Updating the Information Blocking Rule: Implications for Patients and Physicians

Authors, Case History 

Thomas A. Bledsoe, MD, MACP 
Warren Alpert Medical School of Brown University 
Providence, Rhode Island

Deepti Pandita, MD, FACP, FAMIA
Hennepin Healthcare
Plymouth, Minnesota

Dejaih Johnson, JD, MPA 
American College of Physicians
Philadelphia, Pennsylvania

Authors, Commentary, Planners

Thomas A. Bledsoe, MD, MACP 
as seen above

Elliott J. Crigger, PhD
Center for Ethics and Professionalism

Editor, Planner

Lois Snyder Sulmasy, JD
Center for Ethics and Professionalism
American College of Physicians
Washington, DC

Ethics case studies are developed by the American College of Physicians Ethics, Professionalism and Human Rights Committee and the ACP Center for Ethics and Professionalism. The series uses hypothetical examples to elaborate on controversial or subtle aspects of issues in the College's Ethics Manual or other College position statements. The current edition of the ACP Ethics Manual and additional case studies and College policy on ethics, professionalism, and human rights issues are available at https://www.acponline.org/clinical-information/ethics-and-professionalism or by contacting the Center for Ethics and Professionalism at (215) 351-2839.

Case History

Dr. Cameron knows that her 23-year-old patient Andrea Maxwell has a history of sexual abuse as a teen and other social and mental health comorbidities, including post-traumatic stress disorder symptoms. Ms. Maxwell’s past experiences have led her to distrust  the health care system and to be inconsistent in follow-up with her clinicians. Historically, she has declined cervical cancer screenings but this year, after a number of discussions with Dr. Cameron, Ms. Maxwell agreed to screening. 

Most of Dr. Cameron’s patients have lab work done through a local health care system, HS Health Systems. While Dr. Cameron thoughtfully reassured Ms. Maxwell that she would be in touch with her as soon as the results were reviewed, they did not discuss the fact that under the information blocking rule of the 21st Century Cures Act if Ms. Maxwell chose to access the patient portal when she was notified that test results were available, she would likely see them before Dr. Cameron  reviewed them and contacted her.

Ms. Maxwell’s screening showed evidence of cervical cancer. As the results were released to the portal after office hours, Dr Cameron was not aware that they were available. Later that evening, Ms. Maxwell signed onto the patient portal.,Seeing results labelled “abnormal” she queried ChatGPT about the pathology report language and after reading the AI-enabled interpretation, assumed the worst. Ms. Maxwell subsequently had a mental health crisis that resulted in a trip to the ER that night. On hearing about the night’s events (and seeing the results when she signed onto the EHR in the morning), Dr. Cameron reached out by phone but was unable to connect with Ms. Maxwell. On a subsequent call to her from the office, Ms. Maxwell did not want to schedule an appointment.

Dr. Cameron regrets the whole episode. She knew that it was important that her patient have the Pap smear and thought her usual practice of checking her inbox several times during a normal clinical day would allow her to access the results and contact her patient in a timely manner. Had she failed the first lesson she learned in medical school to “first, do no harm”? Had she done more harm than good?

Commentary

Releasing health information: By whom, why, and when?

How does a well-meaning attempt to empower a patient turn into a painful experience for a vulnerable patient and a frustrating and demoralizing episode for a physician trying to do her best for that patient? Scenarios like the one presented here reflect the challenges posed by evolving technologies in health care. 

Patients cannot be informed and active participants in their health care without the information needed to make informed choices. [1] The rapid increase in AI-enabled resources also risks patients getting low quality or erroneous interpretations of  test results at any time of day or night. Among its other goals, 2016’s 21st Century Cures Act sought to leverage the opportunities electronic health information systems present for empowering patients to access and share their own health information as participants in care.  To promote interoperability across health care, the Act prohibited practices of “information blocking,” i.e., practices that are “likely to interfere with access, exchange, or use of electronic health information” or that a health care professional knows are “unreasonable and [are] likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information” [45 CFR §171.103(a)(1,3)]. The Act provided for delayed release of electronic health information under two exceptions to the Information Blocking Rule that are immediately relevant to Dr. Cameron and her patient: a  “preventing harm” exception and a “privacy” exception.

