21st Century Cures Act Summary: What Software Companies Need to Know
The 21st Century Cures Act and the ONC Final Rule are major new regulations that are reshaping healthcare and health IT in the U.S. Originally passed in 2016 and issued as a Final Rule in March of 2020, they will affect a wide variety of stakeholders from patients and doctors to healthcare organizations and software developers. For the digital health industry, the regulations will completely change how medical information and health data circulate in the public healthcare space.
In our 21st Century Cures Act summary, we’ve outlined everything you need to know to help you navigate the new regulations. Whether you’re a software developer, a provider, a digital health company, or something in between, consider this your Cures Act handbook.
Keep reading for our comprehensive guide to help you determine how the 21st Century Cures Act and the ONC final rule might impact your business.
Table of Contents
Major Questions
What is the 21st Century Cures Act?
The 21st Century Cures Act is bipartisan legislation that was enacted in December of 2016 to provide support for medical product and research development (pharmaceutical, biological products, etc.). It is designed to place a greater emphasis on the patient perspective. It also contains major new regulations for healthcare IT and software systems, which will have far-reaching implications for hospitals, patients, and software vendors.
Listen to Arcweb CEO Chris Cera discuss the impacts and importance of the 21st Century Cures act in an interview with the UpTech Report:
Check out UpTech’s video for the full interview with Alex Ferguson.
Who is affected by the 21st Century Cures Act?
In a general sense, the 21st Century Cures Act will have an impact on almost everyone participating in the healthcare system, including patients, providers, insurance companies, and many different types of equipment and software vendors. In the context of healthcare IT, the groups that will see the largest impact are providers, healthcare IT software companies, and healthcare payers (including insurance companies and managed care organizations).
The information blocking rules also define three specific audiences that will be required to comply with those regulations: health care providers, certified health IT developers, and health information networks (HIN) and healthcare information exchanges (HIE). These groups are known as Actors, and official definitions for each group are included in the regulations.
What is the ONC Final Rule?
A “final rule” is a set of regulations that emerge from a larger piece of legislation, after moving through a public comment and approval period. The final rule of the 21st Century Cures Act is a set of regulations that focus on advancing interoperability and limiting data-blocking practices within health IT systems. Optimizing U.S. healthcare systems for fluid information sharing is meant to increase accessibility to healthcare data both for patients and for providers. Improved interoperability will promote higher quality care and, therefore, better clinical health outcomes. Officially, the ONC’s Cures Act Final Rule supports “seamless and secure access, exchanges, and use of electronic health information.”
What is the ONC?
The Office of the National Coordinator for Health Information Technology (ONC) is responsible for governing the nation’s health information exchange practices. Located within the Office of the Secretary for the U.S. Department of Health and Human Services (HHS), their purpose is to support and promote the adoption of the most advanced health information technology and electronic exchange of health information.
Who is the CMS?
The Centers for Medicare and Medicaid Services (CMS) is a federal agency under the U.S. Department of Health that oversees government-mandated healthcare programs. Those programs include Medicaid, Medicare, the Children’s Health Insurance Program (CHIP), and the state and federal health insurance marketplaces. They are responsible for providing better access to care for improved health and identifying instances of fraud and abuse within the public healthcare system.
What is interoperability?
Interoperability refers to the ability of multiple computer systems to share and exchange electronic data with each other. For healthcare, interoperability means making health data accessible for both patients and providers seamlessly across geographic boundaries. Improving interoperability and making use of that electronic data could potentially optimize the health of individuals and populations globally.
What is information blocking?
Information blocking is any practice that either intentionally or unintentionally prevents relevant parties from accessing, exchanging, or using electronic health information. Information blocking can interfere with providers’ ability to manage and treat patients’ health conditions and prevent information from being used to improve healthcare overall. Data blocking also makes it more difficult to find treatments and cures to diseases and to make healthcare more affordable to the masses.
The three categories of actors that will be regulated by the information blocking rules are:
- Health Care Providers
- Health Information Network or Health Information Exchange
- Health IT Developer or Certified Health IT
What is HL7 and what does it have to do with the Cures Act?
The 21st Century Cures Act enforces a new and updated API requirement in an effort to make both single patients’ data and population data the prime focus of health IT systems. The new API certification criterion requires the use of the Health Level 7 (HL7®) Fast Healthcare Interoperability Resources (FHIR®) standard Release 4. FHIR was created to use the latest technology as well as utilizing the most effective features of HL7 V2, HL7 V3, and CDA.
21st Century Cures Act Compliance Timeline
The Cures Act requires health IT systems to comply with certain sections of the regulations on specific dates over the next few years. We’ve highlighted the key due dates and what will be required for each time frame.
May 1, 2020: ONC Final Ruling Publication Date
On May 1, 2020, the ONC published the 21st Century Cures Act and the ONC Health IT Certification Program final rule.
July 30, 2020: Communication Restrictions
Communication restriction rules go into effect for Health IT Developers.
