ONC’s Cures Act Final Rule
March 2020 marked the release of the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule by the Department of Health and Human Services (HHS). This has been a five-year process and a promise for improvement and progress in the United States health care system.
In December 2016, the Office of the National Coordinator for Health IT (ONC’s) Cures Act was signed into law by Congress and has been under revision so that the newly issued Final Rule supports modern-day technology. The Cures Act is designed to accelerate medical product development, information innovation and advancements in access to patient information. A goal of the Cures Act is to establish the means by which the market takes the lead and drives development – to not wait on legislation and regulations in order to make improvements.
Responding to public comments and identifying reasonable and necessary updates, the ONC made revisions from the original Cures Act to areas such as standards, certifications, electronic prescriptions, and security. It also defined the timeline required for Health IT to be compliant with current legislation (6 months) and to fully comply with the Cures Act Final Rule specifications (24 months).
Section IV of the Cures Act Final Rule focuses on the delivery of information. One of the ONC’s purposes is to place patients at the center of their own care with access to data, improved care, and promoting competition. The Final Rule addresses obstacles with industry-wide information blocking practices by allowing for means of safe and secure access to a patient’s own Electronic Health Information (EHI, also referred to as an “ePHI” [electronically protected health information.]) In section 4004, the ONC specifically addresses eight common-sense exceptions to stated information blocking provisions, providing that the practices are reasonable and necessary. Interoperability – the sharing of information across computer/software systems – is a stated aim of the Cures Act Final Rule.
“Summary of Care Security Tags” are updated and defined – both for sending and receiving information. “Granular privacy marking capabilities” were preserved so that in supporting multiple-service care, such as in behavioral health settings, information can be shared in an easily integrated manner. By establishing application programming interfaces (APIs - i.e. smartphone apps) to access sensitive health information, a patient is given greater control and coordination of their own health care by having access to their personal health records. In addition, facilities and caregivers using certified APIs can readily share patient information while adhering to HIPAA regulations. The creation of APIs broadens accessibility to information for patients at no extra cost – and opens the market for competition and, therefore, continual improvements.
The publicly displayed version of the Final Rule is not a final version, the document posted online may vary slightly from the published document is minor editorial changes have been made during the Office of Federal Register (OFR) review process. To find more information on the Cures Act Final Rule, to download the Rule, and to view fact sheets, please visit here.