A federal law requires health care providers (physicians, hospitals and nursing facilities) to give patients online access to the patients’ health records with the Cures Act release of medical records.

The requirement came from the 21st Century Cures Act, which was passed with bipartisan support and signed by President Barack Obama in 2016. In 2021 and 2022, regulations (referred to as “Final Rules”) to implement the new law were issued by the Office of the National Coordinator for Health Information Technology and the Centers for Medicare & Medicaid Services.

Goal of law

When the regulations were issued, the U.S. Department of Health and Human Services said, “Putting patients in charge of their health records is a key piece of giving patients more control in health care.”

The law prohibits health care providers from “blocking information” or taking other steps that unreasonably interfere with the patient obtaining access to the information. Patients are supposed to be able to access their information on smartphones or other devices at no charge.

The regulations promote “interoperability,” which refers to the ability of different information systems and devices to access and exchange data in a coordinated manner.

Information that must be available

Information that must be available to patients includes reports of their demographics, vital signs, medications, clinical notes, laboratory tests, diagnostic imaging and clinical tests.

Exceptions to disclosure

The rules contain exceptions to the disclosure requirements. “Psychotherapy notes” need not be released. “Psychotherapy notes” are notes recorded by a mental health professional “documenting or analyzing the content of conversation” during an individual or group counseling session that are separated from the rest of the individual’s medical record.

The “psychotherapy notes” do not include medication prescriptions, medication monitoring, the results of clinical tests, counseling session start and stop times, and summaries of diagnosis, symptoms, functional status, treatment plan and prognosis. Those categories of information contained in medical records would be accessible to the patient.

Another exception to disclosure is “Information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding.”

Risk of physical harm to patient or other person

In addition, the rules list eight other exceptions in which blocking of information would be permissible. These exceptions are narrow in their application.

The exceptions include a substantial risk of physical harm to the patient or another person. If this exception is used, the determination must be made on “a case-by-case basis, identifying the criteria used” and the determination must be made “by a licensed health care professional who has a current or prior clinician-patient relationship with the patient.”

If a physician is concerned that patients the physician has sent for cancer testing would be emotionally distressed to learn of their cancer diagnoses by logging onto a hospital’s electronic medical records, the physician may not adopt a general approach that cancer results may not be released to patients until after a certain period of time, such as three days after the physician receives the report.

There are two problems with such an attempt to limit patients’ access to information. First, the exception under the rule is intended only for physical harm, not psychological harm. Second, the application of the exception must be made on a case-by-case basis—not by blanket directive.

Although for the most part, patients are able to access their online records whenever they wish, providers can shut down access if necessary to maintain or improve the information system or if the request for information cannot be fulfilled because of a natural or human-made disaster.

Who sees reports first

A consequence of the disclosure requirements under the Cures Act is that patients may see reports about their condition before the physician who ordered the test sees the report.

For example, if a physician orders a biopsy, blood test or imaging to determine if a patient has cancer, those results would be posted on the patient’s electronic medical record, and the patient might access that record before the treating physician.

If the physician wants to avoid that circumstance, the physician may wish to work with pathologists and radiologists to have protocols by which the pathologists and radiologists will telephone the physician to report a new cancer diagnosis before the information is posted to electronic medical records. Some institutions have such protocols in place already.

The physician then can personally inform the patient of a new diagnosis and discuss a treatment plan.

It also is good practice for physicians to inform patients about how the electronic medical record system works and explain that sometimes the patient might see reports before the physician does. The patient can be reassured that the physician will be available to discuss the report with the patient.

In addition, depending on how the information system works, the physician or member of the physicians’ staff could attach a note to the electronic report, letting the patient know when the physician will discuss the report with the patient.

Benefits of sharing records

A toolkit published online by the AMA found more benefits than drawbacks to the new disclosure rules (“Sharing Clinical Notes With Patients–A New Era of Transparency in Medicine”).

The authors said that patients who read their medical records “feel more in control of and engaged in their health care” and “have a better understanding of their medical conditions and medications.”

Jeff Atkinson is a professor for the Illinois Judicial Conference and has taught health care law at DePaul University College of Law in Chicago.