Can an IT company withhold access to patient data over an unpaid bill or contract dispute?

No. Even if an IT provider is mid-contract or unpaid, it must still honor lawful access requests under the 21st Century Cures Act. Withholding access due to payment disputes or transition timing is unacceptable under HHS's enforcement stance.

How do I report suspected data blocking?

HHS urges patients and providers to report suspected data blocking through ASTP/ONC's reporting portal.

HHS Cracks Down on Data Blocking: What This Means for Dental Practices and Cloud PMS Providers

Q: What is information blocking?

Information blocking is when healthcare providers, IT developers, or health networks restrict the access, exchange, or use of electronic health information (EHI). HHS has instructed agencies to ramp up enforcement against it.

Q: Can a cloud PMS provider refuse to export my practice's data if I switch systems?

No. Cloud-based PMS providers cannot obstruct your right to retrieve e-PHI if you decide to switch systems. They are legally obligated to facilitate seamless data export, whether you're moving to a new software vendor or transitioning IT management.

Q: What are the penalties for information blocking?

HHS, ASTP/ONC, and the HHS Office of Inspector General (OIG) will pursue penalties for noncompliance, including civil monetary fines of up to $1 million per violation for certified health IT developers.

As recently announced, HHS Secretary Robert F. Kennedy, Jr. has instructed agencies to ramp up enforcement against information blocking—when healthcare providers, IT developers, or health networks restrict the access, exchange, or use of electronic health information (EHI). (HHS.gov · Fierce Healthcare · The HIPAA Journal)

01Patients must be able to access and transfer their e‑PHI

Direct answerCloud-based PMS providers cannot obstruct your right to retrieve e‑PHI if you decide to switch systems. They are legally obligated to facilitate seamless data export, whether you're moving to a new software vendor or transitioning IT management.

This enforcement underscores that cloud-based PMS providers cannot obstruct your right to retrieve e‑PHI if you decide to switch systems. These providers are legally obligated to facilitate seamless data export—whether you're moving to a new software vendor or transitioning IT management.

02IT companies can no longer withhold access over billing or timing

Direct answerNo. Even if an IT provider is mid-contract or unpaid, it must still honor lawful access requests under the 21st Century Cures Act. HHS, ASTP/ONC, and the HHS Office of Inspector General will pursue penalties for noncompliance, including civil monetary fines of up to $1 million per violation for certified health IT developers.

$1M

Maximum civil monetary fine per violation

For certified health IT developers found to be information blocking

HHS's renewed enforcement stance makes it clear: withholding access due to payment disputes or transition timing is unacceptable. Even if an IT provider is mid-contract or unpaid, they must still honor lawful access requests under the 21st Century Cures Act. HHS and the Office for the National Coordinator (ASTP/ONC), along with the HHS Office of Inspector General (OIG), will pursue penalties for noncompliance—including civil monetary fines up to