Information blocking rules update: what diagnostic radiology groups should know now

It is increasingly becoming possible that radiology groups that routinely embargo imaging results from patients with significant findings could face scrutiny under the 21st Century Cures Act information blocking rules. 

In September 2025, HHS Secretary Kennedy directed agency resources toward active enforcement, and in February 2026, ASTP/ONC began issuing letters of nonconformity to certified EHR developers. As of July 2026, the ONC complaint portal has logged over 2,500 submissions, with healthcare providers named in the majority and patients filing most of the complaints. No provider has been publicly penalized yet, but investigations are reported to be underway and the direction is unmistakable.

For diagnostic radiology groups, the stakes are uniquely high. The longstanding radiology practice of placing time-limited embargoes on patient portal access to reports has been specifically identified by ONC as conduct that would "likely be considered an interference for purposes of information blocking." A blanket organizational policy delaying report release so that the ordering clinician can review results first does not qualify for the Preventing Harm Exception to the information blocking rules.

The regulatory picture grew more complicated in December 2025 when HHS withdrew the proposed Requestor Preferences Exception as part of a broader deregulatory initiative. Had it been finalized, that exception would have allowed radiology providers to honor a patient's stated preference to delay electronic access to results until a physician could discuss them. The American College of Radiology had supported the exception, urging HHS to codify rather than withdraw it, arguing that "such flexibility is generally useful for providers to have confidence in ethically sharing test results in accordance with their patients' timeframe and condition expectations." Without it, radiology groups have no clear regulatory safe harbor for patient-preference-based delays, and must instead rely on sub-regulatory guidance that lacks the force of law.

Two states have stepped into this gap. Texas Senate Bill 922, effective September 1, 2025, prohibits the electronic disclosure of "sensitive test results" to patients before the third day after finalization. Kentucky's KRS 333.152, enacted in 2022, imposes an identical 72-hour hold. Both statutes cover pathology or radiology reports with a reasonable likelihood of showing a finding of malignancy, as well as tests that could reveal genetic markers. Both laws were direct legislative responses to the Federal rule's immediate-release requirement, enacted after physicians testified about patients receiving cancer diagnoses via smartphone notification before any physician had reviewed the findings.

These state laws interact with the Federal rules through a narrow but important mechanism. The Federal information blocking definition excludes practices "required by law," and ONC has specified that this encompasses state statutes. A radiology group in Texas or Kentucky that withholds a qualifying report for 72 hours is complying with state law and should not be considered an information blocker during that window. However, the protection expires the moment the statutory period ends. After 72 hours, the Federal rule applies with full force and any continued delay must satisfy a separate Federal exception or risk liability.

This creates three critical compliance considerations for radiology groups. First, the state law safe harbor applies only to reports with a reasonable likelihood of showing malignancy, not to routine studies. A blanket embargo of all reports remains indefensible regardless of state. Second, the protection is time-limited; systems and workflows must release results automatically once the 72-hour window closes. Third, radiology groups that operate their own patient portals or share imaging technology with outside providers may unwittingly fall into a second regulatory category. The Federal rule treats such groups not only as “healthcare providers,” but also as a "health information network," and the penalty structure is dramatically different: providers face only Medicare disincentives (i.e., scoring reductions under MIPS or the Shared Savings Program), but health information networks can face civil monetary penalties of up to $1 million per violation imposed by the OIG. A radiology group offering RIS/PACS services to hospitals and imaging centers should particularly avoid the possibility of information blocking scrutiny it before a regulator comes knocking on its door. 

The practical takeaway is straightforward. Radiology groups should eliminate universal report embargoes, configure EHR systems to release routine results immediately, apply state-law holds only to the narrow categories those statutes cover, and document at the time of each individualized hold why a particular report qualifies. Groups should also train front-desk and medical records staff on how to respond to requests for medical records, since these employees are the ones whose responses most often trigger the patient complaints now flowing into ONC's portal.