21st Century Cures: Part 1

In my first article on 21^st Century Cures rulemaking, of what is to be many posts and presentations, we are first going to talk about the need to take this rule seriously, and its inevitable enforcement.

21^st Century Cures prohibits “information blocking,” which is any practice that could materially interfere with a patient’s (or their authorized representative’s) ability to access, exchange, or use their electronic health information without special effort – unless an exception applies. HISTalk, a great source for health IT news and gossip, has reported that both the Office of the National Coordinator for Health IT (“ONC”) and the Centers for Medicare & Medicaid Services (“CMS”) are going to release their final rules implementing the prohibition tomorrow morning. In the next few days, lawyers, compliance professionals, and policy gurus will be writing about what the rule means, this blog included. However, prior to its release, it is important to take note on how this is going to be enforced. And we know enforcement is coming.

Enforcement is left to the Office of the Inspector General (“OIG”), who has requested $5.3 million to enforce the prohibition in their 2021 annual budget. Within the OIG, the attorneys at the Affirmative Litigation Branch – who are generally focused on fraud, waste, and abuse actions –  will take the lead. The budget also states that OIG will bring on three full-time employees to help enforce the prohibition. The OIG will likely pair the investigation of inbound complaints about health IT developers and providers with proactive audits to achieve its goals. When the OIG finds a developer engaged in information blocking, it may impose a civil monetary penalty up to $1 million.

However, that is not the end of enforcement. 21^st Century Cures rulemaking also bakes attestations regarding information blocking into the health IT certification process. This gives the ONC enforcement capabilities by virtue of ONC Direct Review of certified health IT. If the ONC finds that a vendor engaged in information blocking, it would constitute a certification nonconformity. When ONC finds a certification nonconformity, it may take three paths depending on the severity of the issue:

1. Implement a corrective action plan;
2. Suspend a developer’s certification, which means it may not be sold until the suspension is lifted;
3. Removing the health IT product’s certification; and in the most extreme cases,
4. Banning a health IT developer from the ONC Health IT Certification Program.

Option (3) and (4) would likely be even more severe than a mere $1 million penalty because it essentially kills the product’s or company’s viability in the health IT market.

Other enforcement mechanisms exist as well. Invariably, certifiers will have to face questions regarding information blocking, and they have powers similar to the ONC. Given that these attestations invariably become related to reimbursement from federal healthcare programs, False Claims Act (“False Claims Act”) actions are another viable enforcement tool. On the provider side, we’re already seeing conditions of participation crop up as one blunt tool. Further, information blocking attestations are already a part of the Merit-based Incentive Payment System’s reporting process – which again ties this back to the FCA.

For health IT developers and health information networks/exchanges, the stakes could not be higher. Conforming with these rules is not an option: it is potentially a matter of life or death. Get ready to listen to all those lawyers, compliance professionals, and policy folks. They’re banging the drum because this is a big deal, and it’s here.