Information Blocking and EHR Data Export (2026 Guide)

Information blocking is a practice by an EHR vendor, health information network or provider that is likely to interfere with access, exchange or use of electronic health information, where the actor has the knowledge the rule requires of it. It is allowed if a law requires it or one of ten exceptions in 45 CFR Part 171 covers it.

The rule has applied since April 5, 2021, and the first enforcement against vendors, through certification notices, began in 2026. If you are leaving a certified EHR, the rule and the certification program give you a documented export, limits on what the vendor can charge for it, and somewhere to complain.

What counts as information blocking under 45 CFR Part 171?

Three elements have to line up: a practice likely to interfere with EHI, the required knowledge, and no law or exception that covers it. "Interfere" is defined in 45 CFR 171.102 as "prevent, materially discourage, or otherwise inhibit." Missing an exception does not by itself prove a violation, because the knowledge element still has to be shown.

The statute is section 4004 of the 21st Century Cures Act (42 U.S.C. 300jj-52), implemented in ONC's May 1, 2020 final rule. EHI means electronic protected health information that would be in a HIPAA designated record set, whether or not the holder is a covered entity, minus psychotherapy notes and information compiled for a legal proceeding. Until October 6, 2022 the rule reached only the USCDI v1 data elements; ONC's FAQ confirms the full EHI scope has applied since then. Because the designated record set includes billing records, the scope goes well past the problem list.

The knowledge standard depends on the actor. Under 45 CFR 171.103, a developer, network or exchange is covered if it "knows, or should know" a practice is likely to interfere. A health care provider is covered only if it "knows that such practice is unreasonable" and likely to interfere, a harder standard for the government to prove.

What does information blocking look like in practice?

The common cases are delays and restrictions on records, and ONC's guidance gives examples.

• A hospital policy that holds lab results for any period so the ordering clinician can review them first would "likely be considered an interference," according to ONC's FAQ on delays. So would results that are not visible in the patient portal for any period after the patient logs in.
• A patient's own request to delay release is treated differently and would likely not be interference.
• On the vendor side: an export invoice, image-only PDFs, a new license as a precondition, or silence. The stall table below maps each to the rule.

The rule applies to providers whether or not they run a certified EHR, and a provider with self-developed health IT it does not offer to others is judged as a provider.

Who are the actors, and what can happen to each?

Developers of certified health IT and networks face OIG fines; providers face Medicare payment disincentives.

What are the ten information blocking exceptions?

An actor has to meet every condition of an exception at all relevant times, so a vendor citing one by name has not yet shown it qualifies.

The manner exception says an actor "must fulfill a request for electronic health information in any manner requested" unless it is technically unable or cannot reach agreeable terms. Otherwise it must work without unnecessary delay through a fixed order: certified technology the requestor specifies, then federal or ANSI-accredited standards the requestor specifies, then a machine-readable format, with the means to interpret it, "agreed upon with the requestor."

The fees exception does not cover a fee to run the certified 170.315(b)(10) export for switching health IT or giving patients their data, or "a fee to export or convert data from an EHR technology that was not agreed to in writing at the time the technology was acquired." A fee outside the exception is not automatically illegal, but it loses the safe harbor. Read your original contract before paying for "data extraction services."

ONC's HTI-5 proposed rule, published December 29, 2025, would remove the TEFCA manner exception and narrow the manner and infeasibility exceptions. As of late October 2026 we found no final rule.

What are the penalties, and is anyone enforcing them?

Developers and networks face penalties of up to $1,327,209 per violation, and providers in certain Medicare programs face payment disincentives. Enforcement against developers began in 2026 with certification notices, but as of late October 2026 we found no announced penalty or disincentive.

OIG's civil money penalty rule (88 FR 42820) took effect for information blocking on September 1, 2023. 42 CFR 1003.1410 sets the cap at $1,000,000 per violation and defines a violation as a practice. HHS's 2025 inflation adjustment, published January 28, 2026, raised the maximum from $1,293,601 to $1,327,209, and an October 21, 2026 notice says there will be no 2026 adjustment, so the 2025 levels stay. OIG's stated priorities include patient harm, long duration and actual knowledge.

