The digital health ecosystem was shaped by a series of federal laws and regulations that define how medical data is protected, digitized, shared, and enforced. This installment of The life insurer’s guide to EHR terminology defines the regulatory terms life insurance carriers most often encounter, from foundational privacy laws to the most recent enforcement mechanisms, and what each means for carriers relying on electronic health data.
HIPAA (Health Insurance Portability and Accountability Act)
HIPAA is a federal law enacted in 1996 that established national standards for privacy, security, and electronic exchange of health information. The HIPAA Privacy Rule governs how protected health information (PHI) may be used and disclosed, while the HIPAA Security Rule establishes administrative, technical, and physical safeguards for electronic PHI.
Implications for life insurance underwriting: HIPAA is an important part of the legal framework governing when healthcare providers may disclose protected health information and is why life insurance carriers obtain an applicant authorization before requesting medical records. Specific authorization language may be required based on the state, type of information requested or the source holding the records.
42 CFR Part 2 (Substance Use Disorder Records)
This is a federal privacy regulation that protects certain substance-use-disorder treatment records. It generally restricts the disclosure of covered records without patient consent, subject to specific regulatory exceptions. *
Implications for life insurance underwriting: Disclosure of substance-use-disorder records protected under 42 CFR Part 2 requires specific wording as part of a patient’s authorization to meet applicable regulatory requirements, which may be distinct from a standard HIPAA authorization. Depending on the authorization obtained and the sources accessed, underwriters may have limited visibility into an applicant's substance use disorder treatment history.
HITECH Act (Health Information Technology for Economic and Clinical Health)
Enacted in 2009, the HITECH Act accelerated the adoption of EHR technology within the healthcare industry (encouraging providers to switch from paper files to electronic health records) by providing financial incentives for adoption (and later penalties for non-compliance) of EHRs. These policies contributed to widespread EHR adoption, resulting in >99% of hospitals and >91% of office-based physicians now using EHRs for medical use.
Implications for life insurance underwriting: This law created a substantial digital foundation for EHR retrieval; however, the availability of electronic medical data does not mean that it is automatically available for use within the life insurance industry.
CMS (Centers for Medicare & Medicaid Services) EHR Incentive Program
CMS is a federal agency that administers Medicare, Medicaid, and other government healthcare programs. In 2011, under the HITECH Act of 2009, CMS launched its EHR Incentive Program, commonly known as “Meaningful Use” (MU), providing financial incentives to accelerate EHR adoption and use to improve patient care, safety, and data exchange. By 2015, the policy had shifted from encouraging adoption through incentives to reinforcing it through reductions in Medicare payments for providers that failed to meet MU requirements. In 2018, CMS renamed it the Promoting Interoperability Programs.
Implications for life insurance underwriting: Meaningful Use drove the widespread adoption of EHRs among US providers, making available much of the electronic health information accessed by underwriters today.
21st Century Cures Act
Congress enacted the 21st Century Cures Act in 2016. Alongside provisions to speed up medical research and drug approvals, the Act included measures to advance interoperability, support patient access to electronic health information, and prohibit information blocking.
In 2020, the federal government issued the ONC Cures Act Final Rule to implement these measures, significantly changing how medical data is shared. The rule requires that patients be able to electronically access their health information at no cost, requires certified health IT developers to offer standardized application programming interfaces (APIs) that make it easier for patients to retrieve and share their records, and implements the Act's information-blocking prohibition.
Implications for life insurance underwriting: This law makes it easier for life insurance applicants to obtain their medical records digitally and reduces barriers for life insurers seeking to obtain EHRs where authorized.
Information Blocking Rule
Part of the ONC Cures Act Final Rule (see above), this rule prohibits actions or practices that are likely to interfere with the lawful access, exchange, or use of electronic health information, unless a specific exception applies. Fines of up to $1M per violation can be imposed on developers of certified health IT, health information networks, and health information exchanges for non-compliance. Healthcare providers are subject to separate CMS-administered disincentives for non-compliance.
Implications for life insurance underwriting: The Information Blocking Rule may support authorized EHR retrieval by reducing barriers to access electronic health information. However, it does not create a new right of access for life insurers or guarantee access to all EHR records.
CMS Provider Disincentives Rule
Finalized by the U.S. Department of Health and Human Services (HHS) in 2024, this rule establishes how healthcare providers are penalized for information blocking. After HHS determines that a provider has committed information blocking, CMS applies disincentives through the Medicare programs the provider participates in, instead of issuing cash fines. This may result in a lower Medicare performance score or a reduction in Medicare payments.
Implications for life insurance underwriting: This rule establishes financial consequences for certain providers found to have committed information blocking, encouraging timely responses to properly authorized requests for electronic health information. However, these disincentives apply only to providers in certain Medicare programs and therefore do not affect all providers in the same way.
We hope these definitions give you a clearer view of the regulatory landscape shaping EHR access. The life insurer's guide to EHR terminology continues with Part 3 covering network types and frameworks. Be sure to keep reading the series to deepen your understanding of these areas. If you missed it, also read Part 1 on foundational concepts, which covers what an EHR actually is, the difference between structured and unstructured data, and provides a baseline understanding of interoperability.
* Maintained by certain federally assisted treatment programs.
References: