On July 3, 2023, the US Department of Health and Human Services Office of Inspector General (OIG) published its long-awaited final rule implementing the 21st Century Cures Act provisions authorizing OIG to investigate claims of information blocking and impose civil monetary penalties of up to $1 million per information blocking violation. Consistent with OIG’s statements in its proposed rule, OIG will not begin enforcement until 60 days after publication of the OIG final rule in the Federal Register, making the effective date of the OIG final rule September 1, 2023.
Final Rule Specifics
Only ONC-certified health information technology developers and offerors, health information exchanges, and health information networks are subject to the OIG Final Rule. Notably, the OIG Final Rule does not implement its authority to enforce the Information Blocking Rule against health care providers through referral to the appropriate agency and imposition of “appropriate disincentives.” However, OIG intends to issue a separate rulemaking implementing its enforcement authority with respect to health care providers.
OIG may impose a penalty of not more than $1 million per “violation.” A “violation” is defined as a “practice,” meaning an act or omission, which constitutes information blocking. OIG will consider the number of “violations” as connected to the number of “discrete acts” engaged in by the actor. In other words, enactment of a policy that constitutes information blocking will be considered one violation, as will each discrete act of enforcement of that policy. By considering each discrete act as a separate violation, OIG is seeking to preclude the risk that larger entities might simply opt to absorb the cost of a single violation in order to continue engaging in practices that constitute information blocking. Instead, the violations could add up quickly.
With respect to the amount of the penalties, OIG will consider the facts and circumstances of each situation, and the penalty amount will be determined per violation, based on aggravating and mitigating factors set forth in regulation. While OIG declined to establish a baseline penalty amount or a table defining specific penalty amounts for various categories of conduct, OIG noted that the maximum penalty amount of $1 million per violation will be reserved for particularly egregious conduct.
OIG acknowledges that further experience with fielding claims of information blocking and enforcing CMPs for violations of the ONC’s Information Blocking Rule will lead to evolving priorities. Nevertheless, OIG has set forth several anticipated enforcement priorities and its anticipated enforcement approach, subject to evaluation of the facts and circumstances of each claim. This includes looking at patient harm, impact to patient care, the duration of conduct, harm to federal programs, actual knowledge of the conduct, and the volume of information blocking.