Who holds the key
Ten years after Congress outlawed information blocking, enforcement finally has a pulse. And a primary care practice is on both sides of it.
Information blocking stopped being theoretical in 2026. Certified EHR developers are getting nonconformity letters, vendors face penalties up to $1 million per violation, and practices risk MIPS and ACO disincentives. The working rule for a clinic is short: release by default, and when you withhold, be able to name the exception.
Run a real situation through the information-blocking checker, then walk the 2016–2027 timeline.
The law is ten years old. The 21st Century Cures Act named information blocking in 2016 and told HHS to stop it. (ASTP/ONC) For most of that decade, it sat on a shelf next to every other rule nobody enforced.
That changed this year.
What moved in 2026
On February 11, ASTP/ONC began sending letters of nonconformity to certified EHR developers about API performance, interoperability, and possible blocking. (Alston & Bird) A letter is not a fine. It is the step before one: corrective action, decertification, or referral to OIG, which can fine developers and health information networks up to $1 million per violation.
On January 1, payers in Medicare Advantage, Medicaid, and CHIP went on a clock: 72 hours for urgent prior authorizations, seven days for standard ones, and a specific reason for every denial. (CMS) The APIs that make that data move come due January 1, 2027.
And sitting over all of it is HTI-5, proposed last December. It would cut more than half of the EHR certification criteria and tighten several of the exceptions vendors lean on. It also defines access and use to include automated means. Read that as: AI agents. (ASTP/ONC) As of this writing it is still a proposal.
The practice is on both sides
We are the holder. When a patient's results post at 6 AM, that is the rule working. When an outside app asks for a patient's record through our EHR, we can warn the patient about the app. We generally can't refuse it because we don't like the app.
We are also the requester. Outside records still arrive by fax. Hospital discharge summaries arrive after the follow-up visit, if at all. The same law that tells us to release by default is the law that says the hospital down the road owes us the record.
Providers are not exempt. If OIG finds a practice blocking and refers it to CMS, the practice gets a zero in MIPS Promoting Interoperability (typically a quarter of the score), and ACO participants can be barred from the Shared Savings Program for a year. (CAP)
The fight underneath
The enforcement is the visible part. The fight is commercial. Particle Health sued Epic in 2024 alleging it used its position to choke off competitors' data access; a federal judge let part of that case proceed. (Fierce Healthcare) CureIS filed a similar complaint. (Becker's) Those are allegations, in pending cases. They are also a map of where the pressure is.
What we do on Monday
- Release by default. No blanket holds on results or notes. Prepare patients at the visit for seeing results before the call.
- Withhold by exception, in writing. If we can't name the exception and the condition we met, we don't have one.
- Answer every request. An infeasible request gets a written reason within ten business days. Silence never qualifies.
- Ask the vendor three questions. Where is the full-record export? What does an app connection cost a patient? Who answers when a third party asks for API access?
The record was never ours to keep. It was ours to keep accurate.
I built an interactive version of these rules. Run your own situation through it at the Access Map.
© 2026 TRENCHWORK · Dr. Hemanshu Patel · caremd.ai · Educational use only