Connecticut Health Law

Recently, the Office of the National Coordinator for Health IT (ONC) issued a new series of helpful FAQs related to its information blocking regulations. The new FAQs cover a wide range of topics, including the content and manner exception, the definition of “electronic health information” or “EHI,” and whether a patient request is required to create an information blocking violation.  The FAQs summarized below are recommended reading for providers though the precise mechanisms that will be used to enforce these important rules have yet to be addressed.

For our past recaps on the Final Rule on information blocking, please refer to our previous blog posts: here and here.

Must a Provider Give a Patient a Hard Copy or a USB/CD Copy of The Patient’s Data?

ONC clarified that a patient’s request for a copy of their health information as a paper copy or as files on a USB or CD-ROM does fall under the scope of the information blocking regulations. The implication of ONC’s FAQ is that if a patient asks for their information in a particular way, and the provider is in a position to fulfill that request, then the provider should do so. The provider may charge fees in connection with the request, so long as the fees satisfy the requirements of the Fee Exception. 

Is a PDF File Sufficient?

Under the Content and Manner Exception, ONC has previously clarified that where a provider is unable to fulfill a request in the manner requested, the provider may use an alternative machine-readable format agreed upon with the requestor. 

In its latest FAQ, ONC clarified that a PDF of the information may work as an alternative, but only if the PDF allows for the underlying content to be “interpretable” and have a machine-readable output. Images of the content alone will not suffice. If you can’t easily copy and paste the content out of the PDF, then the PDF likely won’t qualify as an appropriate “alternative manner.” 

Is a Patient Request for EHI necessary to Create a Claim of Information Blocking?

A provider may be found to violate the information blocking rules even if there is no affirmative patient request for EHI. A claim of information blocking is not predicated on a patient’s request for EHI. Any act or omission, whether or not in response to a request for access, exchange, or use of EHI, could implicate the information blocking regulation if the act or omission “interferes with, prevents, or materially discourages the access, exchange, or use of EHI.” For example, ONC lists the failure to exchange EHI, the failure to make EHI available for use, or the inclusion of contract provisions that limit the exchange of EHI all as practices that could generate an information blocking claim outside of a patient request.

Is a Patient Portal Affirmatively Required?

In its latest FAQ, ONC indicates that nothing in the regulations contemplates “proactive” conduct on the part of a provider to create a patient portal where one is absent. Rather, failure to provide information in a timely fashion, whether through a portal or otherwise may implicate information blocking.

Better Defining EHI

Two of ONC’s new FAQs focus on defining EHI under the current USCDI standard and the transition on October 6, 2022 to the HIPAA Designated Record Set. 

Until October 6, 2022, the provisions for information blocking are limited to the 16 data elements developed under the USCDI v1 standard. These categories include patient demographics, procedures, medications, smoking status, and others. The USCDI standard also includes “progress notes.” A new FAQ from the ONC has clarified that a “progress note” is any note that “represents a patient’s interval status during a hospitalization, outpatient visit, treatment with a long-term or post-acute care (LTPAC) provider, or other healthcare encounter.”

After October 6, 2022, providers will no longer be able to limit their response to the data contained in the USCDI v1 standard. Instead, providers will need to provide all “identifiable health information” that is transmitted or maintained “in electronic media” which is included in a “designated record set” as defined under HIPAA. A designated record set comprises not only medical records, but also billing records, enrollment, payment, claims adjudication, and other records that are used to make decisions about individuals. ONC’s new FAQs make it clear that healthcare providers will indeed be expected to provide a more comprehensive set of information in responding to requests for EHI after October 6, 2022.

Next Steps

One of the biggest questions remains unanswered: when will the information blocking rules be enforced against providers? ONC published its Final Rule more than a year ago and set a compliance date of April 5^th, 2021. Although the compliance deadline has come and gone, enforcement mechanisms for health care providers have yet to be finalized. HHS has proposed penalties for health IT developers and health information exchanges of up to $1 million per violation. However, proposed penalties for healthcare providers have yet to be specified. Instead, HHS has stated that it will refer provider violators to “agencies identified in future rulemaking” for “appropriate disincentive[s].” Before HHS finalizes its enforcement mechanisms, healthcare providers should review their information blocking protocols for compliance with the Final Rule.

For questions related to information blocking, and compliance review, contact any of our attorneys in our Health Care practice.