Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

Important Updates Every Provider Should Know: Information Blocking

Client Alert

I. Introduction

In December 2016, Congress passed the 21st Century Cures Act (“Cures Act”) which: (1) authorized funding for the National Institutes of Health to promote medical research and drug development, (2) implemented provisions aimed at addressing the prevention and treatment of mental illness and substance abuse, and (3) reformed certain standards of the Medicare program and federal tax laws to foster healthcare access and quality improvement.

Woven within the Cures Act is Section 4004 titled “Information Blocking.”[1] The purpose of this section is to prohibit any action or practice that interferes with or prevents access to electronic health information (i.e., information about a patient’s medical history or treatment). The law requires the Department of Health and Human Services (“HHS”), through rulemaking, to identify reasonable and necessary activities that do not constitute information blocking.

This Client Alert outlines what constitutes information blocking and provider obligations.  Healthcare providers should be sure to review their HIPAA Plans and related policies and procedures to ensure updated compliance as well as conduct additional training and education to workforce members. 

II. Prohibited Conduct

Under the Cures Act, it is unlawful for anyone to engage in “information blocking,” and such conduct could result in a $1,000,000 civil monetary penalty per violation. “Information blocking” is defined as any practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, and if conducted by a health care provider, such provider knows that the practice is unreasonable and is likely to be considered information blocking.[2]

Examples of information blocking include, but are not limited to, (1) practices that restrict authorized access, exchange, or use of such information for treatment, including transitions between certified health information technologies; (2) implementing health information technology in non-standard ways that are likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information; and (3) implementing health information technology in ways that are likely to (a) restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or in transitioning between health information technology systems; or (b) lead to fraud, waste, or abuse, or impede innovations and advancements in health information access, exchange, and use, including care delivery enabled by health information technology.[3]

III. Regulatory Guidance

On May 1, 2020, the Office of the National Coordinator for Health Information Technology (“ONC”), a subset of HHS, issued a final rule on interoperability, information blocking, and the ONC health IT certification program.[4] This guidance clarified the export requirements of certain electronic health information and outlined actions that are not considered information blocking.

a. Interoperability

In the final rule, the ONC refined the scope of data a health IT module must export, aligned the standards to the definition of electronic health information, and advanced common data through the U.S. Core Data for Interoperability (“USCDI”). The USCDI is a standardized set of health data classes and data elements that are essential for nationwide, interoperable health information exchange.[5] The purpose of this rule is to advance and promote the complete access, exchange, and use of all electronically accessible health information.

The finalized criterion requires a certified health IT module to electronically export all of the electronic health information (further defined to include all protected health information under HIPAA, not including psychotherapy notes or information compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding) that can be stored at the time of certification by the product, of which the health IT module is a part.[6]

The rule further defines eight different types of clinical notes that must be shared under new USCDI standards: (1) consultation notes, (2) discharge summary notes, (3) history and physical, (4) imaging narratives, (5) laboratory report narratives, (6) pathology report narratives, (7) procedure notes, and (8) progress notes.[7]

b. Information Blocking Exceptions[8]

Pursuant to the Cures Act directive, in the above-mentioned final rule, the ONC developed eight exceptions to information blocking that may be utilized by health care actors (or health care providers, health IT developers, health information networks, and health information exchanges). If an actor engages in one of these exceptions, then such action is not considered information blocking and will not be subject to civil monetary penalties. An actor’s practice that does not fully meet the conditions of an exception will not automatically constitute a violation; practices will be evaluated on a case-by-case basis.

The eight exceptions are further divided into two categories: (1) exceptions that involve not fulfilling requests to access, exchange, or use electronic health information; and (2) exceptions that involve procedures for fulfilling requests to access, exchange, and use electronic health information.

i. Exceptions that Involve Not Fulfilling Requests to Access, Exchange, or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

  • Practices that are reasonable and necessary to prevent harm to a patient or another person.
  • To not fulfill a request to access, exchange, or use electronic health information in order to protect an individual’s privacy.
  • To interfere with the access, exchange, or use of electronic health information in order to protect the security of the electronic health information.
  • To not fulfill a request to access, exchange, or use electronic health information due to the infeasibility of the request.
  • To take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT’s performance for the benefit of the overall performance of the health IT.

ii. Exceptions that Involve Procedures for Fulfilling Requests to Access, Exchange or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

  • To limit the content of its response to a request to access, exchange, or use electronic health information or the manner in which it fulfills a request to access, exchange, or use electronic health information.
  • To charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using electronic health information.
  • To license interoperability elements for electronic health information to be accessed, exchanged, or used.
  • Key conditions:
  • An actor must bring license negotiations to the requestor within 10 business days from receipt of the request and negotiate a license within 30 business days from receipt of the request.
  • The licensing conditions:
    • Scope of rights
    • Reasonable royalty
    • Non-discriminatory terms
    • Collateral terms
    • Non-disclosure agreement

These new regulations and guidance make it imperative providers and health care practices update their HIPAA policies and procedures, especially with the expansion of telehealth and new ways of sharing information between providers and patients.

