Yes, any individual or entity that meets the definition of at least one category of actor—“health care provider,” “health IT developer of certified health IT,” or “health information network or health information exchange” —as defined in 45 CFR 171.102 is subject to the information blocking regulations in 45 CFR part 171. The information blocking regulations in 45 CFR part 171 apply to a health care provider, as defined in the Public Health Service Act and incorporated in 45 CFR 171.102, regardless of whether any of the health IT the provider uses is certified under the ONC Health IT Certification Program.
Yes, any individual or entity that meets the definition of at least one category of actor —“health care provider,” “health IT developer of certified health IT,” or “health information network or health information exchange” — as defined in 45 CFR 171.102 is subject to the information blocking regulation in 45 CFR part 171. The information blocking regulations in 45 CFR part 171 apply to an entity that meets the HIN or HIE definition regardless of whether any of the health IT the HIN or HIE uses is certified under the ONC Health IT Certification Program.
The definition of “health information network (HIN) or health information exchange (HIE)” in 45 CFR 171.102 is a single, functional definition. We did not specifically exclude any particular entities from the definition, nor did we specifically identify particular entities in the definition. In order to determine whether your organization is a HIN/HIE for information blocking purposes, you should assess whether your organization’s functional activity meets the HIN/HIE definition in 45 CFR 171.102. The Information Blocking Actors fact sheet on HealthIT.gov presents the actor definitions in an easy-to-use format.
The answer depends on whether your company or organization meets the definition of “health IT developer of certified health IT” in 45 CFR 171.102. Under the definition, an individual or entity that develops or offers health IT is a “health IT developer of certified health IT” so long as that individual or entity develops or offers at least one Health IT Module certified under the ONC Health IT Certification Program. However, the definition explicitly excludes a health care provider that self-develops Health IT that is not offered to others. The Information Blocking Actors fact sheet on HealthIT.gov presents the actor definitions in an easy-to-use format.
Updated:
This FAQ has been updated pursuant to the HTI-1 Final Rule.
Yes. For purposes of the information blocking regulation, a “health IT developer of certified health IT” is defined in 45 CFR 171.102. With the sole exception of a health care provider that self-develops certified health IT that is not offered to others, this definition is met by any individual or entity that develops or offers health IT certified under the ONC Health IT Certification Program. If an individual or entity offers certified health IT for any period of time on or after the applicability date of 45 CFR part 171, then they would be considered to be a “health IT developer of certified health IT” for purposes of their conduct during that time. The information blocking provision would not apply to conduct the individual or entity engaged in after they no longer have or no longer offer any certified health IT. However, claims of information blocking with respect to conduct occurring while the individual or entity had certified health IT could be acted upon by HHS after the individual or entity no longer had or offered certified health IT. (See also ONC Cures Act Final Rule page 85 FR 25797).
Updated:
This FAQ has been updated pursuant to the HTI-1 Final Rule.
For purposes of the information blocking regulation in 45 CFR part 171, the term "actor" includes health care providers, health IT developers of certified health IT, and health information networks (HIN) or health information exchanges (HIE), as defined in 45 CFR 171.102. Although health plans and other payers are not specifically identified within any of these definitions, they also are not specifically excluded. To the extent an individual or entity that is a payer also meets the 45 CFR 171.102 definition of "health care provider," "health IT developer of certified health IT" or "health information network or health information exchange," that individual or entity would be considered an "actor" for purposes of information blocking. In addition, the HIN/HIE definition is a functional definition and should be reviewed for potential applicability to a health plan’s activities. The Information Blocking Actors fact sheet on HealthIT.gov presents these definitions in an easy-to-use format. (See also Cures Act Final Rule page 85 FR 25803)
In some instances, a business associate will be an actor under the information blocking regulation in 45 CFR part 171 and in other situations, it may not be an actor. The information blocking regulations in 45 CFR part 171 apply to health care providers, health IT developers of certified health IT, and health information networks (HIN) and health information exchanges (HIE), as each is defined in 45 CFR 171.102. Any individual or entity that meets one of these definitions is an “actor” and subject to the information blocking regulation in 45 CFR part 171, regardless of whether they are also a HIPAA covered entity (CE) or business associate (BA).
We have focused the EHI definition on terms that are used in the HIPAA Rules and that are widely understood in the health care industry as well as on a set of health information that is currently collected, maintained, and made available for access, exchange, and use by actors. On and after October 6, 2022, the definition of information blocking will apply to the full scope of EHI (as defined in 45 CFR 171.102):
“Electronic health information (EHI) means electronic protected health information as defined in 45 CFR 160.103 to the extent that it would be included in a designated record set as defined in 45 CFR 164.501, regardless of whether the group of records are used or maintained by or for a covered entity as defined in 45 CFR 160.103, but EHI shall not include:
(1) Psychotherapy notes as defined in 45 CFR 164.501; or
(2) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.” (emphasis added)
EHI as defined for the purposes of information blocking is information that is consistent with the definitions of electronic protected health information (ePHI) and the designated record set (DRS) regardless of whether they are maintained by or for an entity covered by the Health Insurance Portability and Accountability Act (HIPAA) Rules. Just like ePHI, the data that constitutes EHI is not tied to a specific system in which the EHI is maintained. We also noted in our final rule that health information that is de-identified consistent with the requirements of 45 CFR 164.514(b) is not included in the definition of EHI for the purposes of information blocking (85 FR 25804). Thus, any individually identifiable health information that is transmitted by or maintained in electronic media is EHI to the extent that the information would be included in the designated record set.
