The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health IT (ONC) has begun sending Letters of Nonconformity to organizations suspected of information blocking — a significant escalation in enforcement of the 21st Century Cures Act's information blocking provisions. According to The HIPAA Journal's reporting, these letters represent ONC moving from rulemaking and guidance into active, direct intervention against entities believed to be interfering with the access, exchange, or use of electronic health information (EHI).
If your organization is a healthcare provider, a certified health IT developer, or a health information network/exchange (HIN/HIE), this is not abstract regulatory noise. The Office of Inspector General (OIG) has had enforcement authority since 2023 — with civil monetary penalties of up to $1 million per violation for health IT developers and HINs/HIEs — and CMS "disincentives" for eligible hospitals and clinicians took effect in mid-2024, stripping Promoting Interoperability program credit and cutting Medicare payment adjustments. A letter of nonconformity is the visible tip of an enforcement apparatus that is now fully operational in 2026.
From a security and compliance operations standpoint, information blocking enforcement matters for a reason many teams miss: the same systems and controls that prove information-sharing compliance are the systems attackers target, and the systems your auditors will subpoena. EHR API configurations, audit logs, consent management workflows, and vendor data-sharing agreements now sit at the intersection of HIPAA Security Rule compliance, ONC certification requirements, and active federal enforcement.
Technical and Regulatory Analysis
What "Information Blocking" Actually Means Under the Rule
Under 45 CFR Part 171, information blocking is a practice by a covered "actor" (healthcare provider, health IT developer of certified health IT, or health information network/exchange) that is likely to interfere with access, exchange, or use of EHI — except as required by law or covered by one of the defined exceptions. Key elements:
- Scope of EHI: Since October 2022, the definition covers the full electronic designated record set — not just USCDI data classes. This dramatically expanded exposure.
- Knowledge standard for providers: Providers are held to a "knows or should know" standard; developers and HINs are held to the stricter "knows, or should know" negligence-adjacent standard.
- Exceptions regime: The eight recognized exceptions (Preventing Harm, Privacy, Security, Infeasibility, Health IT Performance, Content and Manner, Fees, Licensing) each have narrow, technical conditions. Claiming an exception without documented satisfaction of every condition is itself a liability.
Why ONC Letters of Nonconformity Matter Operationally
A Letter of Nonconformity typically signals that ONC has reviewed a complaint (submitted through its public information blocking complaint portal), certification surveillance findings, or referral from OIG and identified a suspected practice that does not conform to the rule. While a letter is not itself a penalty, it creates a documented record that:
- Establishes the organization was on notice — strengthening any subsequent OIG penalty action and undermining good-faith defenses.
- May trigger certification review for health IT developers under the ONC Health IT Certification Program, including Conditions of Certification tied to real-world testing, API behavior (FHIR R4, USCDI v3 under HTI-1 timelines), and the (g)(10) standardized API requirements.
- Invites scrutiny of related HIPAA Security Rule posture — because the Security Exception to information blocking must be grounded in an organizational security policy tied directly to your HIPAA risk analysis (45 CFR 164.308(a)(1)). A weak risk analysis undermines both your HIPAA compliance AND your information blocking exception claims simultaneously.
The Security Exception Trap
This is where I see organizations fail most often in 2026. Security teams and compliance teams frequently operate in silos: the SOC restricts API access or delays EHI release citing "security concerns," while the compliance team has no documented security policy justifying that practice. Under 45 CFR 171.203, the Security Exception requires the practice to be:
- Directly related to safeguarding confidentiality, integrity, and availability of EHI
- Tailored to specific security risks
- Implemented in a consistent and non-discriminatory manner
- Documented in an organizational security policy or determined on a case-by-case basis with written documentation
If your SOC throttles a third-party app's FHIR API access, blocks a patient portal export, or delays a records release because of a security tool alert — and there is no written policy tying that action to your risk analysis — you have potentially just committed information blocking while trying to do good security work.
Exploitation Status — This Is Active Enforcement, Not Theory
There is no CVE here and no malware. The "threat actor" is regulatory, and it is confirmed active: ONC's complaint portal has accumulated thousands of submissions since 2021, OIG opened its first enforcement actions in 2023, CMS provider disincentives began applying in 2024, and 2026's letters of nonconformity confirm the pipeline from complaint → review → formal notice is producing outputs. Treat this with the same seriousness as an active exploitation campaign against your compliance posture.
