21 st Century Cures Act,an Information Technology-Led Organizational Initiative

Introduction

In 2020, as the COVID-19 pandemic was unfolding, an important portion of the 21st Century Cures Act (Cures Act), specifically the Open Notes Rule, was enacted [3,8,14]. Just as the Hospital for Special Surgery (HSS) information technology (IT) department was proud to support our institution’s heroic efforts to assist our community during the first surge of the COVID-19 pandemic [10], IT also played an essential role in the roll-out of this new regulation.

Designed to improve care coordination and promote patients’ control over their own health information, the Open Notes Rule passed in May 2020 and went into effect in April 2021 [3]. Key to the goal of the Cures Act is its prohibition of “information blocking,” defined as a practice likely to “interfere with access, exchange, or use of electronic health information” [11]. The provision against information blocking applies not only to physicians, physical therapists, pharmacists, and hospitals but also to healthcare information networks and IT developers [1,12].

These regulations have required a shift in practice and also in attitude. Norms are changing: while continuing to secure confidential patient data, clinicians and health IT professionals are now also charged with sharing medical records with patients in near real-time.

Enforcing these new rules is the Office of the National Coordinator for Health Information Technology (ONC), and financial penalties have been proposed for information blocking. In particular, physicians and other clinicians may be in violation of the information-blocking rule if they interfere with the exchange or use of electronic health information (EHI).

The Interoperability and Patient Access rule is a separate but related rule that was also incorporated into recent changes to the EHI process at HSS. It requires the following 2 provisions [3]:

• Provider directory. Providers must make their digital contact information available publicly in the National Plan and Provider Enumeration System (NPPES). This electronic directory includes the provider’s direct address (the equivalent of electronic health record e-mail address) and the hospital’s application program interface (API) endpoint. The API facilitates sharing of EHI using mobile applications such as Apple Health.

• Event notifications. Hospitals must send notifications of inpatient admission, discharge, and transfer to primary care providers (and other providers the patient specifies). As a condition of hospital participation in Medicare, event notification will be monitored by state survey agencies and the Joint Commission.

As health care systems implement the provisions of both the Cures Act and the Interoperability and Patient Access rule, they must also undergo dramatic changes in workflow and culture. At HSS, implementing these complex regulations has required collaboration among many departments and individuals, including IT and operations teams, clinical staff, health information management, compliance and legal teams, researchers, and physical therapists. We recognized early on that we would need to take action to prevent unintended consequences of these regulations. For example, we wanted to avoid unblinding research, confusing patients with unfamiliar medical terms, and exacerbating unacceptable behavior in predisposed patients.

Organizational Imperative

The IT department introduced and managed the initiative, largely because the changes required in the electronic health record (EHR) (Epic, Verona, Wisconsin) would be considerable. In addition, the department had a strong history of leading similar regulatory projects such as the Health Information Technology for Economic and Clinical Health (HITECH) Act. It became clear during the planning stage that because of the project’s complexity, implementation would involve new workflows that would require collaboration among departments. It would be important to avoid surprises by making sure leadership understood such changes early in the process.

We divided the project into 2 phases, each with its own deadlines. In phase 1, we focused on establishing systems to prevent information blocking; in phase 2, we addressed the requirements of the Interoperability and Patient Access rule [3] by creating an online listing of digital contact information and a process to implement event notifications. We formed workgroups to address technical, operational, and clinical areas. Other constituents included legal, compliance, marketing, and training. Nonphysician providers, medical staff administration, and office managers frequently serve as a link between physicians and patients and therefore were key to provider adoption. A steering committee, co-led by IT and the chief medical information officer, governed decisions, and organizational challenges. We created a phase 1 organization table (Fig. 1) and used a similar structure for phase 2.

Fig. 1.

Health Information Management.

Using the waterfall project management methodology, in which change is implemented in stages, we executed changes including formal documentation and project plans. These would be critical in the event of a compliance audit. Important to our success were our use of a dedicated project manager; strong, standardized tools, including project management software; a decisions, issues, risks, tasks (DIRT) log for project documentation; and Microsoft Teams for collaboration and information sharing.

