21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking
Federal RegisterJul 1, 2024
Ask Donna
What actually matters in this document.
Text
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
42 CFR Parts 414, 425, and 495
Office of the Secretary
45 CFR Part 171
RIN 0955-AA05
21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking
AGENCY:
Centers for Medicare & Medicaid Services (CMS) and Office of the National Coordinator for Health Information Technology (ONC), Department of Health and Human Services (HHS).
ACTION:
Final rule.
SUMMARY:
This final rule implements the provision of the 21st Century Cures Act specifying that a health care provider determined by the HHS Inspector General to have committed information blocking shall be referred to the appropriate agency to be subject to appropriate disincentives set forth through notice and comment rulemaking. This rulemaking establishes, for certain health care providers, a set of appropriate disincentives using authorities under applicable Federal law.
DATES:
This rule is effective as of July 31, 2024.
FOR FURTHER INFORMATION CONTACT:
Alexander Baker, Office of Policy, Office of the National Coordinator for Health Information Technology (ONC), (202) 690-7151, for general issues.
Elizabeth Holland, Centers for Medicare & Medicaid Services (CMS), (443) 934-2532, for issues related to the Promoting Interoperability Program and the Promoting Interoperability performance category of the Merit-Based Incentive Payment System.
Aryanna Abouzari, Centers for Medicare & Medicaid Services (CMS), (415) 744-3668 or
SharedSavingsProgram@cms.hhs.gov,
for issues related to the Medicare Shared Savings Program.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Executive Summary
A. Purpose of Regulatory Action
B. Summary of Major Provisions
C. Costs and Benefits
D. Severability
II. Background
A. Statutory Basis
B. Regulatory History
1. ONC Cures Act Final Rule
2. Office of Inspector General (OIG) Civil Money Penalties (CMP) Final Rule
3. Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking Proposed Rule
C. General Comments on the Disincentives Proposed Rule
III. Provisions of the Regulation and Anticipated Approach to Investigations and Referrals
A. Relevant Statutory Terms and Provisions
1. Appropriate Agency
2. Authorities Under Applicable Federal Law
3. Appropriate Disincentives
B. Approach to Determination of Information Blocking and Application of Disincentives
1. OIG Investigation and Referral
2. General Provisions for Application of Disincentives
3. Transparency for Information Blocking Determinations, Disincentives, and Penalties
C. Appropriate Disincentives for Health Care Providers
1. Background
2. Medicare Promoting Interoperability Program for Eligible Hospitals and Critical Access Hospitals (CAHs)
3. Promoting Interoperability Performance Category of the Medicare Merit-Based Incentive Payment System (MIPS)
4. Medicare Shared Savings Program
IV. Request for Information
V. Collection of Information Requirements
VI. Regulatory Impact Statement
A. Executive Order 12866
B. Regulatory Flexibility Act
C. Unfunded Mandates Reform Act
D. Executive Order 13132
I. Executive Summary
A. Purpose of Regulatory Action
This final rule implements the 21st Century Cures Act (Cures Act) provision for referral of a health care provider (individual or entity), determined by the HHS Office of Inspector General (OIG) to have committed information blocking, “to the appropriate agency to be subject to appropriate disincentives using authorities under applicable Federal law, as the Secretary sets forth through notice and comment rulemaking” (section 3022(b)(2)(B) of the Public Health Service Act (PHSA) (42 U.S.C. 300jj-52(b)(2)(B)), as added by section 4004 of the Cures Act (Pub. L. 114-255, Dec. 13, 2016)). This final rule establishes disincentives for certain health care providers (as defined in 45 CFR 171.102) that are also Medicare-enrolled providers or suppliers.
B. Summary of Major Provisions
This final rule establishes disincentives applicable to certain health care providers (as defined in 45 CFR 171.102), determined by OIG to have committed information blocking (as defined in 45 CFR 171.103), that also are Medicare-enrolled providers or suppliers. This final rule also provides information related to OIG's investigation of claims of information blocking and referral of a health care provider to an appropriate agency to be subject to appropriate disincentives. Finally, this final rule establishes a process by which information will be shared with the public about health care providers and other actors (health IT developers or other entities offering certified health IT, health information exchanges, and health information networks) that OIG determines have committed information blocking.
Although this final rule does not establish disincentives for all of the health care providers included in the 45 CFR 171.102 definition, the health care providers to whom the disincentives finalized in this rule apply furnish a broad array of services to a significant number of both Medicare beneficiaries and other patients. Thus, this set of disincentives directly advances HHS priorities for deterring information blocking, while also advancing appropriate sharing of electronic health information (EHI) by health care providers
1
to support safer, more coordinated care for all patients.
1
Except if noted in reference a particular statutory authority or CFR section, we use in this rule “health care provider,” “provider,” and “provider type” as inclusive of individuals and entities that may be characterized for purposes of Medicare enrollment or particular reimbursement policies as providers or suppliers—or both across different contexts such as specific services furnished in particular settings.
We believe it is important to establish appropriate disincentives that account for all health care providers that fall within the definition of health care provider at 45 CFR 171.102. While effective deterrence of information blocking can benefit patients by reducing the degree to which health care providers engage in this practice, fewer patients will benefit from these deterrent effects if disincentives have not been established for all health care providers within the definition of health care provider at 45 CFR 171.102. In section IV of the 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking proposed rule (Disincentives Proposed Rule), we requested information on how we could establish disincentives for other health care providers, particularly those health care providers not implicated under the CMS authorities
we proposed to use to establish disincentives in the proposed rule (88 FR 74966 and 74967).
Consistent with PHSA section 3022(b)(2)(B), in section III.C. of this final rule, CMS has finalized the following disincentives using authorities under applicable Federal law, as follows:
• Under the authority for the Medicare Promoting Interoperability Program in the Social Security Act (SSA), at sections 1886(b)(3)(B)(ix) and 1886(n) for eligible hospitals, and at section 1814(l)(4) for critical access hospitals (CAHs), CMS has finalized that an eligible hospital or CAH is not a meaningful electronic health record (EHR) user in an EHR reporting period if OIG refers, during the calendar year of the reporting period, a determination that the eligible hospital or CAH committed information blocking as defined at 45 CFR 171.103. As a result, an eligible hospital subject to this disincentive will not be able to earn the three quarters of the annual market basket increase associated with qualifying as a meaningful EHR user, and a CAH subject to this disincentive will have its payment reduced to 100 percent of reasonable costs, from the 101 percent of reasonable costs it might have otherwise earned, in an applicable year.
• Under the authority in SSA sections 1848(o)(2)(A) and (D) and 1848(q)(2)(A)(iv) and (B)(iv), for the Promoting Interoperability performance category of the Merit-based Incentive Payment System (MIPS), CMS has finalized that a health care provider defined in 45 CFR 171.102 that is a MIPS eligible clinician (as defined in 42 CFR 414.1305 and including groups) is not a meaningful EHR user in a performance period if OIG refers, during the calendar year of the reporting period, a determination that the MIPS eligible clinician committed information blocking as defined at 45 CFR 171.103. CMS also has finalized that the determination by OIG that a MIPS eligible clinician committed information blocking will result in the MIPS eligible clinician, if required to report on the Promoting Interoperability performance category of MIPS, not earning a score in the performance category (a zero score), which is typically a quarter of the total final composite performance score (a “final score” as defined at 42 CFR 414.1305). CMS has codified this proposal under the definition of meaningful EHR user for MIPS at 42 CFR 414.1305 and added it to the requirements for earning a score for the MIPS Promoting Interoperability performance category at 42 CFR 414.1375(b).
• Under the authority in SSA section 1899(b)(2)(G) for the Medicare Shared Savings Program (Shared Savings Program), CMS has finalized that a health care provider as defined in 45 CFR 171.102 that is an accountable care organization (ACO), ACO participant, or ACO provider/supplier, if determined by OIG to have committed information blocking as defined at 45 CFR 171.103, may be barred from participating in the Shared Savings Program for at least 1 year (88 FR 74964 and 74965). In this final rule, in consideration of the comments received, CMS has finalized incorporation of an alternative policy discussed in the proposed rule, under which CMS will consider an OIG information blocking determination in light of relevant facts and circumstances before applying a disincentive under the Shared Savings Program, such as denying the addition of an ACO participant to an ACO participant list (or an ACO provider/supplier to the ACO provider/supplier list), informing an ACO that remedial action should be taken against the ACO participant (or ACO provider/supplier), denying an ACO's application to participate in the Shared Savings Program if the remedial action is not taken, or terminating an ACO's participation agreement with CMS. This will result in a health care provider being removed from an ACO or prevented from joining an ACO; and in the instance where a health care provider is an ACO, this will prevent the ACO's participation in the Shared Savings Program. The relevant facts and circumstances include the nature of the health care provider's information blocking, the health care provider's diligence in identifying and correcting the problem, the time since the information blocking occurred, whether the provider was previously subject to a disincentive in another program, and other factors.
C. Costs and Benefits
Executive Order 12866 on Regulatory Planning and Review and Executive Order 13563 on Improving Regulation and Regulatory Review direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Section 3(f) of Executive Order 12866, as amended by Executive Order 14094, defines a “significant regulatory action” as an action that is likely to result in a rule that may: (1) have an annual effect on the economy of $200 million or more (adjusted every 3 years by the Administrator of the Office of Information and Regulatory Affairs (OIRA) for changes in gross domestic product), or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, territorial, or tribal governments or communities; (2) create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raise legal or policy issues for which centralized review would meaningfully further the President's priorities or the principles set forth in the Executive Order, as specifically authorized in a timely manner by the Administrator of OIRA in each case. The Office of Management and Budget (OMB) has determined that this final rule is not a significant regulatory action, as the potential costs associated with this final rule would not be greater than $200 million per year, and it does not meet any of the other requirements to be a significant regulatory action.
D. Severability
We are clarifying and emphasizing our intent that if any provision of this final rule is held to be invalid or unenforceable by its terms, or as applied to any person or circumstance, or stayed pending further action, it shall be severable from this final rule, and from rules and regulations currently in effect, and not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other, dissimilar circumstances. If any provision is held to be invalid or unenforceable, the remaining provisions which could function independently, should take effect and be given the maximum effect permitted by law.
Through this rule, we adopt provisions that are intended to and will operate independently of each other, even if each serves the same general purpose or policy goal. Where a provision is necessarily dependent on another, the context generally makes that clear (such as by cross-reference to a particular standard, requirement, condition, or pre-requisite). Where a provision that is dependent on one that is stayed or held invalid or unenforceable, as described in the preceding paragraph, is included in a subparagraph, paragraph, or section within part 171 of 45 CFR or part 414, 425, or 495 of 42 CFR, we intend that
other provisions of such subparagraph(s), paragraph(s), or section(s) that operate independently of the provision stayed or held invalid or unenforceable would remain in effect.
II. Background
A. Statutory Basis
The Cures Act was enacted on December 13, 2016, “[t]o accelerate the discovery, development, and delivery of 21st century cures, and for other purposes” (Pub. L. 114-255, December 16, 2016). Section 4004 of the Cures Act added section 3022 to the PHSA. Section 3022(a)(1) of the PHSA defines information blocking as a practice that, except as required by law or specified by the Secretary pursuant to rulemaking, is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, and: (1) if the practice is conducted by a health information technology developer, exchange, or network, such developer, exchange, or network knows, or should know, that such practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information; or (2) if the practice is conducted by a health care provider, such health care provider knows that such practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. Section 3022(a)(3) of the PHSA further provides that the Secretary shall, through rulemaking, identify reasonable and necessary activities that do not constitute information blocking. Section 3022(a)(4) of the PHSA states that the term “information blocking” does not include any practice or conduct occurring prior to the date that is 30 days after December 13, 2016 (the date of the enactment of the Cures Act).
2
Section 3022(a)(2) of the PHSA describes certain practices that may constitute information blocking.
2
As January 12, 2017, was the thirtieth day after December 13, 2016, conduct occurring on or after January 13, 2017, that otherwise meets the PHSA section 3022(a) definition of “information blocking,” would be included in that definition.
Section 3022(b)(1) of the PHSA authorizes OIG to investigate information blocking claims. Section 3022(b)(1)(B) of the PHSA authorizes OIG to investigate claims that “a health care provider engaged in information blocking.” Section 3022(b)(2)(B) of the PHSA provides that any health care provider OIG determines to have committed information blocking shall be referred to the appropriate agency to be subject to appropriate disincentives using authorities under applicable Federal law, as the Secretary sets forth through notice and comment rulemaking. Sections 3022(b)(1)(A) and (C) of the PHSA authorize OIG to investigate health information technology (IT) developers of certified health IT or other entities offering certified health IT, health information exchanges, and health information networks. Section 3022(b)(2)(A) of the PHSA authorizes the imposition of civil money penalties (CMPs)
3
not to exceed $1 million per violation on those individuals and entities set forth in sections 3022(b)(1)(A) and (C) of the PHSA.
3
We use the term “civil money penalty” here, rather than “civil monetary penalty” as used in PHSA section 3022(b)(2)(A) for consistency with OIG's usage in the OIG CMP Final Rule (88 FR 42820).
PHSA section 3022 also authorizes ONC, the HHS Office for Civil Rights (OCR), and OIG to consult, refer, and coordinate to resolve claims of information blocking. PHSA section 3022(b)(3)(A) authorizes OIG to refer claims of information blocking to OCR if OIG determines a consultation regarding the health privacy and security rules promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191, Aug. 21, 1996) (42 U.S.C. 1320d-2 note) will resolve such claims. PHSA section 3022(d)(1) specifies that the National Coordinator may serve as a technical consultant to OIG and the Federal Trade Commission (FTC) for purposes of carrying out section 3022 and may share information related to claims or investigations of information blocking with the FTC for purposes of such investigations, in addition to requiring the National Coordinator to share information with OIG, as required by law.
PHSA section 3022(d)(4) requires the Secretary, in carrying out section 3022 and to the extent possible, to ensure that information blocking penalties do not duplicate penalty structures that would otherwise apply with respect to information blocking and the type of individual or entity involved as of the day before the date of enactment of the Cures Act. Section 3022(a)(7) of the PHSA states that, in carrying out section 3022, the Secretary shall ensure that health care providers are not penalized for the failure of developers of health information technology or other entities offering health information technology to such providers to ensure that such technology meets the requirements to be certified under Title XXX of the PHSA.
