Overview
On December 17, 2024, the US Department of Health and Human Services (HHS) Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP) published the Health Data, Technology, and Interoperability: Protecting Care Access (HTI-3) final rule in the Federal Register. The final rule establishes the new protecting care access exception to the 21st Century Cures Act’s information blocking prohibition and makes minor amendments to two existing information blocking exceptions. The final rule finalizes information blocking regulatory changes that ASTP proposed in the HTI-2 Patient Engagement, Information Sharing, and Public Health Interoperability proposed rule.
ASTP adopted the protecting care access exception to address concerns that an actor subject to the information blocking prohibition may have about a patient’s, health care provider’s, or other person’s risk of potential exposure to an investigation, liability, or other legal action resulting from the access, exchange, or use of electronic health information (EHI) that indicates an abortion or other reproductive healthcare was sought, obtained, provided, or facilitated. ASTP notes that the concerns emanate from the new legal landscape in the wake of the Supreme Court of the United States’ 2022 decision in Dobbs v. Jackson Women’s Health Organization. Since that decision, some states have enforced laws or are contemplating legislation that authorizes administrative, civil, or criminal legal action against persons who engage in reproductive healthcare that is permitted by the law of the state in which the care is provided.
The HHS Office for Civil Rights (OCR) addressed the same concerns in its final rule amending the Health Insurance Portability and Accountability Act of 1996 Privacy Rule to prohibit the use and disclosure of protected health information potentially related to reproductive health care for certain legal actions. As part of the HTI-3 final rule, ASTP adopted substantially the same definition of reproductive health care.
Both the HTI-3 and OCR final rules are final agency actions; however, the incoming Trump administration has signaled that it may further act on these rules given different political views tied to reproductive health care. Specifically, the new administration has suggested further review of the new regulations that could result in delay, adjustments, or even full repeal. ASTP had, to some degree, anticipated these possible actions and divided its HTI-2 proposals into several different final rules that the new policy leads could review separately. For now, the HTI-3 final rule changes took effect on December 17, 2024.
In Depth
NEW PROTECTING CARE ACCESS EXCEPTION
Under the protecting care access exception, a practice by a health care provider, health information network and health information exchange (HIN/HIE), or certified health IT developer (each, an actor) that is implemented to reduce potential exposure to legal action will not be information blocking when the practice satisfies the requirements of the exception’s threshold condition and either the exception’s patient protection or care access conditions.
Threshold Condition
To satisfy the threshold condition, an actor’s practice must meet each of the following requirements:
- Good faith belief. The practice is based on the actor’s good faith belief that persons seeking, obtaining, providing, or facilitating reproductive health care are at risk of being potentially exposed to legal action that could arise as a consequence of particular access, exchange, or use of specific EHI, and the practice could reduce that risk. According to ASTP, an actor’s belief does not need to be accurate, provided that it is held in good faith. ASTP advises that to hold a belief in good faith, an actor does not need to conduct tracking, detailed analysis, or extensive research of laws under which the actor does not furnish health care and does not provide HIN/HIE functionality or other health IT items or services to health care providers.
- Tailoring. The practice is no broader than necessary to reduce the risk of potential exposure to legal action that the actor in good faith believes could arise from the particular access, exchange, or use of the specific EHI.
- Implementation. The actor implements the practice either consistent with a written organizational policy or pursuant to a case-by-case determination, either of which must meet requirements specified in the final rule’s regulation text.
An actor who is a business associate of, or otherwise maintains EHI on behalf of, another actor may rely on the good faith belief and organizational policy or case-by-case determinations of the actor on whose behalf relevant EHI is maintained.
Patient Protection Condition
When an actor implements a practice to reduce the patient’s risk of potential exposure to legal action, the practice must:
- Affect only the access, exchange, or use of specific EHI the actor in good faith believes could expose the patient to legal action because the EHI shows, or would carry a substantial risk of supporting a reasonable inference, that the patient obtained reproductive health care; inquired about or expressed an interest in seeking reproductive health care; or has any health condition(s) or history for which reproductive health care is often sought, obtained, or medically indicated.
- Be subject to nullification by an explicit request or directive from the patient that the access, exchange, or use of the specific EHI occur despite the risks to the patient that the actor has identified.
Care Access Condition
When an actor implements a practice to reduce the risk of potential exposure to legal action for licensed health care professionals, other health care providers, or other persons involved in providing or facilitating reproductive health care that is lawful under the circumstances in which it is provided, the practice must affect only access, exchange, or use of specific EHI that the actor believes could expose care providers and facilitators to legal action because the EHI shows, or would carry a substantial risk of supporting a reasonable inference, that they provide or facilitate, or have provided or have facilitated, reproductive health care.
Presumption
For purposes of determining whether reproductive health care is lawful under the circumstances in which it is provided, care provided by someone other than the actor is presumed to have been lawful unless the actor has actual knowledge that the care was not lawful under the circumstances in which such care is it was provided.
PRIVACY EXCEPTION AMENDMENT
The existing privacy exception to the information blocking prohibition includes four sub-exceptions intended to allow an actor to deny a request to access, exchange, or use EHI to protect an individual’s privacy. The fourth sub-exception allows an actor to not fulfill a request for EHI at the request of an individual. ASTP expanded the sub-exception by removing a limitation to individual-requested restrictions that was contingent on whether another law required the EHI be accessed, exchanged, or used.
INFEASIBILITY EXCEPTION AMENDMENT
The existing infeasibility exception includes a segmentation condition that allows an actor to deny a request for EHI if the actor cannot fulfill it because the actor cannot unambiguously segment the requested EHI from EHI that cannot be shared. The final rule expands the segmentation condition to cover all of the sub-exceptions under the privacy exception and the new protecting care access exception discussed above.
ACTION ITEMS AND NEXT STEPS
Actors should consider taking the following steps in response to the final rule:
- Evaluate whether the actor wants to leverage the new protecting care access exception to protect the privacy of patients who have received or will receive reproductive health care, including in light of the laws of the states in which the actor conducts business.
- Review and revise existing information blocking and privacy policies and procedures to reflect the revisions to the information blocking exceptions included in the HTI-3 final rule.
- Educate reproductive health care providers about the special privacy and information blocking considerations related to EHI and other protected health information potentially related to reproductive health care.
- Monitor for additional updates from the new Trump administration as it reviews the implications of this final rule.
THE McDERMOTT AND M+ DIFFERENCE
If you have questions about how the final rule affects your organization, please contact any of the authors of this On the Subject or your regular McDermott lawyer or M+ consultant.
