AHA Comments on the Proposed Rule to Establish Disincentives for Providers Found to Have Committed Information Blocking

January 2, 2024

The Honorable Chiquita Brooks-LaSure 
Centers for Medicare & Medicaid Services 
200 Independence Avenue SW
Washington, DC 20201

The Honorable Micky Tripathi, Ph.D. 
National Coordinator for Health Information Technology Department of Health and Human Services 
200 Independence Avenue, SW 
Washington, D.C. 20201

Re: RIN 0955-AA05; 21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking

Dear Administrator Brooks-LaSure and Dr. Tripathi:

On behalf of our nearly 5,000 member hospitals, health systems and other health care organizations, our clinician partners — including more than 270,000 affiliated physicians, 2 million nurses and other caregivers — and the 43,000 health care leaders who belong to our professional membership groups, the American Hospital Association (AHA) appreciates the opportunity to provide comment to the Centers for Medicare & Medicaid Services (CMS) and the Office of the National Coordinator for Health Information Technology (ONC) on their proposed rule to establish disincentives for providers found to have committed information blocking.

As demonstrated over the course of many years, the AHA and its member hospitals believe in the importance of making critical health information available to patients, the clinicians treating those patients, and those with appropriate reasons for having access, among which are payment, care oversight and research. However, we have a number of concerns regarding this proposal.

First, the disincentive structure proposed in this rule is excessive, so much so that it may threaten the financial viability of economically fragile hospitals, including many small and rural hospitals.

Second, the processes by which the Office of the Inspector General (OIG) will determine if information blocking has occurred are unclear, including the appeals process, giving this proposed rule the appearance of being arbitrary and capricious.

Third, the disincentives are based on variable aspects of provider payment (e.g., the value of the market basket adjustment and certain performance incentives in a given year) and, as a result, would create an unfair and confusing framework in which disproportionate punishment could be levied for the same offense depending on the year of the offense and how long it takes for the violation to be referred to CMS.

Finally, this rule would, if finalized, be the program’s fourth update since 2019. Such instability in program rules has created substantial burden and confusion for providers, detracting from one of the program’s key goals: to use information technology to improve patient outcomes by easing access to electronic health information – a part of which is reducing burden.

Our detailed comments follow.


Penalty Amount and Structure

CMS and ONC propose to penalize providers found to have blocked information sharing by reducing reimbursement under the Traditional Medicare program. For hospitals and health systems paid under the inpatient prospective payment system (IPPS), CMS would reduce the market basket update by 75%. For critical access hospitals (CAHs), CMS would reduce reimbursement by 1 percentage point.

The proposed penalties are excessive, potentially overlapping and unfair. First, it appears that CMS and ONC underestimated the real financial impact of a 75% decrease in yearly market basket updates for IPPS hospitals and a 1 percentage point reduction in the reimbursement for CAHs. In the proposed rule, CMS and ONC reference a hypothetical scenario of a proposed 3.2% market basket increase and a reduction of three-quarters of that percentage increase if the disincentive was applied.

Under this scenario, CMS and ONC estimated a median disincentive amount of $394,353 and a range of $30,406 to $2,430,766 across eligible hospitals. Using the formula described in this scenario, several of AHA’s members estimated what their own penalties might be and found that the impact could be more than three times the upper-level number quoted in the range published in the rule, and an average impact that is nearly 10 times higher than median quoted in the rule.

For CAHs, a 1% cut in payment would be very challenging. This is especially true as sequestration results in CAHs already receiving Traditional Medicare payments below costs, and payments from Medicare Advantage plans, which are rapidly expanding in rural areas, often pay below Traditional Medicare. Any additional cuts to these providers could be devasting for rural communities.

The AHA urges CMS and ONC not to finalize this disincentive structure. Should it move forward, we urge the agencies to verify their calculations and be transparent in publishing the specific formula used so that stakeholders can better understand the discrepancy between their impact numbers and those of the agencies.

