Federal health IT regulators have moved from warning to paperwork. The ONC has issued letters of nonconformity to seven health IT companies suspected of blocking lawful access to patient data under the 21st Century Cures Act.
HHS is not naming the recipients while investigations are active. Companies would be identified only if an investigation yields corrective action plans, financial penalties, suspensions or terminations, the agency said.
The tool carries real theoretical weight. Information blocking can cost up to $1 million per violation. In practice the statute has yet to bite: no penalties have been imposed, and no actor has been suspended or terminated to date.
National Coordinator Thomas Keane, speaking October 15 at the annual ADAPT conference, said most recipients have already remediated the allegations and agreed to change how they share data. He framed the office as wanting providers and vendors to understand the rules, with an enforcement posture when they decline.
Enforcement is deliberately multi-agency. ONC is coordinating with the Justice Department, the HHS Office of Inspector General and the Federal Trade Commission, which widens the consequences beyond a single regulatory penalty.
The practical signal for hospital CIOs sits in that list. The first visible enforcement wave is landing on the vendor side of health information exchange, so contract language on data access and release, and documentation of every refusal, matters more this quarter than last. Where a vendor cites policy as grounds to withhold records a clinician has a lawful right to receive, that exchange is now evidence.
