On June 24, 2024, HHS finalized the Information Blocking Disincentives Rule, effective July 31. The rule completes the enforcement architecture that the 21st Century Cures Act set up: the Office of the National Coordinator defines information blocking, the Office of Inspector General investigates and refers, and now CMS applies specific financial disincentives to providers found to have engaged in it.
Who is in scope
The rule names three categories of providers and three corresponding disincentives:
- Eligible hospitals and Critical Access Hospitals found to have engaged in information blocking will not be considered meaningful EHR users for the relevant reporting period, with associated payment consequences under Medicare
- MIPS eligible clinicians will receive a zero score in the Promoting Interoperability performance category
- Accountable Care Organization participants may be deemed ineligible to participate in the Medicare Shared Savings Program for at least one year
For ASCs, the immediate question is which of your physicians sit inside one of these buckets. Many ASC-based physicians are facility-based or hospital-based clinicians who fall outside the main MIPS reporting scope. But multi-specialty groups that include office-based clinicians, or surgeons who also run an office practice, frequently are MIPS eligible and therefore exposed.
The actor question
The information blocking rules apply to three types of actors: healthcare providers, health IT developers of certified health IT, and health information networks/exchanges. The disincentives rule operationalizes consequences only for the provider actors that participate in the named programs. ASCs themselves are not directly enumerated in the disincentives, but the underlying prohibition on information blocking still applies to the ASC as a healthcare provider actor. The investigation and referral path exists; the disincentive lever just attaches at the individual clinician level.
In practical terms, if a patient requests their record from your ASC and you fail to provide it in a manner consistent with the information blocking rules, the exposure is twofold: a potential information blocking finding against the ASC, and a potential MIPS penalty against the treating physician.
What clinics should be doing this quarter
- Map your providers to the in-scope categories. Pull the roster and tag each clinician with their MIPS status, ACO participation, and facility-based determination. This is the single most useful artifact you can produce in the next 30 days.
- Document your access workflow. When a patient asks for their records, who routes the request, who fulfills it, and within what timeframe. The rule expects access without unreasonable delay. A documented workflow is the first piece of evidence reviewed under audit.
- Train front-line staff on patient access requests. The most common information blocking finding to date has been about delay or denial at the front desk, not about EHR configuration. Staff need to know what a request looks like and what they are not allowed to do with it.
- Confirm your EHR is configured for the United States Core Data for Interoperability. The USCDI version 1 expectation is now baseline. If your vendor has not certified to the current version, that is a contract conversation to have this quarter.
- Review the eight exceptions. The rule contains specific exceptions, including preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, and licensing. Each has documentation requirements. Decide in advance how you would document reliance on an exception if you ever invoked one.
Quick win
Run a test patient access request through your own front desk this week, anonymized through a friendly patient or staff member. Time it. The exercise reliably surfaces a 48 to 72 hour gap that you did not know existed and that the rule treats as a problem.
The audit posture
OIG opened its information blocking investigation portal in 2023 and has been accepting complaints since. The pace of investigation has been measured, but the disincentives rule is what gives those investigations operational consequence for clinicians. ASCs that have not previously focused on information blocking should treat the next six months as the window to get the documentation, training, and configuration in order. The cost of doing so quietly is lower than the cost of reconstructing it after a complaint lands.
How DocForms helps
Staff Records tags each provider with their MIPS participation, ACO affiliation, and facility-based status, so the in-scope question is answered before a complaint forces you to answer it.
Policies and Procedures maintains the patient access workflow, the exception documentation templates, and the version history that proves what your policy said on the date of any disputed request.
EHR Integration records the interoperability configuration of your EHR, the USCDI version supported, and the data flows in and out of the system, which together form the technical evidence base for any information blocking review.