For providers, the CMS disincentives rule (89 FR 54662, effective July 31, 2024) applies only to providers in these programs, once OIG refers a determination:

• An eligible hospital loses meaningful EHR user status and the three quarters of the annual market basket increase tied to it; a critical access hospital is paid 100 percent of reasonable costs instead of 101 percent.
• A MIPS eligible clinician scores zero in Promoting Interoperability, typically a quarter of the final score.
• An ACO, ACO participant or ACO provider/supplier can be removed from or denied entry to the Medicare Shared Savings Program for at least one year.

Under 171.1101, ONC publicly names providers once a disincentive is imposed, and developers or networks once a penalty is resolved or final. Recent enforcement:

• September 4, 2025: OIG and ONC issued a joint enforcement alert after HHS promised more enforcement resources.
• February 2026: at the ASTP annual meeting, Thomas Keane said the office was issuing notices of potential nonconformity to certified health IT developers, according to Holland & Knight. Alston & Bird reported they concern API performance, interoperability and potential information blocking. In March he described the path from notice to corrective action plan to possible loss of certification (Healthcare Dive).
• April 1, 2026: an HHS reorganization removed the Assistant Secretary for Technology Policy title and restored ONC as a singly titled office. Older documents say ASTP/ONC.
• October 19, 2026: Nextgov reported that HHS had issued seven letters of potential nonconformity, without naming the companies, and Keane said the recipients had largely acknowledged the problems and were remediating.

Most complaints still point at providers. ONC's claims data counts 2,450 possible claims from April 5, 2021 through July 31, 2026. By our sum of its monthly spreadsheet, about 1,940 named a provider, 340 a certified developer and 20 a network or exchange; the rest named non-actors, uncertified developers or no one identifiable.

What does the EHI export criterion give you?

Any product with a certified module that stores EHI must be able to export all of the EHI it can store, for one patient or the whole population, in a documented computable format. That is the 170.315(b)(10) criterion, the most direct tool for leaving a vendor.

The single-patient export must let an authorized user "timely create an export file(s) with all of a single patient's electronic health information that can be stored at the time of certification," at any time the user chooses, "without subsequent developer assistance to operate." Both exports must be computable and come with a "publicly accessible hyperlink of the export's format." Under 170.402, developers had to deliver this to all customers by December 31, 2023.

Epic publishes EHI Tables documentation and describes its output as a "computable, tab-separated value (TSV) file format native to Epic," with rich text documents and images in a separate download.

ONC's test method guidance says stored EHI includes data held by non-certified capabilities of the product and in other storage locations the product uses. If the product stores only links to images kept in a PACS, only the links must be exported. On a hosted system the population export is often run by the vendor, which is where stalling happens.

How do you request a full EHI export?

Put the request in writing, name the regulation, and ask for the specific capability, the format documentation and a delivery date. A vague email invites a services quote.

1. Pull your contract, data return clause and business associate agreement, and note any export fee agreed in writing at purchase. HIPAA also requires a business associate, at termination and where feasible, to return or destroy the PHI it holds for you.
2. Confirm on the Certified Health IT Product List that your product is certified to 170.315(b)(10), and save the public export format link.
3. Send the written request (sample wording below) and log every exchange from then on.
4. If the vendor calls the request infeasible, 171.204(b) requires its reasons in writing within ten business days of receipt.
5. While you still have system access, run your own counts of patients, encounters by year and documents, so you can reconcile the export against them before the contract ends.

"Under 45 CFR 170.315(b)(10) and 45 CFR Part 171, we request a patient population export of all electronic health information stored by [product and version] for [organization], for the purpose of switching health IT. Please include all files, attachments, scanned documents and images or image links, and the export format documentation in effect for this export. Please confirm a delivery date by [date]. If you consider any part of this request infeasible, please provide your reasons in writing as required by 45 CFR 171.204(b)."

Patients have a separate path: the HIPAA right of access in 45 CFR 164.524 gives a covered entity 30 days, plus one 30-day extension with written reasons. Under ONC's guidance, staying within that window does not by itself rule out information blocking.

When is FHIR bulk data export the better path?

Use FHIR bulk export for a recurring feed of USCDI data for a group of patients, such as analytics or population health. Use the (b)(10) export when you need everything, once, to leave a vendor.

Certified APIs under 170.315(g)(10) answer multi-patient requests with the FHIR Bulk Data Access guide (v1.0.0, the version named in 170.215(d)), with group export required, and they cover USCDI data classes rather than all EHI. Authorization uses SMART Backend Services. The flow is asynchronous, and every call, including polling and file downloads, carries the token:

# 1. Kick off a group export
GET https://fhir.example-ehr.com/R4/Group/8f2c-practice-panel/$export?_type=Patient,Encounter,Condition,Observation&_since=2026-01-01T00:00:00Z
Accept: application/fhir+json
Prefer: respond-async
Authorization: Bearer eyJhbGciOi...

