The Cures Act and Its Impact on Healthcare Providers

The 1996 Health Insurance Portability and Accountability Act (HIPAA) gave patients a right to view and request corrections to their medical records. In the intervening years, the widespread adoption of electronic health records (EHR), patient portals, and smartphone applications have led to an increase in patients accessing their medical records electronically. The digital evolution of the medical record has prompted a number of healthcare professionals and patient safety advocates to promote quicker access to information stored in the EHR.

The 21st Century Cures Act (Cures Act), passed by the U.S. Congress in 2015, provides new regulation on a variety of healthcare concerns including funding, research, access to new and experimental drugs, telehealth, and interoperability of health information technology (health IT). Authors of the Cures Act introduced a new phrase to the health care community related to the interoperability of health information technology: “information blocking.”

Information Blocking: Defined

Information blocking is defined by the Cures Act and paraphrased by HIT.gov as a practice by a health IT developer of certified health IT, a health information network (HIN), a health information exchange (HIE), or a healthcare provider that, except as required by law or specified by the Secretary of Health and Human Services as a reasonable and necessary activity, “is likely to interfere with the access, exchange, or use of electronic health information (EHI).”

While information blocking can occur when a healthcare provider intentionally restricts access to the patient’s medical record, it can also occur unintentionally as a byproduct of health IT.

Physicians and facilities, like patients, can also experience information blocking. For example, information blocking can occur when a healthcare provider moves from one EHR to another, or when they try to access a patient’s medical record held by another provider. Information blocking can also happen when physicians try to connect EHRs to local information exchanges.^*

However, simple interference with the access, exchange, or use of EHI, may not automatically constitute a violation of the Cures Act. To constitute a violation, actors, such as physicians, must have knowledge and intent to interfere with the access, exchange, or use of EHI.^* Essentially, provisions within the Cures Act seek to discourage physicians and entities from knowingly interfering with or discouraging access to a patient’s EHI. Healthcare providers found to be engaging in the practice may be subject to monetary penalties or reimbursement disincentives from federal healthcare programs, like Medicare and Medicaid.

Open Notes: When to Share

The information blocking provisions of the Cures Act are often colloquially referred to as “open notes.” Healthcare providers who do not make clinical notes open and available for their patients are engaging in the practice of information blocking, unless one of the Cures Act’s regulatory exceptions applies.

The OpenNotes organization—a group of clinicians and researchers committed to increasing patient access to their medical records—advocates for the sharing of medical notes and believe it may improve accuracy and patient safety, improve medication adherence, foster stronger relationships and better engagement, improve chronic care management, support care partners, and promote efficiencies.

The Cures Act references eight types of clinical notes that must be made available to patients upon request, which include the following:

• Consultation note
• Discharge summary note
• Procedure note
• Progress note
• Imaging narrative
• Lab report narrative
• Pathology report narrative
• History and physical

Healthcare providers who do not make clinical notes open and available for their patients are engaging in the practice of information blocking unless one of the Cures Act’s regulatory exceptions applies.

Potential Violations of the Cures Act

The American Medical Association has provided examples of potential violations of the Cures Act including:^*

• Formal restrictions: A healthcare provider or office policy requires staff to obtain a patient’s written consent before sharing any EHI with unaffiliated providers for treatment purposes.
• Technical limitations: A healthcare provider disables the use of an EHR capability that would enable staff to share EHI with users at other systems.
• Isolated interferences: A healthcare provider has the capability to provide same-day EHI access in a format requested by an unaffiliated provider—or by their patient—but takes several days to respond.
  
  

Cures Act Exceptions to Information Blocking

While providers may read the requirements of the Cures Act and believe them to be burdensome, the information blocking rule contains exceptions for flexibility in operation. Knowing how the Cures Act differs from HIPAA is also helpful to understanding the scope of the Act. HIPAA’s regulations affirmatively and specifically state what types of EHI can be shared with other providers, patients, and third parties. The Cures Act information-blocking rule directs the providers to release records to patients and other providers in nearly all instances where an exception does not exist.

Two categories of exceptions to information blocking within the Cures Act provide flexibility to healthcare providers and organizations without burdening them with administrative rigidity.

• Category I involves not fulfilling requests for access. These exceptions include preventing harm to the patient or another, protection of health information privacy, protection of health information security, infeasibility, and health IT performance.
• Category II involves the procedures a healthcare provider uses for fulfilling requests. The exceptions in the procedures category include limitation in content and manner, reasonable fees, and licensing.
  
  

Risk Management Considerations

With enforcement provisions of the Cures Act expected to be announced in the near future, it is important to train staff in sound documentation practices to help manage risk. Be mindful of the following as more and more patients expect instant access to their medical records.

Documentation Practices

• Assume all notes will be read by the patient.
• Complete documentation in a timely manner.
• Avoid abbreviations that may be standard in the healthcare community, but not easily interpreted by the patient.
• Avoid the use of pejorative terms such as “malingering”; instead, use factual observations in the chart.
• Use plain language and focus on clarity, for the benefit of the patient as well as other healthcare providers.
• Avoid copying and pasting from other sources.
• Before documenting difficult situations, attempt a conversation with the patient or guardian first.
• Promote accurate and timely entries that support the appropriate standards of medical care.
• Reinforce the medical record is used as a key witness in legal proceedings.
  
  

Policies and Procedures

• Review, revise, and update current policies to include responding to requests.
• Know the exceptions and incorporate into organizational policies.
• Conduct regular assessments of medical record management and disclosure processes.
  
  

Compliance and Training

• Remain up-to-date on changes and applicability dates.
• Identify decision makers and document when an exception applies.
• Conduct proper and regular training to appropriate staff members.
  
  

Complaint Response

• Prepare for future internal or external investigations.
• Know how to respond and who to involve.
• Conduct quality improvement process regularly and make adjustments in processes as appropriate.
  
  

Conclusion

It is important to note that the Cures Act’s information blocking rule does not override existing state and federal rules protecting patient confidentiality. Compliance with state and federal laws that require patient consent before production of medical records would likely not constitute information blocking. For example, a state may require certain conditions be met before releasing certain classes of EHI, such as HIV status or adolescent mental health information. In these instances, physicians should not release that EHI without first obtaining consent from the patient.^*

The compliance date for healthcare providers to meet the Cures Act information blocking requirements was April 5, 2021. As of October 6, 2022, healthcare providers are required to make the same information available on patient third-party applications to not be engaged in information blocking.

The good news for healthcare providers is that although the date for Cures Act compliance has passed, the final rule went into effect without applicable enforcement provisions, which means providers still have time to bring their EHR systems and procedures into compliance. With proper planning and training, healthcare providers should be able to implement minor procedural changes to comply with Cures Act requirements.

If you have questions about the Cures Act or information blocking, contact Risk Management at 844-223-9648 or email RiskAdvisor@ProAssurance.com.

* American Medical Association. What Is Information Blocking?