The Cures Act


The 21st Century Cures Act (the “Act”), a sweeping piece of legislation with overwhelming bipartisan support, was signed into law on December 13, 2016. Focused on advancing and accelerating medical research, combating America’s opioid abuse epidemic, and improving mental health care, the 21st Century Cures Act will unquestionably affect patients, healthcare providers, medical researchers, and pharmaceutical and device manufacturers.

This feature explores two sections of the Act that will specifically impact healthcare providers and manufacturers. Healthcare providers will want to take note of the first article, which examines mandates to improve medical care through better access to and interoperability among electronic health records. The second article, which details plans for opening new drug and device development pathways, will be of particular interest to pharmaceutical and device manufacturers.

While these articles discuss only a fraction of the Act’s scope, they clearly convey the message that the Act is “[a]n innovation game-changer, a once-in-a-generation, transformational opportunity to change the way we treat disease.”[1]



The 21st Century Cures Act[2] (the “Act”) is a multifaceted piece of healthcare and life sciences legislation designed to accelerate discovery, development, and delivery of innovative cures and treatments.

Title IV of the Act focuses on the delivery of medical care and includes some notable mandates to improve access and interoperability[3] of healthcare information technology (HIT). Sec. 4003(b) establishes new requirements and supports interoperability among disparate electronic health records (EHRs). The Office of the National Coordinator for Health Information Technology (ONC) is the principal federal entity designated to implement and advance HIT and the electronic exchange of health information under the Act.[4] Rapidly driving network-to-network interoperability forward, the ONC is directed to convene, within six months of enactment,[5] a public-private stakeholder convention to develop a trusted exchange framework for trust policies and practices and a common agreement for use among existing health information networks nationally (i.e., a “network of networks”). The Act ambitiously provides that the trusted exchange framework and common agreement will be established and published within one year after the convention of the stakeholders.

The ONC is instructed to work with the National Institute of Standards and Technology and other relevant agencies within HHS to pilot test and provide technical assistance on how to implement the trusted exchange network and common agreement. The Secretary of the Department of Health and Human Services (HHS) shall, through notice and comment rulemaking, establish a process for health information networks that voluntarily elect to adopt the trusted exchange framework and common agreement to attest to such adoption of the framework and agreement.[6] The ONC will publish a list of health information networks that have adopted the voluntary model exchange framework and are capable of trusted exchange pursuant to the common agreement, and the HHS Secretary will set up a comprehensive digital index for health professionals and health facilities that have adopted the agreement and exchange standards.[7]

A new federal HIT Advisory Committee is established in Section 4003(e)[8] to address issues related to achieving an interoperable health technology infrastructure (nationally and locally). The new HIT Advisory Committee is directed to work with private and public stakeholders and make recommendations to the ONC in targeted areas regarding:

  • Technology that provides accurate patient information for the correct patient, including exchanging such information, and avoids the duplication of patient records.
  • Privacy and security of health information in HIT, including technologies that allow for an accounting of disclosures and protections against disclosures of individually identifiable health information made by a covered entity for purposes of treatment, payment, and healthcare operations pursuant to HIPAA, as well as segmentation and protection from disclosure of specific and sensitive individually identifiable health information.
  • The facilitation of secure access by an individual to his/her protected health information, and access to such health information by a family member, caregiver, or guardian acting on behalf of a patient (including due to age-related and other disability, cognitive impairment, or dementia).