We address the statutory basis for each disincentive in greater detail in section III.C. of this final rule.
B. Regulatory History
1. ONC Cures Act Final Rule
On March 4, 2019, a proposed rule titled 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program (ONC Cures Act Proposed Rule) appeared in the
Federal Register
(84 FR 7424). The rule proposed to implement certain provisions of the Cures Act to advance interoperability and support the access, exchange, and use of electronic health information. The ONC Cures Act Proposed Rule included a request for information regarding potential disincentives for health care providers that have committed information blocking and asked whether modifying disincentives already available under existing Department programs and regulations would provide for more effective deterrence (84 FR 7553).
On May 1, 2020, a final rule titled 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program (ONC Cures Act Final Rule) appeared in the
Federal Register
(85 FR 25642). The final rule identified eight reasonable and necessary activities that do not constitute information blocking, consistent with the requirement in PHSA section 3022(a)(3). Such reasonable and necessary activities are often referred to as “exceptions” to the definition of information blocking, or “information blocking exceptions,” as specified in 45 CFR part 171.
The ONC Cures Act Final Rule finalized definitions that are necessary to implement the statutory information blocking provision in PHSA section 3022, including definitions related to the four classes of individuals and entities covered by the statutory information blocking provision: health care providers, health IT developers, health IT networks, and health IT exchanges.
As the term “health care provider” is not explicitly defined in section 3022 of the PHSA, as added by section 4004 of the Cures Act, the ONC Cures Act Final Rule adopted in 45 CFR 171.102 the definition of health care provider in section 3000(3) of the PHSA
4
for
purposes of the information blocking regulations in 45 CFR part 171. The definitions listed in section 3000 of the PHSA apply “[i]n this title,” which refers to Title XXX of the PHSA (85 FR 25795). Section 3022 of the PHSA is included in Title XXX.
4
As defined in 42 U.S.C. 300-jj, the term “health care provider” includes a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center (as defined in section 300x-2(b)(1) of this title), renal dialysis facility, blood center, ambulatory surgical center described in section 1395l(i) of this title, emergency
medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1395x(r) of the title), a practitioner (as described in section 1395u(b)(18)(C) of the title), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act [25 U.S.C. 5301
et seq.
]), tribal organization, or urban Indian organization (as defined in section 1603 of title 5), a rural health clinic, a covered entity under section 256b of this title, an ambulatory surgical center described in section 1395l(i) of this title, a therapist (as defined in section 1395w-4(k)(3)(B)(iii) of the title), and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary. See also this guidance document:
https://www.healthit.gov/sites/default/files/page2/2020-08/Health_Care_Provider_Definitions_v3.pdf.
The ONC Cures Act Final Rule also established in 45 CFR 171.102 regulatory definitions for “health information network or health information exchange” and “health IT developer of certified health IT,”
5
among other terms.
6
The preamble text of the ONC Cures Act Final Rule makes clear that an individual or entity could meet both the definition of a health care provider and the definition of a health IT developer of certified health IT (85 FR 25798 and 25799), or could meet both the definition of a health care provider and a health information exchange or network (85 FR 25801). We mention these potential scenarios so that health care providers are aware that they would not necessarily only be subject to the disincentives finalized in this rule, but depending on the specific facts and circumstances, they could meet the definition of a health information network, health information exchange, or health IT developer of certified health IT—and therefore be subject to civil money penalties, if found by OIG to have committed information blocking.
5
In the ONC Cures Act Final Rule, ONC defined the term “health IT developer of certified health IT” in 45 CFR 171.102, instead of using the term that appears in PHSA 3022(a)(1): “health IT developer.” ONC explained that, because title XXX of the PHSA does not define “health information technology developer,” ONC interpreted section 3022(a)(1)(B) in light of the specific authority provided to OIG in section 3022(b)(1)(A) and (b)(2). ONC noted that section 3022(b)(2) discusses developers, networks, and exchanges by referencing any individual or entity described in section 3022(b)(1)(A) or (C). Section 3022(b)(1)(A) states, in relevant part, that OIG may investigate any claim that
a health information technology developer of certified health information technology
or other entity offering certified health information technology engaged in information blocking (85 FR 25795, emphasis added).
6
In January 2024, ONC finalized a definition of what it means to “offer health IT,” and finalized a corresponding update to the “health IT developer of certified health IT” definition. These policies are part of a final rule titled Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (89 FR 1354 through 1358) (HTI-1 Final Rule).
On November 4, 2020, an interim final rule with comment period titled Information Blocking and the ONC Health IT Certification Program: Extension of Compliance Dates and Timeframes in Response to the COVID-19 Public Health Emergency (ONC Cures Act Interim Final Rule) appeared in the
Federal Register
(85 FR 70064). The ONC Cures Act Interim Final Rule extended certain compliance dates and timeframes adopted in the ONC Cures Act Final Rule to offer the healthcare system additional flexibilities in furnishing services to combat the COVID-19 pandemic, including extending the applicability date for the information blocking provisions to April 5, 2021 (85 FR 70068). The ONC Cures Act Interim Final Rule also extended from May 2, 2022, to October 6, 2022, the date on which electronic health information as defined in 45 CFR 171.102 for purposes of the information blocking definition in 45 CFR 171.103 would no longer be limited to the subset of EHI that is identified by data elements represented in the United States Core Data for Interoperability (USCDI) standard adopted in 45 CFR 170.213 (85 FR 70069).
7
On and after October 6, 2022, practices likely to interfere with access, exchange, or use of any information falling within the definition of EHI in 45 CFR 171.102 may constitute information blocking as defined in 45 CFR 171.103.
7
For more information about the USCDI, see:
https://www.healthit.gov/isa/united-states-core-data-interoperability-uscdi.
2. Office of Inspector General (OIG) Civil Money Penalties (CMP) Final Rule
On April 24, 2020, a proposed rule titled Grants, Contracts, and Other Agreements: Fraud and Abuse; Information Blocking; Revisions to the Office of Inspector General's Civil Money Penalty Rules (OIG CMP Proposed Rule) appeared in the
Federal Register
(85 FR 22979). The OIG CMP Proposed Rule set forth proposed regulations to incorporate new CMP authority for information blocking and related procedures in PHSA section 3022 (85 FR 22982). Specific to information blocking, OIG also provided information on—but did not propose regulations for—expected enforcement priorities, the investigation process, and OIG's experience with investigating conduct that includes an intent element (85 FR 22984).
A final rule titled Grants, Contracts, and Other Agreements: Fraud and Abuse; Information Blocking; Office of Inspector General's Civil Money Penalty Rules appeared in the
Federal Register
on July 3, 2023 (OIG CMP Final Rule) (88 FR 42820). This rulemaking addressed imposition of CMPs for information blocking by health IT developers or other entities offering certified health IT, and health information exchanges and health information networks (HIEs/HINs). The OIG CMP Final Rule did not establish appropriate disincentives for health care providers that OIG has determined to have committed information blocking.
In the OIG CMP Final Rule, OIG stated that a health care provider that also meets the definition of a health IT developer of certified health IT, or HIE/HIN, or both, under 45 CFR 171.102, may be subject to information blocking CMPs (88 FR 42829). OIG further stated that as part of its assessment of whether a health care provider is a HIN/HIE that could be subject to CMPs for information blocking, OIG anticipates engaging with the health care provider to better understand its functions and to offer the health care provider an opportunity to explain why it is not a HIN/HIE (88 FR 42828).
3. Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking Proposed Rule
On November 1, 2023, a proposed rule titled 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking appeared in the
Federal Register
(88 FR 74947) (Disincentives Proposed Rule). The Disincentives Proposed Rule proposed to establish a set of appropriate disincentives for information blocking by health care providers using authorities under applicable Federal law, consistent with PHSA section 3022(b)(2)(B). The Disincentives Proposed Rule also proposed to define certain statutory terms and proposed to establish elements of a process for the imposition of appropriate disincentives by an appropriate agency. The Disincentives Proposed Rule further proposed to publicly post information on ONC's website about health care providers that have been determined by OIG to have committed information blocking and subsequently referred by OIG to an appropriate agency to be subject to appropriate disincentives, as well about health IT developers of certified health
IT and HIEs/HINs and that have been determined by OIG to have committed information blocking. Finally, the Disincentives Proposed Rule requested public comment on establishing disincentives for other health care providers included in the definition of health care provider in 45 CFR 171.102 that are subject to the information blocking regulations, but were not implicated by the disincentives proposed in the Disincentives Proposed Rule.
C. General Comments on the Disincentives Proposed Rule
We received a number of general comments on the Disincentives Proposed Rule. A discussion of those comments and responses can be found below.
Comments.
Several commenters expressed general support for the proposed disincentives for health care providers who have been found to have committed information blocking. A few commenters stated that the disincentives will lead to better patient outcomes, improved information sharing, increased transparency, a reduction in systemic inefficiency and waste, and improved accountability and compliance. A few commenters expressed general support for the establishment of the disincentives proposed because the disincentives are necessary and appropriate and would discourage information blocking by health care providers. Commenters also asserted that the proposed disincentives would encourage data exchange and enhance interoperability.
Response.
We thank the commenters for their support.
Comments.
Many commenters recommended that HHS delay implementation or enforcement of information blocking disincentives against health care providers. Commenters recommended this delay in order for HHS to provide education regarding issues such as: what constitutes information blocking; the investigation process; the application of disincentives; and information about exceptions. Commenters stated that a delay was warranted because the information blocking regulations, including the disincentives discussed in this final rule, are new and complicated, requirements change frequently, and health care providers need time to implement information sharing processes and identify best practices. Commenter recommendations for how long to delay enforcement following the publication of the final rule ranged from 1 to 2 years.
Response.
We disagree with commenters that further delay in establishing disincentives for health care providers that commit information blocking is necessary. We note that the information blocking regulations in the ONC Cures Act Final Rule went into effect April 5, 2021 (85 FR 70068), and several years will have already passed between the date when these regulations went into effect for health care providers and the effective date of this final rule. In addition, the disincentives CMS has finalized in this final rule are established under authorities for existing programs with which health care providers are already familiar. Thus, we do not believe it is necessary to further delay establishment of disincentives. We refer readers to section III.C. of this final rule, in which CMS describes how each of the disincentives it has finalized will be effective upon the effective date of this final rule.
We also note that section III.B.1. of this final rule states that OIG will not begin investigating possible information blocking committed by health care providers until after the effective date of this rule, and that OIG will exercise its enforcement discretion not to make any determinations regarding conduct occurring prior to the effective date of this rule for information blocking disincentives. As OIG will not make a determination on conduct occurring prior to the effective date, OIG will not refer any health care providers based on a determination of conduct occurring prior to the effective date of this rule for information blocking disincentives. This means that no disincentives finalized in this final rule will be applied to conduct occurring before the effective date of this final rule.
We appreciate the recommendations regarding offering educational opportunities that would be helpful to health care providers and will consider these recommendations.
Comments.
A few commenters requested that HHS set a maximum period from the date the alleged information blocking complaint was referred, after which HHS would not impose any disincentives, such as a 6-year period to align with the time period for imposing CMPs for other actors. Some commenters expressed concern that the proposed process for investigating claims of information blocking and referring findings to appropriate agencies for disincentives could cause a long delay between the information blocking complaint being filed and the application of a disincentive.
Response.
For the disincentives finalized in section III.C. of this final rule, CMS did not propose and has not finalized a maximum period from the date the alleged information blocking complaint was referred, after which CMS would not impose the disincentives it has finalized. Because the authorities used to establish disincentives may include requirements related to timing around the imposition of disincentives, we believe it is more appropriate to allow appropriate agencies to establish any such limits instead of setting a uniform limit for any disincentive established to deter information blocking by health care providers. We note that for the disincentive policy finalized under the Shared Savings Program in section III.C.4., CMS will consider relevant facts and circumstances before imposing a disincentive under the Shared Savings Program, and CMS has stated that one of the relevant factors CMS will consider is the time elapsed since a referral of information blocking has taken place. For the disincentives finalized for the Medicare Promoting Interoperability Program and the MIPS Promoting Interoperability performance category in sections III.C.2. and III.C.3., respectively, CMS has stated that it will impose the applicable disincentive in the EHR reporting period or performance period of the calendar year that a referral of a determination of information blocking is received from OIG. We further recognize that there may be a delay between the initial submission of an information blocking claim and the eventual application of a disincentive if OIG determines that the practices identified in the claim were information blocking and refers the determination to an appropriate agency. However, we are unable to estimate the time necessary to complete investigations of these practices.
As commenters mentioned, section 3022(b)(2)(C) of the PHSA, which applies to actors subject to the information blocking regulations that are not health care providers (health IT developers or other entities offering certified health IT, and HINs/HIEs), requires the imposition of CMPs to follow the procedures set forth in section 1128A of the Social Security Act (SSA). Section 1128A(c)(1) requires that an action for CMPs must be initiated within 6 years from the date of the occurrence. In the OIG CMP Final Rule, OIG stated that this would be 6 years from the date of the violation (88 FR 42826).
Comments.
A few commenters recommended the creation of a centralized HHS coordinating entity to
implement and oversee information blocking disincentives, provide a main point of contact for health care providers to learn about the process and resolve discrepancies, ensure coordination among agencies, and minimize confusion and potential errors that could cause burden for providers. One commenter stated that supplemental rulemaking would be needed to create this centralized HHS coordinating entity and that HHS should engage in this supplemental rulemaking before finalizing the Disincentives Proposed Rule. A few commenters specifically suggested the creation of a clearinghouse process to ensure disincentives applied are not duplicative, arbitrary, and unduly punitive.
Response.
