Prepare Your Practice for Expanded Information Blocking Requirements

By: Catherine (Cat) Kirkland, Burr & Forman LLP

Is your practice ready? Starting October 6, 2022, physicians and group practices will be required to make full electronic health information available for access, exchange, and use to patients (among others) in a reasonable manner. This deadline marks the end of a multi-year phase-in from the U.S. Department of Health and Human Services (HHS) of “information blocking” rules set forth in the 21st Century Cures Act Interoperability and Information Blocking Regulations.

The Cures Act defines information blocking as “a practice by an actor that is likely to interfere with the access, exchange, or use of electronic health information (EHI), except as required by law or specified in an information blocking exception.” Physicians, hospitals, and group practices, among many other provider types, are all specifically defined as “actors” under the Act and are therefore subject to the regulations. The Act defines EHI as information contained within a designated record set, which for a physician or group practice would include medical records, billing records, and other documents used by the physician or practice in conjunction with patient care (ex: scans received, emergency department records, etc.).

Examples of prohibited information blocking might include:

• Implementing a blanket (and not individualized) approach of withholding laboratory or other test results from a patient portal until a physician can evaluate the results;
• Charging a fee for physical copies of a patient’s EHI, when the fee does not meet HHS’ fee exception criteria; or
• Purposefully limiting what EHI is shared in a patient portal if the portal technology would allow for full EHI access.

A practice is not considered information blocking if it meets one of eight exceptions. Five of these exceptions relate to why a provider might not fulfill a request for access, exchange, or use of EHI, including: 1) prevention of harm (a very limited exception requiring a patient-by-patient analysis); 2) privacy protection (ex: if state or federal law require a patient consent to set-up a portal and the patient has not consented); 3) safeguarding security of the EHI; 4) infeasibility (ex: hurricanes or uncontrollable events); and 5) if the provider’s IT is temporarily unavailable. Each of these exceptions contain key conditions that must all be demonstrated by the provider before the exception can be claimed.

The Cures Act authorizes the HHS Office of Inspector General to investigate any claim of information blocking and in 2021, HHS established an online portal for complaints. Any complaint submitted through HHS’s portal could result in an OIG investigation and potentially penalties or disincentives.

The overall industry response to the expanded rules has been one of concern and confusion with a major push for HHS to release more guidance before the October 6 deadline. However, waiting on additional HHS guidance is not a defense to the information blocking rules. Physicians and group practices should be proactive in their compliance by reviewing the rules and exceptions carefully. Physicians should ensure that all policies, procedures, and/or compliance programs comply with the rules, address rule exceptions, and require documentation of when an exception is used and why.

Catherine (Cat) Kirkland is a partner at Burr & Forman LLP and practices exclusively in the firm’s Health Care Practice Group. Cat may be reached at (251) 340-7271 or by email at ckirkland@burr.com.