Krystyna H. Monticello is a partner of Attorneys at Oscislawski LLC (Oscislawski LLC), a nationally-recognized boutique health law firm based in Princeton, New Jersey, with an office in Scottsdale, Arizona. Every year since 2018, Oscislawski LLC has been included among the ’Best Law Firms’ in healthcare law in Princeton, New Jersey (issued by Best Lawyers®), and for 2024, included among the Best Law Firms both nationally as well as for healthcare law in New Jersey. Krystyna was recently recognized as one of the Best Lawyers® for 2024. Krystyna has extensive experience in the privacy and health information technology space, representing some of the most sophisticated health care clients in New Jersey and nationally. She counsels several leading health information exchange organizations (HIOs), hospitals and health care systems, and works extensively with health care clients in the areas of HIPAA and other privacy and security laws, health information technology and electronic health information exchange, fraud and abuse, state licensing requirements and other federal and state standards governing health care entities and the exchange of health information.
What is the 21st Century Cures Act and who does it impact?
The 21st Century Cures Act (the “Cures Act”) was bi-partisan legislation passed in December 2016 that sought to drive electronic access, exchange and use of health information in an interoperable manner, accelerate medical device, drug and research development, tackle opioid abuse and mental health issues, and achieve other high priority and patient-focused national health goals.[i] Among other chief concerns, the Cures Act addressed the need for improved interoperability between disparate electronic health record technology, health care innovation and improved patient access to their health information to help reduce costs and burdens for health care providers and payers, increase transparency for patients, improve health outcomes, and achieve better coordinated care. Of particular importance, the Cures Act sought to prohibit practices which it deemed to be “information blocking” when conducted by three categories of actors: (i) health care providers (“HCPs”), (ii) health information exchanges (“HIEs”) and health information networks (“HINs”), and (iii) health information technology (“IT”) developers of certified health IT (“Developers of Certified Health IT”).
The HHS Office of the Inspector General (“OIG”) has the authority under the Cures Act to investigate claims of information blocking.[ii] Information blocking is statutorily defined by the Cures Act to mean practices which are likely to interfere with, prevent or materially discourage access, exchange or use of electronic health information[iii] (“EHI”) unless the practice is required by law or permitted through rulemaking established by the Secretary of the US Department of Health and Human Services (“HHS”).[iv] Different types of activities taken by an actor may constitute information blocking under the Cures Act, including:
- Practices that restrict authorized access, exchange or use under applicable state or Federal law of information for treatment and other permitted purposes under such applicable law(s), including transitions between certified health IT;
- Implementing health IT in nonstandard ways that are likely to substantially increase the complexity or burden of accessing, exchanging or using EHI; and
- Implementing health IT in ways that are likely to restrict the access, exchange or use of EHI with respect to exporting complete information sets or in transitioning between health IT systems, or leading to fraud, waste or abuse, or impede innovations and advancements in health information access, exchange and use, including care delivery enabled by health IT.[v]
Within HHS, the Office of the National Coordinator for Health Information Technology (“ONC”) is tasked with implementing the Cures Act’s interoperability, patient access and information blocking provisions through rulemaking, with additional rule-making obligations tasked to the HHS Centers for Medicare & Medicaid Services (“CMS”) and the OIG. Three distinct but related key rules were previously promulgated under the Cures Act: (i) a 2020 CMS final rule implementing interoperability and information sharing provisions for payers and health care providers that participate in the Medicare and Medicaid programs (the “CMS Patient Access and Interoperability Rule”)[vi], and (ii) a 2020 ONC final rule implementing the information blocking provisions and applicable exceptions, interoperability and certification criteria requirements of the Cures Act (the “ONC Cures Act and Information Blocking Rule”);[vii] and (iii) the July 2023 OIG final rule implementing the Cures Act’s penalties for HIEs/HINs and Developers of Certified Health IT that engaged in information blocking (the “ONC CMP Enforcement Rule”)[viii]. Collectively, these rules are referred to hereinafter as the “Information Blocking Rules”.
Do the Cures Act and Information Blocking Rules apply differently depending upon the type of actor?
The Cures Act and Information Blocking Rules apply differently depending upon which category an actor falls into: HIE/HIN, Developer of Certified Health IT or HCP. They establish different intent requirements depending upon the category of actor. For HIEs/HINs and Developers of Certified Health IT, the actor must have known or should have known that a practice is likely to interfere with the access, exchange or use of EHI in order for the actor to have committed information blocking.[ix] For HCPs, the actor must have known that such practice is both unreasonable and likely to interfere with access, exchange or use of EHI.[x] Additionally, the penalties and disincentives which may apply for information blocking conduct are different depending upon the category an actor falls into.
What is the recent disincentives rule proposed by the Department of Health and Human Services under the 21st Century Cures Act?
On November 1, 2023, CMS and ONC published their proposed rule for the establishment of disincentives for HCPs that have committed information blocking (the “Proposed Disincentives Rule”).[xi] This proposed rule seeks to address enforcement action and the application of disincentives against HCPs that commit information blocking. The newly proposed “appropriate disincentives” for HCPs who commit information blocking could now result in hefty financial ramifications for certain HCPs.
What are the disincentives and/or financial penalties applicable to actors engaging in information blocking?
The Cures Act and the ONC CMP Enforcement Rule set forth specific civil monetary penalties for HIEs/HINs and Developers of Certified Health IT who commit information blocking. Where information blocking is conducted by an HIE/HIN or Developer of Certified Health IT, the Cures Act mandates the application of statutory civil monetary penalties up to $1,000,000 per violation.[xii] The Cures Act states: “the provisions of section 1128A of the Social Security Act (other than subsections (a) and (b) of such section) shall apply to a civil money penalty applied under this paragraph in the same manner as such provisions apply to a civil money penalty or proceeding under such section 1128A(a).” Section 1128A sets forth specific procedures, including an appeal process, with regard to such determinations.
However, the Cures Act and ONC CMP Enforcement Rule left to future rulemaking the establishment of “appropriate disincentives” for HCPs who commit information blocking, requiring the OIG to refer such individuals or entities to “the appropriate agency to be subject to appropriate disincentives using authorities under applicable Federal law” as set forth through HHS rulemaking.[xiii]
Under the Proposed Disincentives Rule, disincentives and financial repercussions for HCPs who commit information blocking would be established based on whether the HCP participates in certain federal incentive programs. Therefore, the Proposed Disincentives Rule would only apply disincentives to HCPs participating in: (i) a Medicare Shared Savings Program (“MSSP”), (ii) the Medicare Promoting Interoperability Program or (iii) the Quality Payment Program. HCPs that do not participate in any of these federal incentive programs would not be subject to disincentives at this time if they committed information blocking.
Each federal incentive program establishes different requirements tied to payment adjustments/shared savings which would be affected if an HCP were found to have committed information blocking. HCPs participating in a MSSP would be banned or rejected from participation for at least one year. For HCPs participating in the Medicare Promoting Interoperability Program, they would not be “meaningful users” of certified electronic health technology and would be ineligible for payment increases/subject to payment decreases under such program. HCPs participating in the Quality Payment Program would receive a score of zero for the Promoting Interoperability category requirements under such program, not receive positive payment adjustments and likely receive negative payment adjustments.
If I do not participate in the Medicare Shared Savings Program, Promoting Interoperability Program or Quality Payment Program, do I need to be concerned about disincentives, financial penalties or the Cures Act?
All health care providers that meet the definition of an HCP actor[xiv] under the Cures Act remain responsible for complying with applicable provisions of the Cures Act and the Information Blocking Rules notwithstanding their lack of participation in any of the federal incentive programs which the proposed disincentives would be applicable to. The ONC Cures Act and Information Blocking Rule remains fully in effect for Health Care Providers as of October 6, 2022, with certain provisions in effect since April 1, 2022. Although OIG has expressed its intent to exercise enforcement discretion until applicable enforcement rules are finalized with respect to HCPs, compliance is still required with the Cures Act and Information Blocking Rules. In the Proposed Disincentives Rule, ONC and CMS have also requested public feedback on additional disincentives which may be applied to HCPs not covered by its current proposed disincentives with the intent to engage in future rulemaking to address these gaps.
Does the Cures Act affect how Health Care Providers and other actors may charge for releasing patient medical records electronically?
The information blocking requirements affect the way an actor may charge for copies of or transmitting EHI. Any fees that are likely to interfere with the access, exchange, or use of EHI can implicate information blocking. For example, it could be information blocking if an HCP charged a patient a fee to access their EHI electronically through an online patient records portal or to transmit EHI from the HCP’s electronic medical record through an application programming interface (“API”) of the patient’s choice. It could also be information blocking if an HCP charged fees for electronic copies of or access to EHI without a reasonable cost-basis or in a discriminatory manner.
The Proposed Disincentives Rule raises more concerns than it sheds light on the proposed disincentives, what are these concerns and who do they impact?
