HHS says it’s upping enforcement of information blocking rules

The Department of Health and Human Services (HHS) is cracking down on actors that prevent access to patient health data.

The agency said in a Sept. 3 press release it’s implementing new policies to enforce information blocking rules, which were established under the 21st Century Cures Act in 2016, including potential fines of up to $1 million per violation. Information blocking can cause delays in patient care, increased healthcare costs, and physician burnout, according to the American Medical Association (AMA).

“Once a tolerated industry practice, information blocking is now a target for real accountability. And that means better, faster, safer care for patients,” Bobby Mukkamala, president of the AMA, said in a Sept. 10 statement.

What is information blocking?

Any practice that potentially interferes with or prevents the access, use, or exchange of electronic health information—except in cases required by law—is considered information blocking. That data includes anything in a patient’s medical chart, like pathology reports and imaging results, according to Josh Newman, VP of clinical systems at Johns Hopkins University.

Three parties are regulated by the HHS rules: healthcare providers, health information exchanges (networks that facilitate the exchange of health information between different entities), and developers of certified health IT (typically makers of electronic health record, or EHR, tech like Epic Systems).

Why block information?

EHR vendors would have the most incentive to block information, as they may do so for competitive purposes, Newman said, adding that healthcare providers more often violate information blocking rules due to factors like a lack of resources or misunderstanding of the rules.

Epic, for example, is one of the largest EHR vendors in the US and has roughly 42% of the acute care EHR market share, according to KLAS data cited by Fierce Healthcare.

Epic is currently facing two lawsuits—one from health data platform Particle Health and one from managed services provider CureIS Healthcare—accusing the company of impeding access to patient data for anticompetitive purposes.

An Epic spokesperson told Fierce Healthcare in 2024 when Particle’s lawsuit was filed that the claims were “baseless” and the company’s software is “open and interoperable.” In response to the CureIS lawsuit, an Epic spokesperson told CNBC in May the company “look[s] forward to setting the record straight in court.”

The consequences

Information blocking has been an issue in the healthcare industry for years, according to the AMA, and can have consequences such as delayed patient care and physician burnout.

For instance, if a patient were to have testing done at one health system and then seek continued care at another, but the two systems didn’t exchange that person’s health information, the second system may repeat tests, Newman said. That could waste time and money.

The punishments

Though information blocking penalties have been finalized for more than a year, HHS has not taken any enforcement actions to date, according to Newman.

It’s not clear why HHS is focusing on enforcement now, but it could be partly attributed to the new administration taking over and increasing attention on lawsuits, like those against Epic, Newman said.

According to the HHS press release, healthcare providers found to be violating information blocking rules could be “subject to disincentives” under the Medicare and Medicaid programs. Health IT developers could face financial penalties of up to $1 million per violation. And developers with products certified by HHS’s Office of the National Coordinator could have their certifications terminated.

The agency “will deploy all available authorities to investigate and hold violators accountable,” Juliet Hodgkins, HHS’s acting inspector general, said in a statement. “We are committed to enforcing the law and protecting patients’ access to health information.”