The 21st Century Cures Act and electronic health records one year later: will patients see the benefits?

Abstract

While federal regulation provides patients the right to access their electronic health records and promotes increased use of health information technology, patient access to electronic health records remains limited. The 21st Century Cures Act, signed into law over a year ago, has important provisions that could significantly improve access and availability of health data. Specifically, the provisions call for partnerships among health information exchange networks, educational and research initiatives, and health information technology certification requirements that encourage interoperability. The article reviews the potential benefits and concerns regarding implementation of these provisions, particularly the difficulty of aligning incentives and requirements for data sharing and the question of whether currently proposed rules and guidance will support the goal of improved patient access and health information exchange. Researchers, clinicians, and patients have the power to advocate for improved patient access and interoperability as policy development and implementation of the 21st Century Cures Act continues.

While Congress seems unable to reach consensus on the Affordable Care Act, it is easy to forget that tucked into the bipartisan 21st Century Cures Act (the Cures Act), signed into law in December 2016, are new provisions that could significantly impact the exchange and availability of health information.

The Cures Act is widely known for its provisions relevant to the drug and device approval process, but a substantial, perhaps underemphasized, portion of the Act builds upon the use of electronic health records (EHRs) and electronic health data across the continuum of care, with health information technology (health IT) provisions in the Cures Act focusing on data availability, usability, and patient access.¹ As the one-year anniversary of the enactment of the 21st Century Cures Act has passed and the Office of the National Coordinator for Health IT (ONC) at the U.S. Department of Health and Human Services (DHHS) develops guidance and regulations to implement these provisions, we review the opportunities and challenges of the Cures Act to promote access and availability of health data to support clinical care, research, and patient engagement.

PATIENT ACCESS

Federal regulation has provided patients with the right to access their medical records. The Privacy Rule, adopted under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and modified by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, established the patient’s right of access, including the right to receive a paper or electronic copy of his/her medical records and to request that records be sent to an individual’s designee. The HITECH Act promoted the widespread adoption and meaningful use of health IT,^2,3 and required providers and hospitals participating in the Medicare and Medicaid EHR incentives programs to exchange electronic health information for transitions of care and allow patients to electronically view, download, and transmit their digital health data.⁴ However, access to digital health data by patients remains limited in practice.⁵

To address some of the implementation challenges, the Cures Act calls for specific policies to promote patient access. Specifically, it encourages partnerships between health information exchange organizations and networks and healthcare organizations to promote patient access to their electronic health information in a “single, longitudinal format that is easy to understand, secure, and updated automatically.” In addition, DHHS and the Office for Civil Rights are directed to educate healthcare professionals on their obligation to provide patients with access to their electronic health information, to provide guidance to health information exchanges related to best practices to provide patient access, and make patients aware of their right to access their health information. There is continuing focus of the federal government to improve on patients’ access to their health information. However, it is unclear whether these educational initiatives will significantly improve patient access.

There have been many efforts to educate entities about promoting access, with limited success. The incentives for stakeholders to promote greater access to data are included within the regulations implementing the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) and new merit-based incentive payments systems (MIPS), regulations implementing the EHR incentives under the HITECH Act, and the need for data and information sharing to support value-based care and payment programs. However, there are disincentives to data sharing, including upfront costs associated with establishing the technology and policies for data sharing, and business interests for EHR vendors and healthcare providers not to share data that are considered valuable and can provide a competitive advantage to the entity that holds the data by limiting the flow of information. Aligning these incentives, disincentives, and requirements for data sharing and taking steps to make the provision of access simple and not overly burdensome to healthcare providers and patients is more likely to lead to improvements than educational efforts alone.

A more impactful provision for patient access is the requirement for certified EHRs to have application programming interfaces (APIs) to allow health information to be accessed, exchanged, and used without special effort. One intent of this provision is to provide the opportunity for innovative patient-facing tools that can pull information from an EHR for a patient’s use in accordance with the patient’s right of access.

The Cures Act seeks to focus on the promotion of patient access as a driver for research. The expectation is that researchers would have improved access to clinical data from EHRs if patients could more easily obtain electronic access to their health information in a way that facilitates communication with other individuals, including researchers. The Cures Act includes support for participant-partnered research initiatives, such as the All of Us program, established under the Precision Medicine Initiative of the National Institutes of Health. The All of Us program, which seeks to enroll more than one million individuals in a large-scale observational study, was designed to develop partnerships with peope and enable them to share their health data for research purposes. The Cures Act supports this approach by providing $1.455 billion in funding to the National Institutes of Health to support the Precision Medicine Initiative, and charges DHHS with promoting policies that empower patients to access and share their health information with researchers. These provisions have the potential to widen opportunities for research by facilitating patient engagement, encouraging innovation, and involving patient perspectives.

