What is Information Blocking in Healthcare?
Information blocking in healthcare is any practice by a healthcare provider, certified health IT developer, or Health Information Network (collectively “actors” ) that prevents or materially discourages access to, exchange of, or use of Electronic Health Information (EHI). Actors responsible for information blocking can face significant sanctions.
In 2016, §4004 of the 21st Century Cures Act added a new section to the Public Health Service Act to prohibit the practice of information blocking in healthcare. The new section describes some of the most common information blocking practices, and instructs the Secretary of Health and Human Services (HHS) to identify exceptions when information blocking in healthcare is permissible.
HHS did so through the 2020 Cures Act Final Rule, which codified the information blocking provisions — including the permitted exceptions — at 45 CFR Part 171.
The new section also authorizes HHS’ Office of Inspector General (HHS OIG) and the Office of the National Coordinator for Health Information Technology (ONC) to sanction “actors” found responsible for information blocking. Sanctions for information blocking in healthcare include civil money penalties, reductions in incentive payments, and/or removal from the ONC’s Health IT Certification Program.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
What is Electronic Health Information?
The term Electronic Health Information (EHI) refers to health information maintained electronically in a designated record set by a covered actor. The term almost has the same meaning as electronic Protected Health Information (ePHI) except that psychotherapy notes and health information prepared for use in a civil, criminal, or administrative proceeding are excluded from the definition of EHI.
It is also the case the term ePHI only applies to healthcare providers that qualify as HIPAA covered entities. In the information blocking provisions, the term EHI applies to all healthcare providers and Health Information Networks/Exchanges regardless of their HIPAA status. The provisions also apply to health IT developers that qualify as certified developers of health IT under the ONC’s certification program.
Common Information Blocking Practices
To date, ONC has received 2,563 submissions claiming information blocking in healthcare – the most common (~75%) being complaints against healthcare providers for allegedly blocking the exchange of information with other healthcare providers or with payers (health plans, Medicare, etc.). Some complaints also relate to patients being denied their HIPAA rights when requesting access to PHI.
Less common information blocking complaints relate to developing or implementing health IT in nonstandard ways that are likely to restrict or increase the complexity of accessing, exchanging, or using EHI – either in individual designated record sets (i.e., to a payer) or as complete information sets (i.e., when a patient transfers to a new healthcare provider). These complaints account for about 15% of the total.
Ten Information Blocking Exceptions Permitted by HHS OIG/ONC
In 2020, HHS OIG and ONC defined eight exceptions to the information blocking legislation. These “original exceptions” are subject to specific conditions being fulfilled and are divided into two categories – exceptions that involve not fulfilling requests to access, exchange, or use EHI (Category 1), and exceptions that involve procedures for fulfilling requests to access, exchange or use EHI (Category 2). Two further information blocking exceprions were added in 2024 – the TEFCA Manner Exception and the Protecting Care Access exception.
Category 1
Preventing Harm Exception
Actors can refuse a request to access, exchange, or use EHI if it is reasonably believed that the access, exchange, or use of EHI could cause harm to a patient or another person.
Privacy Exception
This exception accommodates standards restricting disclosures of health information without a patient’s consent, or when a patient has requested privacy protection (§164.522).
Security Exception
The Security Exception applies when access to exchange of, or use of EHI presents a threat to the confidentiality, integrity, or availability of EHI or the system on which EHI is stored.
Infeasibility Exception
This exception covers external events such as natural disasters, public health emergencies, and other practical reasons why an actor may not be able to accommodate a request.
Health IT Performance Exception
The Health IT Performance Exception can be used as a temporary exception when – for example – health IT systems are offline or unavailable (i.e., in response to a cyberattack).
Category 2
Manner Exception
The Manner Exception applies when an actor is unable to fulfill a request in the manner requested and cannot reach an agreement with the requestor about a suitable alternative.
Fees Exception
This exception is an exception to the “reasonable fee” provisions of HIPAA when the fees relate to the development of technologies or services that enhance interoperability.
