Information Blocking Requirements Under 21st Century Cures Act Effective April 5, 2021: Provider Responsibilities
Release of the Final Rule for the 21st Century Cures Act established a compliance and enforcement date of April 5, 2021 for health care providers to offer patients unhindered electronic access to certain aspects of their electronic health records.
The Act mandates seamless patient access to the notes clinicians take during a health encounter and to eight types of electronic health information free of charge. This includes progress notes; procedure notes; consultation notes; discharge summary notes; history and physical; laboratory report narratives; pathology report narratives and imaging narratives.
There are several exceptions to the access rules under certain conditions. For example, providers may withhold information that could reasonably be construed to result in harm to the patient or another person, or where HIPAA restricts release of the information such as psychotherapy notes. Otherwise, all health care providers, health information exchanges and certified health IT developers must comply.
A key provision of the Act is that health care providers are prohibited from information blocking, or practices that are likely to intentionally or unintentionally interfere or restrict a patient’s access, exchange or use of electronic health information. While there are defined exceptions to not fulfilling access or exchange requests, the spirit of the Act is to disclose records. Therefore, providers found to engage in blocking activities or practices could be subject to monetary penalties, if non-compliance is found, when patient complaints are investigated.
While the Final Rule pertains exclusively to electronic health information and the access and exchange of that data, practices that rely on paper charts are not exempt from information blocking requirements. Providers must continue to provide printed records within the required timeframe under HIPAA and Virginia law.
The Final Rule also establishes secure standards-based application programming interface requirements to support a patient’s access of information through a smartphone app of choice. In addition, it will be vital to determine if a current EHR contract contains a provision that prevents users from sharing information related to the EHR through screenshots or video.
This Final Rules impacts virtually all health care providers, so it is necessary to prepare for these changes. Steps providers should take now include:
- Confirm the provider’s IT vendor is prepared to support the requirements of the Rule, and can make configuration changes as necessary.
- Review and revise clinical workflow policies and procedures to streamline patient record request responses.
- Ensure HIPAA privacy policies adequately address patient access requests. Develop a timely process for patient responses.
- Develop a policy for incoming reports from other providers, as well as lab and test results.
- Consider if provider training and education is needed on sensitivity of language used in notes.
- Determine any electronic health information that may reside in non-EHR applications, and plan for patient access.
- Identify and obtain legal counsel to advise and assist with compliance and exceptions.
Attorneys and practice areas related to this topic include:
- Jonathan M. Joseph
- Health Care Law
Click here for a printable file.
This has been provided as an informational service and does not constitute legal counsel or advice, which can only be rendered in the context of specific factual situations. If a legal issue should arise, please contact an attorney listed or retain the assistance of other competent legal counsel. Case results depend on a variety of factors unique to each case and results do not guarantee or predict a similar result in any future case undertaken.