Editor’s Note: In a recent article for the Health Affairs blog, summarized below, Manatt Health shares how the information blocking rule is impacting patient portals and clarifies new regulatory requirements for providers. To read the full post, click here.
When Congress prohibited “information blocking” under the 21st Century Cures Act in 2016, it made no reference to patient portals. Similarly, the word “portal” does not appear in the 6,000-word information blocking regulation, issued by the Office of the National Coordinator for Health Information Technology (ONC) in 2020. Such regulation defines information blocking to mean a practice that is likely to interfere with the access, exchange or use of electronic health information, subject to some important limitations.
Yet providers have significantly changed the information available to patients in their portals as a direct result of the information blocking rule. While portals once had limited information, many providers now offer a vast array of data to their patients, and providers are continuing to adapt their practices as new regulatory requirements take effect later in 2022. Key aspects of information blocking, however, remain widely misunderstood.
Origins of the Portal Push
The shift in patient portals reflects a fundamental difference between the information blocking rule and the access right under the Health Insurance Portability and Accountability Act (HIPAA), which was adopted in 2000. The Office of Civil Rights (OCR) of the Department of Health & Human Services (HHS) envisioned that patients would phone or write their providers to request a copy of their medical records, and providers would respond by providing a copy of those records. The typical case involved providing paper records via mail or in-person pickup. As a result, HIPAA gives providers 30 days to correspond with the patient about what information needs to be provided, locate the files, make copies and assemble mailings, when applicable (the 30-day time frame can be extended to 60 days).
The information blocking law, in contrast, was adopted in 2016 in a world where most health information is in electronic form. The rule applies only to “electronic health information” (EHI), exempting information that exists solely in paper form. Since the government anticipated that information would be provided electronically, it also anticipated that EHI could be provided in a much faster time frame than 30 days. While ONC declined to mandate that providers proactively make their data available to patients via patient portals, the agency said that a “delay in making EHI available through a ‘patient portal’ or an API [application programming interface] for patients could constitute an interference and thus implicate the information blocking regulations.”
The Extent of Providers’ Obligations
In effect, ONC is interpreting the 21st Century Cures Act to mean that patients have the right to obtain their data from health care providers as quickly as possible. Therefore, patient portals have become a key tool in meeting this obligation. But the ONC’s position leaves open many questions—and providers have been left struggling with how to comply with government regulations.
Providers’ concerns generally fall into three categories. The first is a clinical concern: How can physicians have conversations with their patients about an unexpected laboratory result if results must be posted on a portal as soon as the laboratory completes its work? The information blocking rule recognizes a “preventing harm exception,” which permits a provider to withhold information if disclosure is “reasonably likely to endanger the life or physical safety” of any person.
The second is a legal concern: In many cases, there is tension between the information blocking rule and privacy laws that limit access to information. Striking a balance can be difficult, particularly in the case of minors. Drawing the line between pediatric records that cannot be shared with parents and guardians and those that must be shared is not always an easy task.
The third is a practical concern: Is a provider obligated to upload all records, even those that are many years old, not compatible with the portal’s current configuration or outside the provider’s primary electronic health record (EHR) system?
While ONC has not provided answers, the information blocking rule itself can help to address some of these issues. The rule applies only to records that exist in electronic form. Further, the rule does not apply to information that exists outside of a patient’s “designated record set,” which essentially means records that may be used to make treatment or billing decisions about the patient.
But even a provider’s determination that certain information is part of an electronic designated record does not mean that the provider always needs to make that information available via portal. Preventing a patient from having access to EHI rises to the level of information blocking only if no information blocking exception applies and the “provider knows that such practice is unreasonable.”
Future of Portals
So far, there has been no enforcement of the information blocking rule. However, providers eventually will face enforcement. Data released by the government suggest such enforcement may focus on patient complaints against providers, in regard to portals and otherwise. The government recently found that nearly 80 percent of information blocking complaints received through February 2022 were against providers and that patients made up about two-thirds of those who filed complaints.
In short, health care providers’ efforts to give their patients better access to their information will be subject to scrutiny for years to come.