PART 172—TRUSTED EXCHANGE FRAMEWORK AND COMMON AGREEMENT Authority: 42 U.S.C. 300jj-11; 5 U.S.C. 552. Source: 89 FR 101810, Dec. 16, 2024, unless otherwise noted. Subpart A—General Provisions § 172.100 Basis, purpose, and scope. (a) Basis and authority. (b) Purpose. (1) Ensure full network-to-network exchange of health information; and (2) Establish a voluntary process for a Qualified Health Information Network TM TM TM TM (c) Scope. (1) Minimum qualifications needed for a health information network to be Designated as a QHIN capable of trusted exchange under TEFCA. (2) Procedures governing QHIN Onboarding and Designation, suspension, termination, and further administrative review. (3) Attestation submission requirements for a QHIN to attest to its adoption of TEFCA. (4) ASTP/ONC attestation acceptance and removal processes for publication of attesting QHINs in the QHIN Attestation Directory. § 172.101 Applicability. (a) This part applies to Applicant QHINS, QHINs, terminated QHINs, and the Recognized Coordinating Entity. (b) If any provision of this part is held to be invalid or unenforceable facially, or as applied to any person, plaintiff, or circumstance, it shall be construed to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which case the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances. § 172.102 Definitions. For purposes of this part, the following definitions apply: Applicable Law. Applicant QHIN. Business Associate Agreement (BAA). Business day business days. Common Agreement. Federal Register Confidential Information. (1) Is or becomes known publicly through no fault of the recipient; or (2) Is learned by the recipient from a third party that the recipient reasonably believes is entitled to disclose it without restriction; or (3) Is already known to the recipient before receipt from the discloser, as shown by the recipient's written records; or (4) Is independently developed by recipient without the use of or reference to the discloser's Confidential Information, as shown by the recipient's written records, and was not subject to confidentiality restrictions prior to receipt of such information from the discloser; or (5) Must be disclosed under operation of law, provided that, to the extent permitted by Applicable Law, the recipient gives the discloser reasonable notice to allow the discloser to object to such redisclosure, and such redisclosure is made to the minimum extent necessary to comply with Applicable Law. Connectivity Services. Covered Entity. Designated Network. Designated Network Services. Designation (including its correlative meanings “Designate,” “Designated,” and “Designating”). Disclosure (including its correlative meanings “Disclose,” “Disclosed,” and “Disclosing”). Electronic Protected Health Information (ePHI). Exchange Purpose(s) XP(s). Exchange Purpose Code XP Code. Foreign Control. Framework Agreement(s). Governance Services. Health information network HIN. Individual HIPAA. HIPAA Privacy Rule. HIPAA Rules. HIPAA Security Rule. Individual. Individual Access Services (IAS). Individually Identifiable Information. Node. Non-U.S. Entity. Non-U.S. Person. Onboarding. Organized Health Care Arrangement. Participant. Participant/Subparticipant Terms of Participation (ToP). Qualified Health Information Network or QHIN TM Query(s) (including its correlative uses/tenses “Queried” and “Querying”). Recognized Coordinating Entity® (RCE®). Required Information. (1) Maintained in a Responding Node by any QHIN, Participant, or Subparticipant prior to or during the term of the applicable Framework Agreement; and (2) Relevant for a required XP Code. Responding Node. Response(s) (including its correlative uses/tenses “Responds,” “Responded” and “Responding”). Subparticipant: TEFCA Dispute Resolution Process. TEFCA Exchange. TEFCA Information TI. TEFCA Security Incident. (i) Any unintentional acquisition, access, Use, or Disclosure of TEFCA Information by a Workforce Member or person acting under the authority of a QHIN, Participant, or Subparticipant, if such acquisition, access, Use, or Disclosure: (A) Was made in good faith; (B) Was made by a person acting within their scope of authority; (C) Was made to another Workforce Member or person acting under the authority of any QHIN, Participant, or Subparticipant; and (D) Does not result in further acquisition, access, Use, or Disclosure in a manner not permitted under Applicable Law and the Framework Agreements. (ii) A Disclosure of TI where a QHIN, Participant, or Subparticipant has a good faith belief