The 21st Century Cures Act required the Office of National Coordinator for Health ITs (ONC) to develop regulations to improve interoperability and patient access to electronic health information (EHI) and deter information blocking. These new regulations took effect November 2, 2020. Patients, clinicians and hospitals, and IT developers are the primary parties to these regulations. However, there have been extensions granted due to the COVID-19 pandemic. The interim rule with comment period is open until April, 2021 and much of the rollout is slated for 2022 and 2023 (see ‘Learn More – Primary Sources’ for dates).

There are multiple facets to these new regulations, including patients having ease of access to their medical records, privacy protection, and the ability to shop for care and manage costs similar to online shopping. Patients will be able to electronically access all of their EHI, structured and/or unstructured, at no cost.

For clinicians and hospitals, the plan is for patient data requests to be easy and inexpensive. This includes directives regarding transparency regarding patient safety and protection of developers’ intellectual property rights.

These new regulations do allow fees and royalties, including a reasonable profit margin, for access to data.

What is Information Blocking? 

Information blocking is defined as “a practice by a health IT developer of certified health IT, health information network, health information exchange, or health care provider that, except as required by law or specified by the Secretary of Health and Human Services (HHS) as a reasonable and necessary activity, is likely to interfere with access, exchange, or use of electronic health information (EHI).” These new regulations have been developed to discourage information blocking.

The following actors are subject to information blocking policies

• Health IT developers
• Health care providers
• Health information exchanges (HIEs) and health information networks (HINs)

However, there are reasonable exceptions where information blocking may be acceptable including (but not limited to)

• Preventing harm
  • Focuses on physical harm that could result, for example, due to incorrect information being exchanged and impacting patient care
  • There must be a reasonable belief that blocking information will substantially reduce a risk of harm
  • Blocking must not be broader than necessary
• Privacy
  • Focuses on physical harm that could result, for example, due to incorrect information being exchanged and impacting patient care
  • A provider may be required to fulfill a state or federal law (such as a patient consent or authorization) prior to providing access, exchange, or use of EHI
  • An individual may request not to share information and therefore, and therefore blocking information would be fulfilling the wishes of the individual
• Infeasibility
  • Acknowledges that some circumstances are beyond providers’ control and pose a barrier to information access or exchange
• Health IT performance
  • Recognizes that technology may be unavailable under certain circumstances, for example due to required maintenance or upgrade

Penalties

Those who engage in information blocking are subject to penalties. Penalties could be as high as $1 million per violation should there be interference with the access, exchange or use of electronic health information. Enforcement mechanisms are not yet in place.

Resources

Office of the National Coordinator for Health Information Technology: Information Blocking

Information Blocking and the ONC Health IT Certification Program: Extension of Compliance Dates and Timeframes in Response to the COVID-19 Public Health Emergency

ACOG: Prepare Your Practice: 21st Century CURES Act “Information Blocking” Rules Checklist

HHS Finalizes Historic Rules to Provide Patients More Control of Their Health Data

Federal Register: 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program

Implementing the Cures Act – Bringing Consumer Computing to Health Care (Rucker et al. NEJM, 2020)

Ethical and Legal Implications of Remote Monitoring of Medical Devices (Cohen at al. Milbank Q, 2020)

US policy requires immediate release of records to patients