Written and maintained by CASRAI Editorial Board
Last updated
Who this is for: researchers, research administrators and compliance staff who need to know which parts of the 21st Century Cures Act (Public Law 114-255) reach research, and health IT and records staff who need the information blocking basics. As described on the official pages checked on 2026-11-07.
What the 21st Century Cures Act is and who runs it
The 21st Century Cures Act is Public Law 114-255, enacted December 13, 2016, with the long title “To accelerate the discovery, development, and delivery of 21st century cures, and for other purposes.” There is no single administrator. Different sections are carried out by different bodies: NIH, FDA, and the HHS Office of the National Coordinator for Health Information Technology (ONC). The law has three divisions: Division A (21st Century Cures, Titles I to V: innovation projects and state opioid responses, discovery, development, delivery, savings), Division B (Helping Families in Mental Health Crisis, Titles VI to XIV) and Division C (Increasing Choice, Access, and Quality in Health Care for Americans, Titles XV to XVIII). Source: Public Law 114-255 on govinfo.gov.
Provisions that affect research (section-by-section map)
Most pages on the Act concentrate on interoperability. For research, the useful view is by section. Each row below is traced to the public law text or to a policy that implements it.
| Section | What it does | Where it is implemented | CASRAI page |
|---|---|---|---|
| Sec. 2012 | Privacy protection for human research subjects; amends section 301(d) of the Public Health Service Act (certificates of confidentiality) | NIH notice NOT-OD-17-109: certificates are issued automatically for NIH-funded research from October 1, 2017 | Certificate of confidentiality |
| Sec. 2013 | Protection of identifiable and sensitive information; FOIA exemption authority under 5 U.S.C. 552(b)(3) | Statutory authority in the public law | |
| Sec. 2014 | Data sharing: the Secretary may require recipients of NIH awards to share scientific data they generate, consistent with human-participant protections and proprietary interests | Statutory authority in the public law | |
| Sec. 3022 | Real world evidence program at FDA | FDA Framework for its Real-World Evidence Program (December 2018) | Real-world evidence |
| Sec. 3024 | Informed consent waiver or alteration for clinical investigations | 21 CFR 50.22, effective January 22, 2024 | Waiver of informed consent |
| Sec. 3060 | Non-device clinical decision support criteria, FD&C Act section 520(o)(1)(E) | FD&C Act as amended | Software as a medical device |
| Sec. 4004 | Information blocking | 45 CFR Part 171 (ONC) | Information blocking exceptions |
A common error: Section 2014 is about data sharing by NIH award recipients. It is not the single IRB provision, and this page does not attribute single IRB policy to the Act.
Section 507 of the FD&C Act, added by the Act, also set up the multistage FDA biomarker qualification process (letter of intent, qualification plan, full qualification package), reviewed jointly by CDER and CBER.
Information blocking and the ONC Cures Act Final Rule
ONC’s Cures Act Final Rule implements the Act’s interoperability provisions. As described on the ONC page (last updated 2026-04-01), it requires standardized application programming interfaces (APIs) so individuals can reach structured electronic health information (EHI) through smartphone apps, and gives patients electronic access to all of their EHI, structured or unstructured, at no cost. The rule was published in the Federal Register on May 1, 2020, and an interim final rule of November 4, 2020 extended information blocking compliance dates because of COVID-19.
Information blocking is a practice likely to interfere with access, exchange or use of EHI, unless it is required by law or covered by an exception (45 CFR 171.103). Using an exception is voluntary, and failing to meet one is not automatically information blocking. The exceptions in 45 CFR Part 171 number ten, as confirmed on the eCFR on 2026-08-23 (six for not fulfilling requests, three for procedures for fulfilling them, and one for TEFCA manner). See information blocking exceptions for the detail and TEFCA participation for the network side.
Research relevance: EHI is defined by reference to the designated record set (45 CFR 171.102), so what counts as EHI is scoped by that boundary, not only by what a vendor system happens to store.
Who is an actor under the ONC Cures Act Final Rule?
An actor is one of three categories, per ONC’s information blocking page: health care providers, health IT developers of certified health IT, and health information exchanges or health information networks (HIEs/HINs). The knowledge standard differs. For providers, the practice must be one the provider knows is unreasonable and likely to interfere; for developers and HIEs/HINs the test is “knows or should know”. Do not treat the two as the same. ONC reviews claims against certified developers; HHS OIG can investigate all three actor types; HHS has finalized disincentives for providers that OIG finds committed information blocking.
Does the Cures Act require a patient portal?
No portal mandate appears in the public law text or on the ONC pages read for this guide. What the rule requires is access to EHI and standardized APIs (see above). A portal is one way an organization may provide access, but the sources do not make it a requirement of the Act.
What is the patient access rule?
There is no separate statute by that name in the Act. In the ONC Final Rule, patient access means the API requirement for apps to reach structured EHI plus electronic access to all EHI at no cost. It sits alongside, and is distinct from, the HIPAA right of access, which has its own regulation. The API standard commonly involved is FHIR.
What federal legislation promotes health information interoperability?
The Cures Act (through Section 4004 and the ONC rule) is the law that created the information blocking prohibition. The earlier HITECH Act is the other major statute in this space, and CMS programs such as the Promoting Interoperability Program for hospitals tie payment to health IT use. Disincentives for information blocking can reach those CMS programs (45 CFR 171.1001).
Compliance and application steps
- Identify which section applies: NIH-funded human subjects research (certificate of confidentiality, data sharing), FDA-regulated trials (consent waiver at 21 CFR 50.22, real world evidence), or a health IT or provider role (information blocking).
- For information blocking, determine whether you are an actor in one of the three categories.
- For each practice that limits access to EHI, check whether it is required by law or fits one of the ten exceptions, and record the basis.
- For NIH-funded research, remember that certificates of confidentiality are issued automatically; non-NIH-funded research must apply.
Typical timeline phases
Enactment (the public law), then agency rulemaking or policy (ONC’s final rule and interim final rule, NIH notice, FDA final rule on consent), then effective and compliance dates set by each agency. Phases come from different agencies at different times, so check the agency’s current text for the date that applies to you.
Common mistakes
- Treating Section 2014 as single IRB policy. It is NIH data sharing authority.
- Reading the Act as requiring a patient portal.
- Assuming an exception is mandatory, or that missing one proves information blocking.
- Applying the provider and developer knowledge standards interchangeably.
- Applying for a certificate of confidentiality for NIH-funded work (they are automatic; non-NIH-funded research must apply).
Related programs
| Related item | Link |
|---|---|
| HITECH Act | HITECH Act guide |
| Information blocking exceptions | Exceptions guide |
| TEFCA participation | TEFCA guide |
| Carequality | Carequality guide |
FAQ
Is the Cures Act only about interoperability?
No. It spans NIH research, FDA drug and device review, mental health and Medicare provisions across three divisions.
Which section creates information blocking?
Section 4004, implemented at 45 CFR Part 171.
How many information blocking exceptions are there?
Ten in 45 CFR Part 171, checked on the eCFR on 2026-08-23.
Sources
- Public Law 114-255, govinfo.gov, read 2026-11-07
- ONC Cures Act Final Rule, read 2026-11-07
- ONC information blocking, read 2026-11-07
- NIH NOT-OD-17-109
- 45 CFR Part 171, eCFR, checked 2026-08-23
