By: Alaina N. Crislip and Lindsay D. Petrosky
The time is now for compliance teams to review their systems, policies, and procedures to ensure they are ready to comply with the Final Rule on Information Blocking (the “Final Rule”)1 issued by the Office of the National Coordinator for Health Information Technology (ONC) in March of this year. The Final Rule stems from the 21st Century Cures Act (the “Cures Act”),2 which was passed by Congress in with the goal of increasing innovation and interoperability within the health systems by increasing patient access to their electronic health information (EHI). Compliance with the Final Rule is required by November 2, 2020.3
The two main components of the Cures Act focus on (i) information blocking and (ii) certification criteria. The purpose of the Final Rule is to address concerns that individuals had with entities limiting the availability of EHI for patients. A common theme in the Final Rule is its far-reaching application through the adoption of broad definitions. The Final Rule encourages a seamless flow of information between payers, healthcare providers, and patients. “Information Blocking” is a practice, by a (i) health information technology developer of certified health information technology, (ii)health information network/health information exchange, or (iii) a health care provider (all collectively referred to as “Actors”), that is likely to interfere with, prevent, or materially discourage access, exchange or use of EHI.4 The Final Rule establishes a knowledge threshold. The knowledge requirements vary amongst the types of Actors; a health I.T. developer or health information exchange/network “knows, or should know” of the likelihood of such interferences, while a health care provider “knows that such practice is unreasonable” and is likely to cause interferences.5
The Final Rule defines “health care provider” as it is defined under the Public Health Services Act.6 This definition is extremely broad and include the following types of individuals and entities: hospitals; skilled nursing facilities/nursing facilities and other long-term care facilities; home health entities; health care clinics; community mental health centers; renal dialysis facilities; blood centers; ambulatory surgical centers; emergency medical services providers; federally qualified health centers; group practices; pharmacists/pharmacies; laboratories; physicians; practitioners (physician assistants, nurse practitioner, clinical nurse specialists, certified registered nurse anesthetists, certified nurse-midwives, clinical social workers, clinical psychologists, and registered dietitians or nutrition professionals; providers operated by, or under contract with the Indian Health Service or by an Indian tribe, triable organization, or urban Indian organization; rural health clinics; covered entities under 42 U.S.C. §256b7, ambulatory surgical centers; therapists; any other category of health care facility, entity, practitioner or clinical determined appropriate by the Secretary.
The ONC has identified eight exceptions to the Information Blocking rule.8 The exceptions may be categorized into two buckets. The first bucket includes exceptions one through five which involve not fulfilling requests to access, exchange or use EHI. The second bucket, exceptions six through eight, involve procedures for fulfilling requests to access, exchange or use EHI. These eight categories include: (1) preventing harm, (2) privacy, (3) security, (4) infeasibility, (5) health IT performance, (6) licensing, (7) costs, and (8) content and manner.
These exceptions will be treated by ONC as safe harbors and provide protection from penalties associated with Information Blocking. This means that failure to meet the conditions of an exception does not automatically mean a practice constitutes Information Blocking. Instead these practices will be reviewed on a case-by-case basis, and a determination will be made on the actor’s compliance.
It is clear that Actors will need to examine existing agreements, policies and procedures, and business practices in light of this Final Rule. As we count down to the Information Blocking compliance deadline, Jackson Kelly will roll out more information on each of the Information Blocking exceptions and provide compliance tips to incorporate as part of an overall Compliance Plan. For more resources on Information Blocking and to evaluate whether it applies to you, please contact a Jackson Kelly attorney.
1 85 FR 25642
2 PL 114-255, December 13, 2016, 130 Stat 1033
3 Note that although the compliance deadline is November 2, 2020, ONC has stated that at least a three (3) month enforcement discretion grace period will be provided. Further note, that technically there can be no enforcement until the Office of the Inspector general issues a final rule on civil monetary penalties associated with violations of the Information Blocking Final Rule.
4 42 U.S.C. § 300jj-52(a)(1); 45 C.F.R. § 171.103(a).
5 42 U.S.C. § 300jj-52(a)(1)(B)(i); (ii), 45 C.F.R. § 171.103(a).
6 Final Rule 25955, citing 42 U.S.C. § 300jj(3).
7 Note that this is not a “covered entity” as defined by HIPAA. The definition of a covered entity for purposes of the Final Rule may be found at 42 U.S.C. 256b(a)(4).
8 45 C.F.R. §§ 171.201-205; 45 C.F.R. §§ 171.301-303.