Information Blocking Rule (21st Century Cures Act): Compliance for Medical Practices

The Information Blocking Rule at 45 CFR Part 171, implementing the 21st Century Cures Act, prohibits actors — healthcare providers, health-IT developers of certified products, and health information networks/exchanges — from engaging in practices that are likely to interfere with the access, exchange, or use of electronic health information (EHI), except as required by law or covered by a Part 171 exception. CMS-administered provider disincentives at 45 CFR §§ 171.1000–171.1002 landed in July 2024 and reach MIPS payment after an OIG determination.

What the rule actually prohibits

The substantive standard at 45 CFR § 171.103 defines "information blocking" as a practice that, except as required by law or covered by an exception, is likely to interfere with access, exchange, or use of EHI. For healthcare providers, the standard adds a knowledge element: the practice must be one that the provider knows is unreasonable and is likely to interfere.

Working parts:

• Actors. Three categories under 45 CFR § 171.102: healthcare providers (broad definition including individual practitioners, group practices, hospitals, and most clinical entities); health IT developers of certified health IT; health information networks (HINs) and health information exchanges (HIEs).
• EHI scope. Initially limited to the USCDI v1 subset; expanded on October 6, 2022 to the full EHI definition — any electronic protected health information to the extent that it would be included in a designated record set under HIPAA, with certain exclusions. The Assistant Secretary for Technology Policy / Office of the National Coordinator (ASTP/ONC) maintains the USCDI definition.
• Access, exchange, and use. All three verbs. A practice that interferes with any of the three is potentially blocking.
• Likely to interfere. Objective standard. The rule does not require proof of actual interference; the test is whether the practice is likely to interfere.
• Knowledge standard for providers. Healthcare providers must know the practice is unreasonable. The standard is more lenient than for developers and HINs/HIEs, who face a strict-liability-style "should know" test.

The Part 171 exceptions

The exceptions at 45 CFR §§ 171.201–171.206, 171.301–171.303, and 171.403 define practices that, if every element is met, are not information blocking. The exceptions divide into three groups: exceptions involving not fulfilling requests (Preventing Harm, Privacy, Security, Infeasibility, Health IT Performance, Protecting Care Access); exceptions involving procedures for fulfilling requests (Manner, Fees, Licensing); and the TEFCA Manner exception that applies to actors participating in the Trusted Exchange Framework and Common Agreement.

| Exception | Citation | When it applies | | --- | --- | --- | | Preventing Harm | 45 CFR § 171.201 | Practice is reasonable and necessary to prevent physical harm; meets risk-determination and patient-specific requirements | | Privacy | 45 CFR § 171.202 | Practice protects privacy under federal or state law, including HIPAA, 42 CFR Part 2, state minor-consent laws | | Security | 45 CFR § 171.203 | Practice is reasonable and necessary to protect security; tailored, implemented under organizational policy | | Infeasibility | 45 CFR § 171.204 | Uncontrollable events, segmentation, or other infeasibility; written response within 10 business days | | Health IT Performance | 45 CFR § 171.205 | Practice is necessary to maintain or improve performance; documented; time-limited | | Protecting Care Access | 45 CFR § 171.206 | Practice is reasonable and necessary to reduce risk of legal exposure tied to providing or facilitating reproductive or other lawful care across state lines | | Manner | 45 CFR § 171.301 | Provides EHI in the manner requested, or in a permitted alternative manner if the requested manner is technically not feasible | | Fees | 45 CFR § 171.302 | Charges fees that meet cost-based, uniform, transparent conditions; excludes patient-directed access | | Licensing | 45 CFR § 171.303 | Licenses interoperability elements on reasonable, non-discriminatory terms | | TEFCA Manner | 45 CFR § 171.403 | Actor participates in TEFCA and responds to a TEFCA-routed request in a TEFCA-compliant manner |

Each exception is element-based. Partial fit does not protect the practice. The Privacy Exception, in particular, requires both a recognized privacy interest and one of four sub-bases (state-law precondition, denial of access, individual request, infeasibility of segmentation). Most early enforcement turns on overbroad invocation of the Privacy or Security exceptions without the required elements documented.

How enforcement actually works

Information Blocking enforcement landed in late 2024 with disincentives reaching the practice's MIPS payment, and the practical effect is that a single confirmed determination can convert a positive MIPS adjustment to a substantial negative one. The enforcement architecture:

• OIG investigates. OIG investigates information blocking claims across all actor types. For health-IT developers, HINs, and HIEs, OIG also imposes CMPs up to $1 million per violation under 42 CFR Part 1003, Subpart N. For healthcare providers, OIG's role is investigation and determination — disincentive imposition is handled by CMS.
• CMS applies provider disincentives. After OIG determines that a healthcare provider has committed information blocking, CMS applies the disincentives at 45 CFR §§ 171.1000–171.1002 under the final rule at 89 FR 54662 (July 1, 2024). For MIPS-eligible clinicians, the Promoting Interoperability category is scored zero, materially reducing the overall MIPS final score and the resulting payment adjustment. For eligible hospitals, Medicare EHR Incentive Program eligibility is affected. For ACOs in the Medicare Shared Savings Program, participation eligibility can be revoked.
• ASTP/ONC handles certification nonconformity. For health-IT developers, the Assistant Secretary for Technology Policy / ONC handles certified-product nonconformity actions through the ONC Health IT Certification Program; ASTP/ONC also operates the public complaint portal but does not directly enforce disincentives against provider actors.
• OCR is not the provider disincentive enforcer. While OCR remains the HIPAA Right of Access enforcer (and an Information Blocking refusal that also breaches § 164.524 can independently trigger OCR action), OCR does not impose the Part 171 provider disincentives.
• Complaint portal. Public complaint intake runs through the ASTP/ONC Information Blocking Portal.
• Investigation timeline. OIG investigates the matter, makes a determination, and refers to the appropriate enforcing agency (CMS for provider disincentives, OIG-direct CMPs for developers and HINs/HIEs).

