25510 Federal Register /Vol. 85, No. 85/Friday, May 1 .

Federal Register / Vol. 85, No. 85 / Friday, May 1, 2020 / Rules and Regulationshealth care decisions, including dataabout health care prices and outcomes,while minimizing reporting burdens onaffected health care providers andpayers. We solicited public commentson the CMS Interoperability and PatientAccess proposed rule. In this final rule,we address those public comments andoutline our final policies in therespective sections of this rule.A. PurposeThis final rule is the first phase ofpolicies centrally focused on advancinginteroperability and patient access tohealth information using the authorityavailable to the Centers for Medicare &Medicaid Services (CMS). We believethis is an important step in advancinginteroperability, putting patients at thecenter of their health care, and ensuringthey have access to their healthinformation. We are committed toworking with stakeholders to solve theissue of interoperability and gettingpatients access to information abouttheir health care, and we are taking anactive approach to move participants inthe health care market towardinteroperability and the secure andtimely exchange of health informationby adopting policies for the Medicareand Medicaid programs, the Children’sHealth Insurance Program (CHIP), andqualified health plan (QHP) issuers onthe individual market Federallyfacilitated Exchanges (FFEs). Forpurposes of this rule, references to QHPissuers on the FFEs excludes issuersoffering only stand-alone dental plans(SADPs), unless otherwise noted for aspecific proposed or finalized policy.Likewise, we are also excluding QHPissuers only offering QHPs in theFederally-facilitated Small BusinessHealth Options Program Exchanges (FF–SHOPs) from the provisions of this ruleand so, for purposes of this rulereferences to QHP issuers on the FFEsexcludes issuers offering QHPs only onthe FF–SHOPs. We note that, in thisfinal rule, FFEs include FFEs in statesthat perform plan managementfunctions. State-Based Exchanges on theFederal Platform (SBE–FPs) are notFFEs, even though consumers in thesestates enroll in coverage throughHealthCare.gov, and QHP issuers inSBE–FPs are not subject to therequirements in this rule.B. OverviewWe are dedicated to enhancing andprotecting the health and well-being ofall Americans. One critical issue in theU.S. health care system is that peoplecannot easily access their healthinformation in interoperable forms.Patients and the health care providersVerDate Sep 11 201408:09 May 01, 2020Jkt 250001caring for them are often presented withan incomplete picture of their healthand care as pieces of their informationare stored in various, unconnectedsystems and do not accompany thepatient to every care setting. Althoughmore than 95 percent of hospitals 1 and75 percent of office-based clinicians 2are utilizing certified health IT,challenges remain in creating acomprehensive, longitudinal view of apatient’s health history.3 4 5 This siloednature of health care data preventsphysicians, pharmaceutical companies,manufacturers, and payers fromaccessing and interpreting importantdata sets, instead, encouraging eachgroup to make decisions based upon apart of the information rather than thewhole. Without an enforced standard ofinteroperability, data exchanges areoften complicated and time-consuming.We believe patients should have theability to move from payer to payer,provider to provider, and have boththeir clinical and administrativeinformation travel with themthroughout their journey. When apatient receives care from a newprovider, a record of their healthinformation should be readily availableto that care provider, regardless ofwhere or by whom care was previouslyprovided. When a patient is dischargedfrom a hospital to a post-acute care(PAC) setting there should be noquestion as to how, when, or wheretheir data will be exchanged. Likewise,when an enrollee changes payers or agesinto Medicare, the enrollee should beable to have their claims history andencounter data follow so thatinformation is not lost. As discussed inmore detail in section III. of this finalrule, claims and encounter data canoffer a more holistic understanding of a1 Office of the National Coordinator. (2019).Hospitals’ Use of Electronic Health Records Data,2015–2017. Retrieved from 2019-04/AHAEHRUseDataBrief.pdf.2 Office of the National Coordinator. (2019,December 18). Health IT Playbook, Section 1:Electronic Health Records. Retrieved from hrecords/.3 Powell, K. R. & Alexander, G. L. (2019).Mitigating Barriers to Interoperability in HealthCare. Online Journal of Nursing Informatics, 23(2).Retrieved from interoperability-health-care.4 Hochman, M., Garber, J., & Robinson, E. J. (2019,August 14). Health Information Exchange