The ”preventing harm” exception allowed actors “to engage in practices that are reasonable and necessary to prevent harm to a patient or another person” consistent with conditions set out in the Cures Act [45 CFR §171.201]. Based on professional judgment and in the context of the treatment relationship, the ordering clinician must believe in good faith that withholding information will reduce risk to the patient’s life or physical safety or substantially reduce the risk of “substantial harm.” These determinations must be made at the individual patient and individual test level at the time of ordering the test" [2]. “Blanket” delays that “affect a broad array of routine tests” to give clinicians time to assess results before patients receive them do not qualify for the preventing harm exception [3].

As originally issued, the “privacy exception” permitted information to be withheld on request to protect an individual’s privacy, contingent on whether another law required the information be accessed, exchanged or used [45 CFR §171.202] In December 2024 the Office of the National Coordinator amended the privacy exception by eliminating the provision “unless otherwise prohibited by law” [Fed Regis. 2024;89:102518–19] “to address the conflict between … an individual’s request to restrict disclosure and state laws mandating exchange” [4]. The amended privacy exception now protects actors from information-blocking liability but does not override other law that compels disclosure. 

In response to growing concern about efforts to access information on reproductive health care for legal, including criminal purposes, the Information Blocking Rule was further amended by introduction of a new “protecting care access” exception, in keeping with the April 2025 HIPAA Final Rule on privacy in reproductive health care that restricted use of protected health information for purposes of actions against individuals “for the mere act of seeking, providing, or facilitating lawful reproductive health care” [Fed Regis. 2024;89:32976–33066]. The corresponding information-blocking exception permitted access to be restricted and reduced the risk of legal action [4]. 

However, in June 2025, the U.S. District Court for the Northern District of Texas issued Purl v. Department of Health and Human Services (HHS) vacating the Rule [5]. The Department of Health and Human Services did not appeal the case. In September 2025 HHS announced that it would take an “active enforcement stance” on information blocking[6], but as of January 2026 no enforcement action had publicly been revealed.

Good intentions gone awry

Enabling immediate release of information directly to stakeholders in the health information enterprise, including patients, offered a technically simple solution for avoiding information blocking but opened the door to unintended harm for patients. Release of information without counseling may result in misinterpretation, which may cause real harm for the patient in terms of stress and anxiety. Even results correctly interpreted may cause distress for patients or their representatives if they are not connected to a treatment plan. The gap between the patient receiving her results and those results subsequently coming to the attention of her physician was enough to cause Ms. Maxwell significant harm. The widespread availability of AI-enabled interpretation of test results may exacerbate harm  if patients attempt to interpret  results without the benefit of input from their physician. 

Under longstanding medical tradition, results of tests have been reported to the ordering physician because the ordering physician was best positioned to interpret those results and share the appropriate interpretation with the patient. The clinical significance of a test result requires deep understanding of disease processes and test characteristics. The correct interpretation of results is a crucial aspect of being a skilled clinician who will develop appropriate further diagnostic and then treatment strategies together with the patient. The AMA says, “Patients should be able to be confident that they will receive the results of clinical tests in a timely fashion. Physicians have a corresponding obligation to be considerate of patient concerns and anxieties and ensure that patients receive test results within a reasonable time frame”[7]. 

Two key words in this opinion are “timely” and “considerate.” Timely is not explicitly defined but a considerate physician would know that the period between test completion and test result availability can be a time of high anxiety for the patient, especially if the differential diagnosis includes potentially serious diseases. An egregious example would be a patient who undergoes a breast biopsy, whose results are reported to the physician at the beginning of the physician’s one-week vacation, making the patient wait that extra week to hear the diagnosis of “benign lesion.” Both the patient’s expectations and the physician’s access to test results have changed in the current electronic health systems environment, redefining “timely” and raising new issues for the “considerate” clinician.

What do patients want?

We know relatively little about patient preferences for how and when they receive results of medical tests. The few published discussions suggest that preferences are likely to depend on multiple factors, including the type of test [8], whether results are normal or abnormal [9],  how results are communicated (in person, in writing, by telephone or fax, etc.) [9], and patient age (which may itself reflect digital literacy, access to technology, overall health literacy or other factors) [10]. A survey of patient attitudes about immediately released results at 4 academic medical centers concluded that “most respondents preferred to receive results through the patient portal even if it meant viewing results prior to discussion with a health care professional” [11]. One cancer patient, reflecting on her personal experience, observed that not having direct access to test results can create anxiety and impede timely care. For her, what’s important “is not whether oncologists find immediate access to clinical results for patients with cancer helpful. What matters is whether patients find it helpful” [12]. 

