New Rules for Patient Access to Electronic Health Records

The Rule
There is a new rule governing patient access to electronic health information (EHI), created in accordance with the 21^st Century Cures Act, legislation passed by Congress in 2016. A copy of the rule can be found here: https://www.govinfo.gov/content/pkg/FR-2020-05-01/pdf/2020-07419.pdf. The relevant portion of the Act, as it relates to the new rule, forbids “information blocking,” defined in part as a practice that “is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.”   The Cures Act prohibits a health care provider from engaging in a practice that the health care provider knows “is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.” 42 U.S.C. 300jj-52.

The Cures Act authorized the Secretary of Health and Human Services to make rules consistent with the prohibition against information blocking. The rule in question went into effect on April 5, 2021, requiring electronic health information to be shared with a patient, such as through a patient portal.   In 18 months, by October 6, 2022, EHI must be available to be shared with a patient’s 3^rd party application (“app”) that may be downloaded to a smart phone or other device. Notably, the EHI need only be made available to patients who request access, exchange or use of their EHI, and does not have to be made proactively available to patients who have not requested it.   However, once the request for access, exchange or use is made, the response must be timely.

As stated above, the Cures Act and the new rule are designed to prevent any delay in the access, exchange, or use of EHI. The rule defines “access” as “the ability or means necessary to make EHI available for exchange or use.” The rule defines “exchange” as “the ability for EHI to be transmitted between and among different technologies, systems, platforms, or networks.”   “Use” is defined as “the ability for EHI, once accessed or exchanged, to be understood and acted upon.” 45 CFR 171.102.

In general, the rule requires that healthcare providers give patients access to their EHI without delay. Such access must be free of charge to the patient, although the rule acknowledges that a limited fee for access may be permissible if the fee is reasonably designed to reimburse the provider for the costs of providing access, among other conditions.

What EHI is Affected?
The Rule allows a narrower set of EHI categories to be made available on April 5, 2021, and then requires a broad definition of EHI to be made available on and after October 6, 2022.

The type of EHI that must be made available on April 5, 2021, includes all “data elements” represented in the United States Core Data for Interoperability (USCDI) standard, issued by The Office of the National Coordinator for Health Information Technology (ONC). Those data elements include:   Allergies and Intolerances; Assessment and Plan of Treatment; Care Team Members; Clinical Notes; Goals; Health Concerns; Immunizations; Laboratory; Medications; Patient Demographics; Problems; Procedures; Provenance; Smoking Status; Unique Device Identifier(s) for a Patient’s Implantable Device(s); and Vital Signs.   The types of Clinical Notes that must be provided are consultation notes, discharge summary notes, history & physical, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes, and progress notes. See https://www.healthit.gov/isa/sites/isa/files/2020-10/USCDI-Version-1-July-2020-Errata-Final_0.pdf

By October 6, 2022, the EHI that must be made available broadens to include all individually identifiable health information that is transmitted by electronic media or maintained in electronic media.

For purposes of the rule, EHI does not include (a) psychotherapy notes, meaning notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record; or (b) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

Exceptions to the Rule
The ONC has defined eight (8) exceptions to the rule, which are generally described below, but which have several conditions that control whether they may be claimed.
               1. Preventing Harm (to a patient or another person)
               2. Privacy (to follow federal or state privacy laws)
               3. Security (actions necessary to protect security of EHI)
               4. Infeasibility (technological capabilities or other practical difficulties)
               5. Health IT Performance (protecting overall performance of the health IT)
               6. Content and Manner (flexibility in how EHI is provided)
               7. Fees (certain limited fees may be allowed)
               8. Licensing (allowing a provider to impose certain protections)

Additional details about these exceptions can be found in the following ONC document:  https://www.healthit.gov/cures/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf

Practical Applications of the Rule
The rule does not require a health care provider to generate medical records more quickly than it already does.   Commentary to the rule states that the rule applies to access to EHI “that a health care provider has,” and that a delay in providing access to EHI would not likely be considered information blocking if the delay is necessary to enable access, exchange or use of EHI.   Based on that guidance, health centers and other providers are not required to speed up its generation of medical records, but once those records are generated they have to be made available to the patient without delay.

The rule does not require health care providers to have or use Health IT certified under the ONC Health Certification Program, or immediately upgrade their certified Health IT.

Commentary to the rule acknowledges that some delays in providing access, exchange or use of EHI “may be legitimate and inevitable due to factors such as limited legal, project management, and technical resources,” and that when investigating an allegation of information blocking, each practice will be analyzed on a case-by-case basis.   However, there are some situations that already have been defined as information blocking.   For example, a health care provider should not enact a policy that imposes a delay in the release of EHI to allow a physician to review results or personally inform a patient of the results.    The commentary to the rule expressly rejected the argument that the “Preventing Harm” exception would justify a blanket policy that allowed a physician to communicate with a patient about negative health data (e.g., a bad test result) before that data was made available for the patient to access - and acknowledged that a patient and physician might therefore see the test result at the same time - though it did leave open the possibility that such a delay might be justified if particular facts warrant it on a case-by-case basis.

For more information or assistance on how this new rule applies to your practice, please contact Lewis Kappes attorneys, Tom Ruge or Brian Statz, at 317.639.1210.

News