By Amy Derlink, Director of Compliance and Privacy, Verisma
October 23, 2026
Patient access to electronic health information is no longer simply a service standard – it’s an enforcement priority. The HHS Office of Inspector General (OIG) and the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) have signaled intensified information blocking enforcement, with an emphasis on practices that can harm patients, impair care, continue for long periods, cause financial loss, or reflect actual knowledge.
For HIM, privacy, compliance, and ROI teams, the message is clear: a request cannot remain unresolved because the organization is still working through a privacy, consent, segmentation, technical, or visibility issue. If the organization cannot fulfill a request and intends to rely on the Infeasibility Exception, the regulation requires a written response to the requester within 10 business days of receiving the request, including the reason the request is infeasible.
Patient-access expectation has changed
The 21st Century Cures Act made access, exchange, and use of electronic health information (EHI) the expected norm. Information blocking can include an act or omission likely to interfere with that access, exchange or use – unless the practice is required by law or satisfies an ONC exception. For healthcare providers, the standard considers whether the provider knows a practice is unreasonable and likely to interfere with EHI access, exchange or use.
That framework changes the operational question. It’s no longer enough to ask, “Are we still within the HIPAA access timeline?” Organizations must also ask, “Are we creating an unnecessary delay in access to EHI, and if we cannot fulfill the request, have we met every condition of the exception we’re relying on?” HIPAA and information blocking requirements overlap, but they’re not interchangeable. Meeting one framework doesn’t automatically establish compliance with the other.
Privacy concerns don’t create an open-ended pause
The Privacy Exception may protect a decision not to fulfill a request when the practice is designed to protect an individual’s privacy and meets the applicable regulatory conditions. Depending on the facts, those conditions may involve preconditions under law, an individual’s request not to share information, denial of an individual’s right of access under applicable law or respecting a person’s choice not to provide consent or authorization.
But a privacy review shouldn’t become a holding pattern. If protected information cannot be unambiguously separated from information that could otherwise be released, the segmentation condition of the Infeasibility Exception may be relevant. That’s the critical connection: the underlying reason may involve privacy, consent, or restricted visibility, but reliance on infeasibility brings a specific operational obligation – the written response must go out within 10 business days.
What must happen by day 10
Under 45 CFR § 171.204, an actor relying on the Infeasibility Exception must provide the requester with a written response within 10 business days of receipt. The response must explain why the request is infeasible. Internally, the organization should also be able to show which condition applies and how the facts support that conclusion.
Build the requirement into the workflow
The greatest risk is often not a lack of policy; it’s a workflow allowing difficult requests to age silently. Organizations should configure escalation points before day 10, assign clear ownership across HIM, Privacy, Compliance, Legal, IT, and clinical stakeholders, and use standardized documentation requiring the decision-maker to identify the applicable exception and supporting facts.
Monitoring matters as much as policy. Leaders should review turnaround times, aging by request type, day-10 escalations, reasons for non-fulfillment, partial-release rates, and repeated barriers tied to a system, department, or data category. A pattern of delayed or unsupported denials may draw more scrutiny than an isolated, well-documented decision.
The compliance takeaway
Day 10 should be treated as a firm control point – not a target for beginning the review. When a patient or another requester seeks EHI, the organization should fulfill the request without unnecessary delay, pursue an appropriate alternative manner, or complete and communicate a defensible exception analysis on time.
Privacy remains essential, but privacy and access aren’t opposing goals. A mature program protects both by making prompt, fact-specific decisions; releasing what can be released; explaining what cannot; and documenting why. In today’s enforcement environment, silence and delay aren’t a compliance strategy.
Verisma can help
Information blocking exceptions, privacy reviews, and day-10 deadlines can be complex to navigate, and no organization should sort through them alone. Verisma is always happy to consult with our valued clients on topics such as this, from building escalation points into your ROI workflow to strengthening documentation supporting defensible, timely decisions. Have questions about your process? Contact us to connect with our team.
Want to stay ahead of evolving regulations like information blocking, HIPAA, and patient right of access? Join Verisma Academy for expert-led webinars and on-demand courses on topics like this and earn free AHIMA CEUs along the way.