As defined in the HIPAA Rules, the designated record set comprises:
- medical records and billing records about individuals;
- enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan;
- other records that are used, in whole or in part, to make decisions about individuals.
The term “record” means any item, collection, or grouping of information that includes protected health information. (45 CFR 164.501)
As stated in the United States Core Data for Interoperability Version 1 (July 2020 Errata) (“USCDI v1”), a progress note “represents a patient’s interval status during a hospitalization, outpatient visit, treatment with a LTPAC provider, or other healthcare encounter.” Any note that meets the above definition is considered a progress note for the purposes of the information blocking regulations codified in 45 CFR part 171.
From April 5, 2021 through October 5, 2022, the definition of information blocking is limited to the subset of EHI that is represented by data elements in the USCDI v1. The initial limitation of information blocking to the subset of EHI that is described in USCDI v1 was established to create a transparent, predictable starting point for sharing EHI while actors prepare for the sharing of all EHI (85 FR 25794).
In our final rule, we noted that clinical note types identified in the USCDI are content exchange standard agnostic, and thus they should not necessarily be only interpreted or associated with the specific C-CDA Document Templates that may share the same name (85 FR 25674-5).
For more information on EHI including clinical notes, please review the other FAQs under the Electronic Health Information heading.
This FAQ is specific to the information blocking regulations codified in 45 CFR part 171. For more information about certification of health IT under the ONC Health IT Certification Program, including certification to criteria that include the USCDI as a standard, please see the About The ONC Health IT Certification Program and 2015 Edition Cures Update Test Method pages of ONC’s website, HealthIT.gov.
Yes. Electronic health information (EHI), as defined in 45 CFR 171.102, does not specifically include or exclude notes or other clinical observations based on the type or specialty of the professional who authors them.
Until October 6, 2022, EHI’s scope for purposes of the information blocking definition (45 CFR 171.103) is limited to that information represented by data classes and elements within the United States Core Data for Interoperability (USCDI). Therefore, until October 6, 2022, only those notes that map to any of the eight types specified in the “Clinical Notes” data class within the USCDI would be required to be included in a response to a request for legally permissible access, exchange, or use of EHI. However, actors (health care providers, health IT developers of certified health IT, and health information networks or health information exchanges) should bear in mind that none of the eight types of clinical notes currently represented within the USCDI are limited based on the type or specialty of the professional who authors them.
Please review the other questions under this heading for more information.
It depends. To the extent the content of any particular note meets the definition of “psychotherapy notes” in the HIPAA Rules (see 45 CFR 164.501), that note would be considered a psychotherapy note for purposes of information blocking. The information blocking regulations do not specify types of health care providers to be mental health professionals for purposes of applying the “psychotherapy notes” definition under the information blocking regulations. Thus, all notes that are “psychotherapy notes” for purposes of the HIPAA Rules are also “psychotherapy notes” for purposes of the information blocking regulations in 45 CFR part 171, and are therefore excluded from the definition of EHI for purposes of the information blocking regulations.
It depends. Draft clinical notes and laboratory results pending confirmation are, as we discussed in the ONC 21st Century Cures Act Final Rule, examples of data points that may not be appropriate to disclose or exchange until they are finalized. However, if such data are used to make health care decisions about an individual then that data would fall within the definition of “designated record set” (see 45 CFR § 164.501), and therefore within the definition of EHI. To the extent a data point falls within the definition of EHI, practices likely to interfere with legally permissible access, exchange or use of that EHI could implicate the information blocking definition.
From April 5, 2021 through October 5, 2022, EHI’s scope for purposes of the information blocking definition is limited to the EHI that is represented by data classes and elements within the United States Core Data for Interoperability (USCDI). Therefore, during this period, interference with a request for legally permissible access, exchange, or use of non-final data points would potentially implicate the information blocking regulations only to the extent noted in the above paragraph and only to the extent that the data are within both the definition of EHI and the data classes and elements represented within the USCDI.
No. The definition of electronic health information in 45 CFR 171.102 is not limited by whether the data is recorded or could be exchanged using any particular technical functionality or standard. The information blocking definition (45 CFR 171.103) provides that before October 6, 2022, electronic health information (EHI) is limited to the subset of EHI represented by the data elements identified by the USCDI standard. This limitation of EHI for purposes of the information blocking definition is not contingent on whether those data elements are recorded or represented using the specific content and vocabulary standards in the USCDI standard at 45 CFR 171.213. On and after October 6, 2022, the information blocking regulations in 45 CFR part 171 pertain to all EHI as defined in 45 CFR 171.102.
