21st Century Cures Act: Information Blocking, FDA, and NIH

The 21st Century Cures Act, signed into law on December 13, 2016, reshaped how the FDA approves new treatments, directed $4.8 billion to the National Institutes of Health, and made it illegal for healthcare providers and health IT companies to block patients from getting their own electronic health records.¹ Nearly a decade in, the FDA and NIH pieces have settled into routine practice. The information blocking rules are the live compliance story, with penalties now flowing and several implementation deadlines landing in 2026.

Information Blocking: The Rule With Teeth

Information blocking is any practice by a healthcare provider, a health IT developer of certified technology, or a health information network that interferes with, prevents, or materially discourages access to electronic health information.² The definition is deliberately broad. Refusing to release records counts. So do quieter tactics: charging excessive fees for data exports, using proprietary formats that make records unreadable in other systems, or imposing unnecessary technical hurdles on apps a patient has chosen to receive their data.

Penalties for Developers and Networks

Health IT developers, health information exchanges, and health information networks face civil monetary penalties of up to $1 million per violation if the HHS Office of Inspector General determines they committed information blocking.³ The OIG weighs the number of patients and providers affected, how long the blocking lasted, and whether it caused harm to patients or financial loss to federal healthcare programs.⁴

Disincentives for Providers

Individual providers and provider organizations face a different structure. Rather than direct fines, the statute directs the Secretary of HHS to establish “appropriate disincentives” through rulemaking.³ The final rule took effect in 2024 and works through existing Medicare payment programs:

A MIPS-eligible clinician found to have committed information blocking receives a zero score on the Promoting Interoperability performance category, which typically accounts for a quarter of the total MIPS score. Groups that submitted data at the group level are all zeroed out together.
A hospital or critical access hospital loses meaningful EHR user status, which can affect Medicare payment adjustments.
An accountable care organization, its participants, and its affiliated providers can be removed from or denied entry to the Medicare Shared Savings Program for at least one year.

For a busy practice or hospital system, losing Promoting Interoperability points can translate to tens of thousands of dollars in reduced Medicare payments.⁵

The Eight Exceptions

Not every restriction on data access counts as information blocking. Federal regulations recognize eight exceptions, each with detailed conditions that must be satisfied before a restriction is protected:

Preventing harm to a patient or another person.
Privacy, including honoring a patient’s request not to share.
Security, to protect against threats like cyberattacks.
Infeasibility, when a request is technically or operationally impossible at the time.
Health IT performance, such as scheduled maintenance windows.
Content and manner, when the information is provided but in a different format or through a different method than requested.
Fees that are reasonable and cost-based.
Licensing, when reasonable terms are required for interoperability elements like software interfaces.

Claiming an exception as a defense requires more than a general assertion that security or privacy was at stake. The regulation spells out what each exception demands.⁶

Patient Access Through Apps

Patients have the right to access their electronic health records through third-party applications of their choice, using standardized application programming interfaces. Providers and health IT developers generally cannot vet or block an app the patient has selected; doing so will likely be treated as information blocking. The Office of the National Coordinator (ONC) oversees the certification standards that keep health data portable and machine-readable.²

Filing a Complaint

Anyone who has experienced or witnessed information blocking can submit a complaint through the Information Blocking Portal on HealthIT.gov or through the OIG fraud hotline. The OIG receives more complaints than it can investigate, so it triages based on enforcement priorities: whether the conduct caused or could cause patient harm, whether it significantly impacted a provider’s ability to care for patients, how long it lasted, whether it caused financial loss to federal healthcare programs, and whether the entity acted with actual knowledge that the conduct was information blocking.⁴

When the OIG opens a case, it gathers facts, conducts interviews, and issues document requests, sometimes consulting with ONC on technical questions. If the investigation concludes that information blocking occurred, the OIG sends a demand letter and the entity has an opportunity to appeal before a penalty is imposed. Complaints that document specific dates, systems, and patient-care impact clear the triage threshold far more often than vague reports.

Compliance Deadlines Landing in 2026

Two implementation milestones matter this year for health IT developers and providers.

