Information blocking compliance lived in EHR defaults
When the Cures Act information blocking rules applied on April 5, 2021, health systems discovered that compliance was decided by portal settings and release-of-information queues. Three operational questions mattered: what gets released, when, and how a withholding decision is defended.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
April 5, 2021 was the applicability date for the information blocking provisions of the ONC Cures Act Final Rule, issued in 2020 under the 21st Century Cures Act. The date had been pushed back from November 2020 because of the pandemic. From then on, health care providers, developers of certified health IT, and health information networks and exchanges were prohibited from practices likely to interfere with the access, exchange or use of electronic health information, unless an exception applied. The rule defined eight exceptions, including preventing harm, privacy, security, infeasibility, health IT performance, content and manner, and fees. For the first period, the information covered was limited to the data elements in version 1 of the United States Core Data for Interoperability. Penalties for developers and networks, and disincentives for providers, were left to later rulemaking.
Earlier in this series we looked at the 2020 rules that created the duty not to block and the standardized APIs that would carry patient data out of the HIPAA perimeter. April 2021 is when that duty met daily operations. Many health systems approached the date as a legal milestone and updated their policies. The work that mattered was elsewhere: in what the electronic health record released, how fast, and how staff handled the requests the portal did not answer. It falls into three parts: what is released (the scope of information and the default settings that govern it), when it is released (the timing that drew most clinician concern), and how a withholding is defended (the exceptions, which protect only an organization that can show it met their conditions).
What is released: defaults now carry legal weight
Before the rule, many organizations held back certain note types, results or documents from patient portals by default. Those settings were often made years earlier, during a portal rollout, for reasons nobody could fully recall. Some systems hid all pathology reports. Others shared only discharge summaries and never progress notes. Under the rule, a default that withholds information without an applicable exception can itself be an interfering practice.
That turned EHR configuration into a compliance artifact. Health systems had to list every note type, result category and document class, record whether each flowed to the portal and to API-connected apps, and justify each restriction. The work needed clinical informatics, compliance, privacy and EHR analysts in the same room, because none of them alone understood both the build and the legal test.
Two practical complications followed. Many systems discovered that the same information appeared in several places, so releasing a note type while suppressing a result could leave the result visible inside the note. And some data that should be withheld, such as adolescent confidential information or certain substance use disorder records, sat in the same note types as everything else. Getting defaults right meant tagging sensitive content at the point of documentation, which required clinician training and template changes.
When it is released: the immediate-results debate
The most visible change for clinicians was timing. To avoid interference, many organizations moved to releasing test results and notes as soon as they were finalized, instead of after a waiting period that let clinicians review them first. Some patients therefore saw an abnormal result, sometimes a serious diagnosis, before their clinician had called.
Clinician concern was real and widely reported. The rule did include a preventing harm exception, but it is narrow. It requires either an individualized determination by a licensed professional or a specific, reasonable belief tied to identified risks, and the type of harm must meet a defined threshold that depends on who is asking for what. A general preference to deliver bad news in person did not meet that standard on its own.
Organizations responded with workflow, not delay. Some added a patient-facing choice in the portal to wait for a clinician before viewing certain results, which keeps the decision with the patient. Others built inbox prioritization so that clinicians saw abnormal results first, created standard explanatory text for common tests, and trained staff to expect calls from patients reading results on a weekend. These measures cost little and reduced friction more than any policy memo.
How a withholding is defended: exceptions must be documented
The exceptions are defenses that work only when an organization can show it met each condition. The privacy exception can support withholding when a patient has asked for a restriction or when state law requires consent. The infeasibility exception can apply when a request cannot be met for specified reasons, but it requires a written response to the requester within ten business days. The content and manner exception allows an organization to fulfill a request in an alternative manner when the requested one is not feasible. The fees exception limits what may be charged.
Meeting these conditions is a records problem. Health systems needed a way to log when information was withheld or delayed, which exception applied, who decided and what was sent to the requester. Most EHRs and release-of-information tools were not built for that, so many organizations built tracking around them, often in the same queue that handled HIPAA access requests.
The same discipline applied to requests from other parties: other providers, health information exchanges, payers and apps acting for patients. Many health systems had habits that slowed such requests in practice, such as manual review queues, unclear fee schedules, or insistence on a particular form or fax line. Each now needed a basis in an exception. Release-of-information teams, often outsourced, found themselves at the center of a federal obligation, and health systems needed to confirm that vendors followed the same standard.
Who the rule reaches also matters. Providers face a knowledge standard: they must know a practice is unreasonable and likely to interfere. Developers of certified health IT and health information networks face a broader one. A health system that also operates a regional exchange or sells software to affiliates may sit in more than one category, and organizations should check with counsel on how the definitions apply to them.
With hindsight
From 2026, April 2021 looks like the start of a slow climb. The scope of electronic health information expanded beyond the core data set in October 2022. The HHS Office of Inspector General finalized civil money penalties of up to $1 million per violation for developers and networks in 2023, and HHS finalized disincentives for providers through Medicare programs in 2024. Federal officials announced stepped-up enforcement in 2025. Immediate release of results became normal practice. Early clinician worries eased as patients and care teams adapted, though receiving bad news through a portal remains a real issue that organizations manage through patient choice, messaging and education. What held up is the operational reading of the rule: organizations that treated April 5 as a configuration review and built a withholding log were far better placed when enforcement arrived than those that treated it as a policy update.