What a Month!

For the past two weeks I, and many others, have been reviewing and preparing presentations on the finalized and long (very long) awaited CMS and ONC interoperability regulations. For the past two weeks I, and millions of others, have also been dealing with the existential and practical implications of the COVID-19 pandemic. What a month, and it is not over.

I’ve been planning on blogging on these rules for months and here we are. I’m glad that I have waited a couple of weeks to write this, to be able to reflect on what I have read and learned from colleagues.

So first, on March 9, both ONC and CMS released (but have not yet formally published in the Federal Register) these two major regulations. This blog will focus on the ONC rule.

I’m obsessed with the need for better and more nuanced health policy making. And with this rule from ONC and several actions by HHS in response to the pandemic, we see excellent examples of how to do policy better.

For COVID-19, I’ll point to some of the rapid and powerful HHS actions on telehealth. At Secretary Azar’s direction, CMS has relaxed long standing payment restrictions, allowing more clinicians to provide telehealth services to more patients. And powerfully, the HHS Office of Civil Rights (OCR) announced enforcement discretion for HIPAA privacy and security constraints on telehealth services, such as remote audio or video services for patients.

I ‘ve seen firsthand how rapidly these simple changes have transformed care delivery. For example, my wife, a clinical psychologist, is now providing remote psychotherapy from our home, increasing the safety of her patients, her colleagues, and herself. The OCR announcement was last Tuesday, she and her department chair made the decision the next day, and she “saw” her first remote patients Friday. Fast!

This kind of change is the classic pareto opportunity, grasping the small lever (the 20%) that moves the world 80% of where it needs to go. It is a simple policy change that can be rapidly understood and acted on by health care organizations and administrators, by clinicians, and by patients, with no need for webinars, seminars, lawyers, consultants, or expensive new technology. Facetime and Zoom, along with laptops, tablets and smart phones, are more than up to the task.

Now, to the ONC final rule. First, ONC emphasizes its continuing commitment to the goals of this rule:

It has been three years since the Cures Act was enacted and information blocking remains a serious concern. This final rule includes provisions that will address information blocking and cannot be further delayed.

We have taken multiple actions to address some expressed concerns regarding the timing of the Conditions and Maintenance of Certification requirements as well as the comprehensiveness of the information blocking proposals.

We continue to receive complaints and reports alleging information blocking from a wide range of stakeholders.

Second, ONC made many changes in response to comments. As someone who helped develop several comments that they received, I was struck by the degree to which the ONC rule writers called out comments with a high level of completeness and specificity, responded thoughtfully and in detail, and made important changes reflecting the central themes of these comments. Overall, my senses is that ONC, from its most senior levels on down, took very seriously the need to address comments and to reduce identified challenges and burdens; certainly not to zero but still, to a significant degree.

What were some of the major changes and their implications?

• ONC pushed out some compliance deadlines:
  
  • Compliance for information blocking provisions is now 6 months after Final Rule publication and only after a companion rule on civil monetary penalty (CMP) enforcement is finalized by the HHS Office of the Inspector General (OIG);
  • Most Conditions of Certification take effect six months after publication; and
  • EHR export capability is moved out to 36 months after publication.
• ONC simplified the definition of the interoperability elements that are the subject of potential information blocking.
• ONC made a small revision to the definition of developer of certified health IT, excluding providers who self-develop for their own use from being defined as a developer for purposes of information blocking enforcement.
• Notably, ONC combined and narrowed the HIE and HIN actor categories, creating one category and clarifying that the definition does not unintentionally cover “essentially bilateral exchanges” in which an intermediary is performing a service on behalf of one entity in providing EHI to one or more entities and no “actual exchange” among all entities; it notes that this narrower definition should “clearly exclude entities that might have been included under proposed definitions (e.g., social networks, ISPs, and technology that solely facilitates exchange of information among patients and family members) and in public discussion, excludes traditional claims clearinghouses functions.
• ONC substantially narrowed the definition of Electronic Health Information (EHII), defined it as the finalized US Core Data for Interoperability (USCDI) v. 1 data elements for the first 24 months after rule publication and then as electric Protected Health Information (HIPAA ePHI) in a (HIPAA) Designated Record Set.
• ONC retained the general definition of information blocking practices and did not change the many examples of such practices from the proposed rule, while adding some additional focused examples, responding to comments.
• ONC finalized the USCDI largely as proposed, with a few revisions and an implementation period for certification of 24 months after rule publication.
• ONC simplified the definitions of EHI access, exchange, and use, while retaining the intent from the proposed rule (e.g., “write” access remains part of “use” even if it is not part of the finalized API certification criteria).
• ONC significantly revised the “reasonable and necessary exceptions”:
  
