Information Blocking Enforcement on the Horizon

Information blocking may be old news, but its enforcement is not. On September 3, 2025, the U.S. Department of Health and Human Services (HHS) announced that it would be increasing resources to investigate and enforce information blocking compliance. This announcement highlighted the Health IT Feedback and Inquiry Portal, where information blocking complaints can be reported, and as of mid-February, 2026, over 1,600 complaints have been submitted through the portal, primarily by individual patients and their representatives.

At the 2026 Assistant Secretary for Technology Policy Annual Meeting in February, HHS Assistant Secretary Thomas Keane claimed that since the passing of the 21st Century Cures Act, no enforcement actions have taken place. He announced, however, that HHS is now actively issuing notices of potential nonconformity. Keane noted that so far, these notices have been to developers of certified health IT, but because of the volume of complaints issued by individual patients, it is likely that notices will soon be issued to health care providers.

What is information blocking?

Information blocking is a practice that “is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information” (EHI) when conducted by:

1. A health information technology developer, exchange, or network when it knows or should know that the practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of EHI; or
2. A health care provider when it knows that the practice is unreasonable and is likely to interfere with, prevent, or materially discourage the access, exchange, or use of EHI.

¹There are several enumerated exceptions to the definition of “information blocking” in 45 CFR Part 171.

The penalties for information blocking could be significant:

• For health information technology developers, exchanges, or networks, civil monetary penalties of up to $1,000,000 per violation²;
• For health care providers, financial disincentives such as:
  • For hospitals under the Medicare Promoting Interoperability program in the Social Security Act, loss of annual market basket increases or percentage payment reductions for critical access hospitals, as applicable;
  • For certain health care providers under the Merit-based Incentive Payment System, a score of 0 in the performance category, which is a typically a quarter of the final composite performance score; or
  • For certain health care providers that are an accountable care organization, participant, or provider/supplier, a bar from participating in the Shared Savings Program for at least one year.

What does this mean for me?

While the information blocking rules have been in place for years, there has been no public information regarding information blocking investigations or enforcement actions (though Keane claims there have been no enforcement actions to date). Now, however, with the current administration’s emphasis on and funding of information blocking investigations and enforcement, health IT entities and health care providers should:

• Re-evaluate their policies and procedures on information blocking;
• Retrain staff that receive and process information requests;
• Implement periodic audits to ensure compliance with the information blocking rules; and
• Know your review and appeal rights if you receive a notice of potential nonconformity, demand letter, or otherwise.

We will continue to monitor the information blocking investigation and enforcement trends.

This blog was drafted by Shannon Bond, an attorney in the Overland Park, Kansas, office of Spencer Fane. For more information, visit spencerfane.com.

—

¹ _{42 U.S.C. § 300jj-52.}

^{2 42 C.F.R. § 1003.1410}