Most information blocking claims name providers, not developers

Most information blocking claims name providers, not developers. ASTP logged 2,450 possible claims of information blocking from April 2021 through July 2026. A health care provider was named in 1,938 of them. Certified health IT developers were named in 338. Yet the first enforcement steps HHS has described were notices to software developers.

That order follows the law more than the complaints. Developers and health information networks face penalties of up to $1 million per violation, enforced by OIG since September 2023. Providers face disincentives in Medicare programs instead, under a stricter test of intent. The payment cut lands 2 years after a referral. Health plans are not named as actors, though a plan can become one if it fits an actor’s definition.

Key takeaways

• Complaints keep growing. ASTP logged 2,450 possible claims through July 31, 2026, up from 274 in its first public count in February 2022.
• Providers are named most. About 79% of claims named a health care provider. Patients filed 63% of them.
• Enforcement started with developers. ASTP said in February 2026 that it was issuing notices of nonconformity to certified developers. No penalty had been announced as of late June.
• Provider penalties arrive slowly. A Medicare disincentive takes effect 2 years after OIG refers a finding to CMS.
• HTI-5 would narrow the exceptions. The proposal would remove the TEFCA manner exception and make clear that automated access, including by AI systems, counts as access.
• Plans should act as if covered. Health plans are not named actors. They still hold and request the same records, and we think they should meet the same standard.

Who the rules cover

The 21st Century Cures Act prohibits information blocking by the actors in the table below. Information blocking is a practice likely to interfere with the flow of electronic health information. The rule allows a practice that the law requires. It also allows practices that fit one of its exceptions.

The standard of intent differs by actor. A developer or network violates the rule if it knows, or should know, that a practice is likely to interfere. A provider violates it only if it knows the practice is unreasonable and likely to interfere, under 45 CFR § 171.103. That higher bar makes provider cases harder to prove.

Health plans are not named in the definitions. They are not excluded either, according to an ASTP answer updated in September 2025. A plan can be an actor if it also fits one of the actor definitions. ASTP notes that the network definition is functional, so a plan’s activities matter more than its label.

The penalties differ as sharply as the standards.

OIG’s penalties for developers and networks have applied to conduct since September 1, 2023, according to Alston & Bird. ASTP can also terminate a developer’s certification and bar it from the certification program, according to HHS.

The exceptions take up most of 45 CFR part 171. Some let an actor decline a request in defined cases, such as preventing harm to a patient. Others govern how an actor fulfills a request. The manner exception and the fees exception are among them. A separate exception covers actors that take part in TEFCA, the national framework for exchange among networks.

How provider disincentives work

HHS finalized the provider disincentives in 2024. OIG investigates and decides whether a provider engaged in information blocking. It then refers the finding to CMS, which applies the disincentive without reviewing the finding, according to Hall Render.

• Hospitals. An eligible hospital loses three-quarters of its annual market basket update.
• Critical access hospitals. Payment falls to 100% of reasonable cost from 101%.
• Clinicians in MIPS. The clinician scores zero in the Promoting Interoperability category.
• Accountable care organizations. The organization or participant is barred from the Shared Savings Program for at least a year.

The timing is slow by design. A disincentive applies 2 years after the referral, so conduct referred in 2025 would be penalized in 2027. ASTP will post information about providers subject to disincentives on its public website. It will also post developers and networks found to have blocked information. A separate subpart of the regulation covers that public posting.

The 2024 rule set disincentives only through those programs. A provider outside them faces no disincentive under it.

What the complaints show

ASTP counts every submission to its Report Information Blocking Portal. Its latest figures run from April 5, 2021 through July 31, 2026, according to its quick stat updated August 4, 2026. A claim can name more than one actor.

Patients filed 1,554 of the claims. Third parties acting for patients filed 319 more. Health care providers filed 238, and health IT developers filed 155. Attorneys filed 114.

The growth is steady. ASTP’s first public count, in February 2022, found 274 possible claims. Providers were named in 211 of them, about 77%. The share naming providers has barely moved in more than 4 years.

ASTP is careful about what a claim means. Logging a submission as a claim does not mean ASTP has investigated it or made a determination. The counts describe what people complain about. They do not show how much blocking actually occurs. ASTP also does not publish the claims by type of practice. A breakdown by practice would show which kinds of conduct drive the complaints, and where guidance would help most.

What they do show is who complains and about whom. Most claims come from patients and their representatives, and most name a provider. That points at the provider’s portal and records office, where patients usually meet their records.

Some of those practices are well understood. The office’s guidance in 2021 said that delaying lab results so a clinician can review them first is likely to be considered an interference, according to Davis Wright Tremaine. An organization-wide policy of delay does not fit the preventing harm exception, which generally covers decisions about individual patients. A patient who waits days for a result sees the delay directly. That patient is the person most likely to file a claim.

