West Virginia Health Care Law

The 21st Century Cures Act Final Rule Information Blocking Provision became active on April 5, 2021.  “Information blocking” is a term used to describe a situation where a patient struggles to gain timely access to protected health information (“PHI”).  While patient rights to access PHI are established by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), patient complaints of information blocking are being addressed by – and have become a major priority of - the Office of the National Coordinator for Health Information Technology (“ONC”).

Between April 5, 2021 and August 31, 2022, there were 452 complaints of information blocking submitted to ONC.  Whether accidental or intentional, information blocking practices are subject to the ONC’s enforcement discretion, and the ONC is taking these complaints very seriously.  But what is information blocking?  The ONC defines information blocking as a practice that is likely to interfere with, prevent, or discourage the access, exchange, or use of electronic health information (“EHI”), unless the action or omission is covered by an exception or otherwise required by law.  The goal of the ONC is to provide patients with more control over their healthcare information – and to do so in a timely fashion and in the form and format the patient requests.

What information is included in EHI?  As of April 2021, the minimum requirements under the Cures Act include: (i) Allergies and Intolerances; (ii) Assessment and Plan of Treatment; (iii) Care Team Members; (iv) Clinical Notes; (v) Goals; (vi) Health Concerns; (vii) Immunizations; (viii) Laboratory Tests, Values, and Results; (ix) Medications; (x) Patient Demographics; (xi) Problem Lists; (xii) Procedures; (xiii) Provenance; (xiv) Smoking Status, (xv) Unique Device Identifier(s) for a Patient's Implantable Device(s); and (xvi) Vital Signs.

Now that I have answered questions about what information blocking is and what information is included, you may be wondering why I am writing a Health Care Law Blog about a law that went into effect back in April 2021.

The answer is because starting October 6, 2022, the definition of EHI in the Cures Act expands to include electronic protected health information (“ePHI”), as defined by HIPAA.  According to the HIPAA Privacy Rule, PHI is any identifiable health information used, maintained, stored, or transmitted by a covered entity.  So, instead of being limited to the EHI data classes covered by the initial Cures Act, the definition of EHI now will include information in a designated record set, meaning it now consists of medical and payment records, as well as any information used by healthcare providers to make decisions about their patients.

For many health care providers, medical records requests can be a nuisance; however, healthcare providers need to be taking the Cures Act and the prohibitions against information blocking as seriously as the ONC is taking them.  When the ONC receives an information blocking claim, it will share the complaints with the Office of the Inspector General (“OIG”), which may then investigate any claim that a healthcare provider engaged in information blocking in violation of the Cures Act.  OIG, in turn, will work with the Office for Civil Rights (“OCR”) if an information blocking claim can be resolved under the HIPAA Privacy and Security Rules, meaning that violators may be subject to HIPAA civil monetary penalties, separate from any penalties or disincentives that may be built into the Cures Act.

With compliance in mind, providers who have not already done so will want to immediately begin developing information-sharing policies.  If you need help with the development of your policies, we can help.  Bowles Rice LLP maintains an experienced Health Care Practice Group to assist healthcare providers in answering their most difficult questions, in avoiding unnecessary legal entanglements, and in ensuring that their policies are up-to-date and compliant with the Cures Act and other applicable healthcare laws.