We appreciate this recommendation. While we did not propose to create an entity as recommended by the commenters, we may consider this recommendation in future rulemaking. However, we do not believe that establishing such an entity is necessary to finalize the policies in this final rule, as many of these issues are addressed through existing policies. For instance, regarding coordination between agencies, we refer readers to the discussion in section III.B.1.b. of this final rule where we discuss the ways ONC, OCR, and OIG will consult, refer, and coordinate on information blocking claims as permitted by the Cures Act (see also, 88 FR 42823 and 42824). We also refer readers to the information provided about OIG's investigation process in section III.B.1. of this final rule, which includes a discussion of how OIG may engage with health care providers as part of its investigation, as necessary, to understand specific facts and circumstances related to an information blocking claim. The commenters did not provide further information about how such an entity would address issues related to ensuring disincentives are not duplicative, arbitrary, and unduly punitive.
Comments.
A few commenters recommended that ONC allow for `complaint clearinghouses,' where health care providers or payers can send their complaints alleging information blocking violations to an independent, private sector third party who would aggregate those complaints over time and submit them as a group to HHS to ensure complaints are unattributed to specific complainants. Commenters suggested this approach could mitigate concerns over retaliation, retribution, or harm to business relationships associated with alleging information blocking violations. A few commenters also recommended ONC, OIG, and CMS be more transparent in providing specifics to the public on how complaints will be handled to ensure interested parties have transparency in knowing the status of their complaints, and when a final decision can be expected.
Response.
We thank commenters for their suggestions. As authorized under PHSA section 3022(d)(3)(A), ONC has already established a “a standardized process for the public to submit reports on claims” related to information blocking. We refer readers to the discussion of the complaint process in the ONC Cures Act Final Rule (85 FR 25899 and 25900), as well as the Information Blocking Portal on ONC's website for more information.
8
Regarding commenters' concerns around harm resulting from attribution of complaints to specific organizations, we note that PHSA section 3022(d)(2) prohibits the National Coordinator from disclosing “[a]ny information that is received by the National Coordinator in connection with a claim or suggestion of possible information blocking and that could reasonably be expected to facilitate identification of the source of the information” except as may be necessary to carry out the purpose of PHSA section 3022 (PHSA section 3022(d)(2)(A)). As stated in the ONC Cures Act Final Rule, we believe the publishing of complaints could lead to the identification of the source of the information or reasonably facilitate identification of the source; therefore, we do not intend to make complaints publicly available (85 FR 25900). While the complaint process is not required by statute to be established through rulemaking, we will take commenters' input into consideration as we continue to receive complaints related to information blocking.
8
For more information,
see: https://inquiry.healthit.gov/support/plugins/servlet/desk/portal/6.
Comments.
Commenters stated that health care providers are still unclear about what practices are prohibited under the information blocking regulations. Commenters also recommended that supplemental rulemaking or sub-regulatory guidance be provided on certain topics prior to implementation or enforcement of health care provider information blocking disincentives, including: further describing investigative processes and the application of disincentives; the establishment of an appeals process; and describing how the disincentives implemented under this final rule interact with existing quality reporting program rules.
Response.
We appreciate commenters' concerns and recognize that many health care providers are still gaining awareness and understanding of the information blocking regulations. We encourage health care providers to review the resources available on ONC's website to learn more about practices that may be information blocking.
9
9
For more information,
see: https://www.healthit.gov/faqs.
We appreciate commenters' recommendations for topics HHS should consider addressing through notice and comment rulemaking. However, we note this final rule addresses many of these issues, including: the OIG investigative process (section III.B.1.), application of disincentives (section III.B.2.), and appeals processes (section III.B.2.). The discussion of the disincentives finalized in sections III.C.2. through III.C.4. does not identify any interactions with quality reporting program rules. Quality reporting programs are entirely separate authorities from those under which we proposed appropriate disincentives (which we have finalized in section III.C. of this rule); therefore, we are unclear what commenters' concerns are with respect to information blocking disincentives and quality reporting programs.
The discussion of these issues provides additional information regarding the policies we have finalized in this rule and further notice and comment rulemaking on these topics is not necessary before finalizing these policies, due to the completeness of the policies described in this final rule.
Comments.
A few commenters recommended that before implementing health care provider information blocking disincentives the agencies should work to advance EHR adoption and interoperability. Commenters recommended that HHS further define and clarify interoperability standards, and recognize that not all health care providers utilize EHRs.
Response.
We do not agree that the need for further advances with respect to EHR adoption and interoperability should delay establishing the disincentives for health care providers that have been found to commit information blocking that we finalize in this rule. While we recognize that additional progress can be made to improve interoperability and advance adoption of EHRs, many health care providers are using electronic health information today and could engage in practices that are considered information blocking under PHSA section 3022. Therefore, it is important
that appropriate disincentives exist to deter information blocking by those health care providers that are currently using electronic health information. We note that HHS has pursued activities to advance interoperability in EHRs and other health IT systems through a variety of initiatives, including the ONC Health IT Certification Program. For more information about initiatives to advance interoperability, we refer readers to resources on ONC's website.
10
10
For more information,
see: https://www.healthit.gov/topic/interoperability.
Comments.
Several commenters provided recommendations about specific scenarios that should not be considered information blocking, including: a delay in the release of sensitive and distressing health information and test results, such as for severe or complex diagnoses, to allow for provider review; a delay in the release of information in the interest of patient safety; a delay in the release of information if a patient states that they will harm themselves if they receive a diagnosis from their provider; or instances where a provider attempts in good faith to comply with an exception or not engage in information blocking.
Response.
We thank commenters for their recommendations regarding information blocking exceptions, however, we did not propose any exceptions to information blocking in the Disincentives Proposed Rule and these issues are out of scope for this final rule. In the ONC Cures Act Final Rule (85 FR 25820), ONC established exceptions to information blocking consistent with PHSA section 3022(a)(3), and subsequently made revisions to these exceptions in the HTI-1 Final Rule (89 FR 1373). We invite readers to review the information blocking exceptions to better understand how various scenarios may be addressed by these exceptions.
11
We may also consider this input for future rulemaking related to exceptions to information blocking.
11
For more information on exceptions to information blocking, see ONC's website:
https://www.healthit.gov/topic/information-blocking.
Comments.
A few commenters recommended delaying the implementation or enforcement of provider information blocking disincentives until issues related to reproductive health data and privacy are resolved. A few commenters expressed concern that the proposals described in section III.C. of the Disincentives Proposed Rule could negatively impact patient-provider relationships, risk patient and provider criminalization, and lead to patients delaying seeking healthcare due to reproductive health data and privacy issues. A few commenters recommended considering the context of the healthcare landscape following the overturning of the Federal constitutional right to an abortion and subsequent legislation in certain states to criminalize people who seek reproductive health care before finalizing the proposals in section III.C. of the Disincentives Proposed Rule. Commenters expressed concern that because of the financial impact the proposed appropriate disincentives may carry, health care providers may disclose sensitive health information, including reproductive health information, to the detriment of people seeking reproductive care. Commenters similarly expressed concern that the Disincentives Proposed Rule could result in the disclosure of other forms of sensitive health information, including information related to contraceptive access, in vitro fertilization (IVF), gender-affirming healthcare, sexually transmitted infections (STIs), intimate partner violence, and sexual assault. A few commenters recommended providers be exempt from information blocking requirements if they do not disclose patient information to protect patient privacy related to sexual and reproductive health and to protect the patient or themselves from criminalization or harassment. The commenter also recommended that a new “good faith” exception to information blocking should be established under which providers acting in “good faith” to withhold sensitive health information are presumed to be acting reasonably and in the best interest of their patients. One commenter recommended that implementation of disincentives should not occur until EHRs can ensure sensitive health data can be protected, clear concise exceptions are created, and consent management software is widely available. Commenters stated that EHR vendors cannot currently meet data segmentation standards for sensitive health information, such as reproductive healthcare data. One commenter recommended delaying implementation for 2 years to allow providers to comply with the anticipated “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” final rule
12
and ONC's “Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing” proposed rule (88 FR 23746).
13
12
Subsequent to receiving this comment, the HIPAA Privacy Rule To Support Reproductive Health Care Privacy final rule (89 FR 32976) appeared in the
Federal Register
on April 26, 2024.
13
The Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing final rule (89 FR 1192) appeared in the
Federal Register
on January 9, 2024.
Response.
We acknowledge the concerns commenters may have regarding the sensitivity of health data relating to reproductive health care and will take these comments under consideration. We further acknowledge commenters' concerns that disincentives could lead to health care providers disclosing sensitive health information, including reproductive health information, and welcome commenters' recommendations regarding an exception to information blocking when a health care provider withholds sensitive information to protect the patient or themselves from criminalization or harassment. However, we did not propose exceptions to information blocking in the Disincentives Proposed Rule and believe that such policies are out of scope for this final rule. Instead, we will take these comments under consideration for other rulemaking activities in which we focus on revising and expanding the exceptions to information blocking.
Section 4004 of the Cures Act, which added section 3022 to the PHSA, does not amend existing laws governing the confidentiality, privacy, and security of health information, such as HIPAA, its implementing regulations at 45 CFR parts 160, and 164, or other applicable Federal or state laws or regulations. Health care providers are responsible for ensuring their compliance with applicable laws and regulations governing confidentiality, privacy, and security of their patients' health information.
Regarding commenters' statement that implementation of disincentives should not occur until improvements to technical approaches to data segmentation are achieved, we agree that this is an important area for advancement. However, we believe that this work can continue in parallel with the finalization of this rule and establishment of information blocking disincentives for health care providers.
Finally, we acknowledge that health care providers are also focused on meeting other regulatory provisions. However, we reiterate that the information blocking regulations in 45 CFR part 171 have been effective since April 5, 2021, and that this final rule is focused on establishing disincentives for practices that are inconsistent with
the existing regulations defining information blocking. It does not create new affirmative obligations for health care providers.
Comments.
One commenter expressed concerns that the changes to the information blocking regulations have occurred too frequently, thereby creating burden and confusion for health care providers. One commenter expressed concern about the impact this new proposed disincentive structure will have on health care providers, given that they are also navigating other requirements related to EHI, such as surprise billing, electronic prescription, and electronic clinical quality measures. The commenter recommended that CMS remain cognizant of the many regulations that govern the flow of EHI and the differences in health IT use between provider types and sites of service.
Response.
We appreciate commenters' concerns. We understand that health care providers are continuing to gain experience and understanding of the information blocking regulations, and that health care providers have numerous compliance obligations with respect to Federal laws and regulations. We will continue to collaborate closely within the Department to consider other requirements that impact health care providers and seek to reduce burden.
Comments.
One commenter requested we provide lessons learned from cases of information blocking on the website to help educate actors on what does and does not qualify as information blocking. One commenter recommended a nation-wide marketing campaign to educate patients about information blocking practices and promote awareness of the information blocking website.
Response.
We appreciate the commenters' recommendations and will take them into consideration as we develop educational materials in the future. We note that there are resources available on ONC's website
14
about information blocking, which can help health care providers learn about what practices constitute information blocking and how health care providers can avoid these practices.
14
For more information,
see: https://www.healthit.gov/topic/information-blocking.
III. Provisions of the Regulation and Anticipated Approach to Investigations and Referrals
A. Relevant Statutory Terms and Provisions
In this section, we discuss certain statutory terms and provisions in PHSA sections 3022(a) and (b) related to the establishment of appropriate disincentives for health care providers as defined in 45 CFR 171.102. For brevity, we refer to PHSA section 3022(b)(2)(B), which states that health care providers that OIG has determined to have committed information blocking “shall be referred to the appropriate agency to be subject to appropriate disincentives using authorities under applicable Federal law, as the Secretary sets forth through notice and comment rulemaking,” as the “disincentives provision” throughout this section.
1. Appropriate Agency
The disincentives provision states that an individual or entity that is a health care provider determined by OIG to have committed information blocking shall be referred to the “appropriate agency” to be subject to appropriate disincentives. In the Disincentives Proposed Rule, we proposed to define “appropriate agency” in 45 CFR 171.102 to mean a government agency that has established disincentives for health care providers that OIG determines have committed information blocking (88 FR 74951). An “agency” may be any component of HHS that has established a disincentive or disincentives on behalf of the Secretary of HHS, including any of the Staff or Operating Divisions of HHS. For example, the disincentives finalized in section III.C. of this final rule are established using authorities held by CMS, which is an Operating Division of HHS. Under the disincentives finalized in this final rule, CMS is the “appropriate agency” to which OIG will refer a health care provider to be subject to disincentives.
We invited public comments on our proposed definition of “appropriate agency.” The following is a summary of the comments we received and our responses.
Comments.
One commenter agreed that CMS would be the appropriate agency for OIG referrals for enforcement because of the large percentage of health care providers participating in the programs discussed in section III.C. of the Disincentives Proposed Rule and the fact that CMS administers those programs.
Response.
We thank the commenter for their support. We wish to clarify that an appropriate agency could include any of the Staff or Operating Divisions of HHS. However, all of the disincentives finalized in this rule were established using authorities for programs administered by CMS.
Comments.
One commenter contended that the proposed definition of “appropriate agency” is very broad and requested that the specific agencies that may receive a referral and assess provider disincentives be clarified and listed in the rule.
Response.
We appreciate the comment but decline to change the definition of “appropriate agency” to list all of the specific agencies that may receive a referral and impose disincentives. We note that, as of the effective date of this final rule, the only agency that has established disincentives for health care providers is CMS. While other disincentives could be established under other agencies through future notice and comment rulemaking, we cannot preemptively identify the agencies that may establish disincentives at this time. Therefore, we believe maintaining the broad definition of appropriate agency is appropriate as it allows for the potential addition of disincentives established under other agencies in the future.
After consideration of the public comments, we have finalized our definition of “appropriate agency” in 45 CFR 171.102 as proposed to mean a government agency that has established disincentives for health care providers that OIG determines have committed information blocking.
2. Authorities Under Applicable Federal Law
In the Disincentives Proposed Rule we proposed to interpret the phrase “authorities under applicable Federal law” in the disincentives provision to mean that an appropriate agency may only subject a health care provider to a disincentive established using authorities that could apply to information blocking by a health care provider subject to the authority, such as health care providers participating in a program supported by the authority (88 FR 74951). In section III.C. of this final rule, CMS identifies the authority under which each disincentive has been finalized.
The following is a summary of the comments we received and our responses.
