The roll out of the Office of the National Coordinator’s (ONC) 21^st Century Cures Act Interoperability and Information Blocking Rules is reminiscent of the way HIPAA has rolled out over the course of the past 25 years. As of May 1, 2021, Actors have been required to comply with the Information Blocking rules. However, it will take some time before all Actors know who they are and for complaints of Information Blocking to be determined to be actual instances of Information Blocking, by which time the penalties that have not yet been finalized may also need to be adjusted.

While ONC defined Actors as health care providers, health IT developers of certified health IT and health information exchanges or networks in the Final Rule and published guidance on their website, there is still uncertainty as to whom the Information Blocking Rules apply. The confusion may emanate from the lack of familiarity some health care providers and health IT developers have as never having been regulated or overseen by the ONC. There also appears to be overlap between what the ONC Information Blocking Rules protect against and what and how the Office for Civil Rights protects under the HIPAA Privacy Rule. Furthermore, providers and payers are typically regulated and overseen by CMS, however, CMS has not addressed any of the potential “dis-incentives” that providers would be subject to for Information Blocking violations and payers have never been required to use certified electronic health records. 

It is understandable that the Information Blocking prohibitions would apply to a health IT developer that develops or offers health information technology that is certified under the ONC Certification Program. In the Rules, ONC clarified that the Information Blocking prohibitions apply to a health IT developer as long as the developer has one or more health IT Modules certified under the ONC Health IT Certification Program at the time it engages in a practice that is the subject of an information blocking claim. However, ONC carved out an exception for health care providers that have developed their own health IT for its own use.

When ONC defined health care provider based on the definition provided under the Public Health Services Act (42 U.S.C. 300jj) (“PHSA definition”) it included a significant number of providers that were never before regulated by the ONC. Many of the types of health care providers that were swept into the definition of Actor and subject to the Information Blocking provisions were not included in the incentive programs that made funding available for the purchase of certified electronic health records (e.g., ambulatory surgical centers, long-term care facilities and therapists), there aren’t quality payment incentive programs for them to participate in and some don’t use certified EHRs. Health care providers should be aware that in addition to the guidance ONC published clarifying that Information Blocking applies to any health care provider that meet the definition under the PHSA regardless of whether any of the health IT the provider uses is certified under the ONC Health IT Certification Program, the “catch-all” clause at the end of the PHSA definition allows any other category of health care facility, entity, practitioner, or clinician determined appropriate by the HHS Secretary to be swept into the definition of Actor.

In the Final Rule, ONC combined two categories of Actors, health information exchange and health information networks and adopted one functional definition for both. A health information network or exchange refers to an entity that connects and exercises control over the technologies and services that enable the exchange of information between and among more than two other unaffiliated entities for treatment, payment or health care operations. Considering all the health IT developers, cloud service providers and data aggregators that are offering services to support Interoperability and communication to support health e-commerce, including care and benefit coordination, patient engagement and advancing social determinants of health to achieve care equality, there are a myriad of entities that are connecting multiple provider and/or payer organizations to coordinate the care or benefits of patients. These entities could unwittingly be performing the functions described in the definition of health information exchange or network without even knowing that they are considered Actors under the Information Blocking Rules.