that an unauthorized person to whom the Disclosure was made would not reasonably have been able to retain such information. (iii) A Disclosure of TI that has been de-identified in accordance with the standard at 45 CFR 164.514. (2) Other security events that adversely affect a QHIN's, Participant's, or Subparticipant's participation in TEFCA Exchange. Threat Condition. (2) A TEFCA Security Incident; or (3) An event that the RCE, a QHIN, its Participant, or their Subparticipant has reason to believe will disrupt normal TEFCA Exchange, either due to actual compromise of, or the need to mitigate demonstrated vulnerabilities in systems or data, of the QHIN, Participant, or Subparticipant, as applicable, or could be replicated in the systems, networks, applications, or data of another QHIN, Participant, or Subparticipant; or (4) Any event that could pose a risk to the interests of national security as directed by an agency of the United States government. Trusted Exchange Framework. Federal Register U.S. Entity/Entities. (1) The entity is organized under the laws of a state or commonwealth of the United States or the Federal law of the United States and is subject to the jurisdiction of the United States and the state or commonwealth under which it was formed; (2) The entity's principal place of business, as determined under Federal common law, is in the United States; and (3) None of the entity's directors, officers, or executives, and none of the owners with a five percent (5%) or greater interest in the entity, are listed on the Specially Designated Nationals and Blocked Persons List U.S. Qualified Person. Use(s) (including correlative uses/tenses, such as “Uses,” “Used,” and “Using”). § 172.103 Responsibilities ASTP/ONC may delegate to the RCE. (a) ASTP/ONC may delegate to the RCE the TEFCA implementation responsibilities specified in the following sections: (1) Any section(s) of subpart C of this part; (2) Any section(s) of subpart D of this part; (3) Section 172.501; and (4) Section 172.503. (b) Notwithstanding any delegation, any authority exercised by the RCE under this section is subject to review under subpart F of this part and to any requirement in this part that the RCE receive ASTP/ONC's prior authorization before taking a specific action. Subpart B—Qualifications for Designation § 172.200 Applicability. This subpart establishes Designation qualifications. (a) Applicant QHIN. (b) QHIN. (c) Performance of TEFCA Exchange. § 172.201 QHIN Designation requirements. (a) Ownership requirements. (1) Be a U.S. Entity; (2) Not be under Foreign Control. (b) Exchange requirements. (1) Be capable of exchanging information among more than two unaffiliated organizations; (2) Be capable of exchanging all Required Information; (3) Be exchanging information for at least one Exchange Purpose authorized under TEFCA; (4) Be capable of receiving and responding to transactions from other QHINs for all Exchange Purposes authorized under TEFCA; and (5) Be capable of initiating transactions for the Exchange Purposes authorized under TEFCA that such entity will permit its Participants and Subparticipants to use through TEFCA Exchange. (c) Designated Network Services requirements. (1) Maintain the organizational infrastructure and legal authority to operate and govern its Designated Network; (2) Maintain adequate written policies and procedures to support meaningful TEFCA Exchange and fulfill all responsibilities of a QHIN in this part; (3) Maintain a Designated Network that can support a transaction volume that keeps pace with the demands of network users; (4) Maintain the capacity to support secure technical connectivity and data exchange with other QHINs; (5) Maintain an enforceable dispute resolution policy governing Participants in the Designated Network that permits Participants to reasonably, timely, and fairly adjudicate disputes that arise between each other, the QHIN, or other QHINs; (6) Maintain an enforceable change management policy consistent with the responsibilities of a QHIN; (7) Maintain a representative and participatory group or groups with the authority to approve processes for governing the Designated Network; (8) Maintain privacy and security policies that permit the entity to support TEFCA Exchange; (9) Maintain data breach response and management policies that support meaningful TEFCA Exchange; and (10) Maintain adequate financial and personnel resources to support all its responsibilities as a QHIN, including sufficient financial reserves or insurance-based cybersecurity coverage, or a combination of both. § 172.202 QHINs that offer Individual Access Services. The following requirements apply to QHINs that offer Individual Access Services: (a) A QHIN must obtain express consent from any individual before providing Individual Access Services. (b) A QHIN must make publicly available a privacy and security notice that meets minimum TEFCA standards. (c) A QHIN, that is the IAS provider for an Individual, must delete the individual's Individually Identifiable Information maintained by the QHIN upon request by the individual except as prohibited by Applicable Law or where such information is contained in audit logs. (d) A QHIN must permit any Individual to export in a computable format all of the Individual's Individually Identifiable Information maintained by the QHIN as an Individual Access Services provider. (e) All Individually Identifiable Information the QHIN maintains must satisfy the following criteria: (1) All Individually Identifiable Information must be encrypted. (2) Without unreasonable delay and in no case later than sixty (60) calendar days following discovery of the unauthorized acquisition, access, Disclosure, or Use of Individually Identifiable Information, the QHIN must notify in plain language each Individual whose Individually Identifiable Information has been or is reasonably believed to have been affected by unauthorized acquisition, access, Disclosure, or Use involving the QHIN. (3) A QHIN must have an agreement with a qualified, independent third-party credential service provider and must verify, through the credential service provider, the identities of Individuals seeking Individual Access Services prior to the Individuals' first use of such services and upon expiration of their credentials. Subpart C—QHIN Onboarding and Designation Processes § 172.300 Applicability. This subpart establishes, as to QHINs, the application, review, Onboarding, withdrawal, and redetermination processes for Designation. § 172.301 Submission of QHIN application. An entity seeking to be Designated as a QHIN must submit all of the following information in a manner specified by ASTP/ONC: (a) Completed QHIN application, with supporting documentation, in a form specified by ASTP/ONC; and (b) A signed copy of the Common Agreement. § 172.302 Review of QHIN application. (a) ASTP/ONC (or an RCE) will review a QHIN application to determine if the Applicant QHIN has completed all parts of the application and provided the necessary supporting documentation. If the QHIN application is not complete, the applicant will be notified in writing of the missing information within thirty (30) calendar days of receipt of the application. This timeframe may be extended by providing written notice to the Applicant QHIN. (b) Once the QHIN application is complete, ASTP/ONC (or an RCE) will review the application to determine whether the Applicant QHIN satisfies the requirements for Designation set forth in § 172.201 and, if the Applicant QHIN proposes to provide IAS, the requirements set forth in § 172.202. ASTP/ONC (or an RCE) will complete its review within sixty (60) calendar days of the Applicant QHIN being provided with written notice that its application is complete. This timeframe may be extended by providing written notice to the Applicant QHIN. (c) Additional information may be requested from the Applicant QHIN while ASTP/ONC (or an RCE) is reviewing the application. The timeframe for responding to the request and the manner to submit additional information will be provided to the applicant and may be extended on written notice to the Applicant QHIN. (d) Failure to respond to a request within the proposed timeframe or in the manner specified is a basis for a QHIN Application to be deemed withdrawn, as set forth in § 172.305(c). In such situations, the Applicant QHIN will be provided with written notice that the application has been deemed withdrawn. (e) If, following submission of the application, any information submitted by the Applicant QHIN becomes untrue or materially changes, the Applicant QHIN must notify ASTP/ONC (or an RCE) in the manner specified by ASTP/ONC (or an RCE) of such changes in writing within five (5) business days of the submitted material becoming untrue or materially changing. § 172.303 QHIN approval and Onboarding. (a) An Applicant QHIN has the burden of demonstrating its compliance with all qualifications for Designation in § 172.201 and, if the Applicant QHIN proposes to provide IAS, the qualifications in § 172.202. (b) If ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) determines that an Applicant QHIN meets the requirements for Designation set forth in § 172.201, and if the Applicant QHIN proposes to provide IAS, the qualifications set forth in § 172.202, then ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will notify the applicant in writing that its application has been approved, and the Applicant QHIN may proceed with Onboarding. (c) An approved Applicant QHIN must submit a signed version of the Common Agreement within a timeframe set by ASTP/ONC (or an RCE). (d) An approved Applicant QHIN must complete the Onboarding process, including any tests required to ensure the Applicant QHIN's network can connect to those of other QHINs and other Applicant QHINs, within twelve (12) months of approval of its QHIN application, unless that timeframe is extended in ASTP/ONC's (or an RCE's) sole discretion by up to twelve (12) months. § 172.304 QHIN Designation. (a) If all requirements of the Onboarding process specified in § 172.303 have been satisfied: (1) The Common Agreement will be countersigned; and (2) The Applicant QHIN will be provided with a written determination indicating that the applicant has been Designated as a QHIN, along with a copy of the countersigned Common Agreement. (b) Within thirty (30) calendar days of receiving its Designation, each QHIN must demonstrate in a manner specified by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange. (c) If a QHIN is unable to complete the requirement in paragraph (b) of this section within the thirty (30)-day period provided, the QHIN must provide ASTP/ONC (or an RCE) with a written explanation of why the QHIN has been unable to complete a successful transaction with all other in-production QHINs within the allotted time and include a detailed plan and timeline for completion of a successful transaction with all other in-production QHINs. ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will review and either approve or reject the QHIN's plan based on the reasonableness of the explanation and the specific facts and circumstances, within five (5) business days of receipt. If the QHIN fails to provide its plan or the plan is rejected, ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will rescind its approval of the application, rescind the QHIN Designation, and deny the application. Within thirty (30) calendar days of end of the term of the plan, each QHIN must demonstrate in a manner specified by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange. (d) A QHIN Designation will become final sixty (60) days after a Designated QHIN has submitted its documentation that it has completed a successful transaction with all other in-production QHINs. § 172.305 Withdrawal of QHIN application. (a) An Applicant QHIN may voluntarily withdraw its QHIN application by providing written notice in a manner specified by ASTP/ONC (or an RCE). (b) An Applicant QHIN may withdraw its QHIN application at any point prior to Designation. (c) Upon written notice to the Applicant QHIN, a QHIN application may be deemed withdrawn by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) as a result of the Applicant QHIN's failure to respond to requests for information from ASTP/ONC (or an RCE). § 172.306 Denial of QHIN application. If an Applicant QHIN's application is denied, the Applicant QHIN will be provided with written notice that includes the basis for the denial. § 172.307 Re-application. (a) Subject to paragraphs (b) through (d) of this section, applications may be resubmitted by Applicant QHINs by complying with the provisions of § 172.301 in the event that an application is denied or withdrawn. (b) The Applicant QHIN may reapply at any time after it has voluntarily withdrawn its application as specified in § 172.305(a). (c) If ASTP/ONC (or an RCE) deems a QHIN application to be withdrawn as a result of the Applicant QHIN's failure to respond to requests for information, then the Applicant QHIN may reapply by submitting a new QHIN application no sooner than six (6) months after the date on which its previous application was submitted. The Applicant QHIN must respond to the prior request for information and must include an explanation as to why no response was previously provided within the required timeframe. (d) If ASTP/ONC (or an RCE) denies a QHIN application, the Applicant QHIN may reapply by submitting a new application consistent with the requirements in § 172.301 no sooner than six (6) months after the date shown on the written notice of denial. The application must specifically address the deficiencies that constituted the basis for denying the Applicant QHIN's previous application. Subpart D—Suspension § 172.400 Applicability. This subpart describes suspension responsibilities, notice requirements for suspension, and the effect of suspension. § 172.401 QHIN suspensions. (a) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) may suspend a QHIN after determining that the QHIN is responsible for a Threat Condition. (b) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) may direct the QHIN to suspend that Participant's or Subparticipant's authority to engage in TEFCA Exchange on determining that one of a QHIN's Participants or Subparticipants has done something or failed to do something that resulted in a Threat Condition. (c) ASTP/ONC (or an RCE) will make a reasonable effort to notify a QHIN in writing in advance of an intent to suspend the QHIN or to provide direction to the QHIN to suspend one of the QHIN's Participants or Subparticipants, and to give the QHIN an opportunity to respond. Such notice will identify the Threat Condition giving rise to such suspension. (d) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) shall lift a suspension of the QHIN, or provide direction to the QHIN to lift the suspension of one of the QHIN's Participants or Subparticipants, once the Threat Condition is resolved. § 172.402 Selective suspension of exchange between QHINs. (a) A QHIN may, in good faith and to the extent permitted by Applicable Law, suspend TEFCA Exchange with another QHIN because of reasonable concerns related to the privacy and security of information that is exchanged. (b) If a QHIN decides to suspend TEFCA Exchange with another QHIN, it is required to promptly notify, in writing, ASTP/ONC (or an RCE) and the QHIN with which it is suspending exchange of its decision and the reason(s) for making the decision. (c) If a QHIN suspends TEFCA Exchange with another QHIN under paragraph (a) of this section, it must, within thirty (30) calendar days, initiate the TEFCA Dispute Resolution Process in order to resolve the issues that led to the decision to suspend, or the QHIN may end its suspension and resume TEFCA Exchange with the other QHIN within thirty (30) calendar days of suspending TEFCA Exchange with the QHIN. (d) Provided that a QHIN suspends TEFCA Exchange with another QHIN in accordance with this section and in accordance with Applicable Law, such suspension will not be deemed a violation of the Common Agreement. Subpart E—Termination § 172.500 Applicability. This subpart establishes QHIN termination responsibilities, notice requirements for termination, and the effect of termination. § 172.501 QHIN self-termination. A QHIN may terminate its own Designation at any time without cause by providing ninety (90) calendar days prior written notice. § 172.502 QHIN termination. A QHIN's Designation will be terminated with immediate effect by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) giving written notice of termination to the QHIN if the QHIN: (a) Fails to comply with any of the regulations of this part and fails to remedy such material breach within thirty (30) calendar days after receiving written notice of such failure; provided, however, that if a QHIN is diligently working to remedy its material breach at the end of this thirty- (30-) day period, then ASTP/ONC (or an RCE) must provide the QHIN with up to another thirty (30) calendar days to remedy its material breach; or (b) A QHIN breaches a material provision of the Common Agreement where such breach is not capable of remedy. § 172.503 Termination by mutual agreement. A QHIN's Designation may be terminated at any time and for any reason by mutual, written agreement between the QHIN and ASTP/ONC (or an RCE). Subpart F—Review of RCE or ASTP/ONC Decisions § 172.600 Applicability. This subpart establishes processes for review of RCE or ASTP/ONC actions, including QHIN appeal rights and the process for filing an appeal. § 172.601 ASTP/ONC review. (a) ASTP/ONC may, in its sole discretion, review all or any part of any RCE determination, policy, or action. If ASTP/ONC reviews an RCE determination that required ASTP/ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on its review of that determination. (b) ASTP/ONC may, in its sole discretion and on notice to affected QHINs or Applicant QHINs, stay any RCE determination, policy, or other action pending ASTP/ONC review. If ASTP/ONC stays an RCE determination that required ASTP/ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on whether it should stay that determination. (c) ASTP/ONC may, in its sole discretion and on written notice, request that a QHIN, Applicant QHIN, or the RCE provide ASTP/ONC additional information regarding any RCE determination, policy, or other action. (d) On completion of its review, ASTP/ONC may affirm, modify, or reverse the determination, policy, or other action under review. ASTP/ONC will provide notice to affected QHINs or Applicant QHINs that includes the basis for ASTP/ONC's decision. (e) ASTP/ONC will provide written notice under this section to affected QHINs or Applicant QHINs in the same manner as the original RCE determination, policy, or other action under review. (f) ASTP/ONC will issue a decision under this section within a timeframe agreed to by the affected Applicant QHIN or QHIN, as applicable, the RCE, and ASTP/ONC. ASTP/ONC may, at its sole discretion, extend the timeframe for a decision as circumstances necessitate. § 172.602 Basis for appeal by QHIN or Applicant QHIN. (a) An Applicant QHIN or QHIN may appeal the following decisions to ASTP/ONC or a hearing officer, as appropriate: (1) Applicant QHIN. (2) QHIN. (i) A decision to suspend the QHIN or to instruct the QHIN to suspend its Participant or Subparticipant. (ii) A decision to terminate the QHIN's Common Agreement. (b) [Reserved] § 172.603 Method and timing for filing an appeal. (a) To initiate an appeal, an authorized representative of the Applicant QHIN or QHIN must submit electronically, in writing to ASTP/ONC, a notice of appeal that includes the date of the notice of appeal, the date of the decision being appealed, the Applicant QHIN or QHIN that is appealing, and the decision being appealed within fifteen (15) calendar days of the Applicant QHIN's or QHIN's receipt of the notice of: (1) Denial of a QHIN application; (2) Suspension or instruction to suspend its Participant or Subparticipant; or (3) Termination. With regard to an appeal of a termination, the 15-calendar day timeframe may be extended by ASTP/ONC up to another fifteen (15) calendar days if the QHIN has been granted an extension for completing its remedy under § 172.502(a). (b) An authorized representative of an Applicant QHIN or QHIN must submit electronically to ASTP/ONC, within thirty (30) calendar days of filing the intent to appeal, the following: (1) A statement of the basis for appeal, including a description of the facts supporting the appeal with citations to documentation submitted by the QHIN or Applicant QHIN; and (2) Any documentation the QHIN would like considered during the appeal. (c) The Applicant QHIN or QHIN filing the appeal may not submit on appeal any evidence that it did not submit prior to the appeal except evidence permitted by the hearing officer under § 172.606. § 172.604 Effect of appeal on suspension and termination. An appeal does not stay the suspension or termination, unless otherwise ordered by ASTP/ONC or the hearing officer assigned under § 172.605(b). § 172.605 Assignment of a hearing officer. (a) On receipt of an appeal under § 172.603, ASTP/ONC may exercise its authority under § 172.601 to review an RCE determination being appealed. If ASTP/ONC exercises its authority under § 172.601 to review an RCE determination that required ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on its review of that determination. An appealing QHIN or Applicant QHIN that is not satisfied with ASTP/ONC's subsequent determination may appeal that determination to a hearing officer by filing a new notice of appeal and other appeal documents that comply with § 172.603. (b) If ASTP/ONC declines review under paragraph (a) of this section, or if ASTP/ONC made the determination under review, ASTP/ONC will arrange for assignment of the case to a hearing officer to adjudicate the appeal. (c) The hearing officer must be an officer appointed by the Secretary of Health and Human Services. (d) The hearing officer may not be responsible to, or subject to the supervision or direction of, personnel engaged in the performance of investigative or prosecutorial functions for ASTP/ONC, nor may any officer, employee, or agent of ASTP/ONC engaged in investigative or prosecutorial functions in connection with any adjudication, in that adjudication or one that is factually related, participate or advise in the decision of the hearing officer, except as a counsel to ASTP/ONC or as a witness. § 172.606 Adjudication. (a) The hearing officer will decide issues of law and fact de novo (b) In making a determination, the hearing officer may consider: (1) The written record, which includes: (i) The RCE's or ASTP/ONC's determination and supporting information; and (ii) Appeal materials submitted by the Applicant QHIN or QHIN under § 172.603. (2) Any information from a hearing conducted in-person, via telephone, or otherwise. The hearing officer has sole discretion to conduct a hearing: (i) To require either party to clarify the written record under paragraph (b)(1) of this section; or (ii) If the hearing officer otherwise determines a hearing is necessary. (c) The hearing officer will neither receive witness testimony nor accept any new information beyond what was provided in accordance with paragraph (b) of this section, except for good cause shown by the party seeking to submit new information. § 172.607 Determination by the hearing officer. (a) The hearing officer will issue a written determination within a timeframe agreed to by the affected Applicant QHIN or QHIN, as applicable, and ASTP/ONC and approved by the hearing officer. The hearing officer may, at their sole discretion, extend the timeframe for a written determination as circumstances necessitate. (b) The hearing officer's determination on appeal is the final decision of HHS unless within ten (10) business days, the Secretary, in the Secretary's sole discretion, chooses to review the determination. ASTP/ONC will notify the appealing party if the Secretary chooses to review the determination and will provide notice of the Secretary's final determination. Subpart G—QHIN Attestation for the Adoption of the Trusted Exchange Framework and Common Agreement § 172.700 Applicability. This subpart applies to QHINs. § 172.701 Attestation submission and acceptance. (a) Applicability. (1) The attestation submission requirements for QHINs. (2) The review and acceptance processes that ASTP/ONC will follow for TEFCA attestations. (b) Submission of QHIN attestation. (i) Attestation affirming its adoption of the Common Agreement and Trusted Exchange Framework. (ii) General identifying information, including: (A) Name, address, city, state, zip code, and a hyperlink to its website. (B) Designation of an authorized representative, including the representative's name, title, phone number, and email address. (iii) Documentation confirming its Designation as a QHIN. (2) A QHIN must provide ASTP/ONC with written notice of any changes to its identifying information provided in accordance with this paragraph (b) within thirty (30) business days of the change(s) to its identifying information. (c) Submission method. (d) Review and acceptance. (2) ASTP/ONC will accept an attestation if it determines that the QHIN has satisfied the requirements of paragraphs (b) and (c) of this section. ASTP/ONC will provide written notice to the applicable QHIN's authorized representative that the attestation has been accepted. (3) ASTP/ONC will reject an attestation if it determines that the requirements of paragraph (b) or (c) of this section, or both, have not been satisfied. (4) ASTP/ONC will provide written notice to the QHIN's authorized representative of the determination along with the basis for the determination. (5) An ASTP/ONC determination under this section is final agency action and not subject to further administrative review, except the Secretary may choose to review the determination as provided in § 172.607(b). However, a QHIN may, at any time, resubmit an attestation in accordance with paragraphs (b) and (c) of this section. § 172.702 QHIN Attestation Directory. (a) Applicability. (b) Publication. (2) ASTP/ONC will identify within the QHIN Attestation Directory those QHINs that are suspended under the Common Agreement. (c) Removal from the QHIN Attestation Directory. (2) Upon termination of a QHIN's Common Agreement, ASTP/ONC (or an RCE) will send a written a statement of intent to remove the QHIN from the QHIN Attestation Directory to the authorized representative of the QHIN. (3) Any written statement given under paragraph (c)(2) of this section shall consist of the following, as appropriate: (i) The name of the terminated QHIN and the name and contact information of the authorized representative of the QHIN. (ii) A short statement setting forth findings of fact with respect to any violation of the Common Agreement or other basis for the QHIN's termination under the Common Agreement and justifying the termination on the basis of those findings of facts. (iii) Other materials as ASTP/ONC (or the RCE) may deem relevant. (d) Duration. (e) Final agency action.