What is Information Blocking?
In the 21st Century Cures Act, The Office of the National Coordinator (ONC) for Health Information Technology (HIT) released requirements regarding the prevention of “information blocking.” Information blocking refers to anything that restricts sharing and accessing electronic health information (EHI) among physicians and patients. The benefits of the information blocking provisions:
Direct Address Requirement
Upload digital contact information in NPPES
As of
May 1, 2021, per the 2020 CMS Interoperability and Patient Access Final Rule, physicians must provide their digital contact information (direct address and/or an Application Programming Interface endpoint) in the
National Plan and Provider Enumeration System (NPPES). The direct address is similar but not the same as an email address and can be obtained from the physician's EHR vendor (ex.
B.wells@direct.aclinic.org). This information is publicly available in the
NPI registry and the
NPI downloadable file. To learn more about direct addresses, refer to the
Direct Address Q&A.
How to meet this requirement
- Refer to the CMS Public Reporting of Missing Digital Contact Information web page to determine if you are non-compliant with the requirement, or search for your name and/or NPI on the NPPES NPI lookup web page and verify in the Health Information Exchange section that your endpoint (direct address) is included. If you do not see any information in that section, most likely you are not at compliance and will need to upload your direct address.
- Obtain your direct address or API endpoint from your EHR vendor, HIE, or another certified entity with direct messaging capability, such as a Health Information Service Providers (HISPs).
- Log in to NPPES with your user ID and password and enter the direct address in the API endpoint field in the Health Information Exchange section.
Penalties
There are no penalties at this time for noncompliance. However, CMS has publicly published a list of physicians who have not complied. Penalties will be considered in future rulemaking.
Resources
Information Blocking Requirement
Information blocking is a practice by an "actor" that is likely to interfere with the access, exchange, or use of electronic health information (EHI), except as required by law or specified in an information blocking exception.
EHI is electronic protected health information (ePHI) as defined in
45 CFR 160.103 to the extent that it would be included in a designated record set as defined in
45 CFR 164.501, regardless of whether the group of records are used or maintained by or for a covered entity asdefined in
45 CFR 160.103. EHI shall not include psychotherapy notes as defined in
45 CFR 164.501 or information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
Information is EHI if it is:
- Individually identifiable health information that is either maintained or transmitted electronically; AND
- Either individual medical records, billing records, payor records, or records used to make decisions about individuals; AND
- Not excluded form the EHI definition
Information is not EHI if it is:
Psychotherapy notes as defined in 45 CFR 164.501
Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action
or proceeding
Individually identifiable health information in education records covered by the Family Educational Rights and
Privacy Act, 20 U.S.C. 1232g
Individually identifiable health information in records described at 20 U.S.C. 1232g(a)(4)(B)(iv)
Individually identifiable health information in employment records held by a covered entity in its role as employer
Individually identifiable health information regarding a person who has been deceased for more than 50 years
De-identified protected health information as defined under 45 CFR 164.514
As of April 5, 2021, patients and their physicians must be given immediate electronic access to the following limited USCDI v1 data elements in the patient’s electronic health information upon request:
- Procedure, progress, and clinical notes; lab, pathology, and imaging reports
- Discharge summaries
- Assessment, plan of care, health concerns, and goals
- Allergies, immunizations, smoking status, implanted device identifiers, and demographics
- Care team members
- Vitals, problems, history and physical, and provenance
As of October 6, 2022, physicians must respond to a request to access, exchange, or use electronic health information (EHI) more broadly. The definition of EHI would include medical records, billing records, payment and claims records, case management records, and other records used, in whole or in part, for a medical group to make decisions about individuals.
How to meet this requirement
The
physician is responsible for verifying with their EHR vendor their preparations for
complying with the information blocking rules. To ensure that the requirement
is met, patients should be able to access this health information
electronically without charge and without delay. To
comply, physicians and practices should:
- Check
with their EHR vendor about their capabilities to allow the release and accessibility of the required information in the patient portal.
- Ask the EHR vendor how they will help to determine and document the use of exceptions (see
“Exceptions” section below).
- Evaluate whether existing practice policies about accessing EHI reflect the ONC Final
Rule requirements and ensure that the practice staff understands how to
approach EHI requests.
Penalties
Physician penalties for noncompliance will be decided in future rulemaking. ONC's proposed rule to identify appropriate disincentives and refer healthcare providers to the appropriate agency for enforcement is pending before the Office of Management and Budget Unified Agency (OMB).
Exceptions
There are eight exceptions that when the practice meets the condition(s) of an exception, it will not be considered information blocking.
Resources