Healthcare Law Alert: Get Ready to “Open” Your Records: Cures Act Open Notes Rule Takes Effect April 5



The federal “Open Notes” rule is scheduled to take effect on April 5, 2021. The rule implements a portion of the federal 21st Century Cures Act (Cures Act) related to “information blocking,” specifying that clinical notes are among electronic health information (EHI) that must not be “blocked” and must be available free of charge to patients and their representatives. Generally speaking, such access is through a patient portal or health applications on smart devices.

Background and Overview

By way of background, on March 9, 2020, the U.S. Department of Health & Human Services (DHHS) announced two new rules issued under the Cures Act that are intended to give patients “unprecedented safe, secure access to their health data” so they may make better healthcare decisions for themselves.i The two rules, issued by the HHS Office of the National Coordinator for Health Information Technology (ONC) and Centers for Medicare & Medicaid Services (CMS), implement interoperability and patient access provisions of the Cures Act and support former President Trump’s MyHealthEData initiative.

The ONC final rule, sometimes referred to as the “Open Notes” rule, identifies and finalizes the reasonable and necessary activities that do not constitute “information blocking” and establishes new rules to prevent information blocking practices (e.g., anti-competitive behaviors) by healthcare providers, developers of certified health IT, health information exchanges, and health information networks as required by the Cures Act.

The ONC final rule also requires electronic health records to provide the clinical data necessary, including core data classes and elements, to promote new business models of care, including by advancing common data through the U.S. Core Data for Interoperability (USCDI), which is a standardized set of health data classes and data elements that are essential for nationwide, interoperable health information exchange.

With respect to patient access, ONC’s final rule establishes secure, standards-based application programming interface (API) requirements to support a patient’s access and control of their EHI. APIs are the foundation of smartphone applications (apps). The rule is intended to allow patients to securely and easily obtain their EHI from their healthcare provider’s medical record for free, using the smartphone app of their choice.

Failure to make the required information available to patients electronically will constitute “information blocking” and be punishable under the rule.

What Information Must be Accessible?

More specifically, with limited exceptions, the rule effectively grants patients with immediate access to health information in their electronic medical record, without charge by the provider, including the notes their clinicians write. The rule covers the following eight types of patient data that must be made available to patients electronically:

  • Consultation Notes;
  • Discharge Summary Notes;
  • History and Physical;
  • Imaging Narratives;
  • Laboratory Report Narratives;
  • Pathology Report Narratives;
  • Procedure Notes; and
  • Progress Notes.
What Clinical Notes are Excluded From Access?

The rule does not apply to the following types of clinical notes: (1) psychotherapy notes that are separated from the rest of the individual’s medical record and are recorded (in any medium) by a healthcare provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session; and (2) information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding. Psychotherapy notes do not include medication prescription and monitoring; counseling session start and stop times; the modalities and frequencies of treatment furnished; results of clinical tests; and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. As such, these items must be shared with the patient.

Exceptions to Information Blocking

The rule establishes eight “exceptions” that offer actors covered by the rule, including healthcare providers, with certainty that they will not be engaging in information blocking if the exception is met—that is, information meeting an exception may be “blocked” from the patient’s electronic access. The failure to meet the conditions of an exception will not automatically constitute information blocking; rather, practices will be evaluated on a case-by-case basis to determine whether information blocking has occurred.

Three exceptions of note for healthcare providers are briefly summarized as follows:

  • Preventing harm exception – it will not be information blocking for an actor to engage in practices that are reasonable and necessary to prevent harm to a patient or another person, provided certain conditions are met;
  • Privacy exception – it will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI in order to protect an individual’s privacy, provided certain conditions are met; and
  • Security exception – it will not be information blocking for an actor to interfere with the access, exchange, or use of EHI in order to protect the security of EHI, provided certain conditions are met.

As evidenced by the “provided certain conditions are met” language, each exception is detailed and nuanced and, as such, requires careful analysis prior to an actor seeking to rely on an exception to avoid sanctions under the rule.

It should be noted that, even if a record meets an exception under the Open Notes rule and may be blocked from the patient’s electronic access under the rule, the record nonetheless may be required to be produced through the provider’s regular record request process, unless such records are permitted or required to be withheld from release or disclosure under HIPAA, 42 CFR Part 2 or other applicable law.

In Summary

The Open Notes rule applies to all healthcare providers, including but not limited to, hospitals, physicians, medical practices, ambulatory surgical centers, skilled nursing facilities, long-term care facilities and healthcare clinics, as well as health information exchanges and certified health IT developers. Under the rule, clinical notes must be shared by health providers starting April 5, 2021, but the portion of the rule requiring sharing with a patient’s third-party app that may be downloaded to a smartphone or other device has a compliance effective date of October 6, 2022.

Healthcare providers and other actors covered by the rule will need to develop and institute policies, procedures, and training to ensure full compliance with the rule’s detailed and technical requirements.

If you have any questions about this alert or any other Healthcare Law issue, please contact:

Lani M. Dornfeld, CHPC, Member, Healthcare Law, at 973-403-3136 or

*This is intended to provide general information, not legal advice. Please contact the authors if you need specific advice.

Related Practices:   Healthcare Law

Related Attorney:   Lani M. Dornfeld