Health care providers and others will need to cease practices the government calls “information blocking” under rules published on May 1. HHS also published final rules on interoperability that establish protocols for information sharing.
Both rules stem from requirements contained in the 21st Century Cures Act[1] that are aimed at easing the sharing of patient information throughout the health care system, including with patients themselves.
The rules are likely to mean that hospitals and other providers will have to adopt better systems to allow patients to electronically access all of their electronic health information (EHI). Although some parts of the rules took effect in April, most won’t apply until later this year, 2021 and 2022. It’s also possible that deadlines in the rules could be delayed.
The final rules also detail the process for investigations and sanctions, including civil penalties, by the HHS Office of Inspector General (OIG) for actors—provider organizations, health information technology (IT) developers, exchanges and others—that engage in information blocking. Also on May 1, OIG published a proposed rule establishing penalties for violating the rules.
Several HHS agencies, including the Centers for Medicare & Medicaid Services (CMS), the Office for Civil Rights and the Office of the National Coordinator for Health Information Technology (ONC), were involved in the rules’ creation. The CMS interoperability and patient access rule runs for 131 pages,[2] while the ONC rule on interoperability, information blocking and the ONC Health IT Certification Program came in at 320 pages.[3]
The provisions on information blocking likely are of most interest to HIPAA covered entities and business associates. The ONC final rule identifies and finalizes what HHS terms “the reasonable and necessary activities that do not constitute information blocking while establishing new rules to prevent ‘information blocking.’” HHS considers “information blocking practices” as anticompetitive behaviors by health care providers, developers of certified health information technology, health information exchanges and health information networks.
