On October 6, 2022, new federal regulations pertaining to the access provided to patients’ electronically-stored health records and information will go into effect for many different kinds of healthcare practices and facilities, including orthodontic practices. The following article sets out new requirements that are clear under the regulations, as well as guidance[1] where the new regulations are not entirely clear.

Current Requirements

The 21st Century Cures Act, which was passed by Congress in 2016, required healthcare providers to give patients access to electronically stored portions of their medical records. Under the Act, patients must have easy, unrestricted access to the following electronic health information:

  • Consultations
  • Treatment Notes
  • Discharge Summaries
  • Imaging Reports
  • Procedure Notes
  • Progress Notes
  • History and Physical Exam Reports

Currently, these requirements apply only to electronic records and data that are stored within the standards set in the United States Core Data for Interoperability (USCDI)—meaning that until now, orthodontic and dental practices did not fall under the requirements of the Act. On October 6, 2022, new regulations under the Act will go into effect that require all healthcare providers (including orthodontic and dental practices) to comply with the rules. The most pertinent concern for orthodontists is complying with the prohibitions against information blocking in the new rules.

What is Information Blocking? Information blocking means a practice that: (1) Except as required by law or covered by an exception, is likely to interfere with access, exchange, or use of electronic health information (EHI); and (2) If conducted by a health information technology developer of certified health IT, health information network or health information exchange, such developer, network or exchange knows, or should know, that such practice is likely to interfere with access, exchange, or use of EHI; or (3) If conducted by a health care provider, such provider knows that such practice is unreasonable and is likely to interfere with the access, exchange, or use of EHI.

What is electronic health information? Electronic Health Information (EHI) is electronic protected health information (ePHI) that would be included in a designated record set, regardless of whether it is maintained by or for an “actor” required to comply with HIPAA.

Source: 45 CFR 171.103. Notably, prior to October 6, 2022, the definition of “information blocking” applied only to data stored in the USCDI format; but after October 6, 2022, will apply to all healthcare providers (including orthodontic practices).

Note: The new information blocking rule does not apply to records stored in paper-only format, but only to electronic health information (although it should be noted that other health records-based laws, such as HIPAA, apply to personal health information no matter whether paper- or electronic-based).

Starting October 6, 2022, all health care providers, including dental and orthodontic practices, must comply with the Information Blocking Rule. Information Blocking is any practice by a health care provider that is:

  1. Unreasonable;
  2. Likely to interfere with access, exchange, or use of EHI; and
  3. Not covered by an exception to the rule.

Common information blocking practices include restricting authorized access, use, and exchange of EHI and non-standard implementation of health technology systems that increase the complexity or burden of accessing EHI.

Exceptions to the Information Blocking Rule

The Information Blocking Rule provides the following applicable exceptions for dental and orthodontic practices:

  • Preventing Harm Exception: It is not information blocking if health care providers engage in reasonable and necessary practices to prevent harm to the patient or others.
  • Privacy Exception: Health care providers may refuse requests if there are legitimate concerns regarding a patient’s EHI.
  • Security Exception: It is not information blocking if a health care provider interferes with the access, exchange, or use of EHI to protect the security of EHI.  
  • Infeasibility Exception: Covers situations where it is impractical for health care providers to comply with patients’ requests for accessing, exchanging, or using EHI, whether for technological or legal reasons.
  • Content and Manner Exception: Allows health care providers to limit the scope of the request for accessing, exchanging, or using EHI.  
  • Fees Exception: Health care providers can charge reasonable fees for accessing, exchanging, or using EHI

If a practice does not fall within these exceptions, the failure to provide EHI to a patient following a request by the patient may be considered information blocking and subject the practice to penalties and disincentives. The penalties and disincentives have not yet been fully determined.

Answers to Common Questions about the New Information Blocking Rule:

What is the primary requirement of the new rule? At its core, the Information Blocking Rule prohibits healthcare providers (incl. orthodontic practices) from “blocking” patients’ requests for their electronically-stored health records.

Does the Information Blocking Rule require me to store records in any certain type of file format (PDF, Excel, etc.)? No. The Information Blocking Rule does not impose any specific requirements on how orthodontic practices must store patients’ electronic health information. Practices can continue to maintain their electronic files in whatever file format they are currently storing them. The rule instead requires that providers cannot “block” a patient’s request to receive any electronically-stored information.

