Client Alerts, News Articles & Blog Posts

Everything you need to know about BMD and the industry.

Important Updates Every Provider Should Know: Information Blocking

I. Introduction

In December 2016, Congress passed the 21st Century Cures Act (“Cures Act”) which: (1) authorized funding for the National Institutes of Health to promote medical research and drug development, (2) implemented provisions aimed at addressing the prevention and treatment of mental illness and substance abuse, and (3) reformed certain standards of the Medicare program and federal tax laws to foster healthcare access and quality improvement.

Woven within the Cures Act is Section 4004 titled “Information Blocking.”[1] The purpose of this section is to prohibit any action or practice that interferes with or prevents access to electronic health information (i.e., information about a patient’s medical history or treatment). The law requires the Department of Health and Human Services (“HHS”), through rulemaking, to identify reasonable and necessary activities that do not constitute information blocking.

This Client Alert outlines what constitutes information blocking and provider obligations.  Healthcare providers should be sure to review their HIPAA Plans and related policies and procedures to ensure updated compliance as well as conduct additional training and education to workforce members. 

II. Prohibited Conduct

Under the Cures Act, it is unlawful for anyone to engage in “information blocking,” and such conduct could result in a $1,000,000 civil monetary penalty per violation. “Information blocking” is defined as any practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, and if conducted by a health care provider, such provider knows that the practice is unreasonable and is likely to be considered information blocking.[2]

Examples of information blocking include, but are not limited to, (1) practices that restrict authorized access, exchange, or use of such information for treatment, including transitions between certified health information technologies; (2) implementing health information technology in non-standard ways that are likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information; and (3) implementing health information technology in ways that are likely to (a) restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or in transitioning between health information technology systems; or (b) lead to fraud, waste, or abuse, or impede innovations and advancements in health information access, exchange, and use, including care delivery enabled by health information technology.[3]

III. Regulatory Guidance

On May 1, 2020, the Office of the National Coordinator for Health Information Technology (“ONC”), a subset of HHS, issued a final rule on interoperability, information blocking, and the ONC health IT certification program.[4] This guidance clarified the export requirements of certain electronic health information and outlined actions that are not considered information blocking.

a. Interoperability

In the final rule, the ONC refined the scope of data a health IT module must export, aligned the standards to the definition of electronic health information, and advanced common data through the U.S. Core Data for Interoperability (“USCDI”). The USCDI is a standardized set of health data classes and data elements that are essential for nationwide, interoperable health information exchange.[5] The purpose of this rule is to advance and promote the complete access, exchange, and use of all electronically accessible health information.

The finalized criterion requires a certified health IT module to electronically export all of the electronic health information (further defined to include all protected health information under HIPAA, not including psychotherapy notes or information compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding) that can be stored at the time of certification by the product, of which the health IT module is a part.[6]

The rule further defines eight different types of clinical notes that must be shared under new USCDI standards: (1) consultation notes, (2) discharge summary notes, (3) history and physical, (4) imaging narratives, (5) laboratory report narratives, (6) pathology report narratives, (7) procedure notes, and (8) progress notes.[7]

b. Information Blocking Exceptions[8]

Pursuant to the Cures Act directive, in the above-mentioned final rule, the ONC developed eight exceptions to information blocking that may be utilized by health care actors (or health care providers, health IT developers, health information networks, and health information exchanges). If an actor engages in one of these exceptions, then such action is not considered information blocking and will not be subject to civil monetary penalties. An actor’s practice that does not fully meet the conditions of an exception will not automatically constitute a violation; practices will be evaluated on a case-by-case basis.

The eight exceptions are further divided into two categories: (1) exceptions that involve not fulfilling requests to access, exchange, or use electronic health information; and (2) exceptions that involve procedures for fulfilling requests to access, exchange, and use electronic health information.

i. Exceptions that Involve Not Fulfilling Requests to Access, Exchange, or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

  • Practices that are reasonable and necessary to prevent harm to a patient or another person.
  • To not fulfill a request to access, exchange, or use electronic health information in order to protect an individual’s privacy.
  • To interfere with the access, exchange, or use of electronic health information in order to protect the security of the electronic health information.
  • To not fulfill a request to access, exchange, or use electronic health information due to the infeasibility of the request.
  • To take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT’s performance for the benefit of the overall performance of the health IT.

