Information blocking compliance lived in EHR defaults

The week

Monday, April 5, 2021, was the applicability date, meaning the day the rules actually started to bite, for the information blocking provisions of the ONC Cures Act Final Rule. ONC is the Office of the National Coordinator for Health Information Technology, the federal office that sets standards for health software. It issued the rule in 2020 under the 21st Century Cures Act, a sweeping federal health law that, among much else, told the health industry to stop sitting on patients’ data. The date had originally been November 2020, but it was pushed back because of the pandemic.

The road to that Monday was long. Congress passed the Cures Act in December 2016, and it defined information blocking and directed HHS to identify reasonable exceptions. ONC proposed its rule in early 2019 and published the final version on May 1, 2020. In late October 2020, an interim final rule moved the information blocking date to April 5, 2021, and pushed several related software certification deadlines to the end of 2022.

A patient opening the hospital app on her phone on a Saturday morning and finding a new lab result felt the change directly. Until that spring, there was a good chance the result would have waited unseen for days while her doctor reviewed it first. After April 5, that waiting period became much harder to justify.

From April 5 on, three groups were prohibited from practices likely to interfere with the access, exchange or use of electronic health information: health care providers, developers of certified health IT (the companies whose electronic health record software carries a federal certification), and health information networks and exchanges (the regional and national services that move records between organizations). “Interfere” is a broad word. It covers refusing to share, and also slowing things down, adding needless hurdles or charging unreasonable fees.

The three groups were held to different standards of knowledge. A provider commits information blocking only if it knows a practice is unreasonable and likely to interfere. Developers and networks are covered if they know or should know. A practice required by law, such as a state rule on how certain sensitive results are disclosed, is outside the definition altogether.

The ban was not absolute. The rule defined eight exceptions, situations in which holding information back is allowed. Five cover cases where a request need not be fulfilled: preventing harm, privacy, security, infeasibility and health IT performance. Three cover how a request may be fulfilled: content and manner, fees and licensing. Each comes with specific conditions that an organization must meet, rather than a general sense that withholding seemed sensible.

The scope started narrow. For the first period, the information covered was limited to the data elements in version 1 of the United States Core Data for Interoperability, or USCDI, a federal list of the basic building blocks of a health record, such as medications, allergies, lab results, vital signs and clinical notes. It was the agreed minimum every system had to be able to serve. The broader definition of electronic health information was scheduled to apply from October 2022. From then on it would reach all electronic protected health information in a designated record set, as HIPAA defines that term, which covers most of the clinical and billing record.

The date did not arrive alone. The Centers for Medicare & Medicaid Services had issued a companion interoperability rule in 2020. Under it, hospitals were required from May 1, 2021, to send electronic notifications when patients were admitted, discharged or transferred, and many health plans had to offer patients an application programming interface to their claims and clinical data from July 1, 2021. HIPAA’s enforcer, the HHS Office for Civil Rights, had also proposed in January 2021 to shorten the time allowed for responding to patient access requests from 30 days to 15.

The timing was hard for the people who had to do the work. April 2021 fell in the middle of the COVID-19 vaccine rollout, when many of the same IT, portal and informatics teams were building scheduling tools and vaccination record workflows. Release settings competed for attention with the most urgent public health program in decades.

The Cures Act itself had already set the outline of enforcement. It allowed civil money penalties of up to $1 million per violation for developers and networks, and told HHS to set appropriate disincentives for providers. It also directed ONC to build a national framework for exchange between networks, which would become TEFCA, the Trusted Exchange Framework and Common Agreement.

One thing was missing on day one: teeth. Penalties for software developers and networks, and “disincentives” for providers, were left to later rulemaking. Some organizations read that as permission to wait. The better-prepared ones read it as a window to get their house in order before the bill arrived.

The 2020 rules created the duty not to block and the standardized APIs that would carry patient data out of the HIPAA perimeter. April 2021 is when that duty met daily operations.

Many health systems approached the date as a legal milestone. Counsel updated policies, compliance teams circulated memos, and leadership was told the organization was ready. The work that actually mattered was elsewhere: in what the electronic health record released, how fast, and how staff handled the requests the patient portal did not answer on its own.

