Join us October 28-29th at The Sequoia Project Annual Meeting

|
Resource

Enforcement Process for Information Blocking Penalties

Last updated: November 6, 2025
Section 1

Understanding the Enforcement Process

Enforcement of Information Blocking (IB) Penalties

On July 3, 2023, the U.S. Department of Health and Human Services Office of Inspector General (HHS/OIG) finalized its rule implementing civil monetary penalties for information blocking (IB), as authorized by the 21st Century Cures Act. As of September 1, 2023, OIG may impose penalties of up to $1 million per violation on certain entities – specifically:

Establishment of Disincentives for Health Care Providers

In a separate rule, HHS established disincentives, rather than monetary penalties, for certain healthcare providers who commit IB. These apply to specific Medicare and Medicaid program participants and can affect:

Who enforces the rules?

Assistant Secretary for Technology Policy (ASTP)

ASTP receives and reviews complaints, and can also take enforcement action against Health IT Developers of Certified Health IT through the ASTP/ONC Health IT Certification Program (e.g., corrective action plans, suspension, or termination of certification).

Office of Inspector General (OIG)

OIG investigates violations and enforces penalties on rule breaking entities.

Centers for Medicare & Medicaid Services (CMS)

CMS applies disincentives to Medicare/Medicaid providers under its programs.

View the Final Rules

Section 2

Complaints & Investigation

How is enforcement triggered?

Through complaints filed by individuals or entities

Where to file a complaint?

What happens after a complaint is filed?

  1. OIG reviews the complaint and consults with ASTP/ONC when appropriate.
  2. OIG investigates and determines whether enforcement is warranted.
  3. ASTP/ONC Complaint Trends: View Complaint Data
OIG Prioritization

To prioritize cases, OIG will focus on those that:

Section 3

Preparing for Enforcement

Legal Disclaimer:

This resource does not constitute legal advice. Please consult with your legal counsel to determine whether the IB Rules apply to you or your organization and what compliance and enforcement might mean for you or your organization.

Why preparation matters

While enforcement is complaint-driven, OIG prioritizes investigations based on patient harm, impact to care, or willful violations. Organizations that can demonstrate a proactive compliance posture are better positioned in the event of an investigation, or to prevent violations in the first place.

Start with a Compliance Program

Establish or update an (IB) Compliance Program that includes: 

Six Readiness Tips for all Organizations

Here are some tips to ensure your organization is ready in the event of an investigation. Note that The Sequoia Project has an array of resources available that provide much more detail on strategies for IB compliance. Information Sharing Workgroup Resources – The Sequoia Project.

  1. Review and centrally store your policies and procedures for information sharing, including your definition of the designated record set.
  2. Respond promptly to requests for information by creating workflows to address patient and third-party data requests
    1. Document information requests and your decisions, especially when denying or delaying access to EHI.
  3. Educate staff to ensure everyone understands IB basics and how to communicate with requestors and how to engage compliance when needed.
  4. Use certified health IT effectively to configure settings to support access and exchange
    1. Work with your vendor and implementation specialist to ensure access capabilities such as Application Programming Interfaces (APIs) are appropriately leveraged and maintained.
  5. Conduct internal audits to regularly check compliance and fix gaps
    1. Consider establishing an internal complaint line.
    2. Consider conducting tabletop exercises.
  6. Identify your investigation response team
    1. Who is on point to interact with OIG?
    2. Who is on the multi-disciplinary support team to answer questions and provide needed information (legal, compliance, privacy, health information management, information technology, etc.)?

Three tips for an active investigation

Gather information about the request that triggered the investigation and identify the scope of those requests (if possible)

Maintain a posture of cooperation with investigators, while documenting all interactions and an inventory of documents shared

Follow generally accepted practices for retention and maintenance of records

Tailored Readiness and Response

Not all actor types have the same capabilities for readiness and response. The following section provides more tailored tips by organization type and size.

Large Health System

Key Readiness Focus: Ensure enterprise-wide consistency in IB policies; centralize logging and audit capabilities.

