HHS’s Information Blocking Disincentives for Health Care Providers Take Effect

At a high-level, the final rule establishes information blocking disincentives only for Medicare-enrolled health care providers participating in the Medicare Promoting Interoperability Program, the Merit-based Incentive Payment System (MIPS) program, and the Medicare Shared Savings Program (MSSP). However, CMS and ONC suggest in the final rule that future rulemaking could usher in additional disincentives for other types of health care providers that are covered actors under the information blocking regulations.

Specifically, the final rule applies penalties in the following instances to providers participating in certain CMS quality programs:

• Medicare Promoting Interoperability Program Reductions for Hospitals: When a hospital is found to have engaged in information blocking, that action prevents designation as a ‘meaningful user’ of health information technology for a reporting period, which would directly reduce incentive payments for achieving separate interoperability goals. A hospital that loses its ‘meaningful user’ designation for the year would be ineligible to for three quarters of the annual market basket increase that would otherwise be earned. Similarly, a Critical Access Hospital that loses its ‘meaningful user’ designation would be subject to a downward payment adjustment from 101% to 100% of reasonable costs.
• Provider MIPS Reductions: Under the MIPS program, MIPS-eligible clinicians are subject to payment adjustments based on their performance in four weighted categories. When a provider (e.g., a physician, practice group, medical clinic, etc.) is found to have engaged in information blocking, one of those categories – promoting interoperability (PI) – will receive a score of zero. When providers submit PI data as a group, the finalized policy would apply disincentives at the group level, meaning that one bad actor who engages in information blocking could adversely impact other physician MIPS Scores. The impact of zeroing out this MIPS category would typically result in a negative MIPS adjustment, but the magnitude of the impact will vary by provider.[1]
• ACO Disincentives Related to the MSSP: Accountable Care Organizations (“ACO”) are networks of providers (ACO Participants) organized to driving down costs through efficient collaboration. Under the final rule, ACOs are now explicitly required, as a condition of participation in the MSSP, to agree not to commit information blocking and to require the same of all participants. Beginning on January 1, 2025, active ACOs could be denied ACO status, for a period of at least one year, for actions that information blocking. This would prevent receipt of MSSP funds. This penalty could also interfere with routine operations for a suspended ACO, because certain regulatory flexibilities that accommodate the flow of funds among ACO Participants are similarly unavailable during the sanction period. CMS will evaluate relevant facts to determine appropriate disincentives, so ACOs should ensure sufficient resources are dedicated to fact-finding and advocacy early in an information blocking investigation. The specific sanctions applicable to ACOs and ACO participants include:
  • Denial of the addition of an ACO participant to an existing ACO participant list;
  • Notifying an ACO that remedial action should be taken against an offending ACO Participant;
  • Denial of an application by an ACO to participate in the MSSP if remedial actions are not completed; and
  • Termination of the ACO participation agreement with CMS.

CMS cannot independently penalize the above-mentioned providers; rather, the penalties only apply if an OIG investigation results in an affirmative finding that a provider committed information blocking and met the relevant knowledge standard by “knowing” that the targeted conduct constituted information blocking. While not binding, OIG provided a roadmap in the proposed rule issued last fall by ONC and CMS around the factors it plans to prioritize when conducting information blocking investigations, including conduct that:

• Risks harm to patients;
• Significantly impacts a provider’s ability to care for patients;
• Continues for a significant duration; and
• Causes financial loss to federal health care programs, or other government or private entities.

Investigations of certain providers for information blocking concerns may already be in progress, although the final rule states that OIG will exercise enforcement discretion not to make determinations about conduct occurring prior to July 31, 2024 (and CMS declined commenters’ request for a delay in the imposition of penalties). Going forward, when OIG makes a finding of information blocking (which requires a finding of intent to interfere with access, exchange, or use of EHI) it will also consider referrals to the appropriate agency to determine the appropriate disincentive(s) as described above. Alongside that referral, the names of the actors responsible for information blocking would be publicly posted on ONC’s website, along with details of the underlying conduct.

Despite many requests from commenters that HHS adopt a uniform appeals process to alleviate concerns additional administrative burdens for certain providers, CMS and ONC declined, explaining that to do so “may conflict with, or duplicate, administrative review or appeals processes available under existing authorities.” Instead, providers subject to this final rule will have to go through the existing appeals process (if any) for their particular Medicare program to challenge the imposition of a disincentive.

CMS and ONC also declined to provide warnings of non-compliance, education, corrective action, and technical assistance prior to imposing a disincentive on a provider. The agencies will, however, consider offering educational opportunities and materials to help providers going forward. For now, health care providers generally (and especially those subject to this final rule) should prepare themselves to mitigate risks relating to the disincentives by evaluating current policies and procedures to ensure compliance. To the extent currently existing practices need improvement, appropriate risk management strategies may include:

• Auditing industry-standard tools commonly used to support interoperability, including functional reviews;
• Conducting secret-shopper style trials of interoperability request/complaint processes, in order to ensure technical issues with standard tools are addressed with the requestor of the EHI in a timely manner;
• Implementation of uniform information sharing policies and procedures across providers who submit MIPS scores as a group;
• Standardizing EHI request procedures among ACO participants, either within a single routinely audited office, or by promulgating standard policies and procedures to participants, along with contractual requirements and assurances.

[1] In the Proposed Rule, HHS simulated the impact of the MIPS disincentives on providers by using MIPS 2021 data. The analysis resulted in an estimated median disincentive of $686 per provider and estimating that 95% of penalties would fall between $38 and $7,184 per provider. For provider groups between 2 and 241 providers, HHS estimated a median group disincentive of $4,116, and that 95% of group penalties would fall between $1,372 and $165,326. See 88 Fed. Reg. 74947, 74960 (Nov. 1, 2023).