By Beth Neal Pitman
This article is Part 2 of a two-part series on the information blocking disincentives for healthcare providers that took effect on Aug. 1, 2024, following publication of the final rule in July by the U.S. Department of Health and Human Services (HHS).
In August, HHS finalized information blocking disincentives for healthcare providers that continue the agency’s commitment to encouraging permitted access to and exchange of electronic health information. The final rule specifically focuses on establishing disincentives for healthcare providers found by the HHS Office of Inspector General (OIG) to have committed information blocking.
Key Considerations
The final rule maintains several noteworthy aspects from the proposed rule:
Scope. Disincentives apply to healthcare providers, including hospitals, physicians, dentists, certain therapists and other eligible professionals participating in Medicare and Medicaid programs, and is not limited to persons regulated by the Health Insurance Portability and Accountability Act (HIPAA) or healthcare providers using certified Health Information Technology (IT).
There remains a large gap in healthcare providers for which there is no current disincentive and we expect to see OIG and ONC address this gap.
Healthcare providers will not be penalized for information blocking conduct attributed to a Health IT developer.
There will be no “double” penalty for providers who may participate in multiple CMS payment programs, such as the Medicare Access and CHIP Reauthorization Act (MACRA), Merit-Based Incentive Payment System (MIPS) program and Affordable Care Organizations (ACO) shared savings program.
Impact. Facilities required to report Promoting Interoperability may see the greatest financial impact in Medicare reimbursement reductions. Hospitals will have a 75 percent reduction in the market basket update, and critical access hospitals will see a reduction from 101 percent to 100 percent of reasonable cost reimbursements. HHS estimated the impact in the range of $30,406 to $2,430,766. The AHA issued strong objections to the disincentives noting that the actual penalties may be higher by as much as three times and will have a disproportionate, inequitable and potentially destructive impact on hospitals.
HHS estimated that the median group disincentive for MIPS clinicians will be $4,116, with a range of $1,372 to $165,326. Participation in MIPS is voluntary.
Disincentives for ACOs and participants will result in removal from or denial of participation in the ACO for at least one year and receipt of related incentives. As noted by AHA, the ACO disincentive will negatively impact other ACO participants in the ACO and community beneficiaries of the ACO activities.
Attestations of no information blocking are required reporting in the MIPS and Promoting Interoperability programs. Providers found to be information blockers may also be subject to False Claims Act enforcement.
Process. OIG is responsible for investigating and determining instances of information blocking. The OIG’s Information Blocking site includes specific resources for more detail. After a determination of information blocking, OIG will refer the healthcare provider to the appropriate agency, in this case the CMS, to impose the appropriate disincentives. During the investigation and prior to a determination of information blocking, OIG will coordinate with the appropriate agency (CMS in this case) regarding the potential referral for imposition of disincentives. The proposed OIG enforcement priority structure (which is not binding) was maintained in the final rule, which includes:
resulted in, are causing, or have the potential to cause patient harm
significantly impacted a provider’s ability to care for patients
were of long duration
caused financial loss to federal healthcare programs or other government or private entities
Appeals. Neither the 21st Century Cures Act (Cures Act) nor the final rule establishes an administrative appeals process but instead defers to appeal processes available under the authority relied upon by HHS to establish a disincentive (i.e., authority for payments, recoupment, or contracting for Shared Savings Programs, MIPS or Promoting Interoperability).
Timing. The Cures Act and HHS did not establish a time period for imposition of disincentives after a determination of information blocking has been determined, but defers to the timing requirements in regulatory authority for the agency imposing the disincentive.
Enforcement Discretion. OIG will not investigate healthcare providers until after the effective date of the final rule and is exercising its enforcement discretion not to make any determination of information blocking, and related referral for imposition of disincentives, on conduct occurring prior to the effective date of the final rule. There is, however, no structure allowing OIG to exercise enforcement discretion, as there is with HIPAA, in either waiving or reducing penalties in light of voluntary corrective action or other voluntary remediation.
Current Information Blocking Complaint Status
Anyone can submit an information blocking complaint to the ONC Information Blocking Portal or the OIG Hotline. From April 5, 2021, through August 31, 2024, over 1100 complaints have been received. OIG has determined that 1,059 are possible claims of information blocking, approximately 85 percent were filed by patients (which could also include attorneys on behalf of patients) and more than 90 percent were regarding healthcare providers.
Implications for Healthcare Providers
Information blocking regulations have been effective since April 5, 2021, with a lengthy phase-in period. HHS reiterated through the final rule that its imperative to begin enforcement without delay is predicated on the fact that providers have had more than three years to implement an anti-information blocking program. Providers should take the following steps:
Review and Update Policies and Processes. Ensure that organizational policies and procedures align with information blocking regulations and promote seamless electronic health information (EHI) exchange. Assure that processes implemented align with policy statements and do not contribute to practices of information blocking.
Privacy Compliance Integration. Monitor changes in privacy laws and integrate compliance with privacy laws, such as HIPAA’s reproductive healthcare privacy rules and Part 2 Substance Use Disorder privacy law, with processes to mitigate and prevent information blocking.
Training. Provide comprehensive training to staff members on information blocking, including the definition, exceptions and potential consequences of noncompliance. Particular attention to staff responsible for Health IT, health information management and privacy is important.
Monitor Compliance. Implement mechanisms to monitor and audit information sharing practices to identify and address any potential issues proactively. Address specific processes for navigating privacy laws prohibiting or delaying disclosures, such as the recent HIPAA reproductive healthcare privacy rules.
Health IT Coordination and Contracting. Investigate technology processes that can enable compliance with the Cures Act and assist in flagging and restricting disclosure of sensitive information that is either prohibited from disclosure or requires additional consents or other actions prior to disclosure. Contracts with Health IT vendors should include provisions requiring compliance with the Cures Act and affording healthcare providers with protection in the event the Health IT vendor engages in information blocking conduct.
Mergers and Acquisitions. Information blocking compliance should be incorporated into diligence reviews in transactional matters.
In Case You Missed It
Part 1 of Holland & Knight’s series on information blocking disincentives appeared in the September 2024 issue of The Birmingham Medical News.
Beth Neal Pitman is a partner in the Birmingham, Alabama, office of Holland & Knight.
