Congress enacted the 21st Century Cures Act (the “Cures Act”) in 2016 to address the use and exchange of health data through health information technology (HIT), strengthen interoperability, promote patient access to electronic health information (EHI), and prevent information blocking. The Cures Act and its administrative rules regulate health care providers (including physicians in private practice and their medical practices), HIT developers of certified health IT, health information exchanges, and health information networks. Compliance with HIPAA continues, but HIPAA covered entities (including hospitals, physicians and their business associates) also will need to comply with applicable requirements established by the Cures Act and its administrative rules. For health care providers and their business associates, this means that some disclosures which are permissive under HIPAA may become mandatory disclosures under the Cures Act and its administrative rules.
In May 2020, the HHS Office of the National Coordinator for Health Information Technology (ONC) published its final rule on Interoperability, Information Blocking, and the ONC Health IT Certification Program (the “Final Rule”). The Final Rule clarifies when information blocking occurs (the “Information Blocking provisions”) and updates ONC’s HIT certification criteria. The Information Blocking provisions apply to health care providers, HIT developers of certified health IT, health information exchanges, and health information networks (collectively “Actors”). Actors must comply with the Information Blocking provisions of the Final Rule by November 2, 2020. However, there is a three-month enforcement discretion period which runs through February 2, 2021. The government’s announcement does not refer to this as a delay in enforcement, but states that enforcement will be discretionary during this period. “This additional flexibility for development and implementation enables our healthcare system to focus on addressing the COVID-19 pandemic, while still maintaining a trajectory that will advance patients’ access to their health information, reduce the cost of care, and improve the quality of care.”
For health care providers, “Information blocking” generally means a practice that the provider knows is “unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.” Beginning November 2, 2020, subject to limited exclusions and exceptions, eight types of clinical notes, outlined in the United States Core Data for Interoperability (USCDI), must be shared: consultation notes, discharge summary notes, history and physical, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes, and progress notes. Notes which qualify as psychotherapy notes under HIPAA are excluded. Also excluded is information compiled in reasonable anticipation of, or use in, a civil, criminal or administrative proceeding.
In addition to the exclusions, the Final Rule provides exceptions to the Information Blocking provisions (the “Information Blocking Exceptions”). Thus, an Actor will not be deemed to engage in information blocking if the Actor’s conduct falls within an Information Blocking Exception. There are eight exceptions. Five of the exceptions involve not fulfilling requests to access, exchange, or use EHI: the preventing harm exception, the privacy exception, the security exception, the infeasibility exception, and the HIT performance exception. The three remaining exceptions involve procedures for fulfilling requests to access, exchange or use EHI: the content and manner exception, the fees exception and the licensing exception.
There are many open issues that physicians and other providers will need to work through as the Information Blocking and Cures Act provisions are implemented. For example, will physicians be required to establish portals for patients to access specified health information in real-time? Physicians and other providers should begin assessing the capabilities of their portals and other electronic systems in order to determine how they will comply with the Information Blocking rules. As the Information Blocking and other Cures Act provisions are implemented over the coming months, look for MSMS to continue providing educational resources to physicians and their practices.