On December 17, 2024, the US Department of Health and Human Services (HHS) Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP) published the Health Data, Technology, and Interoperability: Protecting Care Access (HTI-3) final rule in the Federal Register. The final rule establishes the new protecting care access exception to the 21st Century Cures Act’s information blocking prohibition and makes minor amendments to two existing information blocking exceptions. The final rule finalizes information blocking regulatory changes that ASTP proposed in the HTI-2 Patient Engagement, Information Sharing, and Public Health Interoperability proposed rule.
ASTP adopted the protecting care access exception to address concerns that an actor subject to the information blocking prohibition may have about a patient’s, health care provider’s, or other person’s risk of potential exposure to an investigation, liability, or other legal action resulting from the access, exchange, or use of electronic health information (EHI) that indicates an abortion or other reproductive healthcare was sought, obtained, provided, or facilitated. ASTP notes that the concerns emanate from the new legal landscape in the wake of the Supreme Court of the United States’ 2022 decision in Dobbs v. Jackson Women’s Health Organization. Since that decision, some states have enforced laws or are contemplating legislation that authorizes administrative, civil, or criminal legal action against persons who engage in reproductive healthcare that is permitted by the law of the state in which the care is provided.
The HHS Office for Civil Rights (OCR) addressed the same concerns in its final rule amending the Health Insurance Portability and Accountability Act of 1996 Privacy Rule to prohibit the use and disclosure of protected health information potentially related to reproductive health care for certain legal actions. As part of the HTI-3 final rule, ASTP adopted substantially the same definition of reproductive health care.
Both the HTI-3 and OCR final rules are final agency actions; however, the incoming Trump administration has signaled that it may further act on these rules given different political views tied to reproductive health care. Specifically, the new administration has suggested further review of the new regulations that could result in delay, adjustments, or even full repeal. ASTP had, to some degree, anticipated these possible actions and divided its HTI-2 proposals into several different final rules that the new policy leads could review separately. For now, the HTI-3 final rule changes took effect on December 17, 2024.
NEW PROTECTING CARE ACCESS EXCEPTION
Under the protecting care access exception, a practice by a health care provider, health information network and health information exchange (HIN/HIE), or certified health IT developer (each, an actor) that is implemented to reduce potential exposure to legal action will not be information blocking when the practice satisfies the requirements of the exception’s threshold condition and either the exception’s patient protection or care access conditions.
Threshold Condition
To satisfy the threshold condition, an actor’s practice must meet each of the following requirements:
An actor who is a business associate of, or otherwise maintains EHI on behalf of, another actor may rely on the good faith belief and organizational policy or case-by-case determinations of the actor on whose behalf relevant EHI is maintained.
Patient Protection Condition
When an actor implements a practice to reduce the patient’s risk of potential exposure to legal action, the practice must:
Care Access Condition
When an actor implements a practice to reduce the risk of potential exposure to legal action for licensed health care professionals, other health care providers, or other persons involved in providing or facilitating reproductive health care that is lawful under the circumstances in which it is provided, the practice must affect only access, exchange, or use of specific EHI that the actor believes could expose care providers and facilitators to legal action because the EHI shows, or would carry a substantial risk of supporting a reasonable inference, that they provide or facilitate, or have provided or have facilitated, reproductive health care.
Presumption
For purposes of determining whether reproductive health care is lawful under the circumstances in which it is provided, care provided by someone other than the actor is presumed to have been lawful unless the actor has actual knowledge that the care was not lawful under the circumstances in which such care is it was provided.
PRIVACY EXCEPTION AMENDMENT
The existing privacy exception to the information blocking prohibition includes four sub-exceptions intended to allow an actor to deny a request to access, exchange, or use EHI to protect an individual’s privacy. The fourth sub-exception allows an actor to not fulfill a request for EHI at the request of an individual. ASTP expanded the sub-exception by removing a limitation to individual-requested restrictions that was contingent on whether another law required the EHI be accessed, exchanged, or used.
INFEASIBILITY EXCEPTION AMENDMENT
The existing infeasibility exception includes a segmentation condition that allows an actor to deny a request for EHI if the actor cannot fulfill it because the actor cannot unambiguously segment the requested EHI from EHI that cannot be shared. The final rule expands the segmentation condition to cover all of the sub-exceptions under the privacy exception and the new protecting care access exception discussed above.
ACTION ITEMS AND NEXT STEPS
Actors should consider taking the following steps in response to the final rule:
THE McDERMOTT AND M+ DIFFERENCE
If you have questions about how the final rule affects your organization, please contact Kristen O’Brien, James A. Cannatti III, (Partner – McDermott Will & Emery), Daniel F. Gottlieb, (Partner – McDermott Will & Emery), or your regular McDermott lawyer or M+ consultant.
