By: Neil C. Brown, Alaina N. Crislip, and J. Parker Zopp
On July 3, 2023, the Office of the Inspector General (OIG) and the U.S. Department of Health and Human Services (HHS) published a final rule implementing information blocking penalties against two types of health care actors—health information networks (HINs)/health information exchanges (HIEs) and developers and offerors of health information technology (HIT).[1] The final rule became effective August 2, 2023, but OIG did not begin enforcing penalties until after September 1, 2023.[2] Notably, OIG will not impose penalties on actors for information blocking violations that occurred before September 1, 2023.[3]
Information Blocking – A Refresher
In May 2020, the Office of the National Coordinator of Health Information Technology (ONC) issued a final rule that defined the scope of information blocking practices as detailed by provisions in the 21st Century Cures Act.[4] The federal regulations define information blocking as a practice that is likely to interfere with the access, exchange, or use of electronic health information (EHI).[5] Three types of actors are relevant in the information blocking sphere: (1) health care providers; (2) HINs/HIEs; and (3) developers and offerors of HIT certified by ONC’s certification program.[6]
It is important to note that whether a practice is a violation varies between actors, as the legal standards surrounding actors’ intent are not created equally. For HINs/HIEs and developers of certified HIT, a violation occurs when the actor knows, or should know, that a practice is considered information blocking. Alternatively, for OIG to consider a health care provider as engaging in information blocking, that health care provider must demonstrate intent to violate the law. The standard there is whether the health care provider knows that such practice is unreasonable and is likely to constitute information blocking.
Penalties Under the Most Recent Final Rule
Critically, this final rule only sets forth penalties for actors that are either: (1) HINs/HIEs; or (2) developers or offerors of ONC-certified HIT. Each violation[7] is tied to the actor’s number of discrete acts in engaging in the violation.[8] This means OIG will essentially punish the enactment of a policy that constitutes information blocking as one violation, and it will additionally punish each “discrete act” of enforcement of that policy as each as separate violations.[9] OIG will vary penalty amounts with respect to each specific violation and will use the aggravating and mitigating factors set forth in 42 C.F.R. § 1003.140.[10] The limit for a violation is $1 million.
On the Horizon – Provider Enforcement
OIG makes clear that this final rule does not address OIG investigations of potential information blocking by health care providers.[11] Instead, HHS/ONC is developing a separate notice of proposed rulemaking to establish disincentives for providers.[12] However, in this August 2023 final rule, OIG does clarify one point with respect to providers. Certain programmatic requirements exist for the Centers for Medicare & Medicaid Services (CMS), which includes the Promoting Interoperability Program. When investigations into alleged information blocking reveal that a health care provider is potentially non-compliant, OIG indicates in the final rule that it may refer the matter to CMS.
Jackson Kelly attorneys are ready to assist you with information blocking guidance and other health care compliance matters.
[1] Grants, Contracts, and Other Agreements: Fraud and Abuse; Information Blocking; Office of Inspector General’s Civil Money Penalty Rules, 88 Fed. Reg. 42820 (July 3, 2023) (to be codified at 42 C.F.R. §§ 1003.1400-.1420) (hereinafter “Civil Money Penalty Rules”).
[2] See id.
[3] See id. at 42827.
[4] 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program, 85 Fed. Reg. 25642 (May 1, 2020) (codified at 45 C.F.R. Part 171).
[5] 45 C.F.R. § 171.103(a)(1).
[6] See 45 C.F.R. § 171.101.
[7] Under the final rule, a violation is a practice (i.e., either an act or an omission) by an actor that constitutes information blocking.
[8] See id.
[9] See id.
[10] See id.
[11] See id. at 42824.
[12] See id.