Cures Act

The Cures Act: What Nursing Professionals Need to Know

By Georgia Reiner

In December 2016, President Obama signed the 21st Century Cures Act (“Cures Act”) into law. The U.S. Department of Health and Human Services published the final rule on May 1, 2020. The act has several elements of interest to healthcare providers, including regulations designed to facilitate sharing of data for research purposes, thereby accelerating drug and device development, and those designed to improve interoperability so that patients have easier access to their health information.

However, the act has the potential to create difficulties for both patients and healthcare providers. Nurse practitioners, registered nurses, and other nursing professionals need to understand the act, its benefits and potential risks, and how to protect themselves against legal action.

​

What Is the Cures Act?

One of the Cures Act’s goals is to speed development of new treatments through a variety of methods, including data sharing. The act also promotes patients’ ready access to information in their electronic health record. Although patients already have the right to access their information under the Health Insurance Portability and Accountability Act (HIPAA), the Cures Act focuses on quick, free access to electronic health information (EHI), including consultation notes, discharge and summary notes, history and physical, imaging narratives, lab report narratives, pathology report narratives, procedure notes, and progress notes. The act requires organizations to have a secure “application programming interface” so patients can access this information via apps on their personal devices.

Failure to provide patients with access can result in penalties related to “information blocking.” The act defines information blocking as practices “likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information,” which includes delays in giving access.

The Office of the National Coordinator for Health Information Technology has issued eight exceptions that will not result in penalties for information blocking:

•  Preventing harm
•  Privacy
•  Security
•  Infeasibility
•  Health information technology (IT) performance
•  Content and manner
•  Fees
•  Licensing

The “preventing harm” exception is of particular interest to healthcare providers and states: “It will not be information blocking for an actor [healthcare provider] to engage in practices that are reasonable and necessary to prevent harm to a patient or another person, provided certain conditions are met.” It’s beyond the scope of this article to review each exception and its associated conditions; more information can be found at here.

The deadline for compliance with most of the act’s parameters that directly impact healthcare providers was April 5, 2021; full compliance with all information-blocking provisions will be required on October 6, 2022.

What Are the Potential Risks?

Although providing patients with access to information is a worthy goal, that access can create problems. For example, a patient with slight chest discomfort who is waiting in the emergency department to see a provider may access their lab results via their smartphone app and incorrectly assume they don’t have a problem because no test is marked “abnormal.” The patient may then leave without seeing the provider, but later return with serious heart damage. Or a patient accessing their health record could object to terms or labels used, such as seeing that a nurse listed “male-to-female transgender” as a “health issue” in their record. Issues such as these can affect the clinician-patient relationship between nurses and their patients, and even result in lawsuits.

Another challenge is balancing access with privacy protection. There has been confusion as to what is meant by EHI and how it relates to electronic “protected health information (PHI)” listed under HIPAA. The definition of EHI in the final rule is aligned with the information in HIPAA, so it’s important nurses review what falls under PHI (see Protected health information).

How Can Nurses Protect Themselves?

Nurses, other healthcare providers, administrators, and IT personnel should understand the act’s requirements, particularly as they relate to information blocking, including the eight exceptions that will not result in penalties for information blocking, listed above. Before proceeding with acting under an exception, nurses should consult with a risk manager.

It’s also important to know nurses still need to adhere to state requirements for sharing EHI. If, for example, a state law prohibits sharing certain EHI, nurses should follow the law. And, of course, nurses need to adhere to HIPAA requirements, which include PHI in paper, electronic, and verbal formats.

More data may prompt patients to ask more questions. Therefore, it’s a good time for nurses to remember to document patient counseling fully in the health record so they are protected in case of legal action.

Meeting Information Needs

As awareness of the act increases, more patients are demanding access to their EHI. Nurses need to ensure this access is available, while remembering that it’s up to them to help patients interpret that information correctly and to document education and counseling efforts completely in the health record to protect themselves from liability.

Georgia Reiner, MS
Senior Risk Specialist
Nurses Service Organization (NSO)