What is the 21st Century Cures Act?

With increased patient access to health records, increased requests for changes might ensue.

Posted in Examiner eNewsletter on Monday, October 11, 2021

Cures Act Overview

The new federal rule decrees that all health care professionals, including chiropractors and naturopaths, must share eight types of notes and records with their patients if the patient requests it:

1. History and physical notes
2. Consultation notes
3. Procedure notes
4. Progress notes
5. Discharge summary notes
6. Imaging narratives
7. Laboratory report narratives
8. Pathology report narratives

These types of information must be made available electronically. For many practices, the easiest way to do this is to a new or existing EHR system. If your practice still relies solely on handwritten notes, these will need to be scanned and formatted as a secure PDF file.

The Blocking Rule

Under the Cures Act, information blocking is not allowed, whether it is against the patient or the health care professional. 

• Patient blocking: 
  • A provider not allowing the patient to access their records.
  • Not honoring a patient’s request to forward their information to another provider.
• Health care professional blocking:
  • They may be denied access to information from another provider.
  • They might be prohibited from linking their EHRs.

Appropriate Denials

Sometimes information may be legally denied if the request falls into one of eight exception types. You can find detailed information in the Cures Act Final Rules: Information Blocking Exceptions [PDF], but as an overview, they are:

1. Preventing Harm
2. Privacy
3. Security
4. Infeasibility
5. Health IT performance
6. Content & manner
7. Fees
8. Licensing

Make sure you establish a process for evaluating information requests and train staff members on it, including potential exceptions.

The Patient’s HIPAA Rights

Consider this scenario: A patient calls your practice and asks that information regarding a diagnosis be removed from her records. This request is not about demographic information, where changes are not an issue, but with a diagnosis resulting from a medical procedure. Should you comply?

HIPAA gives the patients (and sometimes their representatives) the right to access and amend their protected health information (PHI). It is important you are familiar with this right and how it should (or should not) be accomplished prior to receiving this kind of call.

With the 21st Century Cures Act and the provision for open notes, effective April 2021, it is more important than ever to be compliant with requests from patients reviewing their records. The Cures Act requires healthcare providers to improve how easily patients can access their health information.

As a result, patients may be reviewing the information in their records more often and more closely. Information which must be provided to patients (or their representative) includes consultation notes, procedure, discharge summaries, etc. Reviewing these notes may increase the chances of requests for amendments.

It is important for healthcare providers to comply with both HIPAA and the Cures Act. For a simple overview of both of these programs, visit: HealthIT Promote Patient Access

According to American Health Information Management Association:

Access to PHI must be granted within 30 days of the request. One 30-day extension is available. 

According to AHIMA, the patient must be advised of any extension, and that extension must be documented. If a patient is denied access, the 30/30 day rule/extension applies. There are exceptions to patient access, including:

• The information is in psychotherapy notes.
• The PHI was obtained from someone other than the healthcare professional under a promise of confidentiality; access to records would reveal the source.
• The PHI refers to another person who is not a healthcare provider and access is likely to cause harm to that other person.

The patient has a right to request an amendment to their records.

• The request should be in writing, dated and signed.
• The request should provide a reason to validate the amendment.
• The request should identify the requested change.
• The request should identify the relationship to the patient if the request is not being made by the patient (and proof provided if other than custodial parent).
• The request is subject to a 60-day turnaround with a 30-day extension.
  • The patient must be advised of the extension, the reason for the delay and the date the action will be finalized.

The response to the request may be a partial or full agreement to the amendment.

Which depends on the situation and should follow these steps:

• The response to the request should be on a form filed with the patient’s medical records.
• The response should be completed on or before the effective date.
• Within a reasonable time, the healthcare professional should provide a copy of the amended record to the individuals identified by the patient.

The healthcare professional can deny the request for various reasons.

These may include, but are not limited to:

• If the healthcare professional determines the PHI is accurate and complete.
• If the information was not created by the healthcare professional being asked to make the amendment, unless the originator of the information is no longer available to act on the request.
• If the information is not part of the patient’s medical or billing record.

If the request to amend is denied:

• The patient should be advised they have a right to submit a statement disagreeing with the denial. As always, stay away from medical jargon and use clear language when communicating with a patient.

State regulations may be relevant to access and amending medical records so it is always important to talk with your attorney.