  • Revising titles and simplifying and clarifying text;
  • Establishing a new Content and Manner exception that draws from or refines aspects of the Infeasibility, Fee, and Licensing exceptions, with a provision that fees and licensing terms mutually agreed to when an actor handles a request for EHI in the “manner requested” can reflect “market rates” and need not use or meet the Fee or Licensing exceptions (this latter change is huge and responds to many comments on the complexity and burden of the proposed fee and licensing exceptions); and
  • Removing the confusing RAND licensing model in the Licensing exception.
• For health IT certification, ONC made several final policy decisions:
  
  • Maintained use of the 2015 edition ONC certification criteria, with limited modifications;
  • Eliminated several criteria, mostly as had been proposed, because they are already well implemented in EHRs or included in the new USCDI;
  • Revised several referenced standards (e.g., specifying use of HL7® FHIR® 4.01)
  • Revised the API certification criteria; and
  • Specified that timing for some Conditions of Certification is 60 days after publication, with most at 6 months after publication

So, what should “actors” be doing as we wait for the Final Rule to be published (which could be delayed as the Administration grapples with the COVID-19 pandemic) and the various implementation periods to be completed? And, we need to consider the challenges being wrought by the pandemic, especially on provider organizations but truly, across our nation. The answer can be found by reflecting on Congress’s reasons for enacting the Cures provisions, by ONC’s intent and priority regulatory themes, and by common sense.

First, organizations that are actors or exchange data with actors, or who want to do so, should move now to set implementation and compliance plans in motion and to designate executive sponsorship for their information blocking and API efforts. Again, reality intrudes and the pandemic must be the highest priority but this rule is unlikely to go away and its focus on increased data access could help in combatting COVID-19.

Second, actors should focus sequentially and seriously on the big questions raised by the information blocking and API provisions:

• Is my organization an actor or even multiple actors?
• What interoperability elements and types of EHI do we control?
• How are these elements deployed to support current or likely requests for access, exchange or use?
• What activities do we engage in that could be considered information blocking practices?
• What exceptions will apply or be needed?
• How do we handle client and stakeholder requests for access, exchange, and use and to what extent can we reach mutually agreeable resolution of any issues, now?
• How can my organization benefit from increased data liquidity and what are the ways the I can better meet the needs of my key stakeholders who seek such liquidity?
• How can I assess and ensure that our policies for data access, exchange, and use are perceived as fair, non-discriminatory, and consistent with the spirit (and the letter) of the final policy and the eight exceptions?

You now know what ONC and the broader community are looking for. You can also expect, given the profound changes to our world from COVID-19 (and advocate for) enforcement focused on the most egregious violations. Yes, detailed compliance will matter, but for now, simply try to do, and prepare to do, the right thing. That approach will lead to satisfied stakeholders, lower compliance costs, and a more proportional response to these rules considering the massive challenges that our providers and nation are facing.

Be well.

Mark Segal, PhD, FHIMSS, Principal, Digital Health Policy Advisors, LLC. Member and Past Chair of the eHI Policy Steering Committee. March 23, 2020. Twitter @msegal111

eHI thinks Mark Segal is a super cool guy and is providing his opinions for informational purposes only. The opinions presented, do not represent those of eHealth Initiative, our members or the Foundation.