Resources

I. Introduction

In December 2016, Congress passed the 21^st Century Cures Act (“Cures Act”) which: (1) authorized funding for the National Institutes of Health to promote medical research and drug development, (2) implemented provisions aimed at addressing the prevention and treatment of mental illness and substance abuse, and (3) reformed certain standards of the Medicare program and federal tax laws to foster healthcare access and quality improvement.

Woven within the Cures Act is Section 4004 titled “Information Blocking.”[1] The purpose of this section is to prohibit any action or practice that interferes with or prevents access to electronic health information (i.e., information about a patient’s medical history or treatment). The law requires the Department of Health and Human Services (“HHS”), through rulemaking, to identify reasonable and necessary activities that do not constitute information blocking.

This Client Alert outlines what constitutes information blocking and provider obligations.  Healthcare providers should be sure to review their HIPAA Plans and related policies and procedures to ensure updated compliance as well as conduct additional training and education to workforce members. 

II. Prohibited Conduct

Under the Cures Act, it is unlawful for anyone to engage in “information blocking,” and such conduct could result in a $1,000,000 civil monetary penalty per violation. “Information blocking” is defined as any practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, and if conducted by a health care provider, such provider knows that the practice is unreasonable and is likely to be considered information blocking.[2]

Examples of information blocking include, but are not limited to, (1) practices that restrict authorized access, exchange, or use of such information for treatment, including transitions between certified health information technologies; (2) implementing health information technology in non-standard ways that are likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information; and (3) implementing health information technology in ways that are likely to (a) restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or in transitioning between health information technology systems; or (b) lead to fraud, waste, or abuse, or impede innovations and advancements in health information access, exchange, and use, including care delivery enabled by health information technology.[3]

III. Regulatory Guidance

On May 1, 2020, the Office of the National Coordinator for Health Information Technology (“ONC”), a subset of HHS, issued a final rule on interoperability, information blocking, and the ONC health IT certification program.[4] This guidance clarified the export requirements of certain electronic health information and outlined actions that are not considered information blocking.

a. Interoperability

In the final rule, the ONC refined the scope of data a health IT module must export, aligned the standards to the definition of electronic health information, and advanced common data through the U.S. Core Data for Interoperability (“USCDI”). The USCDI is a standardized set of health data classes and data elements that are essential for nationwide, interoperable health information exchange.[5] The purpose of this rule is to advance and promote the complete access, exchange, and use of all electronically accessible health information.

The finalized criterion requires a certified health IT module to electronically export all of the electronic health information (further defined to include all protected health information under HIPAA, not including psychotherapy notes or information compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding) that can be stored at the time of certification by the product, of which the health IT module is a part.[6]

The rule further defines eight different types of clinical notes that must be shared under new USCDI standards: (1) consultation notes, (2) discharge summary notes, (3) history and physical, (4) imaging narratives, (5) laboratory report narratives, (6) pathology report narratives, (7) procedure notes, and (8) progress notes.[7]

b. Information Blocking Exceptions[8]

Pursuant to the Cures Act directive, in the above-mentioned final rule, the ONC developed eight exceptions to information blocking that may be utilized by health care actors (or health care providers, health IT developers, health information networks, and health information exchanges). If an actor engages in one of these exceptions, then such action is not considered information blocking and will not be subject to civil monetary penalties. An actor’s practice that does not fully meet the conditions of an exception will not automatically constitute a violation; practices will be evaluated on a case-by-case basis.

The eight exceptions are further divided into two categories: (1) exceptions that involve not fulfilling requests to access, exchange, or use electronic health information; and (2) exceptions that involve procedures for fulfilling requests to access, exchange, and use electronic health information.

i. Exceptions that Involve Not Fulfilling Requests to Access, Exchange, or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

• Practices that are reasonable and necessary to prevent harm to a patient or another person.

• To not fulfill a request to access, exchange, or use electronic health information in order to protect an individual’s privacy.

• To interfere with the access, exchange, or use of electronic health information in order to protect the security of the electronic health information.

• To not fulfill a request to access, exchange, or use electronic health information due to the infeasibility of the request.

• To take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT’s performance for the benefit of the overall performance of the health IT.

ii. Exceptions that Involve Procedures for Fulfilling Requests to Access, Exchange or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

• To limit the content of its response to a request to access, exchange, or use electronic health information or the manner in which it fulfills a request to access, exchange, or use electronic health information.

• To charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using electronic health information.

• To license interoperability elements for electronic health information to be accessed, exchanged, or used.

• Key conditions:

• An actor must bring license negotiations to the requestor within 10 business days from receipt of the request and negotiate a license within 30 business days from receipt of the request.
• The licensing conditions:
  • Scope of rights
  • Reasonable royalty
  • Non-discriminatory terms
  • Collateral terms
  • Non-disclosure agreement

These new regulations and guidance make it imperative providers and health care practices update their HIPAA policies and procedures, especially with the expansion of telehealth and new ways of sharing information between providers and patients.

Please contact a BMD healthcare attorney should you have any questions regarding this final rule, questions regarding information blocking and the sharing of health information, or other general healthcare issues.

[1] Codified at 42 U.S.C. § 300jj-52.

[2] Id. at (a)(1).

[3] Id. at (2).

[4] See 85 Fed. Reg. 25642.

[5] HHS, HHS Finalizes Historic Rules to Provide Patients More Control of Their Health Data, (March 9, 2020), https://www.hhs.gov/about/news/2020/03/09/hhs-finalizes-historic-rules-to-provide-patients-more-control-of-their-health-data.html.

[6] 45 C.F.R. § 170.315(b)(10).

[7] 85 Fed. Reg. 25642, 25674.

[8] A full breakdown of these exceptions can be found, https://www.healthit.gov/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf.