275 
‘‘(1) IN GENERAL.—Any person or entity de-
scribed in paragraph (1), (2), or (3) of subsection 
(a) determined to have committed on or after Janu-
ary 1, 2018, an act described in such respective 
paragraph with respect to the use of a qualified elec-
tronic health record or health information tech-
nology, as applicable under such respective para-
graph, with respect to items and services furnished 
under the Medicare Program under title XVIII of 
the Social Security Act or the Medicaid program 
under title XIX of such Act, shall be subject to a 
civil monetary penalty in such amount as determined 
appropriate by the Secretary through rulemaking. 
‘‘(2) APPLICATION.—Subject to paragraph (3), 
the provisions of section 1128A (other than sub-
sections (a) and (b)) of such Act (42 U.S.C. 1320a– 
7a) shall apply to a civil money penalty applied 
under this subsection in the same manner as they 
apply to a civil money penalty or proceeding under 
subsection (a) of such section 1128A. 
‘‘(3) RECOVERY OF FUNDS.—Notwithstanding 
section 3302 of title 31, United States Code, or any 
other provision of law affecting the crediting of col-
lections, the Inspector General of the Department of 
Health and Human Services may receive and retain
276 
for current use any amounts recovered under this 
subsection. In addition to amounts otherwise avail-
able to the Inspector General, funds received by the 
Inspector General under this paragraph shall be de-
posited, as an offsetting collection, to the credit of 
any appropriation available for purposes of carrying 
out this subsection and subsection (a) and shall be 
available without fiscal year limitation and without 
further appropriation. 
‘‘(d) INFORMATION BLOCKING.— 
‘‘(1) IN GENERAL.—For purposes of this sec-
tion and section 3010, subject to paragraph (3), the 
term ‘information blocking’ means, with respect to 
the access, use, and exchange of qualified electronic 
health records and other health information tech-
nology, business, technical, and organizational prac-
tices, including practices described in paragraph (2), 
that— 
‘‘(A) prevent or materially discourage the 
access, exchange, or use of electronic health in-
formation; and 
‘‘(B) the actor knows or should know (as 
defined in section 1128A(i)(7) of the Social Se-
curity Act) are likely to interfere with the ac-
277 
cess, exchange, or use of electronic health infor-
mation. 
‘‘(2) PRACTICES DESCRIBED.—For purposes of 
paragraph (1), the practices described in this para-
graph shall include the following: 
‘‘(A) Contract terms, policies, or business 
or organizational practices that restrict author-
ized use under applicable State or Federal law 
of electronic health information or restrict the 
authorized exchange under applicable State or 
Federal law of such information for treatment 
and other permitted purposes under such appli-
cable law, including transitions between cer-
tified EHR technologies. 
‘‘(B) Charging unreasonable prices or fees 
(such as for health information exchange, port-
ability, interfaces, and full export of health in-
formation) that make accessing, exchanging, or 
using electronic health information cost prohibi-
tive. 
‘‘(C) Developing or implementing health 
information technology in nonstandard ways 
that are likely to substantially increase the 
costs, complexity, or burden of sharing elec-
tronic health information, especially in cases in
278 
which relevant interoperability standards or 
methods to measure interoperability have been 
adopted by the Secretary. 
‘‘(D) Developing or implementing health 
information technology in ways that are likely 
to lock in users or electronic health information, 
such as not allowing for the full export of 
health information; lead to fraud, waste, or 
abuse; or impede innovations and advancements 
in health information access, exchange, and use, 
including health information technology-enabled 
care delivery. 
‘‘(3) EXCEPTIONS.— 
‘‘(A) IN GENERAL.—The term ‘information 
blocking’ shall not include practices that— 
‘‘(i) are required by applicable law; or 
‘‘(ii) that the Secretary, through regu-
lation, identifies as necessary to protect 
patient safety, to maintain the privacy or 
security of individuals’ health information, 
or to promote competition and consumer 
welfare. 
‘‘(B) PROCESS.—For purposes of subpara-
graph (A)(ii), not later than 12 months after 
the date of the enactment of this section, the
279 
Secretary shall issue regulations following the 
notice and comment procedures of section 553 
of title 5, United States Code, except that the 
Secretary may issue the first such regulation as 
an interim final regulation. 
‘‘(C) NO ENFORCEMENT BEFORE EXCEP-
TIONS
IDENTIFIED.—The term ‘information 
blocking’ shall not include any practice or con-
duct occurring before the date that is 30 days 
after the date on which the first regulation (as 
described in subparagraph (B)) is issued under 
such subparagraph. 