That work had three parts: what is released (the scope of information and the default settings that govern it), when it is released (the timing that drew most clinician concern), and how a withholding is defended (the exceptions, which protect only an organization that can show it met their conditions). Each depends on machinery that most executives never see.

The article first describes that machinery, then takes the three parts in order. It closes with how the rule changed a health organization, what the prepared organizations had in common, and what a board should be able to see.

Records, portals, APIs and request queues

An electronic health record, or EHR, is the master software system a hospital or clinic runs on. It holds the chart for every patient: diagnoses, medications, test results, imaging reports, the notes doctors and nurses write after each visit. In a large health system it is the single most important piece of software in the building, closer to an operating system for the whole organization than to a filing cabinet.

A patient portal is the window patients look through into that record, usually a website or phone app where they can read results, see notes, message their doctor and pay bills. The portal does not decide on its own what to show. It shows whatever the EHR is configured to send it.

That configuration is a long list of defaults: settings that say, for each kind of document, whether it goes to the portal, whether it goes immediately or after a delay, and whether a clinician must approve it first. Most of those instructions were written once, during the original system rollout, and then forgotten.

An API, short for application programming interface, is a standardized doorway that lets one piece of software ask another for information automatically. Rather than a patient logging in and reading a screen, an app the patient has chosen can request the data directly and receive it in a structured form. If the portal is a shop counter where a person asks for things, an API is the loading dock where trucks pick up orders in standard crates.

Finally, release of information is the back-office function that handles everything the portal and API do not: a lawyer requesting records, another hospital asking for a chart, a patient wanting copies on paper or a disk. These teams, often outsourced to specialist vendors, process requests by hand from a queue.

Before 2021, all of this was mostly treated as an operational matter, a question of good service. The information blocking rule turned it into a legal one.

How the rule relates to HIPAA

HIPAA already gave patients a right of access to their records. It sets a deadline for responding, limits fees, and lets patients direct copies to a third party. The HHS Office for Civil Rights had begun an enforcement initiative on the right of access in 2019, and a series of settlements followed with providers that were slow to respond.

The two regimes fit together but differ in kind. HIPAA’s right of access is a patient right with a response deadline. Information blocking is a prohibition on interference that covers requests from patients, providers, apps and others, and it reaches practices such as slow defaults that HIPAA’s access deadline might tolerate. HIPAA mostly says what an organization may share. The information blocking rule says that once sharing is permitted, an organization must not get in the way without an exception.

That shift reverses the usual instinct in a health system. Privacy and compliance teams had spent years asking “are we allowed to release this?” Under the new rule, the parallel question became whether the organization was allowed to hold it back.

Who counts as an actor

The rule applies to three kinds of “actor,” and one organization can be more than one. A health system is a provider. If it runs a regional exchange for community physicians, it may also be a health information network. If it licenses its EHR instance to affiliated practices and supports it for them, it may face questions about whether it acts like a developer. The standards and later penalties differ by category, which is why classification deserved legal review early.

Many organizations that matter to the flow of data were not actors at all. Most health plans, consumer app makers and research partners fell outside the definitions. The rule bound the parties holding the data, not every party asking for it.

The API timeline

The rule also required certified EHR developers to offer a standardized API based on the FHIR standard, a modern format for exchanging health data in small, structured pieces. The deadline for that capability was pushed to the end of 2022. In April 2021, then, many organizations faced the duty not to block before the new standardized API was fully in place, and relied on older interfaces, portals and release-of-information queues to meet requests.

That timing made the configuration work more urgent. The portal and the release queue were the channels that actually carried patients’ data in 2021, so their defaults were where interference would show up first.

What is released: defaults now carry legal weight

Before the rule, many organizations held back certain note types, results or documents from patient portals by default. Those settings were often made years earlier, during a portal rollout, for reasons nobody could fully recall. Some systems hid all pathology reports. Others shared only discharge summaries and never progress notes.

Under the rule, a default that withholds information without an applicable exception can itself be an interfering practice. Nobody has to make a decision to block anyone. The setting does the blocking, unnoticed, thousands of times a day, and the organization owns it.

