New Organ Donation Law Mandates Hospital EHR Access for Agencies: Two-Year Countdown Begins

The newly named “Removing Burdens From Organ Donation Act” is designed to speed up the process of identifying potential organ donors, aiming to boost transplant rates. The core of this legislation is a major procedural shift for hospitals: two years after the law is enacted, hospitals must start automatically sending an electronic alert to the designated organ procurement agency (OPA) the moment a patient is declared deceased or when death is clearly imminent. That’s the first big change.

The Digital Hand-Off: EHR Access

Here’s where it gets fast—and potentially complicated. Under the new rule (Section 2), once that death status is updated, the OPA must immediately be given electronic and remote access to the potential donor's electronic health records (EHRs). Think of it like an instant digital hand-off of critical medical data. For OPAs, this means faster screening and less delay, which is crucial in organ donation. For hospitals, especially smaller ones, this means ensuring their IT systems are fully integrated and secure enough to allow real-time, remote access to external agencies.

The High Cost of Compliance and the Hardship Clause

Mandating new electronic notification systems and EHR integration comes with a cost, particularly for critical access hospitals and those in rural areas. Recognizing this, the bill allows the Secretary of Health and Human Services to grant an exemption for up to three years if a hospital can prove that meeting the requirement would cause a “significant hardship.” What exactly counts as “significant hardship”? The bill doesn’t spell it out, leaving that definition up to the Secretary. This vagueness could be a necessary lifeline for hospitals struggling with broadband or IT budgets, but it also means the rule could be inconsistently applied, potentially undermining the law’s intent if too many exemptions are granted.

When the Internet Goes Down: Emergency Exemptions

The bill is smart enough to account for real-world chaos. Hospitals automatically get a one-year exemption if they are hit by a major disaster or, significantly, if they are dealing with a cybersecurity attack—a malicious activity trying to disrupt or steal their data. This is a practical recognition that when a hospital is fighting hackers or recovering from a flood, their priority isn't compliance with new IT mandates. The Secretary must also report annually to Congress on all exemptions granted, detailing exactly why each one was necessary.

Data Security and Real-World Impact

While the goal—saving lives through faster organ placement—is clear, the immediate electronic access to EHRs by external OPAs upon death confirmation introduces new data security risks. Hospitals will need to ensure airtight protocols to protect patient privacy, even after death. Furthermore, the Government Accountability Office (GAO) is tasked with studying the implementation over the first three years. This study will look at the true costs, how location (especially rural broadband access) affects compliance, and, crucially, whether this new process actually improves organ transplant outcomes. This required study ensures there’s an accountability mechanism built in, so we’ll know if the procedural burdens placed on hospitals are actually yielding better results for patients waiting for a transplant.