You are using an outdated browser. Please upgrade your browser to improve your experience.

You are using an outdated browser.

To ensure optimal security, this website will soon be unavailable on this browser. Please upgrade your browser to allow continued use of ACP websites.

You are here

Things to Know about Information Blocking (CMS & ONC)

Overview of the regulation, key dates, what is expected of physicians, and additional resources.

What is Information Blocking, and to which actors does it apply?

The Office of the National Coordinator for Health IT (ONC) Information Blocking Rule applies to three categories of actors: developers of certified health IT; Health Information Exchanges and Health Information Networks; and health care “providers”, which includes hospitals, skilled nursing facilities, health care clinics, group practices, and laboratories. As it pertains to health care physicians, “information blocking” is defined as the intentional withholding of patient health information – either from “provider” to “provider” or “provider” to patient. “Information Blocking”, as used throughout this FAQ, references the body of works that are the information blocking provisions of the 21st Century Cures Act. Information Blocking gives patients more control of their health data, and physicians will be able to take advantage of the improved ability to collect and utilize the flow of information for the benefit of their patients and practice. This expanded right of access will also result in improvements in the patient-physician relationship, including enhanced trust, transparency, communication, and shared decision-making.

What is changing, and what is expected of physicians as a result?

The 21st Century Cures Act, as part of Information Blocking, mandates that patients have increased access to their electronic health information (EHI), including clinical notes, through an application of their choosing or EHR portal. The new applicability date for Information Blocking is April 5, 2021. We say “increased access” because 21st Century Cures Act simply builds on the already existing legal rights for patients to access all their information. The Cures Act reduces barriers and makes information more accessible to the right people. As a result, physicians must exchange EHI unless an exception applies. This should be distinguished from HIPAA rules which permit physicians to exchange EHI for certain purposes.

If a practice still uses paper records, are they subject to the Information Blocking regulations?

No, Information Blocking pertains only to the access, exchange, and use of EHI. This should be contrasted to HIPAA, which covers paper, electronic, and verbal data as protected health information (PHI). Individuals still have the right to access their papers records under existing HIPAA rules. Where an individual requests a paper copy of PHI maintained by the practice, it is still expected that the practice will be able to provide the individual the paper copy requested.

When responding to requests for EHI, what are the exceptions that a physician may claim?

While the end goal of the Information Blocking regulations is to improve access to and sharing of the entire record, there are situations when reasonable and necessary activities would not constitute information blocking. ONC has established eight exceptions to the Information Blocking Rule. The first category of exceptions involves unfulfilled requests to access, exchange, or use EHI: Preventing Harm Exception; Privacy Exception; Security Exception; Infeasibility Exception; and Health IT Performance Exception. The second category involves the procedures followed in fulfilling requests to access, exchange, or use EHI: Content and Manner Exception; Fees Exception; and Licensing Exception. Actors have the burden of proof that practices restricting the free flow of health information fit within one of the eight exceptions. Exceptions apply on a case-by-case basis and will require substantial documentation that will be evaluated by ONC and the Office of the Inspector General (OIG). More details on each exception can be found on ACP’s FAQ on Information Blocking: Documentation Guidelines.

What data and note types are covered under Information Blocking and must be shared as a result?

Until October 6, 2022, EHI is limited to the data elements represented in version 1 of the United States Core Data for Interoperability (USCDI) standard. The clinical notes that must be shared are consultation notes, discharge summary notes, history and physical, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes, and progress notes. After October 6, 2022, the definition of EHI will expand to include any electronic, individually identifiable health information included in the designated record set per HIPAA access requirements, with certain limitations. The type of information that must be shared may differ if, for example, the patient is an adolescent. Please reference ACP’s FAQ on Information Blocking: Patient Access Guidelines for more details, as well as the table below which indicates what items in an EHR are required to be shared under Information Blocking.