The ONC is required to convene the HIT Advisory Committee, not later than six months after the date on which the HIT Advisory Committee first meets, to identify priority uses of HIT and standards and implementation specifications that support such uses of HIT,[10] and publish a report of findings and recommendations regarding priorities, focusing on uses of HIT arising from/related to:

  • The implementation of incentive programs to promote the adoption and meaningful use of certified HER technology (CEHRT), the Merit-based Incentive Payment System (MIPS), Alternative Payment Models (APMs), the Hospital Value-Based Purchasing Program (HVBP), and any other value-based payment program determined appropriate by the HHS Secretary;
  • Quality of patient care
  • Public health
  • Clinical research
  • Privacy and security of electronic health information
  • Innovation in the field of HIT
  • Patient safety
  • Usability of HIT
  • Individuals’ access to electronic health information
  • Other priorities determined appropriate by the HHS Secretary

Beginning five years after the enactment of the Act, and every three years after that, the ONC must convene stakeholders to review and make recommendations with respect to maintaining or phasing out adopted standards and implementation specifications.


Notably, Sec. 4004 of the Act[11] explicitly prohibits “information blocking,” which is defined as a practice that, except as required by law or specified by HHS Secretary rulemaking, is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information; and

  • if conducted by a health information technology developer, exchange, or network, such developer, exchange, or network knows, or should know, that such practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information; or
  • if conducted by a healthcare provider, such provider knows that such practice is unreasonable and likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.

Specific descriptions of “information blocking” practices include:

  • Practices that restrict the authorized access, exchange, or use of electronic health information for treatment or other permitted purposes under applicable state/federal law, including transitions between certified HIT systems.
  • Implementing HIT in nonstandard ways likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information.
  • Implementing HIT in ways likely to:
    • restrict access, exchange, or use of electronic health information with respect to exporting complete information sets or in transitioning between HIT systems, or
    • lead to fraud, waste, or abuse, or impede innovations and advancements in health information access, exchange, and use, including care delivery enabled by HIT.

The Inspector General of the Department of Health and Human Services (OIG) is authorized to investigate information blocking claims. Health-information vendors found to have committed information blocking (including false attestations) will be subject to civil monetary penalties up to $1 million per violation. Health providers determined to have committed information blocking will be subject to other “appropriate disincentives,” as the HHS Secretary sets forth through notice and comment rulemaking.

The Cures Act legislation also promotes patient access to secure and up-to-date electronic health information through interoperable health information exchanges. Pursuant to Section 4006, the HHS Secretary is tasked to encourage partnerships among health information exchanges, healthcare providers, and health plans to offer patients access to their electronic information in “a single longitudinal format that is easy to understand, secure, and may be updated automatically.” Further, Section 4006 amends the Health Information Technology for Economic and Clinical Health Act (HITECH) providing that business associates may directly transmit or grant designee(s) access to an individual’s Protected Health Information (PHI) in response to a request from the individual.[12]


The 21st Century Cures Act has set the stage for industry-wide interoperability that will modernize and personalize healthcare. The exchange of accurate and complete electronic health information and advanced technology may be leveraged in ways that improve patient care and outcomes, enable patients to access and use their health data to collaborate in their care, advance precision medicine tailored to individual patients, reduce errors, increase efficiency, lower costs, and optimize reimbursements for healthcare providers. The health information technology provisions in the Cures Act should stimulate the rapid advancement of such interoperability and exchange. Once new HHS leadership and essential rulemaking take shape this year, compliance will be the name of the game!


“Title III — Development” of the 21st Century Cures Act (the “Act”) contains several significant provisions devoted to facilitating new pathways for both drug and medical device development. Patient-focused drug development, new drug development tools, new approaches to clinical trial design, and the use of real-world evidence for certain clinical purposes all represent a theme in the Act to allow for new and flexible approaches to research, testing, and approval of drugs in appropriate circumstances.


Section 3002 of the Act establishes a framework to collect and use “patient experience data” and related information in support of applications submitted under Section 569C of the Federal Food, Drug, and Cosmetic Act (the “FDCA”) or Section 351(a) of the Public Health Service Act (the “PHSA”). Patient experience data is intended to provide information about patient experiences with a health condition, including the impact of the health condition or related therapy on patients’ lives, and patient preferences with respect to treatment of a health condition. Patient experience data may be collected from patients, family members and caregivers of patients, patient advocacy organizations, disease research foundations, researchers, and drug manufacturers.

