What Information Must be Made Available on Patient Portals?

• Portals present challenges that many Actors continue to focus on.
• Until October 6, 2022, Actors are only required to respond to requests for EHI with USCDI, but this is only for purpose of IBR.
• Other factors, such as how an Actor “holds out” its portal need to be considered when deciding what should be made available.

Subscribe to HERE to Legal HIE’s compliance library to gain access to sample policies, documents and tools for compliance with the Information Blocking Rule.

Well folks, the Information Blocking Rule (IBR) April 5th compliance deadline is behind us.  However, I know that many of you are continuing to work through your top IBR challenges and questions one at a time.  At this point, I have worked through many thorny IBR issues with numerous health care providers and health information exchanges (HIE), so I thought you all might be interested in me sharing what is the main topic that I see Actors are focused on.

And the “winner” is:  Portals.

Yes, portals – including both patient portals and provider portals – have been, from my personal experience, currently the biggest area of focus for health care providers working on compliance with the IBR.  The legal issues and challenges portals present have multiple layers.  These challenges include working through thorny legal issues such as deciding what to do with parental access to portals containing EHI about a minor child’s independent episode of care allowed under state law.  However, I think that one of the most frequent questions I have been asked, at least in connection with patient portals, is “what do we have to send?”  So, I thought I would put together a list of decision points to share what I have learned as a result of looking into this question in depth.

• Only USCDI From April 5, 2021 through October 5, 2022, Actors are only obligated to respond to a patient’s request with United States Core Data for Interoperability (USCDI) data.  This is part of the IBR’s Content & Manner Exception. For USCDI version 1, this includes: allergies and intolerances; assessment and plan of treatment; care team members; clinical notes (including, consultation notes and discharge summary notes); H&P; imaging narratives; laboratory report narratives; pathology report narratives; procedure notes; progress notes; goals; health concerns; immunizations; laboratory tests, values & results; patient demographics; problem lists; procedures; provenance (i.e., author time stamp and author organization); smoking status; unique device identifiers for a patient’s implantable device; and vital signs).  But, public comments on USCDI v2 are open until April 15, 2021, and so Actors will need to keep an eye on that and comply when the expanded definition of USCDI goes into effect.

However, in his recent blog post about the IBR compliance deadline date, the National Coordinator for health IT, Micki Tripathi, had this to say about the USCDI restriction:

“This initial 18-month period and limited scope gives the regulated community time to grow more experienced with the information blocking regulation, including when and how to meet an ‘exception,’ before the full scope of the regulation’s EHI definition comes into effect. Of course, those who are able to share more EHI than is represented by the USCDI Version 1 need not wait to begin doing so. Similarly, as a way to prepare for October 2022, we strongly encourage the regulated community to make all EHI available as if the scope of EHI were not currently limited.”

So, ONC is encouraging Actors to share all EHI rather than just USCDI, even before October 6, 2022.  In addition, it is worth noting that the USCDI limitation only applies only to compliance with the IBR.  A health care provider must still comply in full with HIPAA when responding to a patient’s request for access to her/his PHI, and may not limit the response to just USCDI.

• Beginning on October 6, 2022, health care providers must comply with the IBR with respect to all EHI.

• Proactive “push” of USCDI/EHI Not Required. For purposes of compliance with the information blocking rule (IBR), ONC has expressly stated in its FAQs,

“[t]here is no requirement under the information blocking regulations to proactively make available any EHI to patients or others who have not requested the EHI.”

Therefore, an Actor may, but is not required to, proactively push USCDI/EHI data to a patient portal unless the patient requests it or the Actor has “promised” that such data is being made available on the patient portal. [Note: other Medicare programs (e.g., meaningful use) may require participating providers to proactively make certain USCDI/EHI data available via patient portals].

• Patient Request. If the patient requests that his/her USCDI/EHI be made available to him/her via the patient portal, then such requested USCDI/EHI must be made available without delay unless (i) it is technologically infeasible to make such requested data available through the patient portal, or (ii) another IBR exception applies (e.g., Preventing Harm Exception; Privacy Exception etc.). A patient may submit his/her requests for access in person, verbally over the phone, and electronically, including through the portal, by email, or an App.

• Promised Data. Actors who “advertise” or otherwise tell their patients that certain specific USCDI/EHI (e.g., labs and other diagnostic results) will be made available through the portal and encourage registration for portal accounts must make such “promised” information available in the patient portal without delay.

• Impermissible Delays. A health care provider-Actor may not knowingly and unreasonably delay the access, exchange or use of USCDI/EHI in response to a patient’s request for access or exchange of such information. “Default” technical settings which auto-delay release of USCDI/EHI for a pre-defined period of time (e.g., 48hrs, 72hrs) will generally be viewed as “unreasonable interference” under the IBR.  Similarly, a health care provider-Actor should not adopt organization-wide policies that expressly require or permit the unreasonable delay of access, exchange or use of USCDI/EHI.

• Finalized Data. USCDI/EHI may be withheld until “finalized.”  Per ONC, “finalized” data points means that they are considered by the health care provider-Actor to be deemed “reliable for purposes of clinical decision making.”  In theory, ONC has said that lab results should be made available to patients contemporaneous with their availability to the ordering provider.

• Alternate Manner. USCDI/EHI that cannot be made available through the patient portal due to either technological limitations (e.g., Infeasibility Exception), or the applicability of another IBR exception (e.g., Privacy Exception; Preventing Harm Exception) may still need to be provided to the patient in an alternate manner (e.g., through Medical Records) in order to comply with HIPAA’s right of access requirements.

We’ve recently added a slew of tools, whitepapers and policies covering portals to our compliance library, and more are on the way!  If you are not a subscriber to our Legal HIE compliance library, check out our Table of Contents here to check out all the resources that are available there today!