Because there are many different types of facilities and clinicians which are either not eligible to participate in or which do not participate in the federal incentive programs identified under the Proposed Disincentives Rule, many HCPs would not be subject to any proposed disincentives at this time, even though such HCPs would be prohibited from engaging in information blocking under the Cures Act. First, there are Medicare volume threshold and other eligibility requirements for each federal incentive program that may not be met by a provider. Second, there are a number of hardship exceptions or flexibilities available to providers which may exempt them entirely or from certain requirements under a particular federal incentive program to which the proposed disincentives would apply. Additional rulemaking in the future would be warranted to address these categories of providers not subject to the proposed disincentives.
Some of the concerns raised by the Proposed Disincentives Rule include:
- How will the OIG determine an HCP has engaged in information-blocking resulting in referral for proposed disincentives, and will there be opportunities for HCPs to appeal OIG determinations before they are referred for disincentives?
- What disincentives will be applied to HCPs that do not participate in one of the identified federal programs?
- Disparity in the financial disincentives applicable to HCPs, which would be applied regardless of the severity or nature of the offense. For example, HHS noted the median disincentive amount of $394,353 and a 95 percent range of $30,406 to $2,430,766 across eligible hospitals, with a higher impact to hospitals with greater base inpatient prospective payment system payments.
- Treatment of HCPs with multiple ‘offenses’ over several years in the same manner as a provider with only one offense (no apparent additional disincentives if the OIG investigates all offenses within the same referral).
- How will HCPs who also meet the definition of an HIE/HIN will be investigated and assessed? HHS expressly references that HCPs that meet these dual actor definitions may be subject to the Cures Act civil monetary penalties as an HIE/HIN; however, the OIG has previously expressed that it would coordinate with other agencies to avoid duplication of penalties.
- No disincentives for HCPs that do not fall under one of the existing quality incentive programs. The Cures Act requires the disincentives be established using “authorities under applicable federal law” which HHS would propose to mean only a government agency that has established disincentives for HCPs that OIG determines have committed information blocking could subject a HCP to disincentives using authorities that could apply to information blocking by a HCP subject to the authority, such as HCPs participating in a program supported by the authority.
What should healthcare providers now be doing before the Final Rule is published by HHS regarding compliance with the Cures Act information blocking requirements?
HHS is accepting public comment and feedback on its proposed disincentives until January 2, 2024. HCPs who would be affected by the Proposed Disincentives Rule are encouraged to submit their comments and concerns about the impact of the proposed disincentives. A common misconception is that Developers of Certified Health IT and HIEs/HINs have primary responsibility for compliance with the Information Blocking Rules. While it is true that these actors have their own direct compliance obligations, HCPs remain independently responsible for and may be held accountable for their own practices which result in information blocking. Although the good news is that enforcement will be limited for HCPs in the interim, HCPs should take this time to re-familiarize themselves with the Information Blocking Rules and evaluate their current practices which could directly or indirectly affect access to, exchange or use of EHI, such as medical record access, fee schedules, and security practices, as well as their participation in federal incentive programs affected by the proposed disincentives.
[i] 21st Century Cures Act, P.L. 114-225 (December 13, 2016).
[ii] 42 U.S.C. § 300jj-52(b).
[iii] Electronic health information has such definition set forth in 42 U.S.C. § 300jj(4) and 42 U.S. Code § 1320d(4).
[iv] 42 U.S.C. 300jj–52(a). Notably, subsequent rulemaking did not retain “prevent or materially discourage”. See 45 C.F.R. 171.103.
[v] 42 U.S.C. 300jj–52(a)(2).
[vi] Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Interoperability and Patient Access for Medicare Advantage Organization and Medicaid Managed Care Plans, State Medicaid Agencies, CHIP Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally- Facilitated Exchanges, and Health Care Providers, 85 Fed. Reg. 25510 (May 1, 2020).
[vii] 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program, 85 Fed. Reg. 25642 (May 1, 2020).
[viii] Grants, Contracts, and Other Agreements: Fraud and Abuse; Information Blocking; Office of Inspector General’s Civil Money Penalty Rules, 88 Fed. Reg. 42820 (July 3, 2023).
[ix] 45 C.F.R. 171.103.
[x] 45 C.F.R. 171.103.
[xi] 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking, 88 Fed. Reg. 74947 (November 1, 2023).
[xii] 42 U.S.C. § 300jj-52(b)(2)(A).
[xiii] 42 U.S.C. § 300jj-52(b)(2)(B).
[xiv] 42 U.S.C. § 300jj(3). Health Care Providers includes hospitals, skilled nursing facilities, nursing facilities, home health, long term care facilities, health care clinics, community mental health centers, renal dialysis facilities, blood centers, ambulatory surgical centers, emergency medical services providers, federally qualified health centers, group practices, pharmacists, pharmacies, laboratories, physicians and other practitioners, among others.
Published by: www.lawyer-monthly.com