USCDI Version 3

The HTI-1 final rule adopted the United States Core Data for Interoperability version 3 as the baseline standard within the ONC Health IT Certification Program, effective January 1, 2026.⁷ USCDI v3 defines the minimum data elements — lab results, clinical notes, medication lists, demographic information, and the rest — that certified health IT must be able to exchange. In March 2025, ONC exercised enforcement discretion and removed certain data elements, releasing USCDI v3.1. A proposed rule (HTI-5) would formally adopt v3.1 going forward.⁸ The certified data elements directly determine what must flow through APIs to patients and other providers, so developers should be tracking the changes closely.

TEFCA and MIPS

The Trusted Exchange Framework and Common Agreement (TEFCA) is the national framework for health information sharing that grew out of the Cures Act’s interoperability mandates. The first Qualified Health Information Networks were designated in December 2023, and the network has expanded since.⁹ TEFCA participation is not technically mandatory, but CMS has made it financially attractive. For the 2026 performance year, the “Enabling Exchange Under TEFCA” measure is worth 30 points toward the MIPS Promoting Interoperability score. Clinicians who don’t participate must submit alternative health information exchange measures instead.¹⁰

FDA Pathways the Law Created

The Cures Act expanded the types of evidence manufacturers can submit to the FDA and created faster review tracks for high-need products.

Real-World Evidence

Before the Cures Act, drug applications leaned almost entirely on traditional clinical trials. The law opened the door for the FDA to consider real-world evidence: data drawn from electronic health records, insurance claims, patient registries, and similar sources outside the controlled trial setting. This matters most for drugs already on the market. A manufacturer seeking approval for a new use of an existing drug can now support that application with real-world data rather than running a fresh trial. The FDA can also rely on summary-level reviews for supplemental applications instead of requiring the full dataset from scratch.¹

Breakthrough Devices Program

The Cures Act formalized the Breakthrough Devices Program, which fast-tracks medical devices that treat or diagnose life-threatening or irreversibly debilitating conditions. To qualify, a device must also meet at least one additional criterion: it represents a breakthrough technology, no approved alternative exists, it offers significant advantages over existing options, or its availability is in patients’ best interest.¹¹ Manufacturers in the program get prioritized review and direct access to FDA staff through sprint discussions, data development plan meetings, and clinical protocol agreements.

Regenerative Medicine Advanced Therapy Designation

The Regenerative Medicine Advanced Therapy (RMAT) designation provides an expedited pathway for cell therapies, tissue engineering products, gene therapies, and combination products using those technologies. A product qualifies if it targets a serious or life-threatening condition and shows preliminary clinical evidence of potential to address an unmet medical need. The FDA must respond to designation requests within 60 days.¹²

Patient-Focused Drug Development

The Cures Act required the FDA to develop formal guidance on incorporating patient experience data into drug approval decisions. The agency responded with a four-part guidance series covering how to collect representative patient input, identify what matters most to patients, develop clinical outcome assessments that measure those priorities, and build those assessments into regulatory endpoints.¹³ The framework lets drugmakers show the FDA not just whether a treatment works in clinical measurements, but whether patients actually feel better on it.

Pediatric Rare Disease Priority Review Vouchers

The Cures Act extended the rare pediatric disease priority review voucher program, which rewards companies that develop treatments for rare childhood diseases with a voucher that can be used or sold to speed up FDA review of any future drug application. Following the Consolidated Appropriations Act of 2026, the program is set to expire after September 30, 2029, and the FDA cannot award any vouchers under this program after that date.¹⁴ These vouchers have sold for hundreds of millions of dollars on the open market.

NIH Research Funding the Law Authorized

The Cures Act authorized $4.8 billion for the National Institutes of Health over ten years, though Congress appropriates the funds annually.¹⁵ The money supports four programs.

