Understanding the CMS and ONC Cures Act Final Rules

Because both agencies must administer Cures Act requirements to the entities under their jurisdictions, it’s important for practices to be familiar with both Final Rules. In this blog, we will explore their most important elements.

A new era: ONC and CMS issue Final Rules for interoperability

The passage of the Cures Act in 2016 signaled the start of a new era for electronic health information exchange and interoperability. In subsequent years, industry stakeholders awaited guidance from the Department of Health and Human Services (HHS) as to how it planned to implement requirements of the law.

The wait came to an end in 2020, when HHS agencies ONC and CMS issued their respective Final Rules.

Because the ONC serves as the certifying body for electronic health records (EHRs), the health IT industry followed the ONC Final Rule most closely. This rule outlines the requirements members of the industry — or “actors,” as the ONC defines them — must follow. CMS, meanwhile, aimed its rule largely at payers, but the rule does impact providers as well.

Both sets of rules address the Cures Act’s provisions for interoperability, patient access, and information blocking.

ONC Final Rule

While the ONC Final Rule focuses primarily on information blocking, it also lays out requirements for health IT developers related to Application Programing Interface (API) functionality and Fast Healthcare Interoperability Resources (FHIR) adoption.

It requires that health IT certified through the ONC Health IT Certification Program have standardized APIs and implement FHIR standards. Crucially for practices, it prohibits information blocking practices by providers, health IT developers, health information exchanges (HIEs), and health information networks.

The compliance date for actors to no longer engage in information blocking practices was April 5, 2021.

While there are no “disincentives” at the time of this writing for providers who may engage in information blocking practices, the Office of the Inspector General (OIG) is expected to release an enforcement rule later in the 2021 calendar year aimed at providers.

You can read more about information blocking in Greenway’s Cures Act summary blog.

CMS Final Rule

Similar to the ONC Final Rule, the CMS Final Rule requires federal payers to make provider directory information publicly available via API functionality.

Such policies “help liberate health information and move the healthcare system toward greater interoperability,” according to CMS.

Originally, CMS required both Patient Access and Provider Directory APIs by Jan. 1, 2021. Due to the COVID-19 public health emergency (PHE), CMS postponed enforcement. These rules have been in effect since July 1, 2021.

Here is further information on these policies: 

• Patient Access API: A secure, standards-based API gives patients easy access to claims data and encounter information, including cost. Claims and clinical data, used in conjunction, offer “a broader and more holistic understanding of an individual’s interactions with the healthcare system, leading to better decision-making and better health outcomes,” CMS said.
• Provider Directory API: By making provider directory information broadly available using a standards-based API, payers “encourage innovation” among third-party application developers, which can access information to create services. “Making this information more widely accessible is also a driver for improving the quality, accuracy, and timeliness of this information,” CMS said.
• Payer-to-payer data exchange, increased frequency of federal-state data exchanges, public reporting of information blocking, and other policies to increase interoperability are also covered. Learn more about CMS Final Rule policies.