That turned EHR configuration into a compliance artifact, something an auditor or investigator might ask to see. Health systems had to list every note type, result category and document class, record whether each flowed to the portal and to API-connected apps, and justify each restriction. The work needed clinical informatics, compliance, privacy and EHR analysts in the same room, because none of them alone understood both the build and the legal test. The analyst knows where the switch is; the lawyer knows what the switch means; the clinician knows why it was flipped in the first place.

Two practical complications followed. First, many systems discovered that the same information appeared in several places. Releasing a note type while suppressing a result could leave the result visible inside the note, because the doctor had typed or pasted it there. Holding back the original while releasing the copy is not much of a control.

Second, some data that should be withheld, such as adolescent confidential information or certain substance use disorder records, was stored in the same note types as everything else. A teenager’s confidential conversation with a doctor might be recorded in an ordinary progress note, which a parent with portal access could otherwise see. Getting defaults right meant tagging sensitive content at the point of documentation, so the system could tell which parts of a note needed protection. That required clinician training and template changes, which take months, not days.

Suppose a mid-sized health system runs this exercise. Its first inventory turns up dozens of note and document types. Most are already flowing to the portal. A handful are blocked, and in most cases nobody can explain why: the analyst who made the setting left years ago. Its choice is simple to state and hard to execute. For each blocked type, either find an exception that genuinely fits and write it down, or open the gate. Opening the gate is often the easier answer, provided the sensitive content inside can be tagged and protected separately.

Preparing for the wider scope

The October 2022 expansion changed the size of the inventory. Electronic health information would then include everything in the designated record set, wherever it was stored: billing records, images in a picture archive, results in a separate laboratory system, scanned documents and data held by departmental applications. Many of those systems had no portal connection at all.

Organizations that used 2021 to build a data map of where record set information lived were ready for the expansion. Those that reviewed only the EHR found in 2022 that much of their exposure was in systems the first review never touched. The practical step was to extend the release-of-information log and the exception policy to those systems early, since most requests for that data would arrive through the records queue rather than the portal.

The note types in scope

USCDI version 1 named eight types of clinical note: consultation notes, discharge summaries, history and physical notes, imaging narratives, laboratory report narratives, pathology report narratives, procedure notes and progress notes. That list gave organizations a concrete checklist for the first period. Each note type mapped to one or more document types in the EHR, and each of those had its own release setting.

The mapping was rarely one to one. A large system might have dozens of local document types that all counted as progress notes, created over years for different departments. Behavioral health, social work and nursing notes might be built on separate templates with separate defaults. The inventory had to reconcile local names to the federal categories before anyone could say what was in scope.

Proxy access and the adolescent problem

Portal access is often shared. Parents hold proxy access to children’s records, adult children to aging parents’ records, and caregivers to the records of people they support. Each proxy relationship is another channel through which a default can release information to someone other than the patient.

Adolescents are the hardest case. State laws let minors consent to some kinds of care on their own, such as certain reproductive, mental health or substance use services, and often protect that information from parents. The rules vary by state. A health system operating across state lines may need different proxy rules for adolescents in each state, and its EHR must apply them correctly.

Many organizations responded by limiting parent proxy access for adolescents above a certain age to a narrower set of information, while giving the adolescent their own access. That approach protects confidentiality but can frustrate parents who expect full access. The privacy exception can support some of these restrictions, but each needs a documented basis in law or in the patient’s request.

Different organizations, different inventories

An academic medical center with a single enterprise EHR has one inventory, but a very large one, with research, specialty and teaching documents that a community hospital never sees. An ambulatory network that grew by acquisition may run several EHRs at once, each with different defaults, so the same note type may be released by one clinic and held back by another. A federally qualified health center may have behavioral health and primary care in one record, with substance use disorder treatment subject to the stricter federal confidentiality rule known as Part 2.

Part 2 programs had a specific challenge. Their records required patient consent for most disclosures, so release defaults had to keep Part 2 information out of the general flow without blocking everything else. That is only possible when the record can tell Part 2 information apart, which again depends on tagging at the source.

