Information Blocking

What is Information Blocking?

In the 21st Century Cures Act, The Office of the National Coordinator (ONC) for Health Information Technology (HIT) released requirements regarding the prevention of “information blocking.”  Information blocking refers to anything that restricts sharing and accessing electronic health information (EHI) among physicians and patients. The benefits of the information blocking provisions:

  • Enhances care coordination among physicians.
  • Facilitates secure sharing of patient information.
  • Reduces administrative burden.
  • Provides patients with convenient access and transparency to their health information and increases patient engagement.

Direct Address Requirement

Upload digital contact information in NPPES

As of May 1, 2021, per the 2020 CMS Interoperability and Patient Access Final Rule, physicians must provide their digital contact information (direct address and/or an Application Programming Interface endpoint) in the National Plan and Provider Enumeration System (NPPES). The direct address is similar but not the same as an email address and can be obtained from the physician's EHR vendor (ex. This information is publicly available in the NPI registry and the NPI downloadable file. To learn more about direct addresses, refer to the Direct Address Q&A.

How to meet this requirement

  1. Refer to the CMS Public Reporting of Missing Digital Contact Information web page to determine if you are non-compliant with the requirement, or search for your name and/or NPI on the NPPES NPI lookup web page and verify in the Health Information Exchange section that your endpoint (direct address) is included. If you do not see any information in that section, most likely you are not at compliance and will need to upload your direct address.
  2. Obtain your direct address or API endpoint from your EHR vendor, HIE, or another certified entity with direct messaging capability, such as a Health Information Service Providers (HISPs).
  3. Log in to NPPES with your user ID and password and enter the direct address in the API endpoint field in the Health Information Exchange section.


There are no penalties at this time for noncompliance. However, CMS has publicly published a list of physicians who have not complied. Penalties will be considered in future rulemaking.



Information Blocking Requirement

Information blocking is a practice by an "actor" that is likely to interfere with the access, exchange, or use of electronic health information (EHI), except as required by law or specified in an information blocking exception.  EHI is electronic protected health information (ePHI) as defined in 45 CFR 160.103 to the extent that it would be included in a designated record set as defined in 45 CFR 164.501, regardless of whether the group of records are used or maintained by or for a covered entity asdefined in 45 CFR 160.103. EHI shall not include psychotherapy notes as defined in 45 CFR 164.501 or information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding. Information is EHI if it is:
  • Individually identifiable health information that is either maintained or transmitted electronically; AND
  • Either individual medical records, billing records, payor records, or records used to make decisions about individuals; AND
  • Not excluded form the EHI definition
Information is not EHI if it is:
  • Psychotherapy notes as defined in 45 CFR 164.501
  • Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding
  • Individually identifiable health information in education records covered by the Family Educational Rights and Privacy Act, 20 U.S.C. 1232g
  • Individually identifiable health information in records described at 20 U.S.C. 1232g(a)(4)(B)(iv)
  • Individually identifiable health information in employment records held by a covered entity in its role as employer
  • Individually identifiable health information regarding a person who has been deceased for more than 50 years
  • De-identified protected health information as defined under 45 CFR 164.514

  • As of April 5, 2021, patients and their physicians must be given immediate electronic access to the following limited USCDI v1 data elements in the patient’s electronic health information upon request:

    • Procedure, progress, and clinical notes; lab, pathology, and imaging reports
    • Discharge summaries
    • Assessment, plan of care, health concerns, and goals
    • Allergies, immunizations, smoking status, implanted device identifiers, and demographics
    • Care team members
    • Vitals, problems, history and physical, and provenance

    As of October 6, 2022, physicians must respond to a request to access, exchange, or use electronic health information (EHI) more broadly. The definition of EHI would include medical records, billing records, payment and claims records, case management records, and other records used, in whole or in part, for a medical group to make decisions about individuals.

    How to meet this requirement

    The physician is responsible for verifying with their EHR vendor their preparations for complying with the information blocking rules. To ensure that the requirement is met, patients should be able to access this health information electronically without charge and without delay. To comply, physicians and practices should:

    • Check with their EHR vendor about their capabilities to allow the release and accessibility of the required information in the patient portal.
    • Ask the EHR vendor how they will help to determine and document the use of exceptions (see “Exceptions” section below).
    • Evaluate whether existing practice policies about accessing EHI reflect the ONC Final Rule requirements and ensure that the practice staff understands how to approach EHI requests.


    Physician penalties for noncompliance will be decided in future rulemaking. ONC's proposed rule to identify appropriate disincentives and refer healthcare providers to the appropriate agency for enforcement is pending before the Office of Management and Budget Unified Agency (OMB).


    There are eight exceptions that when the practice meets the condition(s) of an exception, it will not be considered information blocking.