New Teeth to the Information Blocking Rule: Long-Awaited Disincentives for Health Care Providers Finalized

On June 24, 2024, the U.S. Department of Health and Human Services (“HHS”) Office of the National Coordinator for Health Information Technology (“ONC”) and the Centers for Medicare & Medicaid Services (“CMS”) released a final rule titled “21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking” (the “Final Rule”).¹ The Final Rule implements the “appropriate disincentives” required under the 21st Century Cures Act (the “Cures Act”) for providers found to have committed information blocking violations under federal information blocking regulations (the “Information Blocking Rule”).² The Final Rule’s disincentives could lead to significant consequences for eligible hospitals, critical access hospitals (“CAHs”), and eligible clinicians participating in the Medicare Electronic Health Records (“EHR”) Incentive Programs and accountable care organizations (“ACOs”), ACO participants, and ACO providers/suppliers participating in the Medicare Shared Savings Program (“MSSP”) that are found to have engaged in information blocking.

The Final Rule’s disincentives will become effective 30 days following the Final Rule’s publication in the Federal Register. In addition, ONC will publish information blocking determinations, disincentives, and penalties that have been imposed to inform the public about how and where information blocking is occurring. The Final Rule represents the latest action by HHS agencies to advance interoperability and support the access, exchange, and use of electronic health information (“EHI”).

Information Blocking Background

The Cures Act authorizes the HHS Office of Inspector General (“OIG”) to investigate claims that developers of federally certified health information technology (“health IT”), health information exchanges and health information networks (“HIE/HINs”), and health care providers (collectively, “Actors”) have engaged in information blocking.³ The Cures Act also calls on the Secretary of HHS to “identify reasonable and necessary activities that do not constitute information blocking.”⁴ ONC has specified such “reasonable and necessary activities” as information blocking exceptions in the Information Blocking Rule. The Information Blocking Rule defines “information blocking” as a practice that, except as required by law or covered by an exception set forth in the Information Blocking Rule, is likely to interfere with access, exchange, or use of EHI and (1) if conducted by a developer of certified health IT or HIE/HIN, such developer or HIE/HIN knows, or should know, that such practice is likely to interfere with access, exchange, or use of EHI; or (2) if conducted by a health care provider, such provider knows that such practice is unreasonable and is likely to interfere with access, exchange, or use of EHI.⁵

Furthermore, the Cures Act describes the penalties that apply to Actors if they engage in information blocking.⁶ Developers of certified health IT must not take any action that constitutes information blocking as a condition of obtaining and maintaining certification under the ONC Health IT Certification Program.⁷ For developers of certified health IT and HIE/HINs, OIG may impose civil monetary penalties (“CMPs”) of up to $1 million per violation.⁸ OIG may refer health care providers “to the appropriate agency to be subject to appropriate disincentives using authorities under applicable Federal law.”⁹ The Final Rule establishes the “appropriate disincentives” that apply to health care providers found to have violated the Information Blocking Rule.

Information blocking enforcement mechanisms for non-provider Actors have previously been finalized through HHS rulemaking. In May 2020, ONC issued a final rule, which codified a definition of information blocking, certain information blocking exceptions, and a requirement that developers not engage in information blocking as a condition of obtaining and maintaining health IT certification.¹⁰ This rule was delayed due to the COVID-19 pandemic but went into effect on April 5, 2021.¹¹ In July 2023, OIG published a final rule establishing CMPs of up to $1 million per information blocking violation for developers and HIE/HINs—including health care providers that also meet the definition of a developer or HIE/HIN under ONC’s regulations—effective September 1, 2023.¹²

The Final Rule

The Final Rule establishes the final information blocking enforcement mechanism required by the Cures Act: “appropriate disincentives” for health care providers. The Final Rule’s appropriate disincentives apply to eligible hospitals, CAHs, and eligible clinicians¹³ that participate in Medicare EHR Incentive Programs and ACOs, ACO participants, and ACO providers/suppliers participating in the MSSP. In addition, ONC will publish information blocking determinations, disincentives, and penalties on its website.

