Information Blocking Rule Overview (45 CFR Part 171)
The 21st Century Cures Act information blocking provisions and the ONC rule prohibiting actions by providers, health IT developers, and HINs/HIEs that interfere with electronic health information access, exchange, or use.
Primary source
45 CFR Part 171 — eCFR →https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-171
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
45 CFR Part 171 — the Information Blocking Rule promulgated by ONC under the 21st Century Cures Act — prohibits practices likely to interfere with the access, exchange, or use of electronic health information (EHI) by health care providers, health IT developers of certified technology, and health information networks/exchanges (HINs/HIEs).
A practice is information blocking if it is:
- Likely to interfere with, prevent, or materially discourage the access, exchange, or use of EHI; and
- For health IT developers/HINs/HIEs: the actor knows or should know that the practice is likely to do so; for providers: the actor knows the practice is unreasonable and likely to do so.
EHI scope expanded from the USCDI subset to the full Designated Record Set definition on October 6, 2022.
Eight regulatory exceptions at 45 CFR 171.200-303 carve out practices that are not information blocking when each exception's conditions are met. Outside an exception, the activity may be information blocking and subject to enforcement.
Enforcement: HHS OIG investigates and may impose CMPs up to $1M per violation against developers and HINs/HIEs. For providers, CMS imposes "disincentives" — payment reductions and program-eligibility consequences — under separate authority finalized in 2024.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationInformation Blocking Eight Exceptions (45 CFR 171.200-303)The eight regulatory exceptions to information blocking: preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, and licensing.
- RegulationInformation Blocking Actors (45 CFR 171.102)Three classes of actors subject to information blocking: health care providers, health IT developers of certified health IT, and health information networks/exchanges.
- RegulationInformation Blocking Disincentives for Providers (42 CFR 414.1305, 412.140, 482.24)CMS finalized disincentives for providers found to have committed information blocking by HHS OIG, applied through the MIPS Promoting Interoperability category, hospital Promoting Interoperability program, and Medicare Shared Savings Program.
- GlossaryInformation BlockingUnder the 21st Century Cures Act, a practice, action, or interference (other than required by law or covered by an exception) that prevents access, exchange, or use of electronic health information.
- ComplianceHIPAA Right of Access Requests (45 CFR § 164.524): Respond Inside 30 DaysA 2026 HIPAA right-of-access procedure citing 45 CFR § 164.524, the 30-day window, OCR Right of Access Initiative settlements ($3,500–$240,000 through 2025), and the patient response packet.
- ComplianceInformation Blocking Rule (21st Century Cures Act): Compliance for Medical PracticesThe ONC Information Blocking Rule reaches every healthcare provider, with the Part 171 exceptions and CMS-administered provider disincentives that hit MIPS payment. Here is what the rule actually prohibits, the exceptions that apply to practices, and how enforcement landed in 2024.
- GlossaryEHI (Electronic Health Information)Electronic protected health information to the extent that it would be included in a designated record set, plus other identifying health information held by an actor.
- GlossaryPatient PortalA secure web-based application that lets patients access portions of their health information and communicate with the practice.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.