Applicability framework.

"Actors" subject to information blocking rule are: healthcare providers (hospitals, medical practices, nurses, other clinicians), health IT developers of certified health IT (EHR vendors with ONC certification), and health information networks / health information exchanges (HIEs).

"Information blocking" is a practice that, except as required by law or covered by an exception, is likely to interfere with access, exchange, or use of electronic health information (EHI). For health IT developers and HIEs, the standard is "knows or should know"; for providers, it's "knows."

Enforcement structure: health IT developers and HIEs face potential civil monetary penalties up to $1M per violation (enforced by HHS OIG). Healthcare providers face "disincentives" — Medicare payment adjustments rather than direct monetary penalties. ONC information blocking guidance.

Practices that aren't information blocking.

The rule establishes eight exceptions — specific categories of practices that, when they meet the exception's conditions, don't constitute information blocking even if they interfere with access or exchange:

• Preventing Harm Exception — practices reasonably necessary to prevent harm to a patient or another person.
• Privacy Exception — practices necessary to comply with privacy laws (HIPAA, state privacy laws, etc.).
• Security Exception — practices necessary to address security of EHI (reasonable and appropriate security measures).
• Infeasibility Exception — practices where meeting a request isn't feasible under specific circumstances.
• Health IT Performance Exception — practices reasonably necessary to maintain or improve health IT performance.
• Content and Manner Exception — providing EHI in alternative manner when requested manner isn't available.
• Fees Exception — charging fees for certain activities that meet specific conditions (reasonable, cost-based).
• Licensing Exception — licensing of interoperability elements on reasonable terms.

Each exception has specific conditions that must be met. Exceptions aren't blanket protections; they require meeting specific criteria for the specific practice. ONC exceptions guidance.

What information blocking compliance looks like operationally.

Patient access to records

Patients are entitled to their EHI. Patient portal access should be accessible and not encumbered by unnecessary friction. Release of records to patients should follow HIPAA timelines (30 days, with limited extension available) without being stretched into information blocking territory. Fees for patient records should follow HIPAA and information blocking rule fee requirements.

Provider-to-provider exchange

Records requested by other healthcare providers for patient care should be shared without unnecessary obstacles. Common historical practices (long delays, excessive fees, requiring paper release forms for electronic exchange, requiring providers to jump through hoops to receive electronic records) are now information blocking exposure.

App and third-party access

Patient-authorized app access to EHI via FHIR APIs is a common information blocking concern. Providers shouldn't prevent patient apps from accessing patient records simply because the provider doesn't want third parties to have data. Legitimate concerns (security, app authenticity) can fit within exceptions; general reluctance does not.

EHR configuration

EHR configuration that unnecessarily restricts EHI access (overly restrictive role permissions, disabled interoperability features, restrictive patient portal configuration) can constitute information blocking. Reviewing EHR configuration for information blocking exposure is practical compliance work. See our EHR consulting scope.

Documentation of exceptions

When practices deny or delay EHI access citing an exception, documentation of the specific exception and how its conditions are met protects the practice. Generic "we don't share that" responses without specific exception justification create information blocking exposure.

Information blocking rule and HIPAA work together.

HIPAA and information blocking rule are distinct but aligned. HIPAA Privacy Rule provides patient right of access; information blocking rule reinforces that right with additional structure preventing practices from unreasonably restricting it. Generally compliance with HIPAA patient access obligations reduces information blocking exposure.

Where HIPAA requires withholding information (psychotherapy notes, some PHI about third parties, etc.), the information blocking rule's Privacy Exception typically covers the practice. Where state law requires restrictions (some mental health protections, 42 CFR Part 2 for SUD records), those restrictions are compatible with the Privacy Exception.

Key principle: comply with HIPAA patient access obligations without adding restrictions that HIPAA doesn't require. Practices that use HIPAA as cover for general reluctance to share information face information blocking exposure; practices that comply with HIPAA's access mandate generally satisfy information blocking rule. See our HIPAA compliance page.