‘‘(D) CONSULTATION.—To the extent that 
regulations issued under this paragraph define 
practices that are necessary to promote com-
petition and consumer welfare, the Secretary 
may consult with the Federal Trade Commis-
sion in issuing such regulations. 
‘‘(E) APPLICATION.—The term ‘informa-
tion blocking’, with respect to an individual or 
entity, shall not include an act or practice other 
than an act or practice committed by such indi-
vidual or entity.
280 
‘‘(e) TREATMENT OF VENDORS WITH RESPECT TO 
PATIENT SAFETY ORGANIZATIONS.—In applying part C 
of title IX— 
‘‘(1) vendors shall be treated as a provider (as 
defined in section 921) for purposes of reporting re-
quirements under such part, to the extent that such 
reports are related to attestation requirements under 
section 3001(c)(5)(C)(i)(I); 
‘‘(2) claims of information blocking described in 
subsection (a) shall be treated as a patient safety ac-
tivity under such part for purposes of reporting re-
quirements under such part; and 
‘‘(3) health care providers that are not mem-
bers of patient safety organizations shall be treated 
in the same manner as health care providers that 
are such members for purposes of such reporting re-
quirements with respect to claims of information 
blocking described in subsection (a). 
‘‘(f) RULEMAKING AND GUIDANCE.— 
‘‘(1) IN GENERAL.—Not later than 12 months 
after the date of the enactment of this section, the 
Secretary, in consultation with the National Coordi-
nator and the Inspector General of the Department 
of Health and Human Services, shall, through rule-
making, implement the provisions of section 3001 of
281 
the 21st Century Cures Act, including amendments 
made by such section, relating to information block-
ing. 
‘‘(2) NON-DUPLICATION
OF
PENALTY
STRUC-
TURES.—In carrying out paragraph (1), in deter-
mining the scope of penalties, assessments, or exclu-
sions under such section 3001, including amend-
ments made by such section, relating to information 
blocking, the Secretary shall ensure to the extent 
possible that such penalties, assessments, and exclu-
sions do not duplicate penalty, assessment, and ex-
clusion structures that would otherwise apply with 
respect to information blocking and the type of indi-
vidual or entity involved as of the day before the 
date of the enactment of this section. 
‘‘(3) CLARIFICATION.—In carrying out para-
graph (1), the Secretary shall ensure that health 
care providers are not penalized for actions of ven-
dor of, and other entities offering to such providers, 
health information technology for the failure of such 
technology to meet requirements for such technology 
to be certified under this title. 
‘‘(4) GUIDANCE
RELATING
TO
HIPAA.—Not 
later than January 1, 2017, the National Coordi-
nator shall publish guidance to clarify the relation-
282 
ship of the provisions of the HIPAA privacy and se-
curity law, as defined in section 3009(a)(2) to infor-
mation blocking, including— 
‘‘(A) examples of how such provisions may 
result in information blocking; and 
‘‘(B) clarifying that a health care provider 
(as defined in subsection (g)) who discloses 
health information as allowed under applicable 
State and Federal law is not liable for unlawful 
actions, including breaches that occur in the 
custody of the recipient unless the disclosure 
proximately cause the breach. 
‘‘(g) HEALTH CARE PROVIDER DEFINED.—For pur-
poses of this section, the term ‘health care provider’ means 
a provider of services under subsection (u) of section 1861 
of the Social Security Act and a supplier under subsection 
(d) of such section. 
‘‘(h) AUTHORIZATION OF APPROPRIATIONS.—In ad-
dition to amounts made available under subsection (c)(3), 
there is authorized to be appropriated $10,000,000 for fis-
cal year 2017 to carry out subsection (a), to remain avail-
able until expended.’’. 
(3) POSTINGS RELATING TO ENFORCEMENT ON 
HHS
INTERNET
WEBSITE.—Section 3001 of the 
Public Health Service Act (42 U.S.C. 300jj–11) is
283 
amended by adding at the end the following new 
subsection: 
‘‘(f) ENFORCEMENT INFORMATION POSTED ON HHS 
INTERNET WEBSITE.— 
‘‘(1) PRICING INFORMATION.—Not later than 
January 1, 2019, the National Coordinator shall 
post 
the 
information 
described 
in 
subsection 
(c)(5)(C)(I)(i)(cc) on the public Internet website of 
the Office of the National Coordinator for Health 
Information Technology in a manner that allows for 
comparison of functionality, price information, and 
other features among health information technology 
products that aids in making informed decisions for 
purchasing such a product. 
