21st Century Cures Act summary: How it impacts your practice

What is the 21st Century Cures Act?

The Cures Act was signed into law by President Barack Obama on Dec. 13, 2016. The bipartisan legislation seeks to increase choice and access for patients and providers.

It contains provisions to streamline development and delivery for drugs and medical devices, accelerate research into serious illnesses, address the opioid crisis, and improve mental health services.

The Cures Act also seeks to ease regulatory burdens associated with use of electronic health record (EHR) systems and health information technology (IT).

It contains provisions focused on advancing interoperability and requiring developers not to engage in information blocking — or preventing or interfering with the access, exchange, or use of electronic health information (EHI).

21st Century Cures Act summary: The Final Rule

After the Cures Act was signed into law, it passed to the Office of the National Coordinator for Health Information Technology (ONC) and the Centers for Medicare & Medicaid Services (CMS) for review.

ONC and CMS produced two sets of rules based on the Cures Act’s interoperability, patient access, and information blocking provisions. These rules guide members of the industry, such as providers, payers, and technology vendors, as they design their health IT systems.

The U.S. Department of Health and Human Services (HHS) finalized the two sets of rules in March 2020, ushering in the next phase for the Cures Act. At the time, HHS called the rules “the most extensive healthcare data sharing policies the federal government has implemented.”

The ONC Final Rule lays out regulations to prevent information blocking practices by providers, health IT developers, health information exchanges (HIEs), and health information networks.

The original deadline for stakeholders to comply with Cures Act information blocking rules was Nov. 2, 2020. In October 2020, HHS moved the information blocking compliance date to April 5, 2021, citing an interest in allowing the healthcare system to focus on COVID-19 concerns.

What is the meaning of information blocking in the Final Rule?

Information blocking can occur in a variety of scenarios. In general, it refers to practices that are likely to interfere with the access, exchange, or use of EHI. The ONC defines information blocking and shares examples of practices that could constitute information blocking here.

Because its definition of information blocking is open-ended, ONC provides eight categories of “reasonable and necessary” activities that do not constitute information blocking, given certain conditions are met. These are called the information blocking exceptions.

Still, more than a year after the public release of the Final Rule, confusion about information blocking remains widespread.  

In March 2021, Life Image, a medical evidence network for clinical and imaging data, surveyed about 4,000 healthcare industry leaders. Nearly half of the respondents, or 47%, said they were unfamiliar with information blocking.

Although 70% of survey respondents said they were aware of the rules, roughly half of the same respondents said they engage in practices that meet the ONC’s definition of information blocking, such as charging patients a fee to obtain records.

The survey showed that many healthcare system stakeholders remain unclear about rule requirements, as well as what steps they need to take to comply with the Final Rule, which, as of April 5, 2021, has taken effect.

What does the 21st Century Cures Act, in sum, mean for my practice?

Information blocking applies to a variety of parties, including providers, payers, and IT developers. While you may have a general idea of what the requirements are, how can you ensure your practice complies?

When it comes to patient requests for data, the Cures Act prohibits providers, developers, and health information networks from engaging in practices that would inhibit patients from receiving their own data or practices that inhibit patient data from flowing where patients would like it to go.

Is your team prepared to respond to requests for health information, either from patients or third parties, under the new requirements?

Cures Act and information blocking focuses on EHI, or the data stored in your EHR or in other electronic forms. If a patient asks for their data, there are several options available:  

• Printing the data from the EHR
• Exporting it through a Continuity of Care Document (CCD) in the EHR
• Directing patients to view and download data using a patient portal

The first step in information sharing is providing U.S. Core Data for Interoperability (USCDI) formatted data. A patient portal is a key component of providing information to patients. Patients can receive USCDI data directly in the portal and share that information with other providers through direct email functionality. Or, they can send it to themselves or their health proxies.

Greenway Patient Portal allows a patient to download a Consolidated Clinical Document Architecture (CCDA) file, which provides huge time savings for your practice.

What are the information blocking exceptions?

What if a provider is unable to share information in the format the patient requests? Should the provider send the patient to the EHR vendor? Because practices are viewed as the guardians of information, the immediate answer should be no. Directing the patient to the EHR vendor could be construed as information blocking.

You can, however, reach out to your EHR vendor and walk through information blocking and the exceptions to understand which if any may apply.

Determining whether information requests fall into exception category starts with a clear understanding of the eight exceptions mentioned previously in this 21st Century Cures Act summary:

1. Preventing harm
2. Privacy
3. Security
4. Infeasibility
5. Health IT performance
6. Content and manner
7. Fees
8. Licensing

Within your practice, you should establish a process for evaluating information requests and ensure staff members are knowledgeable about the exceptions involved.

Additionally, you should continue to summarize the 21st Century Cures Act for your staff. It may be helpful to create a checklist or series of checklists that outline the information you need to evaluate. To help get your practice started, we created a checklist of recommended best practices to avoid information blocking. However, we still encourage you to develop a checklist of your own that accounts for the specific data requested, as well as your ability to provide the data. For future reference, you should document what was requested, your evaluation, and your response.

Other considerations

What other scenarios should practices consider?

1. If your practice only uses a practice management system, the requirements still apply. You will still need to be able to provide health information to a patient or third party. Determine whether your practice will be able to access the data in your practice management system.
2. If your practice doesn’t know whether your system supports certain methods of information transfer, you have an obligation to still provide records. Consider how you will support requests for connecting to your data.
3. If your practice isn’t using a patient portal, the EHR can produce the information the portal would contain via CCD or another mechanism, without requiring a manual effort.
4. If your practice handles revenue services in-house, you will need to understand where the data is located and how you can provide it in an electronic format. Do you have the in-house capability process to support EHI exports? Or if you use a billing service, can you export the stored data? Greenway Revenue Services, integrated with the EHR, has the ability with FHIR to access and export data, thus helping clients be compliant.  

21st Century Cures Act timeline summary

A final step in Cures Act preparation is having a good grasp of the timeline. Here’s a summary of key 21st Century Cures Act milestones through 2023:

• April 5, 2021: Applicability date for information blocking provisions.
• Oct. 6, 2022: EHI definition no longer limited to EHI identified by data elements in USCDI.
• Dec. 31, 2022: New HL7 FHIR API capability and other criteria must be made available.
• Dec. 31, 2023: EHI export capability must be made available.

Click here for a detailed timeline of regulatory dates through 2023.