When it is released: the immediate-results debate

The most visible change for clinicians was timing. To avoid interference, many organizations moved to releasing test results and notes as soon as they were finalized, instead of after a waiting period that let clinicians review them first. Some patients therefore saw an abnormal result, sometimes a serious diagnosis, before their clinician had called.

Both sides have a real case. For a patient, the information is about their own body, and waiting days for it can be agonizing. For a physician, the thought of a patient reading a word like “malignant” alone at midnight, with no one to explain it, is deeply uncomfortable. Clinician concern was real and widely reported.

The rule did include a preventing harm exception, but it is narrow. It requires either an individualized determination by a licensed professional or a specific, reasonable belief tied to identified risks, and the type of harm must meet a defined threshold that depends on who is asking for what. A general preference to deliver bad news in person did not meet that standard on its own. A doctor could hold back a particular result for a particular patient for a documented reason, but a blanket three-day delay on every result for everyone was hard to defend.

Organizations responded with workflow, not delay. Some added a patient-facing choice in the portal to wait for a clinician before viewing certain results, which keeps the decision with the patient. Others built inbox prioritization so that clinicians saw abnormal results first, created standard explanatory text for common tests, and trained staff to expect calls from patients reading results on a weekend. These measures cost little and reduced friction more than any policy memo.

The approach works outside medicine too. When a rule takes away a delay you relied on, the better answer is usually to redesign the process so the delay is no longer needed, rather than fight for it: give the customer a choice, put the urgent items at the top of the pile, and prepare the explanation in advance.

How release timing is configured

Release timing is usually controlled by rules attached to each result or document type. A rule may release immediately, release after a fixed number of hours or days, or hold until a clinician marks the result as reviewed. Some systems allow exceptions by ordering department, by test or by patient.

A defensible configuration starts from immediate release and records each departure. A hold on a specific test, where a state law sets conditions on how that kind of result is disclosed, cites the law. A hold for a specific patient, placed by their clinician because of a documented risk, cites the preventing harm exception. A hold on a whole category for everyone, with no legal basis, is the setting most likely to be challenged.

The weight on clinicians

Immediate release moved work. Patients who read a result before their clinician often send a message, and those messages arrive in an inbox that was already full. Clinicians also began writing notes with the patient as a reader, which changes how findings are worded and how long notes take.

Health systems handled that load in different ways. Some routed portal messages about results to nurses first, with standard responses for common questions. Some changed templates so that notes included plain explanations of abnormal findings. Some protected clinician time to review results in the first hours after they finalized. Each of these is a staffing decision with a cost, and the organizations that funded them saw less friction than those that expected clinicians to absorb the change.

The case for the delay, and why it lost

The strongest argument for a short, blanket delay was clinical. A few days let a clinician review a result, call the patient and explain it in context. For a serious new diagnosis, that conversation can shape how the patient copes and what they do next. A delay also prevents some unnecessary alarm over minor abnormalities that a clinician would have explained in one sentence.

The argument lost because the rule placed the choice with the patient. A patient who prefers to wait for a conversation can be offered that option. A patient who wants the result immediately should not be made to wait for the organization’s convenience. The preventing harm exception remains for individual cases where a clinician judges that release would cause harm, with that judgment documented.

How a withholding is defended: exceptions must be documented

The exceptions are defenses that work only when an organization can show it met each condition. They are less like a general permission and more like a legal checklist: tick every box, keep the evidence, and you are protected; miss one and you are not.

The privacy exception can support withholding when a patient has asked for a restriction or when state law requires consent. The infeasibility exception can apply when a request cannot be met for specified reasons, but it requires a written response to the requester within ten business days. The content and manner exception allows an organization to fulfill a request in an alternative manner when the requested one is not feasible, for example by offering a different format. The fees exception limits what may be charged.

Meeting these conditions is a records problem. Health systems needed a way to log when information was withheld or delayed, which exception applied, who decided and what was sent to the requester. Most EHRs and release-of-information tools were not built for that, so many organizations built tracking around them, often in the same queue that handled HIPAA access requests. HIPAA, the long-standing federal health privacy law, already gave patients a right to their records; the new rule layered a broader duty on top.

