Today marks the date that payers must adhere to the CMS Interoperability and Patient Access Rule. It’s a powerful, landmark moment for our industry and our country that empowers patient to access their data from payers. There’s still much to come, but it’s also been a long and winding road to get to this point.

Way back in 2016, Congress passed the sprawling “21st Century Cures Act”. It’s from this act that our recent CMS deadline was born, but like most legislation, it actually covered a lot of seemingly unrelated ground — clinical trials processes, study participant protections, opioid prevention funding, medical research, and much more. Contrary to most, however, it appears it was a bundle of pretty darned good regulation through-and-through, with wide ranging impacts on digital health:

• Cures included the restriction of the FDA jurisdiction of medical software solely to devices. Whether making an EHR, creating the next fitness app, or supporting physicians in their clinical decision making, software moves faster than the speed of the FDA. While the agency is hugely important in protecting patients in other areas, preserving the notion of agile software development in healthcare is a very good thing!
• The legislation mandated ONC to find a framework to allow the exchange of patient records and health information between providers, state and regional health information exchanges and federal agencies. The policies they’ve proposed Trusted Exchange Framework and Common Agreement (TEFCA) are voluntary in nature today and still have a very long path until it’s truly an on-ramp for all, but it is idealistic in what it intends to do -finally fulfill a promise of HIPAA and open up exchange between covered entities. Yet another very good thing!
• The “Communications Rule” finally opens communication about vendors’ usability, performance, and patient safety, allowing sharing of things like screenshots and videos. This open transparency means that like-minded organizations can iterate and improve faster than ever.
• Cures defined the concept of “information blocking” and prohibited vendors and providers from exhibiting this behavior. Those who would wish to hold patients’ data hostage finally have no place in healthcare. Providers need to efficiently release EHI upon request, giving patients control of their data.
• Finally there is the patient access rule! Working hand in hand with process-oriented information blocking provisions, this more technical portion of the law requires that patients can electronically access all of their electronic health information, structured and/or unstructured, at no cost. Rolling out this year, next year, and beyond, it will eventually expose not only useful new FHIR APIs, but the entire patient data set electronically when authorized by the patient.

Cures is not the first piece of regulation to push forward the agenda of patient access. HIPAA itself defined that right. Meaningful Use 2 mandated that patients have access to portals and structured downloads. Meaningful Use 3 created the concept of patient APIs. But with its powerful mixture of process and technical standardization, Cures does seem to be the first piece of regulation that may truly succeed in this regard.

The access and control defined in Cures is revolutionary. It defines so clearly how patients can access their data. It demands vendors certify those capabilities to help patients. And it gives legal recourse to firmly and definitively call out those who fail to enable patients. Properly implemented, patients can act as the central hub for their care, sharing and directing their data as needed.

Interestingly enough, last week Congress proposed a Cures 2.0, a successor with again many disparate health related topics. It’s filled with good, but reactive pandemic solutions for testing, infrastructure, education, and readiness. It has continued focus on the interplay between the FDA and the digital era. It hopes to educate caregivers and increase health literacy for patients. By the look of it, all that seems fine to me, but only so long as it doesn’t get in the way or distract from the enforcement of the initial Cures Act. It does not carry forward or advance that cause of patient’s data access and portability. That is a risk that worries me.

With any great revolution also comes those who would oppose it. ONC Cures has had its opponents. Lobbyists waged wars on Washington. The health systems joined together in disapproval. EHR vendors pushed back. The paternalism inherent here is not explicit malfeasance and malevolence — this can come from a good place, wanting to protect, provide, and care for the patient. Health information is impactful and wanting to guide a patient through those impacts is well-intentioned. But this mentality also comes from the underbelly, from institutions under siege from forces of innovation and technology with whom they cannot keep pace.

We are on the cusp in the speed, availability, and cost of medicine through digital health’s alternatives to traditional monopolies. Looking out as we stand at the precipice, hundreds (even thousands) of companies seek to revolutionize care, to be in touch throughout all of a patient’s journey, to understand and end disease through social determinants, through sleep, through emotion. Their approaches have new technology as their core and their foundation, not tacked onto old processes. Whether through the use of chatbots or the continuous engagement of mobile apps or the cost efficiency of highly leveraged providers over thousands of patients, this renaissance requires reinvention from the ground up. The results are undeniable. By virtualizing the doctor’s office (most of primary care and a majority of specialty care), Firefly Health has accomplished 41 low-lift physician touchpoints such as texts, reminders, and virtual visits for the cost of 1 legacy health encounter. Ria Health combines world class alcohol sensation therapy with near real-time access to a personal breathalyzer, allowing therapy to be targeted more effectively than ever before. There are thousands of other examples popping up daily.

Much of our time recently is spent on the largest and most divisive issues of our time — race, war, global climate — which can lead to anxiety or depression, as change moves forward at a glacial pace. But there are simple, practical things we can do to improve. Empowering people with their data and enabling them to move it where they want, when they want is an easy win but an essential win. This is a practical, tactical thing that will immediately help tens of thousands of businesses whose products will dramatically improve millions of peoples’ health, if they are allowed to blossom.

These companies are doing great things and will do even greater things, but their potential to connect into the system and change things if established providers can continue to silo, clench defensively around the data they hold, and end this ascendant, but still nascent threat by suffocation. They have not succeeded previously, but there are still moves they may yet make. We must all be vigilant. This was the intent of HIPAA, this was the intent of the 21st Century Cures Act, and this is the intent we must carry forward into the future.