21st Century Cures Act Information Blocking Rule Finally Has Teeth With Respect to Providers

On July 1, 2024, the U.S. Department of Health and Human Services (HHS) Centers for Medicare & Medicaid Services (CMS) and Office of the National Coordinator for Health Information Technology (ONC) published a final rule establishing disincentives for health care providers that are found in violation of the 21st Century Cures Act Information Blocking Rule (the "Information Blocking Rule"). The Information Blocking Rule prohibits a health care provider from engaging in a practice that the provider knows to interfere with access, exchange, or use of electronic health information and knows to be unreasonable, unless the practice is required by law or a regulatory exception applies.

The HHS Office of Inspector General (OIG) will investigate information-blocking complaints against health care providers for conduct beginning on July 31, 2024, and determine whether the health care provider has violated the Information Blocking Rule. If OIG finds a violation, it will refer the provider to CMS for imposition of disincentives. The rule establishes disincentives for health care providers that participate in the Medicare Promoting Interoperability Program, the Medicare Merit-Based Incentive Payment System (MIPS), and the Medicare Shared Savings Program. ONC will publish on its website information about health care providers to whom CMS has applied disincentives.

For health care providers, now is the time to check that you have corrected any practices that constitute information blocking.

The 21st Century Cures Act and the Final Disincentives Rule

Health care providers have been required to comply with the Information Blocking Rule since April 5, 2021. Until now, however, a key element has been missing with respect to health care providers: any form of penalty for violating the Information Blocking Rule.

The 21st Century Cures Act provides that any health care provider determined by OIG to have committed information blocking shall be referred to the appropriate agency to be subject to appropriate disincentives using authorities under applicable federal law. Until this final rule, however, HHS had not yet completed notice-and-comment rulemaking setting forth who the "appropriate agency" would be and what the "appropriate disincentives" would be using existing authorities under federal law.

The final rule published on June 1 changed this, setting forth a set of disincentives for violations of the Information Blocking Rule. "Eligible hospitals"[1] that participate in the Medicare Promoting Interoperability Program will not qualify as "meaningful EHR users," resulting in a three-quarters reduction in their annual market-based increase for Medicare reimbursement. Depending on the volume of Medicare reimbursement, this could represent over a million dollars in reduced reimbursement. Critical access hospitals that participate in the Medicare Promoting Interoperability Program will be reimbursed at 100% of reasonable costs rather than 101% of reasonable costs. "Eligible clinicians" or medical groups that participate in MIPS will be subject to a score of zero for their Promoting Interoperability performance category, which is typically a quarter of their total MIPS score and may lead to a negative MIPS payment adjustment on Medicare payments (e.g., up to 9% less on Medicare reimbursements). Additionally, CMS may exclude a health care provider that participates in the Medicare Shared Savings Program as an accountable care organization (ACO), ACO participant, or ACO provider or supplier from the Program (and the associated Medicare shared savings) for at least a year.

How Disincentives Are Determined

The size of the disincentive will be tied to the health care provider's Medicare reimbursement rather than the nature or egregiousness of the information blocking. For example, a large eligible hospital that serves a significant Medicare population could lose millions of dollars in Medicare reimbursement for information blocking during a payment year due to an isolated information-blocking event. In contrast, an eligible clinician for whom only a small proportion of patients are Medicare beneficiaries may only lose less than $100 in Medicare reimbursement for a continuing, especially egregious information-blocking practice. A health care provider who does not participate in Medicare programs will not be subject to any disincentives at this time. This apparent inequity is largely because HHS viewed that its hands were tied by the statutory language requiring that disincentives rely on existing federal authority. HHS did not interpret that it could create new enforcement mechanisms that tied the level of disincentive to the nature of the conduct.

That being said, there is still some flexibility with respect to enforcement of the Information Blocking Rule against health care providers. First, OIG will use enforcement discretion to prioritize what information-blocking complaints against health care providers it pursues. It has identified four priorities:

(1) A practice that resulted in, is causing, or has the potential to cause patient harm;

(2) A practice that significantly impacted a provider's ability to care for patients;

(3) A practice of long duration; and

(4) A practice that caused financial loss to federal health care programs, or other government or private entities.

Although OIG's anticipated priorities are framed around individual allegations, OIG may evaluate allegations and prioritize investigations based in part on the volume of claims relating to the same (or similar) practices by the same entity or individual.

Second, while CMS's hands are mostly tied with respect to the Medicare Promoting Interoperability Program and MIPS when it receives a referral from OIG with a finding of information blocking, the final rule provides CMS with discretion as to whether to exclude the health care provider from the Medicare Shared Savings Program (if the provider participates in the program). CMS has discretion to consider relevant facts and circumstances when deciding whether to apply this disincentive, including the nature of the health care provider's information blocking, the health care provider's diligence in identifying and correcting the problem, the time since the information blocking occurred, whether the provider was previously subject to a disincentive in another program, and other factors.

Once CMS imposes disincentives on a health care provider for information blocking, ONC will post the following information on its website:

(i) Health care provider name;

(ii) Business address;

(iii) The practice found to have been information blocking, including when the practice occurred;

(iv) Disincentive(s) applied; and

(v) Where to find any additional information about the determination of information blocking that is publicly available via HHS or, where applicable, another part of the U.S. government.

Accordingly, just like the HHS Office for Civil Rights has a breach portal where information about large breaches of unsecured protected health information is posted (commonly referred to as the "Wall of Shame"), ONC will have a similar website with information about health care providers OIG found were information blocking.

What Providers Should Do Now

Health care providers continue to struggle with compliance with the Information Blocking Rule, especially with respect to areas such as parental access to minors' records and the release of sensitive test results. One saving grace has been that HHS was not yet enforcing the Information Blocking Rule against health care providers. As of July 31, 2024, that will no longer be the case. Accordingly, now is the time for health care providers to review their health information practices and identify any instances where they are unreasonably interfering with access, exchange, or use of electronic health information. In instances where the practice is not legally required and an exception under the Information Blocking Rule does not apply, health care providers should consider documenting a basis for why they believe their practice to be reasonable.

Davis Wright Tremaine has updated our DWT Information Blocking Toolkit based on the new final rule. Click here to learn more about the Toolkit.

If you have questions or need additional assistance regarding the final rule, please contact the author or the DWT attorney with whom you normally work.