When physicians at Nemours Children’s Health System were informed about the information blocking rule,[1] which took effect April 5, there was some grumbling. They worried about a potential minefield, with patients seeing their test results on the portal before speaking to the physician, jumping to conclusions about the implications and flooding physicians with calls.
It’s a recurring theme with the information blocking rule, as hospitals have braced for the fallout of patients having unfettered, real-time access to their medical information.
“What’s been interesting is I’m not getting feedback that that has happened,” said Chief Compliance Officer Anna Small. She’s hoping it’s because “we’ve done a good job of educating patients.” There’s also a banner at the top of the results page in the portal that tells patients they may be seeing results before or at the same time as the ordering physician and to follow up if they have questions.
So far, so good on that score, because patients have yet to hit the panic button, hospital officials and attorneys said. But there have been other challenges and unintended consequences with the information blocking rule, which interprets a provision of the 21st Century Cures Act that prohibits practices likely to interfere with the access, exchange or use of electronic health information (EHI) unless they fall into one of eight exceptions (e.g., the release would cause patient harm). The rule on information blocking and interoperability, which was published by the HHS Office of the National Coordinator for Health Information Technology (ONC) in the May 1, 2020, Federal Register,[2] requires providers to embrace a new way of thinking about access to information, said attorney Gina Bertolini, with K&L Gates in North Carolina. “It is much less paternalistic or protective of the patient,” she said. “While they still need to comply with HIPAA, they don’t need to protect patients from themselves.” A primary focus of the rule is ensuring providers and other “actors”—including developers of health information technology—“aren’t impeding the free flow of information to innovative formats of the patient’s choice, like mobile apps and personal health records,” Bertolini said.
One thing that’s crystal clear, despite a lot of discussion and some resistance: As soon as test results or other clinical information is finalized in the electronic health records, providers must make them available to patients at their request—even if the information is sensitive and the physician hasn’t had a chance to speak to the patient, Bertolini said. “A delay may be considered information blocking depending on the facts and circumstances” unless it’s required by state law or fits into an exception (e.g., for patient harm or privacy), she said. “With regard to the patient harm exception, ONC has made abundantly clear that a delay to the patient based on a concern that the patient will suffer emotional or psychological harm does not meet the harm threshold and would not justify a delay.” The anticipation that patients might panic when they see test results on the portal is not a reason to delay putting them there, until the physician can get them on the phone first, Bertolini said, unless state law requires physician communication before releasing the results or the patient has asked for a delay.
‘It’s an Ongoing and Continuous Medical Request’
For Nemours, the releases will be automatic if patients use the portal. “The way we have interpreted it is, if patients and families request access to our patient portal, it’s an ongoing and continuous medical record request,” Small said. For example, as soon as test results are finalized on EPIC, they’re released to the portal and app. The operative word is complete, Bertolini added. Some diagnostic tests, such as CT scans and MRIs, require a narrative as part of the final results, “so if you have one without the other, it’s not complete and release likely would not be clinically appropriate. The information blocking rule doesn’t require release of records that are incomplete or inaccurate. But categorical delays won’t fly.”
To be clear, ONC is not forcing providers to dump data on a portal, Bertolini said. “What the information blocking rule says is you can’t interfere with use or access.” As ONC explains in answers to frequently asked questions,[3] “There is no requirement under the information blocking regulations to proactively make available any EHI to patients or others who have not requested the EHI.” Hospitals and physicians are already putting some information on portals as required by their participation in the Promoting Interoperability Program (formerly known as the EHR incentive payment program), and ONC’s new HIT standards, finalized concurrently with the information blocking rule, change some of the technical standards applicable to Promoting Interoperability Programs providers.
Bertolini reminds providers enrolled in the Promoting Interoperability Program to follow the information blocking rule for any patient information they push to the portal. Among other things, that means complying with ONC’s technical specifications. Until January 2023, for data available on the portal, they have the choice of using the common clinical data set (CCDS) or the United States Core Data for Interoperability (USCDI), which includes clinical notes. USCDI will be required by January of 2023. “While there are a few differences between CCDS and USCDI, the primary difference is the addition of clinical notes as a data class,” she said.
Deciding When to Use Patient Harm Exception
Like other hospitals, Nemours is leaving it to physicians to determine when to delay EHI release because it may cause patient harm, Small said. But during 10-minute information blocking education sessions, physicians and other clinicians were given examples of when the use of the patient harm and other exceptions would be appropriate. In terms of patient harm, if the physician suspected child abuse or Munchausen’s syndrome by proxy, they could hold back imaging or other diagnostic test results from the portal until the child is safe, Small said.
How do physicians indicate they’re restricting a note in the virtual chart (e.g., MyChart)? SSM Health in Louisville has a “share with patient” button that’s automatically highlighted, said Ann Cappellari, M.D., chief medical information officer. “They have the option to click on that, which unhighlights it and then it isn’t shared,” she said at a Health Care Compliance Association regional conference in St. Louis Feb. 26.[4] “When they do that, they must comply with one of the eight exceptions.” There’s space for the physician to explain why the note was not shared with the patient or proxy (e.g., “reasonable likelihood of causing physical harm” or “minor may independently consent to service and requests block”).
