The 21st Century Cures Act
and the Information Blocking Rules

A patient's data belongs to the patient

The 21st Century Cures Act, Pub. L. 114-255, was signed into law on 13 December 2016 with overwhelming bipartisan support. Alongside its provisions on medical research and drug approval, Title IV of the Act confronted a quieter failure of American healthcare: patient data was technically digitised but practically trapped, held in incompatible systems and behind competitive walls.

The Act's answer was twofold. It required that electronic health information be made accessible through standardised, secure APIs "without special effort" on the part of the patient. And it created a new legal category of misconduct, information blocking: any practice by a regulated actor that is likely to interfere with the access, exchange or use of electronic health information, unless required by law or covered by a defined exception.

45 CFR Part 171: who is bound, and how

In 2020 the Office of the National Coordinator for Health IT (ONC, now ASTP) gave the statute operational force through the Information Blocking Rules, 45 CFR Part 171. The Rules bind three classes of "actors": healthcare providers, developers of certified health IT, and health information networks and health information exchanges. An HIE is therefore not an observer of this regime. It is a directly regulated actor.

A practice that interferes with access is unlawful unless it falls within one of the defined exceptions, each with strict conditions:

1. Preventing Harm — withholding is permitted only to prevent defined harm to a patient or another person.
2. Privacy — honouring a legal privacy precondition that has not been satisfied.
3. Security — practices directly related to safeguarding the confidentiality, integrity and availability of EHI.
4. Infeasibility — genuine impossibility, with a written explanation within ten business days.
5. Health IT Performance — brief, necessary maintenance windows.
6. Content and Manner — fulfilling a request in an agreed alternative manner under defined conditions.
7. Fees — recovering reasonable costs, with express limits protecting patient access.
8. Licensing — licensing interoperability elements on reasonable, non-discriminatory terms.

The architecture of the Rules is deliberate: openness is the default, and every deviation must be justified, documented and defensible.

Up to $1,000,000 per violation

Since 1 September 2023, the HHS Office of Inspector General has held authority to impose civil monetary penalties on HIEs, HINs and certified health IT developers of up to $1 million per violation. Each impeded request can constitute a separate violation. For healthcare providers, HHS has established separate "appropriate disincentives" through programme-level penalties.

Complementing enforcement, the individual right of access under HIPAA, 45 CFR § 164.524, entitles every patient to obtain their records, and to direct them to a designee of their choosing, within strict timeframes. A Personal Health Application acting at the patient's instruction stands in the patient's shoes. Declining, delaying or degrading that access is where regulatory exposure begins.

From statute to enforcement to scale

An unbounded obligation meets an unprecedented wave

The law places no ceiling on volume and provides no default compensation. As consumer platforms ship health record access to hundreds of millions of users, individual access requests against HIE endpoints are projected to grow from thousands to millions per day. Every one of those requests carries the same legal weight, the same identity assurance burden, the same consent complexity across fifty states, and the same audit obligation. An HIE cannot lawfully refuse the wave. The only question is how it is absorbed.

Fulfil the obligation. Remove the burden. Return the value.

Cures Gateway is managed infrastructure operated by Agentic Healthcare that discharges the individual access obligation on behalf of connected HIEs, converting a regulatory liability into governed, compensated participation. In respect of every request, the Gateway undertakes to: