California Data Exchange Framework: Mandated and Voluntary Participants

Participants in the California Data Exchange Framework include general acute care hospitals, physician organizations and medical groups with 25 or more physicians, skilled nursing facilities, health care service plans and disability insurers, and clinical laboratories under the original Assembly Bill 133 mandate, with Senate Bill 660 adding smaller physician practices, specialty hospitals, nonprofit clinics, medical foundations, and emergency medical services entities on staggered deadlines through July 2026.¹ Each of these organizations must sign a single statewide Data Sharing Agreement and exchange patient health information electronically with other participants. As of January 1, 2026, the Department of Health Care Access and Information (HCAI) administers the program.²

The Original Mandated Participants

Health and Safety Code Section 130290 identifies the first wave of organizations required to join. That group had to sign the Data Sharing Agreement by January 31, 2023, and begin exchanging data by January 31, 2024.³ It covers:

General acute care hospitals providing 24-hour inpatient medical, nursing, and surgical care.
Physician organizations and medical groups with 25 or more physicians.
Skilled nursing facilities delivering long-term and rehabilitative care.
Health care service plans and disability insurers.
Clinical laboratories.

These entities are legally required to execute the statewide Data Sharing Agreement to remain in compliance.¹

2026 Deadlines and the SB 660 Expansion

A second set of organizations was given until January 31, 2026, to begin exchanging health information. That group includes physician practices with fewer than 25 physicians, rehabilitation hospitals, long-term acute care hospitals, acute psychiatric hospitals, critical access hospitals, rural general acute care hospitals with fewer than 100 beds, and nonprofit clinics with fewer than 10 providers.¹

SB 660, signed in October 2025 and effective January 1, 2026, expanded the mandate further and staggered new deadlines:⁴

January 1, 2026: certain medical groups, independent practice associations, clinics, and surgical centers must sign the Data Sharing Agreement.
July 1, 2026: medical foundations and emergency medical services entities must sign.

SB 660 also made signing a condition of contracting for healthcare services with the Department of Health Care Services, the California Public Employees’ Retirement System (CalPERS), and Covered California. For organizations that do business with those state programs, participation is no longer optional in any practical sense.⁴

Signing the Data Sharing Agreement

The process starts at the Data Exchange Framework Signing Portal, accessible through the CDII website.⁵ Before logging in, gather your organization’s name, organization type, address, California state license numbers if applicable, details of any subordinate organizations, and the name, title, and email of the person authorized to sign for the organization.⁶

The signer needs legal authority to bind the organization, typically an executive or general counsel. Review the Data Sharing Agreement template on the CDII website first so the privacy obligations and data-sharing terms are clear before you commit.⁵

If your organization runs multiple facilities or clinics, list each subordinate entity during registration so they fall under the master agreement. Once the organizational data is entered, the signing authority reviews the prepopulated agreement, applies an electronic signature, and submits. A fully executed copy is available for download in the portal.⁶

How Participants Actually Exchange Data

Signing the agreement is one thing. Moving data electronically is another, and not every mandated organization has the infrastructure to do it directly. Qualified Health Information Organizations, or QHIOs, are state-designated intermediaries that facilitate secure exchange between participants who lack their own platforms.⁷

A QHIO can handle information requests and responses, deliver test or referral results, and send notifications about patient admissions or discharges. Smaller practices, community clinics, and social services organizations often use a QHIO as the most practical path to compliance. SB 660 codified the QHIO designation process into state law.⁴

QHIOs aren’t the only option. Participants can exchange data through point-to-point connections, nationwide health information networks, or their own proprietary systems, as long as those methods comply with the Data Sharing Agreement and its policies.⁷

Grant Funding to Offset Implementation Costs

California allocated up to $47 million through the DSA Signatory Grants Program to help organizations cover technical implementation. Individual applications are capped at $500,000 regardless of how many signatories or facility locations the application covers.⁸

To qualify, your organization must have already signed the Data Sharing Agreement and must demonstrate it needs additional technical capabilities to meet its exchange obligations. Organizations already conducting real-time data exchange in compliance with the agreement are not eligible. The grants fund two categories of work:

Technical assessment grants for gap analyses, vendor selection, IT consulting, electronic health record upgrades, and new clinical workflows for data exchange.
QHIO onboarding grants covering the fees to connect to a Qualified Health Information Organization and complete an initial real-time data transaction.

The final deadline for the grants program is March 31, 2026. Grantees or their selected QHIO must submit a Milestone Progress Report by that date or lose eligibility for any remaining funds.⁵

What Participation Obligates You to After Signing

The Data Sharing Agreement is the legal commitment; the Policies and Procedures are the operational rules that govern every transaction after that.⁹

The Permitted, Required, and Prohibited Purposes policy controls what data can be shared and why. Required purposes include treatment, payment, and healthcare operations. The framework prohibits using it to bypass any applicable privacy law.¹⁰

Individual Access Services give patients the right to inspect and obtain copies of their health information held by any participant. Participants must offer electronic options for submitting access requests and must have a process for correcting inaccurate records. Internal systems have to identify, extract, and transmit data in approved formats when requests come from other framework members.

The framework adopts the HIPAA Security Rule as the baseline for data protection. California’s own privacy laws, including the Confidentiality of Medical Information Act, remain fully in effect.¹¹ California law is stricter than HIPAA in several areas, particularly around mental health records, substance use treatment information, and HIV-related data. Participants exchanging those categories need to comply with both the federal floor and the more restrictive California ceiling.¹

What Happens If You Don’t Participate

HCAI is now required to publish a list of entities that may be out of compliance with the Data Sharing Agreement and to update that list regularly. HCAI can also refer non-compliant organizations to their relevant state licensing agency.⁴

State purchasing is the other lever. Because signing is a condition of contracting with Medi-Cal, CalPERS, and Covered California, organizations that refuse risk losing access to those revenue streams. As of 2026, the primary accountability tools are public transparency, licensing referrals, and state contracting requirements.¹²

Voluntary Participants

The framework is not limited to organizations under a legal mandate. Social services organizations, including those providing housing services and nutrition assistance, are encouraged to sign the Data Sharing Agreement voluntarily.¹³ The framework was designed to exchange both health and social services information, and voluntary participants gain access to the same data-sharing infrastructure as mandated entities. For organizations working with populations whose outcomes depend heavily on social determinants like housing stability and food access, joining connects them to the clinical side of a patient’s care.

1
California Legislative Information. California Health and Safety Code 130290 – California Health and Human Services Data Exchange Framework
2
California Health and Human Services Agency. Governance – California Data Exchange Framework
3
California Health and Human Services Agency. Frequently Asked Questions – California Data Exchange Framework
4
California Data Exchange Framework. California Data Exchange Framework – SB 660 Fact Sheet
5
Center for Data Insights and Innovation. Data Exchange Framework
6
California Data Exchange Framework. How to Join the DxF – California Data Exchange Framework
7
California Data Exchange Framework. California Announces Designation of Nine Qualified Health Information Organizations to Support Secure Statewide Data Exchange
8
Center for Data Insights and Innovation. DSA Signatory Grants Applicant Guidance Document
9
California Health and Human Services Agency. California Health and Human Services Data Exchange Framework – Single Data Sharing Agreement
10
California Health and Human Services Agency. CalHHS Data Exchange Framework Policy and Procedure – Permitted, Required, and Prohibited Purposes
11
California Data Exchange Framework. For Individuals – California Data Exchange Framework
12
California Data Exchange Framework. How Are Participants Held Accountable Under the Data Exchange Framework
13
California Data Exchange Framework. For Participants – California Data Exchange Framework