What Is Information Blocking Rule?
The Information Blocking Rule, codified at 45 CFR Part 171 under the 21st Century Cures Act, prohibits health care providers, health IT developers, and health information networks from engaging in practices likely to interfere with access, exchange, or use of electronic health information (EHI), subject to ten regulatory exceptions.
- Practices should review their portal release policies, request-fulfillment SLAs, and EHI-export capabilities.
- Any deviation from standard same-time release should be documented against a specific exception.
- CMS is integrating attestation into MIPS and other quality programs.
Information Blocking Rule
Also known as: Info Blocking Rule; ONC Cures Act Final Rule; 45 CFR Part 171
The Information Blocking Rule, codified at 45 CFR Part 171 under the 21st Century Cures Act, prohibits health care providers, health IT developers, and health information networks from engaging in practices likely to interfere with access, exchange, or use of electronic health information (EHI), subject to ten regulatory exceptions.
Definition
Effective April 5, 2021 (and expanded in scope from USCDI v1 to all EHI on October 6, 2022), the Rule prohibits 'information blocking' — a practice by an actor that, except as required by law or covered by an exception, is likely to interfere with the access, exchange, or use of EHI. The ten exceptions now sit in three groups under 45 CFR part 171 (read 17 September 2026): exceptions for not fulfilling a request (Preventing Harm, Privacy, Security, Infeasibility, Health IT Performance, and Protecting Care Access, added at 89 FR 102564 on December 17, 2024); exceptions covering the procedures for fulfilling one (Manner, Fees, Licensing); and the TEFCA Manner exception the HTI-1 final rule added for actors that exchange through TEFCA. The rule launched in 2020 with eight, and the original Content & Manner exception is now simply the Manner exception. HHS OIG has authority to investigate and impose civil monetary penalties up to $1M per violation on health IT developers and HIEs/HINs. CMS-issued provider disincentives took effect in 2024 (Medicare program penalties).
Example
A practice that requires patients to sign a paper authorization to release records via the patient portal, when the records would otherwise flow automatically, may be information blocking unless an exception applies. A specialist who refuses to send a CCD via Direct Trust because 'we only fax' likely cannot satisfy the Infeasibility exception.
Common Misconceptions
The Rule is not 'all-or-nothing' — interference with even a single request can constitute information blocking if not covered by an exception. A common misconception is that delaying release to permit physician review is permitted; under the Rule, that practice is generally prohibited unless the delay falls under the Preventing Harm exception.
Practical Application
Practices should review their portal release policies, request-fulfillment SLAs, and EHI-export capabilities. Any deviation from standard same-time release should be documented against a specific exception. CMS is integrating attestation into MIPS and other quality programs.
Related Terms
21st Century Cures Act
The 21st Century Cures Act is a 2016 federal law whose information blocking provisions, implemented at 45 CFR part 171, prohibit health care providers, health IT developers of certified health IT, and health information networks and exchanges from interfering with the access, exchange or use of electronic health information.
Read definitionFHIR
FHIR (Fast Healthcare Interoperability Resources) is an HL7 standard for exchanging healthcare information using modern web technologies (RESTful APIs, JSON/XML, OAuth 2.0), used for clinical data exchange, patient access APIs, and increasingly for prior-authorization and quality reporting.
Read definitionEHR (Electronic Health Record)
An Electronic Health Record is a digital, longitudinal record of a patient's health information maintained by a healthcare organization, designed to be shared across providers and care settings, and to support clinical decisions, billing, and quality reporting.
Read definitionHIPAA
HIPAA is the 1996 federal law that establishes national standards for protecting the privacy and security of individually identifiable health information held by covered entities and their business associates.
Read definitionWhere This Applies on MedPrecision
Need help with billing?
If this term is showing up in your denials, EOBs, or A/R aging, we can help. Get a free billing audit and we will trace the issue to its root cause.
- No contract
- No setup fees
- Reply within 1 business day