HTTP/1.1 202 Accepted
Content-Location: https://fhir.example-ehr.com/bulkstatus/5c1e7a

# 2. Poll the status URL; 202 means still running
GET https://fhir.example-ehr.com/bulkstatus/5c1e7a
Authorization: Bearer eyJhbGciOi...

HTTP/1.1 202 Accepted
X-Progress: 40% complete

# 3. 200 returns a manifest of NDJSON files
HTTP/1.1 200 OK
{
  "transactionTime": "2026-10-20T14:02:11Z",
  "request": "https://fhir.example-ehr.com/R4/Group/8f2c-practice-panel/$export?...",
  "requiresAccessToken": true,
  "output": [
    { "type": "Patient", "url": "https://files.example-ehr.com/5c1e7a/Patient.ndjson" },
    { "type": "Observation", "url": "https://files.example-ehr.com/5c1e7a/Observation-1.ndjson" }
  ],
  "error": []
}

# 4. Download each file; requiresAccessToken=true means send the token
GET https://files.example-ehr.com/5c1e7a/Patient.ndjson
Accept: application/fhir+ndjson
Authorization: Bearer eyJhbGciOi...

The _since parameter lets you pull resources changed after the last transactionTime, which keeps a copy current. Version 1.0.0 has no feed of deleted resources, and servers differ on patients newly added to a group, so upsert by resource ID and run a full export periodically to reconcile. See our FHIR and HL7 integration guide for the HIPAA side.

What should you do when the vendor stalls?

Get the vendor's position in writing, check it against the exception it relies on, and file a claim if it does not hold up. Part 171 sets no general deadline for fulfilling a request; ONC judges delay case by case, so your dated record is what turns a stall into evidence.

Escalate in order: a second written request that cites the first, then a claim at ONC's Report Information Blocking portal. ONC's portal process chart shows ONC acknowledging the claim and sharing it with OIG; against a certified developer ONC can also act under the certification program, up to terminating certification. The OIG hotline (1-800-HHS-TIPS) is an alternative, and the statute generally bars ONC from disclosing information that could identify the reporter. Attach your log and the vendor's written answers, and keep paying for read access until your data is verified.

Some disputes go to court under other laws. In Particle Health v. Epic, an antitrust suit filed in September 2024 over record access through Carequality, a federal judge in New York let the monopolization and tortious interference with contract claims proceed on September 5, 2025 while dismissing the rest (MedCity News). It is not an HHS information blocking finding.

How do you build a copy of your data that you own?

Keep the raw export unchanged with its format documentation, load it into a database you control, and validate it against counts you took before the old contract ended.

1. Store the original files in encrypted, access-logged storage you control, with a checksum per file. Work only on copies.
2. Save the version of the export format documentation that matches the export, since the public link may later point to a newer one.
3. Load the tables into a staging database as delivered, then reconcile row counts against your pre-exit counts and hand-check a few complex charts.
4. Build what users need: a chart viewer for records requests, and FHIR or flat extracts for the next system.
5. Put the archive under your HIPAA security program, with a business associate agreement for anyone who hosts it.

When the documentation skips a code table or packed field, you work it out from the data. AI tools can speed that up, as our guide to reverse engineering legacy systems explains, but use deidentified samples or a tool covered by a business associate agreement. We used the same enumerate, probe and validate method on an undocumented SOAP CRM API with 49+ polymorphic context types. Whether you may decode a vendor's format depends on your license. This is not legal advice; review your license agreement and MSA with counsel, and see our overview of reverse engineering law.

If your system was never certified to (b)(10), you lose the export criterion, and its vendor is an actor only if it has a certified product when the practice occurs. Our post on getting legacy data out of MEDITECH MAGIC covers that case, and what an HL7 interface costs helps budget feeds for the new system.

Where to start this week

Pull your EHR contract and business associate agreement, find the data return clause and any agreed export fee, and check the certification listing. Then send a dated (b)(10) population export request, even if you are not leaving yet, so you see the export before you need it. For help loading and validating it, our EHR integration team does this work, and you can reach us here.