At the Click of a Button, The New Information Blocking Rule Requires the Immediate Release of Electronic Health Information to Patient Portals

Starting April 5, 2021, certain health care providers[i] and other actors are required to comply with the new Information Blocking Rule (IBR).[ii] The IBR prohibits providers from knowingly engaging in any practice that is unreasonable and likely to interfere with the access, exchange or use of electronic health information (EHI), unless the interference is required by law or qualifies for an exception (aka safe harbor protection).[iii] There are eight (8) exceptions—Preventing Harm;[iv] Privacy;[v] Security;[vi] Infeasibility;[vii] Health IT Performance;[viii] Content and Manner;[ix] Fees;[x] and Licensing.[xi] A health care provider claiming safe harbor protection must be able to demonstrate that such provider satisfied all conditions of the applicable exception at all relevant times.[xii]

The U.S. Department of Health & Human Services (HHS), Office of the National Coordinator (ONC) is accepting IBR complaints through its Information Blocking Portal on ONC’s website, HealthIT.gov.[xiii] The HHS Office of Inspector General (OIG) has authority to investigate claims of information blocking against both provider organizations and individuals.[xiv] If the OIG determines that a provider has violated the IBR, it will refer the provider to the appropriate agency for disincentives.[xv] HHS has not yet released the proposed rule for provider disincentives. Thus, IBR regulatory enforcement actions against providers will be delayed until the provider disincentives rule is finalized.[xvi] Providers should use this grace period to align their practices which affect the access, exchange and use of EHI with the IBR’s requirements and applicable safe harbor protections.

Examples of practices that may implicate the IBR include a provider delaying patient access to EHI or denying a request for EHI when none of the safe harbor protections apply. ONC is particularly focused on ensuring that patients and their legal representatives have immediate electronic access to their EHI requested through a patient portal.

ONC considers the act of logging into a patient portal or requesting access to a patient portal via an application programming interface (API) to constitute an EHI “request” for purposes of the IBR.[xvii] Therefore, if a provider has adopted a blanket practice of delaying the immediate release of EHI “for any period of time” (e.g., delaying release of lab results until the ordering physician reviews and approves release), this will likely constitute an interference that implicates the IBR.[xviii] ONC explains:

[I]f there is a general policy to withhold test results for some period of time say 72 hours before the results are made available to the patient . . . that's probably going to be an interference. The policy under all of this is that now there's an expectation that [EHI] is available when and where it's needed. So[,] these generalized policies like that are going to be an interference, unless you meet an exception, or there is another element missing, and we know this is a big transition for folks who are ordering these tests for lots of people, but as a member of our clinical team here at [ONC] often reminds us Congress passed this law because of the overwhelming good that's going to come from it.[xix]

With the exception of a few states that may legally require some delay on the electronic release of EHI, most blanket policies that adopt such practices with regard to a patient portal will not qualify for safe harbor protection. ONC has determined that blanket delays do not qualify for the Preventing Harm exception because it requires a clinician who has a past or present clinician-patient relationship with the person who is the subject of the EHI to make an individualized determination that the withholding EHI from a patient would “substantially reduce a risk to . . . life or physical safety.”[xx] HHS specifically found that “[n]o commenter cited evidence that routinely delaying EHI availability to patients in the interest of fostering clinician-patient relationships substantially reduces danger to life or physical safety of patients or other persons . . . .”[xxi] However, ONC has indicated that providers are still permitted to honor an individual’s choice to opt out of having EHI immediately released, so long as the provider does not improperly influence the individual’s decision.[xxii]

Providers should identify practices that impose such delays on the release of EHI to their patients’ portals. Such practices should be modified to permit the immediate release of EHI. In ONC’s view, a patient should be able to access test results at the same time such results are made available to the ordering clinician.

Citations:

[i] The IBR uses a broad definition of “health care provider,” which can be found at 42 U.S.C. § 300jj-52(3) and 45 C.F.R. § 171.102. ONC has also published a helpful cross-reference table on its website to assist organizations and professionals who work in the health care space in determining whether they are subject to the rule: see https://www.healthit.gov/cures/sites/default/files/cures/2020-08/Health_Care_Provider_Definitions_v3.pdf.

[ii] 42 U.S.C. § 300jj-52 (2021) and 45 C.F.R. Part 171 (2020).

[iii] 45 C.F.R. § 171.103.

[iv] Id. at § 171.201.

[v] Id. at § 171.202.

[vi] Id. at § 171.203.

[vii] Id. at § 171.204.

[viii] Id. at § 171.205.

[ix] Id. at § 171.301.

[x] Id. at § 171.302.

[xi] Id. at § 171.303.

[xii] Id. at §§ 171.200, 171.300.

[xiii] The Office of the National Coordinator for Health Information Technology, Information Blocking FAQs: Reporting Claims of Information Blocking (“Q: What happens after I report information blocking through . . . .”), https://www.healthit.gov/curesrule/resources/information-blocking-faqs [hereinafter “ONC FAQs”]; id. (“Q: If I experience information blocking, how do I . . . .“) (last visited Sept 23, 2021).

[xiv] 42 U.S.C. § 300jj-52(b); see also ONC FAQs, supra note 15, “Q: What happens after I report information blocking through . . . .”.

[xv] 42 U.S.C. § 300jj-52(b)(2)(B).

[xvi] ONC FAQs, supra note 15, Enforcement (“What are the applicability and enforcement dates for the information blocking regulations? . . .”).

[xvii] ONC, Webinar: Information Blocking Answers to Frequently Answered Questions (Feb. 4, 2021), at 27:32, https://www.healthit.gov/curesrule/resources/webinars (last visited Sept. 23, 2021).

[xviii] ONC FAQs, supra note 15, Interference (Q: When would a delay in fulfilling a request for access . . . ?) (emphasis added).

[xix] ONC, Webinar: Information Blocking Answers to Frequently Answered Questions, supra note 19 at 28:23.

[xx] ONC FAQs, supra note 15, Preventing Harm Exception (“Q: Would the Preventing Harm Exception cover a ‘blanket’ several. . . .”).

[xxi] 85 Fed Reg. 25642, 25842 (2020); see also Helen Oscislawski, Per ONC, Lab Results Generally Cannot be Delayed to ‘“Prevent Harm’ (unless threat to life & physical safety (Oct 8, 2020), www.legalhie.com/lab-results-cannot-be-held-back-per-onc-info-blocking-rule.

[xxii] ONC, Webinar: What Healthcare Providers Need to Know About Information Sharing & the Information Blocking Regulation (Sept. 14, 2021), at 10:56:52, https://www.healthit.gov/curesrule/resources/webinars (last visited Sept. 23, 2021).