Proposed Rule for CMPs for Information Blocking
OIG published a proposed rule (CMP Proposed Rule) on April 24, 2020, to, among other things, amend the CMP regulations and implement the Information Blocking CMP.The CMP Proposed Rule closely tracked the language of the Cares Act. Under the CMP Proposed Rule, OIG would be permitted to impose a penalty of up to $1 million per violation.The Proposed Rule also listed factors for OIG to consider when determining the amount of a penalty, including the nature and extent of information blocking and the harm resulting from information blocking that includes the number patients and providers affected and the duration of the information blocking violation. In the commentary to the Proposed Rule, OIG discussed its anticipated enforcement approach and enforcement priorities.
CMP Final Rule
Over three years later, on July 3, 2023, OIG published the CMP Final Rule.With some slight modifications, discussed more below, OIG adopted the language in the CMP Proposed Rule. In the Preamble to the Final Rule, OIG reiterated its enforcement priorities and anticipated approach to the Information Blocking CMP that it discussed in the CMP Proposed Rule. It also discussed the factors that it will apply when assessing a CMP for Information Blocking.
OIG’s Anticipated Approach to Enforcing the Information Blocking Rule
To give the public and stakeholders a better understanding of what to expect regarding the enforcement of this new CMP, OIG discussed in the Preamble its anticipated approach to exercising its CMP authority.It touched on four items, specifically: (1) anticipated enforcement priorities, (2) coordination with other federal agencies, (3) approach to enforcement, and (4) use of advisory opinions.
Anticipated Enforcement Priorities
To triage allegations of information blocking and effectively allocate its resources, OIG stated that it has established enforcement priorities for investigation.It emphasized that these priorities are non-binding, subject to reassessment, and would not limit OIG’s enforcement discretion.OIG articulated five enforcement priorities of the Information Blocking CMP.Its enforcement will focus specifically on information blocking conduct that:
- Resulted in, is causing, or had the potential to cause patient harm.
- Significantly impacted a provider’s ability to care for patients;
- Was of long duration;
- Caused financial loss to federal healthcare programs or other government or private entities, or
- Was performed with actual knowledge.
OIG gave additional explanation of some of these factors in the Preamble to the CMP Final Rule. With respect to assessing “harm,” OIG stated that it broadly understands “harm” as it is suffered by a patient population, community, or the public—not only harm suffered by an individual patient. OIG also noted that it would likely prioritize cases of information blocking where the actor had actual knowledge, even though the IB Rule applies when these actors either knew or should have known that the practice in question was likely to interfere with, prevent, or materially discourage the access, exchange, or use of EHI.
Cooperation with other Agencies
In the Preamble to the CMP Final Rule, OIG stated that its anticipated enforcement strategy will include cooperation with other federal agencies.OIG specifically noted three federal agencies that it would likely cooperate with: (1) ONC, (2) the HSS Office for Civil Rights (OCR), and (3) the Federal Trade Commission (FTC). The Cures Act authorizes ONC to serve as a technical advisor to OIG as it investigates claims of information blocking.The Cures Act also permits OIG to refer instances of information blocking to OCR if it determines that consultation regarding the HIPAA privacy and security rules will resolve an information blocking claim.The Cures Act gave ONC authority to share information with the FTC if a claim of information blocking or OIG investigation raises concerns of anti-competitive conduct.OIG’s coordination with other HHS agencies will seek to avoid duplicate penalties, which are prohibited under the Cures Act.
Other Enforcement Mechanisms
In the Preamble of the CMP Final Rule, OIG further explained its anticipated enforcement approach.First, OIG responded to commenters asking whether OIG would pursue alternatives to CMPs such as providing additional education or corrective action plans. OIG stated that financial sanctions are its core enforcement authority, and it does not intend at this time to utilize alternatives to CMPs to enforce information blocking. OIG observed that other agencies, such as ONC or OCR, may have independent authority to conduct individualized education and impose corrective action plans.
Second, OIG advised a commenter that it does not intend to investigate non-compliance with CMS programmatic requirements such as interoperability programs, since these obligations are distinct from information blocking. However, OIG stated that it might refer such matters to CMS if it noted non-compliance with these CMS requirements.