After 10Years: Time For A More Assertive, NationalApproach. Retrieved from 0807.475758/full/.5 Payne, T. H., Lovis, C., Gutteridge, C., Pagliari,C., Natarajan, S., Yong, C., & Zhao, L. (2019). Statusof health information exchange: A comparison ofsix countries. Journal of Global Health, 9(2). doi:10.7189/jogh.09.020427.PO 00000Frm 00003Fmt 4701Sfmt 470025511patient’s health, providing insights intoeverything from the frequency and typesof care provided and for what reason,medication history and adherence, andthe evolution and adherence to a careplan. This information can empowerpatients to make better decisions andinform providers to support betterhealth outcomes.For providers in clinical andcommunity settings, health informationtechnology (health IT) should be aresource, enabling providers to deliverhigh quality care, creating efficienciesand allowing them to access all payerand provider data for their patients.Therefore, health IT should not detractfrom the clinician-patient relationship,from the patient’s experience of care, orfrom the quality of work life forphysicians, nurses, other health careprofessionals, and social serviceproviders. Through standards-basedinteroperability and informationexchange, health IT has the potential tofacilitate efficient, safe, high-qualitycare for individuals and populations.All payers should have the ability toexchange data seamlessly with otherpayers for timely benefits coordinationor transitions, and with health care andsocial service providers to facilitatemore coordinated and efficient care.Payers are in a unique position toprovide enrollees with a comprehensivepicture of their claims and encounterdata, allowing patients to piece togethertheir own information that mightotherwise be lost in disparate systems.This information can contribute tobetter informed decision making,helping to inform the patient’s choice ofcoverage options and care providers tomore effectively manage their ownhealth, care, and costs.We are committed to working withstakeholders to solve the issue ofinteroperability and patient access inthe U.S. health care system whilereducing administrative burdens onproviders and are taking an activeapproach using all available policylevers and authorities to moveparticipants in the health care markettoward interoperability and the secureand timely exchange of health careinformation.C. Executive Order and MyHealthEDataOn October 12, 2017, PresidentTrump issued Executive Order 13813 toPromote Healthcare Choice andCompetition Across the United States.Section 1(c)(iii) of Executive Order13813 states that the Administrationwill improve access to, and the qualityof, information that Americans need tomake informed health care decisions,including information about health careE:\FR\FM\01MYR2.SGM01MYR2

25512Federal Register / Vol. 85, No. 85 / Friday, May 1, 2020 / Rules and Regulationsprices and outcomes, while minimizingreporting burdens on impactedproviders, and payers, meaningproviders and payers subject to thisrule.In support of Executive Order 13813,the Administration launched theMyHealthEData initiative. Thisgovernment-wide initiative aims toempower patients by ensuring that theyhave access to their own healthinformation and the ability to decidehow their data will be used, whilekeeping that information safe andsecure. MyHealthEData aims to breakdown the barriers that prevent patientsfrom gaining electronic access to theirhealth information from the device orapplication of their choice, empoweringpatients and taking a critical steptoward interoperability and patient dataexchange.In March 2018, the White HouseOffice of American Innovation and theCMS Administrator announced thelaunch of MyHealthEData, and CMS’sdirect, hands-on role in improvingpatient access and advancinginteroperability. As part of theMyHealthEData initiative, we are takinga patient-centered approach to healthinformation access and moving to asystem in which patients haveimmediate access to their computablehealth information such that they can beassured that their health informationwill follow them as they movethroughout the health care system fromprovider to provider, payer to payer. Toaccomplish this, we have launchedseveral initiatives related to data sharingand interoperability to empowerpatients and encourage payer andprovider competition. We continue toadvance the policies and goals of theMyHealthEData initiative throughvarious provisions included in this finalrule.As finalized in this rule, our policiesare wide-reaching and will have animpact on all facets of the health caresystem. Several key touch points of thepolicies in this rule include: Patients: Enabling patients to accesstheir health information electronicallywithout special effort by requiring thepayers subject