Jan 1, 2021: Enforcement Discretion for Provider Directory and Patient Access API Begins On January 1st, 2021, the following policies will come into effect under discretionary enforcement:
- Patient Access API for Qualified Health Plan (QHP) issuers
- Provider Directory API for Medicare Advantage (MA), Medicaid, and the Children’s Health Insurance Program (CHIP)
- Payer-to-Payer Data Exchange
April 5, 2021: Compliance Requirements (APIs & Information Blocking)
Specific Compliance Requirements Start for Several Conditions of Certification including information blocking, assurances, APIs criteria.
July 1, 2021: Enforcement Discretion for Provider Directory and Patient Access API Ends
- Patient Access API for Qualified Health Plan (QHP) issuers
- Provider Directory API for Medicare Advantage (MA), Medicaid, and the Children’s Health Insurance Program (CHIP)
- Payer-to-Payer Data Exchange
December 15, 2021: Real-World Testing Plans Due
The Deadline for first Real-World Testing Plans are due by this date.
January 1, 2022: Time-Limited Criteria
The Medicaid Promoting Interoperability program sunsets and certain 2015 Edition certification criteria that support measures maintained by this program will no longer be included on this date.
April 1, 2022: Conditions of Certification Attestations
The first attestation to Conditions of Certification Required by this date.
October 6, 2022: Exceptions Compliance & EHI Definition
Compliance with Exceptions Required and the full EHI Definition is in Effect after this date.
December 31, 2022: HL7 “FHIR” API Capabilities Due
The new HL7 “FHIR” API Capability and Other Cures Update Criteria must be rolled out by this date.
March 15, 2023: Real World Testing Results
Real world testing results must be submitted by this date.
December 31, 2023: EHI Export Capability
Full EHI Export Capability must be rolled out by this date.
What does the Cures Act mean for me?
In addition to the specific groups outlined in the regulations themselves, the 21st Century Cures Act will have far-reaching implications for anyone involved in the development and sales of healthcare software. Here’s a quick summary of how the 21st Century Cures Act will affect investors, healthcare entrepreneurs, and product managers.
Investors
The 21st Century Cures Act will have a major impact on the features that will be possible, permitted, and required by digital health products and platforms. That means both new risks and new opportunities: existing products will need to be brought into compliance, while a wide range of new products will be able to take advantage of new healthcare and patient claims data.
Healthcare Entrepreneurs
For entrepreneurs, the 21st Century Cures Act signals major new product opportunities. Data that was previously inaccessible to third-party developers will become available, and much of it will move from tightly controlled HIPAA regulations to more flexible FTC standards. That means the ability to build a business around new types of data—but also more responsibility for that data to be used safely and responsibly.
Product Managers
Under the 21st Century Cures Act, existing digital products face a double-edged sword. Product managers will need to navigate the new opportunities presented by access to new data sources, especially payer sources like the newly mandated USCDI data set, while ensuring compliance around data blocking. Regulation often causes major market shake-ups, and the Cures Act is no exception.
Glossary
The ONC highlights and defines a variety of terms specific to the Cures Act. Here some key definitions every stakeholder should know about the final rule.
- API — A computer application programming interface (API) is a piece of software that translates digital information between software programs so that they may communicate with one another.
In healthcare, APIs are often used to transport patient data from one facility to another. The Cures Act outlines a set of standards that govern how healthcare IT systems will communicate with each other in the future, thereby improving national interoperability.
Our Product Hacker podcast went in-depth on how the Cures Act will affect health IT
- EHR — An electronic health record (EHR) is a digital collection of patient health information. The information included in an EHR includes medical history, treatment history, past diagnoses, prescriptions, treatment plans, immunization dates, allergies, radiology images, and lab work. EHRs are sometimes referred to as EMRs (electronic medical records).
As a part of the 21st Century Cures Act, the EHR Reporting Program was established to provide more detailed information about certified health IT to the public.
- Real-World Testing — Under the Cures Act, health IT developers with certified Health IT Module(s) will be required to successfully test the real-world use of the technology for interoperability in the type of setting where the technology would be marketed.
As a part of the final rule, health IT developers with specific Health IT modules are now required to test the real-world use of their products’ interoperability. The regulation was made in an effort to increase transparency for consumer-facing healthcare marketing campaigns.
- USCDI — The United States Core Data for Interoperability (USCDI) was adopted along with the ONC final rule as part of the new API certification criterion. The USCDI outlines standards for health data classes and constituent data elements. The first version of the USCDI replaces the previous standards under the Common Clinical Data Set (CCDS).
Other Cures Act Resources
The ONC has provided several resources and fact sheets that help elaborate on details of the Cures Act. A list of key resources is included below including the full official document for the Cures Act released in May of 2020.
Final Rule Full Text
Standards Documents
- Standards-based API Certification Criterion
- API Conditions and Maintenance of Certification
- U.S. Core Data for Interoperability
- Highlighted Regulatory Due Dates
- Slater pharmacy
Organizations
- Office of the National Coordinator (ONC)
- Centers for Medicaid and Medicare Services
- HL7 Foundation (FHIR)
- CARIN Alliance
