Resources

Client Alerts, News Articles, Blog Posts, & Multimedia

Everything you need to know about BMD and the industry.

Important Updates Every Provider Should Know: Information Blocking

Client Alert
November 24, 2020

I. Introduction

In December 2016, Congress passed the 21st Century Cures Act (“Cures Act”) which: (1) authorized funding for the National Institutes of Health to promote medical research and drug development, (2) implemented provisions aimed at addressing the prevention and treatment of mental illness and substance abuse, and (3) reformed certain standards of the Medicare program and federal tax laws to foster healthcare access and quality improvement.

Woven within the Cures Act is Section 4004 titled “Information Blocking.”[1] The purpose of this section is to prohibit any action or practice that interferes with or prevents access to electronic health information (i.e., information about a patient’s medical history or treatment). The law requires the Department of Health and Human Services (“HHS”), through rulemaking, to identify reasonable and necessary activities that do not constitute information blocking.

This Client Alert outlines what constitutes information blocking and provider obligations.  Healthcare providers should be sure to review their HIPAA Plans and related policies and procedures to ensure updated compliance as well as conduct additional training and education to workforce members. 

II. Prohibited Conduct

Under the Cures Act, it is unlawful for anyone to engage in “information blocking,” and such conduct could result in a $1,000,000 civil monetary penalty per violation. “Information blocking” is defined as any practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, and if conducted by a health care provider, such provider knows that the practice is unreasonable and is likely to be considered information blocking.[2]

Examples of information blocking include, but are not limited to, (1) practices that restrict authorized access, exchange, or use of such information for treatment, including transitions between certified health information technologies; (2) implementing health information technology in non-standard ways that are likely to substantially increase the complexity or burden of accessing, exchanging, or using electronic health information; and (3) implementing health information technology in ways that are likely to (a) restrict the access, exchange, or use of electronic health information with respect to exporting complete information sets or in transitioning between health information technology systems; or (b) lead to fraud, waste, or abuse, or impede innovations and advancements in health information access, exchange, and use, including care delivery enabled by health information technology.[3]

III. Regulatory Guidance

On May 1, 2020, the Office of the National Coordinator for Health Information Technology (“ONC”), a subset of HHS, issued a final rule on interoperability, information blocking, and the ONC health IT certification program.[4] This guidance clarified the export requirements of certain electronic health information and outlined actions that are not considered information blocking.

a. Interoperability

In the final rule, the ONC refined the scope of data a health IT module must export, aligned the standards to the definition of electronic health information, and advanced common data through the U.S. Core Data for Interoperability (“USCDI”). The USCDI is a standardized set of health data classes and data elements that are essential for nationwide, interoperable health information exchange.[5] The purpose of this rule is to advance and promote the complete access, exchange, and use of all electronically accessible health information.

The finalized criterion requires a certified health IT module to electronically export all of the electronic health information (further defined to include all protected health information under HIPAA, not including psychotherapy notes or information compiled in reasonable anticipation of a civil, criminal, or administrative action or proceeding) that can be stored at the time of certification by the product, of which the health IT module is a part.[6]

The rule further defines eight different types of clinical notes that must be shared under new USCDI standards: (1) consultation notes, (2) discharge summary notes, (3) history and physical, (4) imaging narratives, (5) laboratory report narratives, (6) pathology report narratives, (7) procedure notes, and (8) progress notes.[7]

b. Information Blocking Exceptions[8]

Pursuant to the Cures Act directive, in the above-mentioned final rule, the ONC developed eight exceptions to information blocking that may be utilized by health care actors (or health care providers, health IT developers, health information networks, and health information exchanges). If an actor engages in one of these exceptions, then such action is not considered information blocking and will not be subject to civil monetary penalties. An actor’s practice that does not fully meet the conditions of an exception will not automatically constitute a violation; practices will be evaluated on a case-by-case basis.