Third, OIG issued a reminder that under certain circumstances, a practice of information blocking could create false claims liability for an actor. For example, an actor could engage in information blocking that required the actor to falsify attestations to ONC’s certification program. In that situation, the information blocking practice could have resulted in a false claim. OIG indicated it would coordinate with its law enforcement partners, such as the DOJ, to investigate the conduct.
Fourth, OIG advised that it intends to create an information blocking self-disclosure protocol (SDP) for actors seeking to resolve potential CMP liability.This new SDP will be added following the publication of the Final Rule and will provide actors the ability to evaluate, disclose, coordinate, and resolve CMP liability for information blocking. The benefits of utilizing the SDP, according to OIG, would include lowering potential damages and avoiding costly and disruptive investigations and litigation. OIG was careful to note that the SDP for information blocking would not resolve potential liability arising under any other applicable laws, such as HIPAA.
Advisory Opinions
In response to questions from commenters, OIG, citing a lack of statutory authority, stated that it does not plan to develop and establish an advisory opinion process for information blocking.The Social Security Act that OIG relies on to publish advisory opinions regarding the federal anti-kickback statute and safe harbor provisions does not extend to the Information Blocking CMP. The Cures Act also did not establish an advisory opinion process for the Information Blocking CMP.
Summary of the Information Blocking CMP
CMP Processes and Procedures apply to the Information Blocking CMP
Under the CMP Final Rule, the general procedural elements and processes of the CMP rule, found in parts 1003 and 1005 of the existing CMP regulations, also apply to the Information Blocking CMP.Parts 1003 and 1005 set forth a framework of procedural rights for CMPs, such as imposing and appealing CMPs, assessments, and exclusions. Therefore, individuals and entities subject to CMPs for information blocking will be able to exercise these procedural rights.
Effective Date
OIG determined to establish an effective date of September 1, 2023, for the Information Blocking CMP.CMPs would not be imposed on alleged information blocking conduct that occurred before the effective date. OIG weighed various options and concluded that this date addressed commenters’ requests for a delay in the effective date, afforded time to finalize efforts to comply with the Information Blocking Rule, and provided adequate notice to affected individuals and entities when penalties would become effective.
Actors Subject to the Information Blocking CMP
As noted earlier, the CMP for information blocking is only applicable to three of the four types of actors subject to the Information Blocking Rule. The fourth type of actor, healthcare providers, are not subject to CMPs for information blocking, but rather could be subject to possible disincentives from other federal agencies, which have yet to be announced. However, OIG warned that if a healthcare provider also meets the functional definition of another type of actor (e.g., health information exchange), then CMPs could be imposed for practices by the healthcare provider that constitute information blocking acting as that other type of actor.In the Preamble to the CMP Final Rule, OIG declined to state whether certain types of entities (e.g., health plans) are excluded from information blocking, noting that the definition of an actor in the IB Rule is functional and therefore determined by the conduct of the entity or individual.
What is a CMP violation?
Under the CMP Final Rule, a “violation” of the CMP means a “practice,” as that term is defined under the IB Rule, that constitutes information blocking, as set forth in the IB Rule.In light of that definition, OIG noted that commenters requested clarity on when a “practice” under the IB Rule constitutes a single violation or multiple violations. Because it has no experience yet enforcing this new CMP, OIG refrained from finalizing specific criteria to determine if an information blocking “practice” would constitute a single or multiple CMP violations.
However, in response to requests from commenters, OIG laid out in the Preamble commentary several hypothetical scenarios of information blocking to illustrate whether the actions by the actor constituted a single or multiple violations under the CMP Final Rule.These hypotheticals illustrated that whether a scenario involves one or multiple instances of information blocking will turn on the specific facts of each scenario. In some scenarios, a single “practice” under the Information Blocking Rule may involve multiple patients, but only constitute a single “violation.” However, the practice’s effect on multiple patients could be the factor that increases the amount of the CMP. In other scenarios, the actor may have engaged in separate actions that each constitute separate violations of the CMP. For example, the enactment of a policy that constitutes information blocking would be one violation, while each instance of enforcement of the policy by an actor would constitute another, separate violation. The hypotheticals set forth in the Preamble should be reviewed carefully to more fully understand OIG’s likely approach at this early stage of the Information Blocking CMP.
