HHS Says It’s ‘Cracking Down’ on Health Information Blocking

The U.S. Department of Health and Human Services says it’s “cracking down” on healthcare providers, health IT developers and health information networks that “block” the exchange, access and use of patients’ electronic health data.

See Also: Using the Netskope HIPAA Mapping Guide

The Trump administration announced on Wednesday that it will be “actively” enforcing information blocking regulations that were authorized under the 21st Century Cures Act of 2016, which was signed into law by President Barack Obama in December 2016 and carries fines up to $1 million.

While information blocking regulations have been on the books for several years, the HHS “crackdown” on health data blocking also appears to be part of the Trump administration’s overall push announced in July to bolster health IT interoperability and patients’ access to their electronic health information (see: HHS Data Plan Aims to ‘Make Health Technology Great Again’).

The Cures Act – which overall aimed to improve coordination of care and patient outcomes through innovation and secure health data exchange, access and use – contains various provisions – including those pertaining to information blocking.

Those Cures Act provisions were fleshed out with final rules during both President Donald Trump’s first term and President Joseph Biden’s administration (see: Information Blocking Patient Records Could Cost Providers).

HHS says the regulations maintain that patients should have easy electronic access to their EHI at no cost, including through apps of their choice, and that healthcare providers should be able to choose the digital tools that help them provide the best care, without excessive costs or technical barriers.

“Unblocking the flow of health information is critical to unleashing health IT innovation and transforming our healthcare ecosystem,” said Jim O’Neill, HHS deputy secretary in a statement. “We will take appropriate action against any healthcare actors who are found to be blocking health data for patients, caregivers, providers, health innovators and others.”

HHS said it is already actively investigating an undisclosed number of cases alleging information blocking by certified health IT developers that participate in HHS’ Office of the National Coordinator’s health IT certification program.

HHS’ information blocking regulations apply to three categories of “actors” – certified health IT vendors, health information exchanges or networks and healthcare providers.

The Cures Act established two different “knowledge” standards for the actors’ practices within the definition of “information blocking.”

For health IT developers of certified health IT, health information exchanges and health information networks, the law applies the standard of whether they know, or should know, that a practice is likely to interfere with the access, exchange or use of EHI.

For healthcare providers, the law applies the standard of whether they know that the practice is unreasonable and is likely to interfere with the access, exchange or use of EHI.

Under the information blocking regulations, the Assistant Secretary for Health Technology, also known as the Office of the National Coordinator for Health IT, has authority to review complaints of possible information blocking against health IT developers of certified health IT.

ASTP/ONC also hosts a portal for the public submission and initial HHS vetting of complaints alleging information blocking.

Separately, the HHS Office of Inspector General has authority to investigate claims of possible information blocking across all types of actors: healthcare providers, health information networks and health information exchanges, and health IT developers of certified health IT.

HHS in 2023 finalized a rule that established civil monetary penalties by the HHS OIG of up to $1 million per violation of information blocking committed by two of actor categories – certified health IT vendors and health information exchanges or networks (see: HHS On Information Blocking Rule Enforcement: Stay Tuned).

HHS ONC also has the authority to decertify and ban from the ONC Health IT certification program health IT developers found in violation of information blocking regulations.

In 2024, HHS issued a final rule for financial disincentives for healthcare providers that come in the form of payment penalties from the Centers for Medicare and Medicaid Services for providers that commit information blocking.

What Constitutes Info Blocking?

Information blocking is defined as a practice that is likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified in one of nine information blocking exceptions that HHS carved out.

HHS’s nine exceptions consist of “reasonable and necessary activities” that do not constitute information blocking. Two of those exceptions are privacy and security.

For instance, if an actor – such as a healthcare provider – does not fulfill a request to access, exchange or use certain electronic health information in order to protect an individual’s privacy – in compliance with a state or federal law requiring a patient to provide consent or authorization for certain disclosures – that could fall under the privacy exception for information blocking.

Under the security exception, it is not considered information blocking for an actor to interfere with the access, exchange or use of EHI to protect the security of that information, provided certain conditions are met. For example, during a security incident, such as a ransomware attack, a healthcare provider might be unable to provide access or exchange to certain EHI for a time, and that would not constitute information blocking.

So, what kinds of information blocking is HHS most likely to target in its enforcement efforts?

“For providers, the most common issue is failure to provide timely, electronic access to a patient’s record,” said Layna Cook Rush, an attorney at law firm Baker Donelson. “We anticipate HHS will focus on access in its investigations and potential enforcement actions related to providers.”

For health IT vendors, it is likely that HHS will focus on the failure to cooperate in returning a customer’s data at the termination of a contract and the failure to make data available on reasonable terms, she said. “Vendors cannot impose unreasonable fees for the return of data or limit production of data to a format that makes it impossible for the provider to use or integrate with other platforms,” she said.

Based on the information blocking rule’s “knowledge” requirements, “HHS may find it significantly easier to bring enforcement actions against health information exchanges/networks and health IT developers,” said regulatory attorney Adam Greene of the law firm Davis Wright Tremaine.

“HHS only needs to prove that these actors knew, or should have known, that their practice was likely to interfere with access, exchange or use of electronic health information,” he said.

In contrast, HHS has the far more difficult task of having to prove that a healthcare provider also knew its practice to be unreasonable, he said.

“For example, while HHS has cautioned that a healthcare provider delaying a patient’s access to test results until after an opportunity to discuss the results is an ‘interference’ and generally does not fall under an exception, the practice is not information blocking under the statute and regulation if the healthcare provider believed the practice to be reasonable,” he said.

Some experts said that HHS’ information blocking enforcement push appears to mesh with the administration’s other recent so-called, “make health technology great again” initiative.

“In light of HHS’s recent focus on interoperability with the announcement of the CMS Interoperability Framework, it is not surprising that HHS also announced increased enforcement of the Information blocking rule,” Greene said.

“The information blocking rule is HHS’s most significant stick when it comes to pushing for increased exchange of health data.”

Nonetheless, to date, HHS’ enforcement of information blocking has been insignificant, Rush said. “Both HHS and OIG have recently issued regulations related to enforcement, but the pivot to active enforcement is new,” she said.

Greene said that it worth noting that although the compliance date for the information blocking regulations was April 2021, the enforcement rules were not published until 2023, with compliance deadlines of Sept. 1, 2023, for health information networks/exchanges and health IT developers, and July 31, 2024, for healthcare providers.

Taking Action

In the administration’s announcement Wednesday, HHS also said it would “increase resources dedicated” to curbing information blocking. HHS did not immediately respond to Information Security Media Group’s request for additional details about the information blocking enforcement plans, including whether HHS would be adding or reallocating staff to focus on the effort.

HHS officials have also previously said its information blocking regulations align with the HIPAA right of access provision allowing patients or their representatives to request and gain timely access to the patient’s health information contained in designated record sets (see: Feds Issue More HIPAA Guidance in Push for Patient Access)

“Now is a good time for healthcare providers, health IT developers and health information networks/exchanges to review their practices, procedures, contracts and configurations to identify friction points that may be interfering with patients and third parties’ lawful real-time access to electronic health information,” Greene said.

Rush suggests that health IT vendors should ensure that both their customer contracts and their policies make returning or exporting customer data straightforward and reasonably priced.

“They should avoid technical barriers that could be perceived as information blocking.”

Also, healthcare providers should ensure that the technology partners and vendors they rely on are actively supporting and not hindering patient access to their health data, she said. “That means vetting vendors carefully to confirm their products and practices comply with the ONC Cures Act’s rules on information blocking.”