The Health and Human Services Department (HHS) has issued seven letters of potential nonconformity to companies that may have illegally blocked access to health data, according to an October 19 Nextgov/FCW report. 

Thomas Keane, HHS assistant secretary for technology policy and national coordinator for health information technology, disclosed the number on October 15 at the ADAPT conference in Santa Fe, New Mexico. Keane, however, did not identify the recipients.

The letters concern potential “information blocking”, practices that prevent patients, providers or other authorized parties from accessing electronic health information. He said the companies have been able to remediate the allegations and, for the most part, agreed to change their data-sharing practices.

HHS is coordinating with its Office of Inspector General (OIG), the Justice Department and the Federal Trade Commission on enforcement. 

The 21st Century Cures Act prohibits information blocking, and OIG can impose civil penalties of up to $1 million per violation. Nonconformity letters are not penalties, but they can lead to corrective action, certification consequences or referral for enforcement.

Making Data Access Rules Accountable, Documented and AI-Ready

For chief data officers (CDOs), the enforcement approach makes data-sharing governance an operational requirement.

Organizations strict AI governance: clear rules for who may access data, under what conditions, and how access requests are reviewed and resolved. Without an accountable process, technical defaults, vendor contracts or system design can create unlawful barriers even when no one intends to block data.

The HHS approach shows that regulators may favor remediation before penalties. CDOs should therefore be able to document access restrictions, their legal or security basis, and the remediation taken when a restriction is challenged.

AI systems and agents depend on lawful, reliable access to data. So, organizations must maintain visibility into data flows, access controls and restrictions so they can defend both their sharing practices and AI deployments if regulators ask.