Dr. Anirban Kundu
Manager - Clinical Solutions
(Author)
Dr. Amar Jain
VP - Clinical Solutions
(Co-Author)
Have you heard about the 21st Century Cures Act?
The Cures Act was signed into law on December 13, 2016. The U.S. Department of Health and Human Services (HHS) finalized the two sets of rules in March 2020. The Final Rule of the 21st Century Cures Act is intended to prevent the blocking of electronic health information between devices, applications, and health systems. Health organizations must not obstruct the access, exchange, or use of electronic health information.
Key Takeaways
- Patients should have access to view/inspect their health information that is stored in their clinical notes.
- Doctors, nurse practitioners and clinics will be required to provide patients with immediate access to their health reports, such as lab results and other information.
The Final Rule includes a provision for modern smartphone apps to provide patients with easy access to their records, including access to information about the cost of care and potential outcomes.
What is Information Blocking?
As defined in 45 CFR §171.103, Information blocking is a technique where:
- When mandated by law or exempted by an exception, is likely to obstruct access to, exchange, or utilisation of electronic health information.
- If carried out by a health information technology developer, network, or exchange, they are aware of, or should be aware of, the likelihood that such practices will materially deter access to, exchange of, or use of electronic health information.
- The practice, if carried out by a healthcare provider, is unreasonable and likely to obstruct, prevent, or materially discourage access to, exchange, or use of electronic health information.
For the first two years of the final rule, EHI access, exchange, and use are restricted to the U.S. Core Data for Interoperability (USCDI), a standardized collection of health data classes and underlying data elements for cross-country interoperable health information exchange.
Since the definition of information blocking is open-ended, ONC provides eight categories of “reasonable and necessary” activities that do not constitute information blocking, given that certain conditions are met. These are called the information blocking exceptions.
What are the Information Blocking exceptions?
If a provider cannot provide information in the format requested by the patient, should the provider refer the patient to the EHR vendor for the same?
Since practices are viewed as the keepers of information, the immediate answer should be no. Directing the patient to the EHR vendor could be interpreted as information blocking.
You can, however, contact your EHR vendor and walk through the information blocking and exceptions to determine which, if any, may apply.
Determining whether information requests fall into the exception category, begins with a clear understanding of the eight exceptions mentioned previously in this 21st Century Cures Act summary. These categories are as follows:
- Preventing harm
- Privacy
- Security
- Infeasibility
- Health IT performance
- Content and manner
- Fees
- Licensing
Within your practice, it is critical that you establish a process for evaluating information requests and ensure that all staff members are made aware of the exceptions involved. Based on our experience, we recommend creating checklists that outline the information you need to evaluate.
The best practice is to continue summarizing the 21st Century Cures Act for your staff. Moreover, the rule establishes uniform standards for application programming interface (API) development.
ONC interoperability rules and API functionality
The ONC refers to APIs as “powerful tools” that facilitate interoperability. An API token is an electronic “key” that allows software applications to connect.
According to the Final Rule, the health care industry must support Application Programming Interface (API) functionality. It necessitates the use of standardized APIs in their health IT software certified through the ONC Health IT Certification Program.
However, the way current API technology is built, there isn’t a consistent approach to plug an API token into an app like Apple Health. The Cures Act proposes a standardized format known as Fast Healthcare Interoperability Resources (FHIR), which allows a new market of health apps to leverage data from any EHR in the standard format.
Timelines
The timelines for the 21st Century Cures Act should be followed by all health care systems/IDNs and Payers, as the deadlines for the patient-facing mandates approach. If these standards are not met, health systems may face penalties of up to $1 million.
A good understanding of the timeline is crucial in the final step of the Cures Act preparation.
Here’s a rundown of key 21st Century Cures Act milestones through 2023:
- April 5, 2021: Implementation date for information-blocking provisions.
- October 6, 2022: The definition of EHI is no longer limited to EHI identified by data elements in USCDI.
- Up to October 5, 2022: EHI will only be able to use data elements that are part of the US Core Data for Interoperability (USCDI), a standardised set of health data classes and constituent data elements for cross-country interoperable health information exchange. These informational components include allergies and intolerances; assessments and treatment plans; care team members; clinic notes; goals; immunizations; lab; medications; patient demographics; problems; procedures; provenance; smoking status; special device IDs for implantable devices; and vital signs.
- After October 5, 2022: The standard applies only to electronically protected health information (ePHI) in a specific record set, excluding psychotherapy notes and data gathered for use in a civil, criminal, or administrative action.
- By December 31, 2022: New HL7 FHIR API capability and other criteria must be available.
- By December 31, 2023: EHI export capability must be available.
The rule published by CMS can be accessed here: CMS Guidelines and Regulations
In a nutshell, what does the
21st Century Cures Act imply for your practice?
You may have a general understanding of the requirements, but how do you ensure that your practice complies?
When it comes to patient data requests, the Cures Act forbids Providers, Developers, and Health Information Networks from engaging in practices that prevent patients from receiving their data directly or from a source of their choice.
The Cures Act information blocking is focused on EHI or data stored in your EHR or other electronic forms. When a patient requests their data, they have several options:
- Printing the data from the EHR
- Exporting it through a Continuity of Care Document (CCD) in the EHR
- Directing patients to view and download data using a patient portal
The first step in information sharing is to provide data in US Core Data for Interoperability (USCDI) format. For this, a patient portal is essential to allow you to provide information to your patients. Patients can receive USCDI data directly in the portal and share it with other providers via a direct email. They can also send it to themselves or to their health proxies.
Other considerations
- Determine whether your practice will have access to the data in your practice management system. The requirements still apply if your practice only uses a practice management system. You must still provide medical information to a patient or a third party.
- Even if your practice is unsure whether your system supports specific methods of information transfer, you must still provide records. Consider how you’ll respond to requests to connect to your data.
- If your practice does not use a patient portal, the EHR can generate the portal’s information through CCD or another mechanism without requiring manual intervention.
- If your practice handles revenue services in-house, you’ll need to know where the data is and how you’ll be able to provide it in an electronic format. Can you export the stored data if you use a billing service? Do you have a process in place to support EHI exports?
Avoid the pitfalls of falling behind and start shifting towards a more digitally agile future today. Contact us to learn more.
