The Preventing Harm Exception at 45 CFR 171.201 relies on the same types of harm as apply for a covered entity to deny access to protected health information under the HIPAA Privacy Rule (see 45 CFR 164.524(a)(3)). Where an actor's practice, based on an individualized (45 CFR 171.201(c)(1)) determination of risk, is likely to interfere with a patient's or patient representative's access, exchange, or use of the patient's EHI, the type of harm (45 CFR 171.201(d)) needed for the exception to apply depends on who is seeking access to the EHI, and what EHI they are seeking to access.⁴

The table below shows the type of harm recognized under the Preventing Harm Exception for several commonly encountered patient access scenarios.¹

For more information about the Preventing Harm Exception, please reference the ONC Cures Act Final Rule preamble discussion and the other FAQs under the Preventing Harm Exception heading.

For more information about the HIPAA Privacy Rule, the Privacy Rule individual right of access, or grounds for denial of access under the Privacy Rule, please visit the Health Information Privacy section of the HHS website.

No. Unless an actor reasonably believes a practice that interferes with a parent or other legal representative’s requested access, exchange, or use of the minor’s electronic health information (EHI) will substantially reduce a risk of at least substantial harm to the patient or another person, the Preventing Harm Exception is not designed to cover that practice.

The Privacy Exception contains a sub-exception (45 CFR 171.202(e)) that covers practices respecting an individual’s request not to share information, subject to certain conditions.

Yes. The Preventing Harm Exception’s type of harm condition relies on the same types of harm that serve as grounds for reviewable denial of an individual’s right of access under the Privacy Rule (45 CFR 164.524). (See ONC Cures Act Final Rule preamble Table 3—Mapping of Circumstances Under § 171.201(d) to Applicable Harm Standards.)

In most instances, including where a practice interferes with a patient’s own or the patient’s other health care providers’ legally permissible access, exchange, or use of the patient’s electronic health information (EHI), coverage under the Preventing Harm Exception requires that the risk be of physical harm. (See 45 CFR 171.201(d)(3) and (4).)

However, the Preventing Harm Exception’s type of harm condition applies a “substantial harm” standard for practices interfering with a patient’s representative’s requested access, exchange, or use of the patient’s EHI and to the patient’s or their representative’s access to other persons’ individually identifiable information within the patient’s EHI in some circumstances. (See 45 CFR 171.201(d)(1) and (2)).

No. Blanket delays that affect a broad array of routine results do not qualify for the Preventing Harm Exception. The Preventing Harm Exception is designed to cover only those practices that are no broader than necessary to reduce a risk of harm to the patient or another person.

As we discussed in the Cures Act Final Rule, a clinician generally orders tests in the context of a clinician-patient relationship. In the context of that relationship, the clinician ordering a particular test would know the range of results that could be returned and could prospectively formulate, in the exercise of their professional judgment, an individualized determination for the specific patient that:

• withholding the results of the particular test(s) from the patient would substantially reduce a risk to the patient’s or another person’s life or physical safety
  - or -
• that withholding the results of the particular test(s) from a representative of the patient would substantially reduce a risk of substantial harm to the patient or another person.

Such individualized determinations made in good faith by an ordering clinician, in the exercise of their professional judgment and in the context of the treatment relationship within which they order the test, would satisfy the type of risk and type of harm conditions of the Preventing Harm Exception. Actors, including but not limited to the ordering clinician, could implement practices in reliance on such determinations and the Preventing Harm Exception would cover such practices so long as the practices also satisfy the other four conditions of the exception.

No. The reasonable belief condition does not include a requirement that the harm be expected to occur within a particular time period or that the likelihood of the harm be high enough to be considered “imminent.” (See 45 CFR 171.201(a)). The Preventing Harm Exception’s reasonable belief condition requires an actor engaging in a practice likely to interfere with a patient’s access, exchange, or use of their own EHI to have a reasonable belief that the practice will substantially reduce a risk to life or physical safety of the patient or another person that would otherwise arise from the affected access, exchange, or use.

Yes, where the risk of harm has been determined on an individualized basis and all other conditions of the Preventing Harm Exception are met. For example, the practice must be no broader than necessary and the actor must reasonably believe the practice will substantially reduce the risk of harm. (For all the conditions of the Preventing Harm Exception, please see 45 CFR 171.201.)

For purposes of the Preventing Harm Exception, a parent or legal guardian would be considered a patient’s legal representative. The Preventing Harm Exception’s type of harm condition applies a “substantial harm” standard for practices interfering with a patient’s representative’s requested access, exchange, or use of the patient’s EHI. (See 45 CFR 171.201(d)(1)).

