U.S. Federal Rule Mandates Open Notes

The Cures Rule and Information Blocking guidelines apply to:

• health care providers
• health information networks and exchanges
• health IT developers of certified health IT (e.g. electronic health record vendors)

For more details about each of these groups, review this document from the Office of the National Coordinator for Health IT (ONC) (PDF). If you or your job is listed in this document, the Cures Rule applies to you.

As of April 2021, providers must release information covered in USCDI Version 1 if they have the technical capability to do so. By December 31, 2022, all Certified Health Information Technology (i.e., EHR vendors) must have the new HL7 FHIR API capability and make information in USCDI Version 1 available to their customers.

If providers do not have the technical capability to make information outlined in the USCDI Version 1 available, they can claim an exception to the Cures Rule. An example exception may be that it is technically infeasible to release such information because the provider does not use an electronic health record system (e.g., instead they use paper records).

Starting on October 6, 2022, the definition of electronic health information (EHI) in the 21st Century Cures Act will expand beyond the United States Core Data for Interoperability (USCDI) Version 1 to all electronic Protected Health Information (ePHI) that a patient has the right to access under the Health Insurance Portability and Accountability Act (HIPAA).

Background: In the HIPAA Privacy Rule, protected health information (PHI) is considered any identifiable health information used, maintained, stored, or transmitted by a covered entity.

A covered entity health care provider is one that bills an insurance company for services provided to any patient. Covered entities include health plans and healthcare clearinghouses. Note: The Information Blocking Rule also applies to some organizations that are NOT covered entities; however, it is not applicable to all covered entities

Starting on October 6, 2022, instead of being limited to the USCDI Version 1, the definition of EHI will now include all information in a Designated Record Set, as defined under HIPAA.

In other words, EHI will not be limited to the specific data classes listed in the USCDI and will also consist of medical and payment records about a patient and any information of a type that may be used to make decisions about individuals, including patients. For actors covered by the information blocking rules, all ePHI in a Designated Record Set is considered to be EHI and subject to those rules.

EHI could include:

• Medical records and billing records about individuals maintained by or for a covered healthcare provider;
• Enrollment, payment, claims adjudication, and case or medical management record systems; or
• Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals.

Understanding the scope of Electronic Health Information (EHI) for the Purposes of the Information Blocking Definition

More information about about EHI and ePHI can be found at HealthIT.gov, and downloaded as PDFs:

• Understanding Electronic Health Information (EHI) [PDF]
• Understanding the scope of Electronic Health Information for the purposes of the Information Blocking Definition [PDF]

There are complex situations in which information can be blocked—and these are called Exceptions. Unless one of the Exceptions applies, clinical notes must not be blocked.

For complete details, refer to the HealthIT.gov Information Blocking FAQ.

Summary of the Exceptions

A group called actors are referred to throughout the rule. Actors include:

• Health care providers (including physicians, physician assistants, nurse practitioners, nurses, social workers, chaplains, and therapists)
• Health information networks or health information exchanges
• Health IT developers of certified health IT (e.g., electronic health record vendors)

Featured below are Exceptions outlined by the final rule. The Exceptions fall into two categories (source).

Category 1. Exceptions that involve not fulfilling requests to access, exchange, or use electronic health information (EHI)

• Preventing Harm Exception: It will not be information blocking for an actor to engage in practices that are reasonable and necessary to prevent harm to a patient or another person, provided certain conditions are met.
• Privacy Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI in order to protect an individual’s privacy, provided certain conditions are met.
• Security Exception: It will not be information blocking for an actor to interfere with the access, exchange, or use of EHI in order to protect the security of EHI, provided certain conditions are met.
• Infeasibility Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI due to the infeasibility of the request, provided certain conditions are met.
• Health IT Performance Exception: It will not be information blocking for an actor to take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT's performance for the benefit of the overall performance of the health IT, provided certain conditions are met.

