consenttemporarilyunavailable

Page1of5Section4004ofthe21stCenturyCuresAct(CuresAct)definespracticesthatconstituteinformationblockingandauthorizestheSecretaryofHealthandHumanServices(HHS)toidentifyreasonableandnecessaryactivitiesthatdonotconstituteinformationblocking(referredtoas"exceptions").
INFORMATIONBLOCKINGOnbehalfofHHS,ONChasdefinedeightexceptionsthatofferactors(i.
e.
,healthcareproviders,healthITdevelopers,healthinformationnetworks(HINs)andhealthinformationexchanges(HIEs))certaintythat,whentheirpracticeswithrespecttoaccessing,exchanging,orusingelectronichealthinformation(EHI)meettheconditionsofoneormoreexceptions,suchpracticeswillnotbeconsideredinformationblocking.
Anactor'spracticethatdoesnotmeettheconditionsofanexceptionwillnotautomaticallyconstituteinformationblocking.
Insteadsuchpracticeswillbeevaluatedonacase-by-casebasistodeterminewhetherinformationblockinghasoccurred.
Wehavefinalizedeightexceptionsthataredividedintotwocategories:Exceptionsthatinvolvenotfulfillingrequeststoaccess,exchange,oruseEHI;andExceptionsthatinvolveproceduresforfulfillingrequeststoaccess,exchange,oruseEHI.
CURESACTFINALRULEInformationBlockingExceptionsExceptionsthatinvolvenotfulfillingrequeststoaccess,exchange,oruseEHIPreventingHarmExceptionItwillnotbeinformationblockingforanactortoengageinpracticesthatarereasonableandnecessarytopreventharmtoapatientoranotherperson,providedcertainconditionsaremet.
PreventingHarmExceptionExceptionsthatinvolvenotfulfillingrequeststoaccess,exchange,oruseEHIExceptionsthatinvolveproceduresforfulfillingrequeststoaccess,exchange,oruseEHIPrivacyExceptionSecurityExceptionInfeasibilityExceptionHealthITPerformanceExceptionContentandMannerExceptionFeesExceptionLicensingExceptionObjectiveoftheException:Thisexceptionrecognizesthatthepublicinterestinprotectingpatientsandotherpersonsagainstunreasonablerisksofharmcanjustifypracticesthatarelikelytointerferewithaccess,exchange,oruseofEHI.
KeyConditionsoftheExceptionTheactormustholdareasonablebeliefthatthepracticewillsubstantiallyreduceariskofharm;Theactor'spracticemustbenobroaderthannecessary;Theactor'spracticemustsatisfyatleastoneconditionfromeachofthefollowingcategories:typeofrisk,typeofharm,andimplementationbasis;andThepracticemustsatisfytheconditionconcerningapatientrighttorequestreviewofanindividualizeddeterminationofriskofharm.
Page2of5InformationBlockingExceptionsPrivacyExceptionItwillnotbeinformationblockingifanactordoesnotfulfillarequesttoaccess,exchange,oruseEHIinordertoprotectanindividual'sprivacy,providedcertainconditionsaremet.
SecurityExceptionItwillnotbeinformationblockingforanactortointerferewiththeaccess,exchange,oruseofEHIinordertoprotectthesecurityofEHI,providedcertainconditionsaremet.
ObjectiveoftheException:Thisexceptionrecognizesthatifanactorispermittedtoprovideaccess,exchange,oruseofEHIunderaprivacylaw,thentheactorshouldprovidethataccess,exchange,oruse.
However,anactorshouldnotberequiredtouseordiscloseEHIinawaythatisprohibitedunderstateorfederalprivacylaws.
KeyConditionsoftheExceptionTosatisfythisexception,anactor'sprivacy-protectivepracticemustmeetatleastoneofthefoursub-exceptions:1.
Preconditionnotsatisfied:Ifanactorisrequiredbyastateorfederallawtosatisfyaprecondition(suchasapatientconsentorauthorization)priortoprovidingaccess,exchange,oruseofEHI,theactormaychoosenottoprovideaccess,exchange,oruseofsuchEHIifthepreconditionhasnotbeensatisfiedundercertaincircumstances.
2.
HealthITdeveloperofcertifiedhealthITnotcoveredbyHIPAA:IfanactorisahealthITdeveloperofcertifiedhealthITthatisnotrequiredtocomplywiththeHIPAAPrivacyRule,theactormaychoosetointerferewiththeaccess,exchange,oruseofEHIforaprivacy-protectivepurposeifcertainconditionsaremet.
3.
Denialofanindividual'srequestfortheirEHIconsistentwith45CFR164.
524(a)(1)and(2):Anactorthatisacoveredentityorbusinessassociatemaydenyanindividual'srequestforaccesstohisorherEHIinthecircumstancesprovidedunder45CFR164.
524(a)(1)and(2)oftheHIPAAPrivacyRule.
4.
Respectinganindividual'srequestnottoshareinformation:Anactormaychoosenottoprovideaccess,exchange,oruseofanindividual'sEHIifdoingsofulfillsthewishesoftheindividual,providedcertainconditionsaremet.
ObjectiveoftheException:Thisexceptionisintendedtocoveralllegitimatesecuritypracticesbyactors,butdoesnotprescribeamaximumlevelofsecurityordictateaone-size-fits-allapproach.
KeyConditionsoftheExceptionThepracticemustbe:1.
Directlyrelatedtosafeguardingtheconfidentiality,integrity,andavailabilityofEHI;2.
Tailoredtospecificsecurityrisks;and3.
Implementedinaconsistentandnon-discriminatorymanner.
Thepracticemusteitherimplementaqualifyingorganizationalsecuritypolicyorimplementaqualifyingsecuritydetermination.
Page3of5InformationBlockingExceptionsInfeasibilityExceptionItwillnotbeinformationblockingifanactordoesnotfulfillarequesttoaccess,exchange,oruseEHIduetotheinfeasibilityoftherequest,providedcertainconditionsaremet.
ObjectiveoftheException:Thisexceptionrecognizesthatlegitimatepracticalchallengesmaylimitanactor'sabilitytocomplywithrequestsforaccess,exchange,oruseofEHI.
Anactormaynothave—andmaybeunabletoobtain—therequisitetechnologicalcapabilities,legalrights,orothermeansnecessarytoenableaccess,exchange,oruse.
KeyConditionsoftheExceptionThepracticemustmeetoneofthefollowingconditions:Uncontrollableevents:Theactorcannotfulfilltherequestforaccess,exchange,oruseofelectronichealthinformationduetoanaturalorhuman-madedisaster,publichealthemergency,publicsafetyincident,war,terroristattack,civilinsurrection,strikeorotherlaborunrest,telecommunicationorinternetserviceinterruption,oractofmilitary,civilorregulatoryauthority.
Segmentation:Theactorcannotfulfilltherequestforaccess,exchange,oruseofEHIbecausetheactorcannotunambiguouslysegmenttherequestedEHI.
Infeasibilityunderthecircumstances:Theactordemonstratesthroughacontemporaneouswrittenrecordorotherdocumentationitsconsistentandnon-discriminatoryconsiderationofcertainfactorsthatledtoitsdeterminationthatcomplyingwiththerequestwouldbeinfeasibleunderthecircumstances.
Theactormustprovideawrittenresponsetotherequestorwithin10businessdaysofreceiptoftherequestwiththereason(s)whytherequestisinfeasible.
HealthITPerformanceExceptionItwillnotbeinformationblockingforanactortotakereasonableandnecessarymeasurestomakehealthITtemporarilyunavailableortodegradethehealthIT'sperformanceforthebenefitoftheoverallperformanceofthehealthIT,providedcertainconditionsaremet.
ObjectiveoftheException:ThisexceptionrecognizesthatforhealthITtoperformproperlyandefficiently,itmustbemaintained,andinsomeinstancesimproved,whichmayrequirethathealthITbetakenofflinetemporarily.
ActorsshouldnotbedeterredfromtakingreasonableandnecessarymeasurestomakehealthITtemporarilyunavailableortodegradethehealthIT'sperformanceforthebenefitoftheoverallperformanceofhealthIT.
KeyConditionsoftheExceptionThepracticemust:1.
BeimplementedforaperiodoftimenolongerthannecessarytoachievethemaintenanceorimprovementsforwhichthehealthITwasmadeunavailableorthehealthIT'sperformancedegraded;2.
Beimplementedinaconsistentandnon-discriminatorymanner;and3.
MeetcertainrequirementsiftheunavailabilityordegradationisinitiatedbyahealthITdeveloperofcertifiedhealthIT,HIE,orHIN.
Anactormaytakeactionagainstathird-partyappthatisnegativelyimpactingthehealthIT'sperformance,providedthatthepracticeis:1.
Foraperiodoftimenolongerthannecessarytoresolveanynegativeimpacts;2.
Implementedinaconsistentandnon-discriminatorymanner;and3.
Consistentwithexistingservicelevelagreements,whereapplicable.
Iftheunavailabilityisinresponsetoariskofharmorsecurityrisk,theactormustonlycomplywiththePreventingHarmorSecurityException,asapplicable.
Page4of5InformationBlockingExceptionsContentandMannerExceptionItwillnotbeinformationblockingforanactortolimitthecontentofitsresponsetoarequesttoaccess,exchange,oruseEHIorthemannerinwhichitfulfillsarequesttoaccess,exchange,oruseEHI,providedcertainconditionsaremet.
Exceptionsthatinvolveproceduresforfulfillingrequeststoaccess,exchange,oruseEHIObjectiveoftheException:Thisexceptionprovidesclarityandflexibilitytoactorsconcerningtherequiredcontent(i.
e.
,scopeofEHI)ofanactor'sresponsetoarequesttoaccess,exchange,oruseEHIandthemannerinwhichtheactormayfulfilltherequest.
Thisexceptionsupportsinnovationandcompetitionbyallowingactorstofirstattempttoreachandmaintainmarketnegotiatedtermsfortheaccess,exchange,and,useofEHI.
KeyConditionsoftheExceptionContentCondition:Establishesthecontentanactormustprovideinresponsetoarequesttoaccess,exchange,oruseEHIinordertosatisfytheexception.
1.
Upto24monthsafterthepublicationdateoftheCuresActfinalrule,anactormustrespondtoarequesttoaccess,exchange,oruseEHIwith,ataminimum,theEHIidentifiedbythedataelementsrepresentedintheUnitedStatesCoreDataforInteroperability(USCDI)standard.
2.
Onandafter24monthsafterthepublicationdateoftheCuresActfinalrule,anactormustrespondtoarequesttoaccess,exchange,oruseEHIwithEHIasdefinedin§171.
102.
MannerCondition:Establishesthemannerinwhichanactormustfulfillarequesttoaccess,exchange,oruseEHIinordertosatisfythisexception.
Anactormayneedtofulfillarequestinanalternativemannerwhentheactoris:Technicallyunabletofulfilltherequestinanymannerrequested;orCannotreachagreeabletermswiththerequestortofulfilltherequest.
Ifanactorfulfillsarequestinanalternativemanner,suchfulfillmentmustcomplywiththeorderofprioritydescribedinthemannerconditionandmustsatisfytheFeesExceptionandLicensingException,asapplicable.
FeesExceptionItwillnotbeinformationblockingforanactortochargefees,includingfeesthatresultinareasonableprofitmargin,foraccessing,exchanging,orusingEHI,providedcertainconditionsaremet.
ObjectiveoftheException:Thisexceptionenablesactorstochargefeesrelatedtothedevelopmentoftechnologiesandprovisionofservicesthatenhanceinteroperability,whilenotprotectingrent-seeking,opportunisticfees,andexclusionarypracticesthatinterferewithaccess,exchange,oruseofEHI.
KeyConditionsoftheExceptionThepracticemust:Meetthebasisforfeescondition.
Forinstance,thefeesanactorchargesmust:Bebasedonobjectiveandverifiablecriteriathatareuniformlyappliedforallsimilarlysituatedclassesofpersonsorentitiesandrequests.
Bereasonablyrelatedtotheactor'scostsofprovidingthetypeofaccess,exchange,oruseofEHI.
Notbebasedonwhethertherequestororotherpersonisacompetitor,potentialcompetitor,orwillbeusingtheEHIinawaythatfacilitatescompetitionwiththeactor.
Notbespecificallyexcluded.
Forinstance,theexceptiondoesnotapplyto:Afeebasedinanypartontheelectronicaccessbyanindividual,theirpersonalrepresentative,oranotherpersonorentitydesignatedbytheindividualtoaccesstheindividual'sEHI.
AfeetoperformanexportofelectronichealthinformationviathecapabilityofhealthITcertifiedto§170.
315(b)(10).
ComplywithConditionsofCertificationin§170.
402(a)(4)(Assurances–certificationto"EHIExport"criterion)or§170.
404(API).
Page5of5@ONC_HealthITHealthIT.
gov/CuresRuleInformationBlockingExceptionsLicensingExceptionItwillnotbeinformationblockingforanactortolicenseinteroperabilityelementsforEHItobeaccessed,exchanged,orused,providedcertainconditionsaremet.
ObjectiveoftheException:Thisexceptionallowsactorstoprotectthevalueoftheirinnovationsandchargereasonableroyaltiesinordertoearnreturnsontheinvestmentstheyhavemadetodevelop,maintain,andupdatethoseinnovations.
KeyConditionsoftheExceptionThepracticemustmeet:Thenegotiatingalicenseconditions:Anactormustbeginlicensenegotiationswiththerequestorwithin10businessdaysfromreceiptoftherequestandnegotiatealicensewithin30businessdaysfromreceiptoftherequest.
Thelicensingconditions:ScopeofrightsReasonableroyaltyNon-discriminatorytermsCollateraltermsNon-disclosureagreementAdditionalconditionsrelatingtotheprovisionofinteroperabilityelements.