Rule2024-13793
21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
July 1, 2024
Effective
July 31, 2024
Issuing agencies
Health and Human Services DepartmentCenters for Medicare & Medicaid Services
Abstract
This final rule implements the provision of the 21st Century Cures Act specifying that a health care provider determined by the HHS Inspector General to have committed information blocking shall be referred to the appropriate agency to be subject to appropriate disincentives set forth through notice and comment rulemaking. This rulemaking establishes, for certain health care providers, a set of appropriate disincentives using authorities under applicable Federal law.
Full Text
<html>
<head>
<title>Federal Register, Volume 89 Issue 126 (Monday, July 1, 2024)</title>
</head>
<body><pre>
[Federal Register Volume 89, Number 126 (Monday, July 1, 2024)]
[Rules and Regulations]
[Pages 54662-54718]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2024-13793]
[[Page 54661]]
Vol. 89
Monday,
No. 126
July 1, 2024
Part II
Department of Health and Human Services
-----------------------------------------------------------------------
Centers for Medicare and Medicaid Services
-----------------------------------------------------------------------
42 CFR Part 414, et al.
45 CFR Part 171
21st Century Cures Act: Establishment of Disincentives for Health Care
Providers That Have Committed Information Blocking; Final Rule
Federal Register / Vol. 89 , No. 126 / Monday, July 1, 2024 / Rules
and Regulations
[[Page 54662]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
42 CFR Parts 414, 425, and 495
Office of the Secretary
45 CFR Part 171
RIN 0955-AA05
21st Century Cures Act: Establishment of Disincentives for Health
Care Providers That Have Committed Information Blocking
AGENCY: Centers for Medicare & Medicaid Services (CMS) and Office of
the National Coordinator for Health Information Technology (ONC),
Department of Health and Human Services (HHS).
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This final rule implements the provision of the 21st Century
Cures Act specifying that a health care provider determined by the HHS
Inspector General to have committed information blocking shall be
referred to the appropriate agency to be subject to appropriate
disincentives set forth through notice and comment rulemaking. This
rulemaking establishes, for certain health care providers, a set of
appropriate disincentives using authorities under applicable Federal
law.
DATES: This rule is effective as of July 31, 2024.
FOR FURTHER INFORMATION CONTACT:
Alexander Baker, Office of Policy, Office of the National
Coordinator for Health Information Technology (ONC), (202) 690-7151,
for general issues.
Elizabeth Holland, Centers for Medicare & Medicaid Services (CMS),
(443) 934-2532, for issues related to the Promoting Interoperability
Program and the Promoting Interoperability performance category of the
Merit-Based Incentive Payment System.
Aryanna Abouzari, Centers for Medicare & Medicaid Services (CMS),
(415) 744-3668 or <a href="/cdn-cgi/l/email-protection#0d5e656c7f68695e6c7b64636a7e5d7f626a7f6c604d6e607e2365657e236a627b"><span class="__cf_email__" data-cfemail="4d1e252c3f28291e2c3b24232a3e1d3f222a3f2c200d2e203e6325253e632a223b">[email protected]</span></a>, for issues related
to the Medicare Shared Savings Program.
SUPPLEMENTARY INFORMATION:
Table of Contents
I. Executive Summary
A. Purpose of Regulatory Action
B. Summary of Major Provisions
C. Costs and Benefits
D. Severability
II. Background
A. Statutory Basis
B. Regulatory History
1. ONC Cures Act Final Rule
2. Office of Inspector General (OIG) Civil Money Penalties (CMP)
Final Rule
3. Establishment of Disincentives for Health Care Providers That
Have Committed Information Blocking Proposed Rule
C. General Comments on the Disincentives Proposed Rule
III. Provisions of the Regulation and Anticipated Approach to
Investigations and Referrals
A. Relevant Statutory Terms and Provisions
1. Appropriate Agency
2. Authorities Under Applicable Federal Law
3. Appropriate Disincentives
B. Approach to Determination of Information Blocking and
Application of Disincentives
1. OIG Investigation and Referral
2. General Provisions for Application of Disincentives
3. Transparency for Information Blocking Determinations,
Disincentives, and Penalties
C. Appropriate Disincentives for Health Care Providers
1. Background
2. Medicare Promoting Interoperability Program for Eligible
Hospitals and Critical Access Hospitals (CAHs)
3. Promoting Interoperability Performance Category of the
Medicare Merit-Based Incentive Payment System (MIPS)
4. Medicare Shared Savings Program
IV. Request for Information
V. Collection of Information Requirements
VI. Regulatory Impact Statement
A. Executive Order 12866
B. Regulatory Flexibility Act
C. Unfunded Mandates Reform Act
D. Executive Order 13132
I. Executive Summary
A. Purpose of Regulatory Action
This final rule implements the 21st Century Cures Act (Cures Act)
provision for referral of a health care provider (individual or
entity), determined by the HHS Office of Inspector General (OIG) to
have committed information blocking, ``to the appropriate agency to be
subject to appropriate disincentives using authorities under applicable
Federal law, as the Secretary sets forth through notice and comment
rulemaking'' (section 3022(b)(2)(B) of the Public Health Service Act
(PHSA) (42 U.S.C. 300jj-52(b)(2)(B)), as added by section 4004 of the
Cures Act (Pub. L. 114-255, Dec. 13, 2016)). This final rule
establishes disincentives for certain health care providers (as defined
in 45 CFR 171.102) that are also Medicare-enrolled providers or
suppliers.
B. Summary of Major Provisions
This final rule establishes disincentives applicable to certain
health care providers (as defined in 45 CFR 171.102), determined by OIG
to have committed information blocking (as defined in 45 CFR 171.103),
that also are Medicare-enrolled providers or suppliers. This final rule
also provides information related to OIG's investigation of claims of
information blocking and referral of a health care provider to an
appropriate agency to be subject to appropriate disincentives. Finally,
this final rule establishes a process by which information will be
shared with the public about health care providers and other actors
(health IT developers or other entities offering certified health IT,
health information exchanges, and health information networks) that OIG
determines have committed information blocking.
Although this final rule does not establish disincentives for all
of the health care providers included in the 45 CFR 171.102 definition,
the health care providers to whom the disincentives finalized in this
rule apply furnish a broad array of services to a significant number of
both Medicare beneficiaries and other patients. Thus, this set of
disincentives directly advances HHS priorities for deterring
information blocking, while also advancing appropriate sharing of
electronic health information (EHI) by health care providers \1\ to
support safer, more coordinated care for all patients.
---------------------------------------------------------------------------
\1\ Except if noted in reference a particular statutory
authority or CFR section, we use in this rule ``health care
provider,'' ``provider,'' and ``provider type'' as inclusive of
individuals and entities that may be characterized for purposes of
Medicare enrollment or particular reimbursement policies as
providers or suppliers--or both across different contexts such as
specific services furnished in particular settings.
---------------------------------------------------------------------------
We believe it is important to establish appropriate disincentives
that account for all health care providers that fall within the
definition of health care provider at 45 CFR 171.102. While effective
deterrence of information blocking can benefit patients by reducing the
degree to which health care providers engage in this practice, fewer
patients will benefit from these deterrent effects if disincentives
have not been established for all health care providers within the
definition of health care provider at 45 CFR 171.102. In section IV of
the 21st Century Cures Act: Establishment of Disincentives for Health
Care Providers That Have Committed Information Blocking proposed rule
(Disincentives Proposed Rule), we requested information on how we could
establish disincentives for other health care providers, particularly
those health care providers not implicated under the CMS authorities
[[Page 54663]]
we proposed to use to establish disincentives in the proposed rule (88
FR 74966 and 74967).
Consistent with PHSA section 3022(b)(2)(B), in section III.C. of
this final rule, CMS has finalized the following disincentives using
authorities under applicable Federal law, as follows:
<bullet> Under the authority for the Medicare Promoting
Interoperability Program in the Social Security Act (SSA), at sections
1886(b)(3)(B)(ix) and 1886(n) for eligible hospitals, and at section
1814(l)(4) for critical access hospitals (CAHs), CMS has finalized that
an eligible hospital or CAH is not a meaningful electronic health
record (EHR) user in an EHR reporting period if OIG refers, during the
calendar year of the reporting period, a determination that the
eligible hospital or CAH committed information blocking as defined at
45 CFR 171.103. As a result, an eligible hospital subject to this
disincentive will not be able to earn the three quarters of the annual
market basket increase associated with qualifying as a meaningful EHR
user, and a CAH subject to this disincentive will have its payment
reduced to 100 percent of reasonable costs, from the 101 percent of
reasonable costs it might have otherwise earned, in an applicable year.
<bullet> Under the authority in SSA sections 1848(o)(2)(A) and (D)
and 1848(q)(2)(A)(iv) and (B)(iv), for the Promoting Interoperability
performance category of the Merit-based Incentive Payment System
(MIPS), CMS has finalized that a health care provider defined in 45 CFR
171.102 that is a MIPS eligible clinician (as defined in 42 CFR
414.1305 and including groups) is not a meaningful EHR user in a
performance period if OIG refers, during the calendar year of the
reporting period, a determination that the MIPS eligible clinician
committed information blocking as defined at 45 CFR 171.103. CMS also
has finalized that the determination by OIG that a MIPS eligible
clinician committed information blocking will result in the MIPS
eligible clinician, if required to report on the Promoting
Interoperability performance category of MIPS, not earning a score in
the performance category (a zero score), which is typically a quarter
of the total final composite performance score (a ``final score'' as
defined at 42 CFR 414.1305). CMS has codified this proposal under the
definition of meaningful EHR user for MIPS at 42 CFR 414.1305 and added
it to the requirements for earning a score for the MIPS Promoting
Interoperability performance category at 42 CFR 414.1375(b).
<bullet> Under the authority in SSA section 1899(b)(2)(G) for the
Medicare Shared Savings Program (Shared Savings Program), CMS has
finalized that a health care provider as defined in 45 CFR 171.102 that
is an accountable care organization (ACO), ACO participant, or ACO
provider/supplier, if determined by OIG to have committed information
blocking as defined at 45 CFR 171.103, may be barred from participating
in the Shared Savings Program for at least 1 year (88 FR 74964 and
74965). In this final rule, in consideration of the comments received,
CMS has finalized incorporation of an alternative policy discussed in
the proposed rule, under which CMS will consider an OIG information
blocking determination in light of relevant facts and circumstances
before applying a disincentive under the Shared Savings Program, such
as denying the addition of an ACO participant to an ACO participant
list (or an ACO provider/supplier to the ACO provider/supplier list),
informing an ACO that remedial action should be taken against the ACO
participant (or ACO provider/supplier), denying an ACO's application to
participate in the Shared Savings Program if the remedial action is not
taken, or terminating an ACO's participation agreement with CMS. This
will result in a health care provider being removed from an ACO or
prevented from joining an ACO; and in the instance where a health care
provider is an ACO, this will prevent the ACO's participation in the
Shared Savings Program. The relevant facts and circumstances include
the nature of the health care provider's information blocking, the
health care provider's diligence in identifying and correcting the
problem, the time since the information blocking occurred, whether the
provider was previously subject to a disincentive in another program,
and other factors.
C. Costs and Benefits
Executive Order 12866 on Regulatory Planning and Review and
Executive Order 13563 on Improving Regulation and Regulatory Review
direct agencies to assess all costs and benefits of available
regulatory alternatives and, if regulation is necessary, to select
regulatory approaches that maximize net benefits (including potential
economic, environmental, public health and safety effects, distributive
impacts, and equity). Section 3(f) of Executive Order 12866, as amended
by Executive Order 14094, defines a ``significant regulatory action''
as an action that is likely to result in a rule that may: (1) have an
annual effect on the economy of $200 million or more (adjusted every 3
years by the Administrator of the Office of Information and Regulatory
Affairs (OIRA) for changes in gross domestic product), or adversely
affect in a material way the economy, a sector of the economy,
productivity, competition, jobs, the environment, public health or
safety, or State, local, territorial, or tribal governments or
communities; (2) create a serious inconsistency or otherwise interfere
with an action taken or planned by another agency; (3) materially alter
the budgetary impact of entitlements, grants, user fees, or loan
programs or the rights and obligations of recipients thereof; or (4)
raise legal or policy issues for which centralized review would
meaningfully further the President's priorities or the principles set
forth in the Executive Order, as specifically authorized in a timely
manner by the Administrator of OIRA in each case. The Office of
Management and Budget (OMB) has determined that this final rule is not
a significant regulatory action, as the potential costs associated with
this final rule would not be greater than $200 million per year, and it
does not meet any of the other requirements to be a significant
regulatory action.
D. Severability
We are clarifying and emphasizing our intent that if any provision
of this final rule is held to be invalid or unenforceable by its terms,
or as applied to any person or circumstance, or stayed pending further
action, it shall be severable from this final rule, and from rules and
regulations currently in effect, and not affect the remainder thereof
or the application of the provision to other persons not similarly
situated or to other, dissimilar circumstances. If any provision is
held to be invalid or unenforceable, the remaining provisions which
could function independently, should take effect and be given the
maximum effect permitted by law.
Through this rule, we adopt provisions that are intended to and
will operate independently of each other, even if each serves the same
general purpose or policy goal. Where a provision is necessarily
dependent on another, the context generally makes that clear (such as
by cross-reference to a particular standard, requirement, condition, or
pre-requisite). Where a provision that is dependent on one that is
stayed or held invalid or unenforceable, as described in the preceding
paragraph, is included in a subparagraph, paragraph, or section within
part 171 of 45 CFR or part 414, 425, or 495 of 42 CFR, we intend that
[[Page 54664]]
other provisions of such subparagraph(s), paragraph(s), or section(s)
that operate independently of the provision stayed or held invalid or
unenforceable would remain in effect.
II. Background
A. Statutory Basis
The Cures Act was enacted on December 13, 2016, ``[t]o accelerate
the discovery, development, and delivery of 21st century cures, and for
other purposes'' (Pub. L. 114-255, December 16, 2016). Section 4004 of
the Cures Act added section 3022 to the PHSA. Section 3022(a)(1) of the
PHSA defines information blocking as a practice that, except as
required by law or specified by the Secretary pursuant to rulemaking,
is likely to interfere with, prevent, or materially discourage access,
exchange, or use of electronic health information, and: (1) if the
practice is conducted by a health information technology developer,
exchange, or network, such developer, exchange, or network knows, or
should know, that such practice is likely to interfere with, prevent,
or materially discourage the access, exchange, or use of electronic
health information; or (2) if the practice is conducted by a health
care provider, such health care provider knows that such practice is
unreasonable and is likely to interfere with, prevent, or materially
discourage access, exchange, or use of electronic health information.
Section 3022(a)(3) of the PHSA further provides that the Secretary
shall, through rulemaking, identify reasonable and necessary activities
that do not constitute information blocking. Section 3022(a)(4) of the
PHSA states that the term ``information blocking'' does not include any
practice or conduct occurring prior to the date that is 30 days after
December 13, 2016 (the date of the enactment of the Cures Act).\2\
Section 3022(a)(2) of the PHSA describes certain practices that may
constitute information blocking.
---------------------------------------------------------------------------
\2\ As January 12, 2017, was the thirtieth day after December
13, 2016, conduct occurring on or after January 13, 2017, that
otherwise meets the PHSA section 3022(a) definition of ``information
blocking,'' would be included in that definition.
---------------------------------------------------------------------------
Section 3022(b)(1) of the PHSA authorizes OIG to investigate
information blocking claims. Section 3022(b)(1)(B) of the PHSA
authorizes OIG to investigate claims that ``a health care provider
engaged in information blocking.'' Section 3022(b)(2)(B) of the PHSA
provides that any health care provider OIG determines to have committed
information blocking shall be referred to the appropriate agency to be
subject to appropriate disincentives using authorities under applicable
Federal law, as the Secretary sets forth through notice and comment
rulemaking. Sections 3022(b)(1)(A) and (C) of the PHSA authorize OIG to
investigate health information technology (IT) developers of certified
health IT or other entities offering certified health IT, health
information exchanges, and health information networks. Section
3022(b)(2)(A) of the PHSA authorizes the imposition of civil money
penalties (CMPs) \3\ not to exceed $1 million per violation on those
individuals and entities set forth in sections 3022(b)(1)(A) and (C) of
the PHSA.
---------------------------------------------------------------------------
\3\ We use the term ``civil money penalty'' here, rather than
``civil monetary penalty'' as used in PHSA section 3022(b)(2)(A) for
consistency with OIG's usage in the OIG CMP Final Rule (88 FR
42820).
---------------------------------------------------------------------------
PHSA section 3022 also authorizes ONC, the HHS Office for Civil
Rights (OCR), and OIG to consult, refer, and coordinate to resolve
claims of information blocking. PHSA section 3022(b)(3)(A) authorizes
OIG to refer claims of information blocking to OCR if OIG determines a
consultation regarding the health privacy and security rules
promulgated under section 264(c) of the Health Insurance Portability
and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191, Aug. 21, 1996)
(42 U.S.C. 1320d-2 note) will resolve such claims. PHSA section
3022(d)(1) specifies that the National Coordinator may serve as a
technical consultant to OIG and the Federal Trade Commission (FTC) for
purposes of carrying out section 3022 and may share information related
to claims or investigations of information blocking with the FTC for
purposes of such investigations, in addition to requiring the National
Coordinator to share information with OIG, as required by law.
PHSA section 3022(d)(4) requires the Secretary, in carrying out
section 3022 and to the extent possible, to ensure that information
blocking penalties do not duplicate penalty structures that would
otherwise apply with respect to information blocking and the type of
individual or entity involved as of the day before the date of
enactment of the Cures Act. Section 3022(a)(7) of the PHSA states that,
in carrying out section 3022, the Secretary shall ensure that health
care providers are not penalized for the failure of developers of
health information technology or other entities offering health
information technology to such providers to ensure that such technology
meets the requirements to be certified under Title XXX of the PHSA.
We address the statutory basis for each disincentive in greater
detail in section III.C. of this final rule.
B. Regulatory History
1. ONC Cures Act Final Rule
On March 4, 2019, a proposed rule titled 21st Century Cures Act:
Interoperability, Information Blocking, and the ONC Health IT
Certification Program (ONC Cures Act Proposed Rule) appeared in the
Federal Register (84 FR 7424). The rule proposed to implement certain
provisions of the Cures Act to advance interoperability and support the
access, exchange, and use of electronic health information. The ONC
Cures Act Proposed Rule included a request for information regarding
potential disincentives for health care providers that have committed
information blocking and asked whether modifying disincentives already
available under existing Department programs and regulations would
provide for more effective deterrence (84 FR 7553).
