BY Phuong Nguyen, Esq. and Michael Alexander, Esq., Brown & Fortunato, P.C.
As patients in this day and age, we take for granted that medical providers and facilities use some form of electronic medical record and offer an internet portal from which we, as patients, may access our health information, communicate with our health care providers, schedule appointments, and pay bills. With the prevalent use of electronic medical records and medical information flowing into patient portals, the question arises from time to time whether a health care provider may delay the release of medical information (e.g., lab results) to the patient portal.
In addition to advancing medical research and medical cures, the 21st Century Cures Act (the Cures Act) also contained provisions that addressed the operation and use of electronic medical record systems, including provisions addressing “information blocking.” The Cures Act defined information blocking as a practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. Through a series of rulemakings, the Office of the National Coordinator for Health Information Technology (ONC) within the Department of Health and Human Services, has promulgated federal regulations implementing the information blocking prohibitions of the Cures Act. Under federal regulations (the Final Rule), three categories of “actors” are subject to the information blocking rules: health care providers, health information networks (or health information exchanges), and health IT developers of certified health IT. The Final Rule contains different provisions depending on the actor involved. This article focuses on health care providers.
The term “health care provider” includes a broad array of health care providers and entities, such as hospitals, nursing facilities, physicians, ambulatory surgical centers, pharmacies, labs, and others. Under the Final Rule, information blocking by a health care provider is:
- A practice that is likely to interfere with access, exchange, for use of electronic health information; and
- The health care provider knows that such practice is unreasonable and is likely to interfere with access, exchange, or use of electronic health information.
The information blocking prohibition applies to electronic health information (EHI), which has the same meaning as electronic protected health information under HIPAA. EHI excludes psychotherapy notes and information compiled in reasonable anticipation of or use in litigation or an administrative proceeding.
In public comments to the Final Rule, the concern was raised whether a health care provider may delay the release of medical information, such as lab results, to a patient’s electronic health information portal until the health care provider has had an opportunity to review the results or communicate the results to the patient. Commentators suggested an exception to the prohibition on information blocking to allow for time-delayed lab results when consistent with a health care provider’s policy. A similar concern was raised that releasing sensitive test results or diagnoses (e.g., genetic test results indicating a high risk of developing an incurable neurodegenerative disease) through a patient portal without allowing the treating clinician the opportunity to first communicate the result or diagnosis would pose a risk of substantial harm to patients. In both cases, the ONC declined to allow an exception to information blocking for routine time-delay of lab test results. This was further echoed in a Frequently Asked Questions (FAQ), which can be found on the ONC’s website, healthit.gov., that states, in part:
It would likely be considered an interference for purposes of information blocking if a health care provider established an organizational policy that, for example, imposed delays on the release of lab results for any period of time in order to allow an ordering clinician to review the results or in order to personally inform the patient of the results before a patient can electronically access such results (see also 85 FR 25842 specifying that such a practice does not qualify for the “Preventing Harm” Exception).
To further illustrate, it also would likely be considered an interference:
- where a delay in providing access, exchange, or use occurs after a patient logs in to a patient portal to access EHI that a health care provider has (including, for example, lab results) and such EHI is not available—for any period of time—through the portal.
- where a delay occurs in providing a patient’s EHI via an API to an app that the patient has authorized to receive their EHI.
As the FAQ points out, the Final Rule contains exceptions to information blocking, including an exception for reducing risk of harm to a patient. The preventing harm exception requires a reasonable belief that the practice will substantially reduce harm to the patient that is the subject of the EHI or another natural person, and the practice must be no broader than necessary. The type of risk must be determined on an individualized basis in the exercise of professional judgement or arise from data that is erroneous. The type of harm must be one that could serve as grounds to deny access under HIPAA. And the practice being implemented must be consistent with the health care provider’s organizational policy.
The ONC explained in comments to the Final Rule that delaying lab results could fit the reducing-harm exception on a case-by-case basis where “a licensed health care professional has made an individualized determination of risk in the exercise of professional judgment.” Absent such individualized determination of risk, it appears that the ONC could view any routine delay of lab results as “interference” and, thus, a violation of information blocking Final Rule. Health care providers should carefully review the information blocking rule and its exceptions prior to withholding or delaying a test result from being sent to a patient’s portal account.