United States21st Century Cures Act information blocking, interference with access, exchange or use of electronic health information
42 U.S.C. 300jj-52; 45 CFR Part 171
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Data subject rights
As of .
What it requires
- If you are a health IT developer of certified health IT, a health information network or exchange, or a health care provider, do not engage in a practice that is likely to interfere with access, exchange, or use of electronic health information unless a law requires it or an exception in 45 CFR Part 171, Subpart B, C or D applies (42 U.S.C. 300jj-52(a); 45 CFR 171.103).
- Do not implement health IT in a way likely to restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or transitioning between health IT systems (42 U.S.C. 300jj-52(a)(2)(C)(i)).
- To rely on an exception, meet all applicable requirements and conditions of that exception at all relevant times (45 CFR 171.200, 171.300 and 171.400).
These lines are LexLint's reading of the law's text, as of . Also read by: U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology (guidance, recorded ).
If you get it wrong
Penalty structure
The statute sets the civil monetary penalty for a developer, network or exchange at an amount the Secretary determines for all violations identified through an investigation, not to exceed $1,000,000 per violation; a health care provider is referred to the appropriate agency for disincentives instead.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 1,000,000
Who enforces it
Enforcement body
HHS Office of Inspector General, which may investigate claims and imposes civil monetary penalties on developers, networks and exchanges; the appropriate agency, such as the Centers for Medicare & Medicaid Services, applies disincentives to a health care provider
Settledness
- As of
- Guidance link
- https://www.healthit.gov/topic/information-blocking
- Guidance body
- U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology
- Open questions
- When does a health care provider that “knows that such practice is unreasonable” meet the standard of 42 U.S.C. 300jj-52(a)(1)(B)(ii) for a practice “likely to interfere with, prevent, or materially discourage” access, exchange, or use of electronic health information?
What this law does
Section 3022 of the Public Health Service Act defines information blocking as a practice that, except as required by law or specified by the Secretary in rulemaking, is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.
A health information technology developer, exchange or network engages in it if it knows, or should know, that the practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information, and a health care provider engages in it only if the provider knows that the practice is unreasonable and is likely to do so.
The regulations in 45 CFR Part 171 apply to health care providers, health IT developers of certified health IT, health information exchanges, and health information networks, which are subject to the part on and after .
A health IT developer of certified health IT is an individual or entity, other than a health care provider that self-develops health IT that is not offered to others, that develops or offers health information technology and has, at the time of the practice, one or more Health IT Modules certified under the voluntary certification program the National Coordinator keeps or recognizes.
A health information network or health information exchange is an individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of any technology or services for access, exchange, or use of electronic health information among more than two unaffiliated individuals or entities that are enabled to exchange with each other, for a treatment, payment, or health care operations purpose.
Electronic health information means electronic protected health information to the extent that it would be included in a designated record set, regardless of whether the group of records are used or maintained by or for a covered entity, and excludes psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.
A practice is not treated as information blocking if the actor satisfies an exception in Subpart B by meeting all applicable requirements and conditions of the exception at all relevant times. The Subpart B exceptions are the preventing harm, privacy, security, infeasibility and health IT performance exceptions and the exception for protecting care access. The Subpart C exceptions are the manner, fees and licensing exceptions.
Subpart D adds an exception for limiting the manner in which an actor fulfills a request to only via the Trusted Exchange Framework and Common Agreement. A developer of certified health information technology, an entity offering it, or a health information exchange or network that the Inspector General determines, after an investigation, to have committed information blocking is subject to a civil monetary penalty determined by the Secretary, which may not exceed $1,000,000 per violation.
A health care provider that the Inspector General determines to have committed information blocking is referred to the appropriate agency to be subject to appropriate disincentives.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app handles health records.