Toolkit · Healthcare

The Health Record Access, Interoperability, and Information Blocking Toolkit

42 U.S.C. § 1320

Type
Toolkit
Jurisdiction
National
Date
2024-12-29
Topic
Healthcare

This toolkit supplies working documents for health record access and information blocking. Tool 1 is a designated record set map that inventories every system holding records. Tool 2 is an individual access request letter set with fee objection and deadline notice. Tool 3 is a records request log for tracking response times. Tool 4 is a fee methodology worksheet built on the cost-based standard. Tool 5 is an exception analysis worksheet covering all eight information blocking exceptions. Tool 6 is a contract review checklist for restrictive terms. Tool 7 is a portal and proxy configuration matrix. Tool 8 is an information blocking complaint narrative template, and Tool 9 is a consolidated authority table.

The Health Record Access, Interoperability, and Information Blocking Toolkit

Healthcare > Health Records, Interoperability, and Information Blocking | Published 29 December 2024 - Updated 5 September 2025 | UpLaw - uplaw.us

How to use this toolkit. Providers should begin with Tool 1; requesters should begin with Tool 2. Bracketed text is for completion. The guide supplies the doctrine and the checklist supplies the sequence.

TOOL 1 — DESIGNATED RECORD SET MAP

Organization: [ ] · Prepared: [date] · Owner: [name, role] · Review: [date]

System Content Custodian Vendor In designated record set? Export capability Format Tested
[EHR] [notes, orders, results] [HIM] [vendor] Yes [API / bulk] [ ] [date]
[PACS] [imaging and reports] [Radiology] [vendor] Yes [ ] [ ] [ ]
[Billing] [claims, statements] [Revenue cycle] [vendor] Yes [ ] [ ] [ ]
[Legacy EHR] [pre-migration records] [ ] [ ] Yes [ ] [ ] [ ]
[Device / RPM] [monitoring data used in care] [ ] [ ] [analyze] [ ] [ ] [ ]
[Risk scores] [algorithmic outputs used in decisions] [ ] [ ] [analyze] [ ] [ ] [ ]
[QA files] [peer review not used for individual decisions] [ ] — No — — —

Conclusion. The designated record set for this organization comprises: [list]. Anything used in whole or in part to make decisions about an individual is included, regardless of which system holds it.

⚠️ Most organizations have never written this down, which is why productions are incomplete and why infeasibility claims fail.

TOOL 2 — REQUEST LETTER SET

A. Individual access request. "I request a copy of my health information. Please provide all records used in whole or in part to make decisions about my care between [dates], including clinician and nursing notes, orders, laboratory and imaging results and reports, medication administration records, discharge summaries, correspondence regarding my care, billing records, and any risk scores or algorithmic outputs relied on. These records are maintained electronically; I request an electronic copy in [format], delivered by [method]. Response is due within thirty days, extendable once by thirty days only on written notice stating the reason. Please provide a fee estimate in advance; the fee is limited to a reasonable, cost-based amount covering labor for copying, supplies, and postage."

B. Third-party direction. "Please transmit a copy of the records described above to [recipient, organization, address or electronic endpoint]. This signed writing directs transmission under the individual right of access."

C. Fee objection. "The quoted fee appears to be per-page and to include search and retrieval. For an individual access request the fee is limited to a reasonable, cost-based amount and may not include search and retrieval time. Please provide the methodology applied and a corrected estimate."

D. Deadline notice. "My request was delivered on [date]. More than thirty days have elapsed with neither production nor a written extension notice stating a reason. Please produce within five business days; otherwise I will file complaints with the federal enforcement office and [state agency]."

E. Denial challenge. "Your denial cites [ground], which does not apply because [reason]. Please produce the portion of the record not subject to that ground, state whether the denial is reviewable, and identify how to request review by a licensed professional not involved in the original decision."

📌 Statutory anchors: 42 U.S.C. § 1320d, 42 U.S.C. § 17935, 45 C.F.R. Part 164.

TOOL 3 — REQUEST LOG

# Received Requester Records sought Format requested Fee quoted Fee basis Extension sent Fulfilled Days Notes
[ ] [date] [individual / third party] [ ] [electronic / paper] [$] [cost calc ref] [date or n/a] [date] [ ] [ ]

Monthly metrics

Metric Target Actual
Median days to fulfillment [ ] [ ]
Percentage fulfilled within thirty days 100% [ ]
Extensions used [ ] [ ]
Requests fulfilled electronically when electronic was requested 100% [ ]
Denials, by ground [ ] [ ]
Fee complaints 0 [ ]

☐ Report to leadership monthly. A log turns assertions into evidence and surfaces systemic problems before a complaint does.

