TRENCHWORK
Interactive · The Access Map

Who holds the key to the record?

Ten years after Congress outlawed information blocking, enforcement finally has a pulse. Run your situation through the checker and see where the rules stand in 2026.

Specimen № 2016

Is this information blocking?

Four taps. The answer updates as you go.

1Who holds the record
2Who's asking
3What they want
4What happened
Risky

Blanket “hold for review” is the textbook violation.

Exception in play
Preventing Harm

An individualized determination, by a licensed clinician, that access is reasonably likely to endanger the life or physical safety of the patient or another person. A policy that delays everything is not that.

This week

Kill blanket holds. Use the harm exception case by case, and write down why.

If it goes wrong: If OIG finds information blocking and refers it to CMS: a zero in MIPS Promoting Interoperability (typically 25% of the MIPS score), hospitals lose three-quarters of the market-basket update, and ACO participants can be barred from MSSP for at least a year.

Orientation, not legal advice. Every exception has conditions this doesn't capture. For a real case, talk to counsel.

Ten years in nine dates

Tap a year. Arrow keys work too.

Jan–Feb 2026

Enforcement gets a pulse

Jan 1: payers must decide prior auths in 72 hours (urgent) or 7 days (standard) with a specific denial reason. Feb 11: ASTP/ONC starts sending nonconformity letters to certified EHR developers over APIs and possible blocking.

Source: Alston & Bird · Information blocking enforcement 2026 →

What a clinic does on Monday

  1. 01

    Release by default.

    Results and notes go out without a hold. Prepare patients at the visit for seeing results before your call.

  2. 02

    Withhold by exception, in writing.

    If you can't name the exception and the condition you met, you don't have one.

  3. 03

    Answer every request.

    Infeasible requests get a written reason within 10 business days. Silence is the one answer that never works.

  4. 04

    Ask your vendor three questions.

    Where is the full EHI export? What does an app connection cost a patient? Who answers when a third party asks for API access?

Read the dispatch behind this map →

Sources

Checked October 2026. HTI-5 was a proposed rule at last check; litigation described is pending and consists of allegations. Orientation only, not legal advice.