What information is a US healthcare provider required to provide access to under the 21st Century Cures Act?

Question

In the United States, in response to the 21st Century Cures Act, the Department of Health and Human Services has developed regulations that prohibit "information blocking".

This publication from the American Medical Association notes:

Information blocking practices can be ... essentially anything that interferes with the access, exchange, or use of [electronic health information].

The same publication notes the following example as a possible violation of the rules:

A physician has the capability to provide same-day [electronic health information] access in a format requested by an unaffiliated provider—or by their patient—but takes several days to respond.

This suggests that all US healthcare providers are required to provide patients immediate access to their electronic health information. The Office of the National Coordinator for Health Information Technology has even created a handy form to report incidents of information blocking.

Exactly what "health information" is a US healthcare provider required to provide access to?

Answer 1

The regulations define two phases of expanding definitions of what information must not be blocked.

Before October 6, 2022

The first phase is described in the Office of the National Coordinator for Health Information Technology (ONC) Information Blocking FAQs:

Before October 6, 2022, electronic health information (EHI) for the purposes of the information blocking definition is limited to the EHI identified by the data elements represented in the United States Core Data for Interoperability (USCDI) standard.

From April 5, 2021 through October 5, 2022, the definition of information blocking is limited to the subset of EHI that is represented by data elements in the USCDI v1.

The USCDI v1 provides this summary of the elements:

After October 5, 2022

After October 5, 2022, the information that must not be blocked is extended to the entire "designated record set" defined in the Health Insurance Portability and Accountability Act

On and after October 6, 2022, the definition of information blocking will apply to the full scope of EHI... EHI as defined for the purposes of information blocking is information that is consistent with the definitions of electronic protected health information (ePHI) and the designated record set (DRS)

The designated record set is basically any health information about an individual. The Health and Human Services guidance materials note the DRS comprises:

• Medical records and billing records about individuals maintained by or for a covered health care provider
• Enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan
• Other records that are used, in whole or in part, by or for the [healthcare] entity to make decisions about individuals.

Thus, individuals have a right to a broad array of health information about themselves ... including: medical records; billing and payment records; insurance information; clinical laboratory test results; medical images, such as X-rays; wellness and disease management program files; and clinical case notes; among other information used to make decisions about individuals.

Conclusion

In short, after October 6, 2022, US healthcare providers must not block any health records they are technically capable of providing immediately.

The ONC FAQ notes:

For health care providers, HHS must engage in future rulemaking to establish appropriate disincentives as directed by the 21st Century Cures Act.

In other words, they haven't yet figured out what stick to use.