Comments.
One commenter expressed concern that the proposed interpretation of “authorities under applicable Federal law” limits the agency's ability to put in place an effective and fair enforcement structure for information blocking by limiting the applicable authority only to those with already existing penalty structures that exist to serve other policy goals. The commenter recommended that HHS revisit its interpretation of “authorities under applicable Federal law” to allow appropriate agencies to promulgate specific disincentives for information blocking conduct that: permit
consideration of mitigation and aggravating factors; allow for a broader range of disincentives (including technical assistance and corrective action plans); and preserve a health care provider's due process rights.
Response.
We appreciate the commenter's recommendations. However, we note that PHSA section 3022(b)(2)(B) specifies that disincentives must be established “using authorities under applicable Federal law.” As a result, disincentives established by an appropriate agency must be consistent with the authority under which the appropriate agency establishes the disincentive through notice and comment rulemaking. Furthermore, under the definition of “disincentive” that we have finalized in 45 CFR 171.102, a disincentive is imposed for the purposes of deterring information blocking. By finalizing this definition, we intend to limit disincentives to only include the conditions established by an appropriate agency that are intended to have a deterrent effect on information blocking practices. The disincentives provision in PHSA section 3022(b)(2)(B) and the definition of disincentive that we have finalized in 45 CFR 171.102 do not limit an appropriate agency from proposing, via notice and comment rulemaking, to establish other programmatic elements mentioned by the commenters, if such elements are within the scope of the appropriate agency's authority.
Comments.
One commenter stated that the interpretation of “authorities under applicable Federal law” described in the Disincentives Proposed Rule limits HHS to promulgating disincentives that are duplicative of existing penalty structures that might otherwise apply to information blocking conduct committed by certain health care providers. The commenter stated that this may conflict with the statutory requirement in PHSA section 3022(d)(4). The commenter stated that Congress' intent with the provision in PHSA section 3022(d)(4) was that HHS, in establishing disincentives, should take all measures possible to not use existing authorities that could apply to information blocking by a health care provider. The commenter further stated that existing authorities under which we proposed to establish disincentives in the Disincentives Proposed Rule, such as the Medicare Promoting Interoperability Program as well as the Medicare Shared Savings Program, exist to serve other policy goals and regulatory requirements, and disincentives established under these authorities should not qualify as an appropriate enforcement structure to target information blocking specifically.
Response.
We disagree that the disincentives CMS has finalized in this final rule conflict with the statutory provision in PHSA section 3022(d)(4). Section 3022(d)(4) of the PHSA requires the Secretary, in carrying out section 3022 and to the extent possible, to ensure that information blocking penalties do not duplicate penalty structures that would otherwise apply with respect to information blocking and the type of individual or entity involved as of the day before the date of enactment of the Cures Act. However, the disincentives that CMS has finalized in section III.C. of this final rule create new policies to deter information blocking that are based on a referral of a determination by OIG that a health care provider has committed information blocking as defined in PHSA section 3022(a).
After consideration of the public comments, we continue to view the disincentives provision in PHSA section 3022(b)(2)(B) to require that an appropriate agency may only subject a health care provider to a disincentive established using authorities that could apply to information blocking by a health care provider subject to the authority, such as health care providers participating in a program supported by the authority.
3. Appropriate Disincentives
We stated in the Disincentives Proposed Rule that the Cures Act does not specify or provide illustrations for the types of disincentives that should be established (88 FR 74951). As such, we proposed to define the term “disincentive” in 45 CFR 171.102 to mean a condition specified in 45 CFR 171.1001(a) that may be imposed by an appropriate agency on a health care provider that OIG determines has committed information blocking for the purpose of deterring information blocking practices. In section III.B.2. of the Disincentives Proposed Rule, we proposed to identify in 45 CFR 171.1001(a) those disincentives that have been established pursuant to the statute for the express purpose of deterring information blocking practices (88 FR 74952 and 74953).
We also noted that the term “appropriate” for disincentives is likewise not defined in PHSA section 3022, nor are illustrations provided. In the Disincentives Proposed Rule, we stated that a disincentive for a health care provider that OIG has determined to have committed information blocking may be any condition, established through notice and comment rulemaking, that would, in our estimation, deter information blocking practices among health care providers subject to the information blocking regulations (88 FR 74951). In section III.C. of the Disincentives Proposed Rule, CMS described the potential impact that each proposed disincentive would have on a health care provider (88 FR 74954 through 74966).
Finally, in the Disincentives Proposed Rule we noted that the disincentives provision does not limit the number of disincentives that an appropriate agency can impose on a health care provider (88 FR 74951). Accordingly, we proposed that a health care provider would be subject to each appropriate disincentive that an agency has established through notice and comment rulemaking and is applicable to the health care provider. We stated that imposing cumulative disincentives, where applicable, would further deter health care providers from engaging in information blocking.
We invited public comments on our proposals to establish disincentives in section III.C. of the Disincentives Proposed Rule (88 FR 74954 through 74966). The following is a summary of the comments we received and our responses on the definition of the term “disincentive” and related proposals.
Comments.
One commenter agreed that a health care provider should be subject to appropriate and applicable disincentives established through notice and comment rulemaking. Some commenters agreed that subjecting health care providers to cumulative disincentives, where applicable, may deter providers from engaging in information blocking.
Response.
We thank the commenters for their support.
Comments.
A few commenters expressed concern that the proposed definition of “appropriate disincentives” is too broad and unclear. The commenters requested that ONC narrow its definition of “appropriate disincentives” so that it is reflective of the underlying statute's requirement that disincentives be appropriate. Another commenter expressed concern that the definition does not impose limits on what may be deemed “appropriate,” therefore any disincentive proposed by an appropriate agency could theoretically meet this broad standard. Commenters expressed that a disincentive structure that does not consider the severity of the underlying misconduct cannot be considered “appropriate.”
Response.
We thank the commenters for their input. We note that we did not propose to define the term “appropriate
disincentives.” Instead, we proposed to define the term “disincentive,” to mean a condition specified in § 171.1001(a) that may be imposed by an appropriate agency on a health care provider that OIG determines has committed information blocking for the purpose of deterring information blocking practices (88 FR 74951). We have finalized this proposed definition at 45 CFR 171.102 with a modification to replace the phrase “may be imposed” with “is imposed” to clarify that a disincentive is the completed action by an appropriate agency to impose a condition on a health care provider that OIG determines has committed information blocking.
Regarding commenter concerns that we did not propose to impose limits on what may be deemed “appropriate,” and that a disincentive which does not consider the severity of the underlying misconduct should not be deemed “appropriate,” we reiterate that the term “appropriate” is not defined in PHSA section 3022, nor are illustrations provided. We believe that term “appropriate” is capacious and is best read to give the Secretary significant discretion to craft disincentives using existing authorities. As we noted in the Disincentives Proposed Rule, the key feature of appropriate disincentives is that the agency believes that they will deter information blocking (88 FR 74951). We have carefully considered each disincentive we have finalized for appropriateness, as it relates to deterring information blocking; in section III.C.2.-III.C.4., CMS describes the potential impact of each proposed disincentive on a health care provider which would result in deterring information blocking practices.
However, we believe the disincentives finalized in section III.C. also align with the use of the term “appropriate” in PHSA section 3022 by including certain limits on the impact of each disincentive. For instance, under the Medicare Promoting Interoperability Program and the MIPS Promoting Interoperability performance category, CMS has finalized disincentives that affect otherwise applicable payment adjustments based on a health care provider failing to meet the requirements of each program by committing information blocking. In sections III.C.2.c. and III.C.3.c., CMS has finalized that the disincentive under each program would only be applied for the EHR reporting period or performance period of the calendar year in which OIG refers a determination of information blocking to CMS. Barring a subsequent referral of a determination of information blocking, the health care provider would be eligible to successfully meet the program's requirements in the following calendar year's EHR reporting period or performance period. As discussed in section III.C.4., the disincentive finalized under the Medicare Shared Savings Program to deter information blocking through potential denial of approval to participate in or removal from the Shared Savings Program, limits the duration of the disincentive to a year to ensure that health care providers who have committed information blocking and corrected their actions are not permanently barred from participating in the Shared Savings Program. By balancing deterrent impact with these limits, CMS has finalized disincentives consistent with the general direction in PHSA section 3022 to establish disincentives that are “appropriate.”
We disagree with the commenter that a disincentive that cannot be adjusted to reflect the severity of the underlying misconduct cannot be considered “appropriate.” To be sure, the agency imposing an appropriate disincentive on a health care provider may not have the flexibility to determine the value of the disincentive for each individual or entity based on their conduct, as authorized for developers, networks, and exchanges that engage in information blocking under PHSA section 3022(b)(2)(A) (through CMPs). But lingering inflexibility is a function of the statute's authorization only to use “existing authorities” to subject health care providers to disincentives rather than CMPs.
Finally, we did not propose to define disincentive in the manner commenters have suggested in order to preserve flexibility for agencies to establish disincentives for information blocking. Since disincentives must be established using authorities under applicable Federal law (in accordance with PHSA section 3022(b)(2)(B)), there may be a limited set of statutory provisions that could be used to establish disincentives. Thus, we proposed and have finalized a definition of disincentive that would not unduly limit our ability to use available authorities to establish disincentives and have not proposed to further limit disincentives through proposing a definition for the term “appropriate.”
Comments.
One commenter recommended that ONC revise its proposed definition of “appropriate disincentives” to explicitly incorporate technical assistance or a corrective action plan. The commenter further contended that this adjustment would be more consistent with HHS' enforcement of other regulations, such as the HIPAA Privacy and Security Rules.
Response.
We appreciate the commenter's recommendation. We note that we did not propose to define the term “appropriate disincentives.” Instead, we proposed to define the term “disincentive” to mean a condition specified in § 171.1001(a) that may be imposed by an appropriate agency on a health care provider that OIG determines has committed information blocking, for the purpose of deterring information blocking practices. Activities such as the provision of technical assistance or the provision of a corrective action plan may not adequately deter information blocking practices, and we decline to include such activities in the definition of a disincentive at this time. We further refer readers to resources on ONC's website
15
about information blocking, which can help health care providers learn about what practices constitute information blocking and how health care providers can avoid these practices.
15
For more information,
see: https://www.healthit.gov/topic/information-blocking.
Comments.
Many commenters did not support our proposal for a health care provider to be subject to each appropriate disincentive established by an appropriate agency applicable to such health care provider, without limit to the number of disincentives, and disagreed that this policy would deter providers from engaging in information blocking. One commenter contended that unlimited cumulative disincentives should not be considered appropriate.
Several commenters expressed that subjecting health care providers to multiple disincentives for the same misconduct, simply based on their participation in multiple programs rather than the severity of the conduct, is duplicative, overly punitive, and heightens the risk for providers who participate in multiple CMS programs. A few commenters recommended that HHS establish a clear process to reconcile multiple disincentives and ensure fair and non-duplicative or punitive enforcement for providers participating in multiple programs. A few commenters suggested limiting the number of disincentives that could be applied or clarifying under which program the disincentive would be applied. A few commenters expressed concern that the allowance of cumulative disincentives will create confusion and complexity.
Response.
We thank commenters for their input. We disagree with commenters that multiple disincentives will not deter information blocking, as
the increased impact on a health care provider of receiving cumulative disincentives is likely to be a stronger deterrent due to potentially imposing greater adverse consequences on the health care provider that commits information blocking. Moreover, health care providers who participate in multiple programs may be larger than health care providers who do not participate in multiple programs, or may have a greater ability to influence health information exchange than other health care providers, and so may need greater disincentive exposure to deter information blocking practices.
Finally, we believe that the possibility of receiving cumulative disincentives will have a greater deterrent effect on health care providers that are determined to have committed information blocking, since individual disincentives are likely to have variable impacts depending on the circumstances of a given health care provider, as further discussed in section III.C.1. of this final rule. If a health care provider expects to only be subject to one disincentive, and the health care provider expects the disincentive to have a small impact, for instance, through minimal exposure under a certain program, the value of that disincentive to deter information blocking practices for that health care provider will be minimized. The availability of disincentives under more than one authority can mitigate this issue, as under our policy a health care provider may expect that they could be subject to cumulative disincentives established under different authorities, increasing the likelihood that there is an available disincentive that will have a meaningful deterrent effect for that specific health care provider.
We also disagree with the commenter that the term “appropriate” should be interpreted to prohibit applying multiple disincentives on a health care provider that has committed information blocking. PHSA section 3022(b)(2)(B) specifically contemplates that a health care provider may be subject to “appropriate disincentives”—plural. The plain language of the statute therefore suggests that multiple “disincentives” would be “appropriate.”
We further disagree that subjecting a health care provider to multiple disincentives is unfair and overly punitive. The disincentives that CMS has finalized in this final rule are established under authorities which provide for specific requirements for programs authorized under those authorities. CMS describes in section III.C. how information blocking committed by a health care provider would conflict with the requirements under each of the programs through which a disincentive has been established. Accordingly, we believe it is reasonable that a health care provider that has acted in a manner inconsistent with these programs by committing information blocking could be subject to a disincentive under that authority, regardless of whether the health care provider has also been subject to a disincentive established under another authority.
However, we believe it is necessary to provide further clarification around our proposed policy with respect to cumulative disincentives. Specifically, we believe that our proposed policy may not have accounted for scenarios under which an appropriate agency may choose to exercise discretion when imposing a disincentive. For example, in section III.C.4. of this final rule, CMS has finalized a policy under the authority for the Shared Savings Program, which CMS originally discussed as an alternative policy in the Disincentives Proposed Rule (88 FR 74966). This finalized policy will permit CMS, as the appropriate agency, to consider relevant facts and circumstances when deciding whether to apply a disincentive to an ACO, ACO participant, or ACO provider/supplier in the Shared Savings Program.
