Latest 21st Century Cures Act ups ante on interoperability for vendors

The newest version of the 21st Century Cures Act gives EHR vendors until Jan. 1, 2018, to meet two interoperability provisions or face stiff penalties.

The legislative package developed by the House Energy & Commerce Committee is intended to jump-start biomedical innovation and includes incentives, appropriations deregulations and regulatory streamlining impacting everything from drugs and biomarkers to devices and software.

If the bill is passed, the Department of Health and Human Services (HHS) would receive $10 million to contract with a “charter organization” that would develop metrics to assess the state of interoperability in the healthcare system. That organization would be responsible for a July 2016 report describing the state of interoperability and the capability of vendors' software. On Dec. 31, 2017, the agency would publish a follow-up report specifying whether given vendors' software was in compliance with certification requirements surrounding interoperability.

Vendors would have to attest that their software complies with interoperability provisions in January 2018. The provisions include a lack of barriers to sharing information; financial information regarding the pricing of data transmission; application programming interfaces, which provide outside developers and users with a set of instructions for accessing EHR data; and satisfying HHS' request to allow for “everyday” data exchange.

If vendors can't prove their compliance, their software would be decertified and no longer eligible for use in the EHR incentive program. Since that means users of decertified also could not qualify for the incentive program, the bill gives HHS the authority to extend hardship exemptions to providers using decertified software. That exemption period must be at least one year, and can last up to five years, at the agency's discretion. The bill also overhauls patients' rights with regard to their health data, though the exact effects are unclear.

The bill also addresses patient rights regarding their health data, saying patients “have the right to the entirety of the health information contained in the electronic health record.” The bill doesn't include details on timeframes or costs.

The bill says healthcare providers do not need patients' consent to share data for their care, which many providers and software vendors had interpreted as necessary under HIPAA. An exception is made for certain conditions, such as psychiatric records, where regulations explicitly specify a need for patient consent.