What is Information Blocking? Definition, Formula, and Benchmark

Information Blocking is a federal regulatory concept defined by the 21st Century Cures Act and ONC's implementing regulations as any practice by a healthcare provider, health IT developer of certified health IT, health information exchange, or health information network that is likely to interfere with the access, exchange, or use of electronic health information, except as required by law or as permitted by an exception.

The concept was codified in response to longstanding industry concerns that data-sharing frictions — vendor-created or provider-created — were limiting interoperability despite technical standards being available. Information Blocking regulations make such frictions potentially illegal, with enforcement mechanisms including CMS Medicare participation, OIG civil monetary penalties, and specific technical-certification consequences.

Practices that potentially constitute information blocking include fees that charge patients or other providers for electronic access beyond regulatory allowances, requirements for business-associate or data-use agreements that are disproportionate, configuration choices that prevent use of certified FHIR APIs, contractual provisions that restrict data-sharing, and delays or refusals without a defined exception.

The rule defines specific exceptions under which behavior that might otherwise constitute information blocking is permitted. These include preventing harm (withholding data that could cause physical harm to the patient or another person), privacy (honoring patient requests for restrictions), security (preventing access that would compromise data security), infeasibility (technical inability to fulfill requests), health IT performance (temporary unavailability for maintenance), content and manner (reasonable restrictions on content type and delivery method), fees (reasonable cost-recovery within defined limits), and licensing (appropriate intellectual property protections).

Compliance requires providers and vendors to carefully evaluate practices. A provider refusing to share records with a competing practice due to a business dispute is likely information blocking. A provider charging a fee exceeding cost-recovery limits for patient-access records is likely information blocking. A vendor configuring FHIR APIs in ways that prevent app access is likely information blocking. Each of these situations requires analysis against the specific exception criteria.

Enforcement mechanisms vary by entity type. Health IT developers and HIEs face OIG civil monetary penalties (up to $1M per violation). Healthcare providers face Medicare participation consequences. The specific enforcement infrastructure continues to develop as CMS and OIG operationalize the statutory authorities.

For RCM and healthcare-operations leaders, information-blocking compliance has become a top-of-mind regulatory topic. Routine practices around data-sharing fees, release-of-information delays, vendor-contract terms, and API-access configuration should be audited against the rule. Missteps can be consequential. Several high-profile enforcement actions in 2024 have clarified enforcement direction.