We note that CMS has finalized this alternative policy for the Medicare Shared Savings Program only, as this policy is consistent with existing practices under the Shared Savings Program for addressing program integrity issues among ACOs, ACO participants, or ACO providers/suppliers. In addition, this policy addresses scenarios specific to imposing a disincentive under the Shared Savings Program, for instance, where removal of one entity from participation in an ACO could result in the ACO not meeting program requirements such as falling below the 5,000 assigned beneficiary threshold required by 42 CFR 425.110(a)(1), thereby interrupting care coordination benefits of beneficiaries receiving care from ACO participants and ACO providers/suppliers that did not commit information blocking. Under the finalized alternative policy, CMS will consider relevant facts and circumstances before imposing a disincentive under the Shared Savings Program. The relevant facts and circumstances include the nature of the health care provider's information blocking, the health care provider's diligence in identifying and correcting the problem, the time since the information blocking occurred, whether the provider was previously subject to a disincentive in another program, and other factors. We refer readers to section III.C.4. for a complete discussion of the alternative policy finalized under the Shared Savings Program. As discussed in sections III.C.2. and III.C.3. of this final rule, the Medicare Promoting Interoperability Program and the MIPS Promoting Interoperability performance category will impose a disincentive on an applicable health care provider following a referral of an information blocking determination by OIG.
Thus, we are revising our proposed policy for consistency with the policies finalized in this rule. Where we stated in the proposed rule (88 FR 74951) that a health care provider “would” be subject to each appropriate disincentive that an agency has established through notice and comment rulemaking and is applicable to the health care provider, in this final rule we clarify that, under the disincentives provision, a health care provider “may” be subject to each appropriate disincentive that an agency has established through notice and comment rulemaking and is applicable to the health care provider. Under this revised policy, we acknowledge that an appropriate agency could establish a policy that allows for discretion in imposing a disincentive, consistent with the agency's authority and implementing regulations.
Finally, we disagree with the commenters that a cumulative disincentives approach will introduce more confusion and complexity. We believe this final rule provides clarity about the disincentives established under each of the relevant programs to ensure health care providers understand the consequences they may face for committing information blocking with respect to the requirements of each program.
Comments.
A few commenters expressed concern about the negative and disproportionate impact of potentially imposing cumulative disincentives on small and less resourced practices. One commenter recommended considering the relative impact of cumulative disincentives on the health care provider, such as the size and resources of the provider.
Response.
We appreciate the commenters' concerns about the impact of cumulative disincentives on small and less resourced practices. However, we disagree with commenters that we should revise our policy with respect to cumulative disincentives to be based on the size and resources of the health care provider subject to the disincentive, as we believe this policy should be consistent across health care providers,
regardless of their size, and that any considerations with respect to how an appropriate disincentive should impact health care providers should be addressed by the appropriate agency establishing the disincentive.
An appropriate agency, in establishing a disincentive and related policies, could retain or implement policies based on the type of health care provider subject to the disincentive, including small practices, consistent with the agency's authority. For instance, CMS automatically reweights the MIPS Promoting Interoperability performance category to zero percent of a MIPS eligible clinician's final score if the MIPS eligible clinician is in a small practice as defined in 42 CFR 414.1305 and does not submit data for the MIPS Promoting Interoperability performance category for the applicable performance period (42 CFR 414.1380(c)(2)(i)(C)(
9
)). In other words, if the MIPS eligible clinician meets this criterion for automatic reweighting at 42 CFR 414.1380(c)(2)(i)(C)(
9
), the MIPS eligible clinician is not required to complete the requirements for earning a score for the Promoting Interoperability performance category as set forth in 42 CFR 414.1375. In such event, CMS does not assign a score for the MIPS eligible clinician for the Promoting Interoperability performance category and redistributes the weight of the performance category (typically 25 percent of the final score) to the remaining performance categories on which the MIPS eligible clinician is scored in accordance with 42 CFR 414.1380(c)(2)(ii). In section III.C. of the proposed rule and section III.C. of this final rule, CMS has neither proposed nor finalized any policy that would amend this automatic reweighting policy at 42 CFR 414.1380(c)(2)(i)(C)(
9
) for MIPS eligible clinicians in a small practice if such practice were subject to the disincentive being finalized as discussed section III.C.3. of this final rule.
After consideration of the public comments, we have finalized our definition of the term “disincentive” in 45 CFR 171.102 as proposed to mean a condition specified in 45 CFR 171.1001(a) that is imposed by an appropriate agency on a health care provider that OIG determines has committed information blocking for the purpose of deterring information blocking practices. We have also finalized our policy, with modification, that a health care provider may be subject to each appropriate disincentive that an agency has established through notice and comment rulemaking and is applicable to the health care provider.
B. Approach to Determination of Information Blocking and Application of Disincentives
In this section we provide additional detail about the process by which a health care provider that has committed information blocking may be subject to appropriate disincentives for information blocking. This section begins with a discussion, provided for informational purposes and not including any final policies, of an OIG investigation of a claim of information blocking and how OIG intends to refer a health care provider it determines has committed information blocking to an appropriate agency. Next, we discuss finalized proposals related to the application of a disincentive by an appropriate agency. Finally, we discuss our finalized approach to provide transparency into the nationwide health IT infrastructure by making information available to the public about health care providers that have been determined by OIG to have committed information blocking and have been subject to an appropriate disincentive for information blocking, and about health IT developers of certified health IT and HIEs/HINs and that have been determined by OIG to have committed information blocking.
1. OIG Investigation and Referral
In the Disincentives Proposed Rule, we provided information regarding OIG's anticipated approach to information blocking investigations of health care providers (88 FR 74951 and 74952). We noted that this information was not a regulatory proposal and was provided for information purposes only. Preamble discussion of investigation priorities for health care provider information blocking claims included in the Disincentives Proposed Rule, and restated below, is not binding on OIG and HHS. It does not impose any legal restrictions related to OIG's discretion to choose which health care provider information blocking complaints to investigate. As the discussion in the Disincentives Proposed Rule was not a regulatory proposal, we have not included direct responses to comments provided on this section (III.B.1.). However, to improve public understanding of how OIG anticipates it will approach information blocking investigations of health care providers, this section (III.B.1.) of the preamble provides an informational statement to supplement the discussion set forth in the Disincentives Proposed Rule.
We clarify here that OIG's investigation will depend on the specific facts and circumstances presented in the allegation. OIG will evaluate each allegation based on the facts and circumstances presented in the allegation. As OIG investigates the allegations, though, the scope of the investigation may change, and OIG may change the individual(s) or entity(ies) under investigation depending on the specific facts and circumstances it has found. Indeed, through conducting an investigation, OIG will collect evidence which it will use to evaluate the individual(s) or entity(ies) with potential information blocking liability and potential information blocking conduct. The vast bulk of material and relevant evidence (that is, evidence relating to whether the actor committed information blocking) will come from the actor whose conduct is at issue.
As part of OIG's investigation, OIG will need to evaluate whether an individual or entity meets the definition of an actor under ONC's regulations. OIG has previously stated that it will look to ONC's regulations and any related guidance in evaluating whether an individual or entity meets a specific actor definition, and OIG will continue to do so for health care provider investigations (88 FR 42828). OIG will look to the regulations in effect at the time the conduct occurred. Based on the definitions ONC has finalized for health IT developer of certified health IT and HIN/HIE, a health care provider, as set forth in 45 CFR 171.102, may meet the definition of a health care provider and one of those definitions as well (88 FR 42829). OIG anticipates being in contact with health care providers as part of its investigation, as necessary, to understand the specific facts and circumstances. For example, OIG may need to engage with the health care provider to understand whether the health care provider is a HIN/HIE or a health IT developer of certified health IT. And as mentioned above, much of the evidence gathered by OIG will likely come from the individual(s) or entity(ties) under investigation.
As part of an investigation, OIG will evaluate whether information blocking has occurred. OIG has previously stated that it will look to ONC's regulations and any related guidance in evaluating whether conduct constitutes information blocking, and OIG will continue to do so with respect to health care providers (88 FR 42827). OIG will look to ONC's information blocking regulations in 45 CFR part 171 in effect at the time the conduct occurred. Through conducting an investigation, OIG will collect evidence, which it will use to evaluate whether conduct constitutes information blocking and whether an actor had the requisite
intent. As mentioned above, OIG anticipates engaging with health care providers during this process as it learns the facts and circumstances of the allegation under investigation.
Regarding the timing of investigations, OIG will not begin investigating health care providers until after the effective date of this rule, and will exercise its enforcement discretion not to make any determinations regarding conduct occurring prior to the effective date of this rule for information blocking disincentives. As OIG will not make a determination on conduct occurring prior to the effective date, OIG will not refer any health care providers based on a determination of conduct occurring prior to the effective date of this rule for information blocking disincentives. This means that no disincentives finalized in this final rule will be applied to conduct occurring before the effective date of this final rule.
a. Anticipated Priorities
As with other conduct that OIG has authority to investigate, OIG has discretion to choose which information blocking complaints to investigate. To maximize efficient use of resources, OIG generally focuses on selecting cases for investigation that are consistent with its enforcement priorities and intends to apply that rationale to its approach for selecting information blocking complaints for investigation.
For investigations of health care providers, the Disincentives Proposed Rule stated that OIG expects to use four priorities: (i) resulted in, are causing, or have the potential to cause patient harm; (ii) significantly impacted a provider's ability to care for patients; (iii) were of long duration; and (iv) caused financial loss to Federal health care programs, or other government or private entities (88 FR 74951). As mentioned in the above section concerning OIG investigations, OIG's expected priorities are informational only and are not binding on OIG decision making.
OIG's priorities for health care provider investigations differ from the priorities set out in the OIG CMP Final Rule, due to the differences in intent. In the OIG CMP Final Rule, OIG stated that it would prioritize actors who had actual knowledge, as actual knowledge is more egregious, when a lower intent is required (that is, when the standard is “knows, or should know”) (88 FR 42823). However, under PHSA section 3022(a), the intent requirement for health care providers is that the health care provider “knows” that a practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. Because the Cures Act only provides a single intent standard (“knows”), OIG will not consider actual knowledge as part of its priorities for health care provider actors.
Consistent with the OIG CMP Final Rule (88 FR 42822), OIG's enforcement priorities are a tool OIG uses to triage allegations and allocate resources. OIG provides information about its enforcement priorities so the public and stakeholders have a better understanding of how OIG anticipates allocating resources for enforcement. OIG's enforcement priorities will inform decisions about which information blocking allegations to pursue, but these priorities are not dispositive. Each allegation will be assessed to determine whether it implicates one or more of the enforcement priorities, or otherwise merits further investigation and potential enforcement action. There is no specific formula OIG can apply to every allegation that allows OIG to effectively evaluate and prioritize which claims merit investigation.
Although OIG's anticipated priorities are framed around individual allegations, OIG may evaluate allegations and prioritize investigations based in part on the volume of claims relating to the same (or similar) practices by the same entity or individual.
b. Coordination With Other Agencies
This section summarizes the discussion in the OIG CMP Final Rule of the ways ONC, OCR, and OIG will consult, refer, and coordinate on information blocking claims as permitted by the Cures Act (88 FR 42823).
PHSA section 3022(d)(1) states that the National Coordinator may serve as a technical consultant to the Inspector General. OIG will accordingly consult with ONC throughout the investigative process. Additionally, PHSA section 3022(b)(3)(A) provides the option for OIG to refer claims of information blocking to OCR when a consultation regarding the health privacy and security rules promulgated under section 264(c) of HIPAA will resolve such claims. Depending on the facts and circumstances of the claim, OIG will exercise this statutory discretion as appropriate to refer information blocking claims to OCR for resolution. There is no set of facts or circumstances that will always be referred to OCR. OIG will work with OCR to determine which claims should be referred to OCR under the authority provided in PHSA section 3022(b)(3)(A). It is important to note that while section 3022(b)(3)(A) of the PHSA specifically provides OIG with the authority to refer information blocking claims to OCR, OIG's statutory authority to refer to OCR allegations of violations of the HIPAA Privacy, Security, or Breach Notification Rules
16
is not solely based on PHSA section 3022(b)(3)(A). Thus, OIG's authority to refer to OCR such allegations against health care providers is not limited to claims of information blocking.
16
45 CFR parts 160 and 164, subparts A, C, D, and E.
Finally, OIG anticipates coordinating with other HHS agencies to avoid duplicate penalties as identified in section 3022(d)(4) of the PHSA. Depending on the facts and circumstances, OIG may also consult or coordinate with a range of other government agencies, including CMS, FTC, or others (88 FR 42823 and 42824).
c. Anticipated Approach to Referral
During an investigation of information blocking by a health care provider, but prior to making a referral, OIG will coordinate with the appropriate agency to which OIG plans to refer its determination of information blocking. This coordination will ensure that the appropriate agency is aware of a potential referral and that OIG provides the information the agency needs to take appropriate action. OIG's referral to the appropriate agency will explain its determination that a health care provider committed information blocking, including meeting the requirements of the intent element of PHSA section 3022(a)(1)(B)(ii).
We note that PHSA section 3022 authorizes OIG to investigate claims of information blocking and requires OIG to refer health care providers to an appropriate agency when it determines a health care provider has committed information blocking, to be subject to appropriate disincentives. Once OIG has concluded its investigation and is prepared to make a referral, it will send information to the appropriate agency indicating that the referral is made pursuant to the statutory requirement in PHSA section 3022(b)(2)(B). As part of the referral, OIG will provide information to explain its determination, which may include: the dates when OIG has determined the information blocking violation(s) occurred; analysis to explain how the evidence demonstrates the health care provider committed information blocking (for instance, that the health care provider's “practice”
17
meets each
element of the information blocking definition); copies of evidence collected during the investigation (regardless of whether it was collected by subpoena or voluntarily provided to OIG); copies of transcripts and video recordings (if applicable) of any witness and affected party testimony; and copies of documents OIG relied upon to make its determination that information blocking occurred. OIG may provide additional information as part of its referral based on consultation with the appropriate agency, to the extent permitted by applicable law.
17
“Practice,” as defined in 45 CFR 171.102, means an act or omission by an actor (health care
provider, health IT developer of certified health IT, health information network or health information exchange).
2. General Provisions for Application of Disincentives
Following an investigation through which OIG determines a health care provider has committed information blocking, and OIG's referral of this determination to an appropriate agency, the health care provider may be subject to disincentives that have been established under applicable Federal law through notice and comment rulemaking. In this section, we include general provisions and information related to the application of disincentives. For information on the specific disincentives and further discussion about how each disincentive will be applied, we refer readers to section III.C. of this final rule.
In the Disincentives Proposed Rule, we proposed to add a new subpart J to 45 CFR part 171, entitled “Disincentives for Information Blocking by Health Care Providers” (88 FR 74952 and 74953). We proposed in 45 CFR 171.1000 that this subpart sets forth disincentives that an appropriate agency may impose on a health care provider based on a determination of information blocking referred to that agency by OIG, and certain procedures related to those disincentives. We proposed in 45 CFR 171.1001(a) that health care providers that commit information blocking would be subject to the following disincentives from an appropriate agency based on a determination of information blocking referred by OIG, where applicable. The disincentives proposed for inclusion in 45 CFR 171.1001(a)(1) through (3) corresponded to the appropriate disincentives proposed in section III.C. of the Disincentives Proposed Rule:
• An eligible hospital or CAH as defined in 42 CFR 495.4 is not a meaningful EHR user as also defined in that section;
• A MIPS eligible clinician as defined in 42 CFR 414.1305, who is also a health care provider as defined in 45 CFR 171.102, is not a meaningful EHR user for MIPS as also defined in 42 CFR 414.1305; and
• ACOs who are health care providers as defined in 45 CFR 171.102, ACO participants, and ACO providers/suppliers will be removed from, or denied approval to participate, in the Medicare Shared Savings Program as defined in 42 CFR part 425 for at least 1 year.
We noted that in the future, if we propose to establish additional disincentives, we intend to add such disincentives to the disincentives listed in 45 CFR 171.1001 (88 FR 74953).
We did not receive any comments on these proposals. However, we have modified the regulation text in several ways to increase clarity. First, we have made minor modifications to the language of the proposed “scope” section, in 45 CFR 171.1000, to better reflect language used in this final rule. Second, we have replaced the proposed paragraph (a) from 45 CFR 171.1001, which was redundant with the proposed “scope” section (45 CFR 171.1000), and reorganized the section to clearly reflect that the disincentives finalized in this final rule, and that a health care provider may be subject to, were established by CMS (45 CFR 171.1001(a) as finalized). If we finalize additional disincentives in the future, we will add them to a paragraph under 45 CFR 171.1001 reflecting the appropriate agency that has established the disincentive.
We have finalized, as proposed, the following disincentives in 45 CFR 171.1001(a)(1)-(3):
• An eligible hospital or CAH as defined in 42 CFR 495.4 is not a meaningful EHR user as also defined in that section;
• A MIPS eligible clinician as defined in 42 CFR 414.1305, who is also a health care provider as defined in 45 CFR 171.102, is not a meaningful EHR user for MIPS as also defined in 42 CFR 414.1305; and
• ACOs who are health care providers as defined in 45 CFR 171.102, ACO participants, and ACO providers/supplies will be removed from, or denied approval to participate, in the Medicare Shared Savings Program as defined in 42 CFR part 425 for at least 1 year.
In the Disincentives Proposed Rule, we proposed in 45 CFR 171.1002(a) through (d) that an appropriate agency that imposes a disincentive or disincentives in § 171.1001(a) would send a notice (using usual methods of communication for the program or payment system) to the health care provider subject to the disincentive or disincentives (88 FR 74953). We proposed that this notice includes:
• A description of the practice or practices that formed the basis for the determination of information blocking referred by OIG;
• The basis for the application of the disincentive or disincentives being imposed;
• The effect of each disincentive; and
• Any other information necessary for a health care provider to understand how each disincentive will be implemented.
In the Disincentives Proposed Rule we stated that the information in this notice would be based upon the authority used to establish the disincentive and policy finalized by the agency establishing the disincentive (88 FR 74953). For instance, the notice may contain specific information regarding when a disincentive would be imposed, which may be contingent on both the authority used to establish the disincentive and the specific policy under which the disincentive is established. We noted that, where a health care provider that has been determined to have committed information blocking is subject to multiple disincentives established by an appropriate agency, nothing in this proposal would prevent the appropriate agency from combining these notices into a single communication.
Comments.
One commenter requested clarification regarding whether the proposal to send a notice to the health care provider subject to the disincentive implies that all health care providers who have been identified as alleged information blockers will receive a disincentive.
Response.
A health care provider would only be subject to a disincentive or disincentives and receive the notification described in this section after a determination has been made by OIG that the health care provider committed information blocking and OIG has referred that determination to the appropriate agency, which is CMS for the purposes of the disincentives finalized in this rule. A health care provider that is merely alleged to have committed information blocking but has not been investigated and determined by OIG to have committed information blocking, would not receive a notification described in this section.
Comments.
One commenter expressed support for the proposed notification policies and stated that these policies would improve transparency.
Response.
We thank the commenter for their support.
Comments.
A few commenters recommended adding information or a communications channel so that health care providers who have been notified of a disincentive can respond to or communicate with OIG and the agency issuing the disincentive regarding the finding, possible mitigating circumstances, or establish a process to deter further cases of information blocking. One commenter observed that this would increase transparency, avoid patient confusion, and mitigate potential unnecessary reputational damage. One commenter expressed concern that the proposed notifications only inform health care providers of a disincentive after they have been found to have committed information blocking. This commenter expressed concern that a health care provider found to have committed information blocking may have additional practices being investigated or practices that could lead to another finding of information blocking and that these practices would not be included in the notification, for example, for them to fix potential issues. This commenter recommended creating a form notification that would inform health care providers of the information blocking issues that have led to the disincentive so they could be fixed.
Response.
We appreciate commenters' concerns and wish to clarify that the notifications proposed in this section would be issued by an appropriate agency following a referral of a determination of information blocking by OIG that leads to the imposition of a disincentive. For discussion of when communication between OIG and a health care provider about alleged information blocking practices may occur as part of an investigation (that is, prior to a determination of information blocking), we refer readers to section III.B.1. of this final rule.
After consideration of the public comments, we have finalized our proposal with modification. In the Disincentives Proposed Rule, we proposed in § 171.1002 that an appropriate agency “would send a notice to the health care provider subject to the disincentive or disincentives.” However, we believe that the use of the affirmative “shall,” which we have finalized in the text of § 171.1002, to describe the action of an appropriate agency will provide greater clarity to health care providers and better conveys the intent of the policy, which is that an appropriate agency will send this notice in all cases in which disincentives have been imposed on a health care provider. For the finalized text of § 171.1002, we also revise our proposed reference to disincentives “specified in § 171.1001(a)” to refer to disincentives “specified in § 171.1001” instead, since we have finalized that disincentives may be listed throughout § 171.1001 and not only under paragraph (a), which specifically lists disincentives established by CMS. Therefore, we have finalized in 45 CFR 171.1002 that an appropriate agency that imposes a disincentive or disincentives in § 171.1001 shall send a notice (using usual methods of communication for the program or payment system) to the health care provider subject to the disincentive or disincentives. We have finalized in 45 CFR 171.1002(a) through (d) the elements of the notice as proposed.
In the Disincentives Proposed Rule, we noted that, following the application of a disincentive, a health care provider, as defined in 45 CFR 171.102, may have the right to appeal administratively a disincentive if the authority used to establish the disincentive provides for such an appeal (88 FR 74953). We noted that PHSA section 3022(b)(2)(C) requires that the imposition of CMPs that apply to health IT developers of certified health IT, and HINs/HIEs, that have committed information blocking, follow the procedures of SSA section 1128A, which includes procedures for appeals. However, the Cures Act did not provide similar instruction regarding administrative appeals of disincentives for health care providers established under PHSA section 3022(b)(2)(B), and we did not propose a specific administrative appeals process for health care provider appeals. Therefore, any right to appeal administratively a disincentive, if available, would be provided under the authorities used by the Secretary to establish the disincentive through notice and comment rulemaking.
To provide additional information on these issues to the public, we summarize and respond to comments on our statement regarding appeals.
Comments.
Many commenters expressed concern that there is not a clearly defined appeals process that would apply across all provider types. Many of these commenters recommended that HHS adopt a single appeals process through notice and comment rulemaking. Many commenters expressed concern that relying on each program's appeals process creates an unfair structure in which providers do not have equal appeal rights. Some of these commenters further stated that this could require some providers to appeal multiple times and that other providers may not be able to appeal at all. Some commenters stated that the differing appeals processes could create undue administrative burden, with some requesting a single or streamlined process. A few commenters recommended that HHS ensure that any future disincentives for other provider types also allow for a clear and straightforward appeals process.
Response.
As noted in the Disincentives Proposed Rule, PHSA section 3022(b)(2)(C) requires that the imposition of CMPs that apply to health IT developers of certified health IT, and HINs/HIEs, that have committed information blocking, follow the procedures of SSA section 1128A, which includes procedures for administrative appeals (88 FR 74953). The Cures Act did not provide similar instruction regarding administrative appeals of appropriate disincentives for health care providers established under PHSA section 3022(b)(2)(B), and we did not propose and have not finalized any regulations relating to administrative appeals of the imposition of disincentives. Instead, we reiterate that any right to appeal administratively a disincentive, if available, would be provided under the authority used by the Secretary to establish a disincentive.
Section 3022(b)(2)(B) of the PHSA requires that an OIG determination be referred to the appropriate agency to “be subject to appropriate disincentives using authorities under applicable Federal law.” In establishing disincentives using authorities under applicable Federal law, any administrative appeals processes required under those existing authorities would also apply to the disincentives established by an appropriate agency under that authority. We recognize that reliance on any administrative appeals processes under the authority used to establish a disincentive may result in variability in the appeals processes available to health care providers, and that in some cases, administrative appeals processes may be limited or unavailable. However, we disagree that establishing a new single process for administrative appeals would effectively address this variability, as such a process may conflict with, or duplicate, administrative review or appeals processes available under existing authorities. Accordingly, we did not propose such a process in the Disincentives Proposed Rule.
If we establish additional disincentives in the future, we will evaluate any administrative review or appeals process available under the
authority used to establish the disincentive and how a disincentive would be treated under such a process. However, we decline to limit future disincentives to those which provide for administrative appeals processes meeting certain standards, as we must balance these considerations with our goal of identifying disincentives for all health care providers subject to the information blocking regulations, as defined in 45 CFR 171.102.
Comments.
Many commenters provided recommendations for elements that should be incorporated into an appeals process. Commenters recommended that all health care providers should have the ability to appeal an information blocking determination by OIG before referral or application of a disincentive, as well as the ability to appeal the application and calculation of the disincentive. Other commenters recommended that HHS include evaluation criteria and definitions of intent within the appeals process to ensure transparency. A few commenters suggested that health care providers have the ability to provide further information that may impact a determination. Some commenters recommended entities that the commenters asserted would be appropriate to handle the appeals; the specific entities that commenters recommended were OIG, CMS, ONC, HHS, an Administrative Law Judge, or an impartial agency not involved in the finding or disincentive. Some commenters recommended that HHS ensure that the entity reviewing appeals have sufficient technical expertise to review the OIG finding.
Some commenters recommended potential models for the appeals process, including the process described for ACOs in the Disincentives Proposed Rule, the process established for health IT developers of certified health IT, HINs/HIEs, Medicare programs, and the process for appealing enforcement of the rules promulgated under the Administrative Simplification provisions of HIPAA. Some commenters recommended that HHS clearly define the timelines for the appeals process and build these into the timeline for applying disincentives.
Response.
We appreciate commenters' recommendations regarding elements that should be included in an administrative appeals process, as well as recommendations regarding existing appeals processes that would be an appropriate model for review and appeal of disincentives. However, we did not propose to establish a single process for the administrative appeal of either a determination by OIG of information blocking or a disincentive imposed by an appropriate agency based on a referral of a determination of information blocking. Instead, the ability of a health care provider subject to a disincentive to appeal administratively the specific items identified by commenters, including the information blocking determination by OIG, the determination that information blocking conduct met the required intent standard, the application of a disincentive, and the calculation of the disincentive, would be based on the scope of any administrative appeal rights provided under the authority used to establish an appropriate disincentive. Likewise, any timelines for an administrative appeals process may depend upon timelines already established related to administrative appeal rights under the authority used to establish a disincentive.
We appreciate the comment regarding technical expertise in review of any administrative appeals of a disincentive. While the responsibility for reviewing an appeal administratively would be determined by the authority under which the disincentive has been established and could vary across disincentives, we expect that other agencies, such as ONC, could potentially provide technical assistance to an appropriate agency as part of any administrative appeals process that is available and exercised by a health care provider. We encourage readers to review the information in section III.C. of this final rule where CMS provides further discussion of relevant policies related to administrative appeal, review, and reconsideration under authorities used to establish disincentives.
Comments.
One commenter requested clarification about the impact an appeal would have on the application of a disincentive and the proposed posting of information on the ONC website.
Response.
Regarding the impact an appeal would have on the application of a disincentive, we reiterate that any right to appeal administratively a disincentive, if available, would be provided under the authorities used by the Secretary to establish the disincentive. Therefore, the impact of any appeal rights provided for by a specific authority would depend on that authority. We encourage readers to review the information in section III.C. of this final rule where CMS provides further discussion of relevant policies related to appeal, review, and reconsideration under authorities used to establish disincentives.
As discussed further in section III.B.3. of this final rule regarding our proposal for posting of information on ONC's website, we have finalized our proposal regarding information that will be publicly posted on ONC's website about actors that have been determined by OIG to have committed information blocking (specifically, where the actor is a health care provider, the health care provider's name, business address (to ensure accurate provider identification), the practice found to have been information blocking, including when the practice occurred, the disincentive(s) applied, and where to find additional information, where available, about the determination of information blocking that is publicly available via HHS or another part of the U.S. Government). Further, we have finalized at 45 CFR 171.1101(a)(2) that the information specified in 45 CFR 171.1101(a)(1) will not be posted prior to a disincentive being imposed and will not include information about a disincentive that has not been applied. As noted in section III.B.3., we have modified our finalized policy to provide further clarification that posting of information about a disincentive will not occur until after any available administrative appeals process has been completed.
Comments.
One commenter recommended not applying disincentives in any program that does not have an appeals process that would allow health care providers to appeal the finding and the disincentive.
Response.
We appreciate the commenter's recommendation. However, we decline to limit the establishment of disincentives to those disincentives which can be established using authorities that provide for administrative appeal rights meeting certain standards. Since we must establish disincentives using authorities under applicable Federal law as required under PHSA section 3022(b)(2)(B), we must balance our interest in providing for administrative appeal rights with a limited set of available authorities which can be used to establish appropriate disincentives. We believe that focusing only on those authorities which provide for a specific set of administrative appeal rights would limit our ability to meet our goal of establishing appropriate disincentives for the health care providers subject to the information blocking regulations, as defined in 45 CFR 171.102.
We did not propose to establish a single administrative appeals process for health care providers to appeal the application of disincentives being finalized in this rule. We reiterate that any right to appeal administratively a disincentive, if available, would be provided under the authorities used by
the Secretary to establish the disincentive.
3. Transparency for Information Blocking Determinations, Disincentives, and Penalties
In the Disincentives Proposed Rule, we stated that it is important to promote transparency about how and where information blocking is impacting the nationwide health information technology infrastructure (88 FR 74953). We further stated that publicly releasing information, including applicable public settlements, penalties, and disincentives, about actors that have been determined by OIG to have committed information blocking can inform the public about how and where information blocking is occurring within the broader health information technology infrastructure.
PHSA section 3001(c)(4) (42 U.S.C. 300jj-11(c)(4)) requires that the National Coordinator maintain an internet website “to ensure transparency in promotion of a nationwide health information technology infrastructure.” We believe this provision provides the National Coordinator with the authority to post information on ONC's website if that information has an impact on issues relating to transparency in the promotion of a nationwide health information technology infrastructure. In the Disincentives Proposed Rule, we proposed to add a new subpart K to 45 CFR part 171, entitled “Transparency for Information Blocking Determinations, Disincentives, and Penalties” (88 FR 74953). As proposed in 45 CFR 171.1100, this subpart would set forth the information that would be publicly posted on ONC's website about actors that have been determined by OIG to have committed information blocking.
We proposed in 45 CFR 171.1101 that, in order to provide insight into how and where information blocking conduct is impacting the broader nationwide health information technology infrastructure, ONC would post on its public website information about actors that have been determined by OIG to have committed information blocking (88 FR 74953). For health care providers that are subject to a disincentive, we proposed in 45 CFR 171.1101(a)(1) that the following information would be posted: health care provider's name, business address (to ensure accurate provider identification), the practice found to have been information blocking, the disincentive(s) applied, and where to find additional information, where available, about the determination of information blocking that is publicly available via HHS or another part of the U.S. Government. We proposed in 45 CFR 171.1101(a)(2) that the information specified in 45 CFR 171.1101(a)(1) would not be posted prior to a disincentive being imposed and would not include information about a disincentive that has not been applied.
We recognized that under the authorities used to establish the disincentives proposed in section III.C. of the Disincentives Proposed Rule, an appropriate agency may have other obligations related to the release of information about a participant that is a health care provider (as defined in 45 CFR 171.102) in programs under that authority (88 FR 74953 and 74954). For instance, under SSA section 1848(q)(9)(C), MIPS eligible clinicians have a right to review information about their performance in MIPS prior to having this information publicly posted on the Compare Tool in accordance with 42 CFR 414.1395. Therefore, we proposed in 45 CFR 171.1101(a)(3) that posting of the information about health care providers that have been determined to have committed information blocking and have been subject to a disincentive would be conducted in accordance with existing rights to review information that may be associated with a disincentive specified in 45 CFR 171.1001. For instance, where a health care provider, as defined in 45 CFR 171.102, has a statutory right to review performance information, this existing right would be exercised prior to public posting of information regarding information blocking on the website described above.
In order to provide insight into how and where information blocking conduct is impacting the broader nationwide health information technology infrastructure, we also proposed in 45 CFR 171.1101(b)(1) to post on ONC's public website information specified in 45 CFR 171.1101(b)(1) about health IT developers of certified health IT and HINs/HIEs that have been determined by OIG to have committed information blocking and have either resolved their CMP liability with OIG or had a CMP imposed by OIG for information blocking under subpart N of 42 CFR part 1003 (88 FR 74954). To ensure accurate identification of actors, we proposed in 45 CFR 171.1101(b)(1) to post the type of actor (for example, HINs/HIEs or health IT developers of certified health IT) and the actor's legal name, including any alternative or additional trade name(s) under which the actor operates.
The last information we proposed to post on our public website, for all actors, would be the two types of information mentioned above regarding health care providers (88 FR 74954). First, in 45 CFR 171.1101(a)(1)(iii) and (b)(1)(iii), we proposed to post a description of the practice, as the term is defined in 45 CFR 171.102 and referenced in 45 CFR 171.103, found to have been information blocking. In the case of a resolved CMP liability, we would post the practice alleged to be information blocking. This information will help provide transparency into how information blocking conduct is impacting the nationwide health information technology infrastructure, and in particular, specific practices that are impacting the infrastructure. Second, in 45 CFR 171.1101(a)(1)(v) and (b)(1)(iv), we proposed to post where to find additional information about the determination (or resolution of CMP liability) of information blocking that is publicly available via HHS or, where applicable, another part of the U.S. Government. This information could include hyperlinks and other information, to help interested persons find any additional information about the determination, settlement, penalty, or disincentive that has been made publicly available by the U.S. Government. Such publicly available information would include any summaries or media releases that may be posted by OIG, or another part of HHS, on their internet website(s). It could also include additional information that may be made publicly available about the determination by or other parts of the U.S. Government. For example, if an actor who has exhausted applicable administrative appeal procedures and brought action in a Federal court for review of the decision that has become final, we could post information on our website about the existence of the court action and where or how to access information about the determination, or resulting court action, that has been made publicly available by the court. This information would provide additional context for how information blocking conduct is impacting the nationwide health information technology infrastructure.
In the Disincentives Proposed Rule, we stated that publicly posting information about actors that have been determined by OIG to have committed information blocking is important for providing transparency into how and where information blocking conduct is occurring within and impacting the broader nationwide health information technology infrastructure (88 FR 74954). Between April 5, 2021, and September 30, 2023, we received over 800 claims of information blocking through the
Report Information Blocking Portal.
18
We publicly post information about these claims, which we update monthly. Beyond posting the number of claims, the posted information includes claim counts by type of claimant and claim counts by potential actor.
19
While OIG has not necessarily evaluated whether these claims qualify as information blocking, this information provides transparency about how participants in the nationwide health IT infrastructure perceive actions by actors that are part of the same infrastructure, which is intended to support the access, exchange, and use of EHI. A natural progression of the posting of such information is the posting of information about actual information blocking determinations by OIG, including any disincentives applied to health care providers. This information can help the public understand how the information blocking regulations, which seek to prevent and address practices that unreasonably or unnecessarily interfere with lawful access, exchange, or use of EHI through the nationwide health IT infrastructure, are being enforced. It would also provide clarity regarding how and where actors are engaging in information blocking practices within the nationwide health IT infrastructure. Based on this information, participants in the nationwide health IT infrastructure, as well as members of the general public, can confirm or dispel perceptions of information blocking within that infrastructure. Additionally, the combined transparency into the processes Congress authorized and instructed HHS to implement (that is, ONC implementing a claims reporting process, disincentives for applicable actors found to have committed information blocking by OIG) would foster public confidence in the information blocking enforcement framework and potentially encourage public participation in that framework, whether by submitting a claim of information blocking or participating in an OIG information blocking investigation. We invited public comments on these proposals, including comments on whether we should publicly post additional information (and why) about health care providers, health IT developers of certified health IT, or HINs/HIEs that have been determined by OIG to have committed information blocking.
18
For more information,
see:
“Information Blocking Claims: By the Numbers,”
https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers.
19
Ibid.
The following is a summary of the comments we received and our responses.
Comments.
Many commenters supported the proposal to publicly post information about actors that have been determined to have committed information blocking. Several commenters expressed that the proposal would increase transparency by: providing a better understanding for the healthcare community, including patients, about information blocking practices and how they are assessed by HHS; providing greater visibility to regulators and other health system stakeholders on the gaps and barriers to information sharing; showing the degree to which healthcare data is currently being blocked; supporting patients in making informed decisions about future care; and providing health care providers with information about health IT developers of certified health IT and HINs/HIEs. Several commenters expressed that public posting will further help prevent information blocking violations, enhance accountability, and drive improvements.
Response.
We thank commenters for the support of our proposal to publicly post information about actors that have been determined to have committed information blocking and, in the case of health care providers, have been subject to a disincentive.
Comments.
A few commenters supported the proposal, in 45 CFR 171.1101(a)(3), that posting of the information specified in 45 CFR 1101(a)(1) about health care providers that have been determined to have committed information blocking and have been subject to a disincentive would be conducted in accordance with existing rights to review information that may be associated with the applied disincentive. Other commenters expressed concern over not having the ability to review what information is posted prior to the information being publicly posted and recommended being able to review the information for accuracy before posting. One commenter expressed concern that health care provider information could be erroneously posted and the burden to correct any inaccurate postings would fall upon the provider after the fact.
Response.
We thank commenters for their comments. We did not propose a unique process by which health care providers would be provided an opportunity to review information prior to posting on ONC's website. The information that would be posted is basic information about the health care provider and the information blocking determination (for example, provider name and address, practice found to be information blocking, disincentive(s) applied, and where to find additional information about the determination of information blocking that is publicly available via HHS or, where applicable, another part of the U.S. Government) that would be derived and confirmed through the OIG investigation and referral to CMS. HHS will work with healthcare providers to correct any clerical errors in these information elements to be posted prior to the information being posted on ONC's website or to correct such information after posting.
Further, in the Disincentives Proposed Rule, we recognized that an appropriate agency may have other program obligations related to release of information about a participant that is a health care provider (as defined in 45 CFR 171.102) in such programs (88 FR 74953 and 74954). On this basis, we proposed at 45 CFR 171.1101(a)(3) that posting of the information about health care providers that have been determined to have committed information blocking and have been subject to a disincentive would be conducted in accordance with existing rights to review information that may be associated with a disincentive specified in 45 CFR 171.1001. For instance, where a health care provider, as defined in 45 CFR 171.102, has a statutory right to review performance information, this existing right would be exercised prior to public posting of information regarding information blocking on the website described above. We believe that establishing an additional review process could potentially conflict with or duplicate these existing statutory review rights, such as review rights provided under MIPS at SSA section 1848(q)(9)(C).
Comments.
Many comments recommended against public posting until after a health care provider has completed an appeals process. Many commenters also recommended not publicly posting information on the ONC website if the actor(s) are conducting or have completed educational or corrective steps, including providing a period of one or more years for actors to complete corrective actions or come into compliance before public posting.
Response.
We did not propose a single administrative appeals process for information blocking disincentives. Instead, as described in section III.B.2. of this final rule, any right to appeal administratively a disincentive, if available, would be provided under the authorities used by the Secretary to establish a disincentive through notice
and comment rulemaking. In proposing at 45 CFR 171.1101(a)(2) that information will not be posted prior to a disincentive being imposed and will not include information about a disincentive that has not been applied, we intended to capture scenarios where a health care provider may have a right to administratively appeal under the authority used to establish the disincentive. Our intent was to be consistent with our proposal for health IT developers of certified health IT and HIN/HIEs in 45 CFR 171.1101(b)(2), which states that information will not be posted on ONC's website until a CMP has become final consistent with the procedures in subpart O of 42 CFR part 1003, which include procedures for an appeal of a CMP. However, we believe that additional clarity regarding the issue of appeals highlighted by the commenters is necessary to ensure the language reflects our intended policy. Therefore, we have finalized a modification to the provision in 45 CFR 171.1101(a)(2) to add that information will not be posted prior to the completion of any administrative appeals process pursued by the health care provider, for example, an appeals process provided for under the authority used to establish the disincentive.
For health care providers, we note that we did not propose, and have not finalized, corrective action options for those health care providers that OIG has determined to have committed information blocking, including remedial actions, to avoid public posting. Regarding corrective action plans for health IT developers of certified health IT or HINs/HIEs, we refer readers to the discussion in the OIG CMP Final Rule, in which OIG states that it does not anticipate using alternatives to CMPs such as corrective action plans at the time of the final rule but may consider such approaches in the future (88 FR 42824).
Comments.
One commenter stated that public posting should not be implemented until all health care providers are equally disincentivized for information blocking. Another commenter urged ONC to delay the launch of this website until regulated health care providers and the relevant Federal agencies have had experience with investigations and referrals for disincentives and actors have received clearer guidance.
Response.
We acknowledge commenters' concerns that this final rule does not finalize disincentives that apply to all the types of health care providers included in the health care provider definition at 45 CFR 171.102. However, it is important to begin providing transparency about those health care providers to whom the disincentive(s) finalized in this rule are applied in order to begin providing the public with transparency about how and where information blocking is impacting the nationwide health information technology infrastructure.
PHSA section 3001(c)(4) requires that the National Coordinator maintain an internet website “to ensure transparency in promotion of a nationwide health information technology infrastructure.” The website where the information would appear is not a new website but rather the current ONC website.
20
We disagree that posting on the website should be delayed until regulated health care providers and Federal agencies have had experience with investigations and referrals for disincentives. Federal agencies have experience with investigations and referrals, and health care provider information already appears on several websites throughout the Federal government. We also provide data on the ONC website about claims or suggestions of possible information blocking collected through the Report Information Blocking Portal
21
and education resources and guidance on the information blocking regulations on the ONC website.
22
20
For more information,
see: https://www.healthit.gov/.
21
For more information,
see: https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers.
22
For more information,
see: https://www.healthit.gov/topic/information-blocking.
Comments.
Some commenters stated that posting health care provider information is a second penalty on top of the monetary disincentive. One commenter asked if public posting is considered a disincentive and recommended it be classified as such. Several commenters expressed concerns about the proposal to list the names of actors determined to have engaged in information blocking on ONC's website, stating that this provision will do little to advance transparency regarding the impact of information blocking on the nationwide health information technology infrastructure but will result in public shaming of actors who have already been penalized for their conduct.
