Recent regulatory and enforcement developments in the area of access to patient information create significant new risks for radiology providers.

In particular, imaging providers should pay close attention to these developments to identify any legal issues with their internal policies on releasing radiology reports via patient portals after a specified delay to allow for consultation, care coordination, and other medically appropriate activities.

Two developments warrant particular focus: HIPAA patient right of access enforcement and ONC’s new Information Blocking Rule.

HIPAA Patient Right of Access Enforcement

HIPAA has long required, with limited exceptions, that health care providers and other HIPAA “covered entities” give patients and their personal representatives access to their health information upon request. Covered entities must generally respond to such requests by providing access within 30 days, although a covered entity may in certain circumstances obtain an additional 30 days to respond. Covered entities must provide access to records in the form and format requested by the individual if the records are readily producible in that form and format. Further, HIPAA imposes numerous other requirements that govern responses to such requests, including rules concerning permissible charges for producing records. Some of these requirements are expected to change in the relatively near future, as the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) has recently released a proposed rule to modify HIPAA.

Until recently, HIPAA’s patient right of access requirement was very rarely enforced and, as a result, has not always been a compliance priority for health care organizations. During 2019, however, we began to see some right of access enforcement activity (i.e., two settlements) by OCR under its new Right of Access Initiative.

Somewhat surprisingly given the COVID-19 pandemic, 2020 was a particularly active year for OCR’s right of access enforcement, with a grand total of 11 OCR settlements announced during the second half of the year. These access-related settlements involved a wide range of health care providers, and all involved either a delay to provide or a failure to provide some or all of the records requested (including diagnostic films in one recent instance).

OCR’s major enforcement focus in this area and the upcoming changes to HIPAA highlight the need for imaging providers to evaluate whether their policies on release of radiology reports are consistent and remain consistent with HIPAA’s right of access requirements. Although such policies may not necessarily conflict with HIPAA, the complexity of HIPAA’s right of access rules creates a risk that providers may not have considered some areas of inconsistency between their policies and the law. Further, imaging providers should ensure that they do not lose sight of state laws, which also typically contain requirements with respect to patient right of access to information and may impose response timeframes or other requirements that are stricter than HIPAA.

ONC’s New Information Blocking Rule

Unfortunately, radiology providers now face an even more challenging issue than HIPAA in the form of the anti-information blocking portion of the 21st Century Cures Act (the Cures Act), which was enacted in 2016. The Cures Act went much further than HIPAA’s right of access requirement by, in very broad terms, prohibiting actions or practices “likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.” This immediately raises a question as to whether imaging provider policies on release of radiology reports could potentially conflict with this prohibition.

Earlier in 2020, the Office of the National Coordinator for Health Information Technology (ONC) at HHS released a final rule that further developed the information blocking prohibition (the Information Blocking Rule or the Rule), among other issues. The Rule applies to health care providers, defined very broadly, as well as to developers of certified health information technology, health information networks, and health information exchanges.

The Rule’s information blocking prohibition itself relates to electronic health information (EHI), which is “electronic protected health information” maintained in a “designated record set,” as those terms are defined under HIPAA. (*1) With respect to health care providers, the basic language of the Rule states that information blocking is “a practice that…is likely to interfere with access, exchange, or use of [EHI]…and…[i]f conducted by a health care provider, such provider knows that such practice is unreasonable and is likely to interference with, prevent, or materially discourage access, exchange, or use of electronic health information.”

Most importantly for imaging and other providers, the language of the Information Blocking Rule is so broad and vague that it creates a risk of prohibited information blocking, and resulting OIG enforcement actions, (*2) with a wide range of provider actions, system configurations, or contract terms. Although there are many potential implications of the Rule for radiology providers, the Rule raises some particularly difficult issues with respect to imaging provider policies and practices concerning release of radiology reports. For example, could a delay in release of radiology reports that is viewed as medically necessary and appropriate in the medical community nonetheless be deemed a violation of the Rule in certain circumstances?

The answer to this and related patient communication questions is not yet clear. The American College of Radiology (ACR) and other groups recently inquired with HHS about patient communication policies in the radiology context. In response, HHS released some limited additional guidance. The guidance suggests that, if radiology reports are requested by patients, it may be necessary to release such reports to patients when they first become available, even if ordering clinicians are receiving such reports in parallel. However, several other issues surrounding the Rule are relevant:

• The Information Blocking Rule is an intent-based prohibition. To violate the prohibition, an imaging provider must be deemed to “know” that a particular practice is (i) unreasonable and is (ii) likely to interfere with, prevent, or materially discourage access, exchange, or use of EHI. On this issue, industry consensus about the medical necessity and appropriateness of certain radiology report policies and practices may come into play on the reasonableness issue to allow imaging providers to avoid violation of the Rule.
• At the time this article was published, HHS had not yet released any enforcement rule with respect to health care providers. Thus, further clarity with respect to enforcement of the Information Blocking Rule may be forthcoming. Also, although the compliance date for the Information Blocking Rule has been delayed until April 5, 2021, due to the COVID-19 pandemic, there may be further helpful delays in enforcement of the Information Blocking Rule with respect to health care providers due to delays in release of enforcement rules.
• In its Information Blocking Rule commentary, ONC recognized that specific data points may not be appropriate to disclose or exchange until they are finalized. However, it is not clear if or how radiology reports would fit within this category from ONC’s perspective.
• The Information Blocking Rule contains a number of exceptions. Although the exceptions are circumstance-specific and cannot be used in all situations, some exceptions may be helpful to imaging providers in dealing with specific patient access issues. For example, the Rule contains an exception allowing a provider to engage in a practice that would otherwise be considered information blocking if, among other things, the provider has a reasonable belief that the practice would substantially reduce the risk of harm to a person (e.g., disclosure is likely to endanger life or physical safety).

Fortunately, radiology providers have some time to consider these issues in the lead up to the April 5, 2021, compliance date and as the industry awaits further action from HHS on enforcement rules.

We recommend that imaging providers pay close attention to any rules and clarifications that HHS or ONC provide in the months ahead and evaluate their policies and practices with respect to radiology reports and other issues that could potentially fall within the scope of the Information Blocking Rule.

Footnotes:

*1 Until May 2, 2022, actors will only be obligated to comply with the Rule with respect to the more limited scope of data elements set forth in the U.S. Core Data for Interoperability Standard, Version 1. These elements may be viewed here.

*2 Notably, the OIG’s civil monetary penalty authority under the Cures Act does not extend to health care providers. The “disincentives” to be applied to providers will be determined in future rulemaking. However, the “Promoting Interoperability” (Meaningful Use) performance criteria under the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) include information blocking attestations. As a result, for providers who have provided such attestations, information blocking could negatively impact Medicare reimbursement and potentially even have health care fraud implications.

Read this article and more in Chambliss Connection: Radiology for Spring 2021. The digital publication features the latest insights on PPP forgiveness and audits, provider relief funding, patient data & HIPAA, hospital PSAs, tips on buying/selling, and more.