Information Blocking

Mandated by the Cures Act, the United States Core Data for Interoperability (USCDI) is a new standard that establishes the elements that must be shared to avoid information blocking [13]. The USCDI added several new data classes to prior sharing requirements (for more information visit https://www.healthit.gov/isa/united-states-core-data-interoperability-uscdi). Specifically, it requires the immediate electronic release of laboratory test results, imaging and pathology reports, and specific types of clinical notes. This is typically interpreted to mean that these records should be shared as soon as they are available via an EHR patient portal [14]. There are a number of reasons why this practice should improve patient care. First, by seeing test results patients may become more involved in their own care, inquiring about abnormal results or researching their meaning. This may bring about greater understanding of a diagnosis, improved adherence to treatments, and in turn better outcomes.

However, there are several circumstances in which the benefits of sharing information with patients may not always outweigh the risks. Consider the following:

• Sensitive lab results. Previously, HSS withheld a number of sensitive results from automatic release to patients, enabling providers to deliver the results directly, providing context and answering questions in real-time. For example, the Huntington’s Disease Society of America recommends that positive results on a genetic test for Huntington’s disease—a universally fatal disease, with no treatment or cure—be provided to the patient in person after a mental health assessment [9]. To address some of these issues while abiding by the spirit of the Cures Act, we decreased the number of “sensitive” results. However, we also continue to hold some tests results in order to give time for the clinician to discuss them with the patient.

• Cancer diagnosis. Occasionally, total joint arthroplasty will yield an unsuspected diagnosis of lymphoma, leukemia, or metastatic cancer [6]. Should this information be released to the patient before the physician has had a chance to review test results and pathology reports with the patient? In a survey of 464 patients, Woolen and colleagues found that patients “prefer to receive imaging results associated with a cancer diagnosis as soon as possible, from their physician, and over the telephone” [18]. We now hold pathology reports with a cancer diagnosis for 3 days, allowing time for the clinician to contact the patient.

• MRI scans. At HSS, magnetic resonance imaging (MRI) is extremely detailed and the reports use terminology that may be difficult for patients to understand [19]. In addition, these reports may unnecessarily increase patient concerns and prompt additional communication with physician offices, taxing an already busy staff. As with other issues raised by the Cures Act, we trained physicians to hold scripted conversations with patients about MRI results. A physician might warn a patient, for example, “Although your MRI report will be extremely detailed, and could include many diagnoses, terms, and conditions, many if not most of these will be clinically irrelevant or unimportant. We can discuss this at your next appointment.”

• The Bonferroni correction. This statistical quirk may be a consequence of multiple comparisons. A colloquial interpretation is: do enough tests and one is likely to be abnormal, though unimportant. For example, when a physician orders a complete blood count and a comprehensive metabolic panel, 2 tests are ordered but dozens are actually performed, increasing the chances of abnormal (but insignificant) test results. This could lead to unnecessary patient concern and use of medical resources. Discussing the likelihood of abnormal results with the patient before the test or providing information on the portal should mitigate this concern.

Note Sharing

The USCDI regulations stipulate the types of notes to be shared with patients immediately, including those related to consultation, discharge summary, procedure, history, and physical exams. In addition, only designated provider types are subject to the rule (e.g., physicians’ notes are included in this regulation, but nurses’ notes are not).

The concern stems from the original use for physician notes: they were written for medical students and, subsequently, physicians [7]. Over time, the audience has broadened to include billers and payers, hospital quality and compliance, the government, litigators—and now, the patient! These records also promote safe transitions of care between an institution and caregivers such as rehabilitation therapists and skilled nursing facilities [16].

The movement to share notes with patients has been active for about a decade (see https://www.opennotes.org). In fact, there is a wealth of literature supporting the practice. For example, Bell et al found that, in a survey in which 22,889 patients read at least 1 note in the prior year, 21.1% reported inaccuracies in their notes; 42.3% perceived the inaccuracies to be serious [2]. Among the serious concerns were mistakes in diagnosis and medications, as well as notes thought to be written about the wrong patient. By enabling patients to identify potential documentation errors, open notes may lead to improvements in care quality and safety [2].

In a recent survey of clinicians, 74% believed that sharing notes was a “good idea,” although it did prompt them to make several changes in the way they documented [5]. In fact, sharing notes with patients causes concern among care providers, for example, that patients’ requests for corrections may increase demands on their time. In addition, some argue that notes would have to be simplified so patients could understand them—and thus they could become less meaningful to other physicians [15].

