HHS Proposes Information Blocking Disincentives for Health Care Providers

While health care providers have been required to comply with the 21st Century Cures Act Information Blocking Rule (the Rule) since April 5, 2021, as of yet there is no enforcement mechanism in place with respect to the Rule and health care providers. The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC) and Centers for Medicare & Medicaid Services (CMS) have issued a proposed rule to change that, setting forth disincentives on health care providers for information blocking.

The biggest takeaways from the proposed enforcement rule are:

(1) Health care providers participating in the Medicare Sharing Savings Program may lose eligibility to participate in the program for a year or more for information blocking;

(2) Hospitals and clinicians that participate in the Medicare Promoting Interoperability Program could face a decrease in reimbursement, although they already face this risk due to an existing Program requirement to attest that they are not information blocking; and

(3) HHS still has not proposed disincentives that would govern health care providers who do not participate in Medicare.

Background on the 21st Century Cures Act and Its Information Blocking Rule

The 21st Century Cures Act was enacted in 2016 and prohibits health care providers, health IT developers, health information networks, and health information exchanges (collectively "actors") from information blocking. Information blocking is a practice that interferes with, prevents, or materially discourages access, exchange, or use of electronic health information if the actor has the requisite intent, unless the practice is required by law or an exception applies. For a health care provider, a practice is only information blocking if the provider knows that the practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. With respect to enforcement, the statute provides that the HHS Office of Inspector General (OIG) investigates potential information blocking violations and may impose a civil monetary penalty of up to $1 million per violation on any actor other than a health care provider. If OIG finds that a health care provider has committed information blocking, then OIG shall refer the violation to "the appropriate agency" to be subject to "appropriate disincentives" using authorities under applicable Federal law, as HHS sets forth through notice and comment rulemaking.

On November 1, 2023, ONC and CMS jointly published a proposed rule setting forth the proposed mechanism for enforcement with respect to health care providers.

Appropriate Disincentives

ONC and CMS have proposed three types of disincentives for health care providers that OIG determines to have committed information blocking. First, for "eligible hospitals" and "critical access hospitals," the health care provider will be found to not qualify as a "meaningful user" of an electronic health record ("EHR") in the Medicare Promoting Interoperability Program (also known as the Medicare "Meaningful Use" program). The result will be a decrease in reimbursement for Medicare claims. For an eligible hospital, this would mean that the hospital would not be eligible for ¾ of the annual market basket increase. HHS ran simulations using existing Medicare reimbursement data and found that this would lead to a median disincentive of approximately $400,000 per hospital that is found to have committed information blocking. The payment adjustment would occur two years after OIG refers the violation to CMS. For critical access hospitals, a violation would result in the hospital receiving 100% of reasonable costs instead of 101% in the year that OIG refers the violation to the Centers for Medicare & Medicaid Services (CMS).

Second, for eligible professionals that Medicare reimburses based on the Merit-Based Incentive Payment System (MIPS), a provider that OIG finds to have committed information blocking would not be considered a meaningful EHR user under the Promoting Interoperability Performance Category, which counts for 25% of the MIPS score. This will result in a decrease in reimbursement for Medicare claims, with the payment adjustment occurring two years after OIG's referral to CMS. HHS calculated that the median disincentive for clinicians that are "eligible professionals" under MIPS would be $686. This number will vary based on the health care professional's volume of Medicare claims and there will be a greater impact on group practices with multiple eligible professionals (e.g., the HHS data found the median group to consist of six clinicians, leading to a median disincentive of $4,116 per group).

Third, a health care provider that OIG determines committed information blocking will not be eligible to participate as an accountable care organization (ACO), ACO participant, or ACO provider/supplier in the Medicare Shared Savings Program for at least one performance year beginning the year after the OIG referral to CMS. In the Medicare Shared Savings Program, groups of ACO participants and ACO providers/suppliers, managed by an ACO, work together to better coordinate care and meet quality metrics, sharing with the Medicare program a portion of any resulting savings. If excluded from an ACO network because of information blocking, the health care provider will lose out on its share of any such savings to Medicare.

