Cures Act Information Blocking Rule: Steps to Take to Ensure Your Practice Is in Compliance

© Khakimullin Aleksandr / shutterstock.com

The 21st Century Cures Act (Cures Act), which became law on Dec. 13, 2016, emphasized interoperability in the exchange of healthcare information among healthcare providers, health information entities, and patients. The Cures Act underscored unimpeded access to patient electronic health information (EHI) upon request, in a manner that’s secure, is updated automatically, and prohibits healthcare providers, health IT developers, health information networks, and health information exchanges from engaging in unreasonable or unnecessary blocking of EHI information.

On March 9, 2020, the U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health Information Technology (ONC) issued a final rule that created eight exceptions to the Cures Act information-blocking prohibition. Below, we discuss information blocking, the exceptions created by the final rule, and the steps providers need to take to ensure that they’re in compliance with the rule, which became effective on April 5, 2021.

The Information Blocking Rule

Physicians can experience information blocking when trying to access patient EHI from other providers, when connecting their electronic health record (EHR) systems to local health information exchanges, or when migrating from one EHR to another. Physicians may run afoul of the information blocking prohibition in response to a request for access to, exchange of, or use of EHI. Physicians may also violate the information blocking rule if they knowingly take actions that unreasonably or unnecessarily interfere with access to, exchange of, or use of EHI, even if no patient harm occurs.

Common examples of information blocking include unnecessary delays in the provision of patient test results, policies requiring staff to obtain written consent from a patient before sharing EHI with unaffiliated providers for treatment, or interference with an EHR that would generally enable EHI to be shared with other providers or patients.

Providers and their workforce should participate in any training programs necessary to comply with the information-blocking framework.

The ONC provides eight exceptions to information blocking that may offer healthcare providers protection for certain actions in response to requests to access, exchange, or use EHI. Providers must satisfy all conditions and elements of an exception, or their actions may be considered information blocking and be subject to enforcement. Providers should note that adequate documentation is necessary to demonstrate compliance with an applicable exception.

The information blocking exceptions are summarized below under two categories: exceptions for not fulfilling a request and procedural exceptions.