Health Information Blocking: Responses Under the 21st Century Cures Act

Interoperability, or the easy, secure exchange of electronic health information (EHI), is now vital to health care and public health functions, including disease and laboratory reporting.¹ Conversely, “information blocking,” or activities that interfere with collecting, using, and exchanging EHI, can seriously harm public health.² The 21st Century Cures Act (the Act), signed into law on December 13, 2016, establishes a legal framework to: address the use and exchange of health data through health information technology (HIT), strengthen interoperability, and prevent information blocking, among other health-related initiatives.^3,4 Before the Act, information blocking was not defined or well understood and could not be effectively prevented, leaving interoperability unprotected. The Act defined these concepts and incorporated them into Title IV of the Public Health Service Act (PHSA) under “Delivery.” This article describes the issues involved in information blocking, including the federal actions taken to identify the problem, prohibit it, and impose civil penalties for engaging in it, as well as the implications for interoperability.

Defining Information Blocking

HITs have been used in various forms since the 1950s, and laws governing their use have accelerated their adoption since the early 2000s.^5-7 In 2009, Congress passed the Health Information Technology for Economic and Clinical Health (HITECH) Act to “drive the rapid adoption of interoperable technologies and services to support the exchange of electronic health information to improve care and efficiency in the US health care system.”² Despite these goals, some health care providers and HIT developers knowingly interfere with the exchange of EHI, according to a survey of leaders in the health information exchange field.⁸ For example, survey respondents reported that some electronic health record vendors deploy products designed not to interact with other vendors’ technologies and impose contractual gag clauses that prevent customers from reporting these restrictions.^2,8 Survey respondents also reported that some health care facilities require providers to adopt one specific electronic health record technology.⁸ Such interference constitutes information blocking, and it can seriously impair development of an interoperable health system and the use of HIT in improving health care. Given the evasive nature of information blocking, however, its full impact on health care has not yet been determined.^2,8,9

Information blocking poses several concerns for patient health. It could prevent timely access to patient information, which impedes efficient patient care, and it could prevent patient information from being used to research treatments or decrease health care costs. In addition, requiring health care providers to use specific electronic health record technologies can prevent patients from changing providers, thus limiting their options in making health decisions because their health data are not portable. Although specific actions have not yet been identified as, or excluded from, information blocking, some actions may suggest that information blocking is occurring. For example, when organizations impose cost-prohibitive fees on health data exchange or when they use privacy laws as an excuse to withhold health data, concerns may arise.²

Although both interoperability and information blocking were implicated in the HITECH Act, they were not expressly defined, making them difficult to regulate. Information blocking is challenging to define because of the various types of EHI and the many factors that limit EHI exchange, both intentionally and unintentionally.² Unintentional acts that limit information access and exchange can be caused by technological, economic, or practical challenges,² such as when electronic health records stored by various providers cannot be merged because the systems are not compatible.^10,11 On the other hand, intentional acts that prevent access to and exchange of EHI can be driven by private interests, such as the desire to limit professional liability, protect patient privacy, or increase profits.^2,8 Given the various issues related to interoperability, Congress requested a report from the Office of the National Coordinator for Health Information Technology (ONC) “regarding the extent of the information blocking problem.”²

The ONC’s 2015 response, the “Report on Health Information Blocking,” aimed to propose the first uniform definition of intentional information blocking. It also sought to “enable an interoperable learning health system—one in which EHI is available and can be securely and efficiently shared, when and where it is needed, to support patient-centered care, enhance healthcare quality and efficiency, and advance research and public health.”² The report described the ONC’s efforts to determine the extent to which information blocking impedes the effective use of EHI and to develop a comprehensive approach to address abuses.² ONC staff members reviewed 60 unsolicited reports of information blocking, most of which involved developers who made exchanging EHI cost-prohibitive by charging high fees, providers who refused to share clinical information with competing health care providers, and providers who coerced other providers into using specific HIT vendors. Because identifying and verifying acts of information blocking is difficult and fact-specific, the ONC illustrated the concept with several examples: laboratories that refuse to use interfaces that link electronic orders to competing laboratories would be found to be engaging in information blocking, as would an organization that creates a privacy policy that prevents the release of information when it is otherwise permissible under state or federal law.^2,12

