On July 3, 2023, OIG published its final enforcement rule (the OIG Rule) permitting imposition of civil monetary penalties (CMPs) for certain actors that engage in information blocking in violation of the information blocking rules published by the Office of the National Coordinator for Health Information Technology (ONC) in May 2020 (the ONC Rule). Although health care providers are included within the “actors” subject to the ONC Rule, the OIG Rule only applies to developers or offerors of certified health information technology (IT) and to health information exchanges and networks (CMP Actors). If OIG determines that an individual or entity subject to the OIG Rule has committed information blocking, they may be subject to up to a $1 million penalty per violation. Enforcement of the OIG Rule will begin on September 1, 2023.

The Final Rule

The 21st Century Cures Act authorizes civil monetary penalties (CMPs) against CMP Actors that engage in information blocking, defined in the ONC Rule in the case of CMP Actors to mean individuals or entities that know or should have known that a practice is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI). CMP Actors subject to the OIG Rule include the following as defined in the ONC Rule:

• Health IT developers of certified health (IT);
• Health information exchanges (HIEs); and
• Health information networks (HINs).

Common examples of information blocking include disabling or restricting the use of a capability that enables users to share EHI with users of other systems, placing excessive fees on consumers for connecting with other health IT systems, and configuring or implementing technology in ways that limit the types of data that can be exported or used from the technology, such as using non-standard implementation methods.

Information blocking enforcement against providers is carried out separately through “provider disincentives” that are currently under development by the ONC. But, if OIG investigations into alleged information blocking suggest that a healthcare provider may not be in compliance with ONC requirements, then OIG may refer such matters to ONC. Additionally, OIG hinted that under current ONC definitions, a provider could be considered a HIN/HIE subject to the Final Rule depending on the particular facts and circumstances.

Enforcement Priorities

OIG expects to receive more complaints of information blocking than it is able to investigate. Recognizing this, OIG stated that it will likely prioritize for investigation cases that:

• resulted in, are causing, or had the potential to cause patient harm;
• significantly impacted a provider’s ability to care for patients;
• were of long duration;
• caused financial loss to Federal health care programs, or other government or private entities; or
• were performed with actual knowledge.

If OIG determines that information blocking subject to CMPs occurred, then OIG will determine the penalty amount by taking into account the nature and extent of the information blocking, the number of patients affected, the number of providers affected, the number of days the information blocking persisted, and the resulting harm. Per statute, such penalty is capped at $1 million per violation. In addition, OIG states that it will soon post an information blocking self-disclosure protocol on OIG’s website for actors seeking to resolve potential CMP liability.

Enforcement of the information blocking penalties outlined in the Final Rule begins on September 1, 2023. The Final Rule can be found here. For further background, ONC’s final May 2020 information blocking rule is available here.