TOOL 4 — FEE METHODOLOGY WORKSHEET

Access fee calculation — effective [date] · Reviewed by [name]

Component Included? Basis Amount
Labor for copying (electronic) [Y] [minutes × rate] [$]
Labor for copying (paper) [Y] [ ] [$]
Supplies (media, paper) [Y] [actual cost] [$]
Postage [Y] [actual] [$]
Preparation of requested explanation [Y] [ ] [$]
Search and retrieval [N] Not chargeable to the individual —
Review and redaction time [N] Not chargeable —
System maintenance and storage [N] Not chargeable —
Vendor per-page schedule [N] Litigation copies only —

Flat fee option. [If used, state the basis and confirm it does not exceed actual average cost for the type of request.]

Third-party requests under authorization. [Separate schedule; state law caps apply. Keep this workflow distinct from individual access.]

⚠️ The single most common enforcement finding is a fee error. Separate the workflows and audit the calculation annually.

TOOL 5 — INFORMATION BLOCKING EXCEPTION ANALYSIS

Practice under review: [describe] · Actor type: [provider / developer / network] · Date: [ ] · Analyst: [ ]

Step 1 — Is this a practice likely to interfere with access, exchange, or use of electronic health information? [Yes/No; explain.]

Step 2 — Knowledge. [Provider: do we know the practice is unreasonable and likely to interfere? Developer/network: do we know or should we know?]

Step 3 — Exception analysis.

Exception Applicable? Conditions Evidence Gap
Preventing harm [ ] risk type; belief basis; no broader than necessary; review available [ ] [ ]
Privacy [ ] law and provision requiring withholding; consent that would cure [ ] [ ]
Security [ ] directly related; tailored; consistent; non-discriminatory; written policy [ ] [ ]
Infeasibility [ ] uncontrollable event / segmentation impossible / documented analysis; written response within required period [ ] [ ]
Health IT performance [ ] necessary; no longer than needed; consistent [ ] [ ]
Content and manner [ ] requested manner unattainable; alternative follows the order of preference [ ] [ ]
Fees [ ] objective criteria; uniform; cost-related; no fee for individual access [ ] [ ]
Licensing [ ] reasonable and non-discriminatory; negotiation period; royalty conditions [ ] [ ]

Step 4 — Conclusion. [Practice permitted under [exception]; practice modified as follows; or practice discontinued.] Approved by: [ ] Date: [ ]

📌 Write this at the time of the decision. The rules are at 45 C.F.R. Part 171; certification obligations at 45 C.F.R. Part 170; statutory basis at 42 U.S.C. § 300jj-51.

TOOL 6 — CONTRACT REVIEW CHECKLIST

☐ Prohibitions on sharing screenshots, descriptions, or performance information about the technology ☐ Restrictions on connecting to other systems, exchanges, or competing products ☐ Confidentiality terms extending to pricing or to interoperability limitations ☐ Interface, integration, or connection fees — are they cost-based and uniformly applied? ☐ Data export: cost, format, timeline, and whether export has been tested ☐ Termination assistance and transition services, with defined deliverables ☐ Ownership and license of customer data on termination ☐ Business associate terms with subcontractor flow-down ☐ Breach notification timelines short enough for the customer's own obligations ☐ Indemnity for vendor-caused breaches and for blocking exposure arising from vendor conduct ☐ Certification maintenance commitments and real-world testing participation ☐ Change-of-control provisions affecting continuity of access ☐ Service levels for interface availability and support escalation

⚠️ A restrictive term can be a blocking practice even if no request is ever refused. Inventory contracts and remediate before an enforcement inquiry does it for you.

TOOL 7 — PORTAL AND PROXY CONFIGURATION MATRIX

Population Access granted Results release Sensitive categories Proxy access Automatic changes at age Policy reference
Adult patient Full [immediate] [ ] [designated only] — [ ]
Adult with representative Full [ ] [ ] [documented authority] — [ ]
Minor under [age] [ ] [ ] [ ] [parent full] [ ] [ ]
Adolescent [age range] [ ] [ ] [minor-consent categories withheld from proxy] [parent limited] [at age __] [ ]
Emancipated minor [ ] [ ] [ ] [none] — [ ]
Deceased patient [personal representative] [ ] [ ] [appointment document required] — [ ]

State variations. [List each state's minor-consent categories and the corresponding configuration.]

☐ Configure by policy, not case by case, and re-verify after every system upgrade. ☐ Test proxy behavior at each age boundary before release. ☐ Document the substance use record handling under 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2.

TOOL 8 — BLOCKING COMPLAINT NARRATIVE

1. Actor. [Name; type — health care provider, developer of certified health IT, or health information network or exchange; basis for that classification.]

2. Practice. [Describe the practice, not the incident: technical measure, contract term, fee, policy, or pattern of delay.]

3. Interference. [How the practice is likely to interfere with access, exchange, or use of electronic health information, and who is affected.]

