In December 2024, the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (“ASTP/ONC”) within the U.S. Department of Health and Human Services (“HHS”) published two final rules that establish health data interoperability and information blocking regulations (the “New HTI Final Rules”).
The New HTI Final Rules will affect Trusted Exchange Framework and Common Agreement (“TEFCA”) qualified health information networks (“QHINs”) and health care organizations that exchange data through QHINs, as well as developers of certified health information technology, health information exchanges and networks, and health care providers (collectively, “Actors”) that are subject to the Information Blocking Rule. This alert summarizes key provisions of the New HTI Final Rules.
I. Establishment of TEFCA Governance Rules (HTI-2 Final Rule)
On December 16, 2024, ASTP/ONC published the “Health Data, Technology, and Interoperability: Trusted Exchange Framework and Common Agreement (TEFCA)” final rule (the “HTI-2 Final Rule”).1 The HTI-2 Final Rule finalizes federal regulations for TEFCA, which seeks to establish a floor for nationwide interoperability to facilitate full network-to-network exchange of health information.2
TEFCA comprises two components: (a) the Trusted Exchange Framework, a common set of principles designed to facilitate trust between HINs; and (b) the Common Agreement, an agreement establishing baseline legal and technical requirements for nationwide interoperability that QHINs must execute with the TEFCA Recognized Coordinating Entity (“RCE”) selected by ASTP/ONC to administer the requirements of the Common Agreement. In the HTI-2 Final Rule, ASTP/ONC finalized new TEFCA regulations at 45 C.F.R. Part 172 that establish the processes and procedures governing the onboarding and designation of QHINs; suspension, termination and administrative appeals to ASTP/ONC; and QHIN attestation for the adoption of TEFCA.
The new federal regulations will promote transparency in governance and oversight in TEFCA by providing a central resource for requirements that previously were established through the Common Agreement and various policies and procedures published by the RCE. In addition, ASTP/ONC will exercise more direct authority over the program by requiring the RCE to obtain the agency’s prior authorization for certain actions, including interim or final QHIN designation decisions and establishing QHIN onboarding requirements.
II. Changes to the Information Blocking Rule (HTI-3 Final Rule)
On December 17, 2024, ASTP/ONC published the “Health Data, Technology, and Interoperability: Protecting Care Access” final rule (the “HTI-3 Final Rule”).3 The HTI-3 Final Rule finalizes an exception to the Information Blocking Rule for certain practices that may interfere with access, exchange, or use of electronic health information (“EHI”) that are undertaken to protect patients or providers from legal risk related to reproductive health care. The HTI-3 Final Rule also introduces minor changes to existing information blocking exceptions.
- New Protecting Care Access Exception
The HTI-3 Final Rule implements the new Protecting Care Access Exception to the Information Blocking Rule. The Protecting Care Access Exception was proposed in the HTI-2 Proposed Rule largely in response to new state laws restricting access to and delivery of reproductive health care in the wake of the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.4 To address the chilling effect of these state laws on an individual’s willingness to seek and a provider’s willingness to furnish reproductive health care, the Protecting Care Access Exception protects from information blocking liability certain restrictions on access, exchange, or use of EHI when undertaken to reduce potential legal exposure related to reproductive health care. The Protecting Care Access Exception builds on similar efforts by the federal government and certain states to address concerns related to reproductive health care. At the federal level, the HHS Office for Civil Rights issued a final rule on April 26, 2024,5 which prohibits the use or disclosure of protected health information in certain circumstances for purposes such as imposing criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care. Certain states, including Maryland and California, have enacted laws that regulate the disclosure of information related to reproductive health care.6
Public comments were strongly supportive of the Protecting Care Access Exception, and ASTP/ONC finalized it largely as proposed. The final exception includes additional flexibility for Actors that are business associates to rely on the good faith belief and determination of legal risk of an organization for which the Actor maintains EHI as a business associate.
- Privacy Exception and Infeasibility Exception Modifications
The Privacy Exception allows an Actor to decline to provide access, exchange, or use of EHI if requested by an individual under certain circumstances. In the HTI-2 Proposed Rule, ASTP/ONC proposed to revise the Privacy Exception to remove the limitation that it can apply only where the sharing of EHI is not otherwise required by law. This would mean that Actors may restrict access, exchange, or use of EHI as requested by an individual even when another law requires fulfillment of a request for EHI. ASTP/ONC finalized this modification as proposed, but emphasized that the modification does not override other law compelling disclosure against the individual’s wishes; rather, it merely protects the Actor from information blocking liability that may arise from complying with the individual’s request.7
ASTP/ONC also implemented modifications to the Infeasibility Exception’s segmentation condition, which now allows an Actor not to provide access, exchange, or use of EHI that cannot be segmented from other EHI that (i) cannot be made available by law or (ii) may be withheld under the Preventing Harm Exception, the Privacy Exception, or the new Protecting Care Access Exception.
III. Unimplemented Proposals
While these changes are significant, they represent only a few of many proposals that ASTP/ONC had proposed in the HTI-2 Proposed Rule.8 ASTP/ONC touted the HTI-2 Proposed Rule as a “tour de force” when it was released,9 and it was widely anticipated that the ensuing final rule would have a significant impact on the ONC Health IT Certification Program, the Information Blocking Rule, and TEFCA. The New HTI Final Rules leave out significant proposals, including proposed new certification criteria related to public health, payers, and application programming interface capabilities; regulations codifying examples of practices that may be considered information blocking; and a new information blocking exception for honoring a requestor’s preferences when fulfilling a request to access, exchange, or use EHI.
ASTP/ONC has explained that it chose to limit the scope of the New HTI Final Rules because “the number of public comments received made it impracticable to finalize the [proposed] rule in its entirety in a timely manner.”10 The agency left open the possibility that unimplemented proposals “may be the subject of subsequent final rules related to such proposals in the future.”11 However, it remains to be seen when and whether such proposals will be finalized, particularly considering that a new presidential administration will take office in January 2025.
IV. Conclusion
The New HTI Final Rules introduce meaningful regulations that will increase transparency in the administration of TEFCA and provide protection under the Information Blocking Rule for certain activities undertaken to protect against litigation risk arising from reproductive health care. However, other impactful changes that were proposed in the HTI-2 Proposed Rule were not finalized. Although ASTP/ONC has stated that those proposals have not been abandoned, their future is uncertain, especially considering the imminent change in presidential administrations, which may lead to shifting regulatory priorities.
