21st Century Cures Act

The 21st Century Cures Act is a US federal law that speeds medical product development and makes sharing electronic health information the norm. Signed on 13 December 2016 as Public Law 114-255, it reshaped how providers and health IT vendors release patient records.

Most people meet the law through its two very different halves. One half sits with the US Food and Drug Administration (FDA) and covers drugs, biological products and devices.

The other half sits with health IT and governs who may withhold a patient record, and when.

That second half is the one outsourced healthcare teams feel daily. Release-of-information queues, patient record requests and application programming interface (API) exchanges all run against a legal expectation that data moves unless a listed exception applies.

The Cures Act does not care whether a delay was deliberate. It cares whether a practice is likely to interfere with access, exchange or use of electronic health information. That distinction is why process design matters as much as intent.

Key takeaways

• The Cures Act became law on 13 December 2016 as Public Law 114-255.
• Per the FDA, it aims to speed medical product development and bring advances to patients faster.
• Information blocking rules apply to providers, certified health IT developers, and exchanges or networks.
• Exceptions define reasonable and necessary activities that do not count as information blocking.
• Outsourced record-request and API workflows sit directly inside the compliance perimeter.

How it works

The law works on two tracks. The FDA track modernises how drugs, biological products and devices reach patients. The health IT track defines information blocking, names who is covered, and sets out the exceptions that make certain refusals lawful.

Per the Office of the National Coordinator for Health Information Technology (ONC), information blocking is a practice by an “actor” likely to interfere with the access, exchange or use of electronic health information (EHI).

The exclusions are narrow: required by law, or covered by a published exception.

The Act named three actor types and authorised the Secretary of Health and Human Services (HHS) to identify reasonable and necessary activities that do not constitute information blocking.

It also established two different knowledge standards for actors’ practices — so the bar shifts depending on who you are.

Read the statute text through the FDA’s 21st Century Cures Act page and the sharing rules through the ONC information blocking overview. The ONC Cures Act Final Rule carries the implementation detail plus certification criteria.

Certification matters because it decides which vendors count as actors. A developer of certified health IT is inside the perimeter; the same product uncertified sits elsewhere.

Examples

The Cures Act shows up wherever patient data changes hands. Three settings make it concrete: a hospital release-of-information desk, a vendor running certified software, and a health information exchange moving records across state lines.

A hospital record request. A patient asks for their chart through a portal. If the electronic health record (EHR) holds the data and no exception applies, a “we batch these weekly” policy is an interference risk, not a workflow choice.

A certified software vendor. A developer of certified health IT throttles an API so a competing app pulls data slowly. Because the vendor is a named actor, that throttling is measured against the exceptions, not against commercial reasoning.

An exchange between unaffiliated systems. A health information exchange refuses a records pull citing an internal rule. Since 2016, the expected norm is sharing — so the exchange has to point at a listed exception rather than custom.

An outsourced back office. A healthcare call center team handling record requests, medical transcription turnaround and medical coding queues inherits the same expectations as the client who hired them.

Related terms

The Cures Act sits inside a cluster of health data terms. Each one below touches either the record itself, the way records move between organisations, or the privacy rules that decide what a team may lawfully withhold from a requester.

• Interoperability in Health IT: the ability of systems to exchange and use data across vendors.
• Electronic Medical Record (EMR): a single practice’s digital chart, narrower than an EHR.
• HIPAA Compliance: the privacy and security rules that sit alongside Cures Act sharing duties.
• Telehealth: remote clinical care that generates records subject to the same access rules.
• Remote Patient Monitoring: device-generated patient data feeding back into the chart.
• Population Health: analysis across cohorts that depends on shared, comparable data.

FAQ

When was the 21st Century Cures Act signed?

It was signed into law on 13 December 2016 as Public Law 114-255 in the United States.

What does the Cures Act actually do?

Per the FDA, it helps accelerate medical product development and bring new innovations to patients faster, building on work to include patient perspectives in developing drugs, biological products and devices.

What counts as information blocking?

ONC defines it as a practice by an actor likely to interfere with the access, exchange or use of electronic health information, except where required by law or covered by an exception.

Who has to follow the information blocking rules?

Three actor types: health care providers, health IT developers of certified health IT, and health information exchanges or health information networks.

Does the Cures Act apply to outsourced healthcare teams?

Outsourced teams run the record-request, transcription and API queues where blocking risk appears — so the client’s obligations shape how those workflows must be built.

Compare healthcare-experienced providers in the Outsource Accelerator directory before handing record workflows to an outside team.