Information Blocking Compliance: What Practices Need to Know
The Cures Act information-blocking rules apply to practices of every size. Here's what's required, what the exceptions are, and where practices most often get it wrong.
Healthcare SBC Compliance Team
Compliance & Regulatory ·
The 21st Century Cures Act information-blocking provisions prohibit practices, health IT developers and health information networks from unreasonably interfering with the access, exchange or use of electronic health information.
The rules apply to practices of every size, and the most common violations are unintentional: habits that predate the rule and were never revisited.
What counts as information blocking
- Delaying release of results or records without a permitted reason
- Requiring patients to appear in person or submit paper forms when electronic access exists
- Charging fees for record access that aren't permitted under the rule
- Refusing to share records with another provider treating the same patient
- Configuring systems to make export or exchange unnecessarily difficult
- Contract terms that restrict permitted access, exchange or use of EHI
The eight exceptions
The rule defines exceptions covering situations where withholding information is reasonable: preventing harm, protecting privacy, maintaining security, infeasibility, health IT performance, content and manner, fees, and licensing.
Exceptions are narrow and fact-specific. Relying on one requires meeting its specific conditions and documenting that you did: an undocumented good reason is not a defense.
Where practices most commonly go wrong
The most frequent issue is delaying release of test results so a provider can review them first. Under the rule, results generally must be released to the patient as they become available; a blanket hold policy is not a permitted exception.
The preventing-harm exception is narrower than most practices assume. It requires an individualized determination of likely substantial harm, not a general concern that a patient might be worried by a result.
Practical compliance steps
- Enable immediate electronic release of results and notes through your patient portal
- Document any instance where an exception is invoked, including the specific reasoning
- Review record request workflows to eliminate unnecessary friction and impermissible fees
- Confirm your EHR's patient-access API is enabled and functioning
- Train staff that 'we don't do that electronically' is no longer an acceptable answer
- Review vendor and partner contracts for terms that would restrict permitted exchange