Executive Takeaways
Because this is a regulatory enforcement event rather than a technical vulnerability, the defensive response is organizational — but it has hard technical dependencies. Here is what I recommend to every healthcare client right now:
1. Stand Up a Cross-Functional Information Blocking Response Capability
Create a standing working group with the CISO, Chief Compliance Officer, CMIO/CNIO, HIM director, and legal counsel. Information blocking determinations require simultaneous judgments about clinical workflow, security risk, and legal exception criteria. An organization where the SOC can unilaterally delay EHI release without compliance review is an enforcement action waiting to happen. Define an escalation path and SLA for any practice that restricts, delays, or conditions access to EHI.
2. Map Every Security Control That Touches EHI Access to the Security Exception
Conduct a gap assessment of every technical control that could constitute information blocking: API rate limiting on FHIR endpoints, DLP rules blocking EHI exports, conditional access policies restricting third-party health apps, manual review queues for records requests, and downtime procedures for EHR maintenance. For each control, document: the specific security risk it addresses, the policy citation in your HIPAA risk analysis, why it is narrowly tailored, and evidence it is applied non-discriminatorily. If a control can't survive that documentation exercise, re-engineer it or retire it.
3. Update and Exercise Your HIPAA Risk Analysis — It Is Now Dual-Purpose Evidence
Your 45 CFR 164.308(a)(1) risk analysis is no longer just HIPAA Security Rule evidence; it is the foundational document for any Security Exception claim. Ensure it explicitly addresses risks associated with API-based EHI exchange (TEFCA participation, FHIR endpoints, third-party app ecosystem) and that your security policies reference it by version and date. An undated, generic risk analysis will not support an exception claim under OIG review.
4. Audit Your EHR and Health IT Vendor Agreements for Blocking Risk
Vendor practices are a leading source of complaints: excessive fees for data export, proprietary formats that impede portability, slow-walking interface development, and contractual gag or non-disparagement clauses. Review every health IT contract against the Fees and Licensing exceptions (45 CFR 171.206–207), require certification-status representations, and build exit/portability clauses with defined EHI export formats (FHIR R4, USCDI v3) and timelines. If your vendor's practices get flagged, your organization gets the reputational damage.
5. Instrument and Retain Audit Evidence of EHI Access Decisions
Treat every decision to deny, delay, or condition EHI access like an incident record: who requested access, what data class, what exception was invoked, which policy condition was satisfied, who approved, and when access was ultimately granted. Your EHR audit logs (ATNA/HIE audit trails, FHIR AuditEvent resources) plus your SIEM should give you a reconstructable timeline. In an OIG investigation, the organization with contemporaneous documentation wins; the one reconstructing from memory pays the CMP.
6. Prepare a Letter-of-Nonconformity Response Playbook Now
If ONC or OIG correspondence arrives, you have a limited window to respond substantively. Pre-draft your playbook: single accountable executive owner, legal privilege strategy, document preservation steps, a 72-hour internal fact-finding protocol, and pre-identified outside counsel with HITECH/Cures Act experience. Run a tabletop exercise with a simulated nonconformity letter the same way you would a ransomware scenario — because the business impact profile (penalty exposure, certification risk, CMS payment adjustment, reputational harm) is comparable.
Remediation and Hardening Checklist
| Action | Owner | Timeline |
|---|---|---|
| Inventory all practices that delay/restrict/condition EHI access; map each to a valid exception or kill it | Compliance + CISO | 30 days |
| Align security policies on API throttling, app vetting, and export controls with 45 CFR 171.203 Security Exception conditions | CISO | 30 days |
| Refresh HIPAA risk analysis to cover API-based EHI exchange (FHIR, TEFCA, third-party apps) | Security/Compliance | 60 days |
| Renegotiate or amend vendor contracts with blocking-prone terms (export fees, proprietary lock-in, gag clauses) | Legal/Procurement | 90 days |
| Implement centralized logging of EHI access decisions; route FHIR AuditEvent and EHR audit trails to SIEM | SOC | 60 days |
| Tabletop a nonconformity-letter response with legal, compliance, and executives | Leadership | 90 days |
Bottom line: In 2026, information blocking enforcement is no longer hypothetical. ONC is naming organizations, OIG has penalty authority, and CMS is withholding money. The organizations that will weather this are the ones that treated information sharing as a security-influenced compliance discipline — with documented policies, instrumented evidence, and vendors held to the same standard.
Related Resources
Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.