The information blocking rule has changed the default in healthcare from “share when required” to “share unless an exception applies” — and getting it wrong now carries real penalties. The hard part is rarely wanting to comply; it is operationalizing the rule, applying the eight exceptions correctly, and documenting the decisions. Taction Software provides the technical and workflow side of information blocking compliance: practice discovery, exception-framework implementation, technical access and API design, and the documentation tooling that supports your compliance posture.
An important boundary: information blocking is a legal and regulatory matter, and this is implementation support, not legal advice. We work alongside your compliance team and counsel, who make the legal determinations. For the broader context, see our overview of 21st Century Cures Act compliance.
Schedule an Info Blocking Compliance Assessment (Free 45-Min) → (NDA-protected)
Healthcare regulatory implementation experience · ONC rule specialist team · HIPAA + BAA
What the Info Blocking Rule Prohibits
Definition of “Information Blocking”
Broadly, a practice by a regulated actor that is likely to interfere with the access, exchange, or use of electronic health information (EHI), except as required by law or covered by an exception.
Who Is Subject (Actors Defined)
Three actor types: health care providers, health IT developers of certified health IT, and health information networks and exchanges (HINs/HIEs).
Penalty Framework
Health IT developers, HINs, and HIEs can face OIG civil monetary penalties of up to $1 million per violation. Health care providers are subject to separate “disincentives” established by a later rule (tied to federal program participation rather than CMPs). The specifics of how these apply to you are a legal determination for your counsel.
The 8 Exceptions
The rule defines eight exceptions in two groups. We help you implement the technical and workflow conditions each requires; whether a given practice qualifies is a legal call.
Exceptions for Not Fulfilling a Request (5)
- Preventing Harm — withholding to prevent harm, under defined conditions.
- Privacy — declining where fulfilling would violate privacy law or conditions.
- Security — protecting the security of EHI, under defined conditions.
- Infeasibility — where fulfilling is genuinely infeasible.
- Health IT Performance — temporary actions to maintain or improve health IT performance.
Exceptions for the Manner of Fulfilling a Request (3)
- Content and Manner — fulfilling in an alternative content or manner under the rule’s conditions.
- Fees — charging certain fees that meet the exception’s conditions.
- Licensing — licensing interoperability elements on reasonable, non-discriminatory terms.
Our Info Blocking Compliance Approach
Practice Discovery & Gap Assessment
We inventory your data-sharing practices and identify where information blocking risk exists.
Exception Framework Implementation
We implement the technical and operational conditions your relied-upon exceptions require.
Policy & Procedure Development
We help develop the supporting policies and procedures, in coordination with your compliance team and counsel.
Technical Workflow Design
We design the access, API, and request-handling workflows so sharing is the default and exceptions are applied deliberately — built on our FHIR API development work.
Training & Documentation
We build the documentation and support the training so decisions are recorded and defensible.
Info Blocking for Different Actors
Healthcare Providers
Providers must make EHI available and handle access requests without practices that interfere — with the right exceptions applied. Related: our ONC certification and CMS interoperability work.
Health IT Developers
Developers of certified health IT must not design or operate products in ways that block information, and must support standardized access (e.g., APIs).
HIEs / HINs
Networks and exchanges must not impose practices that interfere with exchange across their participants.
Common Practices That Trigger Info Blocking Concern
The recurring risk areas: data access fees that do not meet the Fees exception, information withholding without a valid exception, API throttling that impedes access, and onerous patient workflows that effectively block patient access. We assess each against the rule.
Enforcement & Penalty Risk
Enforcement is active. Developers, HINs, and HIEs face OIG civil monetary penalties (up to $1 million per violation), and providers face disincentives under the separate provider rule. Enforcement actions have begun under these frameworks; rather than cite specific cases that may be mischaracterized, we focus on reducing your risk to the point where enforcement is not a concern. Your counsel advises on legal exposure.
Frequently Asked Questions
Can we still charge for some data access?
Sometimes. The Fees exception permits certain fees that meet its conditions, but it does not cover things that must be provided without special charge, such as a patient’s access to their own EHI. Whether a specific fee qualifies is a legal determination; we build the workflows and documentation to support fees that your counsel confirms are permissible.
What about competitor data requests?
The rule is specifically concerned with anti-competitive withholding, so declining a legitimate request simply because the requester is a competitor is risky. The Licensing and Content-and-Manner exceptions govern how you may respond on reasonable terms. We implement compliant request-handling; the legal line on a given request is for your counsel.
Documentation requirements?
Documentation is central, because exception reliance has to be demonstrable. We build the tooling to record your practices, the exceptions relied upon, and the basis for decisions, so you can show your reasoning if questioned.
How to handle patient consent?
Patient access to their own EHI generally must be fulfilled, while the Privacy exception governs situations where law or required consent applies. We build consent and access workflows consistent with that, in line with our data security and HIPAA-compliant development practices, with your counsel confirming the legal treatment.
Schedule an Info Blocking Compliance Assessment (Free 45-Min) →
Reviewed by Taction Software’s healthcare regulatory implementation team. ISO 27001-certified information security management. This is technical and workflow implementation support, not legal advice; legal determinations rest with your compliance team and counsel. PHI is handled under a signed BAA.