Understanding Information Blocking
The 21st Century Cures Act defines information blocking as a practice by a health IT developer, health information network, health information exchange, or healthcare provider that is likely to interfere with the access, exchange, or use of electronic health information, unless required by law or covered by a recognized exception.
Who Is Regulated
The information blocking provisions apply to actors defined as healthcare providers, health IT developers of certified health IT, and health information networks or exchanges. RHIA candidates should be able to identify which category a given organization falls into within a scenario.
The Eight Recognized Exceptions
ONC established exceptions that fall into two categories. Exceptions involving not fulfilling requests to access, exchange, or use EHI include the preventing harm exception, the privacy exception, the security exception, the infeasibility exception, and the health IT performance exception. Exceptions involving procedures for fulfilling requests include the content and manner exception, the fees exception, and the licensing exception.
- Preventing Harm Exception: applies when an actor reasonably believes an activity will substantially reduce risk of harm to a patient
- Privacy Exception: applies when not fulfilling a request protects an individual's privacy consistent with applicable law
- Security Exception: applies when interfering with access is necessary to protect the confidentiality, integrity, and availability of EHI
- Infeasibility Exception: applies when an actor cannot fulfill a request due to legitimate practical challenges
- Health IT Performance Exception: applies to reasonable maintenance and improvement activities
Why This Matters for HIM
Release of information staff and HIM directors must ensure that policies for responding to patient and provider access requests do not unintentionally constitute information blocking. A blanket policy of delaying record release for administrative convenience, for example, would not qualify under any exception and could expose the organization to civil monetary penalties.
Penalties and Enforcement
Health IT developers and health information networks or exchanges found to have committed information blocking can face civil monetary penalties up to one million dollars per violation. Healthcare providers face appropriate disincentives established through rulemaking rather than direct monetary penalties from OIG.
Exam Strategy
- Learn the eight exceptions by category rather than trying to memorize them as an unordered list
- Practice matching scenarios to the correct exception, since exam questions often present a plausible-sounding justification that does not actually meet exception criteria
- Understand that the absence of an applicable exception does not automatically mean information blocking occurred, but it removes a safe harbor
Key Takeaway
Information blocking is a modern compliance area that intersects directly with HIM release of information practices, making it a growing focus on the RHIA exam.