The facts and circumstances of each situation or allegation would need to be evaluated. Whether a practice constitutes information blocking depends on the unique facts and circumstances of the practice. More specifically, information blocking occurs when: an individual or entity engaging in a practice is an actor as defined in 45 CFR 171.102; the practice involves EHI as defined in 45 CFR 171.102; the actor meets the requisite knowledge standard applicable to the type of actor; the practice is likely to prevent, materially discourage, or otherwise inhibit the access, exchange, or use of EHI; the practice is not one that is required by law; and the practice is not covered by an exception under 45 CFR Part 171.

Yes, but only to the extent that the fees for the EHI export comply with the “Fees Exception” (45 CFR 171.302). For example, if the fees to export or convert data from the technology were not agreed to in writing at the time the technology was acquired, then the “Fees Exception” would not be available and such fees could implicate the information blocking definition unless another exception applies (45 CFR 171.302(b)(4)).

Note that if the EHI export would be performed using health IT certified under the ONC Health IT Certification Program (45 CFR Part 170) to the “EHI Export” certification criterion (45 CFR 170.315(b)(10)), a fee that is charged to perform such export for purposes of switching health IT or to provide patients their electronic health information (45 CFR 171.302(b)(3)) would not qualify for the “Fees Exception”.

Yes. On and after April 5, 2021, any actor’s agreements, arrangements, or contracts are subject to and may implicate the information blocking regulations in 45 CFR part 171.

No. The information blocking regulations do not require actors to have or use health IT certified under the ONC Health IT Certification Program. Actors subject to the information blocking regulations are not required to immediately upgrade their certified health IT (as of the applicability date (i.e., April 5, 2021)) if they also happen to participate in a separate regulatory program that requires the use of certified health IT, such as CMS’ Promoting Interoperability Programs.

Please review the questions under the "Electronic Health Information" heading for more information.

The applicability date for the information blocking regulations in 45 CFR part 171 was established in the ONC Cures Act Final Rule, and was subsequently adjusted in the ONC Interim Final Rule. The Interim Final Rule moved the applicability date from November 2, 2020 to April 5, 2021.

The Interim Final Rule also revised the information blocking definition in 45 CFR 171.103 to adjust the timeframe for the “USCDI limitation.” Before October 6, 2022, electronic health information (EHI) for the purposes of the information blocking definition is limited to the EHI identified by the data elements represented in the United States Core Data for Interoperability (USCDI) standard.

Enforcement of the information blocking regulations depends upon the individual or entity that is subject of an enforcement action or "actor." For health IT developers and health information networks/HIEs, the HHS Office of the Inspector General posted its final rule implementing information blocking penalties. For health care providers, HHS has posted its proposed rule to establish appropriate disincentives as directed by the 21^st Century Cures Act. For additional information, see the Disincentives Proposed Rule Overview fact sheet and the Disincentives Common Questions fact sheet.

Updated:

This FAQ has been updated pursuant to the HTI-1 Final Rule.

Yes, an individual’s request for a copy of their EHI in some form of physical media, such as where the EHI is printed to paper or copied onto a CD or USB drive, could implicate the information blocking regulations. The definition of information blocking includes any practice (act or omission by an actor, as defined at 45 CFR 171.102) that is not required by law or covered by an exception and that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI) (as defined at 45 CFR 171.102). Importantly, however, any fee charged for providing this type of access to EHI that does not meet the Fees Exception (45 CFR 171.302) potentially could be considered information blocking.

We have consistently interpreted the broad definition of information blocking in section 3022(a) of the Public Health Service Act to encompass potentially any fee that is likely to interfere with, prevent, or materially discourage the access, exchange, or use of EHI (84 FR 7521, 85 FR 25880). This would include any fees charged to individuals for copies of their EHI furnished on paper or on electronic media (such as CDs or USB drives). To be covered by the Fees Exception, any fee(s) charged for copies of EHI on electronic media or printed to paper must meet all of its conditions, including that fees(s) are not among the list of excluded fees at 45 CFR 171.302(b).  Of note, one of the exception’s conditions ensures alignment with HIPAA in that any fee prohibited by the HIPAA Privacy Rule for an individual’s right of access (45 CFR 164.524(c)(4)) is not covered by the Fees Exception. (84 FR 7540, 85 FR 25886).

No, it would not be information blocking if the actor’s practice of not fulfilling a request in such circumstances meets the Privacy Exception (45 CFR 171.202). All actors remain responsible for disclosing EHI only when the disclosure is allowed under all applicable federal laws. For example, actors who are HIPAA covered entities or business associates must comply with the HIPAA Privacy Rule and any other applicable federal laws that limit access, exchange, or use of EHI in particular circumstances. Adherence to such federal laws is not information blocking, if the other conditions of the Privacy Exception are also met.*

In particular, where federal law such as the HIPAA Privacy Rule does not permit EHI to be used or disclosed unless certain requirements (“preconditions”) are met, then an actor’s practice of not fulfilling a request to access, exchange, or use EHI when these preconditions are not met is not information blocking.*** The Precondition Not Satisfied (45 CFR 171.202(b)) sub-exception of the Privacy Exception outlines a framework for actors to follow so that the actors’ practices of not fulfilling requests to access, exchange, or use EHI would not constitute information blocking when a precondition of applicable law has not been satisfied.

One example that highlights the alignment between the HIPAA Privacy Rule and the information blocking regulations is when a law enforcement official requests records of abortions performed from a clinic. As explained in the “HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care” guidance issued by the Office for Civil Rights, there are certain preconditions that must be met before this disclosure can be made: “If the request is not accompanied by a court order or other mandate enforceable in a court of law, the Privacy Rule would not permit the clinic to disclose PHI in response to the request. Therefore, such a disclosure would be impermissible and constitute a breach of unsecured PHI requiring notification to HHS and the individual affected.” In this example, federal law does not permit the disclosure of EHI unless certain requirements are met, and therefore, the actor’s practice not to disclose EHI would not be information blocking. We note that this is just one example of how the HIPAA Privacy Rule gives individuals confidence that their protected health information, including information relating to abortion and other sexual and reproductive health care, will be kept private. Please see the guidance from the Office for Civil Rights for additional information and examples.