The same discipline applied to requests from other parties: other providers, health information exchanges, payers and apps acting for patients. Many health systems had habits that slowed such requests in practice, such as manual review queues, unclear fee schedules, or insistence on a particular form or fax line. To the people doing them, these feel like routine rather than “blocking.” Each now needed a basis in an exception.

Release-of-information teams, often outsourced, found themselves at the center of a federal obligation, and health systems needed to confirm that vendors followed the same standard. Outsourcing the work does not outsource the responsibility. If a vendor’s habits slow down requests, the health system’s name is on the problem.

Who the rule reaches also matters. Providers face a knowledge standard: they must know a practice is unreasonable and likely to interfere. Developers of certified health IT and health information networks face a broader one. A health system that also operates a regional exchange or sells software to affiliates may fall into more than one category, and which definitions apply to it is a question for its lawyers.

What a withholding record should hold

A useful record has a small number of fields. The request: who asked, for what, through which channel and when. The decision: released, delayed, partly withheld or denied. The basis: which exception, and which of its conditions were met. The decision-maker. The response: what was sent to the requester and when, including the written notice the infeasibility exception requires. Any later change, such as a release after the reason lapsed.

Two design choices make the record usable. It should cover every channel, so a portal hold, an API refusal and a release-of-information delay all land in one place. And it should be reportable, so the compliance team can see how often each exception is used, by which departments and with what response times. A department that relies on the infeasibility exception far more than its peers is a signal worth investigating.

Apps, security and privacy

Requests from third-party apps raised a specific question. Once a patient directs their data to an app, HIPAA usually stops applying to the app, and the app’s own privacy practices govern what happens next. Many health systems worried about apps with weak privacy terms.

ONC’s position was that concern about an app’s privacy practices does not by itself justify refusing a patient’s request. An organization may tell patients about the risks, in a neutral and factual way, but the choice belongs to the patient. The security exception allows an organization to block a specific app that presents a specific security risk, such as one that threatens the organization’s systems, under a documented, consistently applied policy. A general distrust of consumer apps does not qualify.

That line is easy to state and hard to apply. Security teams are trained to reduce risk by restricting connections. Under the rule, each restriction on an app connection needed a documented security basis that was tailored to the risk and applied the same way to every comparable request.

Contracts and business associates

Release-of-information vendors, EHR hosting providers and health information exchange partners usually work under business associate agreements, the HIPAA contracts that govern how they handle patient data. Those agreements were written to restrict use and disclosure. Few addressed the obligation not to interfere.

Renewal is the natural point to add terms: service levels for responding to requests, adherence to the organization’s exception policy, reporting of withheld and delayed requests, fee schedules consistent with the fees exception, and cooperation with any investigation. A vendor that cannot report how long requests take is a vendor whose performance the organization cannot defend.

The argument for waiting, and its weakness

In April 2021, a provider that blocked information faced no specific federal penalty under the information blocking rule. The disincentives had not been written. A reasonable executive could ask why the organization should spend scarce informatics time on configuration reviews during a pandemic.

The answer had three parts. HIPAA right of access enforcement already existed and was active. Complaints about information blocking could be submitted to ONC from the start, creating a record that later enforcement could draw on. And the configuration work needed to comply would take many months, so an organization that waited for penalties would start too late to finish before they arrived.

Six ways the rule changed a health organization

The rule put results and notes in front of patients as soon as they were ready, and it changed how a health organization works in six ways.

It changes the patient relationship. Patients who can see their results and notes promptly arrive at appointments better informed, ask sharper questions and sometimes catch errors. They also call more, especially at first. Organizations that prepare for that, with explanatory text and staff ready to answer, turn transparency into trust. Those that do not can see frustration on both sides of the exam room.

It changes clinician workload. Immediate release means clinicians need to review results quickly and write notes knowing patients will read them. That is a cultural shift as much as a technical one, and it lands on people who are already stretched. Leadership attention to inbox design and support staff matters.

