Published: October 28, 2024

Information Blocking: What Physicians Need to Know

As of July 31, 2024, healthcare providers are now subject to civil monetary penalties should they engage in a practice known as “information blocking.”


09 Information Blocking ThumbnailThe Academy originally reported on these regulations when they were first announced. This article provides a more in-depth analysis of the rules, and how they may potentially affect Academy members, and shares useful resources for further information.

Background and Definitions

In December 2016, Congress passed the 21st Century Cures Act. This landmark healthcare legislation included provisions to promote health information interoperability and prohibit “information blocking.”

The law defines information blocking as business, technical, and organizational practices that prevent or materially discourage the access, exchange or use of electronic health information (EHI). If committed by a healthcare provider, there must also be knowledge that such practice is unreasonable and likely to interfere with, prevent, or materially discourage access, exchange, or use of EHI.

The Office of the National Coordinator for Health Information Technology (ONC) later issued final rules that define EHI. EHI is defined as the electronic protected health information (ePHI) in a designated record set [as defined in the Health Insurance Portability and Accountability Act (HIPAA) regulations] regardless of whether the records are used or maintained by or for a covered entity.

The definition of information blocking is fairly broad. It can be interpreted as any action or inaction that prevents the access, exchange, or use of EHI. Physicians can even be held liable for information blocking if no harm materializes. However, physicians must know their actions would likely interfere, prevent, or materially discourage access, exchange, and use of EHI to be held liable.

For nearly all EHI requests, physicians must respond and release patients’ medical records unless an appropriate exception can be identified and used. Appropriate exceptions include preventing harm, protecting privacy, protecting security, infeasibility, and health IT maintenance. Although requests must be fulfilled in a timely and nononerous manner, there are also exceptions for manner and content. For example, a physician must respond in the manner requested unless technically unable to respond or agreeable license terms cannot be reached, in which case it must respond in an alternative manner.

Compliance and Enforcement

It will be incumbent upon all physicians and their practices to ensure that they are not committing information blocking. Physicians and medical practices should start by identifying whether the organization already has a compliance program. The existing compliance program will likely have policies and procedures in place to begin incorporating compliance with information blocking regulations. If the organization does not have a compliance program, then it is important to consider starting one—both for information blocking compliance and for compliance with laws like HIPAA. Consider including legal counsel with healthcare expertise, IT experts with an understanding of EHI, and experts in information privacy.

Medical practices are urged to review all policies related to their responses to information requests and update their policies and procedures as needed. The policies should address each of the information blocking exceptions prior to the exception’s use. Critically, it should consider defining the organization’s reasonableness standard. Again, to be an information blocker, the law requires that physicians must know that the practice is unreasonable and likely to interfere with, prevent, or discourage access, exchange, or use of EHI.

Although these requirements have been in place for physicians since June 30, 2020, enforcement rules have only recently been issued. As of July 31, 2024, providers are now subject to penalties if they commit information blocking.

If a clinician is found to have committed information blocking, they will not be a meaningful EHR user under the Promoting Interoperability performance category of the Merit-based Incentive Payment System (MIPS) in a performance period if OIG refers, during the calendar year of the performance period. Clinicians who are subject to MIPS and are required to report on the Promoting Interoperability performance category would receive a “zero” score for that performance category. Because the Promoting Interoperability category is 25% of the total MIPS score, the clinician could only earn a maximum total MIPS score of 75 points (assuming perfect scores in the remaining categories), which could result in the clinician receiving a negative payment adjustment. 

The Centers for Medicare & Medicaid Services (CMS) has modified its policy for this disincentive to clarify that if an individual eligible clinician is found to have committed information blocking and is referred to CMS, the disincentive under the MIPS Promoting Interoperability performance category will only apply to the individual, even if they report as part of a group. 

For the Medicare Shared Savings Program (MSSP), CMS finalized its proposal that a clinician who is an accountable care organization (ACO) or part of an ACO, if determined by OIG to have committed information blocking, would be barred from participating in the MSSP for at least one year. This may result in a clinician being removed from an ACO or prevented from joining an ACO. Where a clinician is an ACO, this would prevent the ACO’s participation in MSSP for that time period. Suspension from the MSSP would result in the ACO losing out on any shared savings revenue (potentially millions of dollars) that it otherwise would have earned, among other potential consequences. HHS will consider the relevant facts and circumstances before applying a disincentive under the MSSP, but this level of discretion will not apply to other providers and disincentives.

Despite requests from several healthcare organizations, including the Academy, the final rule does not create an appeal process for penalized entities. CMS and ONC stated that they chose not to create a single appeals process because it “may conflict with, or duplicate, administrative review or appeals processes available under existing authorities.” Clinicians will have to go through the existing appeals process for their particular Medicare program to challenge the imposition of a disincentive. 

The Academy will continue to monitor enforcement of this rule, as well as updates to any of its provisions. To learn more about information blocking, requirements, and penalties, we encourage you to review the resources below.


Resources

ONC Website
What is information blocking?
How do I comply with info blocking?
Info Blocking Disincentives Overview

 


More from October 2024 – Vol. 43, No. 10