Proposed rule sets Medicare penalties for providers that commit information-blocking infractions

Hospitals and other healthcare providers would face penalties for knowingly engaging in information blocking, with the sanctions affecting their Medicare reimbursement, according to a proposed rule from the U.S. Department of Health and Human Services (HHS) and CMS.

Published at the beginning of November, the rule implements some terms of the 21^st Century Cures Act, the 2016 law that includes a wide range of provisions intended to enhance healthcare research and development and the sharing of electronic health information. The latter area represents an effort to remove barriers that impede patients’ access to their digital health records.

Between April 2021 and October 2023, allegations of information blocking were made against roughly 700 providers, according to a tracker maintained by the Office of the National Coordinator for Health Information Technology (ONC). Such charges have not been subject to penalization — or even to investigation, at least generally — but that would change under the proposed rule.

Proposed penalties

A hospital or critical access hospital (CAH) would be ineligible for designation as a meaningful user of electronic health records (EHRs) if the HHS Office of Inspector General (OIG) determines that the facility engaged in information blocking. HHS can establish such disincentives through statutory authority conferred by the Public Health Service Act and regulations set by the Medicare Promoting Interoperability Program, the department wrote in the rule.

Failing to qualify as an EHR meaningful user would reduce a hospital’s Medicare inpatient payment update by 75% for the year in which the hospital was penalized, while a CAH’s reimbursement would drop from 101% to 100% of reasonable costs. The penalty would apply to the affected hospital two years after the OIG referral to CMS, based on the lag between the reporting period and payment adjustment in the Promoting Interoperability Program. For CAHs, the penalty would apply during the payment adjustment year in which the OIG referral was made.

Other providers also would face consequences for information blocking. Penalties would affect performance scores for clinicians in the Merit-based Incentive Payment System and could render accountable care organizations ineligible for the Medicare Shared Savings Program.

Parties found to have committed an information-blocking transgression also would be listed on ONC’s website.

“We are confident the disincentives included in the proposed rule, if finalized, will further increase the appropriate sharing of electronic health information and establish a framework for potential additional incentives in the future,” HHS Secretary Xavier Becerra said in a news release.

What to avoid

In the context of the Cures Act, information blocking by any healthcare stakeholder is defined as a practice that “is likely to interfere with access, exchange or use of electronic health information.” For a provider, the penalty applies only if OIG determines the organization knows that its action is unreasonable and constitutes unlawful information blocking (standards are stricter for developers of certified health IT and health information exchanges, which face civil monetary penalties of up to $1 million per violation).

“OIG has significant experience and expertise investigating and determining whether to take an enforcement action based on other laws that are intent-based,” the proposed rule states. “This history will inform the use of OIG’s discretion to investigate healthcare providers that OIG believes may have the requisite intent.”

In a previously published final rule, OIG said it would prioritize cases that meet at least one of the following criteria:

• Potentially cause patient harm
• Significantly affect a provider’s ability to care for patients
• Span a long duration
• Cause financial loss to federal healthcare programs or government or private entities

According to Cures Act regulations, information blocking is permitted if the action falls under an established exception (such as those derived from the HIPAA Privacy Rule).

Comments on the proposed rule can be submitted through Jan. 2 at regulations.gov.