As of 2021, the U.S. 21st Century Cures Act mandates open notes.

In 2024, Disincentive Penalties for healthcare providers who engage in information blocking were finalized.

In 2026, ONC announced it was proactively testing healthcare organizations for information blocking. The Trump administration indicated it put resources toward its enforcement.

Open Notes Labs monitors developments and will update this page as more information becomes available.

All notes must be shared with patients. On October 6, 2022, the definition of electronic health information (EHI) in the 21st Century Cures Act expanded. It now encompasses not only the United States Core Data for Interoperability (USCDI) Version 1, but also all electronic protected health information (ePHI).

PHI encompasses any identifiable health information about a patient that is used, maintained, stored, or transmitted by a health care provider who bills an insurance company for services provided to any patient—also known as a “covered entity.” To be clear, patient access isn’t affected by whether the patient has insurance or not.

With this change to the interoperability and information blocking rule, EHI now extends to the designated record set (as defined by the Health Insurance Portability and Accountability Act, HIPAA), which includes both medical and payment records. This means the rule now applies to any information that could be used to make decisions about individuals, including patients. For entities subject to information blocking rules, all ePHI within a designated record set will be treated as EHI and subject to the rules.

EHI could include:

• Medical records and billing records about individuals maintained by or for a covered health care provider

• Enrollment, payment, claims adjudication, and case or medical management record systems

• Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals

More information about EHI and ePHI can be found at HealthIT.gov.

Yes. There are complex situations in which information can be blocked—and these are called exceptions. These exceptions must be applied on a case-by-case basis. Unless one of the exceptions applies, clinical notes must not be blocked.

For complete details, refer to the information blocking FAQ on HealthIT.gov.

Summary of the Exceptions

The rule refers throughout to “actors.” Actors include:

• Healthcare providers (including physicians, physician assistants, nurse practitioners, nurses, social workers, chaplains, therapists, and many other roles directly involved in patient care)

• Health information networks or health information exchanges

• Health IT developers of certified health IT (eg, electronic health record vendors)

We list below exceptions outlined by the final rule. These fall into two categories.

Category 1. Exceptions that involve not fulfilling requests to access, exchange, or use electronic health information (EHI):

• Preventing Harm Exception: If a patient makes the request for information, the provider must have a reasonable expectation that providing the information will result in physical harm to the life of the patient, clinician, or another person. If the legal representative of the patient requests the information, the clinician has to have a reasonable expectation that the release of information will result in harm to the patient, the clinician or another person.

• Privacy Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or uses EHI in order to protect an individual’s privacy, provided certain conditions are met.

• Security Exception: It will not be information blocking for an actor to interfere with the access, exchange, or use of EHI in order to protect the security of EHI, provided certain conditions are met.

• Infeasibility Exception: It will not be information blocking if an actor does not fulfill a request to access, exchange, or use EHI due to the infeasibility of the request, provided certain conditions are met.

• Health IT Performance Exception: It will not be information blocking for an actor to take reasonable and necessary measures to make health IT temporarily unavailable or to degrade the health IT's performance for the benefit of the overall performance of the health IT, provided certain conditions are met.

Category 2. Exceptions that involve procedures for fulfilling requests to access, exchange, or use of EHI:

• Content and Manner Exception: It will not be information blocking for an actor to limit the content or fulfillment methods for accessing, exchanging, or using EHI, provided certain conditions are met.

• Fees Exception: It will not be information blocking for an actor to charge fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using EHI, provided certain conditions are met

• Licensing Exception: It will not be information blocking for an actor to license interoperability elements for EHI to be accessed, exchanged, or used, provided certain conditions are met.

Details regarding conditions that must be met to fulfill these exceptions can be found on the ONC website.

There are a few types of clinical notes to which the rules do not apply.

Examples include:

Psychotherapy side notes or process recordings that are not intended to be a part of the individual’s medical/mental health record. These notes must be recorded (in any medium) by a mental health professional documenting or analyzing the contents of the conversation (transference/countertransference, for instance) during a private, group, joint, or family counseling session. Note that all behavioral health care providers are required to share their notes regarding:

• medication prescription and monitoring

• counseling session start and stop times

• the modalities and frequencies of treatment furnished

• results of clinical tests

• any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date

Information compiled in reasonable anticipation of, or use in a civil, criminal, or administrative action or proceeding and not intended to be a part of the health record.

Under the Cures rule, in certain specified situations, you can block (or “hide”) information from patient access on online portals. These are known as exceptions. For instance, you can block information in the following scenarios:

• If you believe a patient will harm another person or themselves as a result of reading the information

• If you need to protect the security of another person’s electronic health information (e.g., a mother’s health information in a child’s record; health information related to domestic violence concerns)

Unless one of the exceptions applies, clinical notes must not be blocked. Details about exceptions are outlined at HealthIT.gov.

So far, studies suggest that some clinicians are changing the way they write notes in response to open notes implementations, while some are not. However, many clinicians experienced in sharing notes have reported positive changes in the way they write their notes, commenting that their notes have become more valuable overall, especially to patients.

Few report “dumbing down” their language. Instead, they find themselves using fewer abbreviations in their notes and trying to avoid language that could appear judgmental to patients. Some report modulating their approach so that their notes become “teaching notes.”

In general, patients do not expect clinicians to write notes in layperson language, and in one large study, more than 90% report understanding their notes well. Studies suggest that most patients are not bothered by terms they don’t understand; they are happy to research them. 

They feel reading notes helps them prepare more focused questions for clinicians. Overall, studies show repeatedly that patients are enthusiastic about having a window into more information about their health.

Your patient is now reading your note: opportunities, problems, and prospects Am J Med (2016)

The views and experiences of clinicians sharing medical record notes with patients JAMA Netw Open (2020)