HHS to Start Actively Enforcing Healthcare Information Blocking Regulations
The U.S. Department of Health and Human Services (HHS) has announced that it will be increasing dedicated resources for enforcing its health information blocking regulations and will actively pursue penalties against any healthcare entity that blocks the exchange, access, and use of patients’ electronic health data permitted by law.
It has been nine years since President Barack Obama signed the 21st Century Cures Act into law, which, in part, aimed to improve interoperability and promote secure health data exchange. Three years in the making, the 21st Century Cures Act was signed into law in 2016 and authorized civil monetary penalties for any organization that engaged in intentional and inappropriate information blocking, which prevents or discourages access, exchange, and the use of electronic health information.
It took until 2023 for the HHS to finalize a rule establishing civil monetary penalties for information blocking, which, for certified health IT vendors and health information exchanges, is a maximum penalty of $1 million. In 2024, the HHS issued a final rule finalizing financial disincentives for healthcare providers, which can include payment penalties from the Centers for Medicare and Medicaid Services (CMS).
The Assistant Secretary for Health Technology/Office of the National Coordinator for Health IT (ASTP) has established a portal through which information blocking complaints can be filed, and shared the complaints with the HHS Office of Inspector General (HHS-OIG), which may pursue penalties against healthcare providers, health information exchanges, offerors of certified Health IT, and health IT developers of certified health IT. Health IT developers of certified health IT may also be investigated by ASTP under the Health IT Certification Program, and if information blocking is confirmed, health IT vendors may be banned from the Health IT certification program.
Information blocking is defined as any practice that is likely to interfere with the access, exchange, or use of electronic health information that is not covered by any of the nine exemptions, which include privacy and security reasons. HHS explained that during the first Trump administration, the ONC final rule was published to improve health information access and health IT choice, ensuring patients have easy electronic access to their EHI at no cost, including via apps of their choice; and that health care providers can choose the digital tools that allow them to provide the best care, without facing excessive costs or technical barriers.
“Information blocking was not a priority under the Biden Administration. That changed under President Trump and Secretary Kennedy,” explained HHS in a press release announcing active enforcement of the regulations. That said, the enforcement rule for healthcare providers was not published until July 31, 2024, and there have been relatively few complaints about information blocking since the complaint portal was established in 2021. Since then, HHS has received 1,420 submissions through the portal, 84 of which have been rejected, leaving 1,336. While that is a significant number, the last HHS report to Congress indicated that HHS was receiving more than 30,000 complaints a year about potential HIPAA violations.
The announcement means that while information blocking has been prohibited since 2021, there will now be actual consequences for information blocking. That could include healthcare providers that do not give patients timely access to their medical records, something the HHS has been actively enforcing under HIPAA, as well as vendors who block providers from accessing healthcare data when contracts come to an end, and any vendor that makes it difficult or impossible for providers to integrate Health IT with other platforms. “Patients must have unfettered access to their health information as guaranteed by law,” acting HHS Inspector General Juliet Hodgkins said in an agency press release. “Providers and certain health IT entities have a legal duty to ensure that information flows where and when it’s needed.”
For healthcare providers, there is now the added risk that failing to provide patients with timely access to their healthcare information could be classed as information blocking, which could mean more substantial penalties than a fine for a HIPAA violation. “We have already begun reviewing reports of information blocking against developers of certified health IT under the ONC Health IT Certification Program and are providing technical assistance to our colleagues at OIG for investigations,” said Tom Keane, MD, Assistant Secretary for Technology Policy and National Coordinator for Health Information Technology, indicating this is a key area of enforcement initially.
Led by Secretary Robert F. Kennedy Jr., the HHS has experienced large-scale restructuring and staffing reduction this year. It is currently unclear where the extra dedicated resources for enforcement will come from, and if this will mean new resources specifically for enforcement of information blocking or the reallocation of existing staff from other areas.