On May 1, 2020, a final rule titled 21st Century Cures Act:
Interoperability, Information Blocking, and the ONC Health IT
Certification Program (ONC Cures Act Final Rule) appeared in the
Federal Register (85 FR 25642). The final rule identified eight
reasonable and necessary activities that do not constitute information
blocking, consistent with the requirement in PHSA section 3022(a)(3).
Such reasonable and necessary activities are often referred to as
``exceptions'' to the definition of information blocking, or
``information blocking exceptions,'' as specified in 45 CFR part 171.
The ONC Cures Act Final Rule finalized definitions that are
necessary to implement the statutory information blocking provision in
PHSA section 3022, including definitions related to the four classes of
individuals and entities covered by the statutory information blocking
provision: health care providers, health IT developers, health IT
networks, and health IT exchanges.
As the term ``health care provider'' is not explicitly defined in
section 3022 of the PHSA, as added by section 4004 of the Cures Act,
the ONC Cures Act Final Rule adopted in 45 CFR 171.102 the definition
of health care provider in section 3000(3) of the PHSA \4\ for
[[Page 54665]]
purposes of the information blocking regulations in 45 CFR part 171.
The definitions listed in section 3000 of the PHSA apply ``[i]n this
title,'' which refers to Title XXX of the PHSA (85 FR 25795). Section
3022 of the PHSA is included in Title XXX.
---------------------------------------------------------------------------
\4\ As defined in 42 U.S.C. 300-jj, the term ``health care
provider'' includes a hospital, skilled nursing facility, nursing
facility, home health entity or other long term care facility,
health care clinic, community mental health center (as defined in
section 300x-2(b)(1) of this title), renal dialysis facility, blood
center, ambulatory surgical center described in section 1395l(i) of
this title, emergency medical services provider, Federally qualified
health center, group practice, a pharmacist, a pharmacy, a
laboratory, a physician (as defined in section 1395x(r) of the
title), a practitioner (as described in section 1395u(b)(18)(C) of
the title), a provider operated by, or under contract with, the
Indian Health Service or by an Indian tribe (as defined in the
Indian Self-Determination and Education Assistance Act [25 U.S.C.
5301 et seq.]), tribal organization, or urban Indian organization
(as defined in section 1603 of title 5), a rural health clinic, a
covered entity under section 256b of this title, an ambulatory
surgical center described in section 1395l(i) of this title, a
therapist (as defined in section 1395w-4(k)(3)(B)(iii) of the
title), and any other category of health care facility, entity,
practitioner, or clinician determined appropriate by the Secretary.
See also this guidance document: <a href="https://www.healthit.gov/sites/default/files/page2/2020-08/Health_Care_Provider_Definitions_v3.pdf">https://www.healthit.gov/sites/default/files/page2/2020-08/Health_Care_Provider_Definitions_v3.pdf</a>.
---------------------------------------------------------------------------
The ONC Cures Act Final Rule also established in 45 CFR 171.102
regulatory definitions for ``health information network or health
information exchange'' and ``health IT developer of certified health
IT,'' \5\ among other terms.\6\ The preamble text of the ONC Cures Act
Final Rule makes clear that an individual or entity could meet both the
definition of a health care provider and the definition of a health IT
developer of certified health IT (85 FR 25798 and 25799), or could meet
both the definition of a health care provider and a health information
exchange or network (85 FR 25801). We mention these potential scenarios
so that health care providers are aware that they would not necessarily
only be subject to the disincentives finalized in this rule, but
depending on the specific facts and circumstances, they could meet the
definition of a health information network, health information
exchange, or health IT developer of certified health IT--and therefore
be subject to civil money penalties, if found by OIG to have committed
information blocking.
---------------------------------------------------------------------------
\5\ In the ONC Cures Act Final Rule, ONC defined the term
``health IT developer of certified health IT'' in 45 CFR 171.102,
instead of using the term that appears in PHSA 3022(a)(1): ``health
IT developer.'' ONC explained that, because title XXX of the PHSA
does not define ``health information technology developer,'' ONC
interpreted section 3022(a)(1)(B) in light of the specific authority
provided to OIG in section 3022(b)(1)(A) and (b)(2). ONC noted that
section 3022(b)(2) discusses developers, networks, and exchanges by
referencing any individual or entity described in section
3022(b)(1)(A) or (C). Section 3022(b)(1)(A) states, in relevant
part, that OIG may investigate any claim that a health information
technology developer of certified health information technology or
other entity offering certified health information technology
engaged in information blocking (85 FR 25795, emphasis added).
\6\ In January 2024, ONC finalized a definition of what it means
to ``offer health IT,'' and finalized a corresponding update to the
``health IT developer of certified health IT'' definition. These
policies are part of a final rule titled Health Data, Technology,
and Interoperability: Certification Program Updates, Algorithm
Transparency, and Information Sharing (89 FR 1354 through 1358)
(HTI-1 Final Rule).
---------------------------------------------------------------------------
On November 4, 2020, an interim final rule with comment period
titled Information Blocking and the ONC Health IT Certification
Program: Extension of Compliance Dates and Timeframes in Response to
the COVID-19 Public Health Emergency (ONC Cures Act Interim Final Rule)
appeared in the Federal Register (85 FR 70064). The ONC Cures Act
Interim Final Rule extended certain compliance dates and timeframes
adopted in the ONC Cures Act Final Rule to offer the healthcare system
additional flexibilities in furnishing services to combat the COVID-19
pandemic, including extending the applicability date for the
information blocking provisions to April 5, 2021 (85 FR 70068). The ONC
Cures Act Interim Final Rule also extended from May 2, 2022, to October
6, 2022, the date on which electronic health information as defined in
45 CFR 171.102 for purposes of the information blocking definition in
45 CFR 171.103 would no longer be limited to the subset of EHI that is
identified by data elements represented in the United States Core Data
for Interoperability (USCDI) standard adopted in 45 CFR 170.213 (85 FR
70069).\7\ On and after October 6, 2022, practices likely to interfere
with access, exchange, or use of any information falling within the
definition of EHI in 45 CFR 171.102 may constitute information blocking
as defined in 45 CFR 171.103.
---------------------------------------------------------------------------
\7\ For more information about the USCDI, see: <a href="https://www.healthit.gov/isa/united-states-core-data-interoperability-uscdi">https://www.healthit.gov/isa/united-states-core-data-interoperability-uscdi</a>.
---------------------------------------------------------------------------
2. Office of Inspector General (OIG) Civil Money Penalties (CMP) Final
Rule
On April 24, 2020, a proposed rule titled Grants, Contracts, and
Other Agreements: Fraud and Abuse; Information Blocking; Revisions to
the Office of Inspector General's Civil Money Penalty Rules (OIG CMP
Proposed Rule) appeared in the Federal Register (85 FR 22979). The OIG
CMP Proposed Rule set forth proposed regulations to incorporate new CMP
authority for information blocking and related procedures in PHSA
section 3022 (85 FR 22982). Specific to information blocking, OIG also
provided information on--but did not propose regulations for--expected
enforcement priorities, the investigation process, and OIG's experience
with investigating conduct that includes an intent element (85 FR
22984).
A final rule titled Grants, Contracts, and Other Agreements: Fraud
and Abuse; Information Blocking; Office of Inspector General's Civil
Money Penalty Rules appeared in the Federal Register on July 3, 2023
(OIG CMP Final Rule) (88 FR 42820). This rulemaking addressed
imposition of CMPs for information blocking by health IT developers or
other entities offering certified health IT, and health information
exchanges and health information networks (HIEs/HINs). The OIG CMP
Final Rule did not establish appropriate disincentives for health care
providers that OIG has determined to have committed information
blocking.
In the OIG CMP Final Rule, OIG stated that a health care provider
that also meets the definition of a health IT developer of certified
health IT, or HIE/HIN, or both, under 45 CFR 171.102, may be subject to
information blocking CMPs (88 FR 42829). OIG further stated that as
part of its assessment of whether a health care provider is a HIN/HIE
that could be subject to CMPs for information blocking, OIG anticipates
engaging with the health care provider to better understand its
functions and to offer the health care provider an opportunity to
explain why it is not a HIN/HIE (88 FR 42828).
3. Establishment of Disincentives for Health Care Providers That Have
Committed Information Blocking Proposed Rule
On November 1, 2023, a proposed rule titled 21st Century Cures Act:
Establishment of Disincentives for Health Care Providers That Have
Committed Information Blocking appeared in the Federal Register (88 FR
74947) (Disincentives Proposed Rule). The Disincentives Proposed Rule
proposed to establish a set of appropriate disincentives for
information blocking by health care providers using authorities under
applicable Federal law, consistent with PHSA section 3022(b)(2)(B). The
Disincentives Proposed Rule also proposed to define certain statutory
terms and proposed to establish elements of a process for the
imposition of appropriate disincentives by an appropriate agency. The
Disincentives Proposed Rule further proposed to publicly post
information on ONC's website about health care providers that have been
determined by OIG to have committed information blocking and
subsequently referred by OIG to an appropriate agency to be subject to
appropriate disincentives, as well about health IT developers of
certified health
[[Page 54666]]
IT and HIEs/HINs and that have been determined by OIG to have committed
information blocking. Finally, the Disincentives Proposed Rule
requested public comment on establishing disincentives for other health
care providers included in the definition of health care provider in 45
CFR 171.102 that are subject to the information blocking regulations,
but were not implicated by the disincentives proposed in the
Disincentives Proposed Rule.
C. General Comments on the Disincentives Proposed Rule
We received a number of general comments on the Disincentives
Proposed Rule. A discussion of those comments and responses can be
found below.
Comments. Several commenters expressed general support for the
proposed disincentives for health care providers who have been found to
have committed information blocking. A few commenters stated that the
disincentives will lead to better patient outcomes, improved
information sharing, increased transparency, a reduction in systemic
inefficiency and waste, and improved accountability and compliance. A
few commenters expressed general support for the establishment of the
disincentives proposed because the disincentives are necessary and
appropriate and would discourage information blocking by health care
providers. Commenters also asserted that the proposed disincentives
would encourage data exchange and enhance interoperability.
Response. We thank the commenters for their support.
Comments. Many commenters recommended that HHS delay implementation
or enforcement of information blocking disincentives against health
care providers. Commenters recommended this delay in order for HHS to
provide education regarding issues such as: what constitutes
information blocking; the investigation process; the application of
disincentives; and information about exceptions. Commenters stated that
a delay was warranted because the information blocking regulations,
including the disincentives discussed in this final rule, are new and
complicated, requirements change frequently, and health care providers
need time to implement information sharing processes and identify best
practices. Commenter recommendations for how long to delay enforcement
following the publication of the final rule ranged from 1 to 2 years.
Response. We disagree with commenters that further delay in
establishing disincentives for health care providers that commit
information blocking is necessary. We note that the information
blocking regulations in the ONC Cures Act Final Rule went into effect
April 5, 2021 (85 FR 70068), and several years will have already passed
between the date when these regulations went into effect for health
care providers and the effective date of this final rule. In addition,
the disincentives CMS has finalized in this final rule are established
under authorities for existing programs with which health care
providers are already familiar. Thus, we do not believe it is necessary
to further delay establishment of disincentives. We refer readers to
section III.C. of this final rule, in which CMS describes how each of
the disincentives it has finalized will be effective upon the effective
date of this final rule.
We also note that section III.B.1. of this final rule states that
OIG will not begin investigating possible information blocking
committed by health care providers until after the effective date of
this rule, and that OIG will exercise its enforcement discretion not to
make any determinations regarding conduct occurring prior to the
effective date of this rule for information blocking disincentives. As
OIG will not make a determination on conduct occurring prior to the
effective date, OIG will not refer any health care providers based on a
determination of conduct occurring prior to the effective date of this
rule for information blocking disincentives. This means that no
disincentives finalized in this final rule will be applied to conduct
occurring before the effective date of this final rule.
We appreciate the recommendations regarding offering educational
opportunities that would be helpful to health care providers and will
consider these recommendations.
Comments. A few commenters requested that HHS set a maximum period
from the date the alleged information blocking complaint was referred,
after which HHS would not impose any disincentives, such as a 6-year
period to align with the time period for imposing CMPs for other
actors. Some commenters expressed concern that the proposed process for
investigating claims of information blocking and referring findings to
appropriate agencies for disincentives could cause a long delay between
the information blocking complaint being filed and the application of a
disincentive.
Response. For the disincentives finalized in section III.C. of this
final rule, CMS did not propose and has not finalized a maximum period
from the date the alleged information blocking complaint was referred,
after which CMS would not impose the disincentives it has finalized.
Because the authorities used to establish disincentives may include
requirements related to timing around the imposition of disincentives,
we believe it is more appropriate to allow appropriate agencies to
establish any such limits instead of setting a uniform limit for any
disincentive established to deter information blocking by health care
providers. We note that for the disincentive policy finalized under the
Shared Savings Program in section III.C.4., CMS will consider relevant
facts and circumstances before imposing a disincentive under the Shared
Savings Program, and CMS has stated that one of the relevant factors
CMS will consider is the time elapsed since a referral of information
blocking has taken place. For the disincentives finalized for the
Medicare Promoting Interoperability Program and the MIPS Promoting
Interoperability performance category in sections III.C.2. and
III.C.3., respectively, CMS has stated that it will impose the
applicable disincentive in the EHR reporting period or performance
period of the calendar year that a referral of a determination of
information blocking is received from OIG. We further recognize that
there may be a delay between the initial submission of an information
blocking claim and the eventual application of a disincentive if OIG
determines that the practices identified in the claim were information
blocking and refers the determination to an appropriate agency.
However, we are unable to estimate the time necessary to complete
investigations of these practices.
As commenters mentioned, section 3022(b)(2)(C) of the PHSA, which
applies to actors subject to the information blocking regulations that
are not health care providers (health IT developers or other entities
offering certified health IT, and HINs/HIEs), requires the imposition
of CMPs to follow the procedures set forth in section 1128A of the
Social Security Act (SSA). Section 1128A(c)(1) requires that an action
for CMPs must be initiated within 6 years from the date of the
occurrence. In the OIG CMP Final Rule, OIG stated that this would be 6
years from the date of the violation (88 FR 42826).
Comments. A few commenters recommended the creation of a
centralized HHS coordinating entity to
[[Page 54667]]
implement and oversee information blocking disincentives, provide a
main point of contact for health care providers to learn about the
process and resolve discrepancies, ensure coordination among agencies,
and minimize confusion and potential errors that could cause burden for
providers. One commenter stated that supplemental rulemaking would be
needed to create this centralized HHS coordinating entity and that HHS
should engage in this supplemental rulemaking before finalizing the
Disincentives Proposed Rule. A few commenters specifically suggested
the creation of a clearinghouse process to ensure disincentives applied
are not duplicative, arbitrary, and unduly punitive.
Response. We appreciate this recommendation. While we did not
propose to create an entity as recommended by the commenters, we may
consider this recommendation in future rulemaking. However, we do not
believe that establishing such an entity is necessary to finalize the
policies in this final rule, as many of these issues are addressed
through existing policies. For instance, regarding coordination between
agencies, we refer readers to the discussion in section III.B.1.b. of
this final rule where we discuss the ways ONC, OCR, and OIG will
consult, refer, and coordinate on information blocking claims as
permitted by the Cures Act (see also, 88 FR 42823 and 42824). We also
refer readers to the information provided about OIG's investigation
process in section III.B.1. of this final rule, which includes a
discussion of how OIG may engage with health care providers as part of
its investigation, as necessary, to understand specific facts and
circumstances related to an information blocking claim. The commenters
did not provide further information about how such an entity would
address issues related to ensuring disincentives are not duplicative,
arbitrary, and unduly punitive.
Comments. A few commenters recommended that ONC allow for
`complaint clearinghouses,' where health care providers or payers can
send their complaints alleging information blocking violations to an
independent, private sector third party who would aggregate those
complaints over time and submit them as a group to HHS to ensure
complaints are unattributed to specific complainants. Commenters
suggested this approach could mitigate concerns over retaliation,
retribution, or harm to business relationships associated with alleging
information blocking violations. A few commenters also recommended ONC,
OIG, and CMS be more transparent in providing specifics to the public
on how complaints will be handled to ensure interested parties have
transparency in knowing the status of their complaints, and when a
final decision can be expected.
Response. We thank commenters for their suggestions. As authorized
under PHSA section 3022(d)(3)(A), ONC has already established a ``a
standardized process for the public to submit reports on claims''
related to information blocking. We refer readers to the discussion of
the complaint process in the ONC Cures Act Final Rule (85 FR 25899 and
25900), as well as the Information Blocking Portal on ONC's website for
more information.\8\ Regarding commenters' concerns around harm
resulting from attribution of complaints to specific organizations, we
note that PHSA section 3022(d)(2) prohibits the National Coordinator
from disclosing ``[a]ny information that is received by the National
Coordinator in connection with a claim or suggestion of possible
information blocking and that could reasonably be expected to
facilitate identification of the source of the information'' except as
may be necessary to carry out the purpose of PHSA section 3022 (PHSA
section 3022(d)(2)(A)). As stated in the ONC Cures Act Final Rule, we
believe the publishing of complaints could lead to the identification
of the source of the information or reasonably facilitate
identification of the source; therefore, we do not intend to make
complaints publicly available (85 FR 25900). While the complaint
process is not required by statute to be established through
rulemaking, we will take commenters' input into consideration as we
continue to receive complaints related to information blocking.
---------------------------------------------------------------------------
\8\ For more information, see: <a href="https://inquiry.healthit.gov/support/plugins/servlet/desk/portal/6">https://inquiry.healthit.gov/support/plugins/servlet/desk/portal/6</a>.
---------------------------------------------------------------------------
Comments. Commenters stated that health care providers are still
unclear about what practices are prohibited under the information
blocking regulations. Commenters also recommended that supplemental
rulemaking or sub-regulatory guidance be provided on certain topics
prior to implementation or enforcement of health care provider
information blocking disincentives, including: further describing
investigative processes and the application of disincentives; the
establishment of an appeals process; and describing how the
disincentives implemented under this final rule interact with existing
quality reporting program rules.
Response. We appreciate commenters' concerns and recognize that
many health care providers are still gaining awareness and
understanding of the information blocking regulations. We encourage
health care providers to review the resources available on ONC's
website to learn more about practices that may be information
blocking.\9\
---------------------------------------------------------------------------
\9\ For more information, see: <a href="https://www.healthit.gov/faqs">https://www.healthit.gov/faqs</a>.
---------------------------------------------------------------------------
We appreciate commenters' recommendations for topics HHS should
consider addressing through notice and comment rulemaking. However, we
note this final rule addresses many of these issues, including: the OIG
investigative process (section III.B.1.), application of disincentives
(section III.B.2.), and appeals processes (section III.B.2.). The
discussion of the disincentives finalized in sections III.C.2. through
III.C.4. does not identify any interactions with quality reporting
program rules. Quality reporting programs are entirely separate
authorities from those under which we proposed appropriate
disincentives (which we have finalized in section III.C. of this rule);
therefore, we are unclear what commenters' concerns are with respect to
information blocking disincentives and quality reporting programs.
The discussion of these issues provides additional information
regarding the policies we have finalized in this rule and further
notice and comment rulemaking on these topics is not necessary before
finalizing these policies, due to the completeness of the policies
described in this final rule.
Comments. A few commenters recommended that before implementing
health care provider information blocking disincentives the agencies
should work to advance EHR adoption and interoperability. Commenters
recommended that HHS further define and clarify interoperability
standards, and recognize that not all health care providers utilize
EHRs.
Response. We do not agree that the need for further advances with
respect to EHR adoption and interoperability should delay establishing
the disincentives for health care providers that have been found to
commit information blocking that we finalize in this rule. While we
recognize that additional progress can be made to improve
interoperability and advance adoption of EHRs, many health care
providers are using electronic health information today and could
engage in practices that are considered information blocking under PHSA
section 3022. Therefore, it is important
[[Page 54668]]
that appropriate disincentives exist to deter information blocking by
those health care providers that are currently using electronic health
information. We note that HHS has pursued activities to advance
interoperability in EHRs and other health IT systems through a variety
of initiatives, including the ONC Health IT Certification Program. For
more information about initiatives to advance interoperability, we
refer readers to resources on ONC's website.\10\
---------------------------------------------------------------------------
\10\ For more information, see: <a href="https://www.healthit.gov/topic/interoperability">https://www.healthit.gov/topic/interoperability</a>.
---------------------------------------------------------------------------
Comments. Several commenters provided recommendations about
specific scenarios that should not be considered information blocking,
including: a delay in the release of sensitive and distressing health
information and test results, such as for severe or complex diagnoses,
to allow for provider review; a delay in the release of information in
the interest of patient safety; a delay in the release of information
if a patient states that they will harm themselves if they receive a
diagnosis from their provider; or instances where a provider attempts
in good faith to comply with an exception or not engage in information
blocking.
Response. We thank commenters for their recommendations regarding
information blocking exceptions, however, we did not propose any
exceptions to information blocking in the Disincentives Proposed Rule
and these issues are out of scope for this final rule. In the ONC Cures
Act Final Rule (85 FR 25820), ONC established exceptions to information
blocking consistent with PHSA section 3022(a)(3), and subsequently made
revisions to these exceptions in the HTI-1 Final Rule (89 FR 1373). We
invite readers to review the information blocking exceptions to better
understand how various scenarios may be addressed by these
exceptions.\11\ We may also consider this input for future rulemaking
related to exceptions to information blocking.
---------------------------------------------------------------------------
\11\ For more information on exceptions to information blocking,
see ONC's website: <a href="https://www.healthit.gov/topic/information-blocking">https://www.healthit.gov/topic/information-blocking</a>.
---------------------------------------------------------------------------
Comments. A few commenters recommended delaying the implementation
or enforcement of provider information blocking disincentives until
issues related to reproductive health data and privacy are resolved. A
few commenters expressed concern that the proposals described in
section III.C. of the Disincentives Proposed Rule could negatively
impact patient-provider relationships, risk patient and provider
criminalization, and lead to patients delaying seeking healthcare due
to reproductive health data and privacy issues. A few commenters
recommended considering the context of the healthcare landscape
following the overturning of the Federal constitutional right to an
abortion and subsequent legislation in certain states to criminalize
people who seek reproductive health care before finalizing the
proposals in section III.C. of the Disincentives Proposed Rule.
Commenters expressed concern that because of the financial impact the
proposed appropriate disincentives may carry, health care providers may
disclose sensitive health information, including reproductive health
information, to the detriment of people seeking reproductive care.
Commenters similarly expressed concern that the Disincentives Proposed
Rule could result in the disclosure of other forms of sensitive health
information, including information related to contraceptive access, in
vitro fertilization (IVF), gender-affirming healthcare, sexually
transmitted infections (STIs), intimate partner violence, and sexual
assault. A few commenters recommended providers be exempt from
information blocking requirements if they do not disclose patient
information to protect patient privacy related to sexual and
reproductive health and to protect the patient or themselves from
criminalization or harassment. The commenter also recommended that a
new ``good faith'' exception to information blocking should be
established under which providers acting in ``good faith'' to withhold
sensitive health information are presumed to be acting reasonably and
in the best interest of their patients. One commenter recommended that
implementation of disincentives should not occur until EHRs can ensure
sensitive health data can be protected, clear concise exceptions are
created, and consent management software is widely available.
Commenters stated that EHR vendors cannot currently meet data
segmentation standards for sensitive health information, such as
reproductive healthcare data. One commenter recommended delaying
implementation for 2 years to allow providers to comply with the
anticipated ``HIPAA Privacy Rule to Support Reproductive Health Care
Privacy'' final rule \12\ and ONC's ``Health Data, Technology, and
Interoperability: Certification Program Updates, Algorithm
Transparency, and Information Sharing'' proposed rule (88 FR
23746).\13\
---------------------------------------------------------------------------
\12\ Subsequent to receiving this comment, the HIPAA Privacy
Rule To Support Reproductive Health Care Privacy final rule (89 FR
32976) appeared in the Federal Register on April 26, 2024.
\13\ The Health Data, Technology, and Interoperability:
Certification Program Updates, Algorithm Transparency, and
Information Sharing final rule (89 FR 1192) appeared in the Federal
Register on January 9, 2024.
---------------------------------------------------------------------------
Response. We acknowledge the concerns commenters may have regarding
the sensitivity of health data relating to reproductive health care and
will take these comments under consideration. We further acknowledge
commenters' concerns that disincentives could lead to health care
providers disclosing sensitive health information, including
reproductive health information, and welcome commenters'
recommendations regarding an exception to information blocking when a
health care provider withholds sensitive information to protect the
patient or themselves from criminalization or harassment. However, we
did not propose exceptions to information blocking in the Disincentives
Proposed Rule and believe that such policies are out of scope for this
final rule. Instead, we will take these comments under consideration
for other rulemaking activities in which we focus on revising and
expanding the exceptions to information blocking.
Section 4004 of the Cures Act, which added section 3022 to the
PHSA, does not amend existing laws governing the confidentiality,
privacy, and security of health information, such as HIPAA, its
implementing regulations at 45 CFR parts 160, and 164, or other
applicable Federal or state laws or regulations. Health care providers
are responsible for ensuring their compliance with applicable laws and
regulations governing confidentiality, privacy, and security of their
patients' health information.
Regarding commenters' statement that implementation of
disincentives should not occur until improvements to technical
approaches to data segmentation are achieved, we agree that this is an
important area for advancement. However, we believe that this work can
continue in parallel with the finalization of this rule and
establishment of information blocking disincentives for health care
providers.
Finally, we acknowledge that health care providers are also focused
on meeting other regulatory provisions. However, we reiterate that the
information blocking regulations in 45 CFR part 171 have been effective
since April 5, 2021, and that this final rule is focused on
establishing disincentives for practices that are inconsistent with
[[Page 54669]]
the existing regulations defining information blocking. It does not
create new affirmative obligations for health care providers.
Comments. One commenter expressed concerns that the changes to the
information blocking regulations have occurred too frequently, thereby
creating burden and confusion for health care providers. One commenter
expressed concern about the impact this new proposed disincentive
structure will have on health care providers, given that they are also
navigating other requirements related to EHI, such as surprise billing,
electronic prescription, and electronic clinical quality measures. The
commenter recommended that CMS remain cognizant of the many regulations
that govern the flow of EHI and the differences in health IT use
between provider types and sites of service.
Response. We appreciate commenters' concerns. We understand that
health care providers are continuing to gain experience and
understanding of the information blocking regulations, and that health
care providers have numerous compliance obligations with respect to
Federal laws and regulations. We will continue to collaborate closely
within the Department to consider other requirements that impact health
care providers and seek to reduce burden.
Comments. One commenter requested we provide lessons learned from
cases of information blocking on the website to help educate actors on
what does and does not qualify as information blocking. One commenter
recommended a nation-wide marketing campaign to educate patients about
information blocking practices and promote awareness of the information
blocking website.
Response. We appreciate the commenters' recommendations and will
take them into consideration as we develop educational materials in the
future. We note that there are resources available on ONC's website
\14\ about information blocking, which can help health care providers
learn about what practices constitute information blocking and how
health care providers can avoid these practices.
---------------------------------------------------------------------------
\14\ For more information, see: <a href="https://www.healthit.gov/topic/information-blocking">https://www.healthit.gov/topic/information-blocking</a>.
---------------------------------------------------------------------------
III. Provisions of the Regulation and Anticipated Approach to
Investigations and Referrals
A. Relevant Statutory Terms and Provisions
In this section, we discuss certain statutory terms and provisions
in PHSA sections 3022(a) and (b) related to the establishment of
appropriate disincentives for health care providers as defined in 45
CFR 171.102. For brevity, we refer to PHSA section 3022(b)(2)(B), which
states that health care providers that OIG has determined to have
committed information blocking ``shall be referred to the appropriate
agency to be subject to appropriate disincentives using authorities
under applicable Federal law, as the Secretary sets forth through
notice and comment rulemaking,'' as the ``disincentives provision''
throughout this section.
1. Appropriate Agency
The disincentives provision states that an individual or entity
that is a health care provider determined by OIG to have committed
information blocking shall be referred to the ``appropriate agency'' to
be subject to appropriate disincentives. In the Disincentives Proposed
Rule, we proposed to define ``appropriate agency'' in 45 CFR 171.102 to
mean a government agency that has established disincentives for health
care providers that OIG determines have committed information blocking
(88 FR 74951). An ``agency'' may be any component of HHS that has
established a disincentive or disincentives on behalf of the Secretary
of HHS, including any of the Staff or Operating Divisions of HHS. For
example, the disincentives finalized in section III.C. of this final
rule are established using authorities held by CMS, which is an
Operating Division of HHS. Under the disincentives finalized in this
final rule, CMS is the ``appropriate agency'' to which OIG will refer a
health care provider to be subject to disincentives.
We invited public comments on our proposed definition of
``appropriate agency.'' The following is a summary of the comments we
received and our responses.
Comments. One commenter agreed that CMS would be the appropriate
agency for OIG referrals for enforcement because of the large
percentage of health care providers participating in the programs
discussed in section III.C. of the Disincentives Proposed Rule and the
fact that CMS administers those programs.
Response. We thank the commenter for their support. We wish to
clarify that an appropriate agency could include any of the Staff or
Operating Divisions of HHS. However, all of the disincentives finalized
in this rule were established using authorities for programs
administered by CMS.
Comments. One commenter contended that the proposed definition of
``appropriate agency'' is very broad and requested that the specific
agencies that may receive a referral and assess provider disincentives
be clarified and listed in the rule.
Response. We appreciate the comment but decline to change the
definition of ``appropriate agency'' to list all of the specific
agencies that may receive a referral and impose disincentives. We note
that, as of the effective date of this final rule, the only agency that
has established disincentives for health care providers is CMS. While
other disincentives could be established under other agencies through
future notice and comment rulemaking, we cannot preemptively identify
the agencies that may establish disincentives at this time. Therefore,
we believe maintaining the broad definition of appropriate agency is
appropriate as it allows for the potential addition of disincentives
established under other agencies in the future.
After consideration of the public comments, we have finalized our
definition of ``appropriate agency'' in 45 CFR 171.102 as proposed to
mean a government agency that has established disincentives for health
care providers that OIG determines have committed information blocking.
2. Authorities Under Applicable Federal Law
In the Disincentives Proposed Rule we proposed to interpret the
phrase ``authorities under applicable Federal law'' in the
disincentives provision to mean that an appropriate agency may only
subject a health care provider to a disincentive established using
authorities that could apply to information blocking by a health care
provider subject to the authority, such as health care providers
participating in a program supported by the authority (88 FR 74951). In
section III.C. of this final rule, CMS identifies the authority under
which each disincentive has been finalized.
The following is a summary of the comments we received and our
responses.
Comments. One commenter expressed concern that the proposed
interpretation of ``authorities under applicable Federal law'' limits
the agency's ability to put in place an effective and fair enforcement
structure for information blocking by limiting the applicable authority
only to those with already existing penalty structures that exist to
serve other policy goals. The commenter recommended that HHS revisit
its interpretation of ``authorities under applicable Federal law'' to
allow appropriate agencies to promulgate specific disincentives for
information blocking conduct that: permit
[[Page 54670]]
consideration of mitigation and aggravating factors; allow for a
broader range of disincentives (including technical assistance and
corrective action plans); and preserve a health care provider's due
process rights.
Response. We appreciate the commenter's recommendations. However,
we note that PHSA section 3022(b)(2)(B) specifies that disincentives
must be established ``using authorities under applicable Federal law.''
As a result, disincentives established by an appropriate agency must be
consistent with the authority under which the appropriate agency
establishes the disincentive through notice and comment rulemaking.
Furthermore, under the definition of ``disincentive'' that we have
finalized in 45 CFR 171.102, a disincentive is imposed for the purposes
of deterring information blocking. By finalizing this definition, we
intend to limit disincentives to only include the conditions
established by an appropriate agency that are intended to have a
deterrent effect on information blocking practices. The disincentives
provision in PHSA section 3022(b)(2)(B) and the definition of
disincentive that we have finalized in 45 CFR 171.102 do not limit an
appropriate agency from proposing, via notice and comment rulemaking,
to establish other programmatic elements mentioned by the commenters,
if such elements are within the scope of the appropriate agency's
authority.
Comments. One commenter stated that the interpretation of
``authorities under applicable Federal law'' described in the
Disincentives Proposed Rule limits HHS to promulgating disincentives
that are duplicative of existing penalty structures that might
otherwise apply to information blocking conduct committed by certain
health care providers. The commenter stated that this may conflict with
the statutory requirement in PHSA section 3022(d)(4). The commenter
stated that Congress' intent with the provision in PHSA section
3022(d)(4) was that HHS, in establishing disincentives, should take all
measures possible to not use existing authorities that could apply to
information blocking by a health care provider. The commenter further
stated that existing authorities under which we proposed to establish
disincentives in the Disincentives Proposed Rule, such as the Medicare
Promoting Interoperability Program as well as the Medicare Shared
Savings Program, exist to serve other policy goals and regulatory
requirements, and disincentives established under these authorities
should not qualify as an appropriate enforcement structure to target
information blocking specifically.
Response. We disagree that the disincentives CMS has finalized in
this final rule conflict with the statutory provision in PHSA section
3022(d)(4). Section 3022(d)(4) of the PHSA requires the Secretary, in
carrying out section 3022 and to the extent possible, to ensure that
information blocking penalties do not duplicate penalty structures that
would otherwise apply with respect to information blocking and the type
of individual or entity involved as of the day before the date of
enactment of the Cures Act. However, the disincentives that CMS has
finalized in section III.C. of this final rule create new policies to
deter information blocking that are based on a referral of a
determination by OIG that a health care provider has committed
information blocking as defined in PHSA section 3022(a).
After consideration of the public comments, we continue to view the
disincentives provision in PHSA section 3022(b)(2)(B) to require that
an appropriate agency may only subject a health care provider to a
disincentive established using authorities that could apply to
information blocking by a health care provider subject to the
authority, such as health care providers participating in a program
supported by the authority.
3. Appropriate Disincentives
We stated in the Disincentives Proposed Rule that the Cures Act
does not specify or provide illustrations for the types of
disincentives that should be established (88 FR 74951). As such, we
proposed to define the term ``disincentive'' in 45 CFR 171.102 to mean
a condition specified in 45 CFR 171.1001(a) that may be imposed by an
appropriate agency on a health care provider that OIG determines has
committed information blocking for the purpose of deterring information
blocking practices. In section III.B.2. of the Disincentives Proposed
Rule, we proposed to identify in 45 CFR 171.1001(a) those disincentives
that have been established pursuant to the statute for the express
purpose of deterring information blocking practices (88 FR 74952 and
74953).
We also noted that the term ``appropriate'' for disincentives is
likewise not defined in PHSA section 3022, nor are illustrations
provided. In the Disincentives Proposed Rule, we stated that a
disincentive for a health care provider that OIG has determined to have
committed information blocking may be any condition, established
through notice and comment rulemaking, that would, in our estimation,
deter information blocking practices among health care providers
subject to the information blocking regulations (88 FR 74951). In
section III.C. of the Disincentives Proposed Rule, CMS described the
potential impact that each proposed disincentive would have on a health
care provider (88 FR 74954 through 74966).
Finally, in the Disincentives Proposed Rule we noted that the
disincentives provision does not limit the number of disincentives that
an appropriate agency can impose on a health care provider (88 FR
74951). Accordingly, we proposed that a health care provider would be
subject to each appropriate disincentive that an agency has established
through notice and comment rulemaking and is applicable to the health
care provider. We stated that imposing cumulative disincentives, where
applicable, would further deter health care providers from engaging in
information blocking.
We invited public comments on our proposals to establish
disincentives in section III.C. of the Disincentives Proposed Rule (88
FR 74954 through 74966). The following is a summary of the comments we
received and our responses on the definition of the term
``disincentive'' and related proposals.
Comments. One commenter agreed that a health care provider should
be subject to appropriate and applicable disincentives established
through notice and comment rulemaking. Some commenters agreed that
subjecting health care providers to cumulative disincentives, where
applicable, may deter providers from engaging in information blocking.
Response. We thank the commenters for their support.
Comments. A few commenters expressed concern that the proposed
definition of ``appropriate disincentives'' is too broad and unclear.
The commenters requested that ONC narrow its definition of
``appropriate disincentives'' so that it is reflective of the
underlying statute's requirement that disincentives be appropriate.
Another commenter expressed concern that the definition does not impose
limits on what may be deemed ``appropriate,'' therefore any
disincentive proposed by an appropriate agency could theoretically meet
this broad standard. Commenters expressed that a disincentive structure
that does not consider the severity of the underlying misconduct cannot
be considered ``appropriate.''
