For years, healthcare leaders could read about information blocking without seeing many public examples of its consequences. That position is getting harder to defend.

In June, HHS officials reported that the agency had begun issuing notices of nonconformity and placing some organizations on corrective action plans. These are signs of enforcement activity. In the public sources I reviewed, OIG has not announced a civil monetary penalty, and CMS has not announced a penalty against a particular provider.

Meanwhile, ONC recorded 2,450 possible information blocking claims through July 31, 2026. Those are allegations, and they still tell us something useful: people are reporting obstacles to their information.

For CIOs and CISOs, the question is practical. When your organization delays or denies access, can you explain the decision and support it under the applicable rules?

Why the Rule Exists

The rule addresses a long-standing gap. As I told Healthcare IT News in 2022 while CISO of ClearDATA, healthcare organizations "must join multiple HIEs, and many don't share data." Connections between networks made exchange possible. Whether information moved still depended on each organization's decisions about access.

TEFCA aims to simplify data exchange at scale by creating a common pathway. The information blocking rule governs the decisions that determine whether information uses that pathway. Leaders responsible for data exchange need to manage both.

What the Rule Covers

The information blocking provisions grew out of the 21st Century Cures Act of 2016, and the implementing regulations have applied to covered actors since April 5, 2021.

Three categories are covered: healthcare providers, developers of certified health IT, and health information networks and exchanges. Provider coverage extends beyond Medicare-enrolled providers. Medicare participation determines which CMS disincentives can apply.

Under 45 CFR Part 171, information blocking generally means a practice likely to interfere with access, exchange, or use of electronic health information, unless the law requires it or an exception covers it, and subject to the applicable knowledge standard.

For developers, networks, and exchanges, the standard is what they know or should know. For providers, it requires knowledge that the practice is unreasonable and likely to interfere.

Since October 6, 2022, the scope reaches beyond the original USCDI data subset. EHI generally includes electronic information that belongs in a designated record set, with exclusions for psychotherapy notes and information compiled for specified legal proceedings.

The regulations now contain ten exceptions: Preventing Harm, Privacy, Security, Infeasibility, Health IT Performance, Protecting Care Access, Manner, Fees, Licensing, and TEFCA Manner. The two newest, Protecting Care Access and TEFCA Manner, came from recent ASTP/ONC rulemaking.

Each exception carries specific conditions. An actor must meet those conditions to rely on the exception, and a practice outside every exception is then tested against the definition of information blocking.

That distinction matters. A defensible restriction needs a documented basis, and a familiar label such as "privacy" or "security" is only the starting point for that record.

The Consequences Depend on Who You Are

HHS's enforcement guidance separates three enforcement paths.

For providers, the financial consequences vary by program:

The prohibition reaches more providers than these payment consequences do. A provider outside those programs remains subject to the information blocking rules.

Enforcement Has Two Tracks

OIG receives complaints, assesses enforcement priorities, and investigates. Its priorities include potential patient harm, significant interference with a provider's ability to care for patients, long duration, financial loss, and actual knowledge.

OIG's published process for entities subject to civil monetary penalties includes fact gathering, an opportunity to discuss the investigation, a demand letter if OIG concludes blocking occurred, and appeal rights. Anyone can submit a complaint through ONC's portal or the OIG hotline.

ONC's certification oversight is a separate track. It can address developer nonconformities through corrective action and certification enforcement.

The details matter here. A developer that fails to complete a corrective action plan can face certification termination through the applicable process. The effect on that developer's customers depends on certification status and the requirements of each customer's CMS programs.

For a health system, that is a reason to know your vendor's certification status and remediation obligations before a problem becomes an operational surprise.

What Has Changed and What Remains Unclear

The enforcement framework developed in stages. OIG's monetary penalty enforcement for developers and networks began in September 2023. HHS finalized its provider disincentives rule in June 2024. In September 2025, HHS announced a crackdown, followed by a joint OIG and ONC enforcement alert committing additional resources.

By early 2026, HHS officials were discussing notices of potential nonconformity. June reporting then described notices of nonconformity, admissions of noncompliance, and corrective action plans.

The public record is incomplete. In the public sources I reviewed, I did not identify an announced OIG civil monetary penalty for information blocking as of October 4, 2026. Nonpublic actions may exist, and certification enforcement may be more active than it appears.

The complaint count needs perspective. ONC cautions that receiving a claim does not mean an investigation occurred or that blocking was found. A rising count could reflect more obstruction, greater awareness, easier reporting, or some mix of the three.

The rules may change again. ONC describes HTI-5 as a proposed rule, and I found no final rule in the sources I reviewed. Its proposals would revise portions of the information blocking framework. Proposed changes should inform planning, and current requirements govern decisions today.

Security Leaders Need a Documented Answer

Healthcare organizations must protect sensitive information and support lawful access to it. Both obligations belong in the same decision process.

The Security Exception can protect qualifying practices when the restriction addresses an actual security issue and satisfies the exception's conditions. A general concern about risk does not meet that bar. The same discipline applies to the Privacy Exception and the others.

A blanket delay while someone reviews the request deserves scrutiny, and so does a policy that treats every outside application as unacceptable without looking at the facts.

I would start with five actions:

  1. Review denials and delays. Identify where your organization restricts EHI access, exchange, or use. Document the legal basis and, where applicable, the exception behind each practice.
  2. Examine security review workflows. Make sure decisions address specific risks, follow the exception criteria, and end when the risk is addressed.
  3. Review vendor terms and status. Look at export capabilities, fees, licensing restrictions, certification status, and outstanding corrective action obligations.
  4. Assign ownership. Bring legal, compliance, privacy, health information management, clinical leadership, and IT into a defined response process. Someone needs to own the decision and its supporting record.
  5. Track regulatory changes. Review final rules when issued and update policies against their requirements and effective dates.

These steps support compliance. They do not guarantee it. They help you find weak decisions before someone else asks you to defend them.

How I Will Judge Whether It Works

I expect public enforcement outcomes to sharpen attention, especially a named monetary penalty or a provider payment consequence. Corrective action costs and certification risk can influence behavior before that happens.

Penalties are only one measure. I will also watch corrective action outcomes, complaint patterns by actor type, and how long patients and authorized users wait for records and application access.

The outcome that matters is whether information is available when it is needed, with appropriate protections and fewer unnecessary obstacles.

Healthcare leaders already have enough evidence to act. Start with the access decisions you would struggle to explain to a patient, a regulator, or your own leadership team.