Information Blocking Rule (45 CFR Part 171): Cures Act Actors, EHI Scope, OIG Penalties, and CMS Disincentives

Information blocking is a statutory prohibition enacted by Congress under Section 4004 of the 21st Century Cures Act (Public Law 114-255; 42 U.S.C. § 300jj-52) and codified by the Office of the National Coordinator for Health Information Technology (ONC, now the Assistant Secretary for Technology Policy [ASTP]) at 45 CFR Part 171. Under 45 CFR § 171.103, information blocking is defined as any practice by a regulated Actor that—except as required by state or federal law or covered by one of the ten Information Blocking Exceptions—is likely to interfere with, prevent, or materially discourage the access, exchange, or use of Electronic Health Information (EHI).

Unlike the HIPAA Privacy Rule (45 CFR § 164.524)—which gives covered entities up to 30 calendar days to fulfill an individual’s right-of-access request and generally permits (rather than mandates) disclosures for treatment, payment, and health care operations—the Information Blocking Rule establishes an affirmative regulatory baseline across certified EHR technology, health information exchanges, and clinical care delivery: EHI must be shared without unreasonable delay, technical obstruction, or discriminatory fees whenever access, exchange, or use is legally permissible.

The Three Regulated Actor Categories and Scienter (Knowledge) Standards

The Information Blocking Rule does not apply to every entity in the healthcare ecosystem; it regulates three statutory categories of Actors defined in 45 CFR § 171.102, applying distinct statutory knowledge (scienter) standards under 45 CFR § 171.103(a)(2)–(3):

Actor Category (45 CFR § 171.102)	Scope of Entities Included	Statutory Knowledge Standard (45 CFR § 171.103)	Primary Enforcement Authority
1. Health IT Developer of Certified Health IT	Any individual or entity (other than a healthcare provider that self-develops health IT not offered to others) that develops or offers health IT certified under the ONC Health IT Certification Program (45 CFR Part 170)	Knows, or should know, that such practice is likely to interfere with access, exchange, or use of EHI	HHS OIG Civil Monetary Penalties up to $1,000,000 per violation (42 CFR Part 1003) & ONC Certification Ban/Termination
2. Health Information Network (HIN) or Health Information Exchange (HIE)	Any individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of any technology or services for access, exchange, or use of EHI among more than two unaffiliated individuals or entities	Knows, or should know, that such practice is likely to interfere with access, exchange, or use of EHI	HHS OIG Civil Monetary Penalties up to $1,000,000 per violation (42 CFR Part 1003)
3. Health Care Provider	Cross-references the Public Health Service Act definition (42 U.S.C. § 300jj(3)): hospitals, skilled nursing facilities, nursing facilities, home health entities, clinics, community mental health centers, laboratories, pharmacies, therapists, and physicians/practitioners	Knows that such practice is unreasonable and is likely to interfere with access, exchange, or use of EHI	OIG investigation referral to CMS for Provider Disincentives (89 FR 54662; Promoting Interoperability, MIPS, MSSP)

Scope of Electronic Health Information (EHI) Under 45 CFR § 171.102

During the initial transitional period (April 5, 2021 through October 5, 2022), ONC limited the regulatory definition of EHI to the data classes and elements represented in the United States Core Data for Interoperability (USCDI v1). Beginning October 6, 2022, the transitional limitation expired, and EHI expanded to its full statutory scope under 45 CFR § 171.102:

• Alignment with the HIPAA Designated Record Set (DRS): EHI means electronic protected health information (ePHI) as defined in 45 CFR § 160.103 to the extent that it would be included in a Designated Record Set as defined in 45 CFR § 164.501, regardless of whether the group of records is used or maintained by or for a HIPAA covered entity.
• Records Included in EHI: Medical records, billing and claims records, enrollment/payment/claims adjudication records, clinical laboratory test reports, diagnostic imaging reports and images, clinical notes, problem lists, medication histories, and any other electronic record used in whole or in part to make decisions about individuals.
• Explicit Statutory Exclusions from EHI: Under 45 CFR § 171.102, EHI explicitly excludes: (1) psychotherapy notes as defined in 45 CFR § 164.501 (recorded by a mental health professional documenting or analyzing the contents of conversation during a private, group, joint, or family counseling session and maintained separately from the rest of the medical record), and (2) information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. De-identified data (meeting 45 CFR § 164.514(b) standards) is also outside the definition of EHI.

Enforcement Architecture: OIG Civil Monetary Penalties vs. CMS Provider Disincentives

The 21st Century Cures Act bifurcated enforcement remedies depending on which type of Actor committed the violation:

1. HHS OIG Civil Monetary Penalties for Developers and HINs/HIEs (88 FR 42820)

On July 3, 2023, the HHS Office of Inspector General (OIG) published its final enforcement rule (88 FR 42820, codified at 42 CFR Part 1003, Subpart N), effective September 1, 2023. For Health IT Developers of Certified Health IT (including health systems that license certified EHR modules to unaffiliated community practices) and HINs/HIEs, OIG may impose Civil Monetary Penalties of up to $1,000,000 per violation (adjusted annually for inflation). OIG prioritizes enforcement investigations involving practices that: (i) caused or could cause patient harm, (ii) significantly impacted a provider’s ability to care for patients, (iii) were of long duration, (iv) caused financial loss to Federal health care programs, or (v) were performed with actual knowledge.

2. HHS/CMS Disincentives for Health Care Providers (89 FR 54662)

On July 1, 2024, HHS and CMS published the final rule establishing “Appropriate Disincentives” for Health Care Providers determined by OIG to have committed information blocking (89 FR 54662, effective July 31, 2024):

• Medicare Promoting Interoperability Program (Eligible Hospitals & CAHs): An eligible hospital or Critical Access Hospital (CAH) referred by OIG is not a meaningful EHR user for the applicable EHR reporting period. For subsection (d) hospitals, this results in the loss of 75% of the annual market basket increase to the inpatient prospective payment system (IPPS) update; for CAHs, Medicare reimbursement is reduced from 101% to 100% of reasonable costs.
• Merit-based Incentive Payment System (MIPS Eligible Clinicians): A clinician or group (when the group reports together) referred by OIG is not a meaningful EHR user and receives a score of zero (0 points) in the MIPS Promoting Interoperability performance category (which normally accounts for 25% of the MIPS Final Score), without reweighting to other categories.
• Medicare Shared Savings Program (MSSP Accountable Care Organizations): An ACO, ACO participant, or ACO provider/supplier determined by OIG to have committed information blocking may be denied participation or terminated from the Medicare Shared Savings Program for at least 1 consecutive performance year.

Summary of the 10 Regulatory Exceptions (45 CFR Part 171, Subparts B, C, and D)

When an Actor’s practice satisfies all objective preconditions and conditions of an exception in 45 CFR Part 171 Subparts B, C, or D, the practice is legally deemed not to constitute information blocking:

1. Preventing Harm Exception (§ 171.201): Withholding EHI when a licensed healthcare professional makes an individualized determination (or relies on a flagged corrupt/misidentified data error) that access will endanger the life or physical safety of the patient or another person.
2. Privacy Exception (§ 171.202): Not fulfilling a request in order to comply with a state or federal privacy law precondition (such as HIPAA Authorization or 42 CFR Part 2 consent) or honoring an individual’s requested privacy restriction.
3. Security Exception (§ 171.203): Applying tailored, non-discriminatory organizational security policies directly related to specific confidentiality, integrity, or availability risks.
4. Infeasibility Exception (§ 171.204): Declining a request due to uncontrollable events, inability to unambiguously segment requested EHI from withheld EHI, third-party modification requests (outside treatment/HIPAA amendment rights), or infeasible manner after exhausting alternative manners (with written response within 10 business days).
5. Health IT Performance Exception (§ 171.205): Temporarily taking health IT offline or throttling third-party apps that degrade system performance in a non-discriminatory manner.
6. Protecting Care Access Exception (§ 171.206): Added in the HTI-1 / reproductive healthcare privacy rulemaking to protect good-faith restrictions reducing legal exposure risk tied to lawful reproductive health care.
7. Manner Exception (§ 171.301): Fulfilling a request in an alternative machine-readable format (HL7 FHIR, C-CDA, USCDI, or EHI export) when the Actor cannot technically fulfill the requestor’s requested manner or reach agreeable commercial terms.
8. Fees Exception (§ 171.302): Charging objective, cost-recovery-based fees that exclude opportunistic profit margins and completely prohibit fees for patient electronic access or HIPAA right-of-access exports.
9. Licensing Exception (§ 171.303): Negotiating reasonable and non-discriminatory (RAND) IP licenses for interoperability elements within 10 to 30 business days.
10. TEFCA Manner Exception (§ 171.403): Limiting fulfillment to exchange via the Trusted Exchange Framework and Common Agreement (TEFCA) when both the Actor and requestor participate in TEFCA and the EHI is not already accessible via FHIR APIs.

Implications for Clinical Research Informatics and EHR Release-of-Information

In academic medical centers, the Information Blocking Rule transformed two operational workflows:

• Immediate Release of Laboratory, Pathology, and Imaging Results: Health systems may no longer configure blanket organizational holds (such as holding all oncology pathology or genetic test results in the patient portal for 72 hours pending physician review). Under the Preventing Harm Exception (§ 171.201), a delay is permissible only when a clinician makes an individualized determination of substantial risk of physical harm (not emotional distress), or when EHI is temporarily withheld from a patient during a blinded clinical research study in which the patient consented to temporary withholding until unblinding.
• Research App & Registry Connectivity via SMART on FHIR: When a patient uses a patient-facing clinical research application via ONC-certified § 170.315(g)(10) SMART on FHIR APIs to pull their own EHI into a longitudinal study, an EHR developer or health system cannot block the app’s registration or charge the patient or researcher an API access fee unless a strict Security Exception threat is documented.

Frequently Asked Questions

What is the Cures Act Information Blocking Rule?

Enacted under Section 4004 of the 21st Century Cures Act (42 U.S.C. § 300jj-52) and codified by the Office of the National Coordinator for Health Information Technology (ONC/ASTP) at 45 CFR Part 171, the Information Blocking Rule prohibits practices by regulated healthcare Actors that—except as required by law or covered by a regulatory exception—are likely to interfere with, prevent, or materially discourage access, exchange, or use of Electronic Health Information (EHI).

Who are the covered actors (health IT developers, HIEs/HINs, providers) under 45 CFR Part 171?

Under 45 CFR § 171.102, the Information Blocking Rule regulates three categories of Actors: (1) Health IT Developers of Certified Health IT, (2) Health Information Networks (HINs) and Health Information Exchanges (HIEs), and (3) Health Care Providers (as defined in 42 U.S.C. § 300jj(3), including hospitals, clinics, laboratories, pharmacies, and clinicians). Health IT developers and HINs/HIEs are held to a “knows or should know” standard, whereas Health Care Providers are held to an actual knowledge standard (“knows that such practice is unreasonable and is likely to interfere”).

What are the OIG civil monetary penalties and CMS provider disincentives for information blocking?

Under the HHS Office of Inspector General (OIG) final rule (88 FR 42820, 42 CFR Part 1003), Health IT Developers of Certified Health IT and HINs/HIEs face Civil Monetary Penalties (CMPs) of up to $1,000,000 per violation. Under the HHS/CMS Disincentives Final Rule (89 FR 54662, effective July 31, 2024), Health Care Providers determined by OIG to have committed information blocking face Medicare programmatic disincentives across the Hospital Promoting Interoperability Program (losing 75% of the annual market basket increase), the MIPS Promoting Interoperability category (receiving a 0% category score), and the Medicare Shared Savings Program (ACO participation ban for at least 1 year).