The challenge for Dr. Cameron

Physicians should expect that their patients will actively monitor for the release of their test results and increasingly will search the internet or turn to AI resources for assistance in interpreting their results on their own. The exceptions to information blocking underscore physicians’ ethical responsibility to support informed, patient-centered decision making—not simply by advising patients of the risks/discomforts and benefits of a medical test, but also by ascertaining patients’ preferences or concerns about how test results will be conveyed to them and recommending that patients not turn to online sources to interpret results before they hear from their physician. Knowing Ms. Maxwell’s history and that lab results would be released to the patient portal as soon as available,  Dr. Cameron would have been prudent to work out a plan for communicating the test results and her interpretation with her patient at the time the test was performed.  If she felt it likely that Ms. Maxwell would choose to find the results herself, she should have offered some advice  about the implications of the important possible test results at the time of ordering. 

Ms Maxwell might have been best served by advice that she not seek the results on her own but wait for Dr. Cameron to provide timely and considerate discussion of both the results and the meaning of those results. If she’s concerned about how her patient will react to uninterpreted test results, Dr. Cameron should explain how important it is that she review the results with Ms. Maxwell and interpret them for her and see if Ms. Maxwell would agree to that plan. If the health system has the technical capacity to delay posting results for patient access, Dr. Cameron could also request that results not be released until she had reviewed them and obtain Ms. Maxwell’s consent for that.

Realistically, Dr. Cameron is likely to receive clinically significant results on a number of her patients on any given day. The physician must enlist the patient in determining how best to provide timely access with meaningful, personalized and professional interpretation of those results. 

Challenges for the pathologist, the lab director, and hospital leadership 

A pathologist reviewed Ms. Maxwell’s Pap smear and posted the results, knowing that both patient and clinician would have immediate access to the results. Pathologists and radiologists are bound by the same codes of ethics as other physicians [1]These physicians must keep in mind that this technical information is about a real person with hopes and fears, with personal and family connections and responsibilities and usually without medical training. 

Many physician practices utilize private or health system-based testing facilities and feel they have no control over how those organizations manage their compliance with the final rule and its accompanying regulations. For facilities, the default may be a blanket release of information directly to the patient in all cases. With little control over (or even knowledge of) the communication between patient and physician either before or after the performance of a test, it may not be feasible for these larger organizations to release results on an individual patient/individual result basis. (A possibility recognized in the infeasibility exception of the information blocking rule [2.)

Clumsy enactment of complicated regulations can harm patients and create dilemmas across health care—hospital systems and testing facilities have an obligation to attend to the welfare of the population they serve [13] and should be challenged to do better. 

In effectively straddling the tension between “the information belongs to the patient” and “an important obligation of the physician is in interpreting test results for patients,” the AMA Opinion goes on to say that physicians should advocate for policies [at those testing facilities] to ensure that the patient is informed both when to expect test results and how they will be informed, as well as that “test results are conveyed sensitively, in a way that is understandable to the patient.” Importantly, the Opinion goes on to state that physicians should advocate for policies that allow notification of the physician before disclosure to the patient takes place. 

Whole system whole patient orientation 

Physicians are obligated to care for the whole patient. For valid informed decision-making the patient must be informed about both the rationale for and the burdens of diagnostic testing strategies to help them make decisions on how to proceed in keeping with their health-related values [1]. “How and when to disclose information… must be addressed with respect for patient wishes” and “physicians should be sensitive to the patient’s response in setting the pace of communication…” says the ACP Ethics Manual [1].

Abnormal test results happen and should be planned for in the exam room and at the system level [14]. Test results need to be converted from facts to meaning specific to the patient. “Here are your test results and here is what they mean for you” and “Here are your test results and we are in this together so let us talk about what we should do next?” Similarly, pathologists, radiologists, and health systems need to think more broadly about the effect of hitting that “publish” button on a report that will be instantly available in raw form to the patient. A better system is possible.

What then to do…?