Appropriate Disincentives for Eligible Hospitals, CAHs and Eligible Clinicians Participating in the Medicare EHR Incentive Programs

CMS established Medicare and Medicaid EHR Incentive Programs in 2011 pursuant to the Health Information Technology for Economic and Clinical Health Act of 2009 to encourage eligible hospitals, CAHs, and eligible clinicians to demonstrate meaningful use of ONC-certified Electronic Health Record technology (“CEHRT”). The Medicare EHR Incentive Programs have subsequently undergone numerous changes, and the Medicaid EHR Incentive Program expired effective calendar year 2022.¹⁴ Currently, the Medicare Promoting Interoperability (“PI”) Program applies to eligible hospitals and CAHs, while the Merit-Based Incentive Payment System (“MIPS”) under CMS’s Quality Payment Program applies to eligible clinicians.¹⁵ MIPS consists of four performance categories, one of which is a PI performance category with similar requirements as the PI Program applicable to hospitals and CAHs.¹⁶ PI requirements for eligible hospitals and CAHs and eligible clinicians require the participating provider to be a “meaningful user” of CEHRT.¹⁷

Under the Final Rule, OIG will refer to CMS eligible hospitals, CAHs, and eligible clinicians that OIG has determined to have committed information blocking, and CMS will consider such providers not to be meaningful users of CEHRT. Not being a meaningful user of CEHRT can have significant financial consequences on the provider’s Medicare reimbursement. For an eligible hospital, failure to meet the requirements to be a meaningful user of CEHRT leads to a 75% lower annual increase in Medicare payments based on an inflation market basket update or rate of increase for hospitals that CMS publishes each year.¹⁸ For a CAH, loss of “meaningful user” status would lead to a reduction in payments received from CMS under the Medicare Promoting Interoperability Program from 101 percent to 100 percent of its reasonable costs.¹⁹ Eligible clinicians that are not meaningful users of CEHRT receive a PI performance category score of 0.²⁰ The PI performance category represents 25% of the clinician’s MIPS score.²¹ Eligible clinicians’ MIPS scores are compared to a CMS-established benchmark, with those scoring above the benchmark receiving a bonus of up to 9% more in Medicare payments and those scoring below the benchmark receiving a penalty of up to 9% less in Medicare payments.²²

While the financial impact of the disincentive would vary depending on the provider’s circumstances, the information blocking disincentives proposed rule (the “Proposed Rule”)²³ provided the following estimated ranges:

	Median Disincentive Amount	95% Range for Disincentive Amount
Eligible Hospital (assuming a 3.2% market basket increase)	$394,353	$30,406 to $2,430,766
MIPS Eligible Individual Clinician	$686	$38 to $7,184
MIPS Eligible Clinician Group (assuming group size range of two to 241 clinicians)	$4,116	$1,372 to $165,326

While CMS did not separately simulate the impact on CAHs in the Proposed Rule, CMS noted in the Proposed Rule its belief that “receiving 100 percent of reasonable costs instead of 101 percent of reasonable costs . . . would deter information blocking by CAHs because it would reduce the reimbursement a CAH could have received had it met other requirements under the Medicare Promoting Interoperability Program.”²⁴

Commenters disputed the accuracy of these estimates, with one commenter stating that health care providers with a larger share of Medicare patients could face financial costs approximately 10 times greater than the estimated median impact.²⁵ In response, the agencies “acknowledge[d] that there may be outlier examples that result in monetary values that are significantly higher than the figures presented in the analysis” but disputed the commenter’s assertion that the Final Rule would have an annual economic effect exceeding $200 million, which would require it to undergo a Regulatory Impact Analysis as a major rule.²⁶ The actual financial impact of the Final Rule’s disincentives remains to be seen.

