In 2026, certified health IT developers and health information networks face civil money penalties of up to $1 million per information blocking violation. Providers face Medicare disincentives: hospitals lose three quarters of their market basket update, MIPS clinicians score zero in Promoting Interoperability, and ACOs can be barred from Shared Savings for a year.
Information blocking has been prohibited since 2021, but for years it had no teeth. That changed in steps: OIG penalties for developers and networks in September 2023, provider disincentives in July 2024, an HHS "crackdown" announcement in September 2025, and the first ASTP notices of nonconformity to EHR developers in February 2026. If you build or run software that holds electronic health information, this is now a compliance risk with real numbers attached. This guide summarizes who is covered, the penalties, the enforcement status as of November 2026, and the engineering controls that reduce exposure.
Who can be penalized for information blocking?
Three kinds of "actors": health care providers, developers of certified health IT, and health information networks or exchanges. The 21st Century Cures Act defines information blocking as a practice likely to interfere with access, exchange or use of electronic health information, unless it is required by law or fits an exception.
The knowledge standard differs by actor. Developers, networks and exchanges are liable if they know or should know a practice is likely to interfere. Providers are liable only if they know the practice is unreasonable and likely to interfere. That difference is why developers carry the largest financial risk. The scope of electronic health information widened on October 6, 2022 to cover electronic PHI in a designated record set, so most clinical and billing data is in scope. ASTP/ONC's information blocking resources hold the definitions and FAQs.
Is a healthtech startup an "actor"?
Not automatically. A startup that does not offer certified health IT and does not operate as a network is usually not a developer or HIN under the rule, though HTI-1 refined who counts as "offering" certified health IT, so check with counsel. But your customers almost certainly are actors. If your product sits between a provider and a patient's data, your design choices (export formats, API limits, fees you pass through) can become your customer's information blocking problem, and that shows up in contracts and security reviews.
What are the penalties for health IT developers and HINs?
Civil money penalties of up to $1 million per violation, imposed by the HHS Office of Inspector General. The OIG rule was published in July 2023 and enforcement began September 1, 2023, for conduct on or after that date. Developers can also lose ONC certification or be banned from the certification program.
The OIG final rule sets the penalty framework. OIG has said it will prioritize conduct that:
- resulted in, caused or had the potential to cause patient harm;
- significantly impacted a provider's ability to care for patients;
- was of long duration;
- caused financial loss to federal health care programs or other government or private entities.
"Per violation" matters for software. A blocking practice built into an API, such as an unreasonable rate limit or a fee condition, can affect thousands of requests. How OIG counts violations in that situation is exactly the kind of question your counsel should model before an investigation, not during one.
What disincentives do providers face?
Under the HHS rule effective July 31, 2024, a hospital found to have committed information blocking is not a meaningful EHR user and loses three quarters of its annual market basket increase; a critical access hospital is paid 100% of reasonable cost instead of 101%; a MIPS clinician scores zero in the Promoting Interoperability category; and an ACO or ACO participant can be barred from the Shared Savings Program for at least one year.
| Actor | Consequence | Authority |
|---|---|---|
| Certified health IT developer | Up to $1M per violation; certification action or ban | OIG CMP rule (2023); ONC Certification Program |
| HIN / HIE | Up to $1M per violation | OIG CMP rule (2023) |
| Eligible hospital | Not a meaningful EHR user; loses 3/4 of annual market basket increase | Disincentives rule (2024) |
| Critical access hospital | Paid 100% of reasonable cost instead of 101% | Disincentives rule (2024) |
| MIPS eligible clinician | Zero score in Promoting Interoperability category | Disincentives rule (2024) |
| ACO / participant / provider | Ineligible for Shared Savings Program for at least 1 year | Disincentives rule (2024) |
| Any actor found to have blocked | Public posting by ASTP/ONC | Disincentives rule (2024) |
Source: the disincentives final rule and HHS announcement. The disincentive applies after OIG investigates and refers a determination to the relevant CMS program. For a MIPS clinician in a group, only the individual who committed the violation is affected.
Has anyone actually been penalized yet?
As of our check on November 12, 2026, we found no publicly announced OIG civil money penalty for information blocking. But enforcement activity is real: HHS announced a crackdown in September 2025, ASTP began issuing notices of nonconformity to certified EHR developers in February 2026, and the complaint portal had logged 2,450 possible claims by July 2026.
