Ready or Not, ONC and CMS Final Data Blocking, Interoperability, and Patient Access Rules Will Enable Patients to Share Their Data More Freely

Last week, the Office of the National Coordinator (ONC) and the Centers for Medicare and Medicaid Services (CMS) released highly anticipated final rules (here and here,respectively) that together lay out new standards for health care information sharing. The rules seek to implement policies that restrict data blocking, increase interoperability, and improve patient access as required by the 21st Century Cures Act and described in President Trump’s 2017 Executive Order.

While most agreed that increasing the ability of health care providers to use patient data to better manage care was a positive step, many stakeholders cited privacy and transparency concerns related to patients sharing data with mobile applications. Despite this pushback, the agencies finalized rules that will enable patients to share their health care data more freely with both providers and app developers, with an effective marked for January 1, 2021.

ONC Rule (fact sheets): Outlines new standards for information blocking, adopts standards-based application programming interfaces (APIs), and updates electronic health record (EHR) certification criteria, and ongoing maintenance of EHR certification. Among other changes, the rule:

  • Codifies eight exceptions that would not constitute information blocking;
  • Finalizes modifications to the 2015 Edition health IT certification criteria, including the addition of a standard for API-enabled services; and
  • Finalizes voluntary certification criteria for pediatric health IT.

CMS Rule (fact sheet): Requires health plans in Medicare Advantage, Medicaid and the Children’s Health Insurance Program (CHIP) fee for service (FFS) programs, Medicaid and CHIP managed care entities, and Qualified Health Plan (QHP) issuers in Federally-facilitated Exchanges (FFEs) to share claims data electronically with patients. Additionally, the rule addresses the secure exchange of EHR data between health care providers to facilitate coordination of care. Specifically, the rule:

  • Finalizes requirements for payers and providers to share claims and health information with patients via a user-friendly electronic format through the Patient Access API, based on the standards outlined in the ONC rule;
  • Establishes a new Condition of Participation (CoP) for hospitals to provide notification to other providers and facilities regarding patient admissions, discharges, or transfers; and
  • Establishes new requirements for states to more frequently share data regarding dual eligible beneficiaries.

Both rules will be implemented using a phased approach over the next 24 months. A detailed implementation timeline of the ONC final rule is available here. More information about CMS’ forecasted implementation of its final rule is available in our full summaryOfficials have noted, however, that implementation timing may be affected by the recent COVID-19 outbreak, though more details is not available at this time.

If you would like access to our full summaries of these rules as well as a comprehensive collection of WHG’s other regulatory analysis, ask us about a Policy Hub subscription.

Lauren Testa is an Associate Vice President at Wynne Health Group, concentrating primarily on regulatory affairs with a focus on Medicare reimbursement as well as other key issues for providers and health plans. She is passionate about human-centered payment and delivery system innovation in health care. You can reach Lauren via email at, and can find her on Twitter and LinkedIn.

Lauren Testa has experience working with a diverse range of clients – including, investors and lenders, federal and local government