Report information blocking

If MedAI can't connect to your provider, you may have a right that's being violated. Here's how to escalate.

Bottom line: healthcare providers, EHR vendors, and health-information exchanges are not allowed to interfere with your electronic access to your own records. If they do, the federal Office of the National Coordinator for Health IT (ONC) wants to hear about it. The complaint portal is at inquiry.healthit.gov.

What "information blocking" means

"Information blocking" is defined in 45 CFR §171.103: a practice that is likely to interfere with the access, exchange, or use of your electronic health information, by an "actor" (provider, EHR vendor, HIE, etc.) that knows or should know it would do so.

Civil monetary penalties of up to $1 million per violation apply to vendors and exchanges. Providers face other "appropriate disincentives" set by HHS.

Common examples

• A patient-portal app (yours, MedAI's, anyone's) is told it cannot connect, with no specific legal exception cited.
• You're charged a fee to use the SMART on FHIR Patient Access API. This is prohibited by 45 CFR §170.404(a)(4).
• You're asked to sign extra paperwork or pay for the electronic copy of your records that HIPAA requires be delivered to you for free (when delivered through automated FHIR).
• The provider's response is significantly slower than the same provider's response to other apps, with no operational justification.
• The provider tells you "we don't support that app" when the app uses the federally required FHIR API — the app doesn't need to be "supported" in any partnership sense.

Not information blocking

Some refusals are legitimate. The rule has 8 enumerated exceptions (45 CFR Part 171, Subparts B & C):

• Preventing harm (the data could be used against you)
• Privacy (releasing it would violate a privacy law)
• Security (genuine, specific, documented security risk)
• Infeasibility (the request is genuinely impossible)
• Health-IT performance (system maintenance windows, etc.)
• Content & manner (different ways to fulfill the same access)
• Fees (only certain, specifically allowed fees)
• Licensing (interoperability elements legitimately licensed)

A vague "no" is not an exception. The actor must specifically cite which exception applies and why.

Step-by-step: file a complaint

1. Gather context. Note:
   • The vendor or provider name (e.g., "Epic at Acme General Hospital")
   • The date and time of the attempted access
   • The exact error message you saw
   • Any reference number the provider gave you
   • What you were trying to do (e.g., "import my own medical records into the MedAI app on my phone")
   Don't include other people's PHI. Your own data is fine to reference at a high level (e.g., "my labs from 2024-09-15" — but don't paste the actual lab values).
2. Open the ONC inquiry portal. Go to inquiry.healthit.gov in your browser. The site is operated by ONC under HHS.
3. Pick the "Report Information Blocking" path. On the portal home page, look for the option that mentions information blocking. Other paths there are for general inquiries and certified-product complaints — those aren't what you want for an access refusal.
4. Identify yourself or stay anonymous. ONC accepts anonymous complaints. We recommend providing contact info so they can ask follow-up questions — your complaint will move faster — but it's your call.
5. Describe what happened. Use the context you gathered in step 1. Keep it factual: "On [date], I attempted to authorize the MedAI mobile app to read my own health records from [Provider Name] using the provider's SMART on FHIR Patient Access API at [authorize endpoint]. The connection failed with error '[error message]'. The provider's support told me '[response]'. I believe this constitutes information blocking under 45 CFR Part 171."
6. Reference the legal basis. ONC's analysts already know the rules, but citing them in your complaint shows you've done the homework. The two key citations:
   • §170.315(g)(10) — Standardized API requirement
   • §171.103 — Information-blocking definition
7. Submit. You'll get a reference number. Save it. ONC may follow up by email.

While you wait

ONC investigations take time — sometimes months. Meanwhile:

• You can still get your records via the slower HIPAA Right of Access path. Email the provider's medical records office; under 45 CFR §164.524 they must respond within 30 days (one 30-day extension is allowed). They may charge a reasonable copy fee for non-electronic delivery, but the electronic copy via API is supposed to be free.
• If you've donated to MedAI's development and want a sympathetic ear, open a GitHub issue tagged with the provider name. Other users likely hit the same wall and the public record helps.

What MedAI does on its end

MedAI doesn't file the complaint for you — that has to come from you, the patient. But the in-app Settings → Help → Report blocking flow:

• Pre-fills the context (vendor, error code, timestamp) onto your clipboard so you can paste it into ONC's portal.
• Opens the portal in your browser.
• Stores nothing about the complaint — the clipboard write happens on-device and the rest is between you and ONC.

Other recourse

• HIPAA Privacy Rule complaint: if the access refusal is HIPAA-based rather than ONC-based, you can also file with HHS Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint.
• State medical-records law: most states have their own access laws (e.g., California's CMIA, Texas's TMRPA). Your state attorney general's office is the right venue for those.
• State health-data laws (WA MHMD, etc.): these tend to focus on consumer health data outside the clinical setting, but some apply to provider data too.

MedAI does not provide legal advice. This page is informational guidance based on the public ONC rules. If you have a specific legal dispute, consider consulting a healthcare-law attorney.