ONC Archives - OF DIGITAL INTEREST

ONC

Can We Expect to See ONC’s Final Rule on Information Blocking Soon?

by Daniel F. Gottlieb, James A. Cannatti III, Karen S. Sealander and Scott Weinstein | Oct 30, 2019 | Data Privacy, General Interest

A recent update to the Office of Management and Budget (OMB) website suggests that the answer is “yes”—though that depends on how one defines “soon.” According to its website, OMB received the Office of the National Coordinator for Health Information Technology’s (ONC’s) final rule, entitled 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program, for review on October 28, 2019.

Based on the rule title, it appears that ONC is ready to finalize its proposals concerning information blocking and related exceptions. Earlier this year, ONC issued a proposed rule that, among other things, proposed to define information blocking and establish seven exceptions to the broad prohibition for reasonable and necessary activities that should not be considered information blocking. For more information about the information blocking provisions of ONC’s proposed rule, see our On the Subjects here and here.

OMB review is one of the final steps in the process before a rule is published in the Federal Register. OMB did not identify a deadline for completing its review. The agency generally has up to 90 days to complete its review and while it can take less time, OMB took longer with ONC’s proposed rule.

ONC received more than 2,000 public comments on its proposed rule, many of which related to information blocking topics such as the broad scope of the proposed definitions for certain covered actors—e.g., health information exchanges and health information networks—as well as the scope of the definition of “electronic health information.” Several large industry stakeholders recently wrote a letter to Chairman Lamar Alexander and Ranking Member Patty Murray of the Senate Committee on Health, Education, Labor and Pensions raising concerns about ONC’s rulemaking efforts to date and recommending, among other things, that ONC issue a Supplemental Notice of Proposed Rulemaking (SNPRM) to seek further input from stakeholders on various information-blocking-related issues. While we do not know the ultimate contents of ONC’s final rule, it does not appear that ONC has pursued the SNPRM path to gain additional public input.

While we wait for ONC to publish its final rule on key policy decisions that will shape the information blocking enforcement landscape moving forward, please do not hesitate to contact your regular McDermott lawyer or any one of the authors of this blog post if you have questions or need assistance related to information blocking.

2018 Digital Health Data Developments – Navigating Change in 2019

by McDermott Will & Emery | Feb 4, 2019 | Cybersecurity, Data Privacy, Data Transfers/Safe Harbor/Privacy Shield

Data privacy and security legislation and enforcement saw significant activity in 2018 and early 2019. McDermott’s 2018 Digital Health Year in Review: Focus on Data report – the first in a four-part series – highlights notable developments and guidance that health care providers, digital health companies and other health care industry stakeholders should navigate in 2019. Here, we summarize four key issues that stakeholders should watch in the coming year. For more in-depth discussion of these and other notable issues, access the full report.

EU General Data Protection Regulation (GDPR) enhances protections for certain personal data on an international scale. US-based digital health providers and vendors that either (a) offer health care or other services or monitor the behavior of individuals residing in the EU, or (b) process personal data on behalf of entities conducting such activities should be mindful of the GDPR’s potential applicability to their operations and take heed of any GDPR obligations, including, but not limited to, enhanced notice and consent requirements and data subject rights, as well as obligations to execute GDPR-compliant contracts with vendors processing personal data on their behalf.
California passes groundbreaking data privacy law. The California Consumer Privacy Act (CCPA), which takes effect on January 1, 2020, will regulate the collection, use and disclosure of personal information pertaining to California residents by for-profit businesses – even those that are not based in California – that meet one or more revenue or volume thresholds. Similar in substance to the GDPR, the CCPA gives California consumers more visibility and control over their personal information. The CCPA will affect clinical and other scientific research activities of academic medical centers and other research organizations in the United States if the research involves information about California consumers.
US Department of Health and Human Services (HHS) Office of Civil Rights (OCR) continues aggressive HIPAA enforcement. OCR announced 10 enforcement actions and collected approximately $25.68 million in settlements and civil money penalties from HIPAA-regulated entities in 2018. OCR also published two pieces of guidance and one tool for organizations navigating HIPAA compliance challenges in the digital health space.
Interoperability and the flow of information in the health care ecosystem continues to be a priority. The Office of the National Coordinator for Health Information Technology (ONC) submitted its proposed rule to implement various provisions of the 21st Century Cures Act to the Office of Management and Budget (OMB) in September 2018; this is one of the final steps before a proposed rule is published in the Federal Register and public comment period opens. The Centers for Medicare & Medicaid Services (CMS) released its own interoperability proposed rule and finalized changes to the Promoting Interoperability (PI) programs to reduce burden and emphasize interoperability of inpatient prospective payment systems and long-term care hospital prospective payment systems.

ONC Sends Information Blocking Proposed Rule to OMB

by James A. Cannatti III | Sep 19, 2018 | General Interest

The Office of the National Coordinator for Health Information Technology (ONC) is one step closer to issuing its long-awaited proposed rule to implement various provisions of the 21st Century Cures Act, including proposed regulations distinguishing between prohibited health information blocking among health care providers and health information technology vendors and other permissible restrictions on access to health information. According to its website, the Office of Management and Budget (OMB) received ONC’s proposed rule for review on September 17, 2018. OMB review is one of the final steps in the process before a proposed rule is published in the Federal Register for public comments. OMB did not identify a deadline for completing its review. The agency generally has up to 90 days to complete its review, but can take less time than that.