‘‘(2) ANNUAL POSTING.—For 2019 and each 
subsequent year, the Secretary shall post on the 
public Internet website of the Department of Health 
and Human Services a list of any qualified electronic 
health records with respect to which certification has 
been withdrawn under subsection (c)(5)(C)(ii) dur-
ing such year and the vendor of or other entity of-
fering to health care providers (as defined in section 
3010A(g)) such qualified electronic health records. 
‘‘(3) PERIODIC REVIEW.—The Secretary shall 
periodically review and confirm that vendors of and
284 
other entities offering to health care providers (as 
defined in section 3010A(g)) qualified electronic 
health records have publicly published application 
programming interfaces and associated documenta-
tion as required by subsection (c)(5)(C)(i)(II) for 
purposes of certification and maintaining certifi-
cation under any program kept or recognized under 
subsection (c)(5)(A).’’. 
(4) DEMONSTRATION REQUIRED FOR MEANING-
FUL EHR USE UNDER MEDICARE.— 
(A) ELIGIBLE PROFESSIONALS.— 
(i) 
IN
GENERAL.—Section 
1848(o)(2)(A) of the Social Security Act 
(42 U.S.C. 1395w–4(o)(2)(A)) is amended 
by inserting after clause (iii) the following 
new clause: 
‘‘(iv) INTEROPERABILITY.—With re-
spect to EHR reporting periods for pay-
ment years beginning with 2020, the eligi-
ble professional demonstrates to the satis-
faction of the Secretary, in accordance 
with subparagraph (C)(i), that during such 
period the professional has not taken any 
action described in subsection (a)(2) of 
section 3010A of the Public Health Service
285 
Act, with respect to the use of any certified 
EHR technology.’’. 
(ii) HARDSHIP
EXEMPTION
IN
CASE 
OF DECERTIFIED EHR.—Subparagraph (B) 
of section 1848(a)(7) of the Social Security 
Act (42 U.S.C. 1395w–4(a)(7)) is amend-
ed to read as follows: 
‘‘(B) 
SIGNIFICANT
HARDSHIP
EXCEP-
TION.— 
‘‘(i) IN
GENERAL.—The Secretary 
may, on a case-by-case basis, exempt an el-
igible professional from the application of 
the payment adjustment under subpara-
graph (A) if the Secretary determines, sub-
ject to annual renewal, that compliance 
with the requirement for being a meaning-
ful EHR user would result in a significant 
hardship, such as in the case of an eligible 
professional who practices in a rural area 
without sufficient Internet access. 
‘‘(ii) DECERTIFICATION.—The Sec-
retary shall exempt an eligible professional 
from the application of the payment ad-
justment under subparagraph (A) if the 
Secretary determines that such profes-
286 
sional was determined to not be a mean-
ingful EHR user because the certified 
EHR technology used by such professional 
is decertified under section 3001(c)(5)(C) 
of the Public Health Service Act. An ex-
emption under the previous sentence may 
be applied to an eligible professional only, 
subject to clause (iii), during the first pay-
ment year with respect to the first EHR 
reporting period to which such decertifica-
tion applies. 
‘‘(iii) DURATION
OF
DECERTIFICA-
TION.— 
‘‘(I) 
IN
GENERAL.—Notwith-
standing clause (iv)(I), in no case 
shall an exemption by reason of clause 
(ii) be for a period of less than 12 
months. 
‘‘(II) EXTENSION.—An exemp-
tion under clause (ii) may be ex-
tended, on a case-by-case basis, for a 
period of an additional 12 months 
subject to the limitation described in 
clause (iv)(I). 
‘‘(iv) LIMITATION.—
299 
ministrator of the Centers for Medicare & Medicaid Serv-
ices shall provide to the committees of jurisdiction of the 
House of Representatives and the Senate information on 
the following: 
(1) The populations of Medicare beneficiaries, 
such as those who are dually eligible for the Medi-
care Program under title XVIII of the Social Secu-
rity Act (42 U.S.C. 1395 et seq.) and the Medicaid 
program under title XIX of such Act (42 U.S.C. 
1396 et seq.) and those with chronic conditions, 
whose care may be improved most in terms of qual-
ity and efficiency by the expansion, in a manner that 
meets or exceeds the existing in-person standard of 
care under the Medicare Program under title XVIII 
of such Act, of telehealth services under section 
1834(m)(4) of such Act (42 U.S.C. 1395m(m)(4)). 
(2) Activities by the Center for Medicare and 
Medicaid Innovation which examine the use of tele-
health services in models, projects, or initiatives 
funded through section 1115A of the Social Security 
Act (42 U.S.C. 1315a). 
(3) The types of high-volume services (and re-
lated diagnoses) under such title XVIII which might 
be suitable to the furnishing of services via tele-
health.