Key Response Steps: 

Small Provider Practice

Key Readiness Focus: Use ASTP/ONC tip sheets and FAQs; assign a compliance lead even if part-time

Key Response Steps: 

Health IT Developer of Certified Health IT

Key Readiness Focus: Align product documentation and customer agreements with IB requirements

Key Response Steps: 

Section 4

Resources

Disclaimer:

Links to federal websites may not be active during the Government Shutdown.

ASTP

OIG Landing Page

OIG General Compliance Program Guidance

Other OIG Compliance Guides

Inspection and Evaluation Organizations

Inspection and Evaluation Peer review

Guide
Schedule
Toolkit

Other Resources

Table of Contents
    Add a header to begin generating the table of contents

    What can we help you find?

    What We Are Doing

    Consumer Voices

    Workgroup organized to assist understanding the barriers consumers face in accessing health information.

    Consumer Engagement

    Workgroup organized to help propose and develop strategies to meet consumer healthcare needs.

    Data Usability

    Workgroup that targets improvements necessary to enable semantic interoperability of health information.

    Information Sharing

    Workgroup focused on the on-the-ground approaches to facilitate information sharing.

    Payer-to-Payer API

    Workgroup Inactive Workgroup that explores and recommends methods to improve interoperability amongst payers.

    Pharmacy

    Workgroup that is committed to improving pharmacy interoperability.

    Privacy and Consent

    Workgroup focused on supporting proper information exchange that protects consumers privacy.

    Public Health

    Community of Practice focused on providing participants with best practices at the intersection of public health.

    Steering Committee

    Committee is focused on facilitating and prioritizing the work of the Interoperability Matters Workgroups.

    About The Sequoia Project

    Learn about our history and meet the team that makes The Sequoia Project unique in the healthcare industry

    Member List

    Meet the members that help to make up The Sequoia Project community.

    Member Events

    Learn more about the events available to The Sequoia Project members throughout the year.

    Member Benefits

    Learn more about the benefits and resources available to The Sequoia Project members.

    Swag Store

    Visit The Sequoia Project swag store to purchase branded merchandise and apparel.

    Sponsorships

    Learn more about sponsorship opportunities to help advance The Sequoia Project's mission.

    Become a Member

    Help us solve healthcare interoperability by become a member of The Sequoia Project.

    Community Login

    (Members Only Access)
    Access The Sequoia Project members community area and Member Directory

    Services

    Advisory Services

    Discover how The Sequoia Project’s Advisory Services can support your organization with tailored projects and provide expert guidance on interoperability initiatives.

    Education Services

    Bring The Sequoia Project experts to your organization to deliver education on interoperability and Health IT, tailored to your team’s needs and goals.

    Testing Services

    Engage The Sequoia Project team to support interoperability and health IT testing initiatives.

    Partnerships

    Data Usability Taking Root Movement

    Learn how the Data Usability Taking Root Movement is advancing healthcare interoperability by improving the quality, consistency, and usability of shared health data across the industry.

    Privacy and Consent Roundtable

    The Sequoia Project is convening privacy & consent advocates in recognition of various initiatives underway to ensure health data is exchanged with proper patient consent.

    Information Blocking Compliance Training Bundle

    Role-based education that helps healthcare organizations understand and comply with the Information Blocking Rule established under the 21st Century Cures Act.

    Highlight your organization
    Additional Resources

    Resource Library

    Discover the latest resources for advancing interoperability in your organization

    Public Affairs or Policy Matters

    Explore our public comments on Health IT, interoperability, information sharing, TEFCA, and healthcare policy initiatives.

    Feedback Opportunities

    Share your comments on Interoperability Matters Workgroup draft publications and add your insights to open surveys.

    Contact Us

    Contact us to learn more about health data interoperability, membership, initiatives, and how to get involved.

    The Sequoia Project & Carequality

    Oct 28-29 | Austin, TX
    Upcoming Events