The line dividing the policy goals of the information-block clauses in the 21st Century CURES Act and what the Office of the National Coordinator for Health Information Technology (ONC) is demanding that patient care organizations do, is increasingly becoming blurred now—with implications for hospitals and health systems. That’s what one legal expert is saying in an op-ed published on Monday, May 16 in the Health Affairs “Forefront” section.
Writing in “Provider Obligations For Patient Portals Under The 21st Century Cures Act,” Alexander Dworkowitz, an attorney who “represents health care providers, health insurers, pharmaceutical manufacturers, technology vendors, trade associations, and state and local agencies on a wide variety of federal and state regulatory issues and transactional matters,” says that the ONC has effectively reinterpreted the information-blocking provisions of the 21st Century CURES Act for rather a different purpose from what Congress intended when it passed the Act in December 2016, shortly after which President Barack Obama signed it. Dworkowitz is a partner at Manatt Health.
As Dworkowitz writes that, “When Congress prohibited ‘information blocking’ under the 21st Century Cures Act in 2016, it made no reference to patient portals, the websites through which many health care providers share clinical information with their patients. Similarly, the word “portal” does not appear once in the 6,000-word information blocking regulation, issued by the Office of the National Coordinator for Health Information Technology (ONC) in 2020. Such regulation defines information blocking to mean a practice that is likely to interfere with the access, exchange, or use of electronic health information, subject to some important limitations. Yet, nearly two years after the ONC issued its rule, hospitals and other providers throughout the country have significantly changed the information available to patients in their portals as a direct result of the information blocking rule. While portals once had limited information, many providers now offer a vast array of data to their patients, including laboratory results, surgical reports, and doctors’ notes. And providers are continuing to adapt their practices as new regulatory requirements take effect later in 2022. Changes to patient portals are so far the most visible manifestation of the shift in practices resulting from the information blocking rule.”
That said, Dworkowitz writes, “Key aspects of information blocking, however, remain widely misunderstood. The right of access requirements under the Health Insurance Portability and Accountability Act (HIPAA) can be quite prescriptive—with guidance going so far as to specify the exact dollar figure that a provider may charge a patient for a record. In contrast, the information blocking rule looks like a Rorschach test, with countless interpretations possible. While the ONC has issued limited guidance, the government has not answered key questions: What types of information do patients have a right to access via portals? When may providers withhold information when not required to do so by law? Providers are struggling to navigate these issues, just as patients are beginning to understand their rights under this new regulatory framework.”
What’s now happening, Dworkowitz notes, is that, “In effect, the ONC is interpretating the 21st Century Cures Act to mean that patients have the right to obtain their data from health care providers as quickly as possible. Therefore, patient portals—which permit patients to see a significant trove of information about themselves as soon as they log into the sites—have become a key tool in meeting this obligation.
But the ONC’s position leaves open many questions. Providers have been left struggling with how to comply with government regulations and determining whether they must upload every piece of information they have about patients to their portals.”
Dworkowitz notes that “Providers’ concerns generally fall into three categories.” The first is a set of clinical concerns around what happens if, for example, an unexpected laboratory result is posted before a physician can have a conversation about it with their patient—or even worse, an unexpected cancer diagnosis. How the “preventing harm exception” might play out in some circumstances, remains a concern. Then there is the legal concern, around the tension between the information-blocking rule and privacy laws that limit access to information. That concern comes fully to the fore in the arena of pediatric information on the health of minors being shared with their parents. Finally, he writes, there is a practical concern related to how to configure patient portals in order to accommodate large data files and make the importation from electronic health record (EHR) systems more practicable.
Dworkowitz writes that, “So far, there has been no enforcement of the information blocking rule. The HHS Office of Inspector General issued a proposed regulation to enforce information blocking requirements in 2020, but that rule has yet to be finalized. Moreover, the proposed rule only addressed actions against health information exchanges and health information technology vendors, not against providers. The federal government has not developed a scheme to effectuate information blocking requirements against providers.”
That said, he predicts, “Data released by the government so far suggest that such enforcement may focus on patient complaints against providers, in regard to portals and otherwise. The government recently found that nearly 80 percent of information blocking complaints received through February 2022 were against providers and that patients made up about two-thirds of those who filed complaints. ONC officials noted that one common complaint was patients saying their providers unnecessarily delayed providing access to their information.”