 It is likely that the health care system in this case also has a cancer center. What message has the system sent to Ms. Maxwell in bluntly releasing her unfiltered test result with the knowledge that the results may be devastating to the patient as presented? An argument from virtue ethics is that such behavior is not consistent with what a good doctor would do. An argument from pragmatism is that the system may lose business from patients who are put off by such inconsiderate handling of this sensitive information. An argument from deontology is that the system and the practitioners who work there have an obligation to protect the patient’s interests and an argument from principlism argues that physicians (and their institutions) should not cause harm.

The health care system must attend to the effect published results and the “downstream costs” such releases will have for patients. Compassionate reporting of important results to patients, especially of serious or life-threatening results, requires coordinating among multiple stakeholders—physicians and other clinical staff, laboratories, health informatics specialists [15]—to ensure that ethics and professionalism are emphasized and explicitly addressed.[13]

Pathologists and radiologists must either present information in a way that has meaning to the patient or design a method to temporarily “block” those results, within permissibility, from patient access until the ordering physician is able to share the meaning of those results with the patient in an appropriate and compassionate way. Exploring what role emerging technologies could responsibly play in meeting the challenge should be encouraged [16,17].

Supplemental Material

Claim CME Credits and MOC Points

References 

  1. Sulmasy LS, Bledsoe TA, for the American College of Physicians Ethics, Professionalism and Human Rights Committee. American College of Physicians ethics manual: Seventh edition. Ann Intern Med. 2019;170:S1-32.
  2. Office of the National Coordinator; U.S. Department of Health and Human Services. 21st Century Cures Act: interoperability, information blocking, and the ONC health IT certification program. Fed Regist. 2020 May 1;85:25642-961.
  3. Office of the Assistant Secretary for Technology Policy.  FAQ33.1.2021 JAN. https://www.healthit.gov/faqs.
  4. Pitman BN. HHS finalizes key information blocking exceptions. Holland & Knight, December 20, 2024. Accessed at https://www.hklaw.com/en/insights/publications/2024/12/hhs-finalizes-key-information-blocking-exceptions. September 5, 2025.
  5. Department of Health and Human Services. HIPAA Privacy Rule and disclosures of information relating to reproductive health. June 27, 2025. https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html. 
  6. American Medical Association. Opinion 2.1.5: Reporting clinical test results. Accessed at https://www.ama-assn.org/delivering-care/ethics/reporting-clinical-test-results on September 5, 2025. 
  7. LaRocque JR, Davis CL, Tan TP, D’Amico FJ, Merenstein DJ. Patient Preferences for Receiving Reports of Test Results. J Am Board Fam Med. 2015;28:759–66
  8. Shultz SK, Wu R, Matelski JJ, et al. Patient preferences for test result notification. J Gen Intern Med. 2015;30:1651–56.
  9. Pollock JR, Buckner Petty SA, Schmitz JJ, Varner J, Metcalfe AM, Tan N. Patient access of their radiology reports before and after implementation of 21st Century Cures Act information-blocking provisions at a large multicampus health system. AJR:222, June 2024.
  10. Steitz BD, Turer RW, Lin C-T, et al. Perspectives of patients about immediate access to test results through an online patient portal. JAMA Network Open. 2023;6:e233572. doi:10.1001.
  11. Salmi L, Hubbard J, McFarland DC. When bad news comes through the portal: strengthening trust and guiding patients when they receive bad results before their clinicians. ASCO.org/edbook 2024; 44:e433944. 
  12. DeCamp M, Snyder Sulmasy L. Ethical and professionalism implications of physician employment and health care business practices: a policy paper from the American College of Physicians. Ann Intern Med. 2021;174:844-51.
  13. Christensen K, Sue VM. Viewing laboratory test results online: patients’ actions and reactions. J  Particip Med. 2013;5:e38.
  14. Arvisais-Anhalt S, Ratanawongsa N, Sadasivaiah S. Laboratory results release to patients under the 21st Century Cures Act: the eight stakeholders who should care. Appl Clin Inform. 2023;14:45–51.
  15. Amin RS, Davis MA, Naderi A, Forman HP. Release of complex imaging reports to patients: do radiologists trust AI to help? Current Problems in Diagnostic Radiology 2025;54:147–50.
  16. Baumgartner K, Byczkowski M, Schmid T, et al. Effectiveness of the medical chatbot PROSCA to inform patients about prostate cancer: results of a randomized controlled trial. European Association of Urology Open Science. 2024;69:80–88.