Response.
We do not agree with commenters that publicly posting health care provider names constitutes a disincentive. We also disagree with commenters that the posting of health care provider names would be sufficient to deter information blocking, consistent with our discussion of appropriate disincentives in section III.A.3. of this final rule. We note that the disincentives CMS proposed and has finalized in this final rule would each potentially result in a consequence for a health care provider that has been determined by OIG to have committed information blocking, which CMS has stated would deter information blocking practices. The posting of information about health care providers that have committed blocking and been subject to a disincentive does not reflect a consequence commensurate with an OIG determination that the health care provider committed information blocking or the disincentives CMS has finalized.
Last, we disagree that the posting of health care provider names following the imposition of a disincentive as part of the information publicly posted on ONC's website will not advance transparency about information blocking practices. As we have stated, the purpose of posting health care provider names is to ensure transparency in promotion of a nationwide health information technology infrastructure, as we explain elsewhere in this final rule.
Comments.
A few commenters did not support public posting due to the delay from when the information blocking practice may have occurred and when the information would be publicly posted, stating that public posting after an actor has completed corrective action would unfairly label them information blockers and impose reputational harm after they have already come into compliance. One commenter specifically expressed concern with the delay in timing from when the information blocking act may have occurred to when the information would be publicly posted, because it may result in current health care providers operating under an organizational TIN being punished for conduct committed by persons who no longer operate under that TIN and that this could steer patients away from these health care providers to the patient's detriment. A few commenters expressed concern that a group of health care providers could suffer reputational harm from public posting based on a single actor, for instance, commenters expressed concerns about potential harm from public posting information about health care providers who are not involved in the information blocking or commit inadvertent acts.
Response.
We appreciate commenters' concerns regarding the period of time which may exist between the occurrence of the information blocking conduct and the posting of information following the imposition of a disincentive. We note that we did not
propose to establish a corrective action plan or other process to allow any health care provider to demonstrate compliance with the information blocking regulations following a determination by OIG that a practice is information blocking. We also remind readers that the definition of information blocking for health care providers requires that the health care provider “knows” that a practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. This means there would not be posting of unintentional, inadvertent acts of health care providers. While a health care provider may subsequently pursue efforts to cease the information blocking practice which resulted in the imposition of a disincentive, it is still beneficial for the public to be able to understand how and where information blocking is impacting the nationwide health information technology infrastructure, including what aspects of that infrastructure are being impacted by health care providers.
Regarding health care providers operating under or employed by a larger entity, we note that under the regulations we have finalized, the information posted on ONC's website will be specific to the health care provider that OIG has determined has committed information blocking and that has been subject to a disincentive. If OIG determines that a health care provider who is an individual has committed information blocking and refers that individual to an appropriate agency, and the individual is subject to a disincentive, ONC would post only information regarding the individual, not any other entities with which the individual is associated. If OIG determines that a health care provider that is an entity, such as a group practice, has committed information blocking, and the entity is subject to a disincentive, ONC would post information about the entity.
Comments.
Some commenters recommended ONC use certain criteria or thresholds in order to decide whether to publicly post information about a health care provider for information blocking. Commenters recommended that ONC consider the following factors before determining whether to publicly post information, including: whether there is frequent, repeat, or significant information blocking, as opposed to minor conduct undertaken in good faith; whether the public would benefit from the information; whether the actor has corrected the information blocking; and time since the information blocking occurred. Other commenters recommended drawing greater attention to repeat offenders and actors who continue to perform the same type of information blocking for an extended period of time over actors who had a single violation that they remediated quickly.
Response.
We appreciate commenters' suggestions, but we did not propose to utilize criteria to determine whether to publicly post information about a health care provider and decline to adopt them in this final rule. We believe it is important to provide transparency with respect to any determination of information blocking that has resulted in a health care provider being subject to a disincentive in order to increase understanding about how and where information blocking is impacting the nationwide health information technology infrastructure, including the scope of information blocking practices that have resulted in disincentives.
Regarding the suggested factor which referenced “minor conduct undertaken in good faith,” we remind readers, as we did in a prior response, that information blocking has an element of intent. For health care providers, that intent is that the health care provider knows that a practice is unreasonable and is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.
We also remind readers that, as discussed in III.B.1.a. of this final rule, OIG expects to use four priorities to inform decisions about which information blocking allegations to pursue: (i) resulted in, are causing, or have the potential to cause patient harm; (ii) significantly impacted a provider's ability to care for patients; (iii) were of long duration; and (iv) caused financial loss to Federal health care programs, or other government or private entities. However, these priorities are not dispositive. OIG will assess each allegation to determine whether it implicates one or more of the enforcement priorities, or otherwise merits further investigation and potential enforcement action, and OIG may evaluate allegations and prioritize investigations based in part on the volume of claims relating to the same (or similar) practices by the same entity or individual.
Comments.
A few commenters recommended that only deidentified actor information be posted, at least initially. One commenter did not support public posting of obstetrician-gynecologists' names, practice information and information blocking determination, expressing concern about criminalization and scrutiny of reproductive healthcare data. One commenter recommended that rather than listing the details of information blockers, ONC list all health care providers who are successfully exchanging information.
Response.
We disagree with the commenter that only deidentified actor information should be publicly posted. The identification of health care providers that have committed information blocking is important for the public to be aware of the particular circumstances in which information blocking is occurring and, therefore, to understand which aspects of the nationwide health information technology infrastructure are being impacted. We also disagree with the commenter that we should not publicly post information regarding obstetrician-gynecologists. If a health care provider has been determined by OIG to have committed information blocking and is subject to a disincentive, we will post information regardless of their specialty or practice. To promote transparency, we believe it is important to release information about actors that have been determined by OIG to have committed information blocking to inform the public about how and where information blocking is occurring within the broader health information technology infrastructure. For more information about concerns regarding withholding electronic health information related to reproductive health care, we refer readers to a May 13, 2024, blog post on ONC's website
23
that explains how the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” final rule (89 FR 32976), which appeared in the
Federal Register
on April 26, 2024, and the information blocking regulations work together to protect the privacy of such health information.
23
See: https://www.healthit.gov/buzz-blog/information-blocking/supporting-information-privacy-for-patients-now-and-always-four-reminders-of-how-hhs-information-blocking-regulations-recognize-privacy-rules
.
Regarding the recommendation to post information about those health care providers that are successfully exchanging information, we note that we did not propose to do so in the Disincentives Proposed Rule and decline to finalize such a policy in this final rule. We also note that some of this type of information may be made available through existing mechanisms. For instance, the Medicare Promoting Interoperability Program and MIPS Promoting Interoperability performance category involve public reporting components about health care provider performance in these programs, which
can reflect successful performance on measures of health information exchange that contribute to performance under these programs.
Comments.
A few commenters recommended posting the year or timeframe in which the information blocking violation occurred. Several commenters recommended establishing a time limit on posting the information to the website by which to remove health care providers from the information blocking list on the website.
Response.
We thank commenters for the recommendation to include the timeframe during which the information blocking occurred as part of the information we are publicly posting. We stated in the Disincentive Proposed Rule that we sought to help the public understand “how” and “where” information blocking is occurring within the broader health information technology infrastructure (88 FR 74953). We agree that information about when information blocking occurred is a critical piece of information and that this concept is implicit in our interest in providing transparency regarding “how” and “where” information blocking occurred to support understanding of the scope of information blocking practices over time that impact the nationwide health information technology infrastructure. To this point, knowing when information blocking occurred is part of knowing how it occurred. Without this information, the public, including other health care providers, would not know whether a particular practice determined to be information blocking was a recent occurrence that may have implications for their own recent or current interactions with the health care provider that was found to have committed information blocking; or whether the practice occurred at a time when such health care providers had no interactions with the health care provider found to have committed information blocking. Therefore, we agree with commenters that it would be appropriate to explicitly identify the timeframe as part of the “description of the [information blocking] practice” that we proposed to include in the information for posting in 45 CFR 171.1101(a)(1)(iii) for health care providers and 45 CFR 171.1101(b)(1)(iii) (88 FR 74954). Accordingly, we have modified the language in 45 CFR 171.1101(a)(1)(iii) and 45 CFR 171.1101(b)(1)(iii) to clarify that the description of the practice includes when the practice occurred.
We did not propose to put a time limit on how long the information would be posted on ONC's website, and we are not adopting the commenter's recommendation. We may consider this recommendation in future rulemaking.
Comments.
One commenter expressed concern that HHS could further use the posted information to apply additional disincentives or bar a physician from participation in other programs and that additional rulemaking would be needed for such uses.
Response.
We appreciate the commenter's concern; however, we note that the imposition of a disincentive would be based on a referral from OIG of its determination that a health care provider committed information blocking, rather than the public posting of information on ONC's website. Moreover, we note that we have finalized that the disincentives established for health care providers pursuant to PHSA section 3022(b)(2)(B) are listed in 45 CFR 171.1001. Other actions not listed in 45 CFR 171.1001 taken by Federal programs based on the information publicly posted on ONC's website would not be a disincentive and are outside the scope of this final rule.
Comments.
One commenter stated that public posting of information would lead to unintended consequences such as distrust or an adversarial relationship between actors subject to the information blocking regulations and HHS. Another commenter expressed concern that public posting, combined with the potential for significant disincentives, would deter information blocking complaints. The commenter stated that the health data interoperability community is dependent upon good working relationships between individuals and organizations that operate in the space and that a complainant may refrain from submitting information blocking claims in order to maintain a good relationship with the individual or entity alleged to have committed information blocking.
Response.
We appreciate commenters' input but believe that the value of publicly posting this information outweighs any concerns about increasing distrust between health care providers and HHS or between health care providers and other entities supporting health information exchange. We note that information blocking negatively impacts health care providers by limiting access to electronic health information that may be necessary for effective care delivery and suggest that all parties committed to increasing the exchange of electronic health information should support the public availability of information about how and where information blocking is impacting the nationwide health information technology infrastructure.
After consideration of the public comments, we have finalized these proposals with the modifications discussed above.
C. Appropriate Disincentives for Health Care Providers
In the Disincentives Proposed Rule, we proposed to establish a set of disincentives for health care providers that have committed information blocking (88 FR 74954 through 74966). We noted that each of the proposed disincentives would be imposed by CMS following a referral of a determination of information blocking by OIG. We stated that each of the disincentives was being proposed using authorities under applicable Federal law, consistent with PHSA section 3022(b)(2)(B).
1. Background
a. Impacted Health Care Providers
In the Disincentives Proposed Rule, we stated that the proposed disincentives would apply to a subset of the individuals and entities meeting the information blocking regulations' definition of health care provider at 45 CFR 171.102 (88 FR 74954 and 74955). As discussed hereafter, this rule establishes disincentives for health care providers (as defined in 45 CFR 171.102) that are also eligible to participate in certain Federal programs: the Medicare Promoting Interoperability Program and the MIPS Promoting Interoperability performance category (previously the EHR Incentive Programs); and the Medicare Shared Savings Program.
In the Disincentives Proposed Rule, we recognized that the disincentives proposed would only apply to certain health care providers and that the information blocking regulations are also applicable to health care providers that are not eligible to participate in these programs (88 FR 74955). However, the policies we have finalized in this rule are a first step that focuses on authorities that pertain to certain health care providers that furnish a broad array of healthcare services to large numbers of Medicare beneficiaries and other patients. We believe optimal deterrence of information blocking calls for imposing appropriate disincentives on all health care providers (as defined at 45 CFR 171.102) determined by OIG to have committed information blocking. In section IV. of this final rule, we acknowledge public comments received in response to a request for information on establishing disincentives, using applicable Federal law, that could be
imposed on a broader range of health care providers.
b. Impact of Disincentives
In the Disincentives Proposed Rule, we stated that we believe the proposed disincentives would deter information blocking by health care providers. However, we recognized that the actual monetary impact resulting from the application of the disincentives may vary across health care providers subject to the disincentive (88 FR 74955). For example, the disincentive proposed in section III.C.3. of the Disincentives Proposed Rule, for the MIPS Promoting Interoperability performance category, would result in an adjustment to payments under Medicare Part B to MIPS eligible clinicians (as defined in 42 CFR 414.1305). This disincentive would reduce to zero the Promoting Interoperability performance category score of any MIPS eligible clinician that has been determined by OIG to have committed information blocking (as defined at 45 CFR 171.103) during the calendar year (CY) of the referral of a determination from OIG. However, the actual financial impact experienced by a health care provider because of this proposed disincentive being applied in MIPS would vary. For example, Part B payments to the MIPS eligible clinician are subject to a MIPS payment adjustment factor, which CMS determines based on the MIPS eligible clinician's final score. We noted that, in determining each MIPS eligible clinician's final score, CMS considers the assigned weight of, and the MIPS eligible clinician's performance in, the four MIPS performance categories, including the Promoting Interoperability performance category. The MIPS eligible clinician's final score then determines whether the eligible clinician earns a negative, neutral, or positive payment adjustment factor that will be applied to the amounts otherwise paid to the MIPS eligible clinician under Medicare Part B for covered professional services during the applicable MIPS payment year (88 FR 74955).
In the interest of addressing this variability, we discussed in the Disincentives Proposed Rule that we had considered whether we could propose an alternative approach under which we would tailor the monetary impact of a disincentive imposed on a health care provider to the severity of the conduct in which the health care provider engaged (88 FR 74955). However, we stated that we did not believe it would be feasible to develop such an approach for the disincentives proposed for health care providers. We noted that, because disincentives must be established using authorities under applicable Federal law, the statute under which a disincentive is being established would need to specifically authorize or provide sufficient discretion for an appropriate agency to be able to adjust the monetary impact of the disincentive to fit the gravity or severity of the information blocking the health care provider has been determined to have committed. We noted that, based on our review of potential authorities under which to establish disincentives, we believed many authorities do not provide discretion to adjust the monetary impact of a potential disincentive in this fashion. For instance, in the Disincentives Proposed Rule, CMS proposed to establish a disincenti
This text is long and has been trimmed here. Open the source document for the complete record.
This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.