Regulatory De-Arbitrage in Twenty-First Century Cures Act’s Health Information Regulation

19 Pages Posted: 28 May 2020 Last revised: 3 Jun 2020

See all articles by Craig Konnoth

Craig Konnoth

University of Virginia School of Law

Date Written: May 21, 2020


Health data regulation can be thought of at two levels. First, the micro- level of regulation has to do with Electronic Health Records (EHRs). Second, the macro-level concerns the networks on which EHRs are transmitted. The micro- and macro-levels of regulation interact. For example, EHRs need to be configured so that they can be transmitted on mandated networks. As a result, the lines do sometimes blur.

That said, the 21st Century Cures Act (Cures) clearly takes a dual approach to regulation. Cures was passed in December 2016 on a bipartisan basis. Its mandate was to address health data regulation at both the micro- and macro-levels. At the micro-level, Cures seeks to address the problem of information blocking. It seeks to configure EHRs such that their users are incentivized to share the information to the greatest degree possible. As I describe below, most penalties, however, apply only with respect to those who participate in the voluntary EHR certification program of the Office of the National Coordinator for Health Information Technology (ONC). At the macro-level, Cures seeks to promote the creation of a national health information network (NHIN). Like the certification program, participation in the network is voluntary.

To the extent much of Cures’ regulation relies on voluntary programs, regulatory arbitrage is easy. Firms can just choose not to participate in more robust regulation. However, in promulgating regulations, the Department of Health and Human Services (HHS) has taken steps to incent providers and other healthcare entities to participate both in the certification program and in the national network. I conclude that while the incentives for participation in the certification program will be effective, those for participating in the national network are less so. I make recommendations to make such participation highly desirable.

Part I offers a brief history of health data regulation. Part II offers an overview of Cures. Part III explains Cures information blocking rules, and the incentivized voluntary approach it has adopted there. Part IV explains steps ONC has taken with respect to creating a national network, and the shortcomings to the voluntary approach there. Part V offers a solution.

Keywords: EHR, Cures Act, health privacy, data regulation

Suggested Citation

Konnoth, Craig, Regulatory De-Arbitrage in Twenty-First Century Cures Act’s Health Information Regulation (May 21, 2020). Annals of Health Law, Forthcoming, U of Colorado Law Legal Studies Research Paper No. 20-27, Available at SSRN:

Craig Konnoth (Contact Author)

University of Virginia School of Law ( email )

580 Massie Road
Charlottesville, VA 22903
United States

Do you have a job opening that you would like to promote on SSRN?

Paper statistics

Abstract Views
PlumX Metrics