The ONC Cures Act

Beth Plumptre
May 17, 2023

Anyone curious about the purpose of the 21st Century Cures Act only has to examine its title to get a good idea: accelerating healthcare delivery into a modern, cutting-edge age. Otherwise simply known as the Cures Act, this body of rules looks out for the weightier aspects of healthcare, with provisions regulating research into major diseases, drug and medical device development, and mental healthcare.

In particular, the Cures Act, or more accurately — the Office of the National Coordinator for Health Information Technology Final Rule (ONC Final Rule) — strikes a special chord with healthcare providers, health information exchanges (HIEs), healthcare IT developers, and most especially, patients. This rule explores the potential for quality, yet affordable healthcare via seamless information exchange.

While the original Act is around 312 pages long, we’ll be giving a TL;DR version. Read on to learn the key aspects of the ONC Cures Act, and how its provisions are shaping the present and future of health information exchange across the United States.

What is the ONC Cures Act?

Verbatim, the Cures Act was created to "accelerate the discovery, development, and delivery of 21st-century cures, and for other purposes.” Passed into law in 2016, this Act authorized $4.8 billion to the National Institute of Health (NIH) to support initiatives such as funding drug development and research, empowering small businesses to provide employee health benefits, and widening insurance coverage for mental health care. This Act also became a darling of value-based care, for its provisions to remove technical barriers to healthcare data exchange.

Despite being at the center of healthcare operations, patients often need to be more prioritized when accessing health information. For example, between 2017 and 2018, only 51% and 52% of patients were offered access to their online medical records. Instead, information-sharing processes accommodate internal and external exchanges between healthcare professionals, and even this is often met with handicaps due to technological limitations, information blocking, or administrative hurdles.

The Cures Act recognizes the importance of transparency and ease in accessing and exchanging health information. To redesign a health information ecosystem with the patient as the focus, the ONC and the Centers for Medicare and Medicaid Services (CMS) developed guidelines for implementing the information exchange provisions of the Act. These directives comprise the ONC Final Rule, guidelines that advance much-needed innovation in data exchange.

How is the ONC Final Rule Transforming Healthcare Information Exchange?

​​With its sights set on fast-tracking healthcare into the 21st century, the Final Rule turned to technology as the most logical way to achieve this. Digital advancements in electronic health records (EHRs), HIEs, Application Programming Interfaces (APIs), telehealth services, wearable devices, and other services have mapped out a new, interconnected healthcare landscape. 

The ONC and CMS produced two complementary rules based on the interoperability, patient access, and information-blocking provisions of the Cures Act. These rules lay down the law for providers, payers, health IT developers, and relevant actors involved in building healthcare software systems.


The ONC ruling sets out to create a national framework for exchanging health information and pushing interoperable practices. These frameworks and guidelines are simply to ensure that healthcare IT design, going forward, has interoperability as its core feature. This ruling achieves just that through the Trusted Exchange Framework and Common Agreement (TEFCA), released on January 18, 2022. Under TEFCA, healthcare operations follow interoperable models along agreed terms for privacy, security, data exchange, and others. 

TEFCA also sets the stage for organizations like health information exchanges and health information networks to connect and share data as Qualified Health Information Networks (QHINs). This agreement also outlines the roadmap for adopting FHIR-based exchanges across the ecosystem. Section 4002 of the ONC Act stipulates the United States Core Data for Interoperability Standard (USCDI) as the baseline standard for data exchange.

API Functionality

Application Programming Interfaces like Metriport’s Medical API work technological magic to connect disparate software systems for easy data access and retrieval. Only, instead of magic, the ONC recognizes the roles standardized datasets can play in promoting API functionality for patients to access their health information via the internet easily. The ONC stipulates standardized APIs, configured in a uniform FHIR format. Using these systems, patients can access health applications from EHR systems.

The earlier mentioned Section 4002 also highlights IT developers' conditions and maintenance requirements under the Cures Act. For instance, developers should no longer build their software in isolation. The Final Rule mandates transparency, requiring developers to publish specific business and technical API documentation that should be publicly available via a hyperlink. This Act also sets guidelines for API developers' permitted fees to users and information sources, and because developers have a history of shutting out rivals and competitors — this Act also mandates open-handed behaviors to encourage cooperation between IT vendors. The ONC set a December 2022 deadline to meet these conditions and show real-world testing plans to stakeholders. A whopping 95% of certified healthcare IT organizations met the stipulations for federal standards.

Information Blocking

According to the Cures Act, information blocking is any practice likely to interfere with, prevent, or materially discourage access, exchange, or use of EHI when the entity knows it is likely to do so. Many common industry practices make the cut for information blocking. For instance, IT vendors may deliberately adopt non-standardized interfaces or data formats to maintain market dominance or competitive advantage.

Likewise, a provider may dabble in blocking practices if patients are charged unreasonable health information fees, or where unnecessary delays or hurdles obstruct easy information flow. The Cures Act mandated that all electronic patient health information be shareable by October 6, 2022. Information-blocking practices beyond this time could be punishable with penalties. That said, not every act limiting data exchange will fall under information blocking. The Cures Act provides eight exceptions to this where blocking occurs for:

  • ​​Prevent harm to a patient or other person.
  • Promote privacy under relevant laws like the HIPAA.
  • Security to avoid unauthorized access, alteration, or other reasons preventing exchange.
  • Infeasibility where there are legitimate technical or other challenges to sharing information.
  • Where IT systems are unable to share data.
  • Content and manner exceptions to preserve the accuracy/integrity of health information.
  • Fees where reasonable charges are required to access health information.
  • Licensing in situations where intellectual rights may be tampered with if the information is exchanged.

The Next Stage for the ONC Cures Act

The ONC is hitting the ground running with its plans to promote interoperability across healthcare. In April 2023, the body released a Notice of Proposed Rulemaking (NPRM) with schemes to push easier data exchange. Among these proposals is a move to adopt USCDI Version 3 as the standard for data exchange; likewise the Act is looking to further expand the exceptions to information blocking for efficient data interactions. Also, the ONC will take advantage of information collated across EHR vendors to determine how efficiently EHR systems are complying with the laid down provisions, plus the effects on exchanging patient data.

The ONC is truly paving the way for a nationwide interoperable healthcare system. Patients can now access their health information in more modern ways, while remaining assured of the safety of their health information. This effect is also tied to easier response times for healthcare providers, and wider adoption of modern APIs across healthcare systems.

Stay up-to-date with news from Metriport.

View Blog

Get the latest updates and blog posts from the Metriport team.

Metriport icon