Information Blocking Enforcement Has Started. Is Your Practice's Records Process Ready?

A patient asks for her complete record, including recent notes, to share with a second-opinion specialist and a health app. The front desk says records go out on paper, in about a month, after the physician signs off. In 2026, that answer can turn into a federal information blocking claim.

The short answer: yes, the information blocking rules apply to physician practices. HHS has begun active enforcement, starting with health IT developers, and provider disincentives have been in effect since July 31, 2024. A practice that unreasonably delays, restricts or discourages access to electronic health information (EHI) risks Medicare program disincentives, and patients can report it online. The fix is mostly operational: a written release process, clear use of the exceptions, and systems that can actually deliver records electronically. The HTI-5 final rule released on October 26, 2026 did not change those provider obligations.For practices looking to improve electronic health information exchange, investing in reliable healthcare interoperability solutions can help connect clinical systems, streamline data sharing, and support better access to patient records.

What Is Information Blocking, and Does It Apply to Practices?

The 21st Century Cures Act of 2016 prohibits practices that are likely to interfere with the access, exchange or use of EHI, unless an exception applies. Health care providers are one of the "actors" covered, alongside health IT developers and health information networks.

Since October 6, 2022, the rule has covered all EHI in a practice's designated record set, not just the narrower USCDI data elements, as the AMA explained on October 25, 2022. In practical terms, that includes notes, results and most of what sits in your EHR.

For example, connected healthcare platforms can make it easier for patients and providers to access medical information across different systems. Softnotions' Medivision healthcare case study demonstrates how digital solutions can support patient report access, centralized booking management, and laboratory information integration.

The rule does not require a practice to push everything out automatically. An ASTP/ONC FAQ (last updated September 2025) says actors are not required to proactively make EHI available. Once a patient requests it, though, the response must be timely, and patients can access results such as lab values in parallel with the clinician. A separate FAQ (September 14, 2025) adds that blanket delays affecting a broad range of routine results do not qualify for the Preventing Harm exception.

What Changed in 2025 and 2026?

For years, enforcement was mostly theoretical. That has changed:

• September 3, 2025: HHS announced a crackdown on information blocking, directing resources to active enforcement led by ASTP/ONC and the HHS Office of Inspector General (OIG).

• February 2026: At the ASTP annual meeting, officials said notices of investigation were going to health IT developers, as Holland & Knight reported on February 13, 2026. Complaint data is being shared with OIG, according to Healthcare Dive (March 5, 2026).

• July 2026: The federal portal had logged 2,450 possible information blocking claims between April 2021 and July 31, 2026, according to ASTP/ONC's claims data.

• October 26, 2026: HHS released the HTI-5 final rule, which mainly reduces certification requirements for health IT developers. ASTP/ONC said comments on HTI-5's information blocking proposals "remain under consideration." HealthSystemCIO reported the same day that the current rules still apply. It also said a proposed HTI-6 rule is listed for November.

Providers should not read deregulation as relief. In the first ASTP/ONC claims analysis (February 2022), 211 of 274 claims were against health care providers, and patients or their attorneys filed 64% of them.

The pending proposals point in a stricter direction, not a looser one. According to McDermott Will & Schulte (January 7, 2026), HTI-5 proposed narrowing parts of the infeasibility exception and removing the TEFCA manner exception. Those changes are not final, but they signal where policy is heading.

What Are the Penalties for Physician Practices?

Providers do not face the civil penalties of up to $1 million per violation that apply to developers and networks, as Holland & Knight notes. Instead, the HHS disincentives rule, effective July 31, 2024, works through CMS programs, as the Texas Medical Association summarizes (updated July 22, 2026):

• MIPS: an eligible clinician or group found to have committed information blocking loses meaningful EHR user status and receives a zero in the Promoting Interoperability category.

• Medicare Shared Savings Program: an ACO, ACO participant or supplier may be barred for at least one year and lose shared savings.

• Public listing: providers found to have committed information blocking are posted on the ASTP/ONC website.

HHS has said more disincentives could follow through future rulemaking. Separately, CMS has proposed ending MIPS after the 2028 performance year, as Medical Economics reported (September 28, 2026), so the mechanism may change, but the underlying Cures Act prohibition remains in law.

