Information Blocking

Key facts

Statute

21st Century Cures Act Section 4004 (Public Health Service Act Section 3022)

Regulations

45 CFR Part 171

Compliance start

April 5, 2021

Developers and networks

Civil money penalties of up to $1 million per violation

Enforcement

HHS OIG investigates; CMS applies disincentives to providers

What is information blocking?

The 21st Century Cures Act made information blocking a federal violation to stop organizations from holding patient data back for competitive or financial reasons. The Office of the National Coordinator for Health IT, now ASTP/ONC, issued the implementing regulations in its 2020 Cures Act Final Rule.

The rules apply to three types of actors: health care providers, developers of certified health IT, and health information networks or exchanges. Possible examples include unreasonable fees for data access, needless delays in fulfilling requests and contract terms that restrict exchange.

Electronic health information (EHI) under the rule means electronic protected health information in a designated record set, as HIPAA defines those terms. Until October 6, 2022, the definition was limited to USCDI data elements.

How the rules and exceptions work

Intent matters. Developers and networks violate the rule if they know or should know a practice is likely to interfere with EHI; providers violate it only if they know the practice is unreasonable and likely to interfere. The regulations define exceptions for reasonable practices:

• Not fulfilling requests: preventing harm, privacy, security, infeasibility and health IT performance.
• Procedures for fulfilling requests: manner, fees and licensing.
• TEFCA manner: added by the HTI-1 final rule, released at the end of 2023.
• Later changes: further exceptions have been added or revised in subsequent rules, so check the current 45 CFR Part 171.

Why information blocking matters

The rules create real exposure and real leverage:

• Health IT developers: HHS OIG can impose civil money penalties, and ASTP/ONC can act on the certification of certified health IT.
• Hospitals and clinicians: under a 2024 HHS final rule, providers found to have committed information blocking face disincentives in Medicare Promoting Interoperability, MIPS and the Medicare Shared Savings Program.
• Health IT and AI companies: the rules support requests for EHI through APIs and other means when a data holder refuses access without a valid exception.
• Compliance teams: policies on release timing, fees and third-party app access need to map to specific exceptions.