This article presents only general professional opinions and does not constitute legal, regulatory, financial, or compliance advice relating to your particular case. Reading it creates no consulting relationship with GRAYS™ Strategy. Figures come from the sources cited, as of the publication date, so please check them before you rely on them.
If a health IT developer or health information exchange blocks access to electronic health information, federal law allows a fine of up to $1 million for each violation, and hospitals and clinicians face Medicare payment consequences (U.S. Department of Health and Human Services, Office of Inspector General, 2025; Office of the National Coordinator for Health Information Technology, n.d.). If you share information that is incorrect, the information blocking rule does not penalize it: no fine and no finding. It is in fact the true form of the obligation, and very few organizations have taken the time to consider what it means for themselves.
What does the rule actually require you to do?
Information blocking is stated in the Cures Act to mean a practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information, unless the law requires it or an exception applies (Office of the National Coordinator for Health Information Technology, n.d.). For a long time there had been no real enforcement of that definition. That situation has now changed. The Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) has recently received 2,563 submissions via the portal, 2,450 of them regarding possible cases of information blocking, and in 2026 the U.S. Department of Health and Human Services (HHS) began sending its first enforcement notices to certified health IT developers since the rule came into effect in 2021 (Holland & Knight, 2026; Office of the National Coordinator for Health Information Technology, 2026). Penalties can reach $1 million for each violation for developers and exchanges, and violations can accumulate (U.S. Department of Health and Human Services, Office of Inspector General, 2025). Hospitals and clinicians face Medicare payment disincentives instead (Office of the National Coordinator for Health Information Technology, n.d.).
This obligation now has teeth. Until recently, slow-walking a records request or adding friction to a data exchange drew almost no enforcement. Today it can carry real financial exposure.
What does the rule not ask you to get right?
Nothing in that definition asks whether the electronic health information being shared is correct. The rule governs movement. It does not require accuracy, and that gap matters more than most organizations realize.
80%; that’s how low patient matching can run within a single hospital or other health care facility, according to an industry estimate that the sponsors of the bipartisan MATCH IT Act bill cite in their findings. The same finding says one in five patients may not be matched to all of their records (U.S. Congress, 2025). Many executives may feel that the cost to hospitals of poor patient identification is lower than it truly is. According to research by Black Book, inaccurate or unverified patient identification drives about 35% of all denied insurance claims, translating into an estimated $2.5 million a year in losses for the average hospital and over $6.7 billion annually for the health care industry as a whole (American Health Information Management Association, 2025). None of this breaks the information blocking rule.
Figure 1. Sources: Holland & Knight (2026); U.S. Department of Health and Human Services, Office of Inspector General (2025); Office of the National Coordinator for Health Information Technology (2026); U.S. Congress (2025); American Health Information Management Association (2025), citing Black Book Research.
Who actually owns the gap between those two?
This isn’t hypothetical. A patient safety case published by the Agency for Healthcare Research and Quality described a dermatopathology lab that couldn’t access a patient’s existing record from elsewhere in the same hospital, a genuine interoperability failure with real diagnostic consequences (Koppel, 2009). A separate, widely cited case analysis in Annals of Internal Medicine, examining a wrong-patient procedure, named faulty exchange of information among caregivers as one of several root failures behind the harm (Chassin & Becher, 2002).
Ask the question directly: if another provider receives your organization’s data and acts on it, and it’s wrong, whose problem is that? Most organizations have never actually answered this. It’s easy to assume the receiving provider bears the risk, since they’re the one making the clinical decision. It’s just as easy to assume the sending organization bears it, since the error originated there. Both assumptions are comfortable, and comfortable is usually a sign nobody has actually decided.
What’s the actual fix, since compliance already isn’t it?
Slowing down data sharing to double-check everything isn’t a real option, it risks the same enforcement exposure covered above. The fix has to sit alongside the sharing obligation, not against it.
Many organizations don’t have a true sense of how well they’re matching patients to their own records, so they default to the national average and hope it’s close enough. That’s evolved into a convenient excuse for an estimate instead of a real number. A confidence level attached to whatever gets reported fixes part of that: if a report says 80% of patients were matched successfully, the receiving provider needs to know the other 20% could still be wrong. The rest comes down to ownership, spelled out in writing, for who inside the organization answers for the accuracy of whatever gets shared with other providers.
Most organizations can’t state their own patient match rate on request, with an actual number attached. If yours can’t either, that tells you which side of this gap you’re standing on.
Questions about how this applies to your organization? Reach out at info@graysstrategy.com.
Share this article on LinkedIn
References
American Health Information Management Association. (2025). Bipartisan representatives reintroduce MATCH IT Act of 2025. https://www.ahima.org/news-publications/press-room-press-releases/2025-press-releases/bipartisan-representatives-reintroduce-match-it-act-of-2025/
Chassin, M. R., & Becher, E. C. (2002). The wrong patient. Annals of Internal Medicine, 136(11), 826–833. https://doi.org/10.7326/0003-4819-136-11-200206040-00012
Holland & Knight. (2026, February 13). The wait is over: Information blocking enforcement is officially here. https://www.hklaw.com/en/insights/publications/2026/02/the-wait-is-over-information-blocking-enforcement-is-officially-here
Koppel, R. (2009, April 1). EMR entry error: Not so benign. PSNet, Agency for Healthcare Research and Quality. https://psnet.ahrq.gov/web-mm/emr-entry-error-not-so-benign
Office of the National Coordinator for Health Information Technology. (n.d.). Enforcement alert. HealthIT.gov. https://healthit.gov/information-blocking/enforcement-alert/. Retrieved October 9, 2026.
Office of the National Coordinator for Health Information Technology. (2026, July). Information blocking claims: By the numbers (Health IT Quick-Stat #59). https://www.healthit.gov/data/quickstats/information-blocking-claims-numbers. Retrieved September 30, 2026.
U.S. Congress, House of Representatives, 119th Congress. (2025). H.R. 2002, Patient Matching and Transparency in Certified Health IT (MATCH IT) Act of 2025 [Bill text]. https://www.congress.gov/bill/119th-congress/house-bill/2002. Retrieved September 30, 2026.
U.S. Department of Health and Human Services, Office of Inspector General. (2025, September 4). Enforcement alert: Information blocking. https://www.oig.hhs.gov/documents/special-advisory-bulletins/10930/information-blocking-enforcement-alert-2025.pdf
Cited research reflects the best available evidence at time of writing, including findings drawn from adjacent industries and organization types.
GRAYS™, GRAYS Method™, and Clarity in Complexity™ are trademarks of GRAYS™ Strategy LLC. © 2026 GRAYS™ Strategy LLC. All rights reserved. This content reflects general commentary and professional analysis current as of its publication date. It does not constitute legal, regulatory, financial, or compliance advice, and should not be relied upon as a substitute for professional counsel specific to your organization’s circumstances. Regulatory developments referenced herein may change after publication; readers should verify current status independently before acting.
More from Clarity Defined
