U.S. Federal Rule Mandates Open Notes

The Cures Act final rule and information-blocking guidelines apply to:

• health care providers
• health information networks and exchanges
• Information technology developers of certified health IT (e.g., electronic health record vendors)

For more details about each of these groups, review this document from the Office of the National Coordinator for Health Information Technology (ONC).  If you or your job is listed in this document, the Cures rule applies to you.

In June 2023, the Department of Health and Human Services Office of the Inspector General (OIG) posted its final rule implementing information-blocking penalties. The final rule established statutory penalties created by the 21st Century Cures Act.

These penalties apply to electronic health record vendors (EHRs), health information exchanges, and health information networks (HINs).

If OIG determines that individuals or entities have blocked information, they may be subject to a penalty of up to one million dollars per violation.

Only certain entities are subject to an OIG information-blocking penalty:

• health information developers of certified health IT
• entities offering certified health IT
• health information exchanges, and
• health information networks.

Learn more at OIG Information-Blocking Fast Facts.

All notes must be shared with patients. On October 6, 2022, the definition of electronic health information (EHI) in the 21st Century Cures Act expanded. It now encompasses not only the United States Core Data for Interoperability (USCDI) Version 1, but also all electronic protected health information (ePHI).

PHI encompasses any identifiable health information about a patient that is used, maintained, stored, or transmitted by a health care provider who bills an insurance company for services provided to any patient—also known as a covered entity. To be clear, patient access isn’t affected by whether the patient has insurance or not.

With this change to the interoperability and information blocking rule, EHI now extends to the designated record set (as defined by the Health Insurance Portability and Accountability Act), which includes both medical and payment records. This means the rule now applies to any information that could be used to make decisions about individuals, including patients. For entities subject to information-blocking rules, all ePHI within a designated record set will be treated as EHI and subject to the rules.

EHI could include:

• Medical records and billing records about individuals maintained by or for a covered health care provider
• Enrollment, payment, claims adjudication, and case or medical management record systems
• Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals

More information about EHI and ePHI can be found at HealthIT.gov.

Yes. There are complex situations in which information can be blocked—and these are called exceptions. Unless one of the exceptions applies, clinical notes must not be blocked.

For complete details, refer to the information-blocking FAQ on HealthIT.gov.

Summary of the Exceptions

The rule refers throughout to “actors.” They include:

• Health care providers (including physicians, physician assistants, nurse practitioners, nurses, social workers, chaplains, therapists, and many other roles directly involved in patient care)
• Health information networks or health information exchanges
• Health IT developers of certified health IT (e.g., electronic health record vendors)

We list below exceptions outlined by the final rule. These fall into two categories (source).

Category 1. Exceptions that involve not fulfilling requests to access, exchange, or use electronic health information (EHI):

• Preventing Harm Exception: If a patient makes the request for information, the provider must have a reasonable expectation that providing the information will result in physical harm to the life of the patient, clinician, or another person. If the legal representative of the patient requests the information, the clinician has to have a reasonable expectation that the release of information will result in harm to the patient, the clinician or another person.
• Privacy Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or uses EHI in order to protect an individual’s privacy, provided certain conditions are met.
• Security Exception: It will not be information blocking for an actor to interfere with the access, exchange, or use of EHI in order to protect the security of EHI, provided certain conditions are met.
• Infeasibility Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI due to the infeasibility of the request, provided certain conditions are met.
• Health IT Performance Exception: It will not be information blocking for an actor to take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT's performance for the benefit of the overall performance of the health IT, provided certain conditions are met.

Category 2. Exceptions that involve procedures for fulfilling requests to access, exchange, or use of EHI:

• Content and Manner Exception: It will not be information blocking for an actor to limit the content or fulfillment methods for accessing, exchanging, or using EHI, provided certain conditions are met.
• Fees Exception: It will not be information blocking for an actor to charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using EHI, provided certain conditions are met
• Licensing Exception: It will not be information blocking for an actor to license interoperability elements for EHI to be accessed, exchanged, or used, provided certain conditions are met.

Details regarding conditions that must be met to fulfill these exceptions can be found on the ONC website.

There are a few types of clinical notes to which the rules do not apply. Examples include:

1. Psychotherapy side notes or process recordings that are not intended to be a part of the individual’s medical/mental health record. These notes must be recorded (in any medium) by a mental health professional documenting or analyzing the contents of the conversation (transference/countertransference for instance) during a private, group, joint, or family counseling session. Note that all behavioral health care providers are required to share their notes regarding:

• medication prescription and monitoring
• counseling session start and stop times
• the modalities and frequencies of treatment furnished
• results of clinical tests
• any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date

2. Information compiled in reasonable anticipation of, or use in a civil, criminal, or administrative action or proceeding and not intended to be a part of the health record.

Under the Cures rule, in certain specified situations, you can block (or “hide”) information  from patient access on online portals. These are known as exceptions. For instance, you can block information in the following scenarios:

• If you believe a patient will harm another person or themselves as a result of reading the information
• If you need to protect the security of another person’s electronic health information (e.g., a mother’s health information in a child’s record; health information related to domestic violence concerns)

Unless one of the exceptions applies, clinical notes must not be blocked. Details about exceptions are outlined at HealthIT.gov.

So far, studies suggest that some clinicians are changing the way they write notes in response to open notes implementations, while some are not. However, many clinicians experienced in sharing notes have reported positive changes in the way they write their notes, commenting that that the notes have become more valuable overall, especially to patients.

Few report “dumbing down” their language. Instead, they find themselves using fewer abbreviations in their notes and trying to avoid language that could appear judgmental to patients. Some report modulating their approach so that their notes become “teaching notes.”

In general, patients do not expect clinicians to write notes in layperson language, and in one large study, more than 90% report understanding their notes well. Studies suggest that most patients are not bothered by terms they don’t understand; they are happy to research them. They feel reading notes helps them prepare more focused questions for clinicians. Overall, studies show repeatedly that patients are enthusiastic about having a window into more information about their health.

Resources:

The 21st Century Cures Act was signed into law by President Barack Obama in 2016 with overwhelmingly bipartisan support. Information sharing is central to the Cures Act. The Cures Act Final Rule—also known as the “information blocking rule,” which defines what and how information must be shared with patients—was released by the Office of the National Coordinator for Health Information Technology (ONC) in 2022.

Some refer to this as the “information sharing rule.” It mandates that patients have rapid, free, and full access upon request to test results, medication lists, referral information, and clinical notes, all in electronic formats.

Some refer to the Cures Act final rule as the “Open Notes Rule.” This is inaccurate. While ONC strongly supports the concept of open notes and the efforts of the OpenNotes movement based at Beth Israel Deaconess Medical Center, it's important to note that the Cures Act final rule and open notes are not synonymous. The final rule extends well beyond clinical notes.

See the ONC’s relevant FAQ about clinical notes.