INTEROPERABILITY AND HEALTH INFORMATION EXCHANGE

The Cures Act seeks to address barriers to interoperability to improve patient care. Section 4003 of the Cures Act defines interoperability as health IT that enables the secure exchange of electronic health information without special effort on the part of the user; complete access, exchange, and authorized use of electronic health information; and no “information blocking.” The Cures Act creates a new hammer to encourage interoperability, prohibiting the practice of information blocking by developers, networks, exchanges, and healthcare providers. Information blocking is any practice that may interfere with the use, access, and exchange of electronic health information and that is not “reasonable and necessary.” Developers, networks, and exchanges determined to have committed information blocking are subject to civil monetary penalties of up to $1 million per violation, and healthcare providers will be subject to appropriate disincentives by a referred agency. While the prohibition of information blocking could improve interoperability, the specific actions that constitute information blocking remain vague. However, on January 18, 2018, ONC announced at the Health IT Advisory Committee meeting that it plans to release a proposed rule this spring that implements health IT provisions of the Cures Act,⁶ so there should be more detail as to the specifics of interoperability and information blocking soon.

In addition, enhancements to the certification program of health IT will require additional standards and implementation specifications to be met. These include requirements that the health IT developer does not prohibit or restrict communication about its usability, interoperability, and security, as well as additional certification requirements that would require health IT to undergo “real-world” interoperability testing. This could lead to significant improvements in interoperability. It is anticipated that these changes will also be included in the proposed rule that will be released this spring.

To facilitate health information exchange, DHHS will develop a trusted exchange framework for health data and common agreement across health information networks nationally. The draft guidance was released on January 5, 2018. ONC has stated that the Trusted Exchange Framework’s minimum set of policies, procedures, and technical standards is intended to advance interoperability and enable use of health information networks to support many use cases, including individual access. It proposes principles and minimum terms and conditions for health information exchange networks to achieve a “single on-ramp” and reduce the need for multiple point-to-point interfaces.

Although the Cures Act states that federal agencies may require that health information exchange networks adopt the framework, it is important to note that this is being established as a voluntary program, and that at this time the proposed terms and conditions and use cases go beyond any health information exchange network that currently exists. Most health information exchange networks share information for treatment; however, the proposed use cases include bulk transfer or population-level queries, and disclosures for payment, healthcare operations, research, public health, and benefits determinations. The goal is improved nationwide health information exchange and improved patient access to their health information. The concern is whether this voluntary program will support this goal, or whether the significant number of requirements will limit participation due to the need for changes to business and technological practices or the potential that healthcare providers will drop out of health information exchange organizations. Specifically, healthcare providers have a legal and ethical obligation to make decisions about the sharing of data, including verifying the identity and authority of the requestor and releasing only the minimum necessary data for such purpose. If there is a pull of data without mechanisms for providers to make such determinations to meet their HIPAA obligations or their patients’ expectations about the privacy of their personal health information, they may find it easier to limit their involvement in broad data sharing. ONC will need to consider this as it looks to finalize this policy.

CONCLUSION

The Cures Act attempts to move the country towards a fully interoperable nationwide health information exchange system. This legislation has the potential to bring many benefits to patients, but lacks the details that will be worked out by DHHS through guidance and regulation. Moreover, the extent to which Congress or DHHS can encourage interoperability and health information exchange is limited by the incentives and disincentives for stakeholders to participate in full exchange and the business drivers that government cannot easily impact. Additionally, with proposed budget cuts to the ONC of $22 million for Fiscal Year 2019, there are significant questions about whether the agency could fulfill the requirements of the 21st Century Cures Act.

We are at a critical juncture. DHHS is mandated to implement the Cures Act, but whether implementation will effectively achieve its goals is uncertain. DHHS will look closely at public input and recommendations, which allow interested stakeholders to engage in the policy development process and guide implementation of the Cures Act. Researchers, clinicians, and patients are regarded as stakeholders in its implementation, and there are still opportunities to advocate for a future in which patients have full access to their electronic health information. The question is whether these changes will succeed, or whether Congress or healthcare leaders will have to do more to support patient access and interoperability.

Funding

This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

Contributors

Carolyn Lye wrote the first draft of the manuscript. Carolyn Lye, Howard Forman, Jodi Daniel, and Harlan Krumholz interpreted the information on which the content is based, revised the work with regard to important intellectual content, approved the final version for submission, and agree to be accountable for all aspects of the work. Howard Forman and Harlan Krumholz provided supervision.

Conflict of interest

Dr Krumholz is a recipient of research grants, through Yale, from Medtronic and from Johnson & Johnson (Janssen) to develop methods of clinical trial data sharing and from Medtronic and the US Food and Drug Administration to develop methods for post-market surveillance of medical devices; works under contract with the Centers for Medicare & Medicaid Services to develop and maintain performance measures that are publicly reported; chairs a Cardiac Scientific Advisory Board for UnitedHealth; is a participant/participant representative of the IBM Watson Health Life Sciences Board; is a member of the Advisory Board for Element Science and the Physician Advisory Board for Aetna; and is the founder of Hugo, a personal health information platform. The other authors report no potential conflicts.