The type of harm conditions for Preventing Harm Exception coverage of practices interfering with patients’ and their representatives’ access to EHI on the basis of an individualized determination of risk are specifically aligned with the HIPAA Privacy Rule’s grounds for reviewable denial of an individual’s right of access under the Privacy Rule. (See also ONC Cures Act Final Rule preamble discussion and Table 3—Mapping of Circumstances Under § 171.201(d) to Applicable Harm Standards).

The applicability date for the information blocking regulations in 45 CFR part 171 was established in the ONC Cures Act Final Rule, and was subsequently adjusted in the ONC Interim Final Rule. The Interim Final Rule moved the applicability date from November 2, 2020 to April 5, 2021.

The Interim Final Rule also revised the information blocking definition in 45 CFR 171.103 to adjust the timeframe for the “USCDI limitation.” Before October 6, 2022, electronic health information (EHI) for the purposes of the information blocking definition is limited to the EHI identified by the data elements represented in the United States Core Data for Interoperability (USCDI) standard.

Enforcement of the information blocking regulations depends upon the individual or entity that is subject of an enforcement action or "actor." For health IT developers and health information networks/HIEs, the HHS Office of the Inspector General posted its final rule implementing information blocking penalties. For health care providers, HHS has posted its proposed rule to establish appropriate disincentives as directed by the 21^st Century Cures Act. For additional information, see the Disincentives Proposed Rule Overview fact sheet and the Disincentives Common Questions fact sheet.

Updated:

This FAQ has been updated pursuant to the HTI-1 Final Rule.

Under section 4004 of the 21st Century Cures Act (Cures Act), the HHS OIG has authority to investigate any claim that health care providers, health information networks (HINs) and health information exchanges (HIEs), and health IT developers of certified health IT (collectively defined as “actors” in 45 CFR 171.102) have engaged in information blocking.

For actors HHS OIG determines have committed information blocking, enforcement consequences depend upon the actor involved.

• For health IT developers of certified health IT and HINs/HIEs (as defined in 45 CFR 171.102), the Cures Act subjects these entities to civil monetary penalties if HHS OIG determines they committed information blocking. Under the Cures Act, these penalties could be up to $1 million per violation. The HHS OIG has issued a final rule on this enforcement authority.
• For health care providers (as defined in 45 CFR 171.102) the Cures Act authorizes the Secretary of Health and Human Services to establish appropriate disincentives through notice and comment rulemaking. HHS has posted a final rule to establish appropriate disincentives as directed by the 21^st Century Cures Act. For additional information, see the Disincentives Final Rule Overview fact sheet  and the Disincentives Common Questions fact sheet .  

Updated:

This FAQ has been updated pursuant to the Provider Disincentives Final Rule.

No, it would not be information blocking if the actor’s practice of not fulfilling a request in such circumstances meets the Privacy Exception (45 CFR 171.202). All actors remain responsible for disclosing EHI only when the disclosure is allowed under all applicable federal laws. For example, actors who are HIPAA covered entities or business associates must comply with the HIPAA Privacy Rule and any other applicable federal laws that limit access, exchange, or use of EHI in particular circumstances. Adherence to such federal laws is not information blocking, if the other conditions of the Privacy Exception are also met.*

In particular, where federal law such as the HIPAA Privacy Rule does not permit EHI to be used or disclosed unless certain requirements (“preconditions”) are met, then an actor’s practice of not fulfilling a request to access, exchange, or use EHI when these preconditions are not met is not information blocking.*** The Precondition Not Satisfied (45 CFR 171.202(b)) sub-exception of the Privacy Exception outlines a framework for actors to follow so that the actors’ practices of not fulfilling requests to access, exchange, or use EHI would not constitute information blocking when a precondition of applicable law has not been satisfied.

One example that highlights the alignment between the HIPAA Privacy Rule and the information blocking regulations is when a law enforcement official requests records of abortions performed from a clinic. As explained in the “HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care” guidance issued by the Office for Civil Rights, there are certain preconditions that must be met before this disclosure can be made: “If the request is not accompanied by a court order or other mandate enforceable in a court of law, the Privacy Rule would not permit the clinic to disclose PHI in response to the request. Therefore, such a disclosure would be impermissible and constitute a breach of unsecured PHI requiring notification to HHS and the individual affected.” In this example, federal law does not permit the disclosure of EHI unless certain requirements are met, and therefore, the actor’s practice not to disclose EHI would not be information blocking. We note that this is just one example of how the HIPAA Privacy Rule gives individuals confidence that their protected health information, including information relating to abortion and other sexual and reproductive health care, will be kept private. Please see the guidance from the Office for Civil Rights for additional information and examples.

