The Prinz Law Office

The Department of Health and Human Services (“HHS”), the Office of the National Coordinator for Health Information Technology (“ONC”) and the Centers for Medicare & Medicaid Services (“CMS”) have just published a proposed rule defining the consequences for medical providers who fail to comply with the new information blocking regulations.

HHS previously established information blocking penalties for IT providers, health information exchanges, and networks  of up to $1 million per violation.  A full discussion of the previously proposed information blocking regulations was previously published on the Silicon Valley Digital Health Law Blog at this attached link

The newly announced proposal linked here will establish penalties in the form of financial disincentives for the medical providers who violate the information blocking regulations and are also Medicare-enrolled providers or suppliers.  (For the avoidance of doubt, the proposed rules do not apply to medical providers who fail to comply with the regulations but are not Medicare-enrolled providers or suppliers.)  The proposed financial disincentives are as follows:

• “Eligible Hospital(s)” or “critical access hospital(s)” would not be deemed to be a “meaningful electronic health record (“EHR”)” user, meaning that an “eligible hospital” would not be able to earn the three quarters of the annual market basket increase associated with qualifying as a meaningful EHR user and a “critical access hospital” would have its payment reduced to 100 percent of reasonable costs from the 101 percent of reasonable costs it might otherwise have earned in an applicable year.
• A health care provider that is an a “MIPS eligible clinician” would not be a “meaningful EHR user” in an applicable information blocking performance period and would also be required to report on the Promoting Interoperability performance category of MIP, as not earning a score.
• A health provider that is an accountable care organization (“ACO”), ACO participant, or ACO provider/ supplier will be barred from participating in the Shared Savings Program for at least a year.

What are the potential financial implications for these disincentives?

According to reporting by Healthcare IT News, the consequences to an “eligible hospital” deemed to be non-compliant “could result in a median disincentive amount of $394,353, ” whereas the consequences to a group of “MIPS eligible clinician(s)” deemed to be non-compliant could result in a loss ranging $1,372 to $165,326 for group sizes ranging from two to 241 clinicians.

HHS, ONC and CMS are currently seeking comments on the proposed rule.  Comments should be submitted on or before January 2, 2024 at 5 p.m. ET.  The submission instructions are published at this attached link.

The final update to the HIPAA Privacy Rule on reproductive health is anticipated to be issued soon by the Department of Health and Human Services (“HHS”).

HHS issued a Notice of Proposed Rulemaking on April 17, 2023 to solicit comments on its proposal to modify the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”).  The comment period on the proposed update closed as of June 16, 2023.

If adopted, the proposed update would modify existing standards permitting uses and disclosures of protected health information (“PHI”) by prohibiting uses and disclosures of PHI about reproductive health care for criminal, civil, or administrative investigations or proceedings against individuals, covered entities or their business associates or other persons for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it is provided.

The update was originally prompted by an executive order from President Biden directing HHS to take actions to strengthen the protections under HIPAA for reproductive health information following the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization.  Attached is a link to the Court’s decision: https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf.  A copy of President’ Bidens’s executive order may be viewed here: https://www.govinfo.gov/content/pkg/FR-2022-07-13/pdf/2022-15138.pdf.

According to the HHS Notice, the proposed Privacy Rule will “strengthen privacy protections for individual’s PHI related to reproductive health care” in order to “avoid the circumstance where an existing provision of the Privacy Rule is used to request the use or disclosure of any individual’s PHI as a pretext for obtaining PHI related to reproductive health care for a non-health care purpose where such use or disclosure would be detrimental to any person. ”

To view the full HHS notice on the anticipated HIPAA Privacy Rule update, please click here: https://www.federalregister.gov/documents/2023/04/17/2023-07517/hipaa-privacy-rule-to-support-reproductive-health-care-privacy.   For additional HHS commentary on the proposed Privacy Rule updates, please click here: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-reproductive-health-fact-sheet/index.html.