Appropriate Disincentives Related to the MSSP

Under the MSSP, groups of providers of services and suppliers and their associated health care providers (“ACO participants” and “ACO providers/suppliers,” respectively) that meet certain criteria “may work together to manage and coordinate care for Medicare fee-for-service beneficiaries through an ACO.²⁷ If an ACO meets certain quality performance standards established by the Secretary of HHS, the ACO is eligible to receive payments for any shared savings that the ACO generates for Medicare.²⁸ ACOs that generate losses for Medicare may share in those losses, although loss sharing may be mitigated if the ACO meets HHS quality performance standards.²⁹

One of the conditions of participation in the MSSP is that an ACO must coordinate care for assigned beneficiaries using enabling technologies,³⁰ which CMS has interpreted as requiring “[s]haring health information using enabling technologies across all health care providers engaged in a beneficiary’s care.”³¹ In the Proposed Rule, CMS had proposed to bar ACOs, ACO participants, and ACO providers/suppliers determined by OIG to have committed information blocking from participating in the MSSP for at least one year,³² using its authority to administer the MSSP.³³ In the Final Rule, CMS adopted an alternative policy discussed in the Proposed Rule, under which CMS will consider an OIG information blocking determination in light of relevant facts and circumstances before imposing a disincentive under the MSSP.³⁴ Relevant facts and circumstances include the nature of the information blocking, the provider’s diligence in identifying and correcting the problem, the time since the information blocking occurred, whether the provider was previously subject to a disincentive under another program, and other factors.³⁵ CMS stated that many commenters supported this alternative policy and explained that this policy is consistent with existing practices under the MSSP for addressing program integrity issues involving ACOs, ACO participants, or ACO providers/suppliers.³⁶

The discretionary nature of the MSSP disincentive differs from the “meaningful user” disincentives for eligible clinicians, eligible hospitals, and CAHs, which CMS will impose if OIG concludes that such a provider has engaged in information blocking. Providers participating in the Medicare EHR Incentive Programs should keep this in mind as the information blocking enforcement landscape develops.

Transparency for Information Blocking Determinations, Disincentives, and Penalties

The Final Rule also provides that ONC will publish on its public website certain information about Actors that have been determined by OIG to have committed information blocking, including the Actor’s name, business address, a description of the practice found to have been information blocking, the disincentives applied, and where to find additional information from the applicable government agency.³⁷ ONC will publish this information only after any available administrative appeals process has been exhausted.³⁸ ONC believes that it has authority to publish such information pursuant to the provision in the Cures Act that “requires that [ONC] maintain an Internet website ‘to ensure transparency in promotion of a nationwide health information technology infrastructure.’”³⁹ According to ONC, this transparency would allow the public to better understand how information blocking regulations are being enforced, and the types of information blocking violations that Actors have committed.

Industry Reaction

In finalizing the disincentives, ONC and CMS disregarded comments from stakeholders that requested additional education and leniency before providers would be penalized. For example, the American Medical Association submitted comments to the Proposed Rule “urging the Biden administration to emphasize education and corrective action plans before issuing onerous penalties on doctors who may unintentionally violate regulations.”⁴⁰ In the Final Rule, the agencies acknowledged that “[s]everal commenters recommended that education and technical assistance should be provided before applying a disincentive for specific health care providers” but declined to adopt such measures.⁴¹ ONC and CMS also disagreed with commenters who argued that the agencies should delay information blocking enforcement against health care providers, noting that the information blocking regulations have been in effect for over three years (since April 5, 2021).⁴²

In response to the Final Rule, the American Hospital Association released a statement that it “is disappointed that HHS chose to disregard most of the comments they received and is highly concerned that the disincentive structure retained in the final rule is excessive, confusing and imbalanced.”⁴³ The Medical Group Management Association similarly expressed disappointment that “the Administration chose to move forward with significant administrative and financial penalties within existing Medicare quality programs,” also noting that “HHS could have chosen to work with providers to implement corrective action plans, but instead finalized unnecessarily punitive penalties that will financially damage practices and negatively impact Medicare patients.”⁴⁴

Conclusion

The Final Rule introduces powerful enforcement mechanisms targeting health care providers that engage in information blocking. That ONC and CMS proceeded to finalize these disincentives largely as proposed despite significant commenter objections underscores the agencies’ commitment to facilitating access, exchange, and use of EHI and promoting interoperability. Unlike non-provider Actors subject to CMPs imposed by OIG, health care providers will not have the option of self-disclosing information blocking violations to OIG’s self-disclosure protocol in exchange for less severe consequences.⁴⁵ This is significant, especially considering that the vast majority of information blocking complaints that ONC has received to date have been made against health care providers.⁴⁶ All Actors—and especially health care providers—should act now to review their information sharing practices for compliance with information blocking requirements.