) is not a technology, but instead rules of the road for how organizations will provide Access to and Exchange Health and Social Services information (HSSI). HSSI will not reside on any state DxF system. The Privacy Standards and Security Safeguards Policy and Procedure describes the minimum privacy and security safeguards required by the DxF for Participants to implement. These Policies and Procedures can be found on the Policies and Procedures section of the DxF website.