SSM Health runs a report on the number of notes blocked by provider and department. “We only look at the higher percentages blocked,” Cappellari said. “We understand some blocking happens, but we will loop back with the providers and department leaders if a high percentage is blocked” and there will be some counseling.
Give the Patients a Heads-Up
Hospitals continue to work their way through the kinds of challenges that arise when regulations don’t anticipate every real-world scenario. For example, without context, a radiology report may scare patients unnecessarily, Small said. It may say “cannot rule out neoplasia,” which could panic the patient even though the ordering physician already ruled it out because of the clinical presentation. Should the radiologists modify the reports? Nemours decided against it and will rely on the banner in the portal reminding patients they may be seeing results before the physician, Small said. “We also encouraged providers who order imaging to do preventive education.” They may order a combination of tests and perhaps schedule a follow-up appointment with the patient to discuss all the results.
Broward Health in Florida has the same concerns about the timing of results and its impact on patients, said Mary Hummel, director of information technology and cyber security. The results of a prostate-specific antigen screening might be put on the portal, causing the patient to think he has cancer before the physician has a chance to put them in perspective. “We have to make sure the timing the reports get released to the patient align with the regulations, but also have the doctor communicate with the patient,” she said. “It’s finding that balancing point.”
Physicians Raise ‘Really Good Issues’
To develop a “complex implementation plan” for the information blocking rule, Nemours, which is in Delaware, New Jersey, Pennsylvania and Florida, had a steering committee with compliance and legal as executive sponsors and additional representation from clinical, operations, information technology and other departments, Small said. She and three other members of the steering committee did 10-minute PowerPoint presentations for physicians at every division and department meeting (and many other forms of education for employees, including computer-based modules and emails). “They raised some really good issues,” Small said. For example, should postmortem testing be immediately posted to the portal? “It could be extremely upsetting,” she noted. Nemours is a children’s hospital, and the families could have access to the results on the portal. The hospital decided to delay releasing them under the privacy exception to the rule.
Also, the emergency department (ED) physicians pointed out the side effects of releasing results to the portal in real-time (with a few exceptions, such as test results for sexually transmitted diseases when patients are minors, because parents have access to their children’s portals). “ED providers are not used to being the source of follow-up. They order tests, and when the results are available, patients are told by the portal to follow up with the ordering provider. They really ought to be following up” with their primary care physician, Small said. “This is relatively easy to fix with appropriate communication in person when the tests are ordered, and then with correction of the language on the portal about follow-up.”
With the app, patients start asking questions in person before physicians have reviewed the results. That’s the case with all providers, “but it seems particularly relevant in the ED. In the old world, the ED provider had the time to get the results and review them and formulate their thoughts, assessment and plan before discussing it with the patient, who had not yet seen the results. It is just a shift in how we communicate, and we all have to get used to the new flow,” she said.
Sometimes health systems interpret the information blocking rules differently. For example, some physicians who practice at Nemours also have privileges elsewhere, and they’ve told her the other hospital holds back test results for several days, and they want to know if they can do the same at Nemours. The answer is no. “You need to push it out immediately,” she said. “Nemours’ outside counsel clarified it for us,” and she’s looking forward to additional guidance from ONC and eventually enforcement actions on this and other “unintended consequences.” For providers that information block, Congress requires “appropriate disincentives,” but no enforcement rule has been published yet.
‘We Block Everything’ Independently Consentable
Compliance officers may be familiar with clinical requests for exceptions from having to release all their clinical information. “We got requests from every department about why they should be carved out,” Cappellari said. There were various reasons, often based on the emotional component of clinical care. “I don’t take that lightly in any manner. The patient-provider relationship is as important as any drug we prescribe or scan we order,” she said. “It’s been a difficulty.” Pediatrics and behavioral health were the categories with the most concern.
SSM Health doesn’t allow patients 17 and under to have their own patient portals. “We allow parents to proxy,” she said. They see everything that comes across MyChart. That posed a problem because adolescents can independently consent to certain services, such as birth control, pregnancy services and some behavioral health care. “We went through a whole host of what we can and cannot do,” Cappellari said. “At this point, we block things that go to the proxy. We block anything we consider independently consentable.”
While it has been addressing information blocking, Broward Health also enhanced its portal for users to speak to a telehealth representative, track their medication and schedule an appointment. “It has been a really good strategy that has grown out of this and the pandemic,” Hummel said.
Broward Health also tweaked its notice of privacy practices in response to the information blocking rule to let patients know “there may be times when we may not be able to share your information with you,” said Leslie Hernandez, director of privacy and data. In explaining why the health system may deny patients access to their records, Broward Health cites some of the exceptions to the prohibition on information blocking. For example:
-
“To protect your privacy, especially if you have requested a restriction or confidential communication; or”
-
“When a licensed health care professional determines your request would cause harm; or”
-
“Fulfilling the request is not feasible due to a public health emergency, an uncontrollable event such as an act of terrorism or internet service disruption; or”
-
“Our electronic medical records system is taken offline for maintenance or upgrades which would benefit Broward Health.”[5]
Contact Small at anna.small@nemours.org, Bertolini at gina.bertolini@klgates.com, Hummel at mhummel@browardhealth.org, Hernandez at lrhernandez@browardhealth.org and Cappellari at ann.cappellari@ssmhealth.com.
