In 2020, when the U.S. Department of Health and Human Services (HHS) published its Final Rule to implement the information blocking prohibitions of the 21^st Century Cures Act, HHS left healthcare providers wondering what consequences they may face for violations of the information blocking rules. Over three years later, on November 1, 2023, HHS took a major step toward establishing such consequences by publishing its Proposed Rule: “21^st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking” (the Proposed Rule). The Proposed Rule would allow the HHS Office of Inspector General (OIG) to conduct investigations, make determinations regarding information blocking claims and refer violating healthcare providers to the Centers for Medicare & Medicaid Services (CMS) to be subject to the disincentives described below.

Proposed Disincentives

The Proposed Rule would establish three categories of disincentives for healthcare providers found to have engaged in information blocking based on different CMS programs:

• Hospitals. Eligible hospitals or critical access hospitals (CAH) under the Medicare Promoting Interoperability Program would not qualify as a “meaningful EHR user” in an applicable electronic health record (EHR) reporting period. The practical impact of this re-categorization is a payment reduction: eligible hospitals would lose 75% of the annual market basket increase, while CAHs would see a payment reduction from 101% of reasonable costs to 100% of reasonable costs. HHS estimates that disincentives would range widely from roughly $30,000 to $2.4 million across eligible hospitals, with a median disincentive of $394,353.
• Clinicians. Eligible clinicians or groups under the Promoting Interoperability performance category of the Merit-based Incentive Payment System (MIPS) would not be a “meaningful user of certified EHR technology” in a performance period, resulting in a zero score in the applicable MIPS performance category (often a quarter of an entire MIPS score). In this category, HHS estimates a median individual disincentive of $696 but projects disincentives would grow to over $100,000 for large groups of clinicians.
• Accountable Care Organizations (ACOs). Under the Medicare Shared Savings Program (MSSP), a healthcare provider that is an ACO, ACO participant, or ACO provider or supplier would be deemed ineligible to participate in the program for at least one year. As a result, not only might these providers potentially miss out on revenues they otherwise would have earned as part of the MSSP, but certain ACO providers may also face potential removal from an ACO or resistance to participation in an ACO. CMS would determine whether a longer period of exclusion may be warranted, based in part on any subsequent determinations of further information blocking.

Although the Proposed Rule does not establish disincentives applicable to all types of healthcare providers, the Proposed Rule nevertheless affects a broad enough array of providers to materially advance HHS’s priorities for deterring information blocking. The Proposed Rule invites comments on how to establish further disincentives for other healthcare providers, particularly those not participating in the CMS programs described above.

Enforcement Priorities

The OIG may exercise discretion in selecting which information blocking complaints to investigate. To maximize the efficient use of resources, HHS indicated in the preamble to the Proposed Rule that the OIG would likely focus on the following four stated enforcement priorities applicable to healthcare providers:

• Practices that have resulted in patient harm (or may potentially do so).
• Practices that significantly impact a provider’s ability to care for patients.
• Practices that were of long duration.
• Practices that caused financial loss to federal healthcare programs or other government or private entities.

These enforcement priorities provide the public with a better understanding of how OIG anticipates allocating its enforcement resources and how providers may prioritize their compliance focus.

Practical Suggestions

HHS is accepting comments on the Proposed Rule until January 2, 2024. It is unclear how long providers will wait for a final enforcement regulation. However, in the meantime, providers should proactively focus on confirming they have policies and processes that are updated to promote compliance with the information blocking rules.