With their final rules on information blocking and API-enabled patient access, officials at the Office of the National Coordinator for Health IT said the agency was purposely taking a "phased-in, gradual approach" to data-sharing compliance.

For the next six months, "no enforcement will be rendered on anything related to information blocking," said Deputy National Coordinator for Health IT Steve Posnack. "It's an opportunity for stakeholders and those covered by the rules to educate themselves, prepare themselves and start to change their operating procedures to be in compliance with the rules."

But for 24 months thereafter, covered healthcare organizations will have to be ready to share any data elements that fall within the United States Core Data for Interoperability, or USCDI.

After that (with eight specific exceptions) they'll be on the hook to provide access to ONC's larger definition of electronic health information, or EHI: essentially, "all of the data that you have the ability to access under the HIPAA Right of Access rule," Posnack explained.

ONC describes the compliance timeline like this:

2020

Sixty days after publication is the rule's general effective date, including Cures Update Certification Criteria and Certain Conditions of Certification.

Health IT developers are also prohibited from restricting certain communications.

After a "six-month preparation period," during which compliance is "encouraged," compliance starts for information-blocking rules.

For months six to 24 after publication, the EHI definition is limited to USCDI, with exceptions, and specific compliance requirements start for several conditions of certification, including information blocking, assurances and APIs.

On December 15, 2020, the first Real-World Testing Plans are due.

2021

On April 1, 2021, the first attestation to Conditions of Certification is required

2022

"By no later than 24 months after publication," new HL7 FHIR API capabilities and other Cures update criteria must be rolled out, according to ONC.

And 24 months post-publication and onward, covered organizations will be expected to be in compliance, with exceptions, and able to share any data that falls within the full definition of EHI.

2023

By no later than 36 months after the rules' publication, EHI Export Capability must be rolled out, according to ONC.

In its response to the new rules, HIMSS (parent company of Healthcare IT News) applauded the fact that the ONC and CMS regulations give patients "unprecedented safe, secure access to their health data to make informed healthcare decisions and better manage their care."

And it noted that ONC has built in some wide latitude with regard to enforcement of the information-blocking provisions.

The rules outline "eight exceptions to the definition of information blocking that would apply when one of the designated actors meets the conditions of one or more exceptions – in such an instance, that actor would not be considered an information blocker," HIMSS points out.

Moreover, it is "important to note that an actor’s practice that does not meet the conditions of an exception will not automatically constitute information blocking, as these practices will be evaluated on a case-by-case basis to determine whether information blocking has occurred."

HIMSS Senior Director of Federal and State Affairs Jeff Coughlin cheered the fact that the rules "really reaffirm the role of patient at the center of healthcare." He also said he was appreciative that ONC took a phased-in approach to defining the data that must be shared.

In the proposed rule, the draft definition of EHI comprised "all of a patient's healthcare information," he said. "That is obviously a pretty heavy lift in terms of when you talk about all of something. All of a patient's health information could be pretty voluminous."

So HIMSS and other organizations called on ONC to instead start by tying the definition to USCDI, he said. It also asked for USCDI to expand in the future to "include such information as social determinants of health information, patient-generated health data and also pricing information."

While the broader definition of EHI will kick in after 24 months, "ONC took the deliberate step to include this phase-in step to only require [a] more limited data set to help folks understand how they're going to accomplish the underlying goals of the rules."

Twitter: @MikeMiliardHITN
Email the writer: mike.miliard@himssmedia.com
Healthcare IT News is a publication of HIMSS Media.