The Beau Biden Cancer Moonshot received about $1.8 billion to accelerate cancer research, with particular focus on immunotherapy, genomics, and early detection. Approximately $1.51 billion goes to the Brain Research through Advancing Innovative Neurotechnologies (BRAIN) Initiative, which aims to map how the brain stores and retrieves information to improve diagnosis and treatment of neurological and mental health disorders. Roughly $1.46 billion funds the Precision Medicine Initiative, now operating as the All of Us Research Program, which is building a cohort of one million or more participants whose genetic, environmental, and lifestyle data create a foundation for personalized treatments.¹⁵

Beyond traditional grants, the Cures Act gave NIH authority to run EUREKA prize competitions, which pay financial awards to researchers who hit specific milestones in treating or curing major diseases. Early implementations focused on Alzheimer’s disease and related dementias.

Inclusion in Clinical Trials

The Cures Act reinforced existing mandates that NIH-funded clinical research include women and members of racial and ethnic minority groups appropriately to the scientific question. Phase III clinical trials must be designed to analyze whether outcomes differ across these groups, and researchers must justify any exclusions based on sex, race, or ethnicity on scientific or ethical grounds. Annual progress reports must include demographic breakdowns and the status of subgroup analyses.¹⁶

Mental Health and Opioid Provisions

The Cures Act created the position of Assistant Secretary for Mental Health and Substance Use, who leads SAMHSA and coordinates mental health programs across federal agencies. The role elevated an administrator position into one with broader authority to reduce fragmentation in federal mental health policy.

The law authorized $1 billion in grants to states over two years to address the opioid epidemic. States could use the funding for prescription drug monitoring programs, prevention activities, training healthcare professionals on prescribing best practices, and expanding access to treatment through federally certified opioid treatment programs. Allocations were based on the severity of each state’s crisis and overdose death rates.

On the insurance side, the Cures Act strengthened enforcement of mental health parity, the principle that insurance coverage for mental health and substance use treatment cannot be more restrictive than coverage for physical health services. The law directed federal agencies to issue compliance guidance for insurers and authorized audits of health plans that may be violating parity requirements.

What Providers Can Tell Families

Families dealing with a loved one’s mental health or substance use crisis often hear that HIPAA prevents providers from sharing any information. The Cures Act prompted updated federal guidance clarifying when it doesn’t. If a patient is present and capable of making decisions, a provider can share information with a family member when the patient agrees, is given the opportunity to object and doesn’t, or when the provider reasonably concludes the patient does not object. If the patient is incapacitated or not present, the provider can share information when they determine it’s in the patient’s best interest.¹⁷ Psychotherapy notes are the exception; disclosing those generally requires the patient’s written authorization.

SAMHSA also administers grant programs that fund training for mental health and substance use disorder professionals, aimed at expanding the workforce in underserved communities.¹⁸

1
U.S. Food and Drug Administration. 21st Century Cures Act
2
HealthIT.gov. Information Blocking
3
GovInfo. 42 USC 300jj-52
4
Office of Inspector General. Information Blocking
5
eCFR. Disincentives for Information Blocking by Health Care Providers
6
eCFR. 45 CFR Part 171 – Information Blocking
7
HealthIT.gov. HTI-1 Final Rule
8
HealthIT.gov. ONC Standards Bulletin 2026-1
9
HealthIT.gov. TEFCA
10
CMS Quality Payment Program. 2026 MIPS Promoting Interoperability – Enabling Exchange Under TEFCA Measure
11
U.S. Food and Drug Administration. Breakthrough Devices Program
12
U.S. Food and Drug Administration. Regenerative Medicine Advanced Therapy Designation
13
U.S. Food and Drug Administration. FDA Patient-Focused Drug Development Guidance Series for Enhancing the Incorporation of the Patients Voice in Medical Product Development and Regulatory Decision Making
14
U.S. Food and Drug Administration. Rare Pediatric Disease Designation and Priority Review Voucher Programs
15
National Institutes of Health. The 21st Century Cures Act
16
National Institutes of Health. Inclusion of Women and Members of Racial and/or Ethnic Minority Groups in Clinical Research
17
U.S. Department of Health and Human Services. A Health Care Providers Guide to the HIPAA Privacy Rule – Communicating with a Patients Family, Friends, or Others Involved in the Patients Care
18
Substance Abuse and Mental Health Services Administration. Treatment, Recovery, and Workforce Support Grant