The early 2025 enforcement pattern emerging is documented in OIG's Information Blocking Reports and the ASTP/ONC public-facing materials. The pattern: complaints overwhelmingly come from patients about access requests not honored, second from providers about referrals not honored, third from developers about platform restrictions.

What practices most often miss

Across information-blocking exposures during compliance-binder review, the recurring fact patterns:

• Refusal to send records to patient-chosen third parties. The patient has the right under both HIPAA Right of Access and the Information Blocking Rule to direct records to a third party of their choosing. Refusing to send to a personal Gmail without invoking a documented Security Exception is the pattern that generates the most patient complaints.
• Portal-only access policies. Requiring the patient to use the portal — and only the portal — without alternative paths can fail the Content and Manner Exception if the patient explicitly requests a different format.
• Excessive fees on electronic copies. The Fees Exception requires the fee be cost-based and uniform. Charging more for electronic copies than the OCR Right-of-Access cost limits is a frequent finding.
• Delays on referral-related requests. A referring physician's request for records to support a consultation is a classic interference vector when not fulfilled in a reasonable time. The rule does not specify a deadline — but unexplained delay is the practice that surfaces in complaints.
• Privacy Exception invoked categorically. Treating "all family-member requests" or "all third-party requests" as Privacy Exception cases without the patient-specific element analysis fails the exception.
• Vendor-side restrictions passed through. A practice's EHR vendor restricts data export and the practice accepts the restriction. The restriction is the vendor's potential blocking, but the practice's passive acceptance and failure to push for an alternative path can independently surface.

The practices that survive review document the request, document the response, document the exception relied upon by element, and document the time elapsed. The documentation discipline is the entire game.

State-law overlay

The rule preserves state law that is more protective of privacy. State frameworks that interact with Information Blocking:

• California CMIA at Civil Code §§ 56-56.37 imposes stricter authorization and access timing than HIPAA; Privacy Exception fits the state-law-precondition sub-basis.
• Texas HB 300 / Tex. Health & Safety Code Chapter 181 imposes a 15-business-day electronic-record-access timeline; failure to meet that timeline can independently surface.
• 42 CFR Part 2 for substance-use-disorder records imposes stricter consent requirements that interact with the Privacy Exception — see the 42 CFR Part 2 guide.
• State minor-consent statutes. The Privacy Exception preserves state-law-based parental-access restrictions for adolescent-confidential services.
• State-law breach notification runs independently. An information-blocking-driven disclosure that exceeds the authorization can trigger breach notice under both HIPAA and state breach statutes.

Compliance checklist

For practice-side information blocking compliance:

• [ ] Designated information-blocking compliance lead, named in writing
• [ ] Written information-blocking policy covering each of the eight exceptions, with element-by-element documentation requirements
• [ ] Patient access workflow that honors patient-directed third-party transmission, including reasonable secure channels and patient-acknowledged risk for unencrypted channels
• [ ] Provider-to-provider referral workflow with a defined turnaround target
• [ ] Fee schedule for electronic copies that meets both the Fees Exception elements and the HIPAA Right of Access cost limits — whichever is lower
• [ ] Documentation template for any request not fulfilled in the manner requested, citing the exception by regulation
• [ ] Vendor contract review for EHR and HIN/HIE provisions that could restrict EHI access, exchange, or use
• [ ] Annual workforce training on the rule, the eight exceptions, and the documentation requirements
• [ ] Complaint-intake workflow with a defined response time
• [ ] State-law overlay reviewed for the practice's state and any state where patients are located
• [ ] USCDI v3 and the full-EHI definition incorporated into the practice's data-mapping and access-fulfillment workflows

Restraint about outcomes

The Information Blocking Rule is fact-specific and exception-driven. No vendor or guide can predict how OIG and OCR will evaluate a specific request-and-response on its facts. What rigorous policy, training, and documentation do is materially reduce the likelihood of a complaint, narrow the issues if one surfaces, and position the practice for a defensible exception analysis.

This guide is not legal advice. The exception analysis on any specific information-blocking matter is a legal determination; consult outside healthcare counsel before relying on an exception to decline a request.

How d3rx fits

The d3rx compliance binder holds the source-grounded administrative documentation an information-blocking program is built from — the access-request workflow, the exception-by-exception policy file, the fee schedule, the vendor-contract review log, and the workforce training record. The d3rx audit defense workflow supports OIG, OCR, and ASTP/ONC inquiry handling when a complaint surfaces. d3rx does not represent the practice in any OIG, OCR, or ASTP/ONC proceeding and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.