HHS Cracks Down on Information Blocking in Healthcare
On September 3, 2025, the U.S. Department of Health and Human Services (HHS), under Secretary Robert F. Kennedy Jr., announced a major step to enforce information blocking provisions of the 21st Century Cures Act.
What is information blocking?
It’s any practice that interferes with, prevents, or materially discourages the access, exchange, or use of electronic health information (EHI). In other words, when patients, providers, or innovators can’t get to health data that should be legally available.
Why does this matter?
Patients deserve unfettered access to their own health data—not only to stay engaged in their care, but also to:
Monitor chronic conditions
Follow treatment plans more effectively
Catch errors in their medical records
Use health apps to improve outcomes
What are the consequences?
HHS has now fully activated penalties (“disincentives”) across the healthcare ecosystem:
Health IT Developers: Civil penalties up to $1M per violation and possible loss of ONC certification.
Hospitals / CAHs: Loss of status as meaningful EHR users, reducing Medicare payments (median penalty ~$394K).
Clinicians: Zero score under Medicare’s MIPS program.
ACO Participants: Ineligible for the Medicare Shared Savings Program for at least a year.
Acting Inspector General Juliet T. Hodgkins put it plainly: “Patients must have unfettered access to their health information as guaranteed by law.”
Immediate Audit Steps for Compliance Officers
To get ahead of enforcement actions, compliance and privacy officers should:
Review EHR Release of Information Policies – Ensure requests are being fulfilled within regulatory timeframes. State response times may be shorter than federal response times.
Audit Access Logs – Confirm that no systemic delays, denials, or restrictions exist on legitimate EHI requests. Stated otherwise, meet with your CISO or IT head rather than assuming or sending a short e mail.
Check Patient Portal Functionality – Verify that patients can seamlessly access their records at no cost.
Evaluate Third-Party App Connections – Ensure application interfaces are open and not restricted beyond what HIPAA security standards require.
Retrain Frontline Staff – Clarify what constitutes information blocking and how to escalate questionable denials.
Document Exceptions – If withholding data due to privacy, security, or infeasibility exceptions, ensure rationale is documented and legally sound.
Key takeaway:
Healthcare entities are now officially on notice. The era of tolerating information blocking is over. Patient access, transparency, and interoperability are the law—and enforcement is here. This move comes on the heels of HHS’s recent 42 CFR Part 2 revamp, which aligned substance use disorder record protections more closely with HIPAA. Taken together, these changes signal a broader shift toward stronger enforcement across all areas of health data privacy and access.