Federal rules prohibiting healthcare organizations from restricting patient access to electronic health information have been on the books since 2021. For years, enforcement was limited. That has changed.
Information blocking is a practice by a covered “actor” that is likely to interfere with the access, exchange, or use of electronic health information, except as required by law or specified in a regulatory exception. The law applies to three categories of actors: healthcare providers, health IT developers of certified health IT, and health information exchanges and health information networks.
The Trump administration confirmed in June 2026 that it has begun issuing notices of nonconformity to healthcare organizations found to be blocking patient information, placing some on corrective action plans after they acknowledged noncompliance. More than 2,000 complaints are now under federal review. Here is a look at how the law developed, what it requires and where things stand:
2016
On Dec. 13, 2016, President Barack Obama signed the 21st Century Cures Act into law. Section 4004 of the law established the federal information blocking prohibition. Congress wrote the $1 million per violation civil monetary penalty for health IT developers, exchanges and networks directly into the statute. For healthcare providers, the law directed HHS to establish “appropriate disincentives” through rulemaking rather than setting a dollar penalty. The law also applied different knowledge standards depending on the actor: health IT developers, exchanges and networks are covered if they “know or should know” their practice interferes with information access, while healthcare providers are covered only if they “know” the practice is unreasonable.
2020
In May 2020, the Office of the National Coordinator for Health Information Technology, or the ONC, issued a final rule codifying a definition of information blocking, certain exceptions and a requirement that developers not engage in information blocking as a condition of obtaining and maintaining health IT certification. The rule was delayed due to the COVID-19 pandemic and went into effect April 5, 2021.
2023
On June 27, 2023, HHS-OIG posted its final rule implementing information blocking penalties, establishing the statutory penalties created by the 21st Century Cures Act. If OIG determines that an individual or entity has committed information blocking, they may be subject to up to a $1 million penalty per violation. Enforcement against health IT developers and exchanges began Sept. 1, 2023.
2024
In June 2024, providers found in violation began to face penalties including being stripped of meaningful use status, reduced Medicare payments for critical access hospitals and ineligibility to participate in an ACO for at least one year. HHS finalized the provider disincentives rule on June 24, with penalties effective July 1, 2024.
In December 2024, HHS continued refining the framework. A Dec. 17 final rule addressed information blocking practices that created barriers to competition, innovation and patient access, and expanded exceptions allowing providers to honor a patient’s request not to share electronic health information despite other laws that may compel disclosure.
2025
HHS said it would increase enforcement against healthcare organizations that block access to electronic health information, citing the need to improve patient engagement and protect data rights. The effort directed more resources to addressing information blocking and named the Office of the Assistant Secretary for Technology Policy, ONC and the HHS Office of Inspector General as the agencies leading the initiative.
ONC can also ban a developer of certified health IT from the ONC Health IT Certification Program and terminate the certification of health IT involved in information blocking. If a developer does not meet the requirements of a corrective action plan, its customers lose the ability to access CMS payment incentives.
In December, HHS proposed a rule that would significantly reduce federal health IT certification requirements, revise information-blocking policies and establish a framework to support AI-enabled interoperability. The HTI-5 proposed rule, if finalized, would eliminate more than 50% of ONC’s health IT certification criteria, saving an estimated $1.53 billion and more than 1.4 million developer compliance hours in the first year. The proposal also seeks to revise or remove information-blocking exceptions that could be misused, and aligns with executive orders on deregulation and anti-competitive barriers issued under President Trump.
The public comment period closed Feb. 27, 2026. As of June 24, HHS has not issued a final rule.
2026
By June 2026, enforcement had expanded beyond health IT developers to provider organizations. Thomas Keane, assistant secretary for technology policy at HHS, confirmed the agency has begun issuing notices of nonconformity to organizations found to be blocking information and placing some on corrective action plans. More than 2,000 complaints have been submitted, the OIG is hiring attorneys and conducting investigations, and some organizations have already acknowledged noncompliance.
For health systems, the enforcement trajectory is clear. What began as a rulemaking effort in 2016 is now producing active investigations, corrective action plans and acknowledged violations across the industry.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.