EHR Information Blocking: Who Decided the Records Could Not Move?

Information blocking is a practice likely to interfere with access, exchange or use of electronic health information, unless the law requires it or an exception covers it. The rule also asks what the provider, software developer or network knew. If you work with export requests, interfaces or patient records, you may see the decision behind the obstruction: a capability switched off, a fee tied to competition, or a policy that keeps available results waiting. The request shows what someone needed. The decision shows who stood in the way.

When an Export Barrier Connects to a False Claims Act Case

An EHR False Claims Act case connects knowing deception to government payment. The vendor cases show the connection through certification representations: providers sought incentive payments for using certified technology, and the government alleged that vendors caused false claims by misrepresenting their products’ capabilities.

The historical export allegations make that connection concrete. In the government’s 2017 complaint against eClinicalWorks, the alleged failure to support batch export came with an internal explanation:

We see the absurdity in that allegation: a records company reluctant to let the records leave. The employee’s reported understanding adds something a failed export alone cannot show. The case began with a software technician at a municipal health agency that used the product, and the United States joined it. The outside user could see the problem.

Practice Fusion agreed to approximately $113.4 million in federal civil payments to resolve certification and kickback allegations. In its January 2020 civil settlement announcement, the Justice Department alleged that several versions lacked the standardized export capability represented during certification. It further alleged that Practice Fusion later disabled access to the feature altogether and required users to contact the vendor separately for an export.

Certification also carries continuing obligations against information blocking. Developers of certified health IT must comply with continuing certification conditions and attest to that compliance twice a year. Those conditions include avoiding information blocking and assuring access and exchange. When we assess an export barrier, we examine what the developer represented alongside what its product actually allowed and any connection to government payment.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Information blocking alone does not establish a False Claims Act case. The information blocking law provides no qui tam action or share of its civil penalties for the person who reports it. Knowing which conduct makes a case is where we come in.

Who Is Subject to Information Blocking?

The information blocking rules cover health care providers, developers of certified health IT, and health information networks or exchanges. What the organization knew matters, and providers face different consequences from developers and networks.

Providers include hospitals, clinics, laboratories, pharmacies, nursing facilities and individual practitioners. For a provider, the question is whether it knew the practice was unreasonable and likely to interfere with access, exchange or use. Covered developers, networks and exchanges are also held to what they should have known about likely interference.

That difference puts the organization’s decisions at the center of the story. A product team may control the export capability. A commercial team may control its price. A hospital may control the policy that delays release. We look at the conduct of each organization and what its people understood when they made those choices.

Under the 21st Century Cures Act, each organization answers for its own decisions: the vendor for its software, the hospital for its release policy. Leaving a barrier in place counts, too.

What Is Electronic Health Information?

Electronic health information reaches beyond the information displayed on an EHR screen. The definition follows electronic protected health information that would belong in a designated record set, the group of records covered by HIPAA’s access right. It applies even when the organization holding those records is outside HIPAA’s covered-entity category.

Psychotherapy notes and information compiled for anticipated or ongoing legal proceedings are excluded. The scope therefore turns on the information requested, rather than the name of the product holding it.

Since October 6, 2022, the rule has reached the full electronic health information definition, beyond the narrower set of standardized data it covered initially.

What Are Examples of Information Blocking?

Examples of potential information blocking include barriers to complete exports, burdensome exchange arrangements, competition-based fees and blanket delays in releasing available results. The actor’s knowledge, applicable law and exception conditions determine how a particular practice is treated.

Export Restrictions and Switching Systems

Congress named it outright: blocking a full export or a switch to another system. It also named nonstandard implementation that substantially increases the difficulty of accessing, exchanging or using information. An interface can exist while the way it is implemented makes exchange burdensome.

For the employee handling a migration, the useful comparison is between the information requested and the information the system can actually release. A support request can reveal a missing capability. An internal decision about making that capability available can reveal something else: who controlled the restriction and why it remained.

There is an economic reason to examine that decision. A Panacea or a Problem? Electronic Health Records and the Complicated Politics of Its Stakeholder Network, a 2022 Vassar College senior thesis, argues that EHR interoperability is shaped by competing institutional interests. Its analysis describes how the adoption program strengthened vendors’ financial position without giving them equally strong incentives to improve exchange or usability. It also describes why sharing information can conflict with a provider’s competitive interests.

That is a useful question for us to bring to an export dispute: who benefits when the records cannot leave? The engineering explanation and the commercial decision both deserve attention.

Interface Fees, Contracts and App Access

The fee schedule can make the barrier visible. The Office of the National Coordinator for Health Information Technology’s exceptions guidance says protected fees must be tied to objective, consistently applied criteria and reasonably related to the cost of providing access, exchange or use. Whether the requester competes with the organization cannot supply the basis for the fee.