4. Knowledge. [Facts showing the actor knew, or should have known, depending on actor type.]

5. Exception asserted, if any. [What the actor said; why the conditions are not met — tailoring, consistency, non-discrimination, documentation, or timing.]

6. Comparators. [Evidence the practice is applied to some requesters and not others.]

7. Evidence. [Correspondence, screenshots, fee schedules, contract excerpts, dates, and names.]

8. Relief sought. [Change in practice; note there is no private right of action and remedies run through penalties or program disincentives.]

TOOL 9 — AUTHORITY TABLE

Provision Subject
42 U.S.C. § 1320d Administrative simplification definitions
42 U.S.C. § 1320d-1 Applicability of standards
42 U.S.C. § 1320d-2 Standards for information transactions
42 U.S.C. § 1320d-5 Civil monetary penalties
42 U.S.C. § 1320d-6 Wrongful disclosure — criminal penalties
42 U.S.C. § 17931 Application of security provisions
42 U.S.C. § 17935 Restrictions and electronic access
42 U.S.C. § 17937 Business associate and vendor provisions
42 U.S.C. § 300jj Health information technology definitions
42 U.S.C. § 300jj-11 Office of the National Coordinator
42 U.S.C. § 300jj-14 Standards committee
42 U.S.C. § 300jj-51 Interoperability and information blocking
42 U.S.C. § 290dd-2 Substance use disorder record confidentiality
5 U.S.C. § 552a Privacy Act — federal agency records
20 U.S.C. § 1232g Education records
45 C.F.R. Part 160 General administrative requirements
45 C.F.R. Part 162 Transactions and code sets
45 C.F.R. Part 164 Privacy, security, and breach notification
45 C.F.R. Part 170 Health IT certification program
45 C.F.R. Part 171 Information blocking
42 C.F.R. Part 2 Substance use disorder records
42 C.F.R. Part 482 Hospital conditions of participation
42 C.F.R. Part 483 Long-term care requirements
Whalen v. Roe Interest in avoiding disclosure of medical data
Sorrell v. IMS Health Health data restrictions and the First Amendment
NASA v. Nelson Informational privacy and safeguards
Doe v. Chao Actual damages requirement
FAA v. Cooper Emotional distress excluded
Gonzaga University v. Doe Individually enforceable rights under spending statutes
Alexander v. Sandoval No implied private rights of action
Loper Bright v. Raimondo Review of agency interpretation

Closing note

Three artifacts carry the program: the designated record set map, the request log, and the dated exception analyses. Build those and most of what follows is routine. Skip them and every dispute becomes an argument about memory.

TOOL 10 — EXPORT TEST PROTOCOL

System: [ ] · Tested: [date] · Tester: [ ] · Next test: [ ]

1. Scope. Export a complete record for [three] representative patients: one with a long history, one with imaging and scanned documents, and one whose care spans a system migration.

2. Method. Use the standard export path a departing customer or a records request would use, not an engineering-only path.

3. Measure. Time to produce; cost quoted; format produced; completeness against the encounter list; whether imaging, scanned documents, outside records, and pre-migration data are included.

4. Ingest. Attempt to load the output into [second system]. Record what imports cleanly, what imports with loss, and what fails.

5. Findings. [List gaps, with owner and remediation date.]

6. Conclusion. [Export is adequate / adequate with noted gaps / inadequate — escalate to vendor management and to contract remediation.]

⚠️ An untested export is an assumption. Organizations discover the problem at migration, at closure, or in response to a records request — always at the worst moment and always with a deadline running.

TOOL 11 — INCIDENT AND ESCALATION PLAYBOOK

Trigger events

☐ A records request passes twenty days without production or an extension notice ☐ A fee complaint is received ☐ A third-party direction request is declined for any reason ☐ A connection or interface request from an outside organization is declined, delayed, or priced above the standard schedule ☐ A patient reports that portal data was visible to a proxy who should not have seen it ☐ A regulator inquiry or complaint notice arrives

Immediate steps

  1. Assign an owner and open a file with the date and the trigger.
  2. Pull the request log entry, the correspondence, and the applicable policy.
  3. Determine whether the underlying obligation was met; if not, cure first and analyze second.
  4. Prepare the exception analysis using Tool 5 if a practice is being defended.
  5. Notify privacy, legal, and the accountable executive.
  6. Preserve records, including vendor logs, and suspend any automated deletion.
  7. Record the corrective action and the date completed.

Within thirty days

☐ Determine whether the incident reflects a practice or an outlier, using the log ☐ Remediate the practice if it is one, and document the change ☐ Update training and policy ☐ Report to leadership with the metric affected

📌 Cure first. In this field, the fastest path to a good outcome is producing the records or removing the term, then explaining. An organization that fixed the problem before responding is in a materially better posture than one that argued first.

Related Documents