Response. We thank the commenters for their input. We note that we
did not propose to define the term ``appropriate
[[Page 54671]]
disincentives.'' Instead, we proposed to define the term
``disincentive,'' to mean a condition specified in Sec. 171.1001(a)
that may be imposed by an appropriate agency on a health care provider
that OIG determines has committed information blocking for the purpose
of deterring information blocking practices (88 FR 74951). We have
finalized this proposed definition at 45 CFR 171.102 with a
modification to replace the phrase ``may be imposed'' with ``is
imposed'' to clarify that a disincentive is the completed action by an
appropriate agency to impose a condition on a health care provider that
OIG determines has committed information blocking.
Regarding commenter concerns that we did not propose to impose
limits on what may be deemed ``appropriate,'' and that a disincentive
which does not consider the severity of the underlying misconduct
should not be deemed ``appropriate,'' we reiterate that the term
``appropriate'' is not defined in PHSA section 3022, nor are
illustrations provided. We believe that term ``appropriate'' is
capacious and is best read to give the Secretary significant discretion
to craft disincentives using existing authorities. As we noted in the
Disincentives Proposed Rule, the key feature of appropriate
disincentives is that the agency believes that they will deter
information blocking (88 FR 74951). We have carefully considered each
disincentive we have finalized for appropriateness, as it relates to
deterring information blocking; in section III.C.2.-III.C.4., CMS
describes the potential impact of each proposed disincentive on a
health care provider which would result in deterring information
blocking practices.
However, we believe the disincentives finalized in section III.C.
also align with the use of the term ``appropriate'' in PHSA section
3022 by including certain limits on the impact of each disincentive.
For instance, under the Medicare Promoting Interoperability Program and
the MIPS Promoting Interoperability performance category, CMS has
finalized disincentives that affect otherwise applicable payment
adjustments based on a health care provider failing to meet the
requirements of each program by committing information blocking. In
sections III.C.2.c. and III.C.3.c., CMS has finalized that the
disincentive under each program would only be applied for the EHR
reporting period or performance period of the calendar year in which
OIG refers a determination of information blocking to CMS. Barring a
subsequent referral of a determination of information blocking, the
health care provider would be eligible to successfully meet the
program's requirements in the following calendar year's EHR reporting
period or performance period. As discussed in section III.C.4., the
disincentive finalized under the Medicare Shared Savings Program to
deter information blocking through potential denial of approval to
participate in or removal from the Shared Savings Program, limits the
duration of the disincentive to a year to ensure that health care
providers who have committed information blocking and corrected their
actions are not permanently barred from participating in the Shared
Savings Program. By balancing deterrent impact with these limits, CMS
has finalized disincentives consistent with the general direction in
PHSA section 3022 to establish disincentives that are ``appropriate.''
We disagree with the commenter that a disincentive that cannot be
adjusted to reflect the severity of the underlying misconduct cannot be
considered ``appropriate.'' To be sure, the agency imposing an
appropriate disincentive on a health care provider may not have the
flexibility to determine the value of the disincentive for each
individual or entity based on their conduct, as authorized for
developers, networks, and exchanges that engage in information blocking
under PHSA section 3022(b)(2)(A) (through CMPs). But lingering
inflexibility is a function of the statute's authorization only to use
``existing authorities'' to subject health care providers to
disincentives rather than CMPs.
Finally, we did not propose to define disincentive in the manner
commenters have suggested in order to preserve flexibility for agencies
to establish disincentives for information blocking. Since
disincentives must be established using authorities under applicable
Federal law (in accordance with PHSA section 3022(b)(2)(B)), there may
be a limited set of statutory provisions that could be used to
establish disincentives. Thus, we proposed and have finalized a
definition of disincentive that would not unduly limit our ability to
use available authorities to establish disincentives and have not
proposed to further limit disincentives through proposing a definition
for the term ``appropriate.''
Comments. One commenter recommended that ONC revise its proposed
definition of ``appropriate disincentives'' to explicitly incorporate
technical assistance or a corrective action plan. The commenter further
contended that this adjustment would be more consistent with HHS'
enforcement of other regulations, such as the HIPAA Privacy and
Security Rules.
Response. We appreciate the commenter's recommendation. We note
that we did not propose to define the term ``appropriate
disincentives.'' Instead, we proposed to define the term
``disincentive'' to mean a condition specified in Sec. 171.1001(a)
that may be imposed by an appropriate agency on a health care provider
that OIG determines has committed information blocking, for the purpose
of deterring information blocking practices. Activities such as the
provision of technical assistance or the provision of a corrective
action plan may not adequately deter information blocking practices,
and we decline to include such activities in the definition of a
disincentive at this time. We further refer readers to resources on
ONC's website \15\ about information blocking, which can help health
care providers learn about what practices constitute information
blocking and how health care providers can avoid these practices.
---------------------------------------------------------------------------
\15\ For more information, see: <a href="https://www.healthit.gov/topic/information-blocking">https://www.healthit.gov/topic/information-blocking</a>.
---------------------------------------------------------------------------
Comments. Many commenters did not support our proposal for a health
care provider to be subject to each appropriate disincentive
established by an appropriate agency applicable to such health care
provider, without limit to the number of disincentives, and disagreed
that this policy would deter providers from engaging in information
blocking. One commenter contended that unlimited cumulative
disincentives should not be considered appropriate.
Several commenters expressed that subjecting health care providers
to multiple disincentives for the same misconduct, simply based on
their participation in multiple programs rather than the severity of
the conduct, is duplicative, overly punitive, and heightens the risk
for providers who participate in multiple CMS programs. A few
commenters recommended that HHS establish a clear process to reconcile
multiple disincentives and ensure fair and non-duplicative or punitive
enforcement for providers participating in multiple programs. A few
commenters suggested limiting the number of disincentives that could be
applied or clarifying under which program the disincentive would be
applied. A few commenters expressed concern that the allowance of
cumulative disincentives will create confusion and complexity.
Response. We thank commenters for their input. We disagree with
commenters that multiple disincentives will not deter information
blocking, as
[[Page 54672]]
the increased impact on a health care provider of receiving cumulative
disincentives is likely to be a stronger deterrent due to potentially
imposing greater adverse consequences on the health care provider that
commits information blocking. Moreover, health care providers who
participate in multiple programs may be larger than health care
providers who do not participate in multiple programs, or may have a
greater ability to influence health information exchange than other
health care providers, and so may need greater disincentive exposure to
deter information blocking practices.
Finally, we believe that the possibility of receiving cumulative
disincentives will have a greater deterrent effect on health care
providers that are determined to have committed information blocking,
since individual disincentives are likely to have variable impacts
depending on the circumstances of a given health care provider, as
further discussed in section III.C.1. of this final rule. If a health
care provider expects to only be subject to one disincentive, and the
health care provider expects the disincentive to have a small impact,
for instance, through minimal exposure under a certain program, the
value of that disincentive to deter information blocking practices for
that health care provider will be minimized. The availability of
disincentives under more than one authority can mitigate this issue, as
under our policy a health care provider may expect that they could be
subject to cumulative disincentives established under different
authorities, increasing the likelihood that there is an available
disincentive that will have a meaningful deterrent effect for that
specific health care provider.
We also disagree with the commenter that the term ``appropriate''
should be interpreted to prohibit applying multiple disincentives on a
health care provider that has committed information blocking. PHSA
section 3022(b)(2)(B) specifically contemplates that a health care
provider may be subject to ``appropriate disincentives''--plural. The
plain language of the statute therefore suggests that multiple
``disincentives'' would be ``appropriate.''
We further disagree that subjecting a health care provider to
multiple disincentives is unfair and overly punitive. The disincentives
that CMS has finalized in this final rule are established under
authorities which provide for specific requirements for programs
authorized under those authorities. CMS describes in section III.C. how
information blocking committed by a health care provider would conflict
with the requirements under each of the programs through which a
disincentive has been established. Accordingly, we believe it is
reasonable that a health care provider that has acted in a manner
inconsistent with these programs by committing information blocking
could be subject to a disincentive under that authority, regardless of
whether the health care provider has also been subject to a
disincentive established under another authority.
However, we believe it is necessary to provide further
clarification around our proposed policy with respect to cumulative
disincentives. Specifically, we believe that our proposed policy may
not have accounted for scenarios under which an appropriate agency may
choose to exercise discretion when imposing a disincentive. For
example, in section III.C.4. of this final rule, CMS has finalized a
policy under the authority for the Shared Savings Program, which CMS
originally discussed as an alternative policy in the Disincentives
Proposed Rule (88 FR 74966). This finalized policy will permit CMS, as
the appropriate agency, to consider relevant facts and circumstances
when deciding whether to apply a disincentive to an ACO, ACO
participant, or ACO provider/supplier in the Shared Savings Program.
We note that CMS has finalized this alternative policy for the
Medicare Shared Savings Program only, as this policy is consistent with
existing practices under the Shared Savings Program for addressing
program integrity issues among ACOs, ACO participants, or ACO
providers/suppliers. In addition, this policy addresses scenarios
specific to imposing a disincentive under the Shared Savings Program,
for instance, where removal of one entity from participation in an ACO
could result in the ACO not meeting program requirements such as
falling below the 5,000 assigned beneficiary threshold required by 42
CFR 425.110(a)(1), thereby interrupting care coordination benefits of
beneficiaries receiving care from ACO participants and ACO providers/
suppliers that did not commit information blocking. Under the finalized
alternative policy, CMS will consider relevant facts and circumstances
before imposing a disincentive under the Shared Savings Program. The
relevant facts and circumstances include the nature of the health care
provider's information blocking, the health care provider's diligence
in identifying and correcting the problem, the time since the
information blocking occurred, whether the provider was previously
subject to a disincentive in another program, and other factors. We
refer readers to section III.C.4. for a complete discussion of the
alternative policy finalized under the Shared Savings Program. As
discussed in sections III.C.2. and III.C.3. of this final rule, the
Medicare Promoting Interoperability Program and the MIPS Promoting
Interoperability performance category will impose a disincentive on an
applicable health care provider following a referral of an information
blocking determination by OIG.
Thus, we are revising our proposed policy for consistency with the
policies finalized in this rule. Where we stated in the proposed rule
(88 FR 74951) that a health care provider ``would'' be subject to each
appropriate disincentive that an agency has established through notice
and comment rulemaking and is applicable to the health care provider,
in this final rule we clarify that, under the disincentives provision,
a health care provider ``may'' be subject to each appropriate
disincentive that an agency has established through notice and comment
rulemaking and is applicable to the health care provider. Under this
revised policy, we acknowledge that an appropriate agency could
establish a policy that allows for discretion in imposing a
disincentive, consistent with the agency's authority and implementing
regulations.
Finally, we disagree with the commenters that a cumulative
disincentives approach will introduce more confusion and complexity. We
believe this final rule provides clarity about the disincentives
established under each of the relevant programs to ensure health care
providers understand the consequences they may face for committing
information blocking with respect to the requirements of each program.
Comments. A few commenters expressed concern about the negative and
disproportionate impact of potentially imposing cumulative
disincentives on small and less resourced practices. One commenter
recommended considering the relative impact of cumulative disincentives
on the health care provider, such as the size and resources of the
provider.
Response. We appreciate the commenters' concerns about the impact
of cumulative disincentives on small and less resourced practices.
However, we disagree with commenters that we should revise our policy
with respect to cumulative disincentives to be based on the size and
resources of the health care provider subject to the disincentive, as
we believe this policy should be consistent across health care
providers,
[[Page 54673]]
regardless of their size, and that any considerations with respect to
how an appropriate disincentive should impact health care providers
should be addressed by the appropriate agency establishing the
disincentive.
An appropriate agency, in establishing a disincentive and related
policies, could retain or implement policies based on the type of
health care provider subject to the disincentive, including small
practices, consistent with the agency's authority. For instance, CMS
automatically reweights the MIPS Promoting Interoperability performance
category to zero percent of a MIPS eligible clinician's final score if
the MIPS eligible clinician is in a small practice as defined in 42 CFR
414.1305 and does not submit data for the MIPS Promoting
Interoperability performance category for the applicable performance
period (42 CFR 414.1380(c)(2)(i)(C)(9)). In other words, if the MIPS
eligible clinician meets this criterion for automatic reweighting at 42
CFR 414.1380(c)(2)(i)(C)(9), the MIPS eligible clinician is not
required to complete the requirements for earning a score for the
Promoting Interoperability performance category as set forth in 42 CFR
414.1375. In such event, CMS does not assign a score for the MIPS
eligible clinician for the Promoting Interoperability performance
category and redistributes the weight of the performance category
(typically 25 percent of the final score) to the remaining performance
categories on which the MIPS eligible clinician is scored in accordance
with 42 CFR 414.1380(c)(2)(ii). In section III.C. of the proposed rule
and section III.C. of this final rule, CMS has neither proposed nor
finalized any policy that would amend this automatic reweighting policy
at 42 CFR 414.1380(c)(2)(i)(C)(9) for MIPS eligible clinicians in a
small practice if such practice were subject to the disincentive being
finalized as discussed section III.C.3. of this final rule.
After consideration of the public comments, we have finalized our
definition of the term ``disincentive'' in 45 CFR 171.102 as proposed
to mean a condition specified in 45 CFR 171.1001(a) that is imposed by
an appropriate agency on a health care provider that OIG determines has
committed information blocking for the purpose of deterring information
blocking practices. We have also finalized our policy, with
modification, that a health care provider may be subject to each
appropriate disincentive that an agency has established through notice
and comment rulemaking and is applicable to the health care provider.
B. Approach to Determination of Information Blocking and Application of
Disincentives
In this section we provide additional detail about the process by
which a health care provider that has committed information blocking
may be subject to appropriate disincentives for information blocking.
This section begins with a discussion, provided for informational
purposes and not including any final policies, of an OIG investigation
of a claim of information blocking and how OIG intends to refer a
health care provider it determines has committed information blocking
to an appropriate agency. Next, we discuss finalized proposals related
to the application of a disincentive by an appropriate agency. Finally,
we discuss our finalized approach to provide transparency into the
nationwide health IT infrastructure by making information available to
the public about health care providers that have been determined by OIG
to have committed information blocking and have been subject to an
appropriate disincentive for information blocking, and about health IT
developers of certified health IT and HIEs/HINs and that have been
determined by OIG to have committed information blocking.
1. OIG Investigation and Referral
In the Disincentives Proposed Rule, we provided information
regarding OIG's anticipated approach to information blocking
investigations of health care providers (88 FR 74951 and 74952). We
noted that this information was not a regulatory proposal and was
provided for information purposes only. Preamble discussion of
investigation priorities for health care provider information blocking
claims included in the Disincentives Proposed Rule, and restated below,
is not binding on OIG and HHS. It does not impose any legal
restrictions related to OIG's discretion to choose which health care
provider information blocking complaints to investigate. As the
discussion in the Disincentives Proposed Rule was not a regulatory
proposal, we have not included direct responses to comments provided on
this section (III.B.1.). However, to improve public understanding of
how OIG anticipates it will approach information blocking
investigations of health care providers, this section (III.B.1.) of the
preamble provides an informational statement to supplement the
discussion set forth in the Disincentives Proposed Rule.
We clarify here that OIG's investigation will depend on the
specific facts and circumstances presented in the allegation. OIG will
evaluate each allegation based on the facts and circumstances presented
in the allegation. As OIG investigates the allegations, though, the
scope of the investigation may change, and OIG may change the
individual(s) or entity(ies) under investigation depending on the
specific facts and circumstances it has found. Indeed, through
conducting an investigation, OIG will collect evidence which it will
use to evaluate the individual(s) or entity(ies) with potential
information blocking liability and potential information blocking
conduct. The vast bulk of material and relevant evidence (that is,
evidence relating to whether the actor committed information blocking)
will come from the actor whose conduct is at issue.
As part of OIG's investigation, OIG will need to evaluate whether
an individual or entity meets the definition of an actor under ONC's
regulations. OIG has previously stated that it will look to ONC's
regulations and any related guidance in evaluating whether an
individual or entity meets a specific actor definition, and OIG will
continue to do so for health care provider investigations (88 FR
42828). OIG will look to the regulations in effect at the time the
conduct occurred. Based on the definitions ONC has finalized for health
IT developer of certified health IT and HIN/HIE, a health care
provider, as set forth in 45 CFR 171.102, may meet the definition of a
health care provider and one of those definitions as well (88 FR
42829). OIG anticipates being in contact with health care providers as
part of its investigation, as necessary, to understand the specific
facts and circumstances. For example, OIG may need to engage with the
health care provider to understand whether the health care provider is
a HIN/HIE or a health IT developer of certified health IT. And as
mentioned above, much of the evidence gathered by OIG will likely come
from the individual(s) or entity(ties) under investigation.
As part of an investigation, OIG will evaluate whether information
blocking has occurred. OIG has previously stated that it will look to
ONC's regulations and any related guidance in evaluating whether
conduct constitutes information blocking, and OIG will continue to do
so with respect to health care providers (88 FR 42827). OIG will look
to ONC's information blocking regulations in 45 CFR part 171 in effect
at the time the conduct occurred. Through conducting an investigation,
OIG will collect evidence, which it will use to evaluate whether
conduct constitutes information blocking and whether an actor had the
requisite
[[Page 54674]]
intent. As mentioned above, OIG anticipates engaging with health care
providers during this process as it learns the facts and circumstances
of the allegation under investigation.
Regarding the timing of investigations, OIG will not begin
investigating health care providers until after the effective date of
this rule, and will exercise its enforcement discretion not to make any
determinations regarding conduct occurring prior to the effective date
of this rule for information blocking disincentives. As OIG will not
make a determination on conduct occurring prior to the effective date,
OIG will not refer any health care providers based on a determination
of conduct occurring prior to the effective date of this rule for
information blocking disincentives. This means that no disincentives
finalized in this final rule will be applied to conduct occurring
before the effective date of this final rule.
a. Anticipated Priorities
As with other conduct that OIG has authority to investigate, OIG
has discretion to choose which information blocking complaints to
investigate. To maximize efficient use of resources, OIG generally
focuses on selecting cases for investigation that are consistent with
its enforcement priorities and intends to apply that rationale to its
approach for selecting information blocking complaints for
investigation.
For investigations of health care providers, the Disincentives
Proposed Rule stated that OIG expects to use four priorities: (i)
resulted in, are causing, or have the potential to cause patient harm;
(ii) significantly impacted a provider's ability to care for patients;
(iii) were of long duration; and (iv) caused financial loss to Federal
health care programs, or other government or private entities (88 FR
74951). As mentioned in the above section concerning OIG
investigations, OIG's expected priorities are informational only and
are not binding on OIG decision making.