In its report, the ONC defined information blocking as “when persons or entities knowingly and unreasonably interfere with the exchange or use of electronic health information.”² This definition of information blocking contains 3 requirements: (1) interference, (2) knowledge of interference, and (3) the absence of a reasonable justification for interference. The requirement of interference means identifiable conduct that obstructs access to EHI, including policies that prevent EHI exchange and organizational practices that make EHI exchange more difficult or expensive than the uninhibited exchange of EHI.²

To satisfy the second requirement—knowledge of interference—an individual or entity must know or should know that its conduct was likely to interfere with exchanging or using EHI.² Although the ONC has yet to enforce this requirement, the report provided hypothetical occurrences as examples, including not connecting with other service providers outside a particular network, encrypting patient information to make it inaccessible to providers, prohibiting sharing information with out-of-state providers, and disabling an electronic sharing system.^2,13

Finally, the conduct must also be “objectively unreasonable in light of public policy.”² Absent a reasonable justification, interfering with interoperability is against the public interest. This requirement of unreasonableness seeks to balance several public health concerns, such as making EHI available when needed, protecting the security and privacy of EHI, and protecting incentives to innovate and enhance technology, consumer health, and welfare.² Determining whether an action is reasonable requires carefully considering the circumstances, the action’s effect on health information exchange, the extent to which it could have been avoided, and the extent to which it advances countervailing interests. For example, some limitations on sharing information may be justifiable if they protect patient safety or promote consumer welfare.²

In addition to laying out a definition, the report also proposed an approach to stop information blocking. This approach proposed that the ONC should coordinate its efforts with those of the US Department of Health and Human Services (HHS) Office of the Inspector General (OIG) and the Centers for Medicare & Medicaid Services. The report’s approach also recommended that accounts of prohibited practices be directed to the appropriate enforcement agency, such as the Federal Trade Commission’s Bureau of Competition and Bureau of Consumer Protection, the US Department of Justice, and state attorneys general.²

The report noted that strategies to prevent, rather than just respond to, information blocking would likely require Congressional action because creating a comprehensive approach to prevent information blocking requires clarifying the authority of federal agencies to target, deter, and remedy information blocking.² Accordingly, the ONC’s November 2016 progress report to Congress included a new goal of changing the culture around how providers access EHI, because some information technology vendors and providers continue to choose not to share EHI out of concerns for complying with privacy laws and fears of losing a competitive advantage by not maintaining exclusive control over the EHI.^13,14 This practice prevents patients, families, and caregivers from learning and communicating about their health, hindering treatment and ultimately preventing better health outcomes.¹³ Because no law at that time addressed investigation and penalties for these practices, the ONC also included in its 2017 budget a legislative proposal to prohibit information blocking and to impose penalties for infractions.¹³ Congress addressed this gap in the 21st Century Cures Act by creating a legal framework for prohibiting information blocking and addressing how penalties for engaging in it will be prescribed.

The 21st Century Cures Act: Information Blocking Updates

Effective as of December 13, 2016, the Act incorporates definitions of both interoperability and information blocking into existing provisions in the PHSA that regulate the use of HIT in health care practice and public health. The Act defines interoperability as the ability to securely exchange EHI between vendor technologies without requiring special efforts by the user and the ability of providers and patients to completely access and exchange EHI for authorized uses.¹⁵ The Act also defines information blocking as a practice that “is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information” and expressly prohibits it.¹⁶ This definition is similar to the ONC’s recommended definition, although it does not expressly include its 3 criteria. The purpose of these definitions is to clearly identify actions that constitute information blocking and when it has occurred so that violations can be identified and investigated. The investigations enable HHS to assign appropriate civil monetary penalties or refer the party in violation to the appropriate agency to impose civil penalties.¹⁷