Unreasonable and Variable Impact. The proposed market basket approach creates the potential for significantly different penalties to be levied on similarly sized hospitals with similar numbers of patients based on the rapidity with which the OIG processes the case and refers it to CMS for action. Two different hospitals that OIG claims have the same information blocking allegations on patients and providers, for the same duration, could suffer significantly different monetary penalties only because they are referred to CMS in different years with different market basket increase percentages. The proposed rule is shoehorning a new penalty structure for information blocking into a structure created more than a decade ago to promote meaningful use of information technology. The AHA recommends CMS and ONC reconsider applying disincentives through the market basket payment adjustment.

Alignment to HIPAA

The proposed rule points out that “The Cures Act does not specify or provide illustrations for the types of disincentives that should be established.” The law also does not compel the Department of Health and Human Services (HHS) to designate CMS as the appropriate agency and, by extension, Medicare reimbursement, as a vehicle for monetary disincentives. Under the 21st Century Cures Act, health care providers determined by the HHS OIG to have violated the information blocking rules would be separately referred by HHS “to the appropriate agency to be subject to appropriate disincentives using authorities under applicable Federal law, as the Secretary sets forth through notice and comment rulemaking.”

As such, ONC is not obligated to create an entirely new penalty structure and instead could leverage existing practices, such as referring enforcement of HIPAA violations to the Office of Civil Rights (OCR). As the providers that this rule applies to are all HIPAA covered entities, and there are already specific references to HIPAA in the OCR’s existing information blocking regulation that underpins this rule, we recommend that HHS carefully consider this existing connection to HIPAA and how that connection could simplify the structure and promote a more equitable and balanced approach to enforcement of the disincentives for this proposed rule. An example of that direct connection to HIPAA is the privacy exception of the information blocking rule.

How providers interpret this exception and, subsequently, whether OIG agrees with that interpretation, will be a significant factor driving the decision of OIG to refer a recommendation to CMS for enforcement of information blocking. The language of that exception specifically references the HIPAA privacy rule when determining if the content, public distribution and implementation of the provider’s organizational privacy policies comply with the HIPAA privacy law. Given this direct and pre-existing statutory connection to HIPAA, it is unclear why OIG would not harmonize enforcement of information blocking with HIPAA. Disconnecting this from HIPAA forces the penalty structure to be unnecessarily confusing, imbalanced and overlapping.

ONC should harmonize the requirements and penalties, as well as clarify the possible overlap between the two regulations. AHA recommends that CMS and ONC adopt a simplified penalty structure, like the OCR’s penalty structure for HIPAA violations, instead of the proposed disincentives. Both regulations involve access to patient information; HIPAA’s tiered structure for violations is already familiar to providers. It also offers a graduated escalation of penalties based on the level of knowledge a covered entity had of the violation, ranging from Tier 1 (Lack of Knowledge) to Tier 4 (Willful Neglect). OCR then determines the penalty based on several “general factors” and the severity of the HIPAA violation. OCR also tries to resolve HIPAA violations using non-punitive measures, such as voluntary compliance or technical guidance, to help covered entities fix areas of noncompliance. Financial penalties are only applied if the entity fails to make corrections or if the violations are serious and persistent.

ACO Penalties

Under the proposed rule, the penalties for ACOs include removal from or denied approval to participate in the MSSP for at least one year if they are found to be blocking information – and possibly much longer if OIG stacks their findings from subsequent investigations. ACOs were created to provide for Medicare beneficiaries with more coordinated and cost-effective care. Removing providers from an ACO or an entire ACO from a community could seriously impact Medicare beneficiaries’ access to care in that community, far outstripping the potential impact of information blocking. Often, and especially in rural communities, individual specialists participating in the ACO may be the only available specialist serving that community; blocking their participation in that ACO could be devastating to that community and the patients it serves.

