Healthcare Providers Beware: Finalized Disincentives Sharpen the Teeth of Information Blocking Rule

07/15/2024|9 minute read

On June 24, 2024, the Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC) at the Department of Health and Human Services (HHS) issued the 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking" final rule (Final Rule). The Final Rule is the culmination of long-awaited enforcement rulemaking associated with the prohibitions on the practice of information blocking first outlined in the 21st Century Cures Act (Information Blocking Rule). The Final Rule, which goes into effect July 31, 2024, finalizes the penalties applicable to healthcare providers that are found to have knowingly engaged in the practice of information blocking.

The Cures Act defines information blocking as a practice that, except as required by law or as permitted in accordance with the enumerated exceptions to the information blocking prohibition, is likely to interfere with, prevent or materially discourage access, exchange or use of electronic health information (EHI). The Information Blocking Rule provides that the Office of the Inspector General (OIG) may investigate claims that "a health care provider engaged in information blocking," and that any healthcare provider the OIG determines has committed information blocking shall be referred to the "appropriate agency" to be subject to appropriate disincentives using authorities under applicable federal law.

The disincentives established by the Final Rule are the result of long-gestating enforcement mechanisms specific to healthcare providers that are tethered to payment adjustments under the CMS promoting interoperability programs. We note that enforcement for health IT developers and health information networks/health information exchanges, which are the other two types of actors under the Information Blocking Rule, are subject to a different scheme of civil monetary penalties, which we previously analyzed as part of our ongoing tracking of the Information Blocking Rule.

Key Takeaways:

• The Final Rule establishes disincentives for the following healthcare providers: eligible hospitals and critical access hospitals (CAHs) participating in the Medicare Promoting Interoperability Program; Merit-Based Incentive Payment System (MIPS) eligible clinicians; and accountable care organizations (ACOs), ACO participants and ACO providers participating in the Medicare Shared Savings Program (MSSP). The finalized provider disincentives do not apply to healthcare providers that are not Medicare-enrolled providers or suppliers, and CMS indicated that it plans to address disincentives for healthcare providers not covered by the Final Rule in future rulemaking.

• ONC will publicly post a "wall of shame" containing information about healthcare providers found to have committed information blocking.

• OIG will not begin investigating claims of information blocking or applying disincentives by healthcare providers until July 31, 2024, and will not make any referrals based on conduct occurring prior to this effective date. This is especially important considering ONC indicated that 1,000 complaints have been received in its information blocking portal, with more than 75 percent coming from patients and 80 percent of such complaints being against healthcare providers.

Applicability and Enforcement Standard

The Final Rule sets forth the disincentives that will apply to healthcare providers found to be information blocking. Notably, the provider standard for information blocking is unique compared to the other actors subject to the Information Blocking Rule - before a healthcare provider accused of information blocking can face any disincentives, OIG must be able to demonstrate that the provider knew that the practice was unreasonable and likely to interfere with the access, exchange or use of EHI. According to HHS in a listening session regarding the Final Rule, this is a high bar for OIG to reach prior to making a determination that a healthcare provider was found to be engaged in the practice of information blocking.

Investigation Priorities and Process

While the practice of information blocking may arise in a variety of situations, OIG has reiterated that its

investigation and enforcement priorities will focus on practices that:

• Resulted in, are causing or have the potential to cause patient harm
• Significantly impacted a provider's ability to provide care to patients
• Were of long duration
• Caused financial loss to a federal healthcare program or other private entities

OIG will coordinate with CMS and ONC as necessary as part of its investigations, and may refer allegations of information blocking to the HHS Office for Civil Rights when the information blocking claim may be resolved under HIPAA; further, OIG also has the right to refer other allegations (i.e., not limited to information blocking claims) to OCR, as necessary. The agency that seeks to impose a disincentive under the Final Rule will send notice to the healthcare provider, and the healthcare provider may have a right to an administrative appeal if the agency's authority used to establish the disincentive provides for such an appeal.

Transparency in Information Blocking Enforcement

Once implemented, ONC will publicly post on its website a "wall of shame" listing the actor and its business address, the identified information blocking practices, the disincentive applied to the healthcare provider, and where to find other information about the information blocking determination. If no disincentive is applied, no information will be posted publicly on ONC's website, and information will not be posted until after any appeals process is complete.

The Finalized Provider Disincentives

Hospitals, CAHs and Eligible Clinicians

Key to understanding the applicability of the provider disincentives to healthcare providers is an understanding that such disincentives are tethered to the Electronic Health Records (EHR) Incentive Programs established in 2011 by CMS to encourage the meaningful use of certified health record technology (CEHRT) by eligible hospitals, CAHs and MIPS-eligible clinicians. The current iterations of the respective programs - the Medicare Promoting Interoperability (PI) Program for eligible hospitals and CAHs, and the MIPS program for eligible clinicians under the Quality Payment Program - require that participants report data to demonstrate being a meaningful user of CEHRT to receive positive payment adjustments under the programs. The Final Rule established the disincentives for the PI Program and the MIPS program as follows:

• PI Program
  • An eligible hospital will not be considered a meaningful EHR user for any reporting period in which OIG determines that the hospital committed information blocking.CMS will reduce an eligible hospital's payment by 75 percent of the market basket update, if the hospital is referred by OIG.
  • A CAH will have its payment reduced from 101 percent of reasonable costs it might have earned in a year to 100 percent of reasonable costs.
    • The proposed provider disincentives rule estimated a median disincentive amount of $394,353 and a 95 percent range of $30,406 to $2,430,766 across eligible hospitals (assuming a 32 percent market basket increase).
• MIPS
  • A MIPS-eligible clinician will not be considered a meaningful EHR user in a performance period if OIG determines that the clinician committed information blocking.Clinicians who are found to have committed information blocking will receive a score of zero in the Promoting Interoperability category of MIPS, which typically accounts for a quarter of the total composite score.
  • Importantly, CMS will not use a group score if only one eligible clinician was found to be information blocking.
    • For MIPS-eligible clinicians, the proposed rule estimated a median individual disincentive amount of $686 and a 95 percent range of $28 to $7,184 across eligible clinicians. For groups, assuming a group size between two and 241 clinicians, ONC estimated a group disincentive of $4,116 with a range of $1,372 to $165,326.

Industry stakeholders in response to the proposed provider disincentives rule anticipated that the disincentives would amount to much higher penalties than estimated by ONC and CMS. Specifically, the American Hospital Association (AHA) argued that the penalties were excessive, potentially overlapping, and unfair, and as proposed, an underestimation of the real financial impact to healthcare providers. The AHA, using the same formula as CMS and ONC in the proposed rule, claimed that several hospital members estimated that their penalties could be three times the upper level numbers, and that the average impact would be nearly 10 times higher than the median mentioned in the proposed rule.

Medicare Shared Savings Program (MSSP)

The Final Rule contains provisions specific to the MSSP, which is a voluntary program consisting of groups of providers and suppliers (ACO participants) and their associated healthcare providers (ACO providers/suppliers) to work together to manage and coordinate care for Medicare beneficiaries through an ACO. ACOs that meet quality standards may receive payments for shared savings generated by the ACO for Medicare. A condition of participation in an ACO is coordinating care for Medicare beneficiaries through enabling technologies, which CMS interprets as requiring having a written plan to encourage the use of enabling technologies, including sharing health information using such enabling technologies. The Final Rule implements the following disincentives for ACOs, ACO participants or ACO providers:

• The ACO, ACO participant or ACO provider could be barred from the MSSP for at least one year.
• Denying the addition of an ACO participant to an ACO participant list.
• Informing the ACO that remedial action should be taken against an ACO participant.
• Denying an ACO's application to participate in the MSSP if the remedial action is not taken.
• Terminating an ACO's participation agreement with CMS.

Importantly, the Final Rule implemented an alternative policy for CMS to, upon OIG's determination of information blocking, consider the relevant facts and circumstances before applying a disincentive under the MSSP. Relevant facts and circumstances include the nature of the healthcare provider's information blocking, the healthcare provider's diligence in identifying and correcting the problem, the time since the information blocking occurred, and whether the provider was previously subject to a disincentive under another program, among other factors.

Notably, a healthcare provider may be subject to more than one type of disincentive (e.g., a MIPS-eligible clinician participating in an ACO may be subject to disincentives under both respective programs). However, the Final Rule grants CMS discretion under the alternative policy, at least with respect to the disincentives for the MSSP participants, to consider the relevant facts and circumstances before imposing a disincentive; for example, CMS may consider whether a MIPS-eligible clinician was already subject to a disincentive under the MIPS program before determining to impose a disincentive under the MSSP.