A second example of the alignment between the HIPAA Privacy Rule and the information blocking regulations is in circumstances where the HIPAA Privacy Rule permits a covered entity to use or disclose EHI only following receipt of a valid HIPAA authorization from the individual (patient) or the individual’s personal representative. If an actor does not have a valid HIPAA authorization from the individual or their personal representative that permits the use or disclosure of EHI for the requested purpose, then a precondition for disclosure is not satisfied. Accordingly, the actor’s practice of not disclosing EHI would not be considered information blocking if it is consistent with the requirements of the Precondition Not Satisfied sub-exception.

To emphasize, wherever any federal law requires the authorization of the individual to disclose the EHI, an individual may always choose not to give such authorization, and an actor who does not disclose the EHI would not be information blocking if the actor meets all applicable requirements of the Privacy Exception.

No, if the actor’s conduct satisfies the requirements of the information blocking regulations, such as the Privacy Exception (45 CFR 171.202). For example, the sub-exception Respecting an Individual’s Request Not to Share Information permits an actor, unless the disclosure is required by law, to honor an individual’s request not to provide access, exchange, or use of the individual’s EHI, which aligns with the individual’s right to request a restriction on disclosures of their protected health information under the HIPAA Privacy Rule (45 CFR 164.522(a)(1)).

Separately, if an actor has privacy or security concerns about disclosing EHI to an app/app developer with which an individual may choose to share their EHI, an actor may educate the individual about such concerns consistent with the following FAQ: Will educating patients about the privacy and security risks posed by third-party apps that the patient chooses be considered interference?

Yes, if the actor satisfies the requirements of the information blocking regulations, such as the Precondition Not Satisfied sub-exception of the Privacy Exception (45 CFR 171.202(b)).** For purposes of the information blocking regulations, health care providers and other information blocking actors operating under multiple state laws, or state and tribal laws, with inconsistent legal requirements for EHI disclosures may choose to adopt uniform policies and procedures so that the actor only makes disclosures of EHI that meet the requirements of the state law providing the most protection to individuals’ privacy (45 CFR 171.202(b)).** Essentially, the Precondition Not Satisfied sub-exception establishes conditions under which an actor may adopt policies to satisfy state laws with more restrictive preconditions and apply those policies in all the jurisdictions in which they operate. 

To illustrate, consider a scenario in which an actor operates in two states, “State A” and “State B.” State A forbids disclosure of certain EHI, such as EHI specific to reproductive health care, to another health care provider, who is also currently treating the individual, without first obtaining written authorization from the individual. This scenario assumes State B’s law does not require authorization from the individual for disclosure of reproductive health care EHI for treatment purposes. In this scenario, an actor subject to the laws of both State A and State B can, consistent with the Privacy Exception (see 45 CFR 171.202(b)(3)), adopt uniform privacy policies and procedures that result in the actor disclosing EHI only when the individual has provided written authorization for a specific disclosure (consistent with the more privacy-protective requirements of State A’s law) of EHI about them for treatment purposes across the actor’s operations in both State A and State B. If the actor’s policies, procedures, and actions are consistent with the requirements of the Precondition Not Satisfied sub-exception (45 CFR 171.202(b)), the actor’s practices would not be considered information blocking – even though the actor’s uniform privacy policies and procedures may deny or delay access, exchange, or use of EHI in State B that (under laws in force in State B) would not require specific written authorization.

In a second, similar scenario, State A’s law sets more privacy protective or more “stringent”  requirements (“preconditions”) than both State B’s law and the HIPAA Privacy Rule for disclosures of EHI^[1] for particular purposes (such as disclosing information related to reproductive health care for law enforcement purposes^[2]). An actor operating in States A and B can meet the requirements of the Precondition Not Satisfied sub-exception (45 CFR 171.202(b)(1) through (3)) in order to have confidence that disclosing EHI only when the disclosure is consistent with the most privacy protective (most restrictive or most “stringent”) preconditions (in this example, State A’s) across all their operations in both State A and State B would not be considered information blocking.

^[1] “EHI” as defined in 45 CFR 171.102 is a subset of protected health information (PHI). See 45 CFR 160.103 (definition of “protected health information”). For more information on the HIPAA Privacy Rule and its conditions for disclosures of protected health information (PHI), please see resources of the Office for Civil Rights at HHS.gov/HIPAA.

^[2] For example, see “HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care,” which discusses the permissibility of disclosures for law enforcement purposes under the HIPAA Privacy Rule.