The 21st Century Cures Act and Greater Education: Does Your Institution Have to have to Comply? | Saul Ewing Arnstein & Lehr LLP


On December 13, 2016, the 21st Century Cures Act (the “Cures Act”) was signed into regulation and manufactured changes to the Community Overall health Provider Act connected to wellbeing information engineering. The Workplace of the Nationwide Coordinator for Well being Details Technological innovation (“ONC”), at the U.S. Department of Overall health and Human Solutions (“HHS”), is the principal federal entity billed with coordination of endeavours to carry out innovative wellbeing information and facts technology and the electronic trade of health details. On Might 1, 2020, ONC issued the Cures Act remaining rule, which implements provisions of the Cures Act intended to progress interoperability, support the exchange, access, and use of electronic well being information and facts (“EHI”) and tackle details blocking.

The helpful date to comply with the Cures Act facts blocking policies was at first November 2, 2020 but was extended to April 5, 2021. Regulatory organizations have announced enforcement discretion for supplemental intervals of time, allowing for establishments time to determine if Cures Act compliance is essential and, if so, how to employ compliant procedures, processes, and systems.

Better instruction establishments that deliver well being care services to learners and neighborhood associates may be required to comply with the Cures Act and its details block procedures. This short article offers an overview of the Cures Act and raises queries your establishment may well want to go over between counsel and wellbeing care team. In summary, having said that, the basic language of the Cures Act can make crystal clear that so extensive as digital health data collected by schools and universities are schooling or treatment data, as defined by the Household Instructional Rights and Privateness Act (“FERPA”), individuals information are not matter to the Cures Act.

Who is Lined Underneath the Cures Act?

The Cures Act prohibits health information know-how developers, well being information and facts networks, well being information exchanges, and overall health treatment providers from interfering with the entry, trade, or use of EHI, which is acknowledged as “information blocking.” The Cures Act defines health and fitness treatment suppliers broadly to involve:

“Skilled nursing facility, nursing facility, household wellness entity or other prolonged time period care facility, health and fitness treatment clinic, community psychological well being heart … renal dialysis facility, blood centre, ambulatory surgical heart … unexpected emergency medical expert services company, Federally certified overall health center, team follow, a pharmacist, a pharmacy, a laboratory, a physician…, a practitioner …, a rural wellbeing clinic, … a therapist, and any other group of health care facility, entity, practitioner, or clinician determined acceptable by [HHS].”   

42 U.S.C. § 300jj(3)(emphasis extra).

Drilling down further, a “practitioner” beneath the Cures Act contains any of the subsequent:

  • A health practitioner assistant, nurse practitioner, or scientific nurse specialist
  • A licensed registered nurse anesthetist
  • A qualified nurse-midwife
  • A scientific social employee
  • A scientific psychologist or
  • A registered dietitian or nourishment professional.

42 U.S.C. § 300jj(3) 42 U.S.C. § 1395u(b)(18)(C).

The definition of a well being treatment provider underneath the Cures Act is really broad and captures particular person vendors. To the extent a faculty or college supplies overall health care services at one particular of the services or by just one of the practitioners listed previously mentioned, the establishment may possibly want to comply with the Cures Act, depending on what style of info the institution collects.

What Details is Coated Underneath the Cures Act?

The Cures Act prohibits the actors higher than from partaking in details blocking of EHI. EHI is described to suggest electronic shielded wellbeing info (“ePHI”) as outlined beneath the Health Insurance coverage Portability and Accountability Act of 1996 and its implementing restrictions (“HIPAA”). 45 CFR § 171.102.

The definition of ePHI precisely excludes schooling documents and treatment method information, as those phrases are defined by FERPA. 45 CFR § 160.103. Education documents are:

“those information, information, paperwork, and other components which—

  1. incorporate information and facts right linked to a pupil and
  2. are taken care of by an instructional agency or institution or by a human being acting for such agency or institution.”

20 U.S.C. 1232g(a)(4)(A). 

Therapy information are outlined as:

“records on a university student who is eighteen yrs of age or older, or is attending an institution of postsecondary education, which are designed or maintained by a doctor, psychiatrist, psychologist, or other acknowledged specialist or paraprofessional acting in his expert or paraprofessional potential, or helping in that ability, and which are designed, managed, or utilised only in relationship with the provision of treatment to the college student, and are not out there to everyone other than persons supplying these cure, except that this sort of records can be personally reviewed by a doctor or other proper qualified of the student’s preference.” 

20 U.S.C. 1232g(a)(4)(B)(iv).

This suggests that documents maintained by educational establishments that satisfy the necessities of either “treatment records” or “education records” underneath FERPA are not deemed ePHI below HIPAA and hence are not deemed EHI below the Cures Act. As the Cures Act definition of EHI is specific to electronic knowledge paper records are not implicated.

The interplay concerning HIPAA and FERPA is complicated and has been the topic of guidance from the U.S. Department of Education and learning and HHS. As noted, to the extent an educational establishment maintains data that are not considered ePHI underneath HIPAA, individuals information are not EHI underneath the Cures Act. However, if records are not therapy information or training documents, these information might be matter to the Cures Act. Higher instruction establishments might have data that are ePHI below HIPAA but are not training documents of therapy documents less than FERPA if, for case in point, the institution has records of students who are sufferers at a healthcare facility affiliated with a college or if the institution is a HIPAA-included entity and gives health and fitness care to non-pupils. These kinds of records are matter to the Cures Act. The records maintained and the products and services furnished by the establishment ought to be analyzed to make this perseverance.

What Actions Are Prohibited?

Less than the Cures Act, health facts know-how builders, overall health information networks, wellness details exchanges, and wellness treatment suppliers are prohibited from participating in information blocking. Illustrations of possible information and facts blocking are i) not responding timely to EHI requests ii) charging unreasonably for access to documents, iii) disabling EHR features that aid accessibility, iv) unneeded hold off (e.g., not submitting available documents to the affected individual portal) and v) entering into contracts that would impede access in strategies not expected by HIPAA or state legislation interfering with the entry, exchange, or use of EHI.

Upcoming Methods

ONC has announced it will exercising its discretion in implementing needs beneath the Cures Act that have compliance dates and timeframes for a few months.[1] This overall flexibility offers corporations additional time to assess if the Cures Act applies to their institution or company. Higher schooling establishments may perhaps want to take this opportunity to overview the data they maintain to ascertain if the institution need to comply with the Cures Act’s information and facts blocking procedures. If the Cures Act is implicated, we suggest that the institution employ insurance policies and procedures to comply with the Cures Act, provide instruction to staff on how to reply to a information requests, and check out the compliance technologies of its digital overall health report supplier.

  1. See,