Meeting information blocking requirements

Editor’s note: This article is the second in a series on overcoming the challenges at the heart of interoperability in healthcare. Future article will cover topics such as new expectations for what constitutes electronic health information, how modern technology can break down longstanding obstacles to sharing data and coordinating care, and how third-party partners can help organizations overcome “last mile” barriers to interoperability.

As of Oct. 6, 2022, healthcare organizations are subject to the full scope of the 21^st Century Cures Act’s information blocking final rule, which grants patients the right to access their electronic protected health information (ePHI).

At the moment, individuals or entities may file information blocking claims, and the Department of Health and Human Services (HHS) will investigate claims, but providers aren’t yet subject to penalties. That’s due in part to advocacy on behalf of professional organizations to delay the rule by one year, as many provider organizations weren’t prepared to fully comply with the final rule.

These three considerations can help organizations focus their ongoing efforts to meet the rule’s complex requirements and avoid penalties in the future.

1. When in doubt, start with HIPAA.

Electronic health record systems that are Cures Act certified support information sharing in principle. However, the Office of the National Coordinator has reminded providers that EHR certification rules and information blocking rules have “limited connections.” There are two reasons for this: Many providers subject to the information blocking rule, such as pharmacies and labs, may not use certified EHR technology, and many patient records reside in legacy systems that predate certification rules.

ONC’s guidance on the matter is to lean on the HIPAA Privacy Rule, since the ePHI that patients have a right to access under that rule is the same information that providers cannot “block.” Put another way: As long as providers can make ePHI available under the HIPAA Privacy Rule, whether their technology is certified or not, they aren’t interfering with access to information.

2. Update policies for releasing information.

One possible hurdle to information blocking compliance is that, as of Oct. 6, what constitutes a designated record set now includes all “records used in whole or in part to make decisions about individuals.” These records include imaging scans, lab test results, and unstructured clinical notes. Organizations need to therefore ensure that policies for releasing this information are updated, documented, and shared with any business unit that’s tasked with sharing patient records.

Though use of a patient portal isn’t required for releasing information, Health Affairs noted the portal is increasingly the default application for patients to view ePHI. This means policies need to cover instances in which parts of the designated record set exist outside the EHR to which the portal is directly linked.

3. Be ready to explain some exceptions.

There are eight exceptions to information blocking. Some, such as those that could cause harm or risk, require no explanation from the entity withholding information. But there are three instances that do require an explanation: A license is needed to access information, a request has been deemed infeasible, or the two parties involved cannot agree to the terms of information sharing. The first two cases require a written response within 10 business days; the third, known as the condition and manner exception, comes with its own steps for resolution.

About Consensus Cloud Solutions: Consensus Cloud Solutions, Inc. (NASDAQ: CCSI) has been a global leader of digital cloud fax technology for over 25 years. The company leverages its technology heritage to provide secure solutions that transform simple digital documents into advanced healthcare standard HL7 FHIR for secure data exchange. Consensus offers eFax, a global leader in online faxing, Consensus Unite and Consensus Harmony interoperability solutions, Consensus Signal for secure automatic real-time healthcare communications, Consensus Clarity, a Natural Language Processing (NLP)/Artificial Intelligence solution, and jSign for electronic digital signatures. For more information about Consensus, visit consensus.com. Follow us on Twitter @ConsensusCS.