Eight exceptions of information blocking rule:
The first five exceptions involve not fulfilling requests to access, exchange, or use EHI. The final three exceptions involve procedures for fulfilling requests to access, exchange, or use EHI.
- Preventing Harm
According to ONC, this exception “recognizes that the public interest in protecting patients and other persons against unreasonable risks of harm can justify practices that are likely to interfere with access, exchange, or use of EHI.” In short, organizations can deny EHI requests to protect patients and other consumers from harm. However, the potential risk and harm that would trigger the exception must be appropriately documented.
Is the responding organization able to segment sensitive records, such as those pertaining to behavioral health or substance abuse, for adults who have requested their information that providers believe may harm the patient or family member? Is the organization able to segment sensitive health records of minors, as protected by state and federal regulations, so parents do not have access to information they are not authorized to receive?
The information blocking provisions compels healthcare organizations to broaden EHI access to consumers, but it does not render existing federal and state privacy laws obsolete. Under this exception, organizations would not be required to disclose EHI in a way that is prohibited under applicable laws.
This exception covers risks to the integrity and security of the information and EHI systems. However, this exception is not to be used as a broad brush for request denials. To trigger this exception, healthcare organizations need to demonstrate that the denial is “directly related to safeguarding the confidentiality, integrity, and availability of EHI; tailored to specific security risks; and implemented in a consistent and non-discriminatory manner.” Provider organizations should update relevant privacy and security policies or implement new policies to mitigate practices that prohibit or delay data sharing.
This exception speaks to the reasonability to fulfilling requests. ONC defines several instances where practical fulfilment of EHI requests is severely limited, such as natural or man-made disasters, public health emergencies, technological limitations, or the inability to “unambiguously” segment requested EHI.
- Health IT performance
This exception acknowledges that health IT may be temporarily offline for maintenance, improvements, or a cause beyond the control of the healthcare organization. With the exception, ONC makes clear that EHI requests do not take precedence over health IT performance. Organizations should review historical information or scanned records that are not immediately being shared to include legacy systems. Is the organization able to meet the requirement for making the information available?
- Content and manner
This exception provides clarity and flexibility to organizations concerning the scope of a request to access, exchange, or use EHI. For the next 24 months, the data requests that fall under the information blocking final rule include those identified by the data elements represented in the United States Core Data for Interoperability (USCDI) standard.
This exception also supports innovation and competition by allowing actors to first attempt to reach and maintain market negotiated terms for the access, exchange, and use of EHI. Is your organization able to fulfill requests according to the USCDI definition and scale to meet expanded elements after the 24-month period? Are you technically able to provide the information and reach agreeable terms with the patient?
The Cures Act final rule carved out an exception to permit healthcare organizations to charge fees for record requests to assist in the development of technologies and provision of services that enhance interoperability. However, fees must be based on objective and verifiable criteria and be reasonably related to the costs of access to or exchange or use of EHI.
This exception protects the investments organization make in innovation by permitting them to charge “reasonable royalties” to develop, maintain, and update those innovations. According to ONC, “an actor must begin license negotiations with the requestor within 10 business days from receipt of the request and negotiate a license within 30 business days from receipt of the request.”