Information blocking
In short
In the United States, information blocking is a practice by a provider, a certified health IT developer or an exchange network that is likely to interfere with access, exchange or use of electronic health information. The 21st Century Cures Act provides for penalties, and the regulations define exceptions: practices that are not considered blocking. That country's legal definition of interoperability itself requires that there be no information blocking.
- Type
- Concept
- Jurisdiction
- United States
- Reviewed
- October 25, 2026
Explanation
What it is
The 21st Century Cures Act (2016) defines information blocking as a practice that, except as required by law or specified in a regulatory exception, is likely to interfere with, prevent, or materially discourage access, exchange or use of electronic health information (42 U.S.C. 300jj-52). ONC (formerly ASTP/ONC; HHS restored that name on 1 April 2026) regulates it in 45 CFR part 171.
Who it applies to
| Actor | Knowledge standard |
|---|---|
| Developers of certified health IT | Knows or should know the practice is likely to interfere |
| Health information networks and exchanges | Knows or should know |
| Health care providers | Knows the practice is unreasonable and likely to interfere |
Electronic health information (EHI) is electronic protected health information that would be included in a designated record set, whether or not it is held by a HIPAA covered entity. Psychotherapy notes and information compiled for legal proceedings are excluded.
The exceptions
As of October 2026, part 171 has ten exceptions:
| Group | Exceptions |
|---|---|
| Not fulfilling a request | Preventing harm, privacy, security, infeasibility, health IT performance, protecting care access |
| Procedures for fulfilling it | Manner, fees, licensing |
| TEFCA participation | TEFCA manner |
According to HealthIT.gov, using an exception is voluntary, and a practice that fits none is not automatically information blocking: it is analysed case by case.
Penalties
- Developers and networks: civil money penalties of up to USD 1,000,000 per violation, imposed by the HHS Office of Inspector General (OIG).
- Providers: OIG refers them to the appropriate agency for disincentives. The 2024 final rule (effective 31 July 2024) established disincentives in Medicare programmes.
- Transparency: ONC posts on its website the names of providers subject to a disincentive and the practice found to be information blocking.
Changes under way
The proposed HTI-5 rule, published on 29 December 2025, would clarify that access and use include automated means, including autonomous AI systems; remove a condition from the infeasibility exception; adjust the manner exception; and remove the TEFCA manner exception. As of 25 October 2026, it has not been published as a final rule in the Federal Register.
Common misconceptions
- Believing it only affects software vendors. Health care providers are actors too.
- Believing every refusal is blocking. The exceptions cover, for example, privacy, security or preventing harm.
- Applying it outside the United States. It is a legal concept of that country; other jurisdictions regulate data access through other laws.
Usage examples
HHS-OIG can impose penalties of up to USD 1,000,000 per violation on developers and networks; it prioritizes cases that caused or could cause patient harm, lasted a long time or were committed with actual knowledge.
A hospital that OIG determines committed information blocking is not a meaningful EHR user and does not earn three quarters of the Medicare annual market basket increase.
A clinician in Medicare's MIPS programme who is subject to the disincentive gets a zero score in the Promoting Interoperability category.
An accountable care organization (ACO) or its participants can be removed from, or denied approval to participate in, the Medicare Shared Savings Program for at least one year.
The proposed HTI-5 rule (December 2025) would remove the TEFCA manner exception, based on TEFCA's continued implementation and maturation.
Relation to other terms
Relies on3
- Cures ActRequired
The statutory definition of information blocking and its penalties come from section 4004 of the 21st Century Cures Act.
- HIPAAStrong
Electronic health information (EHI) is defined with HIPAA concepts: electronic protected health information included in a designated record set.
- TEFCAMedium
One of the ten current exceptions, the TEFCA manner exception, depends on the parties taking part in TEFCA; the proposed HTI-5 rule would remove it.
Depend on this one0
No glossary term depends on this one.
Sources
- eCFR — 45 CFR Part 171, Information Blockingecfr.gov
- 42 U.S.C. 300jj-52 — Information blocking (U.S. Code, govinfo)govinfo.gov
- HealthIT.gov — Information Blockinghealthit.gov
- HHS-OIG — Information Blockingoig.hhs.gov
- Federal Register — Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking (89 FR 54662, 1 July 2024)federalregister.gov
- Federal Register — ASTP/ONC Deregulatory Actions To Unleash Prosperity (HTI-5 proposed rule, 90 FR 60970, 29 December 2025)federalregister.gov
- Federal Register — HHS Statement of Organization: Office of the National Coordinator for Health IT (91 FR 16204, 1 April 2026)federalregister.gov