Licensing Exception
This exception is similar to the fees exception inasmuch as it permits actors to license interoperability elements in order to protect the value of innovation.
TEFCA Manner Exception
This exception is similar to the Category 2 Manner Exception, but only applies when both the requestor and the agent participate in the Trusted Exchange Framework and Common Agreement (TEFCA).
Protecting Care Exception
This exception was added to protect agents from potential exposure to legal action when a request is made for reproductive health care information.
When an actor exercises an exception, the reason must be documented and explained to the requestor in writing, who has the right to appeal the decision or complain to ONC. An actor’s practice that does not meet the conditions of an exception will not automatically constitute information blocking. Instead, complaints relating to such practices will be evaluated on a case-by-case basis to determine whether information blocking has occurred.
Sanctions for Information Blocking in Healthcare
Complaints about information blocking in healthcare are made to ONC via a Reporting Portal. The ONC investigates complaints made against certified IT health developers. All other complaints are forwarded to HHS’ OIG, who may forward some to the Centers for Medicare and Medicaid Services (HHS’ CMS) or the Office for Civil Rights (HHS’ OCR) depending on the nature of the complaint.
If the ONC finds a certified IT health developer is responsible for information blocking, it has the authority to issue a Notice of Non-Conformity, enforce a Corrective Action Plan, and/or suspend (or terminate) the developer’s certification. Should a certification be suspended (or terminated), the developer will be ineligible to supply health IT to healthcare organizations in the Promoting Interoperability program.
If HHS’ OIG finds a Health Information Network of certified IT vendor responsible for information blocking in healthcare, the agency has the authority to issue civil monetary penalties of up to $1 million per violation. In addition, any information blocking practices that leads to fraud, waste, and abuse can be subject to further financial penalties and possible exclusion from federal health programs.
Healthcare providers found responsible for information blocking will be subject to reduced annual incentive payments in CMS healthcare programs. However, if a failure to respond to a request to access EHI violates the patients’ rights requirements of HIPAA, the complaint will also be subject to OCR enforcement action.
What is Information Blocking in HIPAA?
Despite often being described as “the HIPAA information blocking rule,” information blocking is not a HIPAA rule – it is a separate Cures Act provision, codified at 45 CFR Part 171, applying to a broader set of actors regardless of their HIPAA status.
The confusion regarding the term Information blocking in HIPAA likely arose because HHS published the 2020 Cures Act Final Rule within months of updating 42 CFR Part 2 and issuing the 2020/21 NPRM for the HIPAA Privacy Rule.
The two frameworks that actually matter here – HIPAA’s right of access and information blocking under 45 CFR Part 171 – set different standards for the same underlying activity. HIPAA’s right of access (45 CFR 164.524) gives covered entities up to 30 days to respond, extendable by a further 30 days, and permits only reasonable, cost-based fees limited to labor, supplies, and postage.
Information blocking imposes no fixed deadline; a delay is instead judged on whether it is unreasonable given that the EHI is electronic – generally a stricter expectation than HIPAA’s 30 days. Its Fees Exception adds further conditions, requiring fees to be non-discriminatory as well as cost-based. Because the standards diverge, an actor can satisfy one framework and still fall foul of the other.
45 CFR Part 171 Compliance
For compliance staff in healthcare organizations, the practical challenge of complying with 45 CFR Part 171 is that a single EHI request can trigger both frameworks at once, so it makes little sense to run separate processes for each.
A unified request-handling workflow – one that captures the request, checks it against both the HIPAA right of access and the Part 171 exceptions, and routes it to the appropriate reviewer – reduces the risk of a decision satisfying one standard while failing the other.
Where an exception is invoked, having a standard documentation template ready in advance, rather than drafting a justification from scratch each time, keeps responses consistent and reduces the risk of an inadequately reasoned denial.
Staff handling these requests need compliance training not just on HIPAA’s access requirements, but on when a Part 171 exception genuinely applies, since the two frameworks’ permissible grounds for delay or denial do not always align.
Periodic internal audits of denied or delayed requests, checked against both standards, are a core part of ongoing 45 CFR Part 171 compliance.
