The U.S. Department of Health and Human Services (“HHS”) on October 30, 2023, issued a Notice of Proposed Rulemaking (“NPRM”) to establish penalties for healthcare providers found to have committed information blocking. This much-anticipated proposal ties “appropriate disincentives” to the Medicare Promoting Interoperability Program, the Promoting Interoperability performance category of the Merit-based Incentive Payment System (“MIPS”), and Accountable Care Organization (“ACO”) participation under the Medicare Shared Savings Program. While this initial round of proposals is focused on penalties in the form of reduced payments under certain Medicare payment programs, HHS also is soliciting input on other “appropriate disincentives” for healthcare providers that do not come within the scope of these initial proposals. Comments on the proposed rule are due by January 2, 2024.

Background

“Information blocking” is prohibited under Section 4004 of the 21^st Century Cures Act (“Cures Act”) and its implementing regulations at 45 CFR 171.100 et seq. These rules define practices that constitute information blocking and authorize the secretary of HHS to identify reasonable and necessary activities that do not constitute information blocking (referred to as “exceptions”).

With respect to healthcare providers, information blocking is defined at 45 CFR 171.103, which HHS has summarized as “when a provider knowingly and unreasonably interferes with the access, exchange, or use of electronic health information except as required by law or covered by a regulatory exception.”

“Healthcare provider” is broadly defined for purposes of the information blocking rules, and includes (among others): (1) entity providers, such as hospitals, various long term and home care entities, healthcare clinics, group practices, ambulatory surgery centers, EMS providers, pharmacies, and laboratories; (2) individual providers, such as physicians, pharmacists, therapists, and other practitioners; and (3) a catchall category for “any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary.”

Disincentives

Under the Cures Act, HHS was tasked with promulgating “appropriate disincentives” applicable to healthcare providers that are found by the HHS Office of Inspector General (“OIG”) to have committed information blocking. Although this Cures Act requirement has existed since late 2016, and the information blocking regulations have been in effect since 2020, HHS has only recently proposed such “disincentives” for healthcare providers.

Specifically, HHS has proposed the following as “appropriate disincentives” for healthcare providers found to have committed information blocking:

• Under the Medicare Promoting Interoperability Program, an eligible hospital or critical access hospital (“CAH”) would not be a meaningful electronic health record (“”er”) user in an applicable EHR reporting period. The impact on eligible hospitals would be the loss of 75% of the annual market basket increase; for CAHs, payment would be reduced to 100% of reasonable costs instead of 101%.
• Under the Promoting Interoperability performance category of MIPS, an eligible clinician or group would not be a meaningful user of certified EHR technology in a performance period and would therefore receive a zero score in the Promoting Interoperability performance category of MIPS, if required to report on that category. The Promoting Interoperability performance category score typically can be a quarter of a clinician or group’s total MIPS score in a year.
• Under the Medicare Shared Savings Program, a healthcare provider that is an Accountable Care Organization (“ACO”), ACO participant, or ACO provider or supplier would be deemed ineligible to participate in the program for a period of at least one year. This may result in a healthcare provider being removed from an ACO or prevented from joining an ACO.

In its NPRM, HHS acknowledges that the above would “not establish disincentives for all of the health care providers included in the [information blocking rule] definition.” However, it goes on to solicit comments on what other disincentives might be appropriate for healthcare providers outside the reach of these initial proposals and also alludes to potential future rulemaking to add additional disincentives.

The Office of the National Coordinator for Health Information Technology (“ONC”) and Centers for Medicare & Medicaid Services (“CMS”) will host an information session about the proposed rule on November 15, 2023 at 1:30 p.m. EST.

To be assured consideration, written or electronic comments must be received no later than 11:59 p.m. EST on January 2, 2024. Instructions for submitting comments are included in the NPRM.

Healthcare Provider Next Steps

While the disincentives under the proposed rule are not yet in force and remain subject to revision through the notice and comment rulemaking process, the NPRM is an indication of HHS’s commitment to moving forward in the process of establishing penalties for failure to comply with the information blocking regulations. Some steps healthcare providers should consider at this point include:

• Conduct a review of the applicability of the information blocking regulations to the healthcare provider’s organization
• Work to understand what the proposed disincentives could mean for the organization from the perspective of potential financial impact
• Review existing policies and processes to mitigate against risk of noncompliance with the information blocking regulations
• Conduct a similar review to confirm that the healthcare provider is adequately positioned to satisfy applicable exceptions on which it may rely
• Coordinate among departments, including IT, compliance, and legal, to ensure that the functions are aligned in their approaches, especially in light of competing regulatory pressures of the information blocking regulations versus more protective frameworks such as HIPAA
• Attend the ONC/CMS information session on November 15, 2023
• Consider submitting comments to the proposed rule
• Continue to actively monitor for updates as further developments arise