The complaints point at providers. The strongest penalties point at developers.

What enforcement has done in 2026

The rules took effect in April 2021. For most of the years since, enforcement was a matter of rulemaking. That changed in September 2025, when HHS announced a crackdown. HHS said ASTP had begun reviewing reports about certified developers to help OIG investigate, according to its release.

OIG has said it will prioritize conduct that harms patients or significantly impairs care. It will also look first at conduct that persists or causes losses to federal programs, according to Alston & Bird.

Developers

At its annual meeting in February 2026, ASTP said it was issuing notices of nonconformity to developers of certified health IT, according to McDermott. It did not say how many. A notice can lead to a corrective action plan. A developer that fails one can have its certification suspended or terminated, or be referred to OIG, according to Alston & Bird.

By June, Assistant Secretary Thomas Keane said some recipients had acknowledged noncompliance. They were on corrective action plans, according to Becker’s. OIG was hiring attorneys and conducting investigations. Becker’s reported no penalty as of June 24.

The stakes reach customers. If a developer fails a corrective action plan and loses certification, its customers can lose access to CMS payment incentives that require certified technology, according to Becker’s. A hospital can do everything right and still inherit its vendor’s problem. That gives developers a strong reason to settle a notice quickly, and it gives customers a reason to ask whether their vendor has received one.

The meeting also signaled a competition theme. Speakers from the FTC and the Justice Department’s Antitrust Division joined OIG at an information blocking session. Presenters voiced concern about dominant technology gatekeepers that use control over data to hold back competitors, according to McDermott.

Providers

No provider disincentive had been publicly reported by June. Alston & Bird’s February review described the disincentives as in effect but reported none applied. Becker’s June report did not count any either.

The slow path is built into the rule. OIG must find that the provider knew the practice was unreasonable. CMS then applies the disincentive 2 years after the referral. A provider referred in 2026 would not see a payment cut until 2028.

Why the order makes some sense

Starting with developers has a logic. A developer’s product decision reaches every customer at once. A fee for an interface or a slow process for registering apps can affect hundreds of hospitals. Fixing it at the source fixes it everywhere.

The rules also give enforcers a way to check developers from the outside. Developers of certified patient access APIs must publish the service base URLs of their customers’ endpoints at no charge. Once a developer verifies an app’s authenticity, it must register the app for production use within 5 business days, under 45 CFR § 170.404. Those are facts an outside tester can check. Outside testing would also catch problems that no patient thinks to report.

The cost of the order falls on patients. The claims show that patients most often meet blocking at a provider. Those are the cases with the hardest standard of intent and the slowest penalty. A patient who filed a claim against a hospital in 2026 has no public way to see where it stands.

What HTI-5 would change

ASTP proposed HTI-5 on December 29, 2025. Comments closed on February 27, 2026. The rule had not been finalized as of late June, according to Becker’s.

Most of HTI-5 removes certification requirements. It would remove 34 of the 60 certification criteria in effect and revise 7, with estimated savings of $1.53 billion, according to the proposed rule. On information blocking, it moves the other way.

• The TEFCA manner exception would go. ASTP cites TEFCA’s maturity. Nearly 500 million records had been exchanged through TEFCA by February 2026, according to Alston & Bird.
• The manner exception would tighten. It could no longer be met with a contract of adhesion. Nor could it be met with terms that are unconscionable or priced above market.
• The infeasibility exception would narrow. An actor could no longer cite a third party’s request to modify records as grounds for refusal. The condition that lets an actor refuse after offering alternatives would be narrowed or removed.
• Automated access would count. The definitions of access and use would state that they include automated means, including autonomous AI systems.

ASTP’s new answers to common questions add that interference can include interference with access by agentic AI or robotic process automation, according to McDermott. That matters for anyone who retrieves records with software, including health plans.

Our piece on TEFCA in early 2026 described how exchange through the framework has grown. Without that exception, an actor could not limit a fellow TEFCA participant to TEFCA alone. It would have to fit the general manner exception instead.

The changes would land on the actors the complaints already name. A provider that offers records only on its own terms, or only through 1 channel, would have less room to call that a reasonable alternative. A developer that charges above market for an interface would lose a defense it might otherwise have used.

HTI-5 cannot change the provider standard of intent. That standard comes from the Cures Act itself, so provider cases will stay harder to prove whatever the final rule says.

Where payers fit

Health plans sit outside the rule’s named actors but inside the record flow. A plan holds claims and prior authorization data that patients and providers want. A plan also requests clinical records from providers for utilization review, and much of that retrieval now runs through software.

CMS covers the first half through its own rules. Its 2024 interoperability rule requires payers to run several FHIR APIs by January 2027, according to CMS’s fact sheet. Our piece on the 2027 payer API deadline described the standards behind them. The APIs give payers duties that run parallel to the information blocking rule.

