Monday, May 20, 2024
HomeHealth LawNavigating Permissive State Legal guidelines in Gentle of the Federal Data Blocking...

Navigating Permissive State Legal guidelines in Gentle of the Federal Data Blocking Guidelines


Beneath the 21st Century Cures Act data blocking necessities and the laws promulgated thereunder by the Workplace of the Nationwide Coordinator for Well being IT (ONC) (the Data Blocking Guidelines), sure actors, reminiscent of healthcare suppliers and sure digital well being document builders (Actors), are prohibited from participating in data blocking of digital well being data (EHI). Data blocking is outlined, partly, as a apply that “[e]xcept as required by legislation or coated by an exception [to the information blocking regulations], is prone to intervene with entry, alternate, or use of digital well being data.”[1] Put merely, the Data Blocking Guidelines usually prohibit any act or omission by an Actor that interferes with the entry, alternate, or use of EHI, topic to enumerated exclusions and exceptions. 

The wide-reaching results of the Data Blocking Guidelines are more and more obvious as Actors proceed to grapple with easy methods to operationalize compliance. A novel challenge that has not too long ago arisen is whether or not Actors could withhold EHI pursuant to different federal and state legal guidelines that allow the withholding of EHI, or whether or not the Data Blocking Guidelines would prohibit such withholding. As mentioned under, the Data Blocking Guidelines could prohibit discretionary withholding of EHI, even the place it’s permitted beneath different federal and state legal guidelines.

Practices Required By Regulation Are Not Data Blocking, However Practices Permitted By Regulation Might Be

Notably, the Data Bocking Guidelines narrowly exclude the withholding of EHI the place “required by legislation” from its basic prohibition. This exclusion has broad-ranging implications for Actors’ compliance with the Data Blocking Guidelines, together with with regard to Actors’ reliance on different federal and state legal guidelines, and particularly such different legal guidelines which might be merely permissive. The exclusion applies solely to different legal guidelines that require a apply that might be data blocking; it doesn’t apply to permissive legal guidelines. 

For instance, ONC’s commentary within the preamble to the data blocking laws means that the place sure disclosures are permitted beneath HIPAA, the Data Blocking Guidelines require such disclosures.[2] The Director of ONC, Dr. Micky Tripathi, not too long ago reiterated this level, stating that, “‘HIPAA says you’re permitted to [share]; data blocking [regulations] say you’re obligated to do it,’ so long as there’s not one other legislation forbidding the sharing.”

Many states have legal guidelines that let particular Actors to withhold sure healthcare information beneath explicit circumstances. The Data Blocking Guidelines, nevertheless, possible prohibit Actors from counting on such permissive state legal guidelines to withhold EHI, except the Actor can usually fulfill an data blocking exception or the apply doesn’t represent data blocking for different causes.

Reliance on Permissive State Legal guidelines to Withhold EHI Might Be Data Blocking

By means of instance, state legal guidelines usually allow healthcare suppliers to withhold sure healthcare information the place the supplier determines releasing such information would pose a threat of hurt to the person that is the topic of the information or one other particular person. In a single occasion, a healthcare supplier not too long ago inquired whether or not withholding sure psychological well being information beneath such a California legislation would violate data blocking prohibitions. 

The related California legislation gives that if a healthcare supplier “determines there’s a substantial threat of serious hostile or detrimental penalties to a affected person in seeing or receiving a replica of psychological well being information requested by the affected person, the supplier could decline to allow inspection or present copies to the affected person” topic to sure circumstances.[3] As a result of the California legislation merely permits (slightly than requires) the supplier to withhold the information, reliance solely on the California provision may violate data blocking as a result of the Data Blocking Guidelines require that Actors share EHI besides as in any other case required by legislation or the place an data blocking exception is met. 

Nevertheless, in sure circumstances, reminiscent of within the above instance, an Actor may withhold the EHI the place it usually satisfies an data blocking exception. Right here, the stopping hurt exception may apply to succeed in the identical or an analogous end result because the California legislation. Notably, although, ONC has indicated that the data blocking exceptions are slender and pose a excessive customary, so in some circumstances assembly an exception could also be extra onerous for an Actor than assembly a permissive state legislation customary.

Actors Ought to Evaluation Their Operational Reliance on Permissive Legal guidelines

Actors ought to concentrate on the Data Blocking Guidelines when counting on different legal guidelines that let the Actor to withhold EHI. Actors ought to proactively decide whether or not the legal guidelines they rely on to withhold EHI are obligatory or merely permissive, and whether or not the apply required or permitted by every legislation would represent data blocking. As an illustration, Actors could have permissive provisions of state and different federal legal guidelines integrated into their insurance policies and procedures for well being data administration. Actors ought to overview such insurance policies and procedures to make sure that these paperwork don’t allow the withholding of EHI pursuant to such permissive legal guidelines except an data blocking exception is met or such apply would in any other case not be thought of data blocking for different causes. 

Failure to adjust to the Data Blocking Guidelines may end up in potentially-significant penalties for Actors. Whereas the penalties and enforcement guidelines have but to be finalized, penalties for well being data networks and exchanges and builders of licensed well being IT could also be as much as $1 million per violation, and healthcare suppliers could also be penalized with applicable disincentives but to be outlined.

For help with questions relating to and compliance with the Data Blocking Guidelines, please contact a member of the Sheppard Mullin Healthcare Group


[1] 45 C.F.R. § 171.103(a) (emphasis added).

[2] 85 Fed. Reg. 25846 (“We famous that practices which might be “required by legislation” may be distinguished from different practices that an actor engages in pursuant to a legislation, however which aren’t “required by legislation.” Such legal guidelines are sometimes framed in a approach that let an entry, alternate or use of well being data to be made provided that particular preconditions are happy however don’t expressly require that the actor have interaction in a apply that interferes with entry, alternate, or use of EHI. . . . Nevertheless, we famous that as a result of the situation doesn’t prohibit the actor from exchanging the EHI in all circumstances, the actor could be liable to participating in a apply that was data blocking except an exception utilized.”).

[3] See CA Well being & Security Code § 123115(b).




Please enter your comment!
Please enter your name here

Most Popular

Recent Comments