CLIENT ALERT: Info Blocking Rule Now Applies to All Electronic Health Information
As of October 6, 2022, the Office of the National Coordinator (ONC)’s Cures Act Final Rule (known as the Info Blocking Rule) applies to all electronic health information (EHI). Prior to October 6th, EHI was limited to the clinical data elements in the United States Core Data for Interoperability version 1 (USCDI). Actors covered by the Info Blocking Final Rule should ensure they respond to requests for access, exchange and use of EHI with all of an individual’s EHI, unless an exception applies.
What is the Info Blocking Rule?
The Info Blocking Rule went into effect on April 5, 2021. It requires health care actors (including health centers) to respond to requests for access, exchange and use of EHI without unreasonable delay, unless one of the limited exceptions applies. Practices that interfere with access, exchange or use of EHI may meet the definition of “information blocking,” which is prohibited by the Info Blocking Rule.
The Info Blocking Rule defines eight exceptions that offer actors certainty that, when their practices with respect to accessing, exchanging, or using EHI meet the conditions of one or more exceptions, such practices will not be considered information blocking. If an actor’s response does not meet the exception, allegations of information blocking require a fact-based assessment as to whether a delay or denial of a request for access, exchange or use of EHI would be considered an interference under the Info Blocking Rule. That assessment would also determine whether the interference is with the legally permissible access, exchange, or use of EHI; whether the actor engaged in the practice with the requisite intent; and whether the practice satisfied the conditions of an exception.
What is EHI?
The Info Blocking Rule defines EHI as electronic protected health information (ePHI) (as defined under HIPAA) to the extent that it would be included in a designated record set (as defined under the Privacy Rule), regardless of whether the group of records are used or maintained by or for a HIPAA covered entity. Under HIPAA, the designated record set is defined as the group of records maintained by or for a covered entity that is the medical records and billing records about individuals maintained by or for a covered health care provider. EHI does not include psychotherapy notes (as defined by the HIPAA Privacy Rule) or information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
What has changed?
From April 5, 2021, to October 5, 2022, the scope of EHI was limited to the clinical data elements in the USCDI. Those data elements included allergies and intolerances, assessment and plan of treatment, care team members, clinical notes, goals, immunizations, laboratory, medications, patient demographics, problems, procedures, smoking status, and vital signs. The ONC limited the scope of EHI to provide actors with time to evaluate and revise their practices related to EHI.
As of October 6, 2022, EHI will include all ePHI in an individual’s designated record set (except for psychotherapy notes or information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding).
What does this mean for health centers and other health care actors?
Health centers that have been responding to requests for access, exchange or use of PHI with only the data elements of the USCDI should determine how to respond to such requests with all the ePHI in the designated record set, including both medical and billing records. Depending upon the health center’s circumstances, an exception to the Info Blocking Rule may apply. For example, a health center may determine that it is infeasible to fulfill requests for access, exchange and use of EHI because it does not have, and cannot obtain, the requisite technological capabilities or other means necessary to enable access, exchange or use of EHI. To avoid allegations of information blocking, the health center should document that it meets the requirements and conditions of the Info Blocking Rule’s Infeasibility Exception (45 CFR 171.204).
For more information on the Info Blocking Rule, please see our recent blog post, recorded webinar series, and the Confidentiality for Health Centers Toolkit.