On November 30, 2016, the U.S. House of Representatives voted strongly in favor of the 21st Century Cures Act (the Act), an expansive health bill that addresses the discovery and development of new medical therapies as well the delivery of health care treatment by providers.

In 2015, the House had previously approved an earlier version of the Act that included notable changes to the HIPAA Privacy Rule relating to the use of protected health information for research activities (see analysis of that bill here). The version of the Act approved by the House last week no longer contains those controversial changes, but the Act nonetheless includes a number of important health care privacy provisions:

• HIPAA
  • The Act calls on the Department of Health and Human Services (HHS) to clarify the permissible uses and disclosures of health information under the HIPAA Privacy Rule in communications between health care providers and caregivers of adults with a serious mental illness to facilitate treatment.
  • The Act directs HHS to make available to health care providers, professionals, patients, patients’ families, and others involved in mental or substance use disorder treatment adequate, accessible, and comprehensible resources relating to appropriate uses and disclosures of protected health information.
  • The Act also requires HHS to issue guidance to clarify the circumstances in which uses or disclosures of protected health information related to mental or substance use disorder treatment are permitted under HIPAA, including to family members, caregivers, or others involved in a patient’s care.

• Information Blocking
  • The Act newly authorizes the HHS Office of Inspector General (OIG) to investigate and penalize individuals and entities found have engaged in “information blocking” related to electronic health information. Interestingly, the Act contains a different definition of “information blocking” depending on who is conducting the practice:
    • The Act defines “information blocking” when conducted by a health care provider as “a practice that… is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information; and… such provider knows that such practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.”
    • The Act defines “information blocking” when conducted by a health information technology developer, exchange, or network as “a practice that… is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information; and…such developer, exchange, or network knows, or should know, that such practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information.”

The Act is expected to be approved by the U.S. Senate and signed into law by President Obama.

[View source.]