Introduction

On March 9, 2020, the US Department of Health and Human Services (HHS), Office of the National Coordinator for Health Information Technology (ONC) released a final rule implementing key provisions of the 21st Century Cures Act (Cures Act). The regulation, which promotes patient access to electronic health information (EHI), focuses on (i) interoperability, (ii) access to, and use and exchange of, EHI, and (iii) information blocking. The stakeholders most affected by the new regulations are health information technology (HIT) developers, exchanges and networks, as well as health care providers.

Certification

HIT developers that participate in the voluntary ONC Health IT Certification Program (the Program) will need to be aware of a new application programming interface (API) certification criterion that replaces the “application access-data category request” requirement. HIT developers also are subject to two new privacy and security certification criteria for transparency attestations to identify whether certified HIT supports encrypting authentication credentials and/or multi-factor authentication. Most importantly, there are new “Conditions and Maintenance of Certification” requirements for HIT developers and their certified HIT module(s) under the Program.

Information Blocking

All stakeholders must comply with the new rules on information blocking. The prohibition on information blocking under the Cures Act responded to concerns that some individuals and entities were engaging in practices that unreasonably limited access to and the use of EHI. These practices were “frustrating [HHS] efforts to use modern technologies to improve health care quality and efficiency, accelerate research and innovation, and provide greater value and choice to health care consumers.”¹

The Cures Act defines “information blocking” as a practice that health care providers or HIT developers, exchanges, or networks engage in that “is likely to interfere with, prevent, or materially discourage access, exchange, or use of [EHI].”² In the final rule, ONC identifies eight exceptions to the information blocking prohibition. In essence, the exceptions address activities that––although likely to interfere with, prevent, or materially discourage access to, or the exchange or use of, EHI––are nevertheless reasonable and necessary under certain circumstances.  

The first five exceptions (each of which is subject to certain conditions) cover situations where a request to access, exchange or use EHI may be denied. These include:

1. Preventing harm exception. Practices that are reasonable and necessary to prevent harm to a patient or another person.
2. Privacy exception. Practices that are reasonable and necessary to protect the privacy of an individual’s EHI.
3. Security exception. Practices that are reasonable and necessary to promote the security of EHI.
4. Infeasibility exception. Practices where a person declines to provide access to EHI because doing so is infeasible.
5. Health IT performance exception. Practices that are reasonable and necessary to maintain and improve the overall performance of HIT.

The final three exceptions (which also are subject to certain conditions) concern procedures for fulfilling requests to access, exchange, or use EHI. These include:

6. Content and manner exception (not included in Proposed Rule). Practices where an actor reasonably limits the content of its response to, or the manner in which it fulfills, a request to access, exchange, or use EHI.
7. Fees exception. Practices where an actor is permitted to recover certain costs reasonably incurred in connection with accessing, exchanging, or using EHI.
8. Licensing exception. Practices where an actor licenses interoperability elements on reasonable and non-discriminatory terms.

A violation of the information blocking provision may result in the imposition of civil monetary penalties or “appropriate disincentives,” so understanding the exceptions will be crucial for providers as they contract with their electronic health records (EHR) or HIT vendors. Providers should re-evaluate their current vendor agreements, EHR systems, and internal policies for potential information blocking activities, and consider possible changes in light of the new rule.

^{1 84 Fed. Reg. 7424, 7508 (March 4, 2019).}

^{2 42 U.S.C. 300jj-52(a)(1)(A)-(B).}