An actor is not automatically required to fulfill a request using the specific content and vocabulary standards identified in the United States Core Data for Interoperability (USCDI) standard for the representation of data classes and data elements, nor are they required to use certified technology or any specific functionality. The information blocking definition (45 CFR 171.103) provides that before October 6, 2022, electronic health information (EHI) is limited to the subset of EHI represented by the data elements identified by the USCDI standard. This limitation of EHI for purposes of the information blocking definition is not contingent on whether those data elements are recorded or represented using specific content and vocabulary standards in the USCDI standard in 45 CFR 171.213. On and after October 6, 2022, the information blocking regulations in 45 CFR part 171 pertain to all EHI as defined in 45 CFR 171.102.
Again, the information blocking regulations do not require the use of any specific standard or functionality. Instead, the “Manner” exception (45 CFR 171.301) outlines a process by which an actor may prioritize the use of standards in fulfilling a request for EHI in a manner that supports and prioritizes the interoperability of the data. This means that, for the purposes of information blocking, before October 6, 2022, an actor may have fulfilled a request with the EHI identified by the data elements represented in the USCDI standard, first in the manner requested and, if not, in an alternate manner agreed upon with the requestor, following the order of priority specified in the exception.
Updated:
This FAQ has been updated pursuant to the HTI-1 Final Rule.
No, the definition of electronic health information (EHI) is not limited by when the information was generated. Before October 6, 2022, an actor must respond to a request to access, exchange, or use EHI with, at a minimum, the requested EHI that they have and that can be identified by the data elements represented in the United States Core Data for Interoperability (USCDI), regardless of when the information was generated. On and after October 6, 2022, an actor must respond to a request to access, exchange, or use EHI with EHI as defined in 45 CFR 171.102, regardless of when the information was generated. For example, an actor who has the necessary technical capability to do so is required to fulfill a request to access, exchange or use EHI that they have and could appropriately disclose in response to that request even if the EHI was generated before the ONC Cures Act Final Rule was published and even if the EHI was generated before the Cures Act was enacted by Congress.
The fulfillment of a request for access, exchange or use of EHI, including what EHI is shared, should be based on the request. However, any activity by the actor that seeks to artificially restrict or otherwise influence the scope of EHI that may be requested may constitute interference and could be subject to the information blocking regulation in 45 CFR part 171.
In terms of fulfilling requests for EHI, it is important to remember that the requirement to fulfill requests for access, exchange, and use of EHI is in any case limited to what the actor may, under applicable law, permissibly disclose in response to a particular request. Under the information blocking regulations in 45 CFR part 171, the actor is only required to fulfill a request with the requested EHI that they have and that can be permissibly disclosed to the requestor under applicable law. However, for protected health information they have, but do not maintain electronically, all HIPAA requirements would still be applicable, including the right of access.
The applicability date for the information blocking regulations in 45 CFR part 171 was established in the ONC Cures Act Final Rule, and was subsequently adjusted in the ONC Interim Final Rule. The Interim Final Rule moved the applicability date from November 2, 2020 to April 5, 2021.
The Interim Final Rule also revised the information blocking definition in 45 CFR 171.103 to adjust the timeframe for the “USCDI limitation.” Before October 6, 2022, electronic health information (EHI) for the purposes of the information blocking definition is limited to the EHI identified by the data elements represented in the United States Core Data for Interoperability (USCDI) standard.
Enforcement of the information blocking regulations depends upon the individual or entity that is subject of an enforcement action or "actor." For health IT developers and health information networks/HIEs, the HHS Office of the Inspector General posted its final rule implementing information blocking penalties. For health care providers, HHS has posted its proposed rule to establish appropriate disincentives as directed by the 21st Century Cures Act. For additional information, see the Disincentives Proposed Rule Overview fact sheet and the Disincentives Common Questions fact sheet.
Updated:
This FAQ has been updated pursuant to the HTI-1 Final Rule.
Under section 4004 of the 21st Century Cures Act (Cures Act), the HHS OIG has authority to investigate any claim that health care providers, health information networks (HINs) and health information exchanges (HIEs), and health IT developers of certified health IT (collectively defined as “actors” in 45 CFR 171.102) have engaged in information blocking.
For actors HHS OIG determines have committed information blocking, enforcement consequences depend upon the actor involved.
- For health IT developers of certified health IT and HINs/HIEs (as defined in 45 CFR 171.102), the Cures Act subjects these entities to civil monetary penalties if HHS OIG determines they committed information blocking. Under the Cures Act, these penalties could be up to $1 million per violation. The HHS OIG has issued a final rule on this enforcement authority.
- For health care providers (as defined in 45 CFR 171.102) the Cures Act authorizes the Secretary of Health and Human Services to establish appropriate disincentives through notice and comment rulemaking. HHS has posted a final rule to establish appropriate disincentives as directed by the 21st Century Cures Act. For additional information, see the Disincentives Final Rule Overview fact sheet and the Disincentives Common Questions fact sheet .
Updated:
This FAQ has been updated pursuant to the Provider Disincentives Final Rule.