California Data Exchange Framework: Who Must Participate in 2026

If you run a healthcare organization in California, the Data Exchange Framework participation requirements likely apply to you, and the current compliance window is 2026. The framework requires hospitals, medical groups, skilled nursing facilities, health plans, clinical labs, and a growing list of other healthcare entities to sign a single statewide Data Sharing Agreement and exchange patient health information electronically. The Department of Health Care Access and Information (HCAI) has administered the program since January 1, 2026, after it moved from the California Health and Human Services Agency.¹

Whether you are already in compliance, newly in scope, or still trying to figure out if the rules reach you, the answer depends on your organization type and when your deadline falls.

Organizations That Were Required First

Under Health and Safety Code Section 130290, the first wave of mandatory participants had to sign the Data Sharing Agreement by January 31, 2023, and begin exchanging data by January 31, 2024.² If your organization falls into any of these categories, you should already be signed and exchanging:

General acute care hospitals
Physician organizations and medical groups with 25 or more physicians
Skilled nursing facilities
Health care service plans and disability insurers
Clinical laboratories

These entities are legally required to execute the statewide Data Sharing Agreement to remain in compliance.¹

Who Must Participate in 2026

A second group of organizations under the original AB 133 mandate received an extended deadline of January 31, 2026, to begin exchanging health information. That group includes:¹

Physician practices with fewer than 25 physicians
Rehabilitation hospitals
Long-term acute care hospitals
Acute psychiatric hospitals
Critical access hospitals
Rural general acute care hospitals with fewer than 100 beds
Nonprofit clinics with fewer than 10 providers

SB 660, signed in October 2025 and effective January 1, 2026, expanded the framework beyond the original AB 133 list and added new deadlines of its own:³

By January 1, 2026: certain medical groups, independent practice associations, clinics, and surgical centers must sign the Data Sharing Agreement.
By July 1, 2026: medical foundations and emergency medical services entities must sign.

SB 660 also made signing the Data Sharing Agreement a condition of contracting for healthcare services with the Department of Health Care Services, CalPERS, and Covered California. For any organization that does business with those state programs, participation is no longer optional in practical terms, even if your organization type is not independently mandated.³

How to Sign the Data Sharing Agreement

The process starts at the Data Exchange Framework Signing Portal on the Center for Data Insights and Innovation (CDII) website.⁴ Before you log in, gather what the portal asks for: your organization’s name, organization type, address, California state license numbers if applicable, details on any subordinate organizations or affiliated facilities, and the name, title, and email address of the person authorized to sign.⁵

The signer needs legal authority to bind the organization, which typically means an executive or general counsel. Review the Data Sharing Agreement template on the CDII site before signing so you understand the privacy and data-sharing obligations you are accepting.⁴

If you operate multiple facilities or clinics, those subordinate entities must be listed during registration so they fall under the master agreement. Having that complete list ready before you start prevents errors. Once the organizational data is entered, the signing authority reviews the prepopulated agreement, applies an electronic signature, and submits. A fully executed copy becomes available for download within the portal.⁵

How You Actually Exchange the Data

Signing the agreement is the legal commitment. You also need a technical way to send and receive the information. Qualified Health Information Organizations (QHIOs) are state-designated intermediaries that handle secure exchange on behalf of participants who do not have their own platforms.⁶

A QHIO can create and respond to information requests, deliver test or referral results, and send admission and discharge notifications. For smaller practices and community clinics, using a QHIO is often the most practical path. SB 660 codified the QHIO designation process into state law, giving it a permanent statutory basis.³

Using a QHIO is not the only option. You can also exchange data through point-to-point connections, nationwide health information networks, or your own proprietary systems, as long as those methods comply with the Data Sharing Agreement and its policies.⁶

What You Are Agreeing To After You Sign

The Data Sharing Agreement incorporates a set of Policies and Procedures that govern every transaction. The Data Elements policies define what you must exchange. For hospitals, skilled nursing facilities, clinical laboratories, and physician groups, that means all electronic health information as defined in 45 CFR Section 171.102. For health insurers and health care service plans, the floor is the data required under the federal CMS Interoperability and Patient Access regulations.¹

The Permitted, Required, and Prohibited Purposes policy controls why data can move. Required purposes include treatment, payment, and healthcare operations. The framework prohibits using exchange to bypass any applicable privacy law.⁷

The HIPAA Security Rule sets the baseline for data protection, and California’s own privacy laws, including the Confidentiality of Medical Information Act, remain in full effect on top of that.⁸ California is stricter than HIPAA in several areas, particularly for mental health records, substance use treatment information, and HIV-related data. If you exchange any of those categories, you need to comply with both the federal floor and the stricter California rules.¹

What Happens If You Do Not Participate

When the framework launched under AB 133, there was no enforcement mechanism. SB 660 changed that. HCAI is now required to publish a list of entities that may be out of compliance and to update that list regularly, and HCAI can refer non-compliant organizations to their relevant state licensing agency.³

The state contracting lever is the other real pressure. Because signing the Data Sharing Agreement is now a condition of contracting with Medi-Cal, CalPERS, and Covered California, organizations that refuse risk losing those revenue streams. As of 2026, the primary accountability tools are public transparency, licensing referrals, and state contracting requirements.⁹

If You Are Not Required but Want to Join

The framework is open to organizations outside the mandate. Social services organizations, including those providing housing services and nutrition assistance, are encouraged to sign the Data Sharing Agreement voluntarily.¹⁰ The framework was built to carry both health and social services information, and voluntary signatories get access to the same exchange infrastructure as mandated entities. For organizations serving populations whose health outcomes depend on housing stability, food access, and other social determinants, that connection to the clinical side of a patient’s care is the main reason to sign.

1
California Legislative Information. California Health and Safety Code 130290 – California Health and Human Services Data Exchange Framework
2
California Health and Human Services Agency. Frequently Asked Questions – California Data Exchange Framework
3
California Data Exchange Framework. California Data Exchange Framework – SB 660 Fact Sheet
4
Center for Data Insights and Innovation. Data Exchange Framework
5
California Data Exchange Framework. How to Join the DxF – California Data Exchange Framework
6
California Data Exchange Framework. California Announces Designation of Nine Qualified Health Information Organizations to Support Secure Statewide Data Exchange
7
California Health and Human Services Agency. CalHHS Data Exchange Framework Policy and Procedure – Permitted, Required, and Prohibited Purposes
8
California Data Exchange Framework. For Individuals – California Data Exchange Framework
9
California Data Exchange Framework. How Are Participants Held Accountable Under the Data Exchange Framework
10
California Data Exchange Framework. For Participants – California Data Exchange Framework