Increased Patient Access to Health Records – the Cures Act
The 21st Century Cures Act (Cures Act), signed into law in 2016, was designed to help bring health care innovations to patients to provide more patient control in a value-based health system.[i] Recognizing that patient access and ease of transfer of health records are key, the law includes two provisions that directly affect health care offices: 1) providers are prohibited from “information blocking” (practices that restrict transfer of information); and 2) electronic health record systems must allow for interoperability (easy interface) among different health systems. After some delays in implementation, HHS’ latest release says that the rule will now be applied starting April 5, 2021.
What is Prohibited Information Blocking?
According to the federal government’s Office for Health Information Technology, “…information blocking is a practice by a health IT developer of certified health IT, health information network, health information exchange, or health care provider that… is likely to interfere with access, exchange, or use of electronic health information (EHI).” The government refers to these entities as “actors” who are covered by the law. In a health care office, physicians are required to adopt health information practices and use standard EHR that does not unreasonably restrict access or exchange of information.
The government wants patients to be able to get records easily, inexpensively, and through the use of widely available technology such as phone applications. To accomplish these goals, physicians must use office procedures that facilitate ease of medical records requests, as well as standard EHR that can easily “talk to” other EHR systems. These rules will apply regardless of the form used for your documentation, including paper notes.
A Shift in the Default to Not Disclose under HIPAA Privacy Rules
HIPAA has always permitted providers to err on the side of caution in transferring records without a patient authorization. Under the HIPAA rules, providers are permitted, but not required, to disclose protected health information (PHI) under certain conditions. Under the Information Blocking Rules, providers are required to disclose records unless an exception applies. The new rule’s policy is to start with the presumption to disclose, rather than not disclose, the records.
Very generally, some of the exceptions permit covered “actors,” including physicians, to deny records disclosure to prevent harm to a patient, to protect an individual’s privacy, or to protect security of electronic health information, provided certain conditions are met. As the application of the rule begins in April 2021, the CCA believes we will be able to learn more about examples of situations that would qualify under an exception and will release more information as that deadline approaches.
EHR Requirements – Interoperability
According to the Department of Health and Human Services (HHS), many EHR contracts contain provisions that prevent users from sharing information related to the EHRs in use, such as screen shots or video. The final rule updates certification requirements for health IT developers and establishes new provisions to ensure that providers using certified health IT have the ability to communicate with each other about user experience, interoperability, and security including (with limitations) screenshots and video.
The rule also requires EHR to use application programming interface (API) to support a patient’s access and control of their electronic health information. APIs allow patients to obtain their electronic health information through the smartphone app of their choice.
Steps to Take Now
It is important to know that many of these requirements will be on the shoulders of your EHR provider. Therefore, the CCA recommends that doctors review their EHR agreements and contact their vendors to confirm that their EHR will be certified and in compliance with the Cures Act and Rules no later than the application date of April 5, 2021. We will continue to provide additional information as it becomes available concerning steps to take to prevent information blocking in your offices.
[i] The Cures Act is unrelated to and not to be confused with the 2020 CARES Act –The Coronavirus Aid, Relief, and Economic Security Act).