On June 27, 2023, the Department of Health and Human Services (HHS), Office of Inspector General (OIG), posted a final rule on its website that amends the civil money penalty (CMP) regulations under the Information Blocking Rule. The final rule incorporates new CMP authority and increases the maximum penalties for certain CMP violations. The final rule was published to the Federal Register on July 3, 2023.
What Is the Information Blocking Rule?
The Information Blocking Rule of the 21st Century Cures Act gives patients control over their own health information by giving them access to their health records and explicitly prohibiting “information blocking” by “actors” “likely to interfere with, prevent, or materially discourage access, exchange or use of electronic health information” (EHI) unless required by law. Actors covered by the rule are developers and offerors of health IT (Certified Health IT), a health information exchange (HIE), or a health information network (HIN) in which the entity “knows or should know” that the practice is likely to constitute information blocking. HHS is authorized to identify “reasonable and necessary activities that do not constitute information blocking” by these entities, which may include withholding data that is corrupt or inaccurate and declining to disclose EHI in a way that is prohibited under state or federal privacy laws.
New Changes under the Final Rule
The final rule imposes no new substantive prohibitions. It does, however, implement three important changes to the Information Blocking investigations and penalties. First, it authorizes OIG to investigate information blocking claims and the Secretary of HHS to impose CMPs for any information blocking. Second, it authorizes HHS to impose CMPs, assessments, and exclusions applicable to HHS grants, contracts, and other agreements. Finally, it authorizes OIG to impose CMPs not to exceed $1 million for each violation the OIG determines, following an investigation, constitutes information blocking.
OIG further clarified its enforcement approach to follow the investigation process of (1) receipt of complaint, (2) assessment of complaint, (3) open investigation, (4) fact gathering, (5) discussion with the actor on information-blocking allegations, (6) submission of a demand letter, and (7) appeal by the actor. This insight into OIG’s approach provides guidance that was not readily available prior to the implementation of the final rule.
Who Will Be Affected?
Congress has clarified that healthcare providers are subject to information blocking oversight through “provider disincentives” and are not subject to CMPs. Thus, under the new final rule, CMPs can be assessed only against Certified Health IT, HIEs, and HINs.
What Comes Next?
Anticipating an increase in information blocking complaints, OIG will prioritize the complaints regarding practices that: (1) result, cause, or have the potential to cause patient harm; (2) significantly affect a provider’s ability to care for patients; (3) have lasted a long time; (4) cause financial loss to federal healthcare programs, or other government or private entities; or (5) were performed with actual knowledge.
Enforcement of this final rule will begin September 1, 2023.
[View source.]
