New Digital Data Access Rule Takes Effect

Editor's Note: The following is excerpted from Sam Collins' upcoming column. It applies to all providers who maintain digital health records.

The 21st Century Cures Act, which passed in 2016 but only recently underwent final regulatory rule-making (implementation of which was subsequently delayed until now due to the pandemic), is different from HIPAA because it mandates not just patient data access – which in some cases could start and end with a copy of one's health records – but also clinical notes. In essence, the Cures Act is putting into action widespread "OpenNotes," the health data philosophy that all patients should have access to the notes their clinicians take during health encounters.

This requirement is different from those indicated in the HIPAA Privacy Rule because it requires patients to have immediate access to their digital data, such as via a patient portal. The eight types of clinical notes that must be shared include consultation notes, discharge summary notes, history and physical exam notes, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes and progress notes.

Under this new rule, clinical notes must be shared by health systems as of April 5, 2021, and shared with a patient's third-party application (app) that may be downloaded to a smartphone or other device by Oct. 6, 2022.

There are some exemptions to the rule, but by and large, all health care providers, health information exchanges and certified health IT developers must comply.

I assume most EHR vendors are aware of this rule, but as the holder of patient health information and records, it is your responsibility ultimately. Make no assumptions about your system and clarify how it will be able to comply. There is no acupuncture provider exception; if you maintain electronic health records, then it is your responsibility.