The U.S. Department of Health and Human Services (HHS) has just unveiled a proposed rule designed to penalize health care providers engaging in information blocking. Information blocking is a practice where health care providers interfere with the access or use of health information — impeding the flow of critical patient data. Under the proposed rule, a single information blocking violation could result in stiff penalties for providers who participate in the Medicare Merit-based Incentive Payment System (MIPS) or the Shared Savings Program.

Between April 5, 2021 and September 2023, the Office of the National Coordinator for Health Information Technology (ONC) received 812 reports of possible information blocking. Most of these reports were submitted by patients, with health care providers being the most common potential information blocking actors. If the penalties and disincentives are implemented as proposed in the rule, providers should expect even more information blocking allegations against them.

The proposed rule seeks to expand on the HHS Office of Inspector General's (OIG) efforts to combat information blocking. The HHS-OIG previously implemented a final rule, imposing significant penalties of up to $1 million on health care IT developers of certified health IT, health information exchanges, or health information networks that engage in information blocking.

The newly proposed rule details potential penalties for health care providers participating in Medicare if the OIG finds that they have engaged in information blocking, and subsequently refers its findings to the appropriate agency, such as Centers for Medicare & Medicaid Services (CMS). HHS plans to solicit information from the public to determine the feasibility of broader application. HHS Secretary Xavier Becerra stated that the proposed rule, if finalized, would further promote the appropriate sharing of electronic health information and establish a framework for creating additional disincentives in the future.

Proposed Disincentives

The proposed rule aims to establish disincentives for health care providers that engage in information blocking. The proposed rule creates disincentives under the following CMS programs:

• Medicare Promoting Interoperability Program for Eligible Hospitals and Critical Access Hospitals (CAHs): Under the new proposed definition of "meaningful electronic health record (EHR) user," an eligible hospital or CAH engaging in information blocking could fail to qualify as a meaningful EHR user during the relevant EHR reporting period. Failure to qualify would result in a downward payment adjustment.

• Medicare Merit-based Incentive Payment System (MIPS): A MIPS-eligible clinician engaging in information blocking could fail to qualify as a meaningful EHR user during the relevant EHR reporting period. This could result in the provider earning a zero score for the MIPS Promoting Interoperability performance category, which typically constitutes a quarter of the total final score. This would significantly impact the provider's final score and potential for positive payment adjustments.

• Shared Savings Program: A health care provider identified as an Accountable Care Organization (ACO), ACO participant, or ACO provider or supplier could become ineligible to participate in the program for a minimum of one year, meaning it would not be eligible to receive any shared savings payments for the period of exclusion.

If CMS (or another applicable agency) imposes a disincentive, it will send a notice to the provider that includes a description of the practice that formed the basis for determination of information blocking (as received from the OIG), the basis for application of the disincentive being imposed, the effect of each disincentive, and any other necessary information for a provider to understand how each disincentive will be implemented.

The proposed rule also includes provisions for establishing additional disincentives in the future.

OIG Assessment of Information Blocking Allegations

The OIG's enforcement priorities will guide its decisions on which information blocking allegations to pursue, but each allegation will be assessed individually based on its unique facts and circumstances. The OIG may also prioritize investigations based on the volume of claims relating to similar practices by the same entity or individual. However, there is no specific formula for evaluating and prioritizing which claims warrant investigation.

As for the OIG's enforcement priorities, the OIG will investigate health care providers based on four factors, including whether the information blocking activity: (i) resulted in, is causing, or has the potential to cause patient harm; (ii) significantly impacted a provider's ability to care for patients; (iii) was of long duration; and (iv) caused financial loss to federal health care programs, or other government or private entities.

When investigating an allegation, the OIG will determine whether the health care provider knew that the practice in question was "unreasonable and likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information." While the "reasonableness" standard will likely evolve through enforcement actions, acts or omissions that are consistent with the information blocking exceptions will presumably be deemed reasonable. As a result, health care providers should develop information blocking compliance policies that are compliant with these exceptions, if they have not done so already.

Agency Referral

When the OIG completes its investigation and determines that a health provider has committed information blocking, it refers the provider to the appropriate agency for further action. At that time, the OIG will provide such agency with an explanation of its determination. In the context of the proposed rule, the OIG would refer the information blocking provider to CMS. Upon receiving the referral, CMS would then apply the proposed disincentives described above.

Appeal Mechanisms

Following the application of a disincentive, a health care provider may have the right to appeal administratively if the authority used to establish the disincentive provides for such an appeal. In the proposed rule, the OIG did not mention a separate appeal process for its determinations regarding information blocking.

For example, under the Shared Savings Program, providers may be able to appeal the application of an information blocking disincentive. Providers can request a reconsideration review by a CMS reconsideration official, subject to certain limitations. The underlying information blocking determination made by OIG, however, would not be subject to the Shared Savings Program's reconsideration process, as it is a determination made by another agency. The Shared Savings Program reconsideration process may not negate, diminish, or otherwise alter the applicability of determinations made by other government agencies. Therefore, any right to appeal an information blocking determination would be provided under the authorities used by the secretary to establish the disincentive through notice and comment rulemaking.

Transparency

In the interest of transparency, the OIG also proposes to publicly release information about actors that have committed information blocking. The aim is to inform the public about how and where information blocking is occurring. The information would be posted on the ONC website. Information will include their name, business address, the information blocking activity, the disincentive(s) applied, and where to find additional information about the information blocking determination.

Other Considerations

In addition to the proposed disincentives for information blocking, an information blocking violation may also constitute a violation of the Health Insurance Portability and Accountability Act (HIPAA) — subjecting the provider to additional fines and penalties. HIPAA and the Cures Act have established regulatory frameworks that intersect in the realm of health information sharing and privacy, and the information blocking framework necessitates a balance between information privacy and information sharing. HIPAA outlines when, how, and by whom Protected Health Information (PHI) can be accessed and disclosed, while the Cures Act mandates that if electronic health information (EHI) can be released, it must be provided to the requestor, unless an exception applies.

The tension between these two frameworks is evident in scenarios where HIPAA permits but does not require the sharing of health information, while the information blocking framework obligates the sharing of EHI unless an exception applies. Furthermore, state-specific data privacy laws must also be considered. These competing, but equally important interests, may be why the OIG works with other agencies like Office for Civil Rights (OCR), if they believe a HIPAA enforcement action will better resolve an information blocking claim.

Public Comment Period

The proposed rule is currently on the Office of the Federal Register's website and was published in the Federal Register on November 1. It will then be available for public comment for 60 days. Written or electronic comments must be received via the Federal Register no later than 11:59 p.m. ET on January 2, 2024.