It creates a paper trail regulators will eventually read. The withholding log is the organization’s evidence. Without it, a reasonable decision looks the same as an unreasonable one. With it, the organization can show its reasoning case by case.

It reaches into vendor contracts. EHR vendors, portal providers and release-of-information firms all shape what is released and how fast. Contracts written before 2021 rarely mention information blocking. Renewals are the natural moment to add commitments on configuration, timeliness and cooperation with audits.

It opens a second front through apps. The portal is only one door. Every setting that governs what a patient sees on screen also governs, or should govern, what flows through the API to apps the patient chooses. Organizations that reviewed the portal but forgot the API could end up releasing in one channel what they held back in another, or the reverse. Either way, the inconsistency is hard to explain to a regulator and harder to explain to a patient.

It rewards starting small and widening. Because the first period covered only the USCDI version 1 data elements, organizations had a manageable starting scope: the core building blocks of the record. That was a natural place to get the inventory, the tagging and the log working properly. The organizations that used the narrow start as practice were building habits they would need when the scope grew. The ones that treated it as the whole job were setting themselves up for a second, larger project later.

Where the cost landed

The six changes put cost in specific places. Clinical informatics teams carried the configuration review and the template changes. Health information management departments carried the request log and the vendor oversight. Nursing and support staff absorbed much of the new patient messaging. Compliance and legal carried the exception policies and the classification questions.

Few of those costs appeared in a single budget line, which made them easy to underfund. An executive sponsor who could see all of them together, and who owned the outcome across departments, was often the difference between a program that finished and one that stalled after the policy was written.

Measures that showed progress

Organizations that tracked the work tended to use a few simple measures: the share of note and result types released to the portal by default, the number of restrictions with a documented exception, the median time to fulfill release-of-information requests, the number of withheld or delayed requests by exception, and portal message volume about results. Each could be reported monthly. Together they showed whether the organization was moving toward openness and whether the extra load was being handled.

What the prepared organizations had in common

A well-prepared organization in 2021 tended to share a few traits:

• A complete inventory of what the EHR releases to the portal and to APIs, with an owner for each setting and a recorded reason for every restriction.
• A cross-functional group, clinical, informatics, compliance, privacy and legal, that meets regularly rather than once.
• Sensitive-content tagging built into note templates, with training so clinicians use it.
• A patient choice to wait for a clinician on selected results, plus prepared explanations for common tests.
• A single log for withheld or delayed requests, covering in-house teams and vendors alike.

The unprepared ones were the mirror image. Some organizations rewrote the policy and never touched the configuration, so the documents said one thing and the system did another. Some treated the clinician delay as non-negotiable and tried to stretch the preventing harm exception to cover it. Some assumed the outsourced records vendor was handling compliance without checking. And some read the absence of penalties on day one as a reason to postpone, which only made the eventual catch-up harder.

How preparation differed by organization

Large health systems on a single enterprise EHR had an advantage: one configuration to review and vendor support for common changes. Their difficulty was volume and politics, with many departments each defending their own defaults.

Ambulatory networks and physician groups often had the opposite problem. Fewer staff, several systems, and limited informatics capacity meant they relied heavily on their EHR vendors’ default settings and guidance. For them, the most efficient step was often to adopt the vendor’s recommended configuration and document exceptions to it.

Critical access and small rural hospitals faced the steepest climb. Many had a single health information management manager who also ran release of information, coding support and privacy. A simple spreadsheet log and a short exception policy, adopted early, did more for them than any elaborate program.

Organizations that operated health information exchanges, or participated in governing them, had to think about their role as a network as well as a provider. Their exchange policies, such as which participants could query for which purposes, became potential interfering practices if they could not be tied to an exception.

What the board should be able to see

If you serve on the board or executive team of a health organization, these questions cut through to whether the work has been done:

1. Can we produce, today, a list of every note type, result and document our EHR holds back from the portal or from apps, and the reason for each?
2. How do we stop sensitive information, such as adolescent confidential notes or substance use disorder records, from being released, without blocking whole categories?
3. What do patients see when a result is released before their clinician has reviewed it, and what choice do they have?
4. When we withhold or delay information, where is that recorded, which exception do we rely on, and who signs off?
5. Do our release-of-information vendors follow the same standard, and how do we know?

Anyone can ask them without technical knowledge, and each deserves a real answer rather than a reassurance.

The questions follow the three parts of the work. The first two concern what is released. The third concerns when. The last two concern how a withholding is defended. A board that hears specific answers to all five, with names, dates and documents, can be reasonably confident the organization has done more than update a policy.

The answers also tell the board where to invest. A weak answer to the first question points to informatics capacity. A weak answer to the second points to documentation practice and clinician training. A weak answer to the last two points to health information management, compliance tooling and vendor management. Each is a modest, specific investment compared with defending an enforcement action without records.

With hindsight

April 2021 turned out to be the start of a slow climb rather than a single cliff edge. The rules arrived first; the consequences arrived in stages.

The scope of electronic health information expanded beyond the core data set in October 2022, so the narrow starting menu of USCDI version 1 gave way to a much broader obligation covering far more of the record. Certified EHR developers had until the end of 2022 to deliver the standardized FHIR-based API. The HHS Office of Inspector General, the watchdog arm of the Department of Health and Human Services, finalized civil money penalties of up to $1 million per violation for developers and networks in 2023, with enforcement beginning that September.

HHS finalized disincentives for providers through Medicare programs in 2024, meaning that hospitals and clinicians found to be blocking could lose money through the federal programs that pay them. A hospital found to have blocked could lose its status as a meaningful user of certified EHR technology, with a reduction in its Medicare payment update. Clinicians in the Merit-based Incentive Payment System could receive a zero score in its interoperability category, and accountable care organizations could be barred from the Medicare Shared Savings Program for at least a year. Federal officials announced stepped-up enforcement in 2025.

The exceptions themselves were refined. ONC’s HTI-1 rule, finalized at the end of 2023, revised several of them and added one for sharing through TEFCA, the national framework for exchange between health information networks that began live operations that December. In 2024, ONC was reorganized as the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health IT. The work of interpreting the exceptions grew more detailed, but the basic structure set in 2020 stayed in place.

Sensitive data rules moved too. In early 2024, HHS finalized changes to the Part 2 rule on substance use disorder records, aligning it more closely with HIPAA, with compliance required by February 2026. Organizations that had tagged sensitive content at the source in 2021 had a far easier time adapting their release rules to the new requirements.

HIPAA enforcement continued alongside. The Office for Civil Rights kept announcing right of access settlements with providers that were slow to give patients their records, so organizations faced two overlapping regimes on the same request queue. A slow response could now raise a HIPAA access problem and an information blocking question at once, and the same log served as evidence for both.

Meanwhile, immediate release of results became widespread. What looked radical to many clinicians in 2021 is now ordinary. Clinicians and patients adjusted over time, though receiving bad news through a portal remains a real issue that organizations manage through patient choice, messaging and education. The debate did not vanish; it moved from “should we release?” to “how do we release well?”

What held up is the operational reading of the rule. Organizations that treated April 5 as a configuration review and built a withholding log were far better placed when enforcement arrived than those that treated it as a policy update. The first group could show, setting by setting and request by request, what they did and why. The second group had to reconstruct years of decisions after the fact, often from systems never designed to remember them.

What held up less well was the expectation that penalties would follow quickly. Provider disincentives took more than three years to finalize, and organizations that bet on a long wait were not punished for it in the short run. The cost of that bet came later, in a compressed catch-up when enforcement priorities sharpened.

The inventory work also proved reusable. Organizations that knew which settings governed release could answer later questions from records they already had: what flowed to networks under TEFCA, how Part 2 information was kept apart, and what clinicians’ notes, increasingly drafted with software help, would show patients.

The pattern reaches beyond health care. When a regulation lands with a delayed penalty, the grace period is the cheapest time to do the work. And when compliance depends on how software is configured, the settings themselves are the policy. A board that only reviews the written policy is looking at the wrong document.

Transparency rules also change relationships. Patients who can see their records behave differently, and staff need support to meet them there. The organizations that came through best treated the rule as a service change with legal stakes, not a legal change with service side effects.