On July 3, 2023, the U.S. Department of Health and Human Services (HHS) Office of the Inspector General (OIG) published its final rule implementing the provisions of Title IV of the 21st Century Cures Act (Cures Act) which authorize OIG to investigate claims of health information blocking and impose civil monetary penalties (CMP) for violations. The rule goes into effect September 1, 2023.
A refresher on information blocking
Under the Cures Act, health information blocking is a practice (by act or omission) that is likely to interfere with access, exchange, or use of electronic health information, unless the practice is required by law or covered by an exception, and the individual or entity conducting such practice has the requisite intent. Prohibited information blocking practices may include:
(A) practices that restrict authorized access, exchange, or use under applicable State or Federal law of such information for treatment and other permitted purposes under such applicable law, including transitions between certified health information technologies;
(B) implementing health information technology in nonstandard ways that are likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information; and
(C) implementing health information technology in ways that are likely to—
(i) restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or in transitioning between health information technology systems; or
(ii) lead to fraud, waste, or abuse, or impede innovations and advancements in health information access, exchange, and use, including care delivery enabled by health information technology.
The HHS National Coordinator for Health Information Technology (ONC) has established exceptions for reasonable and necessary activities that won’t be deemed information blocking if all requirements are met. See 45 C.F.R. pt. 171 (2020).
Enforcement and penalties – The new OIG rule
With the information blocking definition and exceptions in place, OIG has finally promulgated an enforcement and CMP rule, see 88 Fed. Reg. 42,841 (July 3, 2023) (to be codified at 42 C.F.R. §§ 1003.1400, 1003.1410, 1003.1420), which takes effect on September 1, 2023. Notably, the provisions apply only to individuals or entities who are:
- Health IT developers of certified health IT;
- Health information networks; or
- Health information exchanges.
This is so because the Cures Act subjects only those categories of actors to CMPs for information blocking violations. Health care providers, on the other hand, are subject to “disincentives,” and OIG is currently developing a separate rule providing for those.
For actors in the three covered categories who are found by OIG to have committed information blocking, OIG may impose a CMP of up to $1,000,000 per violation.
The rule contains no penalty guidelines. Instead, OIG will determine penalty amounts relying on the factors in 42 C.F.R. § 1003.104 that guide the office in exercising its overall CMP authority. In addition, as pertains to information blocking violations, the CMP rule states OIG will consider the nature and extent of the information blocking, as well as the harm resulting from such actions. OIG will consider, as is applicable, how many patients are affected, how many providers are affected, and the number of days the information blocking persisted.
The investigation and enforcement process will be complaint driven. In the preamble to the CMP rule, OIG advises that its enforcement priorities, at least for now, will focus on complaints alleging conduct that (1) resulted in, is causing, or had the potential to cause patient harm; (2) significantly impacted a provider’s ability to care for patients; (3) was of long duration; (4) caused financial loss to Federal health care programs, or other government or private entities; or (5) was performed with actual knowledge. These priorities are not dispositive and do not imply that OIG won’t pursue complaints falling outside the priority areas. It surely will. And OIG expects its priorities to “evolve” as it gains experience investigating information blocking complaints.
In investigating complaints and determining whether a practice constitutes an information blocking violation, OIG says it will consult with and rely heavily on ONC’s subject matter expertise as the entity that promulgated the information blocking regulations and exceptions.
Self-disclosure protocol coming
While not included in the CMP rule, OIG indicates in the preamble to the rule that it intends to create a self-disclosure protocol (SDP) specifically for information blocking that will be similar to its other SDP processes. (See https://oig.hhs.gov/compliance/self-disclosure-info/) No timeline is given for when the information blocking SDP will be added to OIG’s website, but the SDP will provide a framework and mechanism for evaluating, disclosing, coordinating, and resolving (and potentially reducing) CMP liability for conduct that constitutes information blocking.
YES! PLEASE SIGN ME UP TO RECEIVE EMAIL ALERTS FROM OTHER GUNSTER PRACTICE AREAS.
This publication is for general information only. It is not legal advice, and legal counsel should be contacted before any action is taken that might be influenced by this publication.
About Gunster
Gunster, Florida’s law firm for business, provides full-service legal counsel to leading organizations and individuals from its 13 offices statewide. Established in 1925, the firm has expanded, diversified and evolved, but always with a singular focus: Florida and its clients’ stake in it. A magnet for business-savvy attorneys who embrace collaboration for the greatest advantage of clients, Gunster’s growth has not been at the expense of personalized service but because of it. The firm serves clients from its offices in Boca Raton, Fort Lauderdale, Jacksonville, Miami, Naples, Orlando, Palm Beach, Stuart, Tallahassee, Tampa Bayshore, Tampa Downtown, Vero Beach, and its headquarters in West Palm Beach. With more than 280 attorneys and consultants, and over 290 committed professional staff, Gunster is ranked among the National Law Journal’s list of the 500 largest law firms and has been recognized as one of the Top 100 Diverse Law Firms by Law360. More information about its practice areas, offices and insider’s view newsletters is available at www.gunster.com.