ii. Exceptions that Involve Procedures for Fulfilling Requests to Access, Exchange or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

  • To limit the content of its response to a request to access, exchange, or use electronic health information or the manner in which it fulfills a request to access, exchange, or use electronic health information.
  • To charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using electronic health information.
  • To license interoperability elements for electronic health information to be accessed, exchanged, or used.
  • Key conditions:
  • An actor must bring license negotiations to the requestor within 10 business days from receipt of the request and negotiate a license within 30 business days from receipt of the request.
  • The licensing conditions:
    • Scope of rights
    • Reasonable royalty
    • Non-discriminatory terms
    • Collateral terms
    • Non-disclosure agreement

These new regulations and guidance make it imperative providers and health care practices update their HIPAA policies and procedures, especially with the expansion of telehealth and new ways of sharing information between providers and patients.

Please contact a BMD healthcare attorney should you have any questions regarding this final rule, questions regarding information blocking and the sharing of health information, or other general healthcare issues.

[1] Codified at 42 U.S.C. § 300jj-52.

[2] Id. at (a)(1).

[3] Id. at (2).

[4] See 85 Fed. Reg. 25642.

[5] HHS, HHS Finalizes Historic Rules to Provide Patients More Control of Their Health Data, (March 9, 2020), https://www.hhs.gov/about/news/2020/03/09/hhs-finalizes-historic-rules-to-provide-patients-more-control-of-their-health-data.html.

[6] 45 C.F.R. § 170.315(b)(10).

[7] 85 Fed. Reg. 25642, 25674.

[8] A full breakdown of these exceptions can be found, https://www.healthit.gov/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf.

Changes to Physician Assistant Statutes in Florida

In the last year, there have been many changes to the scope of practice and collaboration/supervision requirements for advanced practice providers such as APRNs and physician assistants in the state of Florida. In a previous Client Alert we discussed House Bill 607, which expanded the autonomous practice of APRNs providing primary care services in Florida.

Ohio Senate Bill 49 – Ohio Expands Lien Rights for Design Professionals

Effective September 30, 2021, Ohio granted limited lien rights to design professionals, including architects, landscape architects, engineers, and surveyors. Ohio Governor Mike DeWine signed Senate Bill 49 into law on July 1, 2021. This new law established a statutory right to lien commercial real estate by Ohio design professionals who, until now, could not file a lien for non-payment of professional services. Senator Vernon Sykes, a primary sponsor of Senate Bill 49, stated that the “legislation ensures that architects, engineers and other designers will get paid for their work, regardless of the outcome of their projects . . . It will support hardworking Ohioans by protecting the value of their labor . . ..”

Primary Care Practice Officially Defined in Florida for APRNs Practicing Autonomously

As many providers in Florida are aware, House Bill 607 (the “Bill”), which was passed in February of last year, gives certain APRNs in Florida the ability to practice autonomously. The only catch is that they must work in primary practice. When the Bill was initially passed, there was question as to what was exactly considered primary care, absent a definition from the Florida Board of Nursing. However, as of February 25, 2021, “primary care practice” has officially been defined.

Part II of the No Surprises Act

The Department of Health and Human Services (“HHS”) published Part II of the No Surprises Act on September 30, 2021, which will take effect on January 1, 2022. The new guidance, in large part, focuses on the independent dispute resolution process that was briefly mentioned in Part I of the Act. In addition, there is now guidance on good faith estimate requirements, the patient-provider dispute resolution processes, and added external review provisions.

Safer Federal Workforce Task Force - Guidance for Federal Contractors and Subcontractors

The Safer Federal Workforce Task Force has issued its Guidance for Federal Contractors and Subcontractors (Guidance). Note that the Guidance applies only to “covered contracts,” which are contracts that include the clause (Clause) set forth in Sec. 2(a) of Executive Order 14042 (Ensuring Adequate COVID Safety Protocols for Federal Contractors). The Federal Acquisition Regulatory Council (FARC) is to conduct rulemaking and take related action to ensure that the Clause is incorporated into federal contracts. Until that happens, federal contractors likely will not see the Clause in its contracts. Following is a broad summary of the Guidance.