By Steven Posnack, M.S., M.H.S. Deputy National Coordinator for Health Information Technology
Twitter: @ONC_HealthIT
Steven’s Twitter: @HealthIT_Policy
In a companion blog post I covered some foundational points about the 21st Century Cures Act’s (Cures Act) information blocking law and the regulation ONC issued to implement the law.
As a quick recap, there are three categories of “actors” to whom the law applies: health care providers, health IT developers of certified health IT, and health information networks (HINs)/health information exchanges (HIEs). Based on the information blocking law, in general, if these three types of actors engage in practices that interfere with the access, exchange, or use of electronic health information (EHI), they could be subject to penalties or other disincentives.
If, under the law, actors make EHI accessible, exchangeable, and usable (“share” for short), then there’s a relatively low likelihood that information blocking has occurred. But what happens if an actor is unable to share EHI? What happens if an actor is willing to share but wants or needs specific conditions to be met before they do (e.g., patient consent, data format, licensing)?
Relevant to circumstances where it may be impossible to share EHI as requested, or reasonable and necessary for specific conditions to be met before EHI can be shared, Congress charged the HHS Secretary to identify reasonable and necessary activities that do not constitute information blocking. In other words, “exceptions” to the information blocking law.
The Office of the National Coordinator for Health Information Technology (ONC) published the Cures Act Final Rule to establish such exceptions, their boundaries (“conditions”), and when each could apply. Moreover, it’s important to keep in mind that under the information blocking law, following or “using” an exception is not mandatory – it is an actor’s choice. Obviously, if someone alleges that information blocking occurred and an actor did not follow or cannot use a relevant exception, then that could put the actor at significantly more risk.
The Cures Act Final Rule established eight exceptions that fall into two categories:
Category 1: Exceptions that involve not fulfilling requests to access, exchange, or use EHI. Five specific exceptions were established in this category. These exceptions aim to give clarity to actors that their practices (consistent with an exception) would not constitute information blocking when they are unable to share all the EHI requested or part of the EHI requested. For example, the Cures Act Final Rule provides exceptions to prevent patient harm, protect patient privacy, and ensure the security of EHI. These exceptions broadly address scenarios such as when a patient’s consent is required and the patient has denied that consent, health IT downtime events, or being unable to segment EHI that, for example, cannot be disclosed by law.
Category 2: Exceptions that involve procedures for fulfilling requests to access, exchange, or use EHI. Three exceptions were established in this category. These exceptions aim to support actors when they are willing to share EHI but may need to do so in a different format than requested or to address specific market considerations, such as intellectual property rights or fees, before doing so. These exceptions recognize that actors should be able to engage and negotiate EHI-related sharing and services in an open market. At the same time, many of the complaints leading up to the Cures Act’s passage and ONC’s subsequent regulation indicated that actors were leveraging their market power to engage in anti-competitive and EHI-restrictive practices – causing more friction in the market and preventing EHI from being shared. Accordingly, the three specific exceptions that HHS adopted provide guardrails for actors with the ultimate goal of EHI being shared.
View a detailed fact sheet on each of the eight exceptions. In addition, there are a few more points to consider.
- An actor’s practice that does not meet the condition(s) of an exception will not automatically constitute information blocking.
- HHS will evaluate practices associated with an information blocking complaint on a case-by-case basis to review specific facts and determine whether an actor has committed information blocking. As described in the Cures Act, the HHS Office of Inspector General has a role to play in investigating claims of information blocking and the enforcement of civil monetary penalties that the statute authorizes for health IT developers of certified health IT and HIN/HIEs.
- If you believe you’ve experienced information blocking please report it through our feedback portal by clicking on “report information blocking.” The Cures Act provides for specific confidentiality protections under the law.
More information about the exceptions to information blocking is available on our Cures Act Final Rule webpage, including fact sheets, frequently asked questions, and recorded webinars. Please note that the summary provided in this blog post is based on the provisions contained in 45 CFR Parts 170 and 171. While every effort has been made to ensure relevant excerpts are summarized accurately, this blog post is not a substitute for the regulations.
This post was originally published on the Health IT Buzz and is syndicated here with permission.