A second example of the alignment between the HIPAA Privacy Rule and the information blocking regulations is in circumstances where the HIPAA Privacy Rule permits a covered entity to use or disclose EHI only following receipt of a valid HIPAA authorization from the individual (patient) or the individual’s personal representative. If an actor does not have a valid HIPAA authorization from the individual or their personal representative that permits the use or disclosure of EHI for the requested purpose, then a precondition for disclosure is not satisfied. Accordingly, the actor’s practice of not disclosing EHI would not be considered information blocking if it is consistent with the requirements of the Precondition Not Satisfied sub-exception.

To emphasize, wherever any federal law requires the authorization of the individual to disclose the EHI, an individual may always choose not to give such authorization, and an actor who does not disclose the EHI would not be information blocking if the actor meets all applicable requirements of the Privacy Exception.

Not necessarily. The information blocking exceptions defined in 45 CFR part 171 are voluntary and offer actors certainty that any practice meeting the conditions of one or more exceptions will not be considered information blocking. However, an actor’s practice that does not meet the conditions of an exception will not automatically constitute information blocking. Instead, such practices will be evaluated on a case-by-case basis to determine whether information blocking has occurred.

Whether information blocking occurred in a particular case would be based on whether:

• the individual or entity engaging in the practice is an "actor" as defined in 45 CFR 171.102;
• the claim involves "EHI" as defined in 45 CFR 171.102;
• the practice was required by law;
• the actor's practice met the conditions of an exception under 45 CFR 171;
• the practice rose to the level of an interference under 45 CFR 171; and,
• the actor met the requisite knowledge standard.

Please note, the knowledge standard varies based on the type of actor.  For health care providers, the standard is that the actor “knows that such practice is unreasonable and is likely to interfere with access, exchange, or use of electronic health information.” For health IT developers of certified health IT and health information networks (HINs) or health information exchanges (HIEs), the standard is that the actor “knows, or should know, that such practice is likely to interfere with access, exchange, or use of electronic health information.” In addition, we recommend review of the examples included in the Final Rule of what is and is not considered interference at 85 FR 25811.

Updated:

This FAQ has been updated pursuant to the HTI-1 Final Rule.

The “Manner” exception does not require the use of any specific standard or functionality. Instead, the “Manner” exception (45 CFR 171.301) outlines a process by which an actor may prioritize the use of standards in fulfilling a request for EHI in a manner that supports and prioritizes the interoperability of the data. This means that, for the purposes of information blocking, before October 6, 2022, an actor could have fulfilled a request with the EHI identified by the data elements represented in the USCDI standard, first in the manner requested and, if not, in an alternate manner agreed upon with the requestor, following the order of priority specified in the exception.

Updated:

This FAQ has been updated to reflect the effective date of the HTI-1 Final Rule.

Anyone who believes they may have experienced or observed information blocking by any health care provider, health IT developer of certified health IT, or health information network or health information exchange is encouraged to share their concerns with us through the Information Blocking Portal on ONC’s website, HealthIT.gov.

Please see the other questions under this heading for more information about reporting claims of potential information blocking. For more information about applicability dates and enforcement dates for the information blocking regulations, please review the question(s) under the “Enforcement” heading.

Updated:

This FAQ has been updated to reflect that we have passed the applicability date (4/5/2021) for the information blocking regulations, and to simplify the internal reference in the final paragraph.

The Cures Act, passed by Congress in 2016, directs ONC to implement a standardized process for the public to report claims of potential information blocking, and gives the HHS Office of Inspector General (OIG) the responsibility of investigating any claim of potential information blocking. Once received, ONC will confirm receipt with the submitter and the report is automatically assigned a tracking number (e.g. IB-XXX). Depending on the facts and details included in the complaint, ONC may contact the submitter for additional information.

ONC has authority to review claims of potential information blocking against health IT developers of certified health IT that may constitute a non-conformity under the ONC Health IT Certification Program. Separately, OIG has authority to investigate claims of potential information blocking across all types of actors: health care providers, health information networks and health information exchanges, and health IT developers of certified health IT. Therefore, upon receiving a claim of potential information blocking, ONC shares the claim with OIG. ONC makes every effort to share these claims of information blocking within two business days of receipt. To contact OIG about a claim of potential information blocking, please use the OIG Hotline via the web at https://oig.hhs.gov/fraud/report-fraud/index.asp or by phone at 1-800-HHS-TIPS (1-800-447-8477).  Please note that the OIG Hotline will not be able to respond to any inquiries about action taken in response to a complaint.  For more information, please see OIG’s Hotline website: https://oig.hhs.gov/fraud/report-fraud/before-you-submit/.

For more information about applicability dates and enforcement dates for the information blocking regulations, please review the question(s) under the “Enforcement” heading.

Yes. Anyone who chooses to report their concerns through the Information Blocking Portal can choose to do so anonymously.

However, if you do submit an anonymous report, we will not be able to contact you, and you will not be able to revisit your report, to add information or clarify your concern. Therefore, it is important to ensure you include all the information that you want us to have about your concern.

In addition, as specified  in the 21^st Century Cures Act, please note that any information received by ONC in connection with a claim or suggestion of possible information blocking and that could reasonably be expected to facilitate identification of the source of the information would fall under protections in section 3022(d)(2) of the Public Health Service Act. These protections limit the public disclosure of the source of the information.