Allergies and Intolerances
Substance (Medication)
Substance (Drug Class)
Reaction
Laboratory
Tests
Values/Results
Unique Device Identifier(s) for a Patient’s Implantable Device(s)
Unique Device Identifier(s) for a Patient’s Implantable Device(s)
Assessment and Plan of Treatment
Assessment and Plan of Treatment
Medications
Medications
Vital Signs
Diastolic Blood Pressure
Systolic Blood Pressure
Body Height
Body Weight
Heart Rate
Respiratory Rate
Body Temperature
Pulse Oximetry<
Inhaled Oxygen Concentration
BMI Percentile (2-20 Years)
Weight-for-length Percentile (Birth – 26 Months)
Head Occipital-frontal Circumference Percentile (Birth – 36 Months)
Care Team Members
Care Team Members
Patient Demographics
First Name
Last Name
Previous Name
Middle Name (including Middle Initial)
Suffix
Birth Sex
Date of Birth
Race
Ethnicity
Preferred Language
Current Address
Previous Address
Phone Number
Phone Number Type
Email Address

 

Clinical Notes
Consultation Note
Discharge Summary Note
History & Physical
Imaging Narrative
Laboratory Report Narrative
Pathology Report Narrative
Procedure Note
Progress Note
Problems
Problems

 

Goals
Patient Goals
Procedures
Procedures

 

Health Concerns
Health Concerns
Provenance
Author Time Stamp
Author Organization

 

Immunizations
Immunizations
Smoking Status
Smoking Status

 

Are there penalties if a physician intentionally withholds? What about in the case of mistake?

Yes. The Office of Inspector General (OIG) is charged with investigating allegations of information blocking and determining whether a violation has occurred. However, unlike other covered actors, physicians are not subject to the civil monetary penalties established. Instead, OIG will refer physician violations to the appropriate outside agency. HHS has yet to identify the agency or agencies that will handle information blocking referrals and has yet to identify the “disincentive” that will apply to physicians that engage in information blocking. In the case of innocent mistake, OIG has confirmed that it will not bring enforcement actions against actors who lack the requisite intent for information blocking.

How does Information Blocking tie into CMS’ Interoperability and Patient Access rule? What effect does Information Blocking have on CMS’ Promoting Interoperability program?

The CMS Interoperability and Patient Access regulations promote patient access and exchange of their clinical data and claims data across CMS-contracted payers. Additionally, CMS is requiring access to physician directory information and requiring physician organizations, including hospitals, to send admission, discharge, and transfer (ADT) notifications to the patient’s care team. A physician participating in CMS’ Promoting Interoperability (PI) program is required to attest they are in good faith implementing and using their EHRs to exchange data. If a health system is found to have falsely attested, it could potentially owe back the incentive funds and could be liable for penalties under the False Claims Act. CMS will also publish on a public website all physicians and physician organizations who have either attested to or been found to be information blocking.

Tips to Help Physicians Ensure They are Ready, and Additional Considerations

Communicate and Educate! – Leadership must buy in and empower team members to take action to ensure compliance. Driving change through the lens of patient-centeredness is key. Have you communicated to your team what compliance looks like for them? Does your vendor have EHR-specific resources available? Communication is key.

Identify Key Stakeholders, Subject Matter Experts, and External Resources – Many different disciplines and departments will need to be engaged as your practice comes into compliance. Consider convening a multidisciplinary change management team inclusive of clinicians, informatics experts, coding and compliance experts. Everyone needs to be on the same page and equipped with tools to succeed.

Review ONC (and CMS) Resources, and Confirm Stakeholders Understand Responsibilities – Timelines, certification requirements, and CMS rule applicability.

Review Internal EHI Practices and Policies, System Functionality, and Identify Risks, Mitigators, and Scope – Identify potentially tricky EHI scenarios that need consideration when sharing information with individuals or requestors outside of your practice, identify the risks for physicians, other clinicians, and organization staff that engage in those various EHI scenarios, develop standard note templates, availability of and access to application programming interfaces (APIs), and establish a positive organizational outlook on data access and release.

Evaluate and Plan for Documenting Exceptions – Identify specific EHI scenarios that may require the use of one of the exceptions, identify affected team members and specialty colleagues, and establish complete documentation and exchange processes.

Actions and Changes – Identify needed changes to make sure you are ready. This may also include needed contracts, agreements, and licenses.


DISCLAIMER - The information contained on this page should not be seen as official technical or legal advice. State laws around data release may affect applicability of the ONC and CMS rules. Consult with your organization’s Health Information Management, compliance, legal, finance, and public affairs teams to find out how it applies to you.