In addition to defining the scope of prohibited information blocking conduct, the proposed rule is likely to address other issues of interest to health industry stakeholders. According to OMB, the proposed rule “would update the ONC Health IT Certification Program (Program) by implementing certain provisions of the 21st Century Cures Act, including conditions and maintenance of certification requirements for health information technology (IT) developers, the voluntary certification of health IT for use by pediatric healthcare providers, health information network voluntary attestation to the adoption of a trusted exchange framework and common agreement in support of network-to-network exchange, and reasonable and necessary activities that do not constitute information blocking. The rulemaking would also modify the Program through other complementary means to advance health IT certification and interoperability.”

Subscribe here to receive future updates from McDermott.

ONC’s De-Regulatory Announcement Aims at Enticing Industry to Adopt 2015 Edition Criteria

by Scott Weinstein | Nov 6, 2017 | Big Data, Consumer Protection, Cybersecurity, Mobile Apps, Telehealth

In September, the Office of the National Coordinator for Health Information Technology (ONC) announced that it is scaling back requirements for third-party certification of criteria related to certified electronic health record (EHR) technology (CEHRT). Going forward, ONC will allow health developers to self-declare their products’ conformance with 30 of the 55 certification criteria.

ONC will also exercise discretion and not enforce the requirement that certification bodies conduct randomized surveillance of two percent of the health IT certifications they issue.

Read “ONC’s De-Regulatory Announcement Aims at Enticing Industry to Adopt 2015 Edition Criteria.”

False Claims Act Settlement with eClinicalWorks Raises Questions for Electronic Health Record Software Vendors

by Daniel F. Gottlieb and Tony Maida | Jul 7, 2017 | Consumer Protection, Data Privacy, General Interest, Uncategorized

On May 31, 2017, the US Department of Justice announced a Settlement Agreement under which eClinicalWorks, a vendor of electronic health record software, agreed to pay $155 million and enter into a five-year Corporate Integrity Agreement to resolve allegations that it caused its customers to submit false claims for Medicare and Medicaid meaningful use payments in violation of the False Claims Act.

Read the full article.

National Roadmap for Health Data Sharing: FTC Advocates Preservation of Privacy and Competition

by Carla A. R. Hine and Jennifer S. Geetter | Apr 17, 2015 | Big Data, Cloud, Consumer Protection, Cybersecurity, Data Privacy, Ecommerce, Mobile Apps

On April 1, 2015, the Office of the National Coordinator for Health Information Technology (ONC), which assists with the coordination of federal policy on data sharing objectives and standards, issued its Shared Nationwide Interoperability Roadmap and requested comments. The Roadmap seeks to lay out a framework for developing and implementing interoperable health information systems that will allow for the freer flow of health-related data by and among providers and patients. The use of technology to capture and understand health-related information and the strategic sharing of information between health industry stakeholders and its use is widely recognized as critical to support patient engagement, improve quality outcomes and lower health care costs.

On April 3, 2015, the Federal Trade Commission issued coordinated comments from its Office of Policy Planning, Bureau of Competition, Bureau of Consumer Protection and Bureau of Economics. The FTC has a broad, dual mission to protect consumers and promote competition, in part, by preventing business practices that are anticompetitive or deceptive or unfair to consumers. This includes business practices that relate to consumer privacy and data security. Notably, the FTC’s comments on the Roadmap draw from both its pro-competitive experience and its privacy and security protection perspective, and therefore offer insights into the FTC’s assessment of interoperability from a variety of consumer protection vantage points.

The FTC agreed that ONC’s Roadmap has the potential to benefit both patients and providers by “facilitating innovation and fostering competition in health IT and health care services markets” – lowering health care costs, improving population health management and empowering consumers through easier access to their personal information. The concepts advanced in the Roadmap, however, if not carefully implemented, can also have a negative effect on competition for health care technology services. The FTC comments are intended to guide ONC’s implementation with respect to: (1) creating a business and regulatory environment that encourages interoperability, (2) shared governance mechanisms that enable interoperability, and (3) advancing technical standards.

Taking each of these aspects in turn, creating a business and regulatory environment that encourages interoperability is important because, if left unattended, the marketplace may be resistant to interoperability. For example, health care providers may resist interoperability because it would make switching providers easier and IT vendors may see interoperability as a threat to customer-allegiance. The FTC suggests that the federal government, as a major payer, work to align economic incentives to create greater demand among providers for interoperability.

With respect to shared governance mechanisms, the FTC notes that coordinated efforts among competitors may have the effect of suppressing competition. The FTC identifies several examples of anticompetitive conduct in standard setting efforts for ONC’s consideration as it considers how to implement the Roadmap.

Finally, in advancing core technical standards, the FTC advised ONC to consider how standardization could affect competition by (1) limiting competition between technologies, (2) facilitating customer lock-in, (3) reducing competition between standards, and (4) impacting the method for selecting standards.

As part of its mission to protect consumers, the FTC focuses its privacy and security [...]

Continue Reading