Proposed Penalties for Information Blocking – Comment Deadline Approaching

On October 30, the U.S. Department of Health and Human Services (HHS) issued a proposed rule (the Proposed Rule) detailing HHS initial set of disincentives to hold healthcare providers accountable for information blocking. If finalized, this initial set of disincentives would apply to Medicare-enrolled providers and suppliers that the HHS Office of Inspector General (OIG) determines have committed information blocking. The deadline for comments on the Proposed Rule is January 2, 2024.

1. Federal Information Blocking Provision Background

The federal Information Blocking Provision (42 U.S.C. § 300jj-52) and its implementing regulations published by the Office of the National Coordinator for Health Information Technology (ONC) (the Information Blocking Provision) was enacted as a result of concerns that certain individuals and entities engage in practices that "unreasonably limit the availability and use of electronic health information [EHI] for authorized and permitted purposes." 85 Fed. Reg. 25790 (May 1, 2020). The term "information blocking" is statutorily defined as a practice that, except as required by law or if it satisfies all the conditions of an exception to the law set forth in the implementing regulations, "is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information," and "(i) if conducted by a health information technology [IT] developer, exchange, or network, such developer, exchange, or network knows, or should know, that such practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information; or (ii) if conducted by a health care provider, such provider knows that such practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information." 42 U.S.C. § 300jj-52(a)(1).

As set forth above, the Information Blocking Provision applies to practices that involve EHI, which is defined as "electronic protected health information as defined in 45 CFR 160.103 to the extent that it would be included in a designated record set as defined in 45 CFR 164.501, regardless of whether the group of records is used or maintained by or for a [HIPAA-covered entity]." The definition of EHI excludes psychotherapy notes and "information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding." 45 C.F.R. § 171.102. In other words, EHI encompasses all identifiable health information used, in whole or in part, to make decisions about individuals that is maintained or transmitted in electronic format. Importantly, the information is considered EHI even when not used or maintained by or for a HIPAA-covered entity.

The Information Blocking Provision applies solely to "actors," which is defined to include healthcare providers, health IT developers of certified health IT, health information exchanges, and health information networks. Notably, the Information Blocking Provision applies to a "health care provider" as defined by the federal regulations, regardless of whether any of the health IT the provider uses is certified under the ONC Health IT Certification Program. The term "health care provider" is defined quite broadly and includes, but is not limited to, the following: hospitals, skilled nursing facilities, home health entities, or other long-term care facilities; clinics; community mental health centers; renal dialysis facilities; blood centers; ambulatory surgical centers; emergency medical services providers; federally qualified health centers; group practices; pharmacists; pharmacies; laboratories; physicians; and "any other category of facility, entity, practitioner, or clinician determined appropriate by the Secretary." 45 C.F.R. § 171.102; 42 U.S.C. § 300jj.

2. The Proposed Rule

HHS explained in the commentary to the Proposed Rule that "the health care providers to whom these disincentives would apply furnish a broad array of services to a significant number of both Medicare beneficiaries and other patients." 88 Fed. Reg. 74948 (Nov. 1, 2023). In addition, the Proposed Rule establishes the following disincentives for providers that have been determined by the OIG to have committed information blocking and for which the OIG refers its determination to the Centers for Medicare & Medicaid Services:

1. Medicare Promoting Interoperability Program: An eligible hospital or critical access hospital (CAH) under the Medicare Promoting Interoperability Program "would not be a meaningful electronic health record [EHR] user" in an applicable EHR reporting period. This would result in eligible hospitals subject to this disincentive losing 75% of the annual market basket increase associated with qualifying as a meaningful EHR user and CAHs subject to this disincentive having their payment reduced to 100% of reasonable costs from the 101% of reasonable costs the CAH might have otherwise earned in an applicable year.
2. Merit-Based Incentive Payment System: An eligible clinician or group under the Promoting Interoperability performance category of the Merit-Based Incentive Payment System (MIPS) subject to this disincentive would not be a meaningful EHR user in an applicable performance period and would receive a zero score in the Promoting Interoperability performance category of MIPS if required to report on this category. This is important because the Promoting Interoperability performance category score is typically a quarter of a clinician's or group's total final composite MIPS score in a year.
3. Medicare Shared Savings Program: A provider that is an accountable care organization (ACO), ACO participant, or ACO provider/supplier subject to this disincentive would be barred from participating in the Medicare Shared Savings Program for a minimum of one year. This could lead to a provider being removed from an ACO or being prevented from joining an ACO, and these providers would potentially lose out on revenue that they might have otherwise earned if they had participated in the Medicare Shared Savings Program.

HHS is getting serious about enforcement, so now is the time for providers to ensure that their practices are compliant with the Information Blocking Provision, as the penalties for those determined to be in violation will likely be significant. Day Pitney lawyers are actively working with in-house counsel and business leaders to develop Information Blocking Provision compliance programs and are continuing to monitor the status of the Proposed Rule. Day Pitney can also assist clients that would like to submit comments prior to the January 2 deadline.