On April 21, 2020, the U.S. Department of Health and Human Services released a series of announcements signaling its intention to finalize and enforce certain aspects of the Office of the National Coordinator (ONC) Cures Act Final Rule and the Centers for Medicare and Medicaid Services (CMS) Interoperability and Patient Access Final Rule. The announcements provide little breathing room for health care providers, payers, and IT companies currently responding to the COVID-19 public health emergency. Although organizations now have additional time to develop and implement compliance strategies, they should not abandon ongoing efforts to address the interoperability and information blocking rules.
Publication in Federal Register and Policy of Enforcement Discretion
The Cures Act Final Rule and the Interoperability and Patient Access Final Rule are scheduled to be published in the Federal Register on May 1, 2020. As written, these rules included several compliance dates that were to be calculated from the date of publication. However, due to the current public health emergency, ONC and CMS have adopted temporary policies of relaxed enforcement with respect to certain obligations under the rules.
In particular, CMS has announced that the following requirements will be extended:
| Requirement |
Extension |
| Admission, discharge, and transfer (ADT) notification Conditions of Participation |
The new Conditions of Participation at 42 CFR Parts 482 and 485 will now be effective 12 months after the final rule is published in the Federal Register |
| Patient Access API and Provider Directory API policies for Medicare Advantage, Medicaid, and the Children's Health Insurance Program |
CMS will not enforce the new requirements under 42 CFR Parts 422, 431, 438, and 457 until July 1, 2021 |
| Patient Access API for Qualified Health Plan Issuers on the Federally-Facilitated Exchange |
CMS will not enforce the new requirements under 45 CFR Part 156 until July 1, 2021 |
However, all other aspects of the Interoperability and Patient Access Final Rule will be implemented and enforced on schedule.
Similarly, ONC has announced that it will exercise enforcement discretion with respect to certain of the new requirements under the Health IT Certification Program, and ONC has published a chart detailing the applicable dates for health IT developers. Importantly, the enforcement discretion does not apply to the information blocking provisions at 45 CFR Part 171, which will go into effect on November 2, 2020 as planned.
OIG Proposed Rule Regarding CMPs for Information Blocking
In addition to the announcements from CMS and ONC, OIG published a Proposed Rule that would amend the civil monetary penalty (CMP) regulations and include, among other things, new CMP authorities for information blocking. As currently structured, ONC's information blocking provisions would serve as the basis for determining whether CMPs should be imposed as well as the amount of any penalty. OIG has not proposed new information blocking requirements in its Proposed Rule. The public comment period for OIG's Proposed Rule ends on June 23, 2020.
Importantly, OIG did not propose to include CMP authority with respect to health care providers who engage in information blocking. Rather, under the Proposed Rule, the CMP authority only applies to health IT developers, other entities offering certified health IT, health information exchanges, and health information networks. For health care providers, OIG would coordinate with, and refer the health care provider to, the "appropriate agency" (such as ONC or OCR) for "appropriate disincentives" as established by future rulemaking.
For those entities that could be subject to the CMPs for information blocking, OIG has currently proposed to delay enforcement until 60 days after the Proposed Rule is finalized. However, OIG also noted that it is considering an alternative proposal for the final rule in which OIG would establish a specific effective date (potentially, October 1, 2020) in order to provide more certainty regarding the enforcement timeline. OIG stated that it believes the rulemaking process can be completed before an October 1, 2020 effective date, and OIG has asked for public comments as to when its information blocking enforcement should begin.
Although the Proposed Rule includes delayed enforcement, OIG stated that "individuals and entities subject to the information blocking regulations must comply with the ONC Final Rule as of the compliance date for 45 CFR part 171." OIG further explained that "the period between the compliance date of the ONC Final Rule and the proposed start of OIG's information blocking enforcement will provide individuals and entities with time to come into compliance with the ONC Final Rule with added certainty that practices during that period will not be subject to penalties."
OIG stated that its "enforcement priorities will include conduct that: (i) resulted in, is causing, or had the potential to cause patient harm; (ii) significantly impacted a provider's ability to care for patients; (iii) was of long duration; (iv) caused financial loss to Federal health care programs, or other government or private entities; or (v) was performed with actual knowledge." Moreover, because the definition of information blocking includes an element of intent, OIG has indicated that it "will not bring enforcement actions against actors who OIG determined made innocent mistakes."