The Act’s prohibition against information blocking now applies to provisions in the PHSA. In addition, the Act prohibits certain information-blocking practices, including restricting authorized access and exchange or implementing HIT in nonstandard ways that will likely: (1) increase the burden of “accessing, exchanging, or using [EHI]”; (2) restrict the access or exchange of EHI in exporting information or in transitioning between HIT technologies; or (3) lead to “fraud, waste, or abuse, or impede innovations” in accessing and exchanging information by HIT.¹⁸

The Act considers HIT developers, exchanges, and networks to be groups guilty of information blocking where they know or should know that their action is information blocking.¹⁹ In addition, the Act states that health care providers may be found to have engaged in information blocking when they know their actions are unreasonable but continue to engage in them, which is similar to the standard of a knowing and unreasonable interference developed by the ONC.^2,20 These definitions and standards are essential to understanding what is prohibited, but the Act goes further by specifying the mechanism through which these provisions can be enforced.

The 21st Century Cures Act: Implementation and Enforcement

To enforce the prohibition on information blocking, Congress granted the OIG the authority to investigate allegations of information blocking.²¹ (The Act does not, however, say who may lodge information-blocking allegations or how allegations may be made.²¹) If the OIG finds that a provider committed information blocking, offending individual(s) will also be “referred to the appropriate agency and be subject to appropriate disincentives,” to be defined in future regulations.²²

Furthermore, the Act enables the OIG to levy civil monetary penalties of up to $1 million per violation for prohibited practices that interfere with EHI exchange if a developer, network, or exchange blocked information.^23,24 This provision gives the OIG the flexibility to determine how to deter intentional information blocking through future rulemaking.²⁵ Ultimately, the Act provides a uniform policy response to information blocking and assigns the OIG the responsibility to expand on the details and penalties defined in the law.²⁶

The ONC is expected to issue a proposed rule on information blocking in 2018, as required by the 21st Century Cures Act. The proposed rule will include a description of activities that are not considered information blocking because they are reasonable and necessary. Identifying acceptable actions will further assist the enforcing agencies in recognizing prohibited actions and knowing when to impose civil penalties.^27,28

Anticipating future regulations promulgated under the Act and other HHS guidance, stakeholders are identifying gaps in the Act’s legal provisions that must be filled. In August 2017, industry stakeholders (eg, American Academy of Family Physicians, National MS Society, National Partnership for Women & Families, and Oracle) requested that the OIG clarify how it will determine the sources and actions of information blocking, as well as the fines involved, so that these efforts can be targeted to decrease offenses.^29-31 Leaders in the EHI community suggested a “mix of strategies that foster an environment with incentives that discourage information blocking, as well as direct enforcement by making information blocking illegal.”⁸

Researchers in HIT concluded that creating a well-developed policy response is difficult without more research on the nature and extent of the problem. One study found that the most effective response to information blocking would be legal action, because allowing the ONC to enforce the Act’s prohibition is a viable near-term strategy, and called for stronger legislative responses against information blocking because such responses could increase interoperability and improve EHI exchange.⁸ Now that prohibitions against information blocking can be enforced, the study also suggested that economic incentives be designed to benefit those who exchange information and promote transparency of their practices, such as by using value-based payments, to support a market that values EHI exchange.⁸

Public Health Implications of Information Blocking

Including information blocking in the Act was an important step in improving the quality and efficiency of health care through the effective exchange of EHI.²⁹ The provisions on information blocking promote interoperability by identifying and penalizing those who interfere with it. This approach ensures that information can be securely and efficiently exchanged where needed, including among public health agencies and health care organizations involved in controlling and preventing the spread of disease and injury. Whether the Act will inhibit information blocking sufficiently remains to be seen.