The application of the disincentives will be consistent across healthcare providers, regardless of the size or resources of the healthcare provider being subjected to the disincentive, though the Final Rule expressed an agency's ability to implement policies based on the type of healthcare provider subject to the disincentive, citing how CMS automatically reweights the MIPS Promoting Interoperability category score to zero for small practices. Notably, while the disincentives established for healthcare providers are expansive, they may not provide exclusive enforcement activity, as the Final Rule expressly noted that additional disincentives may be established through future rulemaking.

Data Segmentation and Technical Infeasibility

During a regulator information session about the Final Rule, ONC acknowledged that data segmentation remains an ongoing technical challenge for actors that are subject to the Information Blocking Rule. Several attendees posed questions about the tension between complying with requests for EHI under the Information Blocking Rule and adhering to laws restricting the disclosure of sensitive health information as well as requests made by individuals to place restrictions on their EHI.

The regulators recognized the challenges presented by technical limitations in data segmentation capabilities and referred attendees to the recently finalized Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Rule(HTI-1 Rule), which made program updates to the ONC Health IT Certification Program and enhanced the information blocking regulations and related exceptions.

In commentary to the HTI-1 Rule, ONC stated that the segmentation condition of the Infeasibility Exception is applicable when an actor cannot fulfill the request for access, exchange, or use of EHI from EHI that cannot be made available due to the individual's preference, cannot be made available by law (for example, HIPAA or other federal law), or may be withheld under the Preventing Harm Exception. ONC expressly recognized in commentary that "many actors may not currently be able to segment" sensitive data, such as reproductive health and behavioral health information, which are types of data patients are likely to request restrictions on use or disclosure.

ONC further noted that actors engaging in practices not fully covered by one exception can seek protection under more than one exception to the Information Blocking Rule (i.e., "stack" exceptions). As an example, ONC described a scenario where an individual requests that an actor not share certain EHI, and the actor agrees to the request but later receives a request for EHI that encompasses information the individual requested not be shared. If the actor determines that it can segment some, but not all, of the requested EHI, the actor can stack the Privacy Exception (by granting the individual's request not to share some of the EHI and not sharing such EHI upon request) and the Infeasibility Exception (by notifying the requestor it cannot provide the EHI that cannot be unambiguously segmented but can provide the portion of the EHI that can be segmented) to prevent its practices from being considered information blocking.

Additionally, ONC confirmed that complying with the PI Program does not require healthcare providers to violate state or federal data protection laws that are more stringent than HIPAA, including the federal regulations governing the confidentiality of drug and alcohol abuse treatment and prevention records under 42 CFR Part 2 or state laws that impose additional preconditions for providing access, exchange or use of EHI (e.g., laws that require a minor's consent before disclosure of records related to a medical treatment/procedure for which the minor consented).

Response from Healthcare Industry Stakeholders

Notable trade associations in reaction to the Final Rule expressed their concerns and reservations about the regulation, as they did when the disincentives were initially proposed. The AHA expressed disappointment that HHS disregarded most of the comments it received and remains highly concerned that the disincentive structure is excessive, confusing and imbalanced. The Medical Group Management Association (MGMA) also expressed disappointment with the Final Rule and the agencies' decision to move forward with consequential administrative and financial penalties within the existing Medicare quality programs. The MGMA noted that medical groups already face difficulties with reporting under MIPS, and that with the enforcement of a penalty of zero points in the Promoting Interoperability category, groups will likely receive a negative payment adjustment to every Medicare claim for an entire payment year, and that preventing practices and ACOs from participating in the MSSP runs counter to the transition to value-based care.

Conclusion

Ever since the passage of the Information Blocking Rule, healthcare providers have been waiting to see how ONC, OIG and CMS would handle enforcement associated with the prohibitions on the practice of information blocking. Many healthcare providers, after years of rulemaking, are faced with significant penalties and a concrete enforcement date. While healthcare providers may take solace in the fact that complaints of information blocking practices made prior to the Final Rule's effective date will not be subject to disincentives, the looming effective date to such complicated, potentially hefty penalties is cause for healthcare providers to reevaluate their practices, the information blocking regulations generally and any applicable exceptions that may cover their practices.

We note that future rulemaking is likely for providers that are carved out from this Final Rule. We will continue to monitor ongoing rulemaking and developments in the enforcement of the information blocking rule.

This alert is co-authored by Devan Hammack, summer associate.

Public link

Please use the above public link if you want to share this noodl on another website.