U.S. Federal Rule Mandates Open Notes

The federal rule on interoperability and information blocking mandates that healthcare providers offer patients access to all the health information in their medical records “without delay” and without charge.

November 2023 – ”Disincentive Penalties for Information-Blocking Providers” proposed by the Department of Health and Human Services (HHS). This proposed rule was posted to the Federal Register and is taking comments until 11:59 p.m. ET on January 2, 2024.

The rule will affect physicians who participate in the Medicare program.

What does this rule mean for patients and consumers?

As of April 2021, “blocking” patients from their own health records is against the law and may result in fines for hospitals and clinicians. Learn how the Cures Act and information-blocking rule affect patients at WhereIsMyMedicalRecord.org.

Who does this rule apply to?

The Cures Act final rule and information-blocking guidelines apply to:

• health care providers
• health information networks and exchanges
• Information technology developers of certified health IT (e.g., electronic health record vendors)

For more details about each of these groups, review this document from the Office of the National Coordinator for Health Information Technology (ONC). If you or your job is listed in this document, the Cures rule applies to you.

How might health information exchanges (HIEs) be penalized for blocking information?

In June 2023, the Department of Health and Human Services Office of the Inspector General (OIG) posted its final rule implementing information-blocking penalties. The final rule established statutory penalties created by the 21st Century Cures Act.

These penalties apply to electronic health record vendors (EHRs), health information exchanges, and health information networks (HINs).

If OIG determines that individuals or entities have blocked information, they may be subject to a penalty of up to one million dollars per violation.

Only certain entities are subject to an OIG information-blocking penalty:

• health information developers of certified health IT
• entities offering certified health IT
• health information exchanges, and
• health information networks.

What information must be shared with patients under the interoperability and information-blocking rule?

All notes must be shared with patients. On October 6, 2022, the definition of electronic health information (EHI) in the 21st Century Cures Act expanded. It now encompasses not only the United States Core Data for Interoperability (USCDI) Version 1, but also all electronic protected health information (ePHI).

PHI encompasses any identifiable health information about a patient that is used, maintained, stored, or transmitted by a health care provider who bills an insurance company for services provided to any patient—also known as a covered entity. To be clear, patient access isn’t affected by whether the patient has insurance or not.

With this change to the interoperability and information blocking rule, EHI now extends to the designated record set (as defined by the Health Insurance Portability and Accountability Act), which includes both medical and payment records. This means the rule now applies to any information that could be used to make decisions about individuals, including patients. For entities subject to information-blocking rules, all ePHI within a designated record set will be treated as EHI and subject to the rules.

EHI could include:

• Medical records and billing records about individuals maintained by or for a covered health care provider
• Enrollment, payment, claims adjudication, and case or medical management record systems
• Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals

More information about EHI and ePHI can be found at HealthIT.gov.

Are there any exceptions to the rule?

Yes. There are complex situations in which information can be blocked—and these are called exceptions. Unless one of the exceptions applies, clinical notes must not be blocked.

For complete details, refer to the information-blocking FAQ on HealthIT.gov.

Summary of the Exceptions

The rule refers throughout to “actors.” They include:

• Health care providers (including physicians, physician assistants, nurse practitioners, nurses, social workers, chaplains, therapists, and many other roles directly involved in patient care)
• Health information networks or health information exchanges
• Health IT developers of certified health IT (e.g., electronic health record vendors)

We list below exceptions outlined by the final rule. These fall into two categories (source).

Category 1. Exceptions that involve not fulfilling requests to access, exchange, or use electronic health information (EHI):

• Preventing Harm Exception: If a patient makes the request for information, the provider must have a reasonable expectation that providing the information will result in physical harm to the life of the patient, clinician, or another person. If the legal representative of the patient requests the information, the clinician has to have a reasonable expectation that the release of information will result in harm to the patient, the clinician or another person.
• Privacy Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or uses EHI in order to protect an individual’s privacy, provided certain conditions are met.
• Security Exception: It will not be information blocking for an actor to interfere with the access, exchange, or use of EHI in order to protect the security of EHI, provided certain conditions are met.
• Infeasibility Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI due to the infeasibility of the request, provided certain conditions are met.
• Health IT Performance Exception: It will not be information blocking for an actor to take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT's performance for the benefit of the overall performance of the health IT, provided certain conditions are met.

