The federal rule on “Interoperability and Information Blocking” mandates U.S. healthcare providers give patients access to all the health information in their electronic medical records “without delay” and without charge.
As of April 5, 2021, the federal rule on Interoperability, Information Blocking, and ONC Health IT Certification—which implemented the 21st Century Cures Act—went into effect. Known as the “Cures Rule,” this national policy requires healthcare providers give patients access to all of the health information in their electronic medical records “without delay” and without charge.
Important changes to the Information Blocking Rule in 2022
October 2022 – Starting on October 6, 2022, the definition of electronic health information (EHI) in the 21st Century Cures Act will expand beyond the United States Core Data for Interoperability (USCDI) Version 1 to include all electronic Protected Health Information (ePHI) that the patient has the right to access under the Health Insurance Portability and Accountability Act (HIPAA). In the HIPAA Privacy Rule, patients have the right to access all identifiable health information about them that is in the medical record, or might be stored in other records, and is the type of information used to make decisions about patients.
For patients and consumers
As of April 2021, “blocking” patients from their own health records is against the law and may result in fines for hospitals and doctors. Find out how the Information Blocking Rule and Cures Act impacts patients at WhereIsMyMedicalRecord.org.
OpenNotes monitors details affecting the implementation of the 21st Century Cures Act Information Blocking Rule and updates this web page on occasion.
March 1, 2023
21st Century Cures Act Information Blocking rule: Common questions
Who does this rule apply to?
The Cures Rule and Information Blocking guidelines apply to:
- health care providers
- health information networks and exchanges
- health IT developers of certified health IT (e.g. electronic health record vendors)
For more details about each of these groups, review this document from the Office of the National Coordinator for Health IT (ONC) (PDF). If you or your job is listed in this document, the Cures Rule applies to you.
What is the timeline for when these rules go into effect?
As of April 2021, providers must release information covered in USCDI Version 1 if they have the technical capability to do so. By December 31, 2022, all Certified Health Information Technology (i.e., EHR vendors) must have the new HL7 FHIR API capability and make information in USCDI Version 1 available to their customers.
If providers do not have the technical capability to make information outlined in the USCDI Version 1 available, they can claim an exception to the Cures Rule. An example exception may be that it is technically infeasible to release such information because the provider does not use an electronic health record system (e.g., instead they use paper records).
How is the definition of “Information Blocking” changing in 2022?
Starting on October 6, 2022, the definition of electronic health information (EHI) in the 21st Century Cures Act will expand beyond the United States Core Data for Interoperability (USCDI) Version 1 to all electronic Protected Health Information (ePHI) that a patient has the right to access under the Health Insurance Portability and Accountability Act (HIPAA).
Background: In the HIPAA Privacy Rule, protected health information (PHI) is considered any identifiable health information used, maintained, stored, or transmitted by a covered entity.
A covered entity health care provider is one that bills an insurance company for services provided to any patient. Covered entities include health plans and healthcare clearinghouses. Note: The Information Blocking Rule also applies to some organizations that are NOT covered entities; however, it is not applicable to all covered entities
Starting on October 6, 2022, instead of being limited to the USCDI Version 1, the definition of EHI will now include all information in a Designated Record Set, as defined under HIPAA.
In other words, EHI will not be limited to the specific data classes listed in the USCDI and will also consist of medical and payment records about a patient and any information of a type that may be used to make decisions about individuals, including patients. For actors covered by the information blocking rules, all ePHI in a Designated Record Set is considered to be EHI and subject to those rules.
EHI could include:
- Medical records and billing records about individuals maintained by or for a covered healthcare provider;
- Enrollment, payment, claims adjudication, and case or medical management record systems; or
- Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals.
More information about about EHI and ePHI can be found at HealthIT.gov, and downloaded as PDFs:
Are there any exceptions to the Rules?
There are complex situations in which information can be blocked—and these are called Exceptions. Unless one of the Exceptions applies, clinical notes must not be blocked.
For complete details, refer to the HealthIT.gov Information Blocking FAQ.
Summary of the Exceptions
A group called actors are referred to throughout the rule. Actors include:
- Health care providers (including physicians, physician assistants, nurse practitioners, nurses, social workers, chaplains, and therapists)
- Health information networks or health information exchanges
- Health IT developers of certified health IT (e.g., electronic health record vendors)
Featured below are Exceptions outlined by the final rule. The Exceptions fall into two categories (source).
Category 1. Exceptions that involve not fulfilling requests to access, exchange, or use electronic health information (EHI)
- Preventing Harm Exception: It will not be information blocking for an actor to engage in practices that are reasonable and necessary to prevent harm to a patient or another person, provided certain conditions are met.
- Privacy Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI in order to protect an individual’s privacy, provided certain conditions are met.
- Security Exception: It will not be information blocking for an actor to interfere with the access, exchange, or use of EHI in order to protect the security of EHI, provided certain conditions are met.
- Infeasibility Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI due to the infeasibility of the request, provided certain conditions are met.
- Health IT Performance Exception: It will not be information blocking for an actor to take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT's performance for the benefit of the overall performance of the health IT, provided certain conditions are met.
Category 2. Exceptions that involve procedures for fulfilling requests to access, exchange, or use EHI
- Content and Manner Exception: It will not be information blocking for an actor to limit the content of its response to a request to access, exchange, or use EHI or the manner in which it fulfills a request to access, exchange, or use EHI, provided certain conditions are met.
- Fees Exception: It will not be information blocking for an actor to charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using EHI, provided certain conditions are met
- Licensing Exception: It will not be information blocking for an actor to license interoperability elements for EHI to be accessed, exchanged, or used, provided certain conditions are met.
- Details regarding conditions that must be met to meet these exceptions can be found on the ONC website.
What notes must be shared with patients?
The eight (8) note types specified in USCDI Version 1 apply only until October 2022, after which the expanded definition of electronic health information includes all note types.
For information on note-types that must be shared after October 2022, see section above: How is the definition of “Information Blocking” changing in 2022?
Note types that must be shared between April 2021-October 2022
The eight (8) types of clinical notes that must be shared are outlined in the United States Core Data for Interoperability (USCDI), and include:
- consultation notes
- discharge summary notes
- history & physical
- imaging narratives
- laboratory report narratives
- pathology report narratives
- procedure notes
- progress notes
There are a few types of clinical notes to which the rules do not apply. Examples include:
- Psychotherapy notes that are separated from the rest of the individual’s medical record. These notes must be recorded (in any medium) by a mental health professional documenting or analyzing the contents of conversation during a private , group, joint, or family counseling session. Note: All behavioral health are required to share their notes regarding medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
- Information compiled in reasonable anticipation of, or use in a civil, criminal or administrative action or proceeding.
Are clinicians allowed to hide specific notes from patients, and how might they do it?
Under the Cures Rule, in certain specified situations information can be blocked (or “hidden”) from patient access on online portals—these are called Exceptions. As examples, clinicians can block information:
- If they believe a patient will harm another person or themselves as a result of reading the information
- If they need to protect the security of another person’s electronic health information (e.g., a mother’s health information in a child’s record)
Unless one of the Exceptions applies, clinical notes must not be blocked. Details about exceptions are outlined at HealthIT.gov.
Learn more about how the Cures Rule applies to open notes.
How might clinicians change the way they document patient notes as a result of the Information Blocking rule??
In several studies of how open notes affect the way doctors prepare notes, the majority report they don’t change the way they write their notes. But many clinicians experienced in sharing notes report their writing does change over time, feeling overall that it becomes more valuable, certainly to patients.
Few report “dumbing down” their language, but they find themselves using fewer abbreviations and trying to avoid language that could appear judgmental to patients. Some report modulating their practice such that they become “teaching notes.”
In general, patients do not expect doctors to write notes in layperson language, and more than 90% in one large study report understanding their notes well. Patients not bothered by terms they don’t understand, and they are happy to research terms. They feel reading notes helps them prepare more focused questions for clinicians. Overall, they express considerable enthusiasm for having a window into more information about their health.
- Klein J, Jackson S, Bell S, et. al. Your Patient Is Now Reading Your Note: Opportunities, Problems, and Prospects. Am J Med. Doi: DOI
- Tip Sheet: Suggestions for implementing open notes in clinical practice, OpenNotes.org
- How to write an open note for patients, CT Lin, MD
- Watch: How to Write an Open Note webinar, January 29, 2021
- DesRoches CM, Leveille S, Bell SK, et al. The Views and Experiences of Clinicians Sharing Medical Record Notes With Patients. JAMA Netw Open. 2020;3(3):e201753. doi:10.1001/jamanetworkopen.2020.1753
What is the difference between the Cures Act Information Blocking rule and OpenNotes?
The 21st Century Cures Act was signed into law by President Obama in 2016 with overwhelmingly bipartisan support. Information sharing is central to the Cures Act Final Rule released by the Office of the National Coordinator for Health Information Technology (ONC) in 2022.
Some refer to this as the “information sharing rule.” It mandates that patients have rapid, free and full access upon request to test results, medication lists, referral information, and clinical notes, all in electronic formats.
Some refer to the Cures Act Final Rule as the “Open Notes Rule.” This is inaccurate. Although ONC strongly supports the concept of ‘open notes’ and work by the OpenNotes movement headquartered at Beth Israel Deaconess Medical Center, the Cures Act Final Rule and ‘open notes’ are not synonymous. The Rule extends well beyond clinical notes.
Statements by OpenNotes
July 2022: Information Blocking Rule includes ePHI starting October 6, 2022
October 2020: Open notes compliance date extended to April 5, 2021
March 2020: OpenNotes Celebrates New Federal Rule on Transparency for Patients
For more information about the ONC Program Rule in its entirety, visit healthit.gov/curesrule
This web page hosted by OpenNotes is shared here for informational purposes only, and is not official technical or legal advice.
State laws around data release may not supersede the 21st Century Cures Act. The Cures Rule specifically states that information need not be released to patients if such release is prohibited by other laws. For example, the California Health and Safety Code limits the online release of the specified results related to HIV antibodies, hepatitis antigens, the “abusing the use of drugs,” and malignant pathology.
Healthcare providers should consult with their organization’s Health Information Management, compliance, legal, finance, and public affairs experts/teams to find out how it applies to them.