1. Exceptions
1.1. Preventing Harm
1.1.1. Reasonable belief that the practice will substantially reduce a risk of harm
1.1.2. practice must be no broader than necessary
1.1.3. practice must satisfy at least one condition from each of these categories
1.1.3.1. Risk type
1.1.3.2. Harm type
1.1.3.3. Implementation Basis
1.2. Privacy
1.2.1. Precondition not satisfied...OR
1.2.2. Developer of certified health IT not covered by HIPAA...OR...
1.2.3. Denial of an individual’s request for their EHI consistent with 45 CFR 164.524(a) (1) and (2)...OR...
1.2.4. Respecting an individual’s request not to share information
1.3. Security
1.3.1. Directly related to safeguarding the confidentiality, integrity, and availability of EHI...AND..
1.3.2. Tailored to specific security risks;
1.3.3. Implemented in a consistent and non-discriminatory manner...AND...
1.3.4. Written security policy supporting the exception
1.4. Infeasibility
1.4.1. Uncontrollable events..OR..
1.4.2. Segmentation..OR..
1.4.3. Infeasibility under the circumstances
1.4.4. AND...The actor must provide a written response to the requestor within 10 business days of receipt of the request with the reason(s) why the request is infeasible.
1.5. Health IT Performance
1.5.1. Condition 1
1.5.1.1. The practice must: 1. Be implemented for a period of time no longer than necessary to achieve the maintenance or improvements for which the health IT was made unavailable or the health IT’s performance degraded; 2. Be implemented in a consistent and non-discriminatory manner; and 3. Meet certain requirements if the unavailability or degradation is initiated by a health IT developer of certified health IT, HIE, or HIN.
1.5.2. Condition 2
1.5.2.1. An actor may take action against a third-party app that is negatively impacting the health IT’s performance, provided that the practice is: 1. For a period of time no longer than necessary to resolve any negative impacts; 2. Implemented in a consistent and non-discriminatory manner; and 3. Consistent with existing service level agreements, where applicable.
1.5.3. Condition 3
1.5.3.1. If the unavailability is in response to a risk of harm or security risk, the actor must only comply with the Preventing Harm or Security Exception, as applicable.
1.6. Content & Manner
1.6.1. Content Condition (N/A due to passed deadline)
1.6.1.1. Content Condition: Establishes the content an actor must provide in response to a request to access, exchange, or use EHI in order to satisfy the exception. 1. Up to 24 months after the publication date of the Cures Act final rule, an actor must respond to a request to access, exchange, or use EHI with, at a minimum, the EHI identified by the data elements represented in the United States Core Data for Interoperability (USCDI) standard. 2. On and after 24 months after the publication date of the Cures Act final rule, an actor must respond to a request to access, exchange, or use EHI with EHI as defined in § 171.102.
1.6.2. Manner Condition
1.6.2.1. Manner Condition: Establishes the manner in which an actor must fulfill a request to access, exchange, or use EHI in order to satisfy this exception. » An actor may need to fulfill a request in an alternative manner when the actor is: − Technically unable to fulfill the request in any manner requested; or − Cannot reach agreeable terms with the requestor to fulfill the request. » If an actor fulfills a request in an alternative manner, such fulfillment must comply with the order of priority described in the manner condition and must satisfy the Fees Exception and Licensing Exception, as applicable.
1.7. Fees
1.7.1. Condition 1
1.7.1.1. Meet the basis for fees condition. » For instance, the fees an actor charges must: − Be based on objective and verifiable criteria that are uniformly applied for all similarly situated classes of persons or entities and requests. − Be reasonably related to the actor’s costs of providing the type of access, exchange, or use of EHI. − Not be based on whether the requestor or other person is a competitor, potential competitor, or will be using the EHI in a way that facilitates competition with the actor
1.7.2. Condition 2
1.7.2.1. Not be specifically excluded. » For instance, the exception does not apply to: − A fee based in any part on the electronic access by an individual, their personal representative, or another person or entity designated by the individual to access the individual’s EHI. − A fee to perform an export of electronic health information via the capability of health IT certified to § 170.315(b)(10).
1.7.3. Condition 3
1.7.3.1. • Comply with Conditions of Certification in § 170.402(a)(4) (Assurances – certification to “EHI Export” criterion) or § 170.404 (API).
1.8. Licensing
1.8.1. Condition 1
1.8.1.1. The negotiating a license conditions: An actor must begin license negotiations with the requestor within 10 business days from receipt of the request and negotiate a license within 30 business days from receipt of the request
1.8.2. Condition 2
1.8.2.1. The licensing conditions: » Scope of rights » Reasonable royalty » Non-discriminatory terms » Collateral terms » Non-disclosure agreement
1.8.3. Condition 3
1.8.3.1. Additional conditions relating to the provision of interoperability elements
2. Claim Process
2.1. Patient, Provider, Devloper, Attorney, files an Information Blocking complaint with ONC
2.1.1. Office Inspector General (OIG) Investigates Claim
3. Penalties
3.1. Devlopers: Civil Monitary Penalties (OIG CMP Final Rule) Effective 9/1/23
3.1.1. 42 CFR Part 1003
3.1.1.1. § 1003.1410 Amount of penalties.: Up to $1 million per violation
3.1.1.2. § 1003.1420 Determinations regarding the amount of penalties
3.1.2. 42 CFR Part 1005
3.2. Providers: 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking (Proposed 10/30/23)
3.2.1. Hospital/CAH: Excluded from Medicare Promoting Interoperability Program for the reporting period
3.2.1.1. Financial Disincentive
3.2.2. Eligible Clinician: Excluded from Quality Payment Program for the reporting period
3.2.2.1. Financial Disincentive
3.2.3. Accountable Care Organization (ACO): Excluded from Medicare Shared Savings Program for at least onc year
3.2.3.1. Financial Disincentive