HHS Warns US Health Care Industry To Share Data With Patients Or Else

It took four presidential administrations to finally get it done, but US health care actors that block patient and provider access to electronic medical data may finally begin to face actual consequences.

The Department of Health and Human Services (HHS) took a break from dismantling the US public health system this week to announce plans to take "an active enforcement stance" against health care actors [PDF] that "restrict patients' engagement in their care by blocking the access, exchange, and use of electronic health information," the agency said in a press release.

"Patients must have unfettered access to their health information as guaranteed by law," acting HHS Inspector General Juliet Hodgkins said in an agency press release. "Providers and certain health IT entities have a legal duty to ensure that information flows where and when it's needed." 

The law Hodgkins referred to is the 21st Century Cures Act, which was signed into law by President Obama in 2016. The rule requires that patients have easy electronic access to their health information, including through whatever app they choose to use, at no cost for basic API access, and also requires that health IT developers make their systems usable by providers without excessive fees or technical barriers.

While a great idea in principle, the Cures Act only set civil monetary penalties for developers, health information networks, and exchanges that violate those sharing rules, leaving penalties for providers undefined and allowing health care data to be locked down with little consequence if they didn't comply. Provider disincentives were left for HHS to determine, and a draft proposal didn't appear until late 2023. 

Disincentives for providers weren't finalized until July of last year. Despite Biden's team having little time to develop and stand up an enforcement mechanism after the finalization, the current HHS still accused the former administration of failing to prioritize information blocking penalties during its time in office. 

The veracity of those accusations may be questionable, but there's also a fairly obvious reason why the Biden administration may not have prioritized information blocking: There haven't been that many reports of it happening in the past few years. 

• Trump officials float plan for Americans to share their medical data more freely
• Uncle Sam throws AI 'chili cook-off' to spice up healthcare fraud detection
• US senators propose law to require bare minimum security standards
• 96% of US hospital websites share visitor info with Meta, Google, data brokers

According to the HHS' own data, just 1,336 possible claims of information blocking have been filed since an online portal to do so went online in April 2021. That's less than a report a day as of August 31, when the data ends. 

That hasn't stopped providers from being concerned about how data blocking may affect the future of health care in the digital age, but it does suggest that it may be a somewhat isolated problem and not an issue threatening patient outcomes. 

Reports might increase if people believe there's a point to filing them, of course, and those penalties might serve that purpose. Per the HHS, blocking access to data in violation of the Cures Act could subject health care providers to unspecified Medicare and Medicaid "disincentives," and health care IT firms may be fined up to $1 million per violation. In addition to those penalties, health care IT firms that participate in HHS' Health IT Certification Program may have their certification revoked and be banned from the program. 

HHS didn't respond to questions for this story. ®