Information blocking and the patient portal: what the Cures Act rule changed for design

30 September 2026

Patient portal & EHR Clinical vs Patient Interfaces Trust, Ethics & Safety

In the US, the information blocking rule (45 CFR Part 171) bars practices that interfere with a patient's electronic access to their health information, unless an exception applies. The law is stable. What it changes on a screen is timing, wording and what happens next.

Not legal advice This article describes a US federal rule for design education. It is not legal advice and not a compliance verdict on any product or organisation. Whether a given practice is information blocking depends on facts and exceptions this article does not assess. Raise it with your legal and compliance team.

In the United States, the information blocking rule in 45 CFR Part 171, made under the 21st Century Cures Act, treats a practice that is likely to interfere with access, exchange or use of electronic health information as prohibited, unless it is required by law or fits a listed exception. For a designer, one effect matters most: a patient's electronic access to their own record is meant to be free of charge and hard to hold back without a stated reason.

The legal structure, in plain words

The Office of the National Coordinator for Health IT (ONC, now within ASTP) describes the final rule as requiring that patients can electronically access all of their electronic health information, structured or unstructured, at no cost. The rule applies to three kinds of actor: healthcare providers, developers of certified health IT, and health information exchanges or networks. The knowledge test differs. A provider is judged on whether it knows a practice is unreasonable. A developer or network is judged on whether it knows or should know.

The fees exception, one of the listed exceptions, says in its text that a fee based even partly on an individual electronically accessing their own information falls outside the exception. In other words, charging a patient for portal-style self-access is not protected.

How many exceptions are there?

Sources disagree, so read the date. The regulation text on eCFR (45 CFR Part 171) lists six exceptions about not fulfilling a request: preventing harm, privacy, security, infeasibility, health IT performance and protecting care access. It lists three about how a request is fulfilled: manner, fees and licensing. It adds one for participation in TEFCA, the national exchange framework. That is ten. ASTP's information blocking page also shows ten. ASTP's Cures Act final rule page still says nine. This article uses the regulation text: ten, as read on 30 September 2026. Check the eCFR before you quote a number.

Two exceptions are the ones a design team meets first. The preventing harm exception lets an actor restrict access when it reasonably believes that will substantially reduce a risk of harm, in a way no broader than necessary. Where the basis is one clinician's judgement, the patient must have a route to ask for review. The manner exception says a request should be met in the way it was made, unless the actor cannot do so, in which case fallbacks apply.

What it can look like on a screen

The rule does not tell a designer what a results screen should say. It changes the situation the screen sits in. Several design problems follow.

Results and notes can arrive before anyone has explained them. A screen cannot assume a conversation has already happened.
Release timing becomes visible. If an item is held for a stated reason, or arrives at once, the patient needs to know which, and what to expect next.
Wording carries more weight. A clinical label or an unexplained range does the explaining that a clinician might once have done.
"What happens next" needs its own space: who will contact you, roughly when, and what to do if you are worried in the meantime.
A held item needs an honest state. Saying something is unavailable without a reason reads as a fault, not a decision.

What the evidence says, and how far it goes

One study from a single academic medical centre (Vanderbilt University Medical Center, JAMA Network Open, 2021) compared the months before and after the centre began releasing results immediately, on 20 January 2021. For tests that had previously been held for a delay, patients viewed 10.4 percent of results before a clinician did. After the change it was 40.3 percent. The median number of patient messages sent within six hours of viewing a result rose from 77.5 to 146 a day. The authors themselves flag that one site limits how far this generalises, and that patient and clinician perceptions need more study. Treat the numbers as one centre's picture, not a national rate.

For scale, ONC's national data brief (No. 77, July 2025) reports, from the 2024 HINTS survey, that 77 percent of US adults were offered online access to their medical records and 65 percent were offered and used it. Portals are now the ordinary route to a record, so the timing and wording problems are not an edge case.

What a design team can do with this

Write the result screen for a reader who has not spoken to anyone. Lead with what the item is and what happens next, then the detail. The reference range and lab result list cards show two ways to do this.
Use plain words first, clinical terms second. See health literacy and plain language and the plain language card.
Design the message route as part of the result, not after it. Say who reads messages and how long a reply may take, so a worried patient does not guess.
Design the held-back state with the clinical and legal owners of the decision. Show that a hold exists, why in a sentence, and how to ask about it.
Test with people who read results alone. Process and research covers who to include, and design for vulnerable users covers who is easily left out.

For the wider picture of how the same record is shown to clinicians and patients, see patient portal and EHR redesign and clinical dashboard vs patient portal. For other jurisdictions, see the digital health regulation map.