OIG's priorities for health care provider investigations differ
from the priorities set out in the OIG CMP Final Rule, due to the
differences in intent. In the OIG CMP Final Rule, OIG stated that it
would prioritize actors who had actual knowledge, as actual knowledge
is more egregious, when a lower intent is required (that is, when the
standard is ``knows, or should know'') (88 FR 42823). However, under
PHSA section 3022(a), the intent requirement for health care providers
is that the health care provider ``knows'' that a practice is
unreasonable and is likely to interfere with, prevent, or materially
discourage access, exchange, or use of electronic health information.
Because the Cures Act only provides a single intent standard
(``knows''), OIG will not consider actual knowledge as part of its
priorities for health care provider actors.
Consistent with the OIG CMP Final Rule (88 FR 42822), OIG's
enforcement priorities are a tool OIG uses to triage allegations and
allocate resources. OIG provides information about its enforcement
priorities so the public and stakeholders have a better understanding
of how OIG anticipates allocating resources for enforcement. OIG's
enforcement priorities will inform decisions about which information
blocking allegations to pursue, but these priorities are not
dispositive. Each allegation will be assessed to determine whether it
implicates one or more of the enforcement priorities, or otherwise
merits further investigation and potential enforcement action. There is
no specific formula OIG can apply to every allegation that allows OIG
to effectively evaluate and prioritize which claims merit
investigation.
Although OIG's anticipated priorities are framed around individual
allegations, OIG may evaluate allegations and prioritize investigations
based in part on the volume of claims relating to the same (or similar)
practices by the same entity or individual.
b. Coordination With Other Agencies
This section summarizes the discussion in the OIG CMP Final Rule of
the ways ONC, OCR, and OIG will consult, refer, and coordinate on
information blocking claims as permitted by the Cures Act (88 FR
42823).
PHSA section 3022(d)(1) states that the National Coordinator may
serve as a technical consultant to the Inspector General. OIG will
accordingly consult with ONC throughout the investigative process.
Additionally, PHSA section 3022(b)(3)(A) provides the option for OIG to
refer claims of information blocking to OCR when a consultation
regarding the health privacy and security rules promulgated under
section 264(c) of HIPAA will resolve such claims. Depending on the
facts and circumstances of the claim, OIG will exercise this statutory
discretion as appropriate to refer information blocking claims to OCR
for resolution. There is no set of facts or circumstances that will
always be referred to OCR. OIG will work with OCR to determine which
claims should be referred to OCR under the authority provided in PHSA
section 3022(b)(3)(A). It is important to note that while section
3022(b)(3)(A) of the PHSA specifically provides OIG with the authority
to refer information blocking claims to OCR, OIG's statutory authority
to refer to OCR allegations of violations of the HIPAA Privacy,
Security, or Breach Notification Rules \16\ is not solely based on PHSA
section 3022(b)(3)(A). Thus, OIG's authority to refer to OCR such
allegations against health care providers is not limited to claims of
information blocking.
---------------------------------------------------------------------------
\16\ 45 CFR parts 160 and 164, subparts A, C, D, and E.
---------------------------------------------------------------------------
Finally, OIG anticipates coordinating with other HHS agencies to
avoid duplicate penalties as identified in section 3022(d)(4) of the
PHSA. Depending on the facts and circumstances, OIG may also consult or
coordinate with a range of other government agencies, including CMS,
FTC, or others (88 FR 42823 and 42824).
c. Anticipated Approach to Referral
During an investigation of information blocking by a health care
provider, but prior to making a referral, OIG will coordinate with the
appropriate agency to which OIG plans to refer its determination of
information blocking. This coordination will ensure that the
appropriate agency is aware of a potential referral and that OIG
provides the information the agency needs to take appropriate action.
OIG's referral to the appropriate agency will explain its determination
that a health care provider committed information blocking, including
meeting the requirements of the intent element of PHSA section
3022(a)(1)(B)(ii).
We note that PHSA section 3022 authorizes OIG to investigate claims
of information blocking and requires OIG to refer health care providers
to an appropriate agency when it determines a health care provider has
committed information blocking, to be subject to appropriate
disincentives. Once OIG has concluded its investigation and is prepared
to make a referral, it will send information to the appropriate agency
indicating that the referral is made pursuant to the statutory
requirement in PHSA section 3022(b)(2)(B). As part of the referral, OIG
will provide information to explain its determination, which may
include: the dates when OIG has determined the information blocking
violation(s) occurred; analysis to explain how the evidence
demonstrates the health care provider committed information blocking
(for instance, that the health care provider's ``practice'' \17\ meets
each
[[Page 54675]]
element of the information blocking definition); copies of evidence
collected during the investigation (regardless of whether it was
collected by subpoena or voluntarily provided to OIG); copies of
transcripts and video recordings (if applicable) of any witness and
affected party testimony; and copies of documents OIG relied upon to
make its determination that information blocking occurred. OIG may
provide additional information as part of its referral based on
consultation with the appropriate agency, to the extent permitted by
applicable law.
---------------------------------------------------------------------------
\17\ ``Practice,'' as defined in 45 CFR 171.102, means an act or
omission by an actor (health care provider, health IT developer of
certified health IT, health information network or health
information exchange).
---------------------------------------------------------------------------
2. General Provisions for Application of Disincentives
Following an investigation through which OIG determines a health
care provider has committed information blocking, and OIG's referral of
this determination to an appropriate agency, the health care provider
may be subject to disincentives that have been established under
applicable Federal law through notice and comment rulemaking. In this
section, we include general provisions and information related to the
application of disincentives. For information on the specific
disincentives and further discussion about how each disincentive will
be applied, we refer readers to section III.C. of this final rule.
In the Disincentives Proposed Rule, we proposed to add a new
subpart J to 45 CFR part 171, entitled ``Disincentives for Information
Blocking by Health Care Providers'' (88 FR 74952 and 74953). We
proposed in 45 CFR 171.1000 that this subpart sets forth disincentives
that an appropriate agency may impose on a health care provider based
on a determination of information blocking referred to that agency by
OIG, and certain procedures related to those disincentives. We proposed
in 45 CFR 171.1001(a) that health care providers that commit
information blocking would be subject to the following disincentives
from an appropriate agency based on a determination of information
blocking referred by OIG, where applicable. The disincentives proposed
for inclusion in 45 CFR 171.1001(a)(1) through (3) corresponded to the
appropriate disincentives proposed in section III.C. of the
Disincentives Proposed Rule:
<bullet> An eligible hospital or CAH as defined in 42 CFR 495.4 is
not a meaningful EHR user as also defined in that section;
<bullet> A MIPS eligible clinician as defined in 42 CFR 414.1305,
who is also a health care provider as defined in 45 CFR 171.102, is not
a meaningful EHR user for MIPS as also defined in 42 CFR 414.1305; and
<bullet> ACOs who are health care providers as defined in 45 CFR
171.102, ACO participants, and ACO providers/suppliers will be removed
from, or denied approval to participate, in the Medicare Shared Savings
Program as defined in 42 CFR part 425 for at least 1 year.
We noted that in the future, if we propose to establish additional
disincentives, we intend to add such disincentives to the disincentives
listed in 45 CFR 171.1001 (88 FR 74953).
We did not receive any comments on these proposals. However, we
have modified the regulation text in several ways to increase clarity.
First, we have made minor modifications to the language of the proposed
``scope'' section, in 45 CFR 171.1000, to better reflect language used
in this final rule. Second, we have replaced the proposed paragraph (a)
from 45 CFR 171.1001, which was redundant with the proposed ``scope''
section (45 CFR 171.1000), and reorganized the section to clearly
reflect that the disincentives finalized in this final rule, and that a
health care provider may be subject to, were established by CMS (45 CFR
171.1001(a) as finalized). If we finalize additional disincentives in
the future, we will add them to a paragraph under 45 CFR 171.1001
reflecting the appropriate agency that has established the
disincentive.
We have finalized, as proposed, the following disincentives in 45
CFR 171.1001(a)(1)-(3):
<bullet> An eligible hospital or CAH as defined in 42 CFR 495.4 is
not a meaningful EHR user as also defined in that section;
<bullet> A MIPS eligible clinician as defined in 42 CFR 414.1305,
who is also a health care provider as defined in 45 CFR 171.102, is not
a meaningful EHR user for MIPS as also defined in 42 CFR 414.1305; and
<bullet> ACOs who are health care providers as defined in 45 CFR
171.102, ACO participants, and ACO providers/supplies will be removed
from, or denied approval to participate, in the Medicare Shared Savings
Program as defined in 42 CFR part 425 for at least 1 year.
In the Disincentives Proposed Rule, we proposed in 45 CFR
171.1002(a) through (d) that an appropriate agency that imposes a
disincentive or disincentives in Sec. 171.1001(a) would send a notice
(using usual methods of communication for the program or payment
system) to the health care provider subject to the disincentive or
disincentives (88 FR 74953). We proposed that this notice includes:
<bullet> A description of the practice or practices that formed the
basis for the determination of information blocking referred by OIG;
<bullet> The basis for the application of the disincentive or
disincentives being imposed;
<bullet> The effect of each disincentive; and
<bullet> Any other information necessary for a health care provider
to understand how each disincentive will be implemented.
In the Disincentives Proposed Rule we stated that the information
in this notice would be based upon the authority used to establish the
disincentive and policy finalized by the agency establishing the
disincentive (88 FR 74953). For instance, the notice may contain
specific information regarding when a disincentive would be imposed,
which may be contingent on both the authority used to establish the
disincentive and the specific policy under which the disincentive is
established. We noted that, where a health care provider that has been
determined to have committed information blocking is subject to
multiple disincentives established by an appropriate agency, nothing in
this proposal would prevent the appropriate agency from combining these
notices into a single communication.
Comments. One commenter requested clarification regarding whether
the proposal to send a notice to the health care provider subject to
the disincentive implies that all health care providers who have been
identified as alleged information blockers will receive a disincentive.
Response. A health care provider would only be subject to a
disincentive or disincentives and receive the notification described in
this section after a determination has been made by OIG that the health
care provider committed information blocking and OIG has referred that
determination to the appropriate agency, which is CMS for the purposes
of the disincentives finalized in this rule. A health care provider
that is merely alleged to have committed information blocking but has
not been investigated and determined by OIG to have committed
information blocking, would not receive a notification described in
this section.
Comments. One commenter expressed support for the proposed
notification policies and stated that these policies would improve
transparency.
[[Page 54676]]
Response. We thank the commenter for their support.
Comments. A few commenters recommended adding information or a
communications channel so that health care providers who have been
notified of a disincentive can respond to or communicate with OIG and
the agency issuing the disincentive regarding the finding, possible
mitigating circumstances, or establish a process to deter further cases
of information blocking. One commenter observed that this would
increase transparency, avoid patient confusion, and mitigate potential
unnecessary reputational damage. One commenter expressed concern that
the proposed notifications only inform health care providers of a
disincentive after they have been found to have committed information
blocking. This commenter expressed concern that a health care provider
found to have committed information blocking may have additional
practices being investigated or practices that could lead to another
finding of information blocking and that these practices would not be
included in the notification, for example, for them to fix potential
issues. This commenter recommended creating a form notification that
would inform health care providers of the information blocking issues
that have led to the disincentive so they could be fixed.
Response. We appreciate commenters' concerns and wish to clarify
that the notifications proposed in this section would be issued by an
appropriate agency following a referral of a determination of
information blocking by OIG that leads to the imposition of a
disincentive. For discussion of when communication between OIG and a
health care provider about alleged information blocking practices may
occur as part of an investigation (that is, prior to a determination of
information blocking), we refer readers to section III.B.1. of this
final rule.
After consideration of the public comments, we have finalized our
proposal with modification. In the Disincentives Proposed Rule, we
proposed in Sec. 171.1002 that an appropriate agency ``would send a
notice to the health care provider subject to the disincentive or
disincentives.'' However, we believe that the use of the affirmative
``shall,'' which we have finalized in the text of Sec. 171.1002, to
describe the action of an appropriate agency will provide greater
clarity to health care providers and better conveys the intent of the
policy, which is that an appropriate agency will send this notice in
all cases in which disincentives have been imposed on a health care
provider. For the finalized text of Sec. 171.1002, we also revise our
proposed reference to disincentives ``specified in Sec. 171.1001(a)''
to refer to disincentives ``specified in Sec. 171.1001'' instead,
since we have finalized that disincentives may be listed throughout
Sec. 171.1001 and not only under paragraph (a), which specifically
lists disincentives established by CMS. Therefore, we have finalized in
45 CFR 171.1002 that an appropriate agency that imposes a disincentive
or disincentives in Sec. 171.1001 shall send a notice (using usual
methods of communication for the program or payment system) to the
health care provider subject to the disincentive or disincentives. We
have finalized in 45 CFR 171.1002(a) through (d) the elements of the
notice as proposed.
In the Disincentives Proposed Rule, we noted that, following the
application of a disincentive, a health care provider, as defined in 45
CFR 171.102, may have the right to appeal administratively a
disincentive if the authority used to establish the disincentive
provides for such an appeal (88 FR 74953). We noted that PHSA section
3022(b)(2)(C) requires that the imposition of CMPs that apply to health
IT developers of certified health IT, and HINs/HIEs, that have
committed information blocking, follow the procedures of SSA section
1128A, which includes procedures for appeals. However, the Cures Act
did not provide similar instruction regarding administrative appeals of
disincentives for health care providers established under PHSA section
3022(b)(2)(B), and we did not propose a specific administrative appeals
process for health care provider appeals. Therefore, any right to
appeal administratively a disincentive, if available, would be provided
under the authorities used by the Secretary to establish the
disincentive through notice and comment rulemaking.
To provide additional information on these issues to the public, we
summarize and respond to comments on our statement regarding appeals.
Comments. Many commenters expressed concern that there is not a
clearly defined appeals process that would apply across all provider
types. Many of these commenters recommended that HHS adopt a single
appeals process through notice and comment rulemaking. Many commenters
expressed concern that relying on each program's appeals process
creates an unfair structure in which providers do not have equal appeal
rights. Some of these commenters further stated that this could require
some providers to appeal multiple times and that other providers may
not be able to appeal at all. Some commenters stated that the differing
appeals processes could create undue administrative burden, with some
requesting a single or streamlined process. A few commenters
recommended that HHS ensure that any future disincentives for other
provider types also allow for a clear and straightforward appeals
process.
Response. As noted in the Disincentives Proposed Rule, PHSA section
3022(b)(2)(C) requires that the imposition of CMPs that apply to health
IT developers of certified health IT, and HINs/HIEs, that have
committed information blocking, follow the procedures of SSA section
1128A, which includes procedures for administrative appeals (88 FR
74953). The Cures Act did not provide similar instruction regarding
administrative appeals of appropriate disincentives for health care
providers established under PHSA section 3022(b)(2)(B), and we did not
propose and have not finalized any regulations relating to
administrative appeals of the imposition of disincentives. Instead, we
reiterate that any right to appeal administratively a disincentive, if
available, would be provided under the authority used by the Secretary
to establish a disincentive.
Section 3022(b)(2)(B) of the PHSA requires that an OIG
determination be referred to the appropriate agency to ``be subject to
appropriate disincentives using authorities under applicable Federal
law.'' In establishing disincentives using authorities under applicable
Federal law, any administrative appeals processes required under those
existing authorities would also apply to the disincentives established
by an appropriate agency under that authority. We recognize that
reliance on any administrative appeals processes under the authority
used to establish a disincentive may result in variability in the
appeals processes available to health care providers, and that in some
cases, administrative appeals processes may be limited or unavailable.
However, we disagree that establishing a new single process for
administrative appeals would effectively address this variability, as
such a process may conflict with, or duplicate, administrative review
or appeals processes available under existing authorities. Accordingly,
we did not propose such a process in the Disincentives Proposed Rule.
If we establish additional disincentives in the future, we will
evaluate any administrative review or appeals process available under
the
[[Page 54677]]
authority used to establish the disincentive and how a disincentive
would be treated under such a process. However, we decline to limit
future disincentives to those which provide for administrative appeals
processes meeting certain standards, as we must balance these
considerations with our goal of identifying disincentives for all
health care providers subject to the information blocking regulations,
as defined in 45 CFR 171.102.
Comments. Many commenters provided recommendations for elements
that should be incorporated into an appeals process. Commenters
recommended that all health care providers should have the ability to
appeal an information blocking determination by OIG before referral or
application of a disincentive, as well as the ability to appeal the
application and calculation of the disincentive. Other commenters
recommended that HHS include evaluation criteria and definitions of
intent within the appeals process to ensure transparency. A few
commenters suggested that health care providers have the ability to
provide further information that may impact a determination. Some
commenters recommended entities that the commenters asserted would be
appropriate to handle the appeals; the specific entities that
commenters recommended were OIG, CMS, ONC, HHS, an Administrative Law
Judge, or an impartial agency not involved in the finding or
disincentive. Some commenters recommended that HHS ensure that the
entity reviewing appeals have sufficient technical expertise to review
the OIG finding.
Some commenters recommended potential models for the appeals
process, including the process described for ACOs in the Disincentives
Proposed Rule, the process established for health IT developers of
certified health IT, HINs/HIEs, Medicare programs, and the process for
appealing enforcement of the rules promulgated under the Administrative
Simplification provisions of HIPAA. Some commenters recommended that
HHS clearly define the timelines for the appeals process and build
these into the timeline for applying disincentives.
Response. We appreciate commenters' recommendations regarding
elements that should be included in an administrative appeals process,
as well as recommendations regarding existing appeals processes that
would be an appropriate model for review and appeal of disincentives.
However, we did not propose to establish a single process for the
administrative appeal of either a determination by OIG of information
blocking or a disincentive imposed by an appropriate agency based on a
referral of a determination of information blocking. Instead, the
ability of a health care provider subject to a disincentive to appeal
administratively the specific items identified by commenters, including
the information blocking determination by OIG, the determination that
information blocking conduct met the required intent standard, the
application of a disincentive, and the calculation of the disincentive,
would be based on the scope of any administrative appeal rights
provided under the authority used to establish an appropriate
disincentive. Likewise, any timelines for an administrative appeals
process may depend upon timelines already established related to
administrative appeal rights under the authority used to establish a
disincentive.
We appreciate the comment regarding technical expertise in review
of any administrative appeals of a disincentive. While the
responsibility for reviewing an appeal administratively would be
determined by the authority under which the disincentive has been
established and could vary across disincentives, we expect that other
agencies, such as ONC, could potentially provide technical assistance
to an appropriate agency as part of any administrative appeals process
that is available and exercised by a health care provider. We encourage
readers to review the information in section III.C. of this final rule
where CMS provides further discussion of relevant policies related to
administrative appeal, review, and reconsideration under authorities
used to establish disincentives.
