Is my practice required to offer a patient portal?

It's one of the most common questions practice administrators ask as they navigate the tangle of federal health IT rules: Do we legally have to offer patients a portal? The short answer is nuanced. No single law flatly mandates that every practice deploy a patient portal, but a web of overlapping regulations creates powerful incentives — and, in some cases, real obligations — that make offering one nearly unavoidable.

Q: Is there a law that specifically requires practices to have a patient portal?

A: Not exactly. No federal statute contains language saying "you must operate a patient portal." But as the American Medical Association explains, the legal landscape is more like a puzzle, with HIPAA, state laws, the Promoting Interoperability program and the federal information blocking rules all fitting together, and that puzzle strongly favors providing patients with electronic access to their records. HIPAA provides patients the right to access most of their health information in their preferred form and format, as long as the practice is technically able to do so. A portal is the most practical way to deliver that access at scale.

Q: What does the 21st Century Cures Act have to do with this?

A: Quite a bit. The 21st Century Cures Act was signed into law in 2016 with overwhelming bipartisan support, and information sharing is central to its requirements. The law's final rule, enforced by the Office of the National Coordinator for Health Information Technology, or ONC, prohibits what regulators call "information blocking." Beginning in November 2020, federal regulation prohibited health care systems and providers from blocking health information from patients, requiring the immediate release of information such as clinical notes, laboratory data, imaging and pathology reports.

As Physicians Practice has reported, that definition of information blocking is broad. ONC has provided examples of practices that may constitute information blocking, including imposing fees that make exchanging electronic health information cost-prohibitive, using organizational policies or contractual arrangements that prevent or limit sharing, and inappropriately citing HIPAA as a reason not to share information. You don't need to be doing something obviously wrong to run afoul of the rule.

Q: Does this mean my practice could be penalized for not having a portal?

A: Potentially, yes, though enforcement has been uneven. As Physicians Practice has covered, the 21st Century Cures Act’s information blocking rules carry real teeth. More than 75% of the complaints HHS has received regarding organizations barring access to patient data have involved health care providers. Complaints can be filed with ONC, and HHS has signaled that closing the enforcement gap is a priority.

It's also worth noting how the rule is framed. According to Physicians Practice's coverage of Cures Act compliance, patients who have trouble with portal technology may mistake a poor user experience as an intentional attempt at information blocking and lodge a complaint. Even a clunky or outdated portal can create legal exposure.

Q: What about the Promoting Interoperability program? Does that apply to my practice?

A: If your practice participates in Medicare or Medicaid and wants to maximize reimbursement, then yes. The Promoting Interoperability program, formerly called Meaningful Use, ties payment incentives to demonstrating that patients can electronically access their records. As Physicians Practice has explained, stage 2 required that more than 50% of all unique patients seen by an eligible provider be given online access to their health information within four business days, and that more than 5% of all unique patients view, download or transmit their health information to a third party. A patient portal is by far the most common vehicle for meeting those thresholds.

Practices that fail to participate face Medicare payment reductions. In that sense, while a portal is not legally mandated, the financial consequences of going without one in a Medicare-participating practice can be significant.

Q: Are there exceptions? What if we're a small practice or don't use an EHR?

A: The information blocking rule applies to any practice that qualifies as a health care provider under the Cures Act, regardless of size. However, the rule does recognize exceptions. The information blocking rule does not require practices to store records in any particular file system or adopt any particular technology. The rule prohibits only an unnecessary delay in providing patient records from whatever storage format or system the practice currently uses. So if you do not maintain electronic health information at all, the information blocking rule's scope is limited.

That said, the information blocking law applies only to electronic health information; therefore, information that exists solely in paper form is entirely exempt from its scope. Practices that have not yet adopted an electronic health record (EHR) face a different calculus, but as EHR adoption has become nearly universal, the practical shelter of a paper-only argument has largely closed.

Q: What kinds of information must be made available if we do have an EHR?

A: The scope has expanded considerably since the rule took effect. As Physicians Practice has reported, ONC expanded its definition of information blocking so that data required to be accessible applies not only to the data elements contained in the United States Core Data for Interoperability, but also to electronic protected health information as defined under HIPAA's designated record set. In plain terms, that covers a wide range of clinical and billing records.

Physicians Practice has also broken down the key definitions of protected health information (PHI), electronic PHI and electronic health information, noting that knowing the exceptions to information blocking and having an alternative method to deliver patients their electronic health information is just as critical as knowing what may constitute an information blocking violation.

Q: Even if we're not strictly required to have a portal, is it still a good idea?

A: Most practice management experts would say it is an operational no-brainer. Physicians Practice has covered patient portal adoption extensively, and the business case is strong. As reported in Patient Portals: Beyond Meaningful Use, letting patients make their own appointments on a portal has reduced call volumes by 20% to 30% at some practices, and the elimination of most faxes has allowed some practices to get by with fewer support staff.

As Physicians Practice has noted, portals help patients take a more active role in their care and control the way their information is managed. And the cost of running a practice can be reduced by using a portal. Getting patients off the phone gets staff off the phone, which either frees staff to do other tasks or reduces the number of staff needed.

The patient satisfaction angle matters too. Physicians Practice has highlighted must-have patient portal features that help practices reduce no-shows and cut phone tag, including self-scheduling with live provider calendar availability and HIPAA-compliant secure messaging routed through clinical staff.

Q: What should we do if we're uncertain about our obligations?

A: Start with your EHR vendor. Most certified EHR systems include a patient portal or can connect to one, and your vendor can help identify what information is automatically flowing to patients and what may require configuration. The AMA's Patient Access Playbook is a solid, free resource for understanding how HIPAA, state law and the Promoting Interoperability program intersect. ONC also maintains an information blocking FAQ that is updated regularly.

When in doubt, consulting a health care attorney familiar with HIPAA and the Cures Act rules is prudent. The regulatory landscape continues to evolve, and the cost of a compliance review is far lower than the cost of a complaint or penalty.