The Secretary of Health and Human Services (the “Secretary”) is required, pursuant to Section 3002 of the Act, to develop a plan to issue draft and final guidance documents, over a period of five years, regarding collection of patient experience data and the use of such data in drug development. A draft version of at least one such guidance document must be issued within 18 months after the enactment of the Act, and no later than 18 months following the end of the public comment period, either revised draft guidance or final guidance must be issued.

The guidance is intended to be used by any person seeking to collect patient experience data for submission to and proposed use by the Secretary in regulatory decision-making. The guidance documents must, among other requirements, address specific methodological approaches that are relevant and objective and ensure that data is accurate and representative of the intended population. The guidance documents must include methods to collect meaningful patient input throughout the drug development process and methodological considerations for data collection reporting, management, and analysis. Finally, at least 180 days following enactment of the Act, the Secretary is required to provide a brief public statement regarding the patient experience data and related information, if any, submitted and reviewed as part of an application.


Section 3011 of the Act amends Chapter V of the FDCA to include a new Section 507 addressing a process of qualification for “drug development tools.” A drug development tool is intended to be used for supporting or obtaining approval or licensure (as applicable) of a drug or biological product, or supporting the investigational use of a drug or biological product under section 505(i) of the FDCA or section 351(a)(3) of PHSA. The term “drug development tool” is defined to include a biomarker, a clinical outcome assessment, and any other method, material, or measure that the Secretary determines aids drug development and regulatory review. The term “biomarker” means “a characteristic that is objectively measured as an indicator of normal biologic processes, pathologic processes, or biological responses to a therapeutic intervention, and includes a surrogate endpoint.” A surrogate endpoint is a marker such as a laboratory measurement, radiographic image, physical sign, or other measure that is known to predict or reasonably likely to predict clinical benefit and could be used to support traditional approval or accelerated approval of a drug or biological product. A “clinical outcome assessment” means “a measurement of a patient’s symptoms, overall mental state, or the effects of a disease or condition on how the patient functions and includes a patient-reported outcome.” A patient-reported outcome is reported by the patient regarding a health condition without interpretation by a clinician or other person.

The Act directs that drug development tools be approved by the Secretary through a defined process of qualification whereby the drug development tool is deemed a “qualified” drug development tool. A drug development tool is “qualified” if in its proposed context of use the tool can be relied upon to have a specific interpretation and application in drug development and review under the Act. The qualification process will consist of several steps, beginning with submission of a letter of intent by a requestor to the Secretary for review. Upon acceptance of a letter of intent by the Secretary, the requestor would then submit a qualification plan to the Secretary for review, and upon acceptance, a full qualification package would be submitted. The Secretary is required to develop draft guidance on the implementation of this section not later than three years following enactment of the Act, and final guidance must be developed not later than six months following closing of the comment period for the draft guidance.


Section 3021 of the Act requires the Secretary to conduct a public meeting and issue guidance that addresses the use of complex adaptive and other novel trial designs in the development and regulatory review and approval or licensure for drugs and biological products. The guidance must specifically include how such proposed clinical trials help satisfy the substantial evidence standard under section 505(d) of the FDCA. Additionally, the guidance must address how sponsors can obtain feedback from the Secretary on technical issues related to modeling and simulations prior to (i) completion of the modeling or simulations, or (ii) the submission of resulting information to the Secretary. Finally the guidance must include the provisions for the types of quantitative and qualitative information that should be submitted for review and recommended analysis methodologies. Before issuing the described guidance, the Secretary must hold a public meeting no later than 18 months after the date of enactment of the Act, for consultation and discussion with representatives of regulated industry, academia, patient advocacy organizations, consumer groups, and disease research foundations. Draft guidance must be issued no later than 18 months following the date of the public meeting and final guidance no later than one year after the close of the public comment period for the draft guidance.


Section 3022 of the Act amends Chapter V of the FDCA to include a new section 505F, dealing with “real-world evidence,” defined as “data regarding the usage, or the potential benefits or risks, of a drug derived from sources other than randomized clinical trials.” The potential use of real-world evidence would be in the context of helping support the approval of a new indication for an approved drug and supporting or satisfying post-approval study requirements. The Secretary is charged with developing a draft framework to implement the program concerning real-world evidence within two years after the date of enactment of the Act. The framework must be developed in consultation with stakeholders in the field including the regulated industry, academia, medical professional organizations, representatives of patient advocacy organizations, consumer organizations, disease research foundations, and other interested parties. The framework must include information describing sources of real-world evidence, including ongoing safety surveillance, observational studies, registries, claims, and patient-centered outcomes research activities. It must also address gaps in data collection activities and the standards and methodologies for collection and analysis of real-world evidence. This framework is designed to provide a foundation for industry guidance on the proper circumstances under which drug sponsors and the Secretary may rely on real-world evidence to help support approval of a new indication for an approved drug and to help support or satisfy post-approval study requirements. Guidance must also provide appropriate standards and methodologies for collection and analysis of real-world evidence. The Secretary is required to issue draft guidance no later than five years following enactment of the Act. Within 18 months of the close of the comment period for draft guidance, either revised draft guidance or final guidance must be published.


The provisions of the Act that are discussed above will not take on concrete form immediately, but are designed to evolve over the next three to five years. Even though guidance and implementation will not be fully in place for some time, the next two to three years provide an opportunity for stakeholders in research and development of drugs or biological products to actively find how they might potentially propose and use drug development tools, novel clinical trial designs, real-world evidence, and/or patient experience data to expand the potential of research and development, and ultimately approval, of new treatments. While these innovations will not replace the need for traditional clinical trial structure, they potentially can enhance clinical trials and expand the general methodologies available for research.


[2] Pub. L. No 114-255, 130 Stat. 1033 (2016).

[3] The Act defines interoperability with respect to HIT, as technology that:

  • enables the secure exchange of electronic health information with, and use of electronic health information from, other health information technology without special effort on the part of the user;
  • allows for complete access, exchange, and use of all electronically accessible health information for authorized use under applicable state or federal law; and
  • does not constitute information blocking (as defined in the Act).

Sec. 4003(a) (to be codified at 42 U.S.C. § 300jj).

[4] Sec. 4003(b) (to be codified at 42 U.S.C. § 300jj-11(c)).

[5] The 21st Century Cures Act was signed into law on December 13, 2016.

[6] While no health information network will be required to adopt the trusted exchange framework, federal agencies may require adoption within their networks.

[7] See Sec. 4003(c) (to be codified at 42 U.S.C. 300jj-11).

[8] The HIT Advisory Committee combines and replaces the previous HIT Policy Committee and the HIT Standards Committee. The new HIT Advisory Committee will consist of at least 25 members who represent a balance among various sectors of the healthcare system so that no single sector unduly influences the recommendations of the Committee. Members must include providers, ancillary healthcare workers, consumers, purchasers, health plans, health information technology developers, researchers, patients, relevant federal agencies, and individuals with technical expertise on healthcare quality, system functions, privacy, security, and on the electronic exchange and use of health information), eight of whom shall be appointed by Congress, three appointed by the HHS Secretary, and the remainder will be appointed by the Comptroller General of the US Government Accountability Office (GAO). See Sec. 4003(e) (to be codified at 42 U.S.C. §300jj).

[9] See Sec. 4003(f) (to be codified at 42 U.S.C. § 300jj-13).

[10] In identifying such standards and implementation specifications, the HIT Advisory Committee must give deference to standards and implementation specifications developed by consensus-based standards development organizations in the private sector.

[11] Sec. 4004 (to be codified at 42 U.S.C. § 300jj-51 et seq.).

[12] Sec. 4006 (b) (to be codified at 21 U.S.C. § 17935(e)(2)).