Information-blocking strongholds keeping health care from the future

Legislating for industry change is America’s standard operating procedure. In health care, one example is information sharing and, more intently, compliance with broad and powerful information-blocking laws.

Federal information-blocking laws intend that providers, networks, and health plans share information or face steep consequences. The government is pushing all corners toward interoperability, uprooting entrenched practices like data hoarding and reliance on outdated or subpar systems.

Recently, the U.S. Department of Health and Human Services (HHS) said it “will take an active enforcement stance” by increasing resources for inspectors to crack down. Its focus is on penalizing health care entities that knowingly restrict patients from engaging in their care by blocking their access, exchange, and use of electronic health information. The American Medical Association (AMA) applauded the effort.

Yet, entities are still slow-walking.

Information sharing benefits patients—it saves lives, avoids medical errors, and improves patient outcomes. So why is health care not moving faster? Why do we have to legislate the right thing to do?

There are several reasons: the belief that holding onto information gives businesses an edge, the monetization of data has boosted bottom lines, the systems in place feel difficult to modernize, and “good enough” compliance is the norm.

So legislate we must—or do we?

Government action against information-blocking

Since late 2022, virtually all electronic patient information has been expected to flow freely to patients and authorized parties such as providers, electronic health records (EHR) companies, health information exchanges (HIEs), and networks. In 2020, HHS’s Office of the National Coordinator (ONC) issued an information-blocking rule defining prohibited interference with electronic health information (EHI) sharing, alongside a Centers for Medicare & Medicaid Services (CMS) rule on interoperability. In late 2022, it expanded to all EHI in a patient’s record. Prior, the 21st Century Cures Act in 2016 stated that sharing EHI is “the expected norm” and directed HHS to stop practices that impede information exchange.

Providers must not unreasonably block any clinical data from patients or other providers who have rights to the information. The penalties for breaking these rules are significant, such as millions of dollars in fines, Medicare program reimbursement penalties, and being publicly named. Providers must also attest to not blocking data as part of federal payment programs, and a false attestation can trigger audits or exclusion. HHS’s Office of Inspector General (OIG) set penalties of up to $1 million per violation by health IT developers, networks, and exchanges.​

Health plans also face federal mandates. The CMS Interoperability and Patient Access Rule in 2020 requires Medicare Advantage, Medicaid, CHIP, and exchange plans to open their data via APIs. They may not be explicitly labeled “information-blocking” actors in the ONC rule, but they are very much part of the movement.

Dispelling Information-Sharing Financial Concerns

The most common hesitation, especially among larger health systems and health plans, is the fear of “giving away” their data, whether it’s losing a competitive edge, exposing proprietary insights, or missing out on monetization opportunities. While patients assume their doctors have access to their medical history, the reality is that disparate healthcare organizations hoard data like a competitive asset and cherry-pick what they share. Issues must be dispelled.

Ownership vs. stewardship: Patients own their health information, and providers and plans are stewards. A business refusing to share “its” data is at odds with patient-centered care and is taking undue risk with compliance.

Competitive advantage illusions: Some hospital systems fear that sharing data with outside providers (especially competitors) could enable patients to go elsewhere or reduce referrals. The reality is that patients and payers expect interoperability, and a hospital that tries to silo information may lose business. Also, if a business doesn’t share data, someone will report it, and the business will face penalties. If it does share, the business likely gets data in return that it would not have had otherwise, which can be a competitive advantage.

Monetization myths: Some organizations have historically monetized data (e.g., selling de-identified datasets for research) and worry that broad sharing will diminish value. (Information-blocking rules actually allow reasonable fees and even licensing in certain contexts.) However, interoperability isn’t “giving data away for free”; it’s meeting requirements for patient care. Information sharing can open new revenue opportunities, like attracting research partnerships or quality incentive payments that outweigh legacy data-selling models.

The truth is that organizations embracing interoperability see better patient outcomes, higher efficiency, and stronger financial performance. When a primary care doctor can easily pull a hospital’s discharge summary, the patient gets timely follow-up. When specialists can see each other’s notes and test results, it avoids duplicates and adverse drug interactions.

Checking the compliance box is not enough

Critical patient information often sits unused in Health Information Exchanges (HIEs) because they are passive repositories where providers must manually retrieve it. Some providers or plans might think, “We’re connected to our state HIE, and we’ll just do the bare minimum to check the compliance box.” Passive compliance (or HIE dumping) is not the same as active interoperability; sending data to an HIE and never looking at it again might technically make it available, but it doesn’t guarantee that all necessary parties can access it. If a complaint is lodged, regulators know the difference. When investigating, they will consider whether an entity made a good-faith effort to share information or just did the bare minimum.

Antiquated systems continue to throttle information sharing. The modern technology-driven approach to information sharing must be adopted. Platforms with real-time insights, easy collaboration, and critical alerts can close the gaps, demonstrate an organization’s commitment to information sharing, and future-proof the business.

Policymakers should continue enforcement, and healthcare leaders should stop resisting the inevitable. The industry must move faster and with more focus on technology-powered care coordination, as information sharing is not just necessary to avoid being punished but is also a patient safety issue, a competitive edge, and a means to reduce administrative costs.

Effie Carlson is the CEO of Watershed Health. She brings more than 16 years of experience in health care leadership, policy, strategy, and business development across the provider and payer sectors, and her experience spans managed care, health care technology, government relations, and value-based care. Carlson founded EJC Consulting Group and has served in executive leadership positions at Modivcare, PayrHealth, Team Select, and CareCentrix. Carlson is an active advisor and board member for health care organizations, including the Texas e-Health Alliance, SendaRide, and the Non-Emergency Medical Transportation Accreditation Commission® (NEMTAC®). Follow on LinkedIn.