LEGAL LEANINGS: How Application Programming Interfaces Apply to Healthcare Entities

By EMMA TRIVAX, Esq.

ONC Final Rule

Information blocking

On May 1, 2020, the Federal Department of Health and Human Services (“HHS”), Office of the National Coordinator for Health Information Technology (“ONC”) released a Final Rule (the “ONC Final Rule”), which implements the information blocking provision of the 21st Century Cures Act, enacted in 2016. The information blocking provision applies to health care providers, health IT (“HIT”) developers, and health information exchanges/networks (“HIEs”).

“Information blocking”, in this context, refers to actions that discourage or interfere with the interoperability of electronic health information (“EHI”) except when necessary to comply with laws, such as HIPAA. An example of a common instance of information blocking is when healthcare entities charge patients unreasonable fees for copies of their electronic medical record. Ultimately, information blocking hinders the desired full interoperability and exchange of EHI.

ADI/FHIR Implementation

In order to enhance interoperability and prevent information blocking, the ONC Final Rule requires that certain technical certification criteria be implemented. The ONC Final Rule affects various kinds of healthcare entities, but HIT developers are the most heavily impacted. Although many HIT developers understand the generalities of the ONC Final Rule, many HIT developers are now struggling to understand the requirement that HIT developers must ensure their HIT is in a secure, standardized Application Programming Interface for Patient and Population Services (“API”) format, so that providers can support a patient’s access to core data in their electronic health record. The ONC Final Rule also includes provisions that make it easier for patients obtain their EHI in a safer and easier manner, with no additional cost when electronically accessed through any application of their choice.

To understand why APIs are important, it is helpful to understand what an API is. APIs allow different applications to interact with each other without the need for each application to know how the other application’s software is designed internally. APIs require the use of HLZ Fast Healthcare Interoperability Resources (“FHIR”), which is the industry gold standard for information exchange. Essentially, FHIR works as a translator between the various applications, so that each application can share data with each other in a language that each application can understand.

To ensure that interoperability is the standard moving forward, the ONC Final Rule included a requirement that all HIT certified through the ONC Certification Program must have standardized APIs for patient and population services. In implementing this requirement, the ONC seeks to minimize the “special effort” necessary for healthcare providers, patients, and their authorized representatives to access, exchange, and use electronic health information via certified APIs.

CMS Final Rule

In conjunction with the ONC Final Rule, CMS released the Interoperability and Patient Access Final Rule on May 1, 2020 (the “CMS Final Rule”). The HIT developers follows the ONC Final Rule, because the ONC certifies HITs. However, the CMS Final Rule does not address HIT developers, but rather, it is aimed largely at payers and some providers as well. The CMS Final Rule finalized three new policies that give patients access to their health information: 1) patient access API; 2) provider directory API; and 3) payer-to-payer data exchange.

For the patient access API, certain CMS-regulated payers are required to implement and maintain a FHIR API that allows patients to easily access their claims and encounter information, including cost, as well as a defined sub-set of their clinical information through third-party applications of their choice. For the provider directory API, the CMS Final Rule requires certain CMS-regulated payers to make provider directory information publicly available via a FHIR API, making it much easier for patients to find information on providers and clinicians.

Lastly, for payer-to-payer data exchange, certain CMS-regulated payers are now required to exchange certain patient clinical data at the patient’s request, allowing the patient to take their information with them as they move from payer to payer over time to help create a cumulative health record with their current payer. Having a patient’s health information in one place will facilitate informed decision-making, efficient care, and ultimately can lead to better health outcomes.

The ONC Final Rule and the CMS Final Rule work together to implement the 21st Century Cure Act. Both final rules discourage information blocking and encourage interoperability. Payers, HIT developers, HIEs, and health care providers must work on implementing the applicable requirements, as the CMS Final Rule is now being enforced, and many of the provisions of the ONC Final Rule will be enforced in mid- to late-2022.