The 21st Century Cures Act is a bipartisan-backed law passed in 2016 and implemented by rules in 2020. It is designed to give patients safe and secure access to health data so they can better manage their care and make more informed healthcare decisions. The Act’s goal is to make electronic health records available to patients without cost or delay. Rules issued under the Act are designed to prevent “information blocking”. Importantly, providers must make “clinical notes” available to patients without charge by April 5, 2021. Health care providers need to be ready to share certain electronic health records with patients by this deadline and avoid claims of “information blocking” in violation of the rule. This is the implementation of the philosophy of “open notes” meaning the patients should generally have full and unfettered access to their notes.
Eight types of clinical notes must be shared: Consultation notes, discharge and summary notes, history and physical, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes and progress notes. Some exceptions exist such as psychotherapy notes. These are notes that are separated by the rest of an individual’s medical record and are recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or group, joint or family counseling session. That being said the mental health provider still must share information on medication prescription and monitoring. Another exception is for medical records compiled in reasonable anticipation of a civil, criminal or administrative action or proceeding.
Providers are forbidden from engaging in “information blocking”. This is defined as anything formally restricting the access or use of electronic health information “EHI” through contracts or policies. It also means unnecessarily slowing or delaying access or limiting the timeliness of access to EHI or charging for EHI. Some exceptions to information blocking exist. For example, a provider can delay a patient’s access to their EHI if that delay is necessary to prevent the risk of harm, cyber security risks, or infeasibility. However, providers should check with their health law counsel or privacy and security officer before delaying or refusing a patient’s free access to their electronic clinical notes. Penalties for health care providers engaged in “information blocking” remain to be fully developed. The government has said so far that they will be subject to the “appropriate disincentives”.
Patients have always had a right to access their patient records under HIPAA but the Cures Act expands this right to quick and free access to EHI. Providers need to work with their EHR vendors, privacy officers and legal counsel to make sure they are providing patients with a free and easy access to their health records and are not engaging in any information blocking. The Cures Act is a supplement to and not a replacement of HIPAA compliance. Accordingly, this is also a good time to review HIPAA compliance, update policies on patients’ rights to access their health records and make sure that the HIPAA Security Risk Assessment is complete and updated for cyber security protections.
