November 2, 2020 is the deadline by when certain provisions of the 21st Century Cures Act implementing regulations come into effect. A helpful graphic describing deadlines is here. While the regulatory requirements are heavy with technical language and require the attention of specialists, as a general matter, November 2 is the date by which health care providers must take substantial steps to promote interoperability and cease information blocking with regard to electronic health records. This will include establishing the framework to allow a health care provider’s internal electronic health records software to communicate and coordinate with third party software through tools called application programming interfaces. It will also include granting patient access to a specific set of data points known as the U.S. Core Data for Interoperability, which includes, among many other pieces of information, clinical notes.
Information blocking, as defined in the regulations for health care providers, prohibits practices that a health care provider knows are unreasonable and are likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. Similar to the safe harbors available under the Anti-Kickback Statute, the information blocking prohibition has eight exceptions for what the National Coordinator for Health Information Technology (“ONC”) considers reasonable and necessary activities. To meet an exception, the health care provider must at all relevant times meet all of the exception’s conditions. The eight exceptions relate to (1) preventing harm; (2) privacy; (3) security; (4) infeasibility; (5) health information technology performance; (6) content and manner; (7) fees; and (8) licensing. A description of each exception, along with objectives and conditions, is available here.
Health care providers who commit information blocking will be subject to appropriate disincentives by governing agencies under applicable federal law. The ONC has stated that there is a 3-month enforcement discretion period after the November 2, 2020 deadline, to allow health care providers to focus on other priorities during the COVID-19 pandemic. Further, enforcement of information blocking civil monetary penalties will not begin until the OIG has had the opportunity for notice and comment rulemaking on what may constitute appropriate disincentives (e.g., fines up to $1,000,000). An ONC resource describing enforcement discretion is here.
Given the broad scope and technical nature of the changes coming in the next three years’ of deadlines, it is important for health care providers to establish a cross-functional, interdisciplinary project team to prepare and implement a project plan that details each step, technical and otherwise, toward achieving timely compliance. In addition to IT professionals, this team will benefit from the participation of health information management, information security, privacy, legal, compliance, management, and perhaps other professionals. This becomes clear upon the initial review of the ONC’s 320-page Final Rule, which is available here.
 While there are other compliance obligations for different types of entities, such as health IT developers, this article focuses solely on health care providers. The 21st Century Cures Act and its regulations define the term “health care provider” to include:
“. . . a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center . . . renal dialysis facility, blood center, ambulatory surgical center . . . emergency medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician [MD, DO, DDS, DMD, DPM, OD, DC], a practitioner [PA, NP, CRNA, clinical nurse specialist, certified nurse-midwife, clinical social worker, clinical psychologist, registered dietitian, and nutrition professional], a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe . . . tribal organization, or urban Indian organization . . . a rural health clinic, a covered entity under section 256b of this title, an ambulatory surgical center [listed twice] . . . a therapist . . . and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary.”
42 U.S.C. § 300jj; see also 45 C.F.R. § 171.102.