• Patient access. Patients can pull their claims into an app, and from 2027 their prior authorization history as well.
• Provider access. In-network providers can pull the same data for patients they treat.
• Payer to payer. A new plan can pull a member’s history from the old plan when the member agrees.
• Prior authorization. Providers can submit requests electronically and get decisions with specific reasons.

Those APIs carry their own requirements, and CMS enforces them rather than OIG. A plan that misses the deadline faces CMS, not a civil money penalty under the Cures Act.

CMS has also asked plans to join voluntary networks. More than 60 companies pledged in July 2025 to meet the agency’s interoperability framework, according to CMS. Our piece on the framework’s first quarter followed the early results.

The second half depends on how HTI-5 lands. If automated access counts as access, a provider practice that blocks a plan’s automated retrieval would be judged like any other interference, subject to the exceptions.

Where Redlake stands

Redlake builds tools that health plans use in utilization review. We read records for a living, and we want them to move.

Plans should act as if the rule applies to them. A plan that answers patient and provider requests by the same standard as an actor loses little. It gains a defense if a regulator later decides its exchange activities make it a network.

Every claim should have a visible status. ASTP should tell each claimant where a claim stands. It should publish closed cases with the practice found and the fix, even when no penalty follows. Public findings teach the market faster than penalties do.

Enforcers should test from the outside. ASTP can check published endpoints for availability and app registration times without waiting for a complaint. A measured registration delay is a finding a developer can fix in a week.

Plans should publish their own endpoints. A plan’s patient access and provider access endpoints should be as easy to find as a certified developer’s. A public directory lets apps and providers connect without a sales call, and it lets anyone check that the endpoints work.

Automated access should come with accountable software. We support counting automated access as access. Software that retrieves records should identify itself and its operator. It should also keep a log of what it retrieved. Every decision our tools support can be reconstructed, and a retrieval should be too.

What to watch in the rest of 2026

• The HTI-5 final rule. Watch whether the automated access definitions and the exception changes survive.
• The first penalty. Watch for OIG’s first civil money penalty against a developer or network.
• The first provider referral. Watch for the first referral to CMS, which would start the 2-year clock.
• Public findings. Watch whether ASTP posts any findings on its website.
• New claim counts. Watch whether the share of claims naming providers changes as enforcement grows.
• Competition cases. Watch whether the FTC or the Justice Department brings a case that cites information blocking.
• The payer API deadline. Payer APIs under CMS’s 2024 rule are due January 1, 2027.

About this analysis

Method. The information blocking rules and their enforcement from April 2021 through September 2026 are described from ASTP’s claim counts and federal regulations. Law firm summaries and trade press fill in what officials said at public meetings.

Data notes. Claim counts are ASTP’s and run through July 31, 2026. A claim can name more than one actor, so actor counts exceed the total. Percentages are this analysis’s calculations from ASTP’s counts. Enforcement steps after February 2026 are described from public remarks reported by law firms and trade press. HHS has not published counts of notices or investigations.

Sources. ASTP quick stat on information blocking claims (August 4, 2026). ASTP claims post (February 28, 2022). ASTP answer on health plans (September 12, 2025). HHS release (September 3, 2025). Alston & Bird (February 23, 2026). McDermott on the ASTP annual meeting (February 20, 2026). McDermott on HTI-5 (January 2026). Becker’s Hospital Review (June 24, 2026). Hall Render on provider disincentives (July 29, 2024). Davis Wright Tremaine on delayed results (March 24, 2021). HTI-5 proposed rule in the Federal Register (December 29, 2025). CMS release on the interoperability framework (July 30, 2025). Federal regulations at 45 CFR part 171 and § 170.404.

Frequently asked questions

What is information blocking?

Information blocking is a practice likely to interfere with the flow of electronic health information. The 21st Century Cures Act prohibits it unless the law requires the practice or an exception applies.

Who can be penalized for information blocking?

Certified health IT developers and health information networks face civil money penalties of up to $1 million per violation. Health care providers face disincentives in Medicare programs. Each group faces a different standard of intent.

Are health plans subject to information blocking rules?

Health plans are not named as actors, but they are not excluded. A plan can be an actor if it also fits one of the actor definitions, such as a health information network.

Has anyone been penalized for information blocking?

No penalty had been publicly announced as of late June 2026. ASTP said in February 2026 that it was issuing notices of nonconformity to developers. Some recipients have since entered corrective action plans.

What would HTI-5 change about information blocking?

It would remove the TEFCA manner exception and tighten the manner exception. It would narrow the infeasibility exception. It would also state that access and use include automated means, including AI systems.

How do patients report information blocking?

Patients can submit a claim through ASTP’s Report Information Blocking Portal on HealthIT.gov. Caregivers and providers can use the same portal.