The same guidance excludes certain fees from protection, including fees based on an individual’s electronic access and fees for an export using the certified electronic health information export capability. Contract terms and interface invoices can therefore explain an obstruction that looks, from the clinical screen, like a technical limitation.

Licensing terms matter too. The licensing exception addresses reasonable royalties and nondiscriminatory terms for the technology needed to exchange information. For an app connection, the decision to limit access, the stated security concern and the treatment of comparable apps belong together. Security protection has to fit a specific risk and be applied consistently.

Can a Doctor Withhold Lab Results?

A blanket policy holding lab results solely so a clinician can review them is likely to interfere with access, according to the Office of the National Coordinator for Health Information Technology.

HIPAA’s Right of Access generally gives a covered organization 30 days to act on a records request. The agency’s explanation of overlapping access laws makes the point: that deadline does not excuse holding available records. If an organization could release information sooner but chooses to delay, the delay itself can matter.

We would want to understand what imposed the hold. The request, the release policy and the explanation given to the patient can connect an available result to the decision to keep it waiting. A maximum response period is a poor excuse for making a patient wait when the organization could fulfill the request sooner.

What Are the Exceptions to Information Blocking?

Information blocking exceptions protect particular practices when their conditions are met. As of September 5, 2026, there were ten, addressing different reasons for limiting access and different ways of fulfilling requests.

• Reasons for not fulfilling a request: Preventing Harm, Privacy, Security, Infeasibility, Health IT Performance and Protecting Care Access. These address circumstances such as a specific security risk, an infeasible request or necessary temporary downtime.
• Procedures for fulfilling a request: Manner, Fees and Licensing. These address how information is provided and the terms attached to doing so.
• Exchange through TEFCA: TEFCA Manner, which addresses certain requests between participants in the Trusted Exchange Framework and Common Agreement.

The exceptions have specific conditions, and weighing a claimed exception against what happened is part of our work with you. The written reason a company gives for refusing a request can itself be evidence.

Who Enforces Information Blocking?

The Department of Health and Human Services’ Office of Inspector General investigates information blocking. Covered developers, networks and exchanges face civil monetary penalties. Providers face separate program disincentives, while the Office of the National Coordinator for Health Information Technology can also act against a developer’s participation in the certification program or the technology’s certification.

Information Blocking Penalties Depend on the Actor

The HHS inflation adjustment published in January 2026 sets the maximum information blocking civil penalty at $1,327,209 per violation. That is the developer, network and exchange track. The Inspector General’s information blocking penalty enforcement began September 1, 2023, for conduct on or after that date.

The provider disincentive rule took effect July 31, 2024.

For eligible hospitals, the consequences reduce the Medicare payment update. Critical access hospitals face reduced reimbursement. A clinician in Medicare’s Merit-based Incentive Payment System can receive a zero score in the Promoting Interoperability category when required to report it. Accountable care organizations and participating providers can lose eligibility for the Medicare Shared Savings Program for at least one year.

Those consequences attach through the relevant programs. The large per-violation dollar figure belongs to a different set of actors. That distinction matters when looking at who patients say is blocking their records.

What the Claims Numbers Show

By July 31, 2026, the Office of the National Coordinator for Health Information Technology’s information blocking claims data recorded 2,563 submissions, including 2,450 claims of possible information blocking. The actor counts included 1,938 provider mentions and 338 mentions of developers listed on the Certified Health IT Product List.

The most frequently named actor was the provider, which faces program disincentives. We see a mismatch worth paying attention to: providers dominate the reports, while the million-dollar penalty headline concerns developers, networks and exchanges.

In their September 4, 2025 enforcement alert, the Inspector General’s office and ONC committed to intensifying enforcement. The alert prioritizes patient harm, significant effects on care, prolonged conduct and financial loss. The Inspector General’s enforcement overview also identifies actual knowledge. An insider’s account of why a barrier stayed in place can speak directly to that concern.

The Decision Behind the Failed Request

An insider may hold the part of the story that a patient never sees. An export ticket can show what was requested. An interface invoice or contract can show the condition placed on access. A product decision or internal message can explain why the restriction existed and who understood its effect.

We examine those connections with you: the information requested, the capability available, the reason given and the people who controlled the decision. Where certification or incentive-payment representations are involved, we examine those alongside the access history. That is where technical knowledge becomes useful evidence about what the business chose to do.

When You Know Who Controlled Access

If you saw an export restricted, a competition-based fee imposed or a release policy used to keep records waiting, speak with our whistleblower experts about the decision behind it. We work with you to connect the software, the business decisions and any government-payment representations to build your strongest EHR whistleblower case. We bring in EHR fraud whistleblower lawyers who understand certification and incentive payments, and stay with you through the whole journey.