LAS VEGAS — Ease of health data exchange is a top priority for the nation’s health IT regulator, and the agency is taking steps to sanction companies that block the free flow of information, according to Dr. Thomas Keane, assistant secretary for technology policy and the national coordinator for health information technology.
The ASTP/ONC is in the process of issuing notices of nonconformity to IT developers accused of information blocking who participate in the agency’s health IT certification program, the first potential enforcement action in nearly a decade since Congress banned information blocking.
IT developers found guilty of information blocking could have their health IT certification pulled by the ASTP/ONC. If their certification is pulled, the company could lose out on financial incentives from the CMS, including incentive payments sent to the customers of IT developers for using certified technology.
The health IT certification program, which outlines standards and functionality for health IT, is voluntary. But certified tools are encouraged or required in order to participate in some federal and state programs.
The ASTP/ONC is working with the CMS to ensure the agency will withhold the incentive payments, Keane said during a presentation at the 2026 HIMSS conference. Additionally, if the HHS’ Office of Inspector General finds a company was blocking the flow of health data, the regulator could levy fines of up to $1 million per each instance of information blocking.
“What’s great about the law is it doesn’t say exactly what an instance constitutes,” Keane said. “So, in theory, the penalties could be quite large.”
Developers who receive notices will have the opportunity to respond and explain if they think they’re following the information blocking rules, Keane said during a panel discussion. If they aren’t, the ASTP will work on a corrective action plan for the company. Only after a vendor neglects to follow the plan requirements would the agency pull the health IT certification.
“No one — not a doctor, not a hospital, not an EHR vendor — should be able to hoard health information for their own gain,” Keane said. “It’s bad for patients, bad for innovation, and, quite frankly, bad for business.
