The Department of Health and Human Services (HHS) finalized a rule establishing disincentives for Medicare providers, including clinicians, hospitals, and accountable care organizations (ACOs), who commit information blocking.
On June 24, 2024, the HHS finalized the Disincentives Rule under the 21st Century Cures Act to address information blocking within Medicare.
Information blocking, defined as any action likely to obstruct or prevent the access, exchange, or use of electronic health information (EHI) without legal justification, will carry severe penalties from July 31, 2024.
The rule impacts clinicians through the Merit-Based Incentive Payment System (MIPS), hospitals and critical access hospitals (CAHs) via the Promoting Interoperability Program, and ACOs through the Medicare Shared Savings Program (MSSP).
The Disincentives Rule uses the MIPS, where clinicians' Medicare Part B payments depend on their performance in four categories: cost, quality, improvement activities, and promoting interoperability.
A clinician guilty of information blocking will receive a zero in the promoting interoperability category, negatively affecting their overall MIPS score and potentially decreasing their Medicare reimbursements.
Hospitals and CAHs found to be engaging in information blocking will lose their status as meaningful EHR users, making them ineligible for annual market-based monetary increases. Specifically, hospitals will forfeit a 75% market-based increase, while CAHs will only receive 100% reimbursement for reasonable costs instead of the 101% they would have otherwise received.
ACOs involved in information blocking will face a minimum one-year prohibition from participating in the MSSP, resulting in a loss of potential shared-savings revenue. The Centers for Medicare & Medicaid Services (CMS) can extend this prohibition if there are subsequent information-blocking incidents.
Additionally, CMS may deny applications from ACOs for the upcoming year or terminate participation agreements for current MSSP participants if they are found to have engaged in information blocking.
“This final rule is designed to ensure we always have access to our own health information and that our care teams have the benefit of this information to guide their decisions. With this action, HHS is taking a critical step toward a health care system where people and their health providers have access to their electronic health information,” explained HHS Secretary Xavier Becerra.
Furthermore, “When health information can be appropriately accessed and exchanged, care is more coordinated and efficient, allowing the health care system to better serve patients. But we must always take the necessary actions to ensure patient privacy and preferences are protected – and that’s exactly what this rule does.”
The Disincentives Rule is part of a broader regulatory framework addressing information blocking. It builds on the Office of Inspector General's (OIG) rule from June 2023, which set penalties for non-healthcare providers involved in information blocking. Under the 21st Century Cures Act, these include developers of certified health IT, health information exchanges, and health information networks.
Specifically, if OIG finds these entities guilty of information blocking, they face civil monetary penalties of up to $1 million per violation.
As healthcare digitizes, exchanging electronic health information without undue restrictions improves interoperability between patients and providers.
The Disincentives Rule promotes better patient care through improved data access and coordination. It also reinforces accountability across the healthcare system, contributing to more efficient and transparent healthcare management.
Medicare providers must reassess their practices according to the Disincentives Rule, ensuring the free flow of health information to avoid financial penalties and operational disruptions.
No, while the rule only applies to Medicare-enrolled providers, the HHS has requested public input on creating disincentives for all healthcare providers.
Providers found information blocking will receive lower Medicare reimbursements due to penalties or reduced performance scores.
HIPAA requires covered entities to safeguard patients' protected health information (PHI) from unauthorized access or disclosure, ultimately securing electronic health data.
Related: HIPAA Compliant Email: The Definitive Guide