The 21st Century Cures Act (“Cures Act”) is a bipartisan-backed law passed in 2016 and implemented by rules in 2020. The Cures Act is intended, in part, to give patients safe and secure access to health data so they can better manage their care and make more informed healthcare decisions. Although patients have always had a right to access their patient records under HIPAA, the Cures Act expands this right to quick and free access to electronic health information (“EHI”). The law’s goal is to make EHI available to patients without cost or delay. The Cures Act also aims to allow “open notes,” meaning that patients will generally have full and unfettered access to their physician notes. To these ends, rules issued under the Cures Act are designed to prevent “information blocking.” Importantly, providers must make “clinical notes” available to patients without charge by April 5, 2021. Health care providers need to be ready to share certain electronic health records with patients by this deadline and avoid claims of “information blocking” in violation of the rule. Providers should note that HHS recently proposed rule changes to HIPAA, which also seem to support the Cures Act expansion of patient rights of access.
Under the new Cures Act requirements, eight types of clinical notes must be shared: consultation notes, discharge and summary notes, history and physical, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes, and progress notes. Some exceptions exist for records such as psychotherapy notes. Psychotherapy notes means notes that are separated from the rest of an individual’s medical record and recorded in any medium by a health care provider who is a mental health professional documenting or analyzing the contents of a conversation during a private counseling session or group, joint, or family counseling session. Although psychotherapy notes are excepted, the mental health provider still must share information with the patient on medication prescription and monitoring. Another exception is for medical records compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding.
Providers are forbidden from engaging in “information blocking.” This is defined as anything formally restricting the access or use of electronic health information (“EHI”) through contracts or policies. It also means unnecessarily slowing or delaying access or limiting the timeliness of access to EHI or charging for EHI. Some exceptions to information blocking exist. For example, a provider can delay a patient’s access to their EHI if that delay is necessary to prevent the risk of harm, cyber security risks, or infeasibility. The exceptions have specific requirements, however, which the practice must meet to be in compliance with the rule. Thus, providers should check with their health law counsel or privacy and security officer before delaying or refusing a patient’s free access to their electronic clinical notes. Penalties for health care providers engaged in “information blocking” remain to be fully developed. The government has said so far that they will be subject to the “appropriate disincentives.” Further rulemaking is anticipated, which will likely provide a more formal regulatory framework and consequences for violation.
In addition to these changes under the Cures Act, providers should be aware that HHS recently proposed rule changes to HIPAA, which also seem to support the Cures Act expansion of patient rights to access. Proposed changes to HIPAA include strengthening individuals’ rights to access their own health information, including electronic information; improving information sharing for care coordination and case management for individuals; facilitating greater family and caregiver involvement in the care of individuals experiencing emergencies or health crises; enhancing flexibilities for disclosures in emergency or threatening circumstances, such as the Opioid and COVID-19 public health emergencies. Although these rules are not yet final, providers should keep them in mind.
As noted above, patients have always had a right of access under HIPAA, but the Cures Act expands this right to quick and free access to EHI. Providers need to work with their EHR vendors, privacy officers and legal counsel to make sure they are providing patients with a free and easy electronic access to their health records and are not engaging in any information blocking. The Cures Act is a supplement to and not a replacement of HIPAA compliance. Accordingly, this is also a good time to review HIPAA compliance, update policies on patients’ rights to access their health records, and make sure that the HIPAA Security Risk Assessment is complete and updated for cyber security protections. Health care providers need to ready their practices for expanded open exchange of information requirements.
