by Margaret Young Levi, Kathie McDonald-McClure, and Drayden Burton (Wyatt Summer Associate)

On July 1, 2024, the U.S. Department of Health and Human Services (HHS) published a final rule entitled “21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking,” 89 Fed. Reg. 54662 (Final Rule) establishing “disincentives” for health care providers who commit information blocking. Importantly, the 21^st Century Cares Act explicitly delegated the authority to HHS to establish “appropriate disincentives” for information blocking through notice and comment rulemaking. 42 U.S. Code § 300jj–52(b)(2)(B). Previously, on October 23, 2023, HHS published its proposed rule seeking comments on the proposed appropriate disincentives (Proposed Rule).   

In general, “information blocking” means knowingly and unreasonably interfering with, preventing, or materially discouraging the access, exchange, or use of “electronic health information” (EHI) unless such blocking is required by law or permitted by regulatory exceptions. To learn more about information blocking and the permitted exceptions, see our article “Information Blocking Rule Effective April 5, 2021: Are Providers Ready?,” which provides an overview of the Rule’s key elements and requirements. The prohibition on information blocking went into effect on April 5, 2021, but until now did not contain any penalties for health care providers who engage in information blocking.  Previously, on June 27, 2023, the HHS Office of Inspector General (HHS-OIG) established civil monetary penalties of up to $1 million per information blocking violation by developers of certified health information technology and for health information networks (HINs) and health information exchanges (HIEs).  (88 Federal Register 42820).

This Final Rule adds some teeth, aiming to ensure that individuals and their health care providers always have access to the individual’s health information.  Some of the comments that HHS had received to its Proposed Rule supported disincentives that incentivize an exchange of EHI across care settings on the basis that this will lead to better patient outcomes. In issuing its Final Rule HHS stated, “When health information can be appropriately accessed and exchanged, care is more coordinated and efficient, allowing the health care system to better serve patients.”

The “Disincentives”

The Final Rule establishes certain “disincentives” for several categories of health care providers that HHS-OIG finds to have engaged in activities that interfere with or prevent access to EHI that constitute information blocking. These disincentives are as follows:

• Hospitals and Critical Access Hospitals (CAHs). Under the Medicare Promoting Interoperability Program, eligible hospitals and CAHs engaged in information blocking could see a decrease in the Medicare payments they would have otherwise received for successful participation.  The hospital or CAH will not qualify as a meaningful user of electronic health records (Meaningful User) during the calendar year in which OIG decides that the entity engaged in information blocking.
  • Hospital Payment Penalty: Eligible hospitals will not be able to earn the ¾ of the annual market basket increase they would have otherwise been able to earn as a Meaningful User.
  • CAH Payment Penalty: CAHs will see their Medicare payment decrease to 100% of reasonable costs from the usual 101% of reasonable costs that they could have earned for being a Meaningful User.
• Clinicians. Individual clinicians eligible for Medicare payment increases due to successful participation under the Merit-based Incentive Payment System (MIPS) Promoting Interoperability performance category and who engage in information blocking will receive a zero score as a Meaningful User during the calendar year that HHS-OIG finds information blocking. As explained by HHS in the Preamble to the Final Rule: “[A]fter application of the linear scaling factor and budget neutrality, a final score above zero, but below the applicable performance threshold, may result in calculation of a MIPS payment adjustment factor between negative 9 percent and zero percent. Depending on how the MIPS eligible clinician performs in the other performance categories and the weight assigned to the applicable performance categories for the final score, the potential effect of application of this disincentive (a zero score for the Promoting Interoperability performance category) on calculation of the MIPS payment adjustment factor may be limited.”
• Accountable Care Organizations (ACOs).  Under the Medicare Shared Savings Program (MSSP), an ACO participant that commits information blocking could become ineligible to participate in the MSSP for at least one year.  However, HHS adopted an “alternative policy” for the ACO category of disincentives. This alternative policy allows HHS to “consider relevant facts and circumstances when deciding whether to apply a disincentive to an ACO, ACO participant, or ACO provider/supplier in the [MSSP].”  HHS stated, for example, that “removal of one entity from participation in an ACO could result in the ACO not meeting program requirements such as falling below the [required] 5,000 assigned beneficiary threshold … thereby interrupting care coordination benefits of beneficiaries receiving care from ACO participants and ACO providers/suppliers that did not commit information blocking.”

Additional disincentives may be established through future rulemaking.

Investigations and Transparency

In addition to the disincentives, this Final Rule also provides information related to HHS-OIG’s process for investigating claims of information blocking and referral of a health care provider to an appropriate agency to apply appropriate disincentives. Finally, this Final Rule establishes a process by which information will be shared with the public about any applicable public settlements, penalties, and disincentives applied to health care providers and others that HHS-OIG determines have committed information blocking.

What now?

According to HHS-OIG, it plans to focus enforcement on cases that could cause patient harm, impact providers’ ability to care for patients, or cause federal or private healthcare entities to lose money. In light of these penalties, healthcare providers should take extra caution not to engage in information blocking activities and be on the lookout for future disincentives to emerge through rulemaking.

Effective Date

The eligible hospital, CAH, and eligible clinician disincentives are effective July 31, 2024 (30 days after the Final Rule was published in the Federal Register).  The MSSP disincentives will not be imposed until after January 1, 2025.  

The Applicable Regulations

The information blocking disincentives are contained in amendments to 42 CFR Chapter IV (Parts 414, 425, and 495) and 45 CFR Part 171.  See 89 Fed. Reg. at 54716 for the relevant regulations.

Looking for assistance in navigating compliance and avoiding the pitfalls associated with the information blocking rules? We regularly work with our clients regarding their policies and procedures related to compliance with information blocking, HIPAA and other data privacy and security laws and regulations.  If you are looking for assistance in this area, contact Kathie McDonald-McClure at (502) 562-7526 or Margaret Levi Young at (859) 288-7469. To learn more about Wyatt’s health care, data privacy and cyber security practice, visit the following Wyatt website pages: Wyatt Data Privacy & Cyber Security and Wyatt Health Care.