Given the potential risks and negative impact to patient outcomes, the AHA recommends that disincentives related to ACOs are introduced in a separate rule once those risks are better understood. We also strongly suggest developing any ACO-specific penalties in close consultation with those administering an ACO to ensure the agencies understand the impact of any proposed penalties. Any penalty targeting an ACO needs to have a clear accommodation for hardship and a well-defined investigation process with a graduated penalty structure that is sensitive to the impact that ACOs have on the communities they serve. Furthermore, as noted in AHA's August 2023 response to the request for information regarding Episode Based Payment, CMS should consider expanding safe harbor protections (i.e., Stark and Anti-Kickback) for hospitals and health systems to extend full access of their EHRs, at no cost, to providers who fill patient care needs as part of an ACO model. This is a far more constructive method of ensuring patients are receiving the intended benefits of interoperability rather than just removing providers or entire ACOs from the program for more than a year.


The proposed rule states “To maximize efficient use of resources, OIG generally focuses on selecting cases for investigation that are consistent with its enforcement priorities and intends to apply that rationale to its approach for selecting information blocking complaints for investigation.” It goes on to list these expected priorities for selecting cases: “(i) resulted in, are causing, or have the potential to cause patient harm; (ii) significantly impacted a provider’s ability to care for patients; (iii) were of long duration; and (iv) caused financial loss to Federal health care programs, or other government or private entities.”

These priorities could be useful guides; however, the agencies include a number of caveats that effectively leave providers in the dark regarding what OIG will seek to enforce. What is particularly concerning is that ONC already has hundreds of information blocking claims they have collected that they can use to provide concrete examples for OIG to use as a baseline.

According to the ONC, as of Nov. 20, 2023, and since they started tracking information blocking claims in April 2021, there have been 856 possible claims of information blocking. Unfortunately, ONC provides no details about any of these claims, other than the type of actor involved. This is a missed opportunity, since ONC can use the data gathered from these hundreds of examples to provide highly detailed, de-identified use cases to clearly illustrate examples of blocking that OIG felt warranted an investigation, as well as cases they felt did not meet that requirement. This approach would allow the provider community to respond and offer insights into extenuating circumstances and hardship conditions that may not be covered by ONC’s existing set of exceptions.

Providing specific examples of information blocking cases that the agencies feel warrant investigation would also provide OIG an opportunity to use these sample cases to explain the investigation process and formally propose an appeals process on which there can be public review and comment. An illustrative sample of the investigation process would help providers understand a true timeline for enforcement, as the proposed rule offers no insight into the duration of OIG investigation process, which is a key determining factor of when any disincentives would be applied if OIG refers the case to CMS for enforcement. This is significant, of course, because the year the case is referred determines the market basket increase percentage on which the disincentive will be calculated.

Additionally, there is no defined appeals process for providers in the proposed rule like there is for health information technology developers, health information networks or health information exchanges in the July 2023 Civil Monetary Penalty final rule. The proposed rule only states that health care providers “may have the right to appeal administratively a disincentive if the authority used to establish the disincentive provides for such an appeal.” Because the rule offers no examples, it fails to acknowledge the vast differences among the broad range of provider types covered by this rule. Indeed, although the rule points out that monetary disincentives will vary among providers, there is no attempt to clarify how the different investigation and appeals process should differ among providers, given the reality that the differences between the types of providers covered by the rule are significant.

The AHA recommends that OIG takes time to assess and clarify its proposed enforcement priorities using examples from the claims ONC has captured through the Report Information Blocking Portal to illustrate the definition of intent, and to clearly define the investigation and appeals processes. ONC should offer an additional 60 days for public review and comment, and delay the enforcement of the suggested disincentives for 18 months from the publishing of the final rule; this will allow for investigations and findings to commence in support of greater education and support for providers. This also will give providers and the public tangible insight into how an investigation determines whether information blocking was committed, how long the typical investigation takes and clear expectations for the appeals process.

We appreciate your consideration of these issues. Please contact me if you have questions or feel free to have a member of your team contact Stephen Hughes, AHA’s director for health information technology policy, at stephen.hughes@aha.org.



Ashley Thompson 
Senior Vice President, Public Policy