APMA News - September/October 2021 - 27

Will any of the exceptions to information blocking apply
when a patient requests their health information
through a community or shared computer while living
in an assisted-living facility?
Possibly, yes. Although information blocking is generally prohibited
by the Cures Act, providers may take certain actions to prevent
access to EHI when it is reasonable and necessary.9
The two
potential exceptions that could apply to the issue regarding a
patient accessing their information through the use of a shared
computer are the privacy exception, or the security exception.
* The privacy exception grants that a provider may block electronic
access to EHI if their intent is to protect the privacy of
the individual whose information could be accessed.10
The
privacy exception sub-exception related to fulfi lling a precondition
(such as obtaining patient consent or prior authorization)
may apply to podiatry. For example, when a patient
living in an assisted-living facility accesses their own EHI on
a community-based computer, such patient information
may be exposed after they have completed reviewing their
EHI. This situation is a privacy risk because the patient may
not be consenting or authorizing for the disclosure of their
EHI, and as such, it is reasonable for a provider to prevent
access to EHI through the use of the shared computer.
* The security exception grants that a provider may block
access to EHI if there is a threat to the " confi dentiality, integrity,
and availability " of the patient's information.11
This
exception does not specify a general security approach that
providers must use, but the security approach must be implemented
consistently and in a non-discriminatory manner.12
APMA
gratefully acknowledges the support of PICA in providing
Coverage Corner to help inform and educate members.
Therefore, as long as the implementation is done in a
consistent and non-discriminatory manner, then the podiatry
practice can point to this exception when blocking access
to EHI.
Does the Cures Act require a provider to give access
to the patient's information to an individual who has
power of attorney (POA) or is an authorized representative
party?
Yes, an individual who has a POA, or who is an authorized
representative, must be allowed to access the patient's EHI, unless
an exception applies, or state law prohibits such access.
When an individual has been designated a patient's agent under
a POA, or is a personal representative of the patient, they
may have access to health information about the patient unless
an exception applies. As discussed above, the preventing harm
exception or the privacy exception could in rare cases apply
and excuse the provider from disclosing a patient's EHI.
As noted earlier, the preventing harm exception will only
apply if the provider reasonably believes that withholding the
1 21st Century Cures Act of 2016, Pub. L. No. 114-255, 130 Stat. 1033.
2 42 U.S.C. § 300jj(3) (The Cures Act defi nes health-care providers broadly
to include: a physician practice and a practitioner.).
3
4
See 21st Century Cures Act, Pub. L. No. 114-255, at sec. 4006.
Id.
5 The Health Insurance Portability and Accountability Act ( " HIPAA " ) of
1996, Privacy and Security Rules, Pub. L. No. 104-191, 110 Stat. 1936.
6
45 C.F.R. § 171.201.
7 45 C.F.R. § 171.202.
Id.
8
9 See 21st Century Cures Act, Pub. L. No. 114-255, at sec. 4004(a)(3).
10 45 C.F.R. § 171.202.
11 45 C.F.R. § 171.203.
12
Id.
13 45 C.F.R. § 171.201.
14 45 C.F.R. § 171.202.
EHI is necessary to prevent harm to a patient or another person.13
Additionally,
the privacy exception may also apply if
one of the sub-exceptions qualifi es.14
The privacy exception
will also excuse a provider from disclosing the patient's medical
records if it is prohibited under state or federal law.
In summary, the POA or representative must be allowed to
access the patient's EHI, unless an exception applies or there
is a law prohibiting such access.
What's the bottom line?
The Cures Act applies to minor patients, and their parents
must be given access to their EHI through any application that
is secure. Additionally, the Cures Act requires that patients'
proxies, such as POAs, must have full access to the patient's
EHI, unless an exception applies. These exceptions may be applicable
depending on the circumstances and are fact dependent
but are not likely to occur in the podiatry fi eld.
Editor's Note: Read more about information blocking
and access APMA resources at www.apma.org/
informationblocking. n
APMA News September/October 2021 27
http://www.apma.org/informationblocking http://www.apma.org/informationblocking
APMA News - September/October 2021

Table of Contents for the Digital Edition of APMA News - September/October 2021