Category 2. Exceptions that involve procedures for fulfilling requests to access, exchange, or use EHI

• Content and Manner Exception: It will not be information blocking for an actor to limit the content of its response to a request to access, exchange, or use EHI or the manner in which it fulfills a request to access, exchange, or use EHI, provided certain conditions are met.
• Fees Exception: It will not be information blocking for an actor to charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using EHI, provided certain conditions are met
• Licensing Exception: It will not be information blocking for an actor to license interoperability elements for EHI to be accessed, exchanged, or used, provided certain conditions are met.
• Details regarding conditions that must be met to meet these exceptions can be found on the ONC website.

The eight (8) note types specified in USCDI Version 1 apply only until October 2022, after which the expanded definition of electronic health information includes all note types.

For information on note-types that must be shared after October 2022, see section above: How is the definition of “Information Blocking” changing in 2022?

Note types that must be shared between April 2021-October 2022

The eight (8) types of clinical notes that must be shared are outlined in the United States Core Data for Interoperability (USCDI), and include:

• consultation notes
• discharge summary notes
• history & physical
• imaging narratives
• laboratory report narratives
• pathology report narratives
• procedure notes
• progress notes

View the full USCDI.

There are a few types of clinical notes to which the rules do not apply. Examples include:

1. Psychotherapy notes that are separated from the rest of the individual’s medical record. These notes must be recorded (in any medium) by a mental health professional documenting or analyzing the contents of conversation during a private , group, joint, or family counseling session. Note: All behavioral health are required to share their notes regarding medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
2. Information compiled in reasonable anticipation of, or use in a civil, criminal or administrative action or proceeding.

Under the Cures Rule, in certain specified situations information can be blocked (or “hidden”) from patient access on online portals—these are called Exceptions. As examples, clinicians can block information:

• If they believe a patient will harm another person or themselves as a result of reading the information
• If they need to protect the security of another person’s electronic health information (e.g., a mother’s health information in a child’s record)

Unless one of the Exceptions applies, clinical notes must not be blocked. Details about exceptions are outlined at HealthIT.gov.

Learn more about how the Cures Rule applies to open notes.

In several studies of how open notes affect the way doctors prepare notes, the majority report they don’t change the way they write their notes. But many clinicians experienced in sharing notes report their writing does change over time, feeling overall that it becomes more valuable, certainly to patients.

Few report “dumbing down” their language, but they find themselves using fewer abbreviations and trying to avoid language that could appear judgmental to patients. Some report modulating their practice such that they become “teaching notes.”

In general, patients do not expect doctors to write notes in layperson language, and more than 90% in one large study report understanding their notes well. Patients not bothered by terms they don’t understand, and they are happy to research terms. They feel reading notes helps them prepare more focused questions for clinicians. Overall, they express considerable enthusiasm for having a window into more information about their health.

Resources:

• Klein J, Jackson S, Bell S, et. al. Your Patient Is Now Reading Your Note: Opportunities, Problems, and Prospects. Am J Med. Doi: DOI
• Tip Sheet: Suggestions for implementing open notes in clinical practice, OpenNotes.org
• How to write an open note for patients, CT Lin, MD
• Watch: How to Write an Open Note webinar, January 29, 2021
• DesRoches CM, Leveille S, Bell SK, et al. The Views and Experiences of Clinicians Sharing Medical Record Notes With Patients. JAMA Netw Open. 2020;3(3):e201753. doi:10.1001/jamanetworkopen.2020.1753

The 21st Century Cures Act was signed into law by President Obama in 2016 with overwhelmingly bipartisan support. Information sharing is central to the Cures Act Final Rule released by the Office of the National Coordinator for Health Information Technology (ONC) in 2022.

Some refer to this as the “information sharing rule.” It mandates that patients have rapid, free and full access upon request to test results, medication lists, referral information, and clinical notes, all in electronic formats.

Some refer to the Cures Act Final Rule as the “Open Notes Rule.” This is inaccurate. Although ONC strongly supports the concept of ‘open notes’ and work by the OpenNotes movement headquartered at Beth Israel Deaconess Medical Center, the Cures Act Final Rule and ‘open notes’ are not synonymous. The Rule extends well beyond clinical notes.

See the ONC’s relevant FAQ about clinical notes.