Comments. One commenter requested clarification about the impact an
appeal would have on the application of a disincentive and the proposed
posting of information on the ONC website.
Response. Regarding the impact an appeal would have on the
application of a disincentive, we reiterate that any right to appeal
administratively a disincentive, if available, would be provided under
the authorities used by the Secretary to establish the disincentive.
Therefore, the impact of any appeal rights provided for by a specific
authority would depend on that authority. We encourage readers to
review the information in section III.C. of this final rule where CMS
provides further discussion of relevant policies related to appeal,
review, and reconsideration under authorities used to establish
disincentives.
As discussed further in section III.B.3. of this final rule
regarding our proposal for posting of information on ONC's website, we
have finalized our proposal regarding information that will be publicly
posted on ONC's website about actors that have been determined by OIG
to have committed information blocking (specifically, where the actor
is a health care provider, the health care provider's name, business
address (to ensure accurate provider identification), the practice
found to have been information blocking, including when the practice
occurred, the disincentive(s) applied, and where to find additional
information, where available, about the determination of information
blocking that is publicly available via HHS or another part of the U.S.
Government). Further, we have finalized at 45 CFR 171.1101(a)(2) that
the information specified in 45 CFR 171.1101(a)(1) will not be posted
prior to a disincentive being imposed and will not include information
about a disincentive that has not been applied. As noted in section
III.B.3., we have modified our finalized policy to provide further
clarification that posting of information about a disincentive will not
occur until after any available administrative appeals process has been
completed.
Comments. One commenter recommended not applying disincentives in
any program that does not have an appeals process that would allow
health care providers to appeal the finding and the disincentive.
Response. We appreciate the commenter's recommendation. However, we
decline to limit the establishment of disincentives to those
disincentives which can be established using authorities that provide
for administrative appeal rights meeting certain standards. Since we
must establish disincentives using authorities under applicable Federal
law as required under PHSA section 3022(b)(2)(B), we must balance our
interest in providing for administrative appeal rights with a limited
set of available authorities which can be used to establish appropriate
disincentives. We believe that focusing only on those authorities which
provide for a specific set of administrative appeal rights would limit
our ability to meet our goal of establishing appropriate disincentives
for the health care providers subject to the information blocking
regulations, as defined in 45 CFR 171.102.
We did not propose to establish a single administrative appeals
process for health care providers to appeal the application of
disincentives being finalized in this rule. We reiterate that any right
to appeal administratively a disincentive, if available, would be
provided under the authorities used by
[[Page 54678]]
the Secretary to establish the disincentive.
3. Transparency for Information Blocking Determinations, Disincentives,
and Penalties
In the Disincentives Proposed Rule, we stated that it is important
to promote transparency about how and where information blocking is
impacting the nationwide health information technology infrastructure
(88 FR 74953). We further stated that publicly releasing information,
including applicable public settlements, penalties, and disincentives,
about actors that have been determined by OIG to have committed
information blocking can inform the public about how and where
information blocking is occurring within the broader health information
technology infrastructure.
PHSA section 3001(c)(4) (42 U.S.C. 300jj-11(c)(4)) requires that
the National Coordinator maintain an internet website ``to ensure
transparency in promotion of a nationwide health information technology
infrastructure.'' We believe this provision provides the National
Coordinator with the authority to post information on ONC's website if
that information has an impact on issues relating to transparency in
the promotion of a nationwide health information technology
infrastructure. In the Disincentives Proposed Rule, we proposed to add
a new subpart K to 45 CFR part 171, entitled ``Transparency for
Information Blocking Determinations, Disincentives, and Penalties'' (88
FR 74953). As proposed in 45 CFR 171.1100, this subpart would set forth
the information that would be publicly posted on ONC's website about
actors that have been determined by OIG to have committed information
blocking.
We proposed in 45 CFR 171.1101 that, in order to provide insight
into how and where information blocking conduct is impacting the
broader nationwide health information technology infrastructure, ONC
would post on its public website information about actors that have
been determined by OIG to have committed information blocking (88 FR
74953). For health care providers that are subject to a disincentive,
we proposed in 45 CFR 171.1101(a)(1) that the following information
would be posted: health care provider's name, business address (to
ensure accurate provider identification), the practice found to have
been information blocking, the disincentive(s) applied, and where to
find additional information, where available, about the determination
of information blocking that is publicly available via HHS or another
part of the U.S. Government. We proposed in 45 CFR 171.1101(a)(2) that
the information specified in 45 CFR 171.1101(a)(1) would not be posted
prior to a disincentive being imposed and would not include information
about a disincentive that has not been applied.
We recognized that under the authorities used to establish the
disincentives proposed in section III.C. of the Disincentives Proposed
Rule, an appropriate agency may have other obligations related to the
release of information about a participant that is a health care
provider (as defined in 45 CFR 171.102) in programs under that
authority (88 FR 74953 and 74954). For instance, under SSA section
1848(q)(9)(C), MIPS eligible clinicians have a right to review
information about their performance in MIPS prior to having this
information publicly posted on the Compare Tool in accordance with 42
CFR 414.1395. Therefore, we proposed in 45 CFR 171.1101(a)(3) that
posting of the information about health care providers that have been
determined to have committed information blocking and have been subject
to a disincentive would be conducted in accordance with existing rights
to review information that may be associated with a disincentive
specified in 45 CFR 171.1001. For instance, where a health care
provider, as defined in 45 CFR 171.102, has a statutory right to review
performance information, this existing right would be exercised prior
to public posting of information regarding information blocking on the
website described above.
In order to provide insight into how and where information blocking
conduct is impacting the broader nationwide health information
technology infrastructure, we also proposed in 45 CFR 171.1101(b)(1) to
post on ONC's public website information specified in 45 CFR
171.1101(b)(1) about health IT developers of certified health IT and
HINs/HIEs that have been determined by OIG to have committed
information blocking and have either resolved their CMP liability with
OIG or had a CMP imposed by OIG for information blocking under subpart
N of 42 CFR part 1003 (88 FR 74954). To ensure accurate identification
of actors, we proposed in 45 CFR 171.1101(b)(1) to post the type of
actor (for example, HINs/HIEs or health IT developers of certified
health IT) and the actor's legal name, including any alternative or
additional trade name(s) under which the actor operates.
The last information we proposed to post on our public website, for
all actors, would be the two types of information mentioned above
regarding health care providers (88 FR 74954). First, in 45 CFR
171.1101(a)(1)(iii) and (b)(1)(iii), we proposed to post a description
of the practice, as the term is defined in 45 CFR 171.102 and
referenced in 45 CFR 171.103, found to have been information blocking.
In the case of a resolved CMP liability, we would post the practice
alleged to be information blocking. This information will help provide
transparency into how information blocking conduct is impacting the
nationwide health information technology infrastructure, and in
particular, specific practices that are impacting the infrastructure.
Second, in 45 CFR 171.1101(a)(1)(v) and (b)(1)(iv), we proposed to post
where to find additional information about the determination (or
resolution of CMP liability) of information blocking that is publicly
available via HHS or, where applicable, another part of the U.S.
Government. This information could include hyperlinks and other
information, to help interested persons find any additional information
about the determination, settlement, penalty, or disincentive that has
been made publicly available by the U.S. Government. Such publicly
available information would include any summaries or media releases
that may be posted by OIG, or another part of HHS, on their internet
website(s). It could also include additional information that may be
made publicly available about the determination by or other parts of
the U.S. Government. For example, if an actor who has exhausted
applicable administrative appeal procedures and brought action in a
Federal court for review of the decision that has become final, we
could post information on our website about the existence of the court
action and where or how to access information about the determination,
or resulting court action, that has been made publicly available by the
court. This information would provide additional context for how
information blocking conduct is impacting the nationwide health
information technology infrastructure.
In the Disincentives Proposed Rule, we stated that publicly posting
information about actors that have been determined by OIG to have
committed information blocking is important for providing transparency
into how and where information blocking conduct is occurring within and
impacting the broader nationwide health information technology
infrastructure (88 FR 74954). Between April 5, 2021, and September 30,
2023, we received over 800 claims of information blocking through the
[[Page 54679]]
Report Information Blocking Portal.\18\ We publicly post information
about these claims, which we update monthly. Beyond posting the number
of claims, the posted information includes claim counts by type of
claimant and claim counts by potential actor.\19\ While OIG has not
necessarily evaluated whether these claims qualify as information
blocking, this information provides transparency about how participants
in the nationwide health IT infrastructure perceive actions by actors
that are part of the same infrastructure, which is intended to support
the access, exchange, and use of EHI. A natural progression of the
posting of such information is the posting of information about actual
information blocking determinations by OIG, including any disincentives
applied to health care providers. This information can help the public
understand how the information blocking regulations, which seek to
prevent and address practices that unreasonably or unnecessarily
interfere with lawful access, exchange, or use of EHI through the
nationwide health IT infrastructure, are being enforced. It would also
provide clarity regarding how and where actors are engaging in
information blocking practices within the nationwide health IT
infrastructure. Based on this information, participants in the
nationwide health IT infrastructure, as well as members of the general
public, can confirm or dispel perceptions of information blocking
within that infrastructure. Additionally, the combined transparency
into the processes Congress authorized and instructed HHS to implement
(that is, ONC implementing a claims reporting process, disincentives
for applicable actors found to have committed information blocking by
OIG) would foster public confidence in the information blocking
enforcement framework and potentially encourage public participation in
that framework, whether by submitting a claim of information blocking
or participating in an OIG information blocking investigation. We
invited public comments on these proposals, including comments on
whether we should publicly post additional information (and why) about
health care providers, health IT developers of certified health IT, or
HINs/HIEs that have been determined by OIG to have committed
information blocking.
---------------------------------------------------------------------------
\18\ For more information, see: ``Information Blocking Claims:
By the Numbers,'' <a href="https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers">https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers</a>.
\19\ Ibid.
---------------------------------------------------------------------------
The following is a summary of the comments we received and our
responses.
Comments. Many commenters supported the proposal to publicly post
information about actors that have been determined to have committed
information blocking. Several commenters expressed that the proposal
would increase transparency by: providing a better understanding for
the healthcare community, including patients, about information
blocking practices and how they are assessed by HHS; providing greater
visibility to regulators and other health system stakeholders on the
gaps and barriers to information sharing; showing the degree to which
healthcare data is currently being blocked; supporting patients in
making informed decisions about future care; and providing health care
providers with information about health IT developers of certified
health IT and HINs/HIEs. Several commenters expressed that public
posting will further help prevent information blocking violations,
enhance accountability, and drive improvements.
Response. We thank commenters for the support of our proposal to
publicly post information about actors that have been determined to
have committed information blocking and, in the case of health care
providers, have been subject to a disincentive.
Comments. A few commenters supported the proposal, in 45 CFR
171.1101(a)(3), that posting of the information specified in 45 CFR
1101(a)(1) about health care providers that have been determined to
have committed information blocking and have been subject to a
disincentive would be conducted in accordance with existing rights to
review information that may be associated with the applied
disincentive. Other commenters expressed concern over not having the
ability to review what information is posted prior to the information
being publicly posted and recommended being able to review the
information for accuracy before posting. One commenter expressed
concern that health care provider information could be erroneously
posted and the burden to correct any inaccurate postings would fall
upon the provider after the fact.
Response. We thank commenters for their comments. We did not
propose a unique process by which health care providers would be
provided an opportunity to review information prior to posting on ONC's
website. The information that would be posted is basic information
about the health care provider and the information blocking
determination (for example, provider name and address, practice found
to be information blocking, disincentive(s) applied, and where to find
additional information about the determination of information blocking
that is publicly available via HHS or, where applicable, another part
of the U.S. Government) that would be derived and confirmed through the
OIG investigation and referral to CMS. HHS will work with healthcare
providers to correct any clerical errors in these information elements
to be posted prior to the information being posted on ONC's website or
to correct such information after posting.
Further, in the Disincentives Proposed Rule, we recognized that an
appropriate agency may have other program obligations related to
release of information about a participant that is a health care
provider (as defined in 45 CFR 171.102) in such programs (88 FR 74953
and 74954). On this basis, we proposed at 45 CFR 171.1101(a)(3) that
posting of the information about health care providers that have been
determined to have committed information blocking and have been subject
to a disincentive would be conducted in accordance with existing rights
to review information that may be associated with a disincentive
specified in 45 CFR 171.1001. For instance, where a health care
provider, as defined in 45 CFR 171.102, has a statutory right to review
performance information, this existing right would be exercised prior
to public posting of information regarding information blocking on the
website described above. We believe that establishing an additional
review process could potentially conflict with or duplicate these
existing statutory review rights, such as review rights provided under
MIPS at SSA section 1848(q)(9)(C).
Comments. Many comments recommended against public posting until
after a health care provider has completed an appeals process. Many
commenters also recommended not publicly posting information on the ONC
website if the actor(s) are conducting or have completed educational or
corrective steps, including providing a period of one or more years for
actors to complete corrective actions or come into compliance before
public posting.
Response. We did not propose a single administrative appeals
process for information blocking disincentives. Instead, as described
in section III.B.2. of this final rule, any right to appeal
administratively a disincentive, if available, would be provided under
the authorities used by the Secretary to establish a disincentive
through notice
[[Page 54680]]
and comment rulemaking. In proposing at 45 CFR 171.1101(a)(2) that
information will not be posted prior to a disincentive being imposed
and will not include information about a disincentive that has not been
applied, we intended to capture scenarios where a health care provider
may have a right to administratively appeal under the authority used to
establish the disincentive. Our intent was to be consistent with our
proposal for health IT developers of certified health IT and HIN/HIEs
in 45 CFR 171.1101(b)(2), which states that information will not be
posted on ONC's website until a CMP has become final consistent with
the procedures in subpart O of 42 CFR part 1003, which include
procedures for an appeal of a CMP. However, we believe that additional
clarity regarding the issue of appeals highlighted by the commenters is
necessary to ensure the language reflects our intended policy.
Therefore, we have finalized a modification to the provision in 45 CFR
171.1101(a)(2) to add that information will not be posted prior to the
completion of any administrative appeals process pursued by the health
care provider, for example, an appeals process provided for under the
authority used to establish the disincentive.
For health care providers, we note that we did not propose, and
have not finalized, corrective action options for those health care
providers that OIG has determined to have committed information
blocking, including remedial actions, to avoid public posting.
Regarding corrective action plans for health IT developers of certified
health IT or HINs/HIEs, we refer readers to the discussion in the OIG
CMP Final Rule, in which OIG states that it does not anticipate using
alternatives to CMPs such as corrective action plans at the time of the
final rule but may consider such approaches in the future (88 FR
42824).
Comments. One commenter stated that public posting should not be
implemented until all health care providers are equally disincentivized
for information blocking. Another commenter urged ONC to delay the
launch of this website until regulated health care providers and the
relevant Federal agencies have had experience with investigations and
referrals for disincentives and actors have received clearer guidance.
Response. We acknowledge commenters' concerns that this final rule
does not finalize disincentives that apply to all the types of health
care providers included in the health care provider definition at 45
CFR 171.102. However, it is important to begin providing transparency
about those health care providers to whom the disincentive(s) finalized
in this rule are applied in order to begin providing the public with
transparency about how and where information blocking is impacting the
nationwide health information technology infrastructure.
PHSA section 3001(c)(4) requires that the National Coordinator
maintain an internet website ``to ensure transparency in promotion of a
nationwide health information technology infrastructure.'' The website
where the information would appear is not a new website but rather the
current ONC website.\20\ We disagree that posting on the website should
be delayed until regulated health care providers and Federal agencies
have had experience with investigations and referrals for
disincentives. Federal agencies have experience with investigations and
referrals, and health care provider information already appears on
several websites throughout the Federal government. We also provide
data on the ONC website about claims or suggestions of possible
information blocking collected through the Report Information Blocking
Portal \21\ and education resources and guidance on the information
blocking regulations on the ONC website.\22\
---------------------------------------------------------------------------
\20\ For more information, see: <a href="https://www.healthit.gov/">https://www.healthit.gov/</a>.
\21\ For more information, see: <a href="https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers">https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers</a>.
\22\ For more information, see: <a href="https://www.healthit.gov/topic/information-blocking">https://www.healthit.gov/topic/information-blocking</a>.
---------------------------------------------------------------------------
Comments. Some commenters stated that posting health care provider
information is a second penalty on top of the monetary disincentive.
One commenter asked if public posting is considered a disincentive and
recommended it be classified as such. Several commenters expressed
concerns about the proposal to list the names of actors determined to
have engaged in information blocking on ONC's website, stating that
this provision will do little to advance transparency regarding the
impact of information blocking on the nationwide health information
technology infrastructure but will result in public shaming of actors
who have already been penalized for their conduct.
Response. We do not agree with commenters that publicly posting
health care provider names constitutes a disincentive. We also disagree
with commenters that the posting of health care provider names would be
sufficient to deter information blocking, consistent with our
discussion of appropriate disincentives in section III.A.3. of this
final rule. We note that the disincentives CMS proposed and has
finalized in this final rule would each potentially result in a
consequence for a health care provider that has been determined by OIG
to have committed information blocking, which CMS has stated would
deter information blocking practices. The posting of information about
health care providers that have committed blocking and been subject to
a disincentive does not reflect a consequence commensurate with an OIG
determination that the health care provider committed information
blocking or the disincentives CMS has finalized.
Last, we disagree that the posting of health care provider names
following the imposition of a disincentive as part of the information
publicly posted on ONC's website will not advance transparency about
information blocking practices. As we have stated, the purpose of
posting health care provider names is to ensure transparency in
promotion of a nationwide health information technology infrastructure,
as we explain elsewhere in this final rule.
Comments. A few commenters did not support public posting due to
the delay from when the information blocking practice may have occurred
and when the information would be publicly posted, stating that public
posting after an actor has completed corrective action would unfairly
label them information blockers and impose reputational harm after they
have already come into compliance. One commenter specifically expressed
concern with the delay in timing from when the information blocking act
may have occurred to when the information would be publicly posted,
because it may result in current health care providers operating under
an organizational TIN being punished for conduct committed by persons
who no longer operate under that TIN and that this could steer patients
away from these health care providers to the patient's detriment. A few
commenters expressed concern that a group of health care providers
could suffer reputational harm from public posting based on a single
actor, for instance, commenters expressed concerns about potential harm
from public posting information about health care providers who are not
involved in the information blocking or commit inadvertent acts.