How quickly must a practice respond to a patients’ request for his/her records in order to not be considered as “blocking” the patient’s request? It is important to note that the regulations do not set a specific timeframe in which a patients’ request for electronically-stored records must be met. The general guidance is that the response to the request should take “no longer than necessary” following procedures that are consistent and non-discriminatory; the question of whether a delay in producing records is so long as to constitute an “unnecessary” delay is made on a “fact-based, case-by-case assessment of the circumstances.” See https://www.healthit.gov/curesrule/resources/information-blocking-faqs for more guidance from the Office of the National Coordinator for Health Information Technology (ONC-HIT), the federal agency with oversight over the new rule.

For instance, if a practice had the technical capability to provide copies of electronic records within 24 hours after a patient’s request, but set a policy that records would be provided within three days of the request so that the practice had time to review the records first and edit them, that could potentially be considered “blocking” under the new rules. A delay caused by factors beyond the practice’s control, however, such as an internet outage or computer problems, would not be considered an “unnecessary” delay. Similarly, the guidance suggests that practices will not be required to produce records more quickly than they have the technical capability to achieve.

Does the Information Blocking Rule require my practice to provide 24-hour access to patients’ records? While the rule does not specifically address this question, the general consensus among those having reviewed the new rules is that practices are not required to adopt new systems or technologies to provide 24-hour access in order to comply with the new rules, if they do not already have such capabilities. The guidance provided by ONC-HIT, for instance, clarifies that there is no requirement under the new rule that practices “proactively” make electronic health information available through a “patient portal” (i.e., a 24-hour web-based access or system). See https://www.healthit.gov/curesrule/faq/do-information-blocking-regulations-45-cfr-part-171-require-actors-proactively-make-electronic; see also guidance from the American Dental Association athttps://www.ada.org/-/media/project/ada-organization/ada/ada-org/files/advocacy/211104_onc_factsheet_finalrule_informationblocking.pdf. Similarly, a practice management software company consulted by the AAO indicated that it did not believe that the new rule required practices that did not already have a 24-hour patient portal to provide one.

As a result, if your practice does not currently utilize a software system that does not offer a 24-hour patient access option, the practice is not required to switch to a system or company that does. Similarly, if your practice is currently using a software system that offers 24-hour patient access as an option or upgrade, but your practice does not currently utilize that option or upgrade, the practice is not required to do so in order to comply with the new rules. The ONC-HIT guidance refers to this as “proactively” adopting a technology, and the guidance states that healthcare providers are not required to “proactively” take any action in order to comply with the new rules—they are only prohibited from “blocking” patient access (defined above) within the technical capabilities the provider is currently using.

Does the new rule require a practice to respond to a request for records outside of normal business hours (after hours or over a weekend)? Although the guidance does not address this question directly, the answer appears to be no. In its primary FAQ page at https://www.healthit.gov/curesrule/resources/information-blocking-faqs, ONC-HIT discusses the concept that practices are not required to “proactively” take measures to comply with the rule (this is the same concept that indicates 24-hour access systems are not required if not already employed by a practice). Requiring practice staff to work after hours or weekends, when they would not typically be working, appears to be an example of “proactive” measure that would not be required in order to avoid a claim of information blocking—the same rationale that would not required a 24-hour computer interface for patients would similarly not require a 24-hour human interface for patients.

Does the new rule require our practice to change its document retention policies? No. Any federal, state, or local laws, or other considerations (legal guidance, malpractice insurer guidance) that currently determine your practice’s document retention policy would not change because of the Information Blocking Rule. The Information Blocking Rule itself does not contain any requirements for length of document retention.

Does the new rule require our practice to store records in any particular file system/program or adopt any particular technology? No. Similar to the question about whether the new rule requires practices to provide 24-hour access to records, the guidance indicates that practices are not required adopt any specific technology or program in which to store records or information. The rule prohibits only an “unnecessary” delay in providing the patient records from whatever storage format or system the practice currently utilizes.

