Information blocking

In one line

Information blocking is any practice by a regulated actor that interferes with the access, exchange or use of electronic health information — unless the law requires it or it fits one of the exceptions written into 45 CFR Part 171.

Read that sentence twice. The default flipped. Sharing is the expected behaviour, and not sharing is what you have to justify.

Where it came from

Section 4004 of the 21st Century Cures Act created the prohibition. The regulation took effect 1 May 2020, and the applicability date — the day actors actually had to comply — was moved to 5 April 2021.

There was a deliberate ramp on scope. From 5 April 2021 through 5 October 2022, "electronic health information" for information blocking purposes was limited to the data elements in USCDI v1. From 6 October 2022 that limit fell away: EHI now means the full designated record set, in electronic form. Practically, that took the rule from "share the summary" to "share the chart."

Who is an actor

Only three categories are regulated. If you are not one of them, Part 171 does not bind you.

Actor	Knowledge standard
Health care providers	knows that the practice is unreasonable and likely to interfere
Health IT developers of certified health IT	knows or should know
Health information exchanges (HIEs) and health information networks (HINs)	knows or should know

The higher bar on developers and networks is intentional. A vendor is presumed to understand the consequences of its own product design.

Note also who is not on the list: payers, as such, are not information blocking actors — their obligations come from CMS rules instead. A patient's employer or a research sponsor is not an actor either.

The exceptions

There are ten, in three groups. Meeting an exception means the practice is not information blocking. Missing one does not automatically mean you blocked — but you have lost your safe harbour, and every condition of an exception must be satisfied.

Subpart B — not fulfilling a request

§	Exception	Gist
171.201	Preventing Harm	Withholding to prevent harm to a patient or another person
171.202	Privacy	Withholding to protect an individual's privacy
171.203	Security	Withholding to protect the security of EHI
171.204	Infeasibility	The request genuinely cannot be met
171.205	Health IT Performance	Downtime, maintenance, performance work
171.206	Protecting Care Access	Reducing exposure to legal action over lawfully provided reproductive health care

Subpart C — how you fulfil a request

§	Exception	Gist
171.301	Manner	Limiting the manner of fulfilment, with conditions
171.302	Fees	Charging fees, within defined limits
171.303	Licensing	Licensing interoperability elements on reasonable terms

Subpart D — TEFCA

§	Exception	Gist
171.403	TEFCA Manner	Fulfilling certain requests only via TEFCA

Two notes on history. The Protecting Care Access exception at § 171.206 came from the HTI-3 final rule (17 December 2024). The TEFCA Manner exception was added by HTI-1 to encourage standards-based exchange — and the proposed HTI-5 rule would remove it again. Check the current text before you rely on it.

The Fees and Licensing exceptions are where most commercial disputes land. A vendor may charge for interoperability, but the fee has to be based on objective, non-discriminatory criteria and cannot be a toll designed to make a competitor's integration uneconomic.

Enforcement has teeth

Developers, HIEs and HINs face civil money penalties from the HHS Office of Inspector General of up to $1 million per violation. OIG's rule took effect for these penalties on 1 September 2023, and OIG will not penalise conduct occurring before that date. OIG has said it prioritises practices that cause patient harm, impair a provider's ability to deliver care, run for a long duration, or cause financial loss to federal health care programmes.

Providers are not fined; they get disincentives, set out in Subpart J of Part 171 by a final rule published 1 July 2024 (89 FR 54717). A provider found to have committed information blocking can be:

• deemed not a meaningful EHR user for the Medicare Promoting Interoperability Program (eligible hospitals and CAHs), losing the associated payment;
• deemed not a meaningful EHR user for the MIPS Promoting Interoperability category, which zeroes that score;
• removed from, or denied entry to, the Medicare Shared Savings Program for at least one year — the harshest of the three for a large ACO.

Complaints are filed through ASTP/ONC's information blocking portal; ASTP/ONC refers them to OIG, and OIG refers provider findings on to CMS.

What this means when you build

Design defensively but honestly. Every place your product can refuse a request — a toggle, a fee schedule, an API rate limit, a "we only support our own portal" answer — is a place a complaint can start. Map each refusal path to a named exception and record which conditions you rely on. If you cannot name the exception, you have a design problem, not a legal one.

For coders and HIM staff, the practical rule is simpler: a lawful request for a record is answered promptly, in the form asked for where you can support it, and any delay needs a reason that would survive being read back to you in a complaint.