This article is general information, not legal advice. Confirm your obligations with counsel, especially where state law restricts release of certain records.

How Is Information Blocking Different From HIPAA Right of Access?

The two rules overlap, but they are not the same. HIPAA Right of Access vs. Information Blocking Rule

• Who Enforces: The HIPAA Right of Access is enforced by the HHS Office for Civil Rights (OCR), while the Information Blocking Rule is overseen by ASTP/ONC and the Office of Inspector General (OIG). CMS applies provider disincentives.

• Who Can Request: Under HIPAA Right of Access, individuals or their personal representatives can request access to their health information. Under the Information Blocking Rule, patients, healthcare providers, apps, and other authorized parties can request access, exchange, or use of electronic health information.

• Timing: HIPAA generally requires practices to provide access within 30 days, with one possible 30-day extension. The Information Blocking Rule does not specify a fixed response deadline, but unnecessary delays may be considered interference.

• What Is Covered: HIPAA Right of Access covers protected health information (PHI) maintained in a designated record set, while the Information Blocking Rule covers electronic health information (EHI) in a designated record set.

• Main Consequences for Practices: Failure to comply with HIPAA Right of Access can result in settlements and financial penalties. Violations of the Information Blocking Rule may lead to program disincentives for healthcare providers and public listings.
  

Right of access enforcement is also active. On October 8, 2026, OCR announced a $140,000 settlement with a Pennsylvania dental practice, its 56th Right of Access action, after the practice failed to provide a patient's records in a timely way despite multiple requests.
Meeting HIPAA's 30-day limit does not by itself rule out information blocking if you could deliver the record electronically much sooner

Which Everyday Practices Create the Most Risk?

Most risk comes from habits, not policy:

• Releasing records only on paper or CD when an electronic option exists.
• Holding all results until a physician reviews them. Blanket holds do not qualify for the Preventing Harm exception, which needs an individualized determination for a specific patient.
• Refusing to connect with a patient-chosen app, or demanding unusual paperwork before release.
• Charging fees for electronic access that the Fees exception does not support.

• Contract or interface terms that make it hard for other providers to receive data.
  

Illustrative scenario (hypothetical): A six-physician internal medicine group in Austin finds that its release-of-information vendor sends everything by mail and that clinicians hold every result for review. The group ends its blanket hold on results and asks counsel whether any Texas law requires a delay. Holds are limited to individual cases where a clinician documents a specific risk to the patient's life or physical safety. The group also asks its EHR vendor to enable electronic export to patient-chosen apps. It then writes a one-page procedure for staff on handling requests the portal cannot meet.

How Should a Practice Prepare? A Readiness Checklist

• Name an owner for EHI requests across the front desk, release-of-information vendor and IT.
• Map every channel patients and providers use to request records, and the response time for each.
• Write a release policy that matches what staff actually do, then train on it.
• Document when and how you rely on each information blocking exception in 45 CFR Part 171, including the Protecting Care Access exception added by HTI-3 in December 2024, and keep the records.
• Replace any automatic delay on result release with case-by-case decisions that meet an exception or state law.
• Confirm with your EHR vendor what electronic export, patient-app access and API connections you can offer today.
• Check vendor contracts and fees for terms that could restrict exchange.
• Audit a sample of requests each quarter for timeliness and completeness.
  

How Softnotions Can Help

A release policy only holds if your systems can deliver records the way patients and partners ask for them. Our engineers work on that technical side:

• Integration and data access: connecting EHRs, release-of-information tools and patient-facing apps through HL7, FHIR and secure APIs, as outlined on our healthcare interoperability page.
• Request tracking: building audit-ready logs of each request, response time and exception used, through our data platform and integration engineering services.

• Security alongside access: access controls, monitoring and governance, so wider access does not create new exposure, supported by our healthcare cybersecurity and compliance work.

We often do this through Forward Deployed Engineering, with engineers working inside your real operating environment and existing systems rather than handing over a design and leaving.

Information blocking is no longer a rule practices can file away. HHS is investigating, patients are filing claims, and the HTI-5 final rule left provider obligations in place while more rulemaking is planned. The practices best placed are the ones whose release process is written down, followed and backed by systems that can deliver EHI electronically.

If you want a second pair of eyes on how records move in and out of your practice, book a free consultation with our team and we will review your release workflow with you.