The U.S. Department of Health and Human Services (HHS) has finalized two transformative rules that will give patients unprecedented safe, secure access to their health data. Interoperability has been pursued by multiple administrations and numerous laws, and now, these rules finally deliver on giving patients true access to their healthcare data to make informed healthcare decisions and better manage their care. Putting patients in charge of their health records is a key piece of giving patients more control in healthcare, and patient control is at the center of the Trump administration’s work toward a value-based healthcare system.

The two rules, issued by the HHS Office of the National Coordinator for Health Information Technology (ONC) and Centers for Medicare & Medicaid Services (CMS), implement interoperability and patient access provisions of the bipartisan 21st Century Cures Act (Cures Act) and support President Trump’s MyHealthEData initiative. MyHealthEData is designed to empower patients around a common aim - giving every American access to their medical information so they can make better healthcare decisions.

Together, these final rules mark the most extensive healthcare data sharing policies the federal government has implemented, requiring both public and private entities to share health information between patients and other parties while keeping that information private and secure, a top priority for the Administration. 

“President Trump is delivering on his vision for healthcare that is affordable, personalized, and puts patients in control. From the start of our efforts to put patients and value at the center of our healthcare system, we’ve been clear: Patients should have control of their records, period. Now that’s becoming a reality,” said HHS Secretary Alex M. Azar. “These rules are the start of a new chapter in how patients experience American healthcare, opening up countless new opportunities for them to improve their own health, find the providers that meet their needs, and drive quality through greater coordination.”

“Delivering interoperability actually gives patients the ability to manage their healthcare the same way they manage their finances, travel and every other component of their lives. This requires using modern computing standards and APIs that give patients access to their health information and give them the ability to use the tools they want to shop for and coordinate their own care on their smartphones,” said Don Rucker, M.D., national coordinator for health information technology. “A core part of the rule is patients’ control of their electronic health information which will drive a growing patient-facing healthcare IT economy, and allow apps to provide patient-specific price and product transparency.”

“The days of patients being kept in the dark are over,” said CMS Administrator Seema Verma. “In today’s digital age, our health system’s data sharing capacity shouldn’t be mired in the stone age. Unfortunately, data silos continue to fragment care, burden patients, and providers, and drive up costs through repeat tests. Thanks to the leadership of President Trump, these rules begin a new chapter by requiring insurance plans to share health data with their patients in a format suitable for their phones or other device of their choice. We are holding payers to a higher standard while protecting patient privacy through secure access to their health information. Patients can expect improved quality and better outcomes at a lower cost.”

These final rules deliver on the Administration’s promise to put patients at the center of their care by promoting patient access and use of their own health information and spurring the use of and development of new smartphone applications.

Addressing Interoperability and Information Blocking

The ONC Final Rule identifies and finalizes the reasonable and necessary activities that do not constitute information blocking while establishing new rules to prevent “information blocking” practices (e.g., anti-competitive behaviors) by healthcare providers, developers of certified health IT, health information exchanges, and health information networks as required by the Cures Act.

Currently, many EHR contracts contain provisions that either prevent or are perceived to prevent users from sharing information related to the EHRs in use, such as screen shots or video. The ONC final rule updates certification requirements for health IT developers and establishes new provisions to ensure that providers using certified health IT have the ability to communicate about health IT usability, user experience, interoperability, and security including (with limitations) screenshots and video, which are critical forms of visual communication for such issues.

The ONC final rule also requires electronic health records to provide the clinical data necessary, including core data classes and elements, to promote new business models of care. This rule advances common data through the U.S. Core Data for Interoperability (USCDI).  The USCDI is a standardized set of health data classes and data elements that are essential for nationwide, interoperable health information exchange. The USCDI includes “clinical notes,” allergies, and medications among other important clinical data, to help improve the flow of electronic health information and ensure that the information can be effectively understood when it is received. It also includes essential demographic data to support patient matching across care settings.

Unleashing Innovation & Patient Access

ONC’s final rule establishes secure, standards-based application programming interface (API) requirements to support a patient’s access and control of their electronic health information. APIs are the foundation of smartphone applications (apps). As a result of this rule, patients will be able to securely and easily obtain and use their electronic health information from their provider’s medical record for free, using the smartphone app of their choice.

Building on the foundation established by ONC’s final rule, the CMS Interoperability and Patient Access final rule requires health plans in Medicare Advantage, Medicaid, CHIP, and through the federal Exchanges to share claims data electronically with patients. CMS took the first step towards interoperability by launching Medicare Blue Button 2.0 for Medicare beneficiaries in 2018. Medicare Blue Button 2.0 gives beneficiaries the ability to securely connect their Medicare Part A, Part B and Part D claims and encounter data to apps and other tools developed by innovators. Engagement and partnership with the technology community has involved more than 2,770 developers from over 1,100 organizations working in the Medicare Blue Button 2.0 sandbox to develop innovative apps to benefit Medicare patients. Currently, 55 organizations have applications in production. Beginning January 1, 2021, Medicare Advantage, Medicaid, CHIP, and, for plan years beginning on or after January 1, 2021, plans on the federal Exchanges will be required to share claims and other health information with patients in a safe, secure, understandable, user-friendly electronic format through the Patient Access API. With more complete data in their hands, patients can be more informed decision makers leading to better informed treatment.

This Patient Access API will allow patients to access their data through any third party application they choose to connect to the API and could also be used to integrate a health plan’s information to a patient’s electronic health record (EHR). By requiring their relevant health information including their claims to be shared with them, patients can take this information with them as they move from plan to plan, and provider to provider throughout the healthcare system.

To further advance the mission of fostering innovation, the CMS final rule establishes a new Condition of Participation (CoP) for all Medicare and Medicaid participating hospitals, requiring them to send electronic notifications to another healthcare facility or community provider or practitioner when a patient is admitted, discharged, or transferred. These notifications can facilitate better care coordination and improve patient outcomes by allowing a receiving provider, facility, or practitioner to reach out to the patient and deliver appropriate follow-up care in a timely manner. Additionally, CMS is requiring states to send enrollee data daily beginning April 1, 2022 for beneficiaries enrolled in both Medicare and Medicaid, improving the coordination of care for this population. This ensures beneficiaries are getting access to appropriate services and that these services are billed appropriately the first time, eliminating waste and burden. Beneficiaries will get the right services at the right time at the right cost, with no administrative burden to rebill services.

For more information on the ONC final rule, please visit: https://healthit.gov/curesrule.

For more information on the CMS final rule, please visit: https://www.cms.gov/newsroom/fact-sheets/interoperability-and-patient-access-fact-sheet.

To view the CMS final rule, please visit: https://www.cms.gov/Regulations-and-Guidance/Guidance/Interoperability/index.

To view the ONC final rule, please visit: https://healthit.gov/curesrule.