to this final rule to makedata available through an applicationprogramming interface (API) to whichthird-party software applicationsconnect to make data available topatients for their personal use. Thisencourages patients to take charge ofand better manage their health care, andthus these initiatives are imperative toimproving a patient’s long-term healthoutcomes. Clinicians and Hospitals: Ensuringthat health care providers have readyVerDate Sep 11 201408:09 May 01, 2020Jkt 250001access to health information about theirpatients, regardless of where the patientmay have previously received care. Weare also implementing policies toprevent health care providers frominappropriately restricting the flow ofinformation to other health careproviders and payers. Finally, we areworking to ensure that betterinteroperability reduces the burden onhealth care providers. Payers: Implementing requirementsto ensure that payers (that is, entitiesand organizations that pay for healthcare), such as payers in MedicareAdvantage, Medicaid, and CHIP, makeenrollee electronic health informationheld by the payer available through anAPI such that, with use of softwareexpected to be developed by payers andthird parties, the information becomeseasily accessible to the enrollee and dataflow seamlessly with the enrollee assuch enrollees change health care andsocial service providers and payers.Additionally, our policies ensure thatpayers make it easy for current andprospective enrollees to identify whichproviders are within a given plan’snetwork in a way that is simple andeasy for enrollees to access andunderstand, and thus find the providersthat are right for them.As a result of our efforts tostandardize data and technicalapproaches to advance interoperability,we believe health care providers andtheir patients, as well as other keyparticipants within the health careecosystem such as payers, will haveappropriate access to the informationnecessary to coordinate individual care;analyze population health trends,outcomes, and costs; and managebenefits and the health of populations,while tracking progress through qualityimprovement initiatives. We areworking with other federal partnersincluding the Office of the NationalCoordinator for Health InformationTechnology (ONC) on this effort withthe clear objectives of improving patientaccess and care, alleviating providerburden, and reducing overall health carecosts, all while taking steps to protectthe privacy and security of patients’personal health information. Asevidence of this partnership, ONC isreleasing the ONC 21st Century CuresAct final rule (published elsewhere inthis issue of the Federal Register) intandem with this final rule. It is thiscoordinated federal effort, inconjunction with strong support andinnovation from our stakeholders, thatwill help us move ever closer to trueinteroperability.PO 00000Frm 00004Fmt 4701Sfmt 4700D. Past EffortsThe Department of Health and HumanServices (HHS) has been working toadvance the interoperability ofelectronic health information for over 15years. For a detailed explanation of pastefforts, see the CMS Interoperability andPatient Access proposed rule (84 FR7612 through 7614).E. Challenges and Barriers toInteroperabilityThrough significant stakeholderfeedback, we understand that there aremany barriers to interoperability, whichhave obstructed progress over the years.We have conducted stakeholdermeetings and roundtables; solicitedcomments via RFIs; and receivedadditional feedback through letters andrulemaking. All of this input togethercontributed to the policies in ourInteroperability and Patient Accessproposed rule, and when combinedwith the comments we received on theproposed rule, the content of this finalrule. Some of the main barriers sharedwith us, specifically patientidentification, lack of standardization,information blocking, the lack ofadoption and use of certified health ITamong post-acute care (PAC) providers,privacy concerns, and uncertainty aboutthe requirements of the HealthInsurance Portability andAccountability Act of 1996 (HIPAA)Privacy, Security, and BreachNotification Rules, were discussed inthe proposed rule (84 FR 7614 through7617). While we have made efforts toaddress some of these barriers in thisfinal rule and through prior rules andactions, we believe there is stillconsiderable work to be done toovercome some of these challengestoward achieving interoperability, andwe will continue this work as we moveforward with our interoperabilityefforts.F. Summary of Major ProvisionsThis final rule empowers patients inMA organizations, Medicaid and CHIPFFS programs, Medicaid managed careplans, CHIP managed care entities, andQHP issuers on the FFEs, by finalizingseveral initiatives that will break downthose barriers currently keeping patientsfrom easily accessing their electronichealth care information. Additionally,the rule creates and implements newmechanisms to enable patients to accesstheir own health care informationthrough third-party softwareapplications, thereby providing themwith the ability to decide how, when,and with whom to share theirinformation.E:\FR\FM\01MYR2.SGM01MYR2

