Information Blocking Rule: What a Medical Practice Must Not Do

A patient asks for a copy of her chart in the health app she uses, and the front desk says the office mails paper copies and has 30 days to do it. That answer sounds careful. Under the federal information blocking rule, it describes two habits that can get a medical practice reported to the government.

ONC, the HHS office that administers the rule, logged 2,450 possible information blocking claims between April 5, 2021 and July 31, 2026, and 1,938 of them named a health care provider as the alleged blocker. Patients filed 1,554. A claim is an allegation, not a finding, but the count shows where complaints land.

This guide reads the rule from the regulation itself: who is covered, the provider knowledge test, the habits that cause trouble, the exceptions, what a finding costs under the 2024 disincentives rule, and where enforcement stands in October 2026.

Why your practice counts as an actor under 45 CFR Part 171

The rule applies to three kinds of "actor": health care providers, developers of certified health IT, and health information networks or exchanges. Your practice is an actor as a health care provider, a term borrowed from the Public Health Service Act that names group practices, physicians, practitioners, therapists and health care clinics.

The definition at 45 CFR 171.102 points to the statute at 42 U.S.C. 300jj, whose list runs from hospitals and pharmacies to a "group practice," "a physician" and "a therapist." Its physician definition is Medicare's, which includes doctors of dental surgery and dental medicine, so a dental office is covered on the same terms as a medical one.

Certified software is not the trigger. ONC's FAQ says the rule applies to a health care provider "regardless of whether any of the health IT the provider uses is certified."

What the rule protects is electronic health information, or EHI: electronic protected health information that would sit in a designated record set. For a provider, that means the medical and billing records kept about patients, plus anything used to make decisions about them (45 CFR 164.501). Psychotherapy notes are excluded, as is information compiled in reasonable anticipation of a legal proceeding.

Until October 5, 2022, EHI was limited to the data elements in the United States Core Data for Interoperability. Since October 6, 2022, it covers the full designated record set, so a scanned referral letter or a billing statement counts the same as a lab value. ONC says draft notes and unconfirmed results may not be appropriate to release until final, but once they are used to make decisions about the patient, they are EHI.

What turns a practice into information blocking: interference plus knowledge

Information blocking has two parts. An act or omission must be likely to interfere with access, exchange or use of EHI, unless a law requires it or an exception covers it. The provider must also know the conduct is unreasonable and likely to interfere, a different test from the one vendors face.

Both halves come from 45 CFR 171.103 and the definitions beside it. To "interfere" means "to prevent, materially discourage, or otherwise inhibit," and a "practice" is any act or omission, so nobody has to ask first. ONC lists omissions that can count, including failing to exchange EHI and failing to make it available.

The knowledge test is where providers differ. A developer of certified health IT or a health information network is information blocking if it "knows, or should know," that its conduct is likely to interfere. A provider is information blocking only if it "knows that such practice is unreasonable and is likely to interfere." Actual knowledge replaces should-have-known, and the provider must know the conduct is unreasonable.

Same definition, different intent test and different consequence. A practice is judged on the provider side.

The "required by law" carve-out matters where a state sets its own rule. ONC says a delay needed to comply with state law is unlikely to be interference, so long as it lasts no longer than necessary. A delay your practice chose for convenience is a different matter.

Exceptions are safe ground: meet every condition of one and the conduct is not information blocking. Miss a condition, and ONC says the conduct is judged case by case rather than condemned automatically. That is a reason to document, not a reason to skip the conditions.

Front-desk and portal habits that can count as interference

Few practices set out to block anything. The usual risks are ordinary habits: a script that makes patients wait, a fee to use the portal, a paper-only rule, a refusal to deal with a patient's app, and a request nobody answers. Each can interfere with access, and each can change this month.

The 30-day line comes from HIPAA's right of access, and ONC has said that meeting another law's deadline does not by itself clear a practice. A practice that could release records sooner, and holds them anyway, can still be interfering. The HIPAA clock and its fee limits are covered in our guide to medical records release.