There are a number of allowable “exceptions” for sharing notes with patients [16]. The most noteworthy stipulates that it is permissible to withhold a note if doing so will substantially reduce the risk of harm to the patient or someone else. Another exception involves a patient’s request not to share notes with specific providers. It should also be noted that local laws may supersede the regulations and that the rules do not apply to psychotherapy notes taken during a counseling session.

One of the most important ways to reduce problems related to sharing notes is to discuss possible test results with the patient before ordering a test or writing a note. Some providers may choose to write notes in plain language and avoid terms that may sound harsh to patients (“chief complaint” or “morbid obesity,” for example).

Special Considerations

Disruptive Patient Behavior

HSS has a longstanding policy on responding to disruptive patients—those who, for example, exhibit physical hostility or use derogatory or threatening language. Legal and risk teams recommend the documentation of such behaviors, but if it were included in a progress note, it must also according to regulations be shared with the patient (because there is no suitable exception). Given that there is a “rising epidemic” of violence against healthcare workers [17] and that sharing such a note with a patient exhibiting disruptive behavior might exacerbate it, we created a new category of note: the “Patient Behavior Note.” Its default setting was to not be shared with the patient.

Research

One of the cornerstones of research is blinding participants to a treatment being studied, or in the case of studies relying on “real-world data,” not unduly influencing choices being made. Sharing laboratory results, radiology reports, and notes introduces the risk that a research project will be compromised. When patients enroll as participants in studies, our consent form stipulates that for the duration of the study, the patient agrees not to receive information related to it. However, this complicates the workflow, if we wish to allow nonstudy information to be released. Although the regulations provide an allowable exception from sharing notes with patients in a research study, this does not apply to laboratory results and reports. Furthermore, in order to apply the exception, the author of the note must know about the study and remember to invoke the exception. For example, if in a study comparing treatments for lumbar disk disease (laminectomy/discectomy vs prosthetic disk replacement) the patient received the operative note or a postoperative X-ray report, the study would be compromised. Because of this concern, we automated the process, finding a number of ways to tag laboratory tests and reports so that they would be routinely withheld from patients. Like behavior notes, research notes are defaulted not to be shared.

Surgical Administrative Notes

Some surgeons use progress notes to communicate nonclinical information about surgical plans to their office staff, physician assistants, and fellows. We created a new note type for this purpose—one that is not shared with patients.

Pediatric Considerations

At present at HSS, patients between the ages of 12 and 17 years are able to get their own MyHSS account (the electronic patient portal) only if their provider recommends it. Without such a recommendation, patients under 18 years of age are not permitted to have their own portal account. Parents of children up to age 11 years are allowed proxy access to all information sent to their child’s portal, and parents of children between the ages of 12 and 17 years have limited proxy access.

Unsigned Notes

On occasion, physicians do not enter or sign notes in a timely manner. Because notes are released to the portal only after they are signed, it can be considered information blocking if this step is not completed promptly. To mitigate this issue, and avoid the fines and legal issues that delays may cause, we created several reports to track and contact clinicians whose notes are overdue. We are following these reports closely and working with service line administrators to assess specific problems.

Instructing Patients and Providers

A project this large required extensive efforts to inform and educate the various people who would be affected. To this end, marketing, communication, and training workgroups were formed and played pivotal roles in the development and dissemination of information. HSS leadership was updated on progress and participated in the discussion as needed. Periodic executive level summary emails were sent when go-live dates approached.

Patients needed to know about the additional information available to them in the portal and what to do if they did not understand details. In addition, we prepared staff to manage requests for corrections or changes in notes. Medical office staff and clinicians could make simple and agreed-upon changes in real-time, although health information management policy guided large or contentious requests. Patients were told that although clinicians were always available to them in an emergency, they should discuss nonemergency issues at their next visit. Scripting and FAQs were provided on the HSS website and in the patient portal, and in emails, brochures, and placards with QR codes in reception areas. Information was provided to the service desk to assist with answering questions. We were sensitive to physician concerns about being overwhelmed by patient communication; so far, the strategies were effective and the postactivation period proved to be quiet.