Federal Register / Vol. 85, No. 85 / Friday, May 1, 2020 / Rules and RegulationsWe are finalizing with modificationsour proposal to require MAorganizations, Medicaid and CHIP FFSprograms, Medicaid managed careplans, CHIP managed care entities, andQHP issuers on the FFEs to implementand maintain a standards-based PatientAccess API. This Patient Access APImust meet the technical standardsfinalized by HHS in the ONC 21stCentury Cures Act final rule (publishedelsewhere in this issue of the FederalRegister) at 45 CFR 170.215 (currentlyincluding Health Level 7 (HL7) FastHealthcare Interoperability Resources (FHIR) Release 4.0.1) and the contentand vocabulary standards finalized byHHS in the ONC 21st Century Cures Actfinal rule (published elsewhere in thisissue of the Federal Register) at 45 CFR170.213, as well as content andvocabulary standards at 45 CFR part 162and the content and vocabularystandards at 42 CFR 423.160. We arefinalizing that through the PatientAccess API, payers must permit thirdparty applications to retrieve, with theapproval and at the direction of acurrent enrollee, data specified at 42CFR 422.119, 431.60, 457.730, and 45CFR 156.221. Specifically, we arerequiring that the Patient Access APImust, at a minimum, make availableadjudicated claims (including providerremittances and enrollee cost-sharing);encounters with capitated providers;and clinical data, including laboratoryresults (when maintained by theimpacted payer). Data must be madeavailable no later than one (1) businessday after a claim is adjudicated orencounter data are received. We arerequiring that beginning January 1,2021, impacted payers make availablethrough the Patient Access API thespecified data they maintain with a dateof service on or after January 1, 2016.This is consistent with the requirementsfor the payer-to-payer data exchangedetailed in section V. of this final rule.Together these policies facilitate thecreation and maintenance of a patient’scumulative health record with theircurrent payer.We are finalizing regulations torequire that MA organizations, Medicaidand CHIP FFS programs, Medicaidmanaged care plans, and CHIP managedcare entities make standardizedinformation about their providernetworks available through a ProviderDirectory API that is conformant withthe technical standards finalized byHHS in the ONC 21st Century Cures Actfinal rule (published elsewhere in thisissue of the Federal Register) at 45 CFR170.215, excluding the securityprotocols related to user authenticationVerDate Sep 11 201408:09 May 01, 2020Jkt 250001and authorization and any otherprotocols that restrict availability of thisinformation to particular persons ororganizations. Authentication andauthorization protocols are notnecessary when making publiclyavailable data accessible via an API. Weare finalizing that the Provider DirectoryAPI must be accessible via a publicfacing digital endpoint on the payer’swebsite to ensure public discovery andaccess. At a minimum, these payersmust make available via the ProviderDirectory API provider names,addresses, phone numbers, andspecialties. For MA organizations thatoffer MA–PD plans, they must alsomake available, at a minimum,pharmacy directory data, including thepharmacy name, address, phonenumber, number of pharmacies in thenetwork, and mix (specifically the typeof pharmacy, such as ‘‘retailpharmacy’’). All directory informationmust be made available to current andprospective enrollees and the publicthrough the Provider Directory APIwithin 30 calendar days of a payerreceiving provider directory informationor an update to the provider directoryinformation. The Provider Directory APIis being finalized at 42 CFR 422.120 forMA organizations, at 42 CFR 431.70 forMedicaid state agencies, at 42 CFR438.242(b)(6) for Medicaid managedcare plans, at 42 CFR 457.760 for CHIPstate agencies, and at 42 CFR457.1233(d)(3) for CHIP managed careentities. Here we are finalizing thataccess to the published ProviderDirectory API must be fullyimplemented by January 1, 2021. We dostrongly encourage payers to make theirProvider Directory API public as soon aspossible to make and show progresstoward meeting all the API requirementsbeing finalized in this rule.We are finalizing our proposal, withcertain modifications as detailed insection V. of this final rule, to requireMA organizations, Medicaid managedcare plans, CHIP managed care entities,and QHP issuers on the FFEs tocoordinate care between payers byexchanging, at a minimum, the dataelements specified in the currentcontent and vocabulary standardfinalized by HHS in the ONC 21stCentury Cures Act final rule (publishedelsewhere in this issue of the FederalRegister) at 45 CFR 170.213 (currentlythe ‘‘United States Core Data forInteroperability’’ (USCDI) version 1 6).This payer-to-payer data exchange6 Office of the National Coordinator. (n.d.). U.S.Core Data for Interoperability (USCDI). Retrievedfrom ability-uscdi.PO 00000Frm 00005Fmt 4701Sfmt 470025513requires these payers, as finalized at 42CFR 422.119(f) for MA organizations, at42 CFR 438.62(b)(1)(vi) for Medicaidmanaged care plans (and by extensionunder § 457.1216 CHIP managed careentities), and at 45 CFR 156.221(f) forQHP issuers on the FFEs, to send, at acurrent or former enrollee’s request,specific information they maintain witha date of service on or after January 1,2016 to any other payer identified bythe current enrollee or former enrollee.This is consistent with the PatientAccess API detailed in section III. of thisfinal rule. We are also finalizing aprovision that a payer is only obligatedto share data received from anotherpayer under this regulation in theelectronic form and format it wasreceived. This is intended to reduceburden on payers. We are finalizing thatthis payer-to-payer data exchange mustbe fully implemented by January 1,2022.In response to comments discussedmore fully below, we are not finalizingour proposal to require MAorganizations, Medicaid managed careplans, CHIP managed care entities, andQHP issuers on the FFEs to participatein a trusted exchange network given theconcerns commenters raised regardingthe need for a mature Trusted ExchangeFramework and Common Agreement(TEFCA) to be in place first, andappreciating that work on TEFCA isongoing at this time.We are finalizing the requirementsthat all states participate in dailyexchange of buy-in data, which includesboth sending data to CMS and receivingresponses from CMS daily, and that allstates submit the MMA file data to CMSdaily by April 1, 2022 in accordancewith 42 CFR 406.26, 407.40, and423.910, respectively, as proposed.These requirements will improve theexperience of dually eligible individualsby improving the ability of providersand payers to coordinate eligibility,enrollment, benefits, and/or care for thispopulation.We are finalizing our proposal toinclude an indicator on PhysicianCompare for the eligible clinicians andgroups that submit a ‘‘no’’ response toany of the three prevention ofinformation blocking statements forMIPS. In the event that these statementsare left blank, the attestations will beconsidered incomplete, and we will notinclude an indicator on PhysicianCompare. The indicator will be postedon Physician Compare, either on theprofile pages or in the downloadabledatabase, starting with the 2019performance period data available forpublic reporting starting in late 2020.E:\FR\FM\01MYR2.SGM01MYR2

25514Federal Register / Vol. 85, No. 85 / Friday, May 1, 2020 / Rules and RegulationsWe are finalizing our proposal toinclude information on a publiclyavailable CMS website indicating thatan eligible hospital or critical accesshospital (CAH) attesting under theMedicare FFS PromotingInteroperability Program had submitteda ‘‘no’’ response to any of the threeattestation statements related to theprevention of information blocking. Inthe event that an eligible hospital orCAH leaves a ‘‘blank’’ response, theattestations will be consideredincomplete, and no information will beposted related to these attestationstatements. We will post thisinformation starting with theattestations for the EHR reporting periodin 2019 and expect this information willbe posted in late 2020.Additionally, as detailed in sectionIX. of this final rule, we are finalizingour proposal to publicly report thenames and NPIs of those providers whodo not have digital contact informationincluded in the National Plan andProvider Enumeration System (NPPES)system beginning in the second half of2020 as proposed. Additionally, we willcontinue to ensure providers are awareof the benefits of including digitalcontact information in NPPES, andwhen and where their names and NPIswill be posted if they do not includethis information. We do stronglyencourage providers to include FHIRendpoint information in NPPES if andwhen they have the information, aswell.To further advance electronicexc

Denise St. Clair, (410) 786–4599, for issues related API policies and related standards. Natalie Albright, (410) 786–1671, for issues related to Medicare Advantage. Laura Snyder, (410) 786–3198, for issues related to Medicaid. Rebecca Zimmermann, (301) 492– 4396, for issues related to Qualified Health Plans.