The 21st Century Cures Act (Cures) was signed into law December 13, 2016. While the primary focus of the 996-page Act centered on biomedical innovation, several components of Cures have significant implications for health care entities outside of that context. The following are some lesser-known elements of Cures that could significantly affect the health care industry.

1. Electronic health records system interoperability

Title 4 of Cures addresses enhancements to health care delivery. Section 4001 aims to reduce the documentation burden on health care providers, intending to ultimately enhance quality of care for patients. To do this, Cures encourages certification of health information technology (HIT) beyond the typical large hospital and clinic settings, such as certification of HIT for use at specialty providers and sites of service. The intent of the expansion of HIT certification is to ensure that more Electronic Health Records (EHR) meet the Center for Medicare and Medicaid Services’ (CMS) standards for improved quality, safety, and efficiency.

Section 4003 of Cures focuses on expediting interoperability among EHRs by developing or supporting a voluntary model framework and common agreement for the secure exchange of health information. Cures proposes to do this by creating a digital health care provider directory to facilitate this information exchange. Additionally, Cures requires the Department of Health and Human Services (HHS) to defer to HIT standards developed in the private sector, including creating a new HIT Advisory Committee to specifically address concerns around interoperability. The new HIT Advisory Committee is charged with engaging stakeholders to identify priorities for this standardization.

Cures also promotes developing and certifying patient-centered EHRs so that patients have better access to their health information in a secure and up-to-date manner. Under Section 4006, the Secretary of HHS must use his or her authority to encourage partnerships between health information exchange organizations, health care providers, and health plans with the goal of offering patient access to their electronic health information in a “single, longitudinal format that is easy to understand, secure, and may be updated automatically.” Section 4006 of Cures also adds a new element to the relationship between covered entities and business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act. Specifically, Cures amends the HITECH Act to state that business associates may directly provide access to Protected Health Information (PHI) in response to a request from an individual. Due to this push to allow business associates to directly provide PHI to a patient in response to a request from that patient, health care entities may need to revisit their business associate agreements to ensure they are not unintentionally in conflict with this section of Cures.

2. Further guidance on HIPAA surrounding mental health and substance abuse disorders

Title 11 of Cures is entitled “Compassionate Communication on HIPAA.” Under the sections of this title, Cures directs the Office of Civil Rights to issue new guidance to clarify when a health care provider or covered entity under HIPAA may use or disclose PHI specifically related to the treatment of an adult with a mental health or substance abuse disorder. This includes clarifying the parameters for sharing mental health and substance abuse information with close relatives. This title also requires HHS—with the help of stakeholders—to assess the impact of the recent, stricter updates to HIPAA governing the confidentiality of alcohol and drug abuse patient records under 42 CFR Part 2. While no specific changes to HIPAA were made as a result of this title, Congress’ directive alludes that future updates are impending.

3. Updates to the Medicare hospital readmissions program

Titles 15, 16, and 17 of Cures amend certain portions of Medicare reimbursement regulations, including Medicare’s hospital readmission program. Section 15002 requires the Secretary of HHS to implement a transitional risk adjustment methodology to allow hospitals to account for patient backgrounds under the Hospital Readmissions Reduction Program (HRRP). Since the implementation of the Affordable Care Act (ACA), hospitals have traditionally been at-fault if a patient returns to the hospital within 30 days after discharge for the same reason that the patient originally was admitted. This is most notable for hospitals located in impoverished areas, where readmission rates can be higher as a result of a patient’s inability to afford medication, healthy food, or transportation to primary-care doctors. Cures now requires CMS to adjust penalties under HRRP based on the proportion of a hospital’s patients who are dual-eligible for Medicare and Medicaid. Dual-eligible patients are often expensive; they accounted for one third of total Medicare fee-for-service spending in 2012, while only comprising 18% of the total beneficiaries.

The Secretary of HHS is also authorized to construct a permanent risk-adjustment method for HRRP. However, Cures does not designate a specific framework beyond the Secretary needing to assign hospitals to groups based on its proportion of dual-eligible patients and apply “a methodology in a manner that allows for separate comparison of hospitals within each group.” Due to the difficulty in capturing which variables contribute most to risk of readmission, we can expect the HRRP risk-adjustment methodology to continue to evolve in the near future.

4. Small employer health reimbursement arrangements

At the very end of Cures, Section 18001 amends the ACA and the Internal Revenue Code (IRC) to allow small employers, those with fewer than 50 employees, to establish health reimbursement arrangements (HRAs). Beginning on January 1, 2017, qualifying small employers can reimburse their employees up to $4,950 annually for employee-only coverage and $10,000 annually for family coverage, in lieu of providing employer-sponsored insurance. Other specific requirements apply, such as that an employee using this arrangement must show he or she actually buys health coverage, and an employer participating in the arrangement cannot use a salary reduction mechanism. HRAs were previously prohibited by the ACA and IRC for violating group health plan rules under these laws. Now that it is officially a permissible practice under the enumerated guidelines in Cures, such arrangements will likely become more widespread and increase enrollment in states’ individual health insurance markets as a result.