- September 4, 2025. HHS announced a crackdown on health data blocking, with more resources for ASTP/ONC and OIG, and a joint enforcement alert.
- December 2025. ASTP/ONC issued FAQs, including that conditioning access to EHI on revenue sharing or royalties generally does not meet the Fees exception, and that delays or restrictions on automated access need careful evaluation.
- February 11, 2026. ASTP said it had begun issuing letters of nonconformity to certain certified developers over API performance, interoperability and potential information blocking. These are not penalties, but can lead to corrective action plans, certification suspension or termination, or OIG referral.
- Through July 31, 2026. ASTP's claims data shows 2,563 portal submissions since April 2021, of which 2,450 were possible information blocking claims. A claim is an allegation, not a finding.
Practically, the first public penalties are a matter of when, not whether. Investigations take time, and the conduct being investigated now may be from 2024 and 2025.
Did HTI-5 change the information blocking rules?
No. ASTP/ONC released the HTI-5 final rule on October 26, 2026, effective mostly December 28, 2026. It removed 14 certification criteria, but did not finalize any of the proposed information blocking changes, so the current definitions, exceptions and penalties still apply.
The HTI-5 proposal (December 2025) would have refined definitions, narrowed some exceptions and removed the TEFCA manner exception. Per McGuireWoods' summary of the final rule, those changes remain under consideration with no announced timeline. Do not design around the proposed rule. Design around today's exceptions, and watch for a separate rulemaking.
Which exceptions protect a developer or provider?
The exceptions cover preventing harm, privacy, security, infeasibility, health IT performance, protecting care access, manner, fees, licensing, and TEFCA-related practices. Meeting an exception is voluntary but gives you certainty; failing one does not automatically mean a violation. Each has specific conditions you must document.
For software teams, four exceptions matter most:
- Health IT performance. Planned maintenance and outage throttling are allowed if they are no longer than necessary, applied consistently and not used to disadvantage competitors. Keep records.
- Security. Blocking a request for security reasons must follow a documented, organization-wide policy or a fact-based determination, and be tailored to the risk. "Our security team didn't like it" is not enough.
- Fees. Fees must be based on objective, verifiable criteria and reasonably related to cost. Revenue sharing tied to the value of the data is a red flag, per the December 2025 FAQs.
- Manner. If you cannot fulfill a request in the manner asked, you must offer an alternative promptly.
Our HIPAA Security Rule and AI guide covers how to document security policies so they hold up as exceptions.
What should engineering teams build to reduce information blocking risk?
Treat information blocking like an SLA you can prove. Log every EHI access request and response with timing, document every throttle and denial against a written policy, publish fee and licensing terms, and review API changes for impact on third-party access before you ship them.
- Request ledger. Every API and export request: who, what, when, outcome, latency. If a request was delayed or denied, the policy and exception relied on.
- Rate-limit policy. Written, consistent across customers and competitors, with the reasoning tied to performance or security.
- Change review. Treat any change that reduces access (new auth step, smaller page size, removed field) as a compliance review item.
- Response clocks. Track time to fulfill patient and third-party requests, and alert before they become "unreasonable delay."
- Automated and AI access. The December 2025 FAQs signal scrutiny of restrictions on automated access. If you restrict apps or AI agents, document why, and apply the rule the same way to everyone. If you build AI agents that read EHI, see FHIR + MCP: connecting AI agents to EHR data safely.
For networks, TEFCA participation adds its own obligations and an exception; see TEFCA in 2026 for healthtech companies. For governance around AI that touches EHI, see AI agent governance.
How BeevR builds this
We build the infrastructure that makes information blocking compliance provable: request ledgers, documented rate-limit and security policies enforced in code, response-time monitoring, export and FHIR API endpoints that meet published terms, and audit trails your counsel can use. We do this inside your existing systems through official APIs, not by replacing them. BeevR signs a BAA as a business associate, and we work in fixed-price phases from $10K per phase, with a working demo every Friday and full code ownership from day one.
We run a multi-tenant EHR live across four US clinics at about 300 patients a day, so we have built these controls into a production system. See our EHR integration services and HIPAA-compliant AI agent development, or book a 30-minute call to review your exposure. This article is not legal advice; involve your counsel in any determination.