The eight exceptions are further divided into two categories: (1) exceptions that involve not fulfilling requests to access, exchange, or use electronic health information; and (2) exceptions that involve procedures for fulfilling requests to access, exchange, and use electronic health information.

i. Exceptions that Involve Not Fulfilling Requests to Access, Exchange, or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

  • Practices that are reasonable and necessary to prevent harm to a patient or another person.
  • To not fulfill a request to access, exchange, or use electronic health information in order to protect an individual’s privacy.
  • To interfere with the access, exchange, or use of electronic health information in order to protect the security of the electronic health information.
  • To not fulfill a request to access, exchange, or use electronic health information due to the infeasibility of the request.
  • To take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT’s performance for the benefit of the overall performance of the health IT.

ii. Exceptions that Involve Procedures for Fulfilling Requests to Access, Exchange or Use Electronic Health Information

It will not be information blocking for an actor to engage in any of the following actions:

  • To limit the content of its response to a request to access, exchange, or use electronic health information or the manner in which it fulfills a request to access, exchange, or use electronic health information.
  • To charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using electronic health information.
  • To license interoperability elements for electronic health information to be accessed, exchanged, or used.
  • Key conditions:
  • An actor must bring license negotiations to the requestor within 10 business days from receipt of the request and negotiate a license within 30 business days from receipt of the request.
  • The licensing conditions:
    • Scope of rights
    • Reasonable royalty
    • Non-discriminatory terms
    • Collateral terms
    • Non-disclosure agreement

These new regulations and guidance make it imperative providers and health care practices update their HIPAA policies and procedures, especially with the expansion of telehealth and new ways of sharing information between providers and patients.

Please contact a BMD healthcare attorney should you have any questions regarding this final rule, questions regarding information blocking and the sharing of health information, or other general healthcare issues.

[1] Codified at 42 U.S.C. § 300jj-52.

[2] Id. at (a)(1).

[3] Id. at (2).

[4] See 85 Fed. Reg. 25642.

[5] HHS, HHS Finalizes Historic Rules to Provide Patients More Control of Their Health Data, (March 9, 2020), https://www.hhs.gov/about/news/2020/03/09/hhs-finalizes-historic-rules-to-provide-patients-more-control-of-their-health-data.html.

[6] 45 C.F.R. § 170.315(b)(10).

[7] 85 Fed. Reg. 25642, 25674.

[8] A full breakdown of these exceptions can be found, https://www.healthit.gov/sites/default/files/cures/2020-03/InformationBlockingExceptions.pdf.

Amanda L. WaeschKevin CripeHealthcareInformation BlockingCURES ActElectronic Health InformationMedicarehealthcare lawproviders
Client Alert

Ohio House Bill 537: Proposed Regulations for Midwives and Birthing Centers

January 28, 2026House Bill 537, introduced in the Ohio House of Representatives, proposes a comprehensive regulatory framework for certified nurse-midwives, certified midwives, licensed midwives, and traditional midwives. The legislation would clarify scope of practice, establish licensure standards, and impose new requirements for freestanding birthing centers and home births. Healthcare providers and facilities should be aware of the proposed changes and their potential operational impact.Client Alert

Proposed Health Information Privacy Reform Act Expands Protections Beyond HIPAA

January 26, 2026The Health Information Privacy Reform Act (HIPRA) seeks to extend privacy protections to health data not covered under HIPAA, including data collected by apps and wearables. HIPRA introduces broader definitions of protected health information, strengthens privacy and security requirements, establishes patient notification rights, and sets national de-identification standards. Companies processing health data should monitor developments to ensure compliance.Client Alert

Medicare Updates on Skin Substitutes: LCDs Withdrawn, Payment Changes Take Effect

January 23, 2026Medicare’s planned Final Local Coverage Determinations (LCDs) for skin substitutes were withdrawn in late December 2025, meaning previous coverage rules remain in effect. The 2026 Medicare Physician Fee Schedule introduces a single payment rate of approximately $127.14 for these products. Providers should review implications for diabetic foot and venous leg ulcer treatments.Client Alert

Understanding the Seven Core Elements of an Effective Healthcare Compliance Program

January 22, 2026The Affordable Care Act requires healthcare providers participating in Medicare, Medicaid, and CHIP to maintain an effective compliance program. Guidance from the Department of Health and Human Services and the Office of Inspector General outlines seven core elements that form the foundation of these programs, from written policies and compliance oversight to auditing, training, and corrective action. This alert highlights each element and explains how practices can tailor compliance programs to their size and risk profile while meeting federal expectations.Client Alert

Preventing a Board Investigation

January 21, 2026Healthcare professionals in Ohio are subject to licensing board investigations that can lead to disciplinary action. Staying compliant with regulations, documenting carefully, and operating within your professional scope can help prevent issues. If contacted by a board, working with an attorney is critical to protect your license and rights.
Older posts