Another noteworthy comment from OIG is that a violation of the CMP does not require there to be a “successful” information blocking practice. In its Preamble commentary, OIG emphasized that under the IB Rule, information blocking also occurs when a practice is likely to interfere with, prohibit, or materially discourage the access, exchange, or use of EHI.It does not require a practice to actually interfere with, prohibit, or materially discourage the access, exchange, or use of EHI. This nuance is important to understand when analyzing whether conduct could constitute a violation or multiple violations of the CMP, because practices that meet either standard would constitute a violation of the CMP.
Penalty Amounts
Under the Cares Act, OIG may impose a penalty of not more than $1 million per violation of the CMP. Where the penalty is less than the maximum amount, the amount of the penalty imposed will depend on OIG’s evaluation of two sets of factors: (1) those specific to the Information Blocking CMP in the Cares Act and (2) the general factors found in the Civil Monetary Penalties Law (CMPL). The CMPL contains a list of general factors that are applicable to all CMPs,and the existing CMP regulatory framework sets forth aggravating and mitigating factors that the OIG will consider when considering a CMP.These factors include the nature and circumstances of the violation, the degree of culpability, history of prior offenses, and other wrongful conduct.
In addition to those factors generally applicable to all CMPs, the CMP Final Rule adds 42 CFR 1003.1420, which sets forth an additional non-exhaustive list of factors that the OIG must consider when imposing a CMP specific to information blocking. These factors include the nature and extent of the information blocking and the harm resulting from such information blocking, including the number of patients affected, the number of providers affected, and the number of days that the information blocking persisted.
OIG declined commenters’ suggestions to include additional aggravating and mitigating factors in the CMP Final Rule beyond what is found in the Cures Act. It stated that additional factors may be the subject of future rulemaking once OIG has more experience enforcing the CMP Final Rule.OIG believed that the general factors outlined in the CMPL would address many of the concerns raised by commenters.
OIG recognized that the Information Blocking CMP’s factors may overlap with the factors generally applicable to all CMPs, noted earlier. OIG reassured commenters that it would not “double count” these overlapping factors against an actor. Instead, OIG intends to undertake a “holistic consideration” of all the relevant factors when assessing a penalty.
OIG illustrated how these potentially overlapping factors could be applied when OIG determines the amount of a CMP that will be assessed. For example, when determining the “nature and circumstances” of the action under the general CMP factorsand the “nature and extent” of information blocking under the Information Blocking CMP,OIG described a list of factors that it may evaluate. These factors include (1) whether the practice actually interfered with the access, exchange, or use of electronic health information; (2) the number of violations; (3) whether an actor took corrective action; (4) whether an actor faced systemic barriers to interoperability; (5) to what extent the actor had control over the EHI; (6) the actor’s size; and (7) the market share of the actor.
OIG also commented on how it might assess factors related to the actor’s culpability, the type of harm caused, and the mitigating effect of self-disclosure by the actor. When evaluating the degree of culpability, OIG stated that it could consider whether the actor had actual knowledge or had specific intent to engage in information blocking.When assessing harm, OIG responded that it will consider whether any harm occurred, which will include physical or financial harm.OIG will also consider the severity and extent of the harm caused by the actor, which could vary based on the number of patients affected, the number of providers affected, and the duration of the information blocking.If an actor self-discloses an information blocking violation, the OIG stated this would be a mitigating factor under the general CMPL factors.
OIG’s goal in setting CMP amounts is “to be fair, reasonable, and commensurate with the conduct so that wrongdoers are held accountable and future information blocking conduct is deterred.”Responding to commenters requesting a more formulaic approach to setting the CMP, OIG declined suggestions to create a baseline penalty amount, create a chart, or establish a threshold applicable to all cases. Rather, OIG’s approach to determining the amount of a CMP will be based on an application of the aggravating and mitigating factors in the rules to the particular facts of each case.
Conclusion
With the publication of the CMP Final Rule, the OIG provided needed clarity about its intended approach to investigation and enforcement of the IB Rule. Many entities prepared extensively to comply with the IB Rule since its publication in May 2020 and effective date in April 2021, but they have faced uncertainty about the enforcement of the IB Rule. It remains to be seen how OIG will enforce the IB Rule since the CMP Final Rule became effective on September 1, and OIG has acknowledged it will have a learning curve as it gains experience investigating and enforcing the Information Blocking CMP. Healthcare providers are also waiting for federal agencies to disclose more information on disincentives. However, the CMP Final Rule will hopefully be an important step towards bringing clarity and certainty to the enforcement of the IB Rule.