CMS may apply the above disincentives cumulatively. For example, a hospital that OIG determines committed information blocking may suffer a loss in reimbursement under the Medicare Promoting Interoperability Program and also may become ineligible to participate in the Medicare Shared Savings Program.

ONC proposes that it also will publish on its website any applied disincentives, including:

• The health care provider's name;
• Its business address;
• The practice found to have been information blocking;
• The disincentives applied; and
• Where to find additional information, where available, about the determination of information blocking that is publicly available via HHS or another part of the U.S. government.

Of note, eligible hospitals, critical access hospitals, and eligible professionals already have to attest that they are not information blocking as a criteria for qualifying as a meaningful EHR user. This was part of the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) and has been in effect since the 2017 meaningful use reporting period. Accordingly, the Promoting Interoperability Program already prohibits information blocking, but enforcement is going from a self-assessment process to a more formal process with OIG investigations and findings.

The Enforcement Process

For investigations of health care providers, the proposed rule indicates that OIG's priorities will be practices that: (i) resulted in, are causing, or have the potential to cause patient harm; (ii) significantly impacted a provider's ability to care for patients; (iii) were of long duration; and (iv) caused financial loss to Federal health care programs, or other government or private entities.

The statute provides that OIG must refer a health care provider that it determines violated the Information Blocking Rule to an "appropriate agency." Under the proposed rule, CMS will be the agency in question because it will apply the disincentives discussed above. Additionally, OIG may request technical assistance during investigations from ONC (regarding interpreting the Rule) and the HHS Office for Civil Rights (regarding the Rule's privacy and security exceptions) and ONC will publish information about applied disincentives on its website.

One big question is whether OIG is going to be incentivized to use its limited resources to investigate health care providers for potential violations of the Rule. For example, will OIG be likely to launch an investigation of a single health care professional for alleged information blocking if the average disincentive is only $686? Will OIG be more likely to investigate information blocking claims against large eligible hospitals or large practice groups where a finding of a violation leads to significantly higher disincentives? We will have to wait and see.

What About the Rest of Health Care Providers?

What is most noteworthy about the proposed rule is not what it says, but what it does not. Specifically, ONC has not proposed disincentives for health care providers who do not participate in the Medicare program, or even for health care providers who participate in Medicare but not the Promoting Interoperability or Medicare Shared Savings Programs. ONC recognizes the limited reach of its proposed disincentives and includes a request for information soliciting suggestions for appropriate disincentives that can be applied to other health care providers. We have been scratching our heads for some time regarding what existing federal authorities exist to penalize health care providers who engage in information blocking but do not participate in federal insurance programs. It seems like ONC is continuing to struggle with this question too.

Requests for Comments

The proposed rule includes requests for comments in a number of areas.

Under the proposed rule, if OIG's investigation identifies multiple information blocking violations over multiple years, this will result in a single referral that will only affect a health care provider's status as a meaningful EHR user in a single EHR reporting period. CMS is requesting comment on whether a determination that information blocking occurred in multiple years should instead lead to multiple disincentives (for example, disincentives in multiple calendar years/reporting periods compared to only the calendar year/reporting period in which OIG made the referral).

ONC and CMS also requested public comments on:

• The definition of "appropriate agency";
• The proposed disincentives;
• Whether ONC should post additional information on its website (and why) about actors that have been found to have committed information blocking;
• Potential disincentives for health care providers who do not participate in the Promoting Interoperability or Medicare Shared Savings Programs; and
• Potential impacts of the rulemaking.

Conclusion

Health care providers continue to struggle with complying with the Rule, including navigating parental access to minor's records and addressing continuing concerns surrounding the release of test results to patients prior to consultation with the ordering physician. ONC indicates that it has received over 800 information blocking complaints since the April 5, 2021 applicability date. While health care providers are currently required to comply with the Rule, this proposed rule brings us one step closer to enforcement of the Rule. Providers should take this as an opportunity to review their information blocking compliance program and to communicate the risk to management of continued practices that may constitute information blocking.

For additional assistance regarding compliance with the Rule, you may contact Adam Greene or the DWT attorney with whom you normally work. We also offer a DWT Information Blocking Toolkit, which has been updated for 2023 to reflect recent developments and guidance.