Office staff received information in virtual meetings, PowerPoint presentations, tip sheets, and direct discussion with administrators. Communications were focused on preparing staff to discuss patient concerns, request changes in the record, and document and handle disruptive patient behavior. As the project became more complicated (with the addition of the research notes and questions about patient behavior notes), 30-minute presentations were delivered to each service line. The 2 concerns that most often arose were that physicians would have to simplify their notes and that patients would be unnecessarily concerned about unimportant abnormalities in test results and reports. Tip sheets developed by service line administrators and informaticists were disseminated directly to clinicians.

Direct Addresses and Event Notifications

In order to improve information flow during care transitions, the Interoperability and Patient Access rule requires “event notification,” designating that providers are notified of a patient’s admission, transfer, or discharge from a facility. To allow this information to be shared, the rule requires providers to list their direct addresses, which will act as a secure email for receipt of electronic patient information. Similarly, patients are asked to provide the names of any provider whom they wish to receive their records. This required changes to the EHR, associated workflows, and training procedures.

The provisions for event notification and provider’s direct addresses caused concern that physicians and offices would be over-run by notifications, especially since HSS is a tertiary care specialty hospital with very few long-term patients. Therefore, the overwhelming number of “admit discharge transfer messages” received would have little clinical importance for our clinicians. The opposite holds true when a primary care provider is notified that their patient was admitted to or discharged from HSS.

Conclusion

In conclusion, the Cures Act and related federal regulations have caused disruptions as well as opportunities. No longer are medical records written solely for clinicians; they are written for patients, as well. This presents a tremendous opportunity to improve communication between clinicians and patients, enhance treatment compliance, and improve outcomes. Likewise, improvements in interoperability can lead to better, more efficient care. Although providers have widely feared this transition, the literature suggests that it actually has gone quite smoothly [4]. In fact, our experience has demonstrated few if any significant issues or challenges. Although regulatory items are not top of mind for clinicians, when organized properly and collaboratively, it became clear that the new requirements were the “right thing to do” and resulted in the cultural change needed for adoption.

This is just the beginning. Indeed, several multiyear, transformational regulatory requirements have been proposed, including other information blocking rules (which are likely to lead to the entire EHR being available to patients), safe prescribing rules, and revisions to the Health Insurance Portability and Accountability Act. Like the changes made under the Cures Act, implementation of these revisions will require careful analysis, project management, governance, and multidisciplinary approaches.

As we saw during the response to the COVID-19 pandemic, IT has a central role to play in responding to regulatory imperatives. As with COVID-19, success meant involving stakeholders from many disciplines, creating a well-defined governance structure, and working as with as much efficiency and agility as possible. As with COVID-19, our experience now will serve us well in the future.

Supplemental Material

sj-docx-1-hss-10.1177_15563316211041613 – Supplemental material for 21^st Century Cures Act, an Information Technology-Led Organizational Initiative

Supplemental material, sj-docx-1-hss-10.1177_15563316211041613 for 21^st Century Cures Act, an Information Technology-Led Organizational Initiative by Steven K. Magid, Karen Cohen and Larry S. Katzovitz in HSS Journal®: The Musculoskeletal Journal of Hospital for Special Surgery

Supplemental Material

sj-docx-2-hss-10.1177_15563316211041613 – Supplemental material for 21^st Century Cures Act, an Information Technology-Led Organizational Initiativee

Supplemental material, sj-docx-2-hss-10.1177_15563316211041613 for 21^st Century Cures Act, an Information Technology-Led Organizational Initiative by Steven K. Magid, Karen Cohen and Larry S. Katzovitz in HSS Journal®: The Musculoskeletal Journal of Hospital for Special Surgery

Supplemental Material

sj-docx-3-hss-10.1177_15563316211041613 – Supplemental material for 21^st Century Cures Act, an Information Technology-Led Organizational Initiative

Supplemental material, sj-docx-3-hss-10.1177_15563316211041613 for 21^st Century Cures Act, an Information Technology-Led Organizational Initiative by Steven K. Magid, Karen Cohen and Larry S. Katzovitz in HSS Journal®: The Musculoskeletal Journal of Hospital for Special Surgery