The results row reaches clinical staff. ONC's FAQ says a policy that delays lab results "for any period of time" so a clinician can review them first is likely interference, and so is a portal that shows nothing after login when the result exists. How to run results under that rule is in the lab result follow-up workflow.

Apps are the newer front. In December 2025, ONC added an FAQ saying that interfering with access by automation technologies, naming robotic process automation and agentic AI, could implicate the rule.

The exceptions a practice can rely on, and what each requires

Part 171 contains 10 exceptions, and 8 of them fit the daily work of a practice: preventing harm, privacy, security, infeasibility, health IT performance, protecting care access, manner and fees. Each protects conduct only when every condition is met at all relevant times, and most expect a written policy or a documented decision.

Eight of the ten exceptions fit daily practice work. Each one only holds if every condition is met.

The other 2, licensing of interoperability elements and the TEFCA manner exception, rarely reach a front desk.

Preventing harm (171.201) requires a reasonable belief that the step will substantially reduce a risk of harm, kept no broader than necessary. A licensed professional with a current or prior clinician-patient relationship must judge the risk individually, unless the data is known or suspected to be misidentified, corrupt or wrong.

Privacy (171.202) covers two front-desk situations. One is a precondition the law requires and nobody has met yet, such as a valid HIPAA authorization or a verified identity; if a patient's form is missing required elements, you must make reasonable efforts to help complete it and may not encourage the patient to withhold it. The other is the patient's own request not to share, documented within a reasonable time.

Security (171.203) protects steps tied directly to safeguarding EHI, tailored to the specific risk and applied the same way to everyone.

Infeasibility (171.204) covers what you truly cannot do, such as a disaster, an internet outage, or data you cannot cleanly separate from information you may not share. The requester gets written reasons within 10 business days. Health IT performance (171.205) allows maintenance downtime for no longer than necessary.

Protecting care access (171.206), added on December 17, 2024, covers withholding specific EHI when a practice believes in good faith that sharing it could expose patients or clinicians to legal action tied to reproductive health care. When the step exists to protect the patient, the patient can override it.

Manner (171.301) says to fulfill a request in any manner requested unless you are technically unable or cannot reach agreeable terms. Otherwise you work down a fixed order: certified technology the requester names, then published standards the requester names, then an agreed machine-readable format.

Fees (171.302) allows cost-based fees set on objective criteria. It never covers a fee HIPAA prohibits for a patient's own copy, or any fee based on a patient's electronic access, meaning an internet-based method that makes EHI available on request with no manual effort. Requests for paper, CD or USB copies can implicate the rule too.

This is a summary of federal text, not legal advice. State law adds its own release rules, so confirm your release policy with counsel before you lean on any exception.

What an information blocking finding costs a practice

For a provider, the consequence is a program disincentive, not a fine. Under a rule in effect since July 31, 2024, HHS OIG refers a finding to CMS, and a MIPS eligible clinician is then treated as not a meaningful EHR user, which zeroes the Promoting Interoperability part of the MIPS score.

For a clinician required to report Promoting Interoperability, that zero lands on a category the rule describes as typically 25 percent of the final score. Its own example: a clinician perfect everywhere else would top out at 75 points, the performance threshold for the 2025 payment year, so the best case is a neutral adjustment. Below the threshold, adjustments turn negative, as far as 9 percent at a score of zero.

Timing follows the referral. CMS applies the disincentive to the performance period of the calendar year in which OIG refers the finding, and MIPS adjusts payment 2 years after the performance year. For example, a referral in 2026 would hit the 2026 performance period and payments in 2028. If OIG finds one clinician in a group responsible, and not the group, CMS would seek to apply it to that clinician.

The other programs carry their own penalties. An accountable care organization, its participants and its providers can be removed from, or denied entry to, the Medicare Shared Savings Program for at least 1 year. A hospital loses the three quarters of its annual market basket increase tied to meaningful EHR use, and a critical access hospital drops from 101 percent of reasonable costs to 100 percent.

If none of those programs reaches your practice, you are still an actor; no provider disincentive applies to you yet. HHS said in the final rule that it intends to add any future disincentives to the same section, 45 CFR 171.1001. Once a disincentive is imposed and any appeal is finished, ONC posts the provider's name, address, conduct and disincentive on its website.

Developers and networks sit on a different track: civil money penalties of up to $1 million per violation.

Where enforcement stands in October 2026

Enforcement became an announced priority in 2025. On September 4, 2025, HHS OIG and ONC issued a joint alert promising more enforcement resources, and ONC's portal had logged 2,450 possible claims by July 31, 2026. A December 2025 proposal to change several exceptions was still not final in October 2026.

The rule is five years old. Provider consequences arrived in 2024 and announced enforcement in 2025.

The alert commits both offices to "intensify enforcement activity, dedicate additional resources, and take decisive action to detect and end information blocking." OIG said it will prioritize conduct that harms patients, significantly impairs a provider's ability to deliver care, lasts a long time, or causes financial loss.

ONC's claims page shows who complains and about whom. Of the 2,450 possible claims logged through July 31, 2026, 1,938 named a health care provider as the potential actor, against 338 naming a listed developer of certified health IT. ONC is careful about the limits: a claim is an allegation, and logging one does not mean an investigation has started.

The rules may still move. On December 29, 2025, ONC published its HTI-5 proposed rule, aimed at "reported misuse and abuse" of the definitions and exceptions. It proposes to:

• State that access and use include automated means, including autonomous AI
• Remove the infeasibility condition for a third party seeking to modify EHI
• Revise or remove the "manner exception exhausted" condition
• Keep the Manner exception from covering contracts that are not at market rate, are contracts of adhesion or include unconscionable terms
• Remove the TEFCA manner exception

Comments closed on February 27, 2026. As of October 3, 2026, no final rule had appeared in the Federal Register, and the eCFR text current through October 1, 2026 still carries the original exceptions, which are the ones that apply until a final rule appears. One naming note: an HHS notice of April 1, 2026 dropped the ASTP title, so "ASTP/ONC" in older documents means the same office.

Build a release policy your front desk, portal and phone line follow

A practice lowers its risk by writing down how EHI leaves the building and making every channel follow the same rules. List each type of request, release as soon as the record is ready, document every exception you use, and give your phone scripts and portal settings the same policy your staff follow.

Start with an inventory: the phone script, the voicemail greeting, the portal's release settings, the fee sheet, the request form and any "we only fax" habit. Run each against the table above. Most fixes are a sentence in a script or a setting in the portal.

Then write down the exceptions you actually use. If a clinician sometimes withholds a note under Preventing harm, the policy should say who decides, on what grounds, and where the decision is recorded. Keep a template for the 10-business-day infeasibility letter so nobody improvises one.

If an AI receptionist or any phone automation answers your line, it follows the same policy. It can take a records request, send the portal or request link, and route anything unusual to the person who owns releases. It should never carry a standing "wait for the doctor's call" rule or interpret a result, the boundary set out in what an AI receptionist does and where it stops. A vendor that handles the request needs a signed business associate agreement first.

Field note

Before your next records or results request

• The phone script, portal settings and fee sheet all follow the written release policy.
• No fee applies to a patient's portal or app access to their own records.
• Each exception you rely on names who decides and where the decision is logged.
• A template letter gives written reasons within 10 business days when a request cannot be met.

Three questions decide most requests. Every path ends with a dated, documented outcome.

Run last week's requests through the path. A request missing a legally required step gets help completing it, with the reason recorded. One covered by a clinician's individual harm determination is withheld only as far as that determination reaches. One you cannot fill as asked gets the set alternatives and a written reason. Everything else is released without delay, and every path ends with a date in the log.

For the phone side of this work, our FAQ on how we handle HIPAA and patient data explains the default design that keeps clinical details out of the system and when we build on vendors that sign a BAA.