What is the “privacy exception” and does it apply to any situation in my practice? Likely, it does not; it appears to be targeted at situations not common in orthodontic practice. According to ONC-HIT’s guidance at https://www.healthit.gov/cures/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf, the privacy exception applies (1) to health information technology developers when HIPAA would not protect the requested release of health information; and (2) in situations where the healthcare provider is required “by federal or state law to satisfy a precondition (such as patient consent or authorization) prior to” providing the requested records. Id. While there is very little guidance otherwise on this exception, in general, the exception is targeted at preventing claims of information blocking when a delay in providing the requested records was caused by the healthcare provider’s efforts to ensure federal and state privacy laws (like HIPAA) were complied with first.

Will my practice be in violation of the new rule if the patient requests records in a format that is not compatible with or supported by my practice’s record-keeping system? No. Under the “Content and Manner” exception, a practice may fulfill a request for records in a format other than the format requested by the patient when the practice is “technically unable to fulfill the request in the manner requested.” See https://www.healthit.gov/cures/sites/ default/files/cures/2020-03/InformationBlockingExceptions.pdf. If the patient has requested copies of records in a file format that is not supported by the practice’s record-keeping system, then the practice can instead produce copies of records in a format that is supported by or compatible with the system.

Can my practice charge a reasonable copying fee for the cost of producing records to the patient in a specific requested format? Yes, so long as copying fees are routinely charged for other similarly-situated patient requests. The ONC-HIT addresses this question in a specific resource located at https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-171#171.302. If your practice charges copying fees for producing records upon patients’ request, it is suggested that you review this section. In general, fees for copies must be based on objective and verifiable criteria; uniformly assessed to all similarly-situated patients; reasonably related to the practice’s costs of reproducing the records; and uniformly charged for all similar requests, among other criteria listed in the cited resource above. In other words, the charging of copying fees should not be considered “information blocking” as long as there is an actual, verifiable basis for the fees (a demonstrable cost to be passed to the patient), and such fees are uniformly charged of all patients making such a request. This applies to all patient records at your practice, including preliminary diagnostic and evaluation records for patients who do not move on to treatment with your practice (decline treatment altogether, or treat with another provider).

Does the new rule limit what information in a patient’s records must be provided to the patient, or is everything in their file subject to a patient’s request for their records? In short, it is likely (though not entirely clear) that everything in a patient’s records is subject to the rule and must be provided. The question applies particularly to notes that are purely for “internal” purposes of the practice, such as notes about a combative parent or patient or other similar notes. The new rules do not provide a specific definition of what records are or are not subject to a patient’s request. Instead, the rules refer back (through a series of references from one rule to another) to 45 CFR § 160.103, which includes the definition of “health information.” Under that section, “any information … whether oral or recorded in any form or medium, that (1) is created or received by a health care provider … and (2) relates to the past, present or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.” (emphasis added). This definition is quite broad and refers to any information in a patient’s file that relates to the patient’s condition, care received, or payment for the care.” This would appear to include “internal” practice notes that still relate to the treatment of the patient, or, to financial records for the patient. In order to avoid penalties under the new rules or civil liability to the patient, and unless the pertinent federal agencies clarify to the contrary, the safest “best practice” seems to be operating under the assumption that everything in the patient’s file is subject to the patient’s request for their records. This means that practitioners should only make notes in the patient’s file under the assumption that any such notes could eventually be seen by the patient. One practical pointer on this subject, then, would be to limit recorded notes about these types of problem patient or parent situations to factual statements and observations rather than statements of opinion or other qualitative statements (e.g., “parent became argumentative” would be a preferred notation rather than “parent is difficult to deal with”).

Is my practice required to submit a patient’s entire record upon any request by a patient for records? This is a difficult question to answer in isolation; whether providing only a portion of a patient’s file in response to a request constitutes “information blocking” depends on the specific request by the patient. For example, if a patient requests only a specific component of their records, such as x-rays or billing records, then producing only that component (but not other portions of the file) likely would not constitute information blocking. However, a patient request for their “records” or “file” generally likely requires providing copies of any records pertaining to that patient. In general, when responding to a patient request for records, you should ensure that the response includes everything that possibly falls within the scope of the patient’s request; while you are not required to provide copies of any records that are clearly outside of the scope of the patient’s request.

[1] The AAO has undertaken considerable efforts to determine the scope of the new EHI regulations, including research by its own Legal team, research by outside attorneys, consultation with practice management software companies, and other research. However, the AAO and/or its attorneys cannot provide “legal advice” to AAO members on the subjects discussed herein. AAO members who have any questions about required compliance with the new regulations should consult with their own practice’s attorney for further guidance if needed.