Category 2. Exceptions that involve procedures for fulfilling requests to access, exchange, or use of EHI:

• Content and Manner Exception: It will not be information blocking for an actor to limit the content or fulfillment methods for accessing, exchanging, or using EHI, provided certain conditions are met.
• Fees Exception: It will not be information blocking for an actor to charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using EHI, provided certain conditions are met
• Licensing Exception: It will not be information blocking for an actor to license interoperability elements for EHI to be accessed, exchanged, or used, provided certain conditions are met.

Details regarding conditions that must be met to fulfill these exceptions can be found on the ONC website.

Are there any other exceptions regarding clinical notes?

There are a few types of clinical notes to which the rules do not apply. Examples include:

1. Psychotherapy side notes or process recordings that are not intended to be a part of the individual’s medical/mental health record. These notes must be recorded (in any medium) by a mental health professional documenting or analyzing the contents of the conversation (transference/countertransference for instance) during a private, group, joint, or family counseling session. Note that all behavioral health care providers are required to share their notes regarding:

• medication prescription and monitoring
• counseling session start and stop times
• the modalities and frequencies of treatment furnished
• results of clinical tests
• any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date

1. Information compiled in reasonable anticipation of, or use in a civil, criminal, or administrative action or proceeding and not intended to be a part of the health record.

Am I allowed to hide specific notes from patients, and how can I do it?

Under the Cures rule, in certain specified situations, you can block (or “hide”) information from patient access on online portals. These are known as exceptions. For instance, you can block information in the following scenarios:

• If you believe a patient will harm another person or themselves as a result of reading the information
• If you need to protect the security of another person’s electronic health information (e.g., a mother’s health information in a child’s record; health information related to domestic violence concerns)

Unless one of the exceptions applies, clinical notes must not be blocked. Details about exceptions are outlined at HealthIT.gov.

How might I change the way I document patient notes as a result of the information-blocking rule?

So far, studies suggest that some clinicians are changing the way they write notes in response to open notes implementations, while some are not. However, many clinicians experienced in sharing notes have reported positive changes in the way they write their notes, commenting that that the notes have become more valuable overall, especially to patients.

Few report “dumbing down” their language. Instead, they find themselves using fewer abbreviations in their notes and trying to avoid language that could appear judgmental to patients. Some report modulating their approach so that their notes become “teaching notes.”

In general, patients do not expect clinicians to write notes in layperson language, and in one large study, more than 90% report understanding their notes well. Studies suggest that most patients are not bothered by terms they don’t understand; they are happy to research them. They feel reading notes helps them prepare more focused questions for clinicians. Overall, studies show repeatedly that patients are enthusiastic about having a window into more information about their health.

Resources:

What is the difference between the Cures Act information-blocking rule and OpenNotes?

The 21st Century Cures Act was signed into law by President Barack Obama in 2016 with overwhelmingly bipartisan support. Information sharing is central to the Cures Act. The Cures Act Final Rule—also known as the “information blocking rule,” which defines what and how information must be shared with patients—was released by the Office of the National Coordinator for Health Information Technology (ONC) in 2022.

Some refer to this as the “information sharing rule.” It mandates that patients have rapid, free, and full access upon request to test results, medication lists, referral information, and clinical notes, all in electronic formats.

Some refer to the Cures Act final rule as the “Open Notes Rule.” This is inaccurate. While ONC strongly supports the concept of open notes and the efforts of the OpenNotes movement based at Beth Israel Deaconess Medical Center, it's important to note that the Cures Act final rule and open notes are not synonymous. The final rule extends well beyond clinical notes.