Response. We appreciate commenters' concerns regarding the period
of time which may exist between the occurrence of the information
blocking conduct and the posting of information following the
imposition of a disincentive. We note that we did not
[[Page 54681]]
propose to establish a corrective action plan or other process to allow
any health care provider to demonstrate compliance with the information
blocking regulations following a determination by OIG that a practice
is information blocking. We also remind readers that the definition of
information blocking for health care providers requires that the health
care provider ``knows'' that a practice is unreasonable and is likely
to interfere with, prevent, or materially discourage access, exchange,
or use of electronic health information. This means there would not be
posting of unintentional, inadvertent acts of health care providers.
While a health care provider may subsequently pursue efforts to cease
the information blocking practice which resulted in the imposition of a
disincentive, it is still beneficial for the public to be able to
understand how and where information blocking is impacting the
nationwide health information technology infrastructure, including what
aspects of that infrastructure are being impacted by health care
providers.
Regarding health care providers operating under or employed by a
larger entity, we note that under the regulations we have finalized,
the information posted on ONC's website will be specific to the health
care provider that OIG has determined has committed information
blocking and that has been subject to a disincentive. If OIG determines
that a health care provider who is an individual has committed
information blocking and refers that individual to an appropriate
agency, and the individual is subject to a disincentive, ONC would post
only information regarding the individual, not any other entities with
which the individual is associated. If OIG determines that a health
care provider that is an entity, such as a group practice, has
committed information blocking, and the entity is subject to a
disincentive, ONC would post information about the entity.
Comments. Some commenters recommended ONC use certain criteria or
thresholds in order to decide whether to publicly post information
about a health care provider for information blocking. Commenters
recommended that ONC consider the following factors before determining
whether to publicly post information, including: whether there is
frequent, repeat, or significant information blocking, as opposed to
minor conduct undertaken in good faith; whether the public would
benefit from the information; whether the actor has corrected the
information blocking; and time since the information blocking occurred.
Other commenters recommended drawing greater attention to repeat
offenders and actors who continue to perform the same type of
information blocking for an extended period of time over actors who had
a single violation that they remediated quickly.
Response. We appreciate commenters' suggestions, but we did not
propose to utilize criteria to determine whether to publicly post
information about a health care provider and decline to adopt them in
this final rule. We believe it is important to provide transparency
with respect to any determination of information blocking that has
resulted in a health care provider being subject to a disincentive in
order to increase understanding about how and where information
blocking is impacting the nationwide health information technology
infrastructure, including the scope of information blocking practices
that have resulted in disincentives.
Regarding the suggested factor which referenced ``minor conduct
undertaken in good faith,'' we remind readers, as we did in a prior
response, that information blocking has an element of intent. For
health care providers, that intent is that the health care provider
knows that a practice is unreasonable and is likely to interfere with,
prevent, or materially discourage access, exchange, or use of
electronic health information.
We also remind readers that, as discussed in III.B.1.a. of this
final rule, OIG expects to use four priorities to inform decisions
about which information blocking allegations to pursue: (i) resulted
in, are causing, or have the potential to cause patient harm; (ii)
significantly impacted a provider's ability to care for patients; (iii)
were of long duration; and (iv) caused financial loss to Federal health
care programs, or other government or private entities. However, these
priorities are not dispositive. OIG will assess each allegation to
determine whether it implicates one or more of the enforcement
priorities, or otherwise merits further investigation and potential
enforcement action, and OIG may evaluate allegations and prioritize
investigations based in part on the volume of claims relating to the
same (or similar) practices by the same entity or individual.
Comments. A few commenters recommended that only deidentified actor
information be posted, at least initially. One commenter did not
support public posting of obstetrician-gynecologists' names, practice
information and information blocking determination, expressing concern
about criminalization and scrutiny of reproductive healthcare data. One
commenter recommended that rather than listing the details of
information blockers, ONC list all health care providers who are
successfully exchanging information.
Response. We disagree with the commenter that only deidentified
actor information should be publicly posted. The identification of
health care providers that have committed information blocking is
important for the public to be aware of the particular circumstances in
which information blocking is occurring and, therefore, to understand
which aspects of the nationwide health information technology
infrastructure are being impacted. We also disagree with the commenter
that we should not publicly post information regarding obstetrician-
gynecologists. If a health care provider has been determined by OIG to
have committed information blocking and is subject to a disincentive,
we will post information regardless of their specialty or practice. To
promote transparency, we believe it is important to release information
about actors that have been determined by OIG to have committed
information blocking to inform the public about how and where
information blocking is occurring within the broader health information
technology infrastructure. For more information about concerns
regarding withholding electronic health information related to
reproductive health care, we refer readers to a May 13, 2024, blog post
on ONC's website \23\ that explains how the ``HIPAA Privacy Rule to
Support Reproductive Health Care Privacy'' final rule (89 FR 32976),
which appeared in the Federal Register on April 26, 2024, and the
information blocking regulations work together to protect the privacy
of such health information.
---------------------------------------------------------------------------
\23\ See: <a href="https://www.healthit.gov/buzz-blog/information-blocking/supporting-information-privacy-for-patients-now-and-always-four-reminders-of-how-hhs-information-blocking-regulations-recognize-privacy-rules">https://www.healthit.gov/buzz-blog/information-blocking/supporting-information-privacy-for-patients-now-and-always-four-reminders-of-how-hhs-information-blocking-regulations-recognize-privacy-rules</a>.
---------------------------------------------------------------------------
Regarding the recommendation to post information about those health
care providers that are successfully exchanging information, we note
that we did not propose to do so in the Disincentives Proposed Rule and
decline to finalize such a policy in this final rule. We also note that
some of this type of information may be made available through existing
mechanisms. For instance, the Medicare Promoting Interoperability
Program and MIPS Promoting Interoperability performance category
involve public reporting components about health care provider
performance in these programs, which
[[Page 54682]]
can reflect successful performance on measures of health information
exchange that contribute to performance under these programs.
Comments. A few commenters recommended posting the year or
timeframe in which the information blocking violation occurred. Several
commenters recommended establishing a time limit on posting the
information to the website by which to remove health care providers
from the information blocking list on the website.
Response. We thank commenters for the recommendation to include the
timeframe during which the information blocking occurred as part of the
information we are publicly posting. We stated in the Disincentive
Proposed Rule that we sought to help the public understand ``how'' and
``where'' information blocking is occurring within the broader health
information technology infrastructure (88 FR 74953). We agree that
information about when information blocking occurred is a critical
piece of information and that this concept is implicit in our interest
in providing transparency regarding ``how'' and ``where'' information
blocking occurred to support understanding of the scope of information
blocking practices over time that impact the nationwide health
information technology infrastructure. To this point, knowing when
information blocking occurred is part of knowing how it occurred.
Without this information, the public, including other health care
providers, would not know whether a particular practice determined to
be information blocking was a recent occurrence that may have
implications for their own recent or current interactions with the
health care provider that was found to have committed information
blocking; or whether the practice occurred at a time when such health
care providers had no interactions with the health care provider found
to have committed information blocking. Therefore, we agree with
commenters that it would be appropriate to explicitly identify the
timeframe as part of the ``description of the [information blocking]
practice'' that we proposed to include in the information for posting
in 45 CFR 171.1101(a)(1)(iii) for health care providers and 45 CFR
171.1101(b)(1)(iii) (88 FR 74954). Accordingly, we have modified the
language in 45 CFR 171.1101(a)(1)(iii) and 45 CFR 171.1101(b)(1)(iii)
to clarify that the description of the practice includes when the
practice occurred.
We did not propose to put a time limit on how long the information
would be posted on ONC's website, and we are not adopting the
commenter's recommendation. We may consider this recommendation in
future rulemaking.
Comments. One commenter expressed concern that HHS could further
use the posted information to apply additional disincentives or bar a
physician from participation in other programs and that additional
rulemaking would be needed for such uses.
Response. We appreciate the commenter's concern; however, we note
that the imposition of a disincentive would be based on a referral from
OIG of its determination that a health care provider committed
information blocking, rather than the public posting of information on
ONC's website. Moreover, we note that we have finalized that the
disincentives established for health care providers pursuant to PHSA
section 3022(b)(2)(B) are listed in 45 CFR 171.1001. Other actions not
listed in 45 CFR 171.1001 taken by Federal programs based on the
information publicly posted on ONC's website would not be a
disincentive and are outside the scope of this final rule.
Comments. One commenter stated that public posting of information
would lead to unintended consequences such as distrust or an
adversarial relationship between actors subject to the information
blocking regulations and HHS. Another commenter expressed concern that
public posting, combined with the potential for significant
disincentives, would deter information blocking complaints. The
commenter stated that the health data interoperability community is
dependent upon good working relationships between individuals and
organizations that operate in the space and that a complainant may
refrain from submitting information blocking claims in order to
maintain a good relationship with the individual or entity alleged to
have committed information blocking.
Response. We appreciate commenters' input but believe that the
value of publicly posting this information outweighs any concerns about
increasing distrust between health care providers and HHS or between
health care providers and other entities supporting health information
exchange. We note that information blocking negatively impacts health
care providers by limiting access to electronic health information that
may be necessary for effective care delivery and suggest that all
parties committed to increasing the exchange of electronic health
information should support the public availability of information about
how and where information blocking is impacting the nationwide health
information technology infrastructure.
After consideration of the public comments, we have finalized these
proposals with the modifications discussed above.
C. Appropriate Disincentives for Health Care Providers
In the Disincentives Proposed Rule, we proposed to establish a set
of disincentives for health care providers that have committed
information blocking (88 FR 74954 through 74966). We noted that each of
the proposed disincentives would be imposed by CMS following a referral
of a determination of information blocking by OIG. We stated that each
of the disincentives was being proposed using authorities under
applicable Federal law, consistent with PHSA section 3022(b)(2)(B).
1. Background
a. Impacted Health Care Providers
In the Disincentives Proposed Rule, we stated that the proposed
disincentives would apply to a subset of the individuals and entities
meeting the information blocking regulations' definition of health care
provider at 45 CFR 171.102 (88 FR 74954 and 74955). As discussed
hereafter, this rule establishes disincentives for health care
providers (as defined in 45 CFR 171.102) that are also eligible to
participate in certain Federal programs: the Medicare Promoting
Interoperability Program and the MIPS Promoting Interoperability
performance category (previously the EHR Incentive Programs); and the
Medicare Shared Savings Program.
In the Disincentives Proposed Rule, we recognized that the
disincentives proposed would only apply to certain health care
providers and that the information blocking regulations are also
applicable to health care providers that are not eligible to
participate in these programs (88 FR 74955). However, the policies we
have finalized in this rule are a first step that focuses on
authorities that pertain to certain health care providers that furnish
a broad array of healthcare services to large numbers of Medicare
beneficiaries and other patients. We believe optimal deterrence of
information blocking calls for imposing appropriate disincentives on
all health care providers (as defined at 45 CFR 171.102) determined by
OIG to have committed information blocking. In section IV. of this
final rule, we acknowledge public comments received in response to a
request for information on establishing disincentives, using applicable
Federal law, that could be
[[Page 54683]]
imposed on a broader range of health care providers.
b. Impact of Disincentives
In the Disincentives Proposed Rule, we stated that we believe the
proposed disincentives would deter information blocking by health care
providers. However, we recognized that the actual monetary impact
resulting from the application of the disincentives may vary across
health care providers subject to the disincentive (88 FR 74955). For
example, the disincentive proposed in section III.C.3. of the
Disincentives Proposed Rule, for the MIPS Promoting Interoperability
performance category, would result in an adjustment to payments under
Medicare Part B to MIPS eligible clinicians (as defined in 42 CFR
414.1305). This disincentive would reduce to zero the Promoting
Interoperability performance category score of any MIPS eligible
clinician that has been determined by OIG to have committed information
blocking (as defined at 45 CFR 171.103) during the calendar year (CY)
of the referral of a determination from OIG. However, the actual
financial impact experienced by a health care provider because of this
proposed disincentive being applied in MIPS would vary. For example,
Part B payments to the MIPS eligible clinician are subject to a MIPS
payment adjustment factor, which CMS determines based on the MIPS
eligible clinician's final score. We noted that, in determining each
MIPS eligible clinician's final score, CMS considers the assigned
weight of, and the MIPS eligible clinician's performance in, the four
MIPS performance categories, including the Promoting Interoperability
performance category. The MIPS eligible clinician's final score then
determines whether the eligible clinician earns a negative, neutral, or
positive payment adjustment factor that will be applied to the amounts
otherwise paid to the MIPS eligible clinician under Medicare Part B for
covered professional services during the applicable MIPS payment year
(88 FR 74955).
In the interest of addressing this variability, we discussed in the
Disincentives Proposed Rule that we had considered whether we could
propose an alternative approach under which we would tailor the
monetary impact of a disincentive imposed on a health care provider to
the severity of the conduct in which the health care provider engaged
(88 FR 74955). However, we stated that we did not believe it would be
feasible to develop such an approach for the disincentives proposed for
health care providers. We noted that, because disincentives must be
established using authorities under applicable Federal law, the statute
under which a disincentive is being established would need to
specifically authorize or provide sufficient discretion for an
appropriate agency to be able to adjust the monetary impact of the
disincentive to fit the gravity or severity of the information blocking
the health care provider has been determined to have committed. We
noted that, based on our review of potential authorities under which to
establish disincentives, we believed many authorities do not provide
discretion to adjust the monetary impact of a potential disincentive in
this fashion. For instance, in the Disincentives Proposed Rule, CMS
proposed to establish a disincentive through the Medicare Promoting
Interoperability Program utilizing authority in SSA section 1886 (88 FR
74955). Under this authority, CMS, as specified in section
1886(b)(3)(B)(ix)(I) of the SSA, adjusts payments for eligible
hospitals by a fixed proportion, based on whether or not an eligible
hospital (as defined in section 1886(n)(6)(B) of the SSA) is a
meaningful EHR user.
We did not make any proposals in this section of the Disincentives
Proposed Rule; however, we summarize and respond below to general
comments that we received on this discussion.
Comments. Some commenters expressed support for disincentives for
health care providers who have been found to have committed information
blocking. These commenters expressed that these disincentives will lead
to better patient outcomes, improved information sharing, increased
transparency, a reduction in systemic inefficiency and waste, and
improved accountability and compliance. Some commenters agreed that the
three programs described in the Disincentives Proposed Rule (that is,
the Medicare Promoting Interoperability Program for eligible hospitals
and CAHs, the Promoting Interoperability performance category of MIPS,
and the Medicare Shared Savings Program) are appropriate programs under
which to establish disincentives.
Response. We thank commenters for their support of the proposed
disincentives.
Comments. One commenter expressed that the proposed disincentives
impose substantial punishments on health care providers found to have
engaged in information blocking and thereby exceed the regulatory
authorities delegated to HHS agencies by Congress. The commenter stated
that the term ``disincentivize'' means the act of creating a
disincentive or withdrawing a previously existing incentive. However,
the commenter stated that the Disincentives Proposed Rule proposed
penalties that would impose significant punishments on health care
providers found to have engaged in information blocking. The commenter
cited West Virginia v. EPA,\24\ to suggest that the rule ``may'' have
the type of significant impact that requires Congress explicitly to
grant regulatory power to the agency.
---------------------------------------------------------------------------
\24\ 597 U.S. 697 (2022).
---------------------------------------------------------------------------
Response. We disagree that the disincentives that CMS has finalized
in section III.C. of this final rule exceed the regulatory authority
Congress granted to the Secretary in the Cures Act. Section 4004 of the
Cures Act amended the PHSA to create section 3022(b)(2)(B), which
states that a health care provider ``shall be referred to the
appropriate agency to be subject to appropriate disincentives using
authorities under applicable Federal law, as the Secretary sets forth
through notice and comment rulemaking.'' The commenter does not dispute
that each of the disincentives CMS proposed and has finalized in this
section (III.C.) use authorities under applicable Federal law, and we
are adopting each disincentive through this notice-and-comment
rulemaking. The agency is applying existing authorities to individuals
and entities that are already subject to them, to disincentivize one
set of prohibited behaviors. This is not one of the ``extraordinary
cases'' in which the ``history and the breadth of the authority that
the agency has asserted, and the economic and political significance of
that assertion'' merits increased scrutiny.\25\ Even if it did, the
statute has specifically delegated responsibility for establishing
appropriate disincentives to the Secretary of HHS, through notice and
comment rulemaking, and so provides all express authorization that
might be needed.
---------------------------------------------------------------------------
\25\ West Virginia v. EPA, 597 U.S. 697, 721 (2022).
---------------------------------------------------------------------------
The commenter reads the term ``disincentive'' to exclude penalties
or punishment. We agree that we should account for statute's use of the
term ``disincentives.'' We do so by adopting a definition of
``disincentive'' in 45 CFR 171.102 that includes conditions imposed by
an appropriate agency on a health care provider that OIG determines has
committed information blocking, for the purpose of deterring
information blocking. A disincentive could be any condition that would
have a deterrent effect on information blocking, as explained in
section III.A.3. of this final rule. But we reject the commenter's
effort to draw a strict line between deterrence and punishment.
[[Page 54684]]
Those two concepts are often interrelated.\26\
---------------------------------------------------------------------------
\26\ See Exxon Shipping Co. v. Baker, 554 U.S. 471, 493 (2008),
(noting one ``aim'' of ``punishment'' is ``deterrence''); Hudson v.
United States, 522 U.S. 93, 102 (1997), (``[A]ll civil penalties
have some deterrent effect.'').
---------------------------------------------------------------------------
Finally, CMS has finalized disincentives that are designed to deter
information blocking; they are not impermissibly punitive. As discussed
in section III.C.2. of this final rule, a reduction of three quarters
of the annual market basket update deters eligible hospitals from
engaging in information blocking because it would reduce the inpatient
prospective payment system (IPPS) payment that an eligible hospital
could have earned had it met other requirements under the Medicare
Promoting Interoperability Program. For CAHs, receiving 100 percent of
reasonable costs instead of the 101 percent of reasonable costs that a
CAH may have earned for successful participation in the Medicare
Promoting Interoperability Program deters information blocking by CAHs
because it reduces the reimbursement a CAH could have received had it
met other requirements under the Medicare Promoting Interoperability
Program. For MIPS eligible clinicians, the disincentive under the MIPS
Promoting Interoperability performance category deters information
blocking by other MIPS eligible clinicians because a MIPS eligible
clinician who receives a score of zero in the MIPS Promoting
Interoperability performance category under the disincentive cannot
earn a positive MIPS payment adjustment factor that they otherwise
could have earned for their performance in MIPS (88 FR 74960). Finally,
the disincentive CMS has finalized under the Shared Savings Program
deters information blocking by potentially withholding revenue which an
ACO or participant in an ACO might otherwise have earned through
participation in the Shared Savings Program.
Comments. Many commenters expressed concern that the proposed
disincentives will have a differential impact, are variable and
confusing, and are not equitable across programs, circumstances of
individual health care providers, and years. A few commenters expressed
concern that there would be a much greater burden for clinicians in the
Shared Savings Program compared to clinicians who are only subject to
disincentives under the MIPS Promoting Interoperability performance
category, because the monetary disincentive would be much greater for
Shared Savings Program clinicians and would potentially interrupt care
coordination and harm Medicare beneficiaries' care. Others stated that
hospitals could be disproportionately impacted, citing concerns about
the high variability of disincentive amounts that could be imposed on
hospitals based on the market basket increase in a given year and the
proportion of Medicare patients served. Commenters also noted that
hospitals face unique financial and operational challenges, such as
narrow operating margins and minimal reserves. Several commenters
expressed concern that disincentives would lead to a larger burden and
impact for health care providers with a larger proportion of Medicare
claims, patients, and reimbursement. Several commenters expressed
concern that disincentives would vary from year to year based on the
value of the market basket adjustment and certain performance
incentives in a given year. A few commenters specifically expressed
concern that variation in disincentives between referral years could be
based on how quickly OIG processes the case and refers it to CMS for
action.
Response. We understand commenters' concerns about the potential
for the disincentives CMS has finalized in this rule to vary based on
factors related to the circumstances of the health care provider, such
as the amount of Medicare reimbursement received. However, under PHSA
section 3022(b)(2)(B), we must establish disincentives ``using
authorities under applicable Federal law.'' As discussed in section
III.A.2. of this final rule, we may therefore only establish, through
notice and comment rulemaking, a disincentive for health care providers
using an authority Congress has previously granted to an appropriate
agency. Where these authorities result in differential treatment of a
health care provider based on the health care provider's circumstances
or based on changes to the regulations promulgated under that authority
over time, these elements will ultimately impact the value of the
disincentive established under that authority. We acknowledged this
variability, providing a specific example with respect to the MIPS
Promoting Interoperability performance category, in the Disincentives
Proposed Rule (88 FR 74955).
However, we disagree that this variability is a compelling reason
to not establish a certain disincentive. Such variability already
exists as part of these programs. For instance, the monetary impact on
an eligible hospital that is not a meaningful EHR user because it fails
to meet the objectives and measures associated with the Medicare
Promoting Interoperability Program will be higher for an eligible
hospital that receives a greater volume of Medicare payment than an
eligible hospital that receives a lower volume of Medicare payment.
Under section 1886(b)(3)(B)(ix) of the SSA, if an eligible hospital
does not demonstrate that it has met the requirements to be a
meaningful EHR user under section 1886(n)(3)(A), CMS reduces the
eligible hospital's payment by three quarters of the applicable
percentage increase in the market basket update or rate-of-increase for
hospitals. Under SSA 1886(b)(3)(B), the market basket update is a
percentage applied to a hospital's base operating cost, meaning that
the monetary value of the market basket update depends on the
hospitals' base operating cost. This variability is integrated into the
authority Congress established for the program, and Congress has
required the Secretary to establish appropriate disincentives using
authorities under Federal law.
We further disagree with the commenters that ensuring equitable
treatment across programs is necessary to finalize the disincentives we
are establishing in this final rule. The authorities under which we
have finalized disincentives require health care providers to satisfy
certain requirements in order to participate in a program that may
provide incentives or other benefits. In the case of the MIPS Promoting
Interoperability performance category and the Medicare Promoting
Interoperability Program, eligible clinicians, and eligible hospitals
and CAHs, have the opportunity earn positive Medicare payment
adjustments as specified under each authority. Under the Shared Savings
Program, ACOs, ACO providers/suppliers, and participants have the
opportunity to earn additional revenue through participation in an ACO
if the ACO meets the requirements to earn shared savings payments.
As discussed in section III.C., by committing information blocking,
a health care provider is engaging in behavior that conflicts with core
requirements of each of these programs. Health care providers that
participate in CMS programs offering opportunities to receive positive
payment adjustments or additional revenue take on increased
responsibilities associated with these programs. To deter information
blocking, we believe that where a health care provider commits
information blocking, it should not receive these benefits, consistent
with the increased responsibilities that these programs impose. Thus,
as discussed by CMS under each part of this section (III.C.) in which
it has finalized a disincentive,
[[Page 54685]]
each of these disincentives is warranted under the authorities that CMS
has used to establish the disincentive.
Comments. Many commenters expressed concern that the proposed
disincentives could be extreme or harsh for health care providers. A
few commenters expressed concern that the burden of health care
provider information blocking disincentives would be greater for
smaller, safety net, and less resourced health care providers. One
commenter expressed concern that the disincentives would create extra
burden for health care providers or sites of service that lack
experience with electronic health records.
Response. We appreciate commenters' concerns regarding the
potential impact of the proposed disincentives, especially on smaller
health care providers. However, we remind readers that, as noted in
section III.A.3. of this final rule, we believe that disincentives
should have the effect of deterring information blocking practices. We
also remind readers that, in order for a practice by a health care
provider to be considered information blocking under PHSA section
3022(a), the health care provider must know that ``such practice is
unreasonable and is likely to interfere with, prevent, or materially
discourage access, exchange, or use of electronic health information.''
Therefore, we believe that health care providers can avoid the burden
of the finalized disincentives by not engaging in information blocking,
including conduct that the health care provider knows is unreasonable.
Finally, we note that certain authorities used by CMS to finalize
disincentives in this final rule include policies which already reflect
the size of the health care provider, such as payment adjustments which
reflect the volume of payments received by a health care provider under
Medicare.
Regarding the comment that disincentives will create additional
burden for health care providers that lack experience with electronic
health records, we understand that commenters are concerned that a
health care provider could be determined to have committed information
blocking due to a lack of knowledge or expertise about technology tools
used to exchange of electronic health information. However, we wish to
emphasize that for a practice committed by a health care provider to
meet the definition of information blocking, the health care provider
must know that such practice is unreasonable, as discussed above.
Comments. Many commenters expressed concern that the proposed
disincentive structure does not provide flexibility for HHS to apply
disincentives that are reasonable, appropriate, and proportional for
the specific instance of information blocking. Many commenters
recommended that disincentives should be tailored to the severity or
frequency of conduct, or the degree to which the conduct resulted in
patient harm. Other commenters suggested tailoring disincentives based
on other factors such as: whether the health care provider participates
in an HIE; whether a health care provider made a good faith attempt to
not engage in information blocking or comply with an exception; whether
the health care provider made proactive efforts to promote access to
information; state-specific circumstances affecting the health care
provider; and whether the health care provider is engaged in
complicated medical areas, such as reproductive and gender-affirming
care. Commenters expressed that tailoring disincentives in this way
would increase the proposed policy's effectiveness and reduce
disproportionate impact. Some commenters recommended including a
maximum disincentive amount to ensure health care providers are not
unduly penalized. Commenters stated that although the Cures Act
requires the disincentives to be made ``using authorities under
applicable Federal law,'' such language could permit different
disincentive thresholds, scaling, or other ways to establish and
appropriately calibrate financial penalties. A few commenters
recommended that the alternative policy discussed in the Disincentives
Proposed Rule for the Shared Savings Program, in which CMS would review
other facts and circumstances of the case should be applied for all
health care provider information blocking disincentives to allow for
consideration of frequency, severity, and intent and to allow for
remediation.
Response. We acknowledge commenters' recommendations to link the
impact of disincentives to different factors, such as the severity or
scale of the conduct. As discussed in the Disincentives Proposed Rule,
we considered whether we could propose an alternative approach under
which we would tailor the monetary impact of a disincentive imposed on
a health care provider to the severity of the conduct in which the
health care provider engaged (88 FR 74955). However, we stated that,
because disincentives must be established using authorities under
applicable Federal law, the statute under which a disincentive is being
established would need to specifically authorize or provide sufficient
discretion for an appropriate agency to be able to adjust the monetary
impact of the disincentive to fit the gravity or severity of the
information blocking the health care provider has been determined to
have committed. We further noted that, based on our review of potential
authorities under which to establish disincentives, many authorities do
not provide discretion to adjust the monetary impact of a potential
disincentive in this fashion (88 FR 74955). For instance, as discussed
in the Disincentives Proposed Rule, the authority we used in section
1886(b)(3)(B)(ix)(I) of the SSA to establish a disincentive under the
Medicare Promoting Interoperability Program does not allow for such
discretion (88 FR 74955).
In the case of the Shared Savings Program, CMS has finalized a
policy based on an alternative proposal discussed in the Disincentives
Proposed Rule. This policy will allow the Shared Savings Program to
exercise discretion about whether or not to impose a disincentive based
on certain factors, consistent with existing discretion exercised by
the Shared Savings Program when addressing program integrity issues and
issues specific to the effects of imposing a disincentive under the
Shared Savings Program on other individuals and entities that may
participate in an ACO. CMS states in section III.C.4. that these
factors include the time since the information blocking conduct
occurred and whether the ACO or provider/supplier has taken steps to
mitigate this conduct. However, it is important to note that CMS has
finalized this as a policy specific to the Shared Savings Program.
For disincentives established under the Medicare Promoting
Interoperability Program and the MIPS Promoting Interoperability
performance category, which have been established under different
authorities in the SSA, CMS did not propose and has not finalized to
take such factors into consideration before imposing a disincentive.
Comments. Many commenters recommended that steps such as initial
notices or warnings of non-compliance, education, corrective action,
and technical assistance be utilized before applying a disincentive for
a health care provider found to have committed information blocking.
Several commenters recommended that education and technical assistance
should be provided before applying a disincentive for specific health
care providers, including health care providers that disproportionately
serve low-income, minority, underserved, or
[[Page 54686]]
immigrant populations; solo and small practitioners; and other less
resourced health care providers. Some commenters recommended these
steps should be used until health care providers gain experience with
the information blocking requirements or for first time offenders.
Commenters recommended these steps for a number of reasons, including:
the information blocking requirements are new and complex and many
health care providers do not yet fully understand the requirements;
most information blocking is inadvertent and should not be subject to
significant penalties as an initial step; such steps could avoid
potential negative impacts on patient access and Medicare
participation; and corrective steps before a disincentive would better
promote information sharing and prevent future information blocking
violations.
Many commenters expressed that such approaches would be consistent
with other HHS and CMS programs and policies that allow for education
and corrective steps. A few commenters expressed that the terminology
used in PHSA section 3022(b)(2)(B), ``appropriate disincentives,''
allows HHS to establish disincentives other than financial
disincentives. One commenter stated that the programs HHS is proposing
to establish disincentives for already have the authority to provide
health care providers with opportunities for corrective action,
education, and learning periods before imposing disincentives.
Response. We appreciate the commenters' recommendations to provide
for corrective action plans, technical assistance, or other activities
for health care providers that have been determined by OIG to have
committed information blocking. We note that we did not propose, and
have not finalized, that elements such as individualized or corrective
action would be generally available to any health care provider that
OIG has determined to have committed information blocking. Nor did we
propose that activities such as corrective action plans or technical
assistance would be generally available to certain types of health care
providers, such as less-resourced providers or first-time offenders.
Commenters did not identify a separate authority under which to
establish the general availability of a corrective action plan process
for any health care provider that has been determined by OIG to have
committed information blocking. We note that in section III.C.4. of
this final rule, CMS has finalized that, prior to imposing a
disincentive under the Shared Savings Program, it will take into
consideration any evidence that indicated whether conduct that resulted
in a determination of information blocking had been corrected and
appropriate safeguards had been put in place to prevent its
reoccurrence.
Regarding commenters' suggestions to provide education and
technical assistance before applying a disincentive for health care
providers that are smaller, less resourced, or care for specific
populations, we note that any considerations with respect to how an
appropriate disincentive should impact health care providers with
certain attributes would be addressed by the appropriate agency
establishing the disincentive. In section III.A.1, an appropriate
agency, in establishing a disincentive, could retain or implement
policies based on the type of health care provider subject to the
disincentive, including small practices, consistent with the agency's
authority. For instance, in section III.A.3. of this final rule we
discuss existing regulations under the MIPS Promoting Interoperability
performance category which pertain to small practices.
Regarding commenters' suggestion to not impose disincentives on
``first-time offenders'' and instead utilize a corrective action plan,
we note that such a policy ignores both the intent standard for a
finding of information blocking by a health care provider and how any
disincentive may impact a provider's behavior. To engage in information
blocking, a health provider must know that the practice was
unreasonable and that the practice was likely to interfere with,
prevent, or materially discourage the access, exchange, or use of EHI.
This intent standard supports establishing disincentives that would
appropriately address and deter such culpable actions by health care
providers. Further, creating a blanket policy that would give each
health care provider a ``free offense'' could incentivize providers not
to refrain from committing information blocking until they are caught.
We do not believe that is the type of ``disincentive'' required by the
statute.
Comments. A few commenters recommended considering whether a health
care provider has self-disclosed a violation before applying a
disincentive. Several commenters recommended offering a self-disclosure
protocol (SDP).
Response. We appreciate the commenters' recommendations. The Cures
Act did not require, and we did not propose, to establish a self-
disclosure protocol for health care providers who have committed
information blocking. We note that OIG stated in the OIG CMP Final Rule
that it would make a self-disclosure protocol available to those actors
seeking to resolve their information blocking CMP liability (88 FR
42824 and 42825). However, we do not believe a self-disclosure protocol
would be feasible with respect to the finalized disincentives for
health care providers. An appropriate agency's ability to adjust a
disincentive to reflect the severity of the underlying information
blocking conduct is dependent on whether the authority under applicable
Federal law used to establish the disincentives allows for such an
adjustment, consistent with section 3022(b)(2)(B) of the PHSA. For
instance, as discussed previously, we are unable to adjust the amount
of the reduction in the market basket increase, which is the basis for
the disincentive finalized under the Medicare Promoting
Interoperability Program in section III.C.2. of this final rule. With
respect to this finalized disincentive, a self-disclosure protocol
would have limited utility as we would be unable to adjust a health
care provider's ``liability''.
Comments. One commenter requested clarification of whether the
proposed disincentive structure allows CMS to determine whether to
apply a disincentive once it receives a referral from OIG, and if so,
if CMS can determine to which program or programs a disincentive may
apply (for example if a physician works in a hospital).
Response. Under PHSA section 3022(b)(2)(B), as discussed in section
III.A.2. of this final rule, disincentives must be established using
authorities under applicable Federal law, as the Secretary sets forth
through notice and comment rulemaking. As we have finalized in section
III.A., a health care provider who has committed information blocking
and is referred by OIG to an appropriate agency could be subject to
each disincentive established by the appropriate agency that is
applicable to the health care provider. CMS has finalized in the Shared
Savings Program a policy in this final rule under which it will
consider certain factors prior to taking action against an ACO, ACO
participant, or ACO provider/supplier, consistent with existing
processes in the Shared Savings Program. CMS did not propose and has
not finalized a policy to consider additional factors prior to imposing
the disincentives being finalized under the Medicare Promoting
Interoperability Program and the MIPS Promoting Interoperability
performance category.
Comments. Some commenters expressed concern about the unintended
consequences of the proposed
[[Page 54687]]
disincentives. Commenters suggested that the proposed disincentives may
discourage health care providers from participating in the Medicare
programs, including quality and value-based programs. Additionally,
commenters expressed that health care providers who receive a greater
proportion of their payments from Medicare would be exposed to greater
financial risk under the proposed disincentives and would therefore be
disincentivized to treat Medicare beneficiaries. Commenters also stated
that the financial impacts of the proposed disincentives could: cause
hospitals and health systems to disinvest from health IT; reduce the
ability to report existing interoperability measures; increase
financial risk for already precarious health care providers; impact
access to care; increase documentation burden for health care providers
to demonstrate they are not information blocking; reduce physician
morale; and increase burnout. A few commenters recommended that HHS
design disincentives through collaboration with interested parties.
Others recommended that if HHS implements the rule as proposed that it
monitor for potential unintended consequences and impacts of the
disincentives on deterring information blocking.
Response. We appreciate the commenters' concerns, but we disagree
that establishing disincentives will discourage participation in these
programs. Each of the programs for which CMS has finalized
disincentives already requires health care providers to meet certain
requirements, which they have been willing to meet in order to
potentially earn the incentives or benefits associated with these
programs. To avoid the disincentives finalized by CMS in this rule,
health care providers do not need to complete any additional program
requirements beyond refraining from conduct that meets the definition
of information blocking in the information blocking regulations, which
have been effective since April 5, 2021 (85 FR 70066). Due to the lack
of significant administrative burden associated with disincentives, we
do not believe finalizing these policies will lead to significant
numbers of health care providers forgoing the opportunity to earn the
incentives or benefits available from the programs under which we have
finalized disincentives.
Comments. Several commenters recommended other authorities under
which to propose disincentives, or programs that should serve as models
for disincentives. These included: the Administrative Simplification
provisions of HIPAA; CMS Conditions of Coverage and Conditions of
Participation; electronic prescribing of controlled substances (EPCS)
disincentives for certain health care provider types; and CMS' Improper
Payment Measurements Program's Payment Error Rate Measurement's (PERM).
Commenters identified aspects of these programs that they asserted
would be desirable as part of the implementation of disincentives, such
as: education and corrective action plans to allow actors to resolve
liability; non-punitive methods of resolution; a warning and grace
period prior to penalties similar to warnings provided for price
transparency requirements; and a tiered approach depending on the
severity of the violation, which they stated would result in
appropriate disincentives and a more just determination.
Response. We thank commenters for their recommendations and may
consider them for future rulemaking.
We did not make any proposals and have not finalized any policies
in this section.
2. Medicare Promoting Interoperability Program for Eligible Hospitals
and Critical Access Hospitals (CAHs)
a. Background
In the Disincentives Proposed Rule, CMS stated that we intended to
use existing Medicare Promoting Interoperability Program authority
concerning the meaningful use of certified EHR technology (CEHRT) to
impose disincentives on eligible hospitals and CAHs that OIG determines
have committed information blocking (defined in 45 CFR 171.103) and for
which OIG refers a determination to CMS (88 FR 74955). Under section
1886(n)(3)(A) of the SSA, an eligible hospital or CAH \27\ is treated
as a meaningful EHR user for the EHR reporting period for a payment
year if it demonstrates to the satisf
[…truncated; see source link]Indexed from Federal Register on July 1, 2024.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.