View Rule

View EO 12866 Meetings Printer-Friendly Version     Download RIN Data in XML

HHS/CMS RIN: 0938-AT79 Publication ID: Fall 2019 
Title: Interoperability and Patient Access (CMS-9115-F) 

To support this Administration’s goals of interoperability, as well as the vision of the 21st Century Cures Act and EO 13813, this rule responds to comments received on the proposal regarding policy changes to move the health care industry toward a more accessible and interoperable healthcare ecosystem.

Agency: Department of Health and Human Services(HHS)  Priority: Economically Significant 
RIN Status: Previously published in the Unified Agenda Agenda Stage of Rulemaking: Long-Term Actions 
Major: Yes  Unfunded Mandates: No 
EO 13771 Designation: Regulatory 
CFR Citation: 42 CFR 406 and 407    42 CFR 422 and 423    ...     (To search for a specific CFR, visit the Code of Federal Regulations.)
Legal Authority: 42 U.S.C. 1395    42 U.S.C. 1302    Pub. L. 111-148   
Legal Deadline:
Action Source Description Date
Final  Statutory  MMA sec. 902 requires Medicare final rules to publish within 3 years of a proposed or interim final rule.  03/04/2022 

Overall Description of Deadline: Per the CMS notice published December 30, 2004 (69 FR 78442), except for certain Medicare payment regulations and certain other statutorily-mandated regulations, we schedule all Medicare final regulations for publication within the 3-year standardized time limit in the current Unified Agenda. We do not intend to delay publishing a Medicare final regulation for 3 years if we are able to publish it sooner.

Statement of Need:

This final rule is intended to move the health care ecosystem in the direction of interoperability. This rule is part of the Agency’s broader efforts under the MyHealthEData Initiative to empower patients by ensuring that they have full access to their own health care information. These policies aim to break down the barriers that prevent patients from gaining electronic access to their health information from the device or application of their choice, while keeping that information safe and secure. Additionally, these policies create and implement new mechanisms to enable patients to access their own health care information through third-party software applications providing them with the ability to decide how, when, and with whom to share their information.  In this way, this rule offers a patient-centered approach to health information access and moves to a system in which patients have immediate access to their computable health information and can be assured that their health information will follow them as they move throughout the health care system from provider to provider, payer to payer. These policies impact CMS regulated payers including Medicare Advantage, Medicaid and CHIP FFS and managed care, and QHP issuers in FFE, as well as Medicare providers, with the ultimate goal of empowering patients, while working to improve care and reduce burden and cost.  As a result of our efforts to standardize data and technical approaches to advance interoperability, we believe health care providers and their patients, as well as payers, will have appropriate access to the information necessary to coordinate individual care; analyze population health trends, outcomes, and costs; and manage benefits and the health of populations, while tracking progress through quality improvement initiatives.

Summary of the Legal Basis:

This rule signals our commitment to the vision set out in the 21st Century Cures Act and Executive Order 13813 to improve quality and accessibility of information that Americans need to make informed health care decisions, including data about health care prices and outcomes, while minimizing reporting burdens on affected health care providers and payers.


Through our review of the comments on the NPRM, we carefully considered the alternatives to this final rule.

Anticipated Costs and Benefits:

Preliminary estimates of the anticipated costs and benefits of this proposed rule indicate that the rule is economically significant.  As we move toward publication, estimates of costs and benefits will be included in the final rule.


The privacy and security of personal health information is critically important. When a patient requests for their health information to be made available to third-party applications, there is an increased risk that these data could be compromised. Appreciating this risk, we have included provisions within the final rule to leverage available privacy and security tools, and we are requiring that patients be provided clear, consumer-friendly information about how to choose applications as well as their rights and the risks involved in sharing their data. We also encourage application developers to follow our lead and include plain language terms and conditions so that patients know exactly how their data could be used.

Action Date FR Cite
NPRM  03/04/2019  84 FR 7610   
NPRM Comment Period Extended  04/23/2019  84 FR 16834   
NPRM Comment Period End  05/03/2019 
NPRM Comment Period Extended End  06/03/2019 
Final Action  03/00/2022 
Regulatory Flexibility Analysis Required: No  Government Levels Affected: Federal, State 
Federalism: No 
Included in the Regulatory Plan: Yes 
RIN Data Printed in the FR: No 
Agency Contact:
Alexandra Mugge
Director & Deputy Chief Health Informatics Officer, Health Informatics and Interoperability Group
Department of Health and Human Services
Centers for Medicare & Medicaid Services
Office of Burden Reduction and Health Informatics, MS: C5-02-00, 7500 Security Boulevard,
Baltimore, MD 21244
Phone:410 786-4457