Please contact a BMD healthcare attorney should you have any questions regarding this final rule, questions regarding information blocking and the sharing of health information, or other general healthcare issues.

[1] Codified at 42 U.S.C. § 300jj-52.

[2] Id. at (a)(1).

[3] Id. at (2).

[4] See 85 Fed. Reg. 25642.

[5] HHS, HHS Finalizes Historic Rules to Provide Patients More Control of Their Health Data, (March 9, 2020), https://www.hhs.gov/about/news/2020/03/09/hhs-finalizes-historic-rules-to-provide-patients-more-control-of-their-health-data.html.

[6] 45 C.F.R. § 170.315(b)(10).

[7] 85 Fed. Reg. 25642, 25674.

[8] A full breakdown of these exceptions can be found, https://www.healthit.gov/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf.

New York, Kansas, Massachusetts, and Delaware Become the latest States to Adopt Full Practice Authority for Nurse Practitioners

While the COVID-19 pandemic certainly created many obstacles and hardships, it also created many opportunities to try doing things differently. This can be seen in the instant rise of remote work opportunities, telehealth visits, and virtual meetings. Many States took the challenges of the pandemic and turned them into an opportunity to adjust the regulations governing licensed professionals, including for advanced practice registered nurses (APRNs).

Explosive Growth in Pot of Gold Opportunity for Bank (and Other) Cannabis Lenders Driving Erosion of the Barriers

Our original article on bank lending to the cannabis industry anticipated that the convergence of interest between banks and the cannabis industry would draw more and larger banks to the industry. Banks were awash in liquidity with limited deployment options, while bankable cannabis businesses had rapidly growing needs for more and lower cost credit. Since then, the pot of gold opportunity for banks to lend into the cannabis industry has grown exponentially due to a combination of market constraints on equity causing a dramatic shift to debt and the ever-increasing capital needs of one of the country’s fastest growing industries. At the same time, hurdles to entry of new banks are being systematically cleared as the yellow brick road to the cannabis industry’s access to the financial markets is being paved, brick by brick, by the progressively increasing number and size of banks that are now entering the market.

2021 EEOC Charge Statistics: Retaliation & Impact of Remote Work

The U.S. Equal Employment Opportunity Commission (EEOC) released its detailed information on workplace discrimination charges it received in 2021. Unsurprisingly, for the second year in a row, the total number of charges decreased as COVID-19 either shut down workplaces or disconnected employees from each other. In 2021, the agency received a total of approximately 61,000 workplace discrimination charges - the fewest in 25 years by a wide margin. For reference, the agency received over 67,000 charges in 2020, and averaged almost 90,000 charges per year over the previous 10 years.

Ohio’s Managed Care Overhaul Delayed – New Implementation Timeline

At the direction of Governor Mike DeWine, the Ohio Department of Medicaid (ODM) launched the Medicaid Managed Care Procurement process in 2019. ODM’s stated vision for the procurement was to focus on people and not just the business of managed care. This is the first structural change to Ohio’s managed care system since the Centers for Medicare & Medicaid Services' (CMS) approval of Ohio’s Medicaid program in 2005. Initially, all of the new managed care programs were supposed to be implemented starting on July 1, 2022. However, ODM Director Maureen Corcoran recently confirmed that this date will be pushed back for several managed care-related programs.

Laboratory Specimen Collection Arrangements with Contract Hospitals - OIG Advisory Opinion 22-09

On April 28, 2022, the Department of Health and Human Services, Office of Inspector General (“OIG”) published an Advisory Opinion[1] in which it evaluated a proposed arrangement where a network of clinical laboratories (the “Requestor”) would compensate hospitals (each a “Contract Hospital”) for specimen collection, processing, and handling services (“Collection Services”) for laboratory tests furnished by the Requestor (the “Proposed Arrangement”). The OIG concluded that the Proposed Arrangement would generate prohibited remuneration under the federal Anti-Kickback Statute (“AKS”) if the requisite intent were present. This is due to both the possibility that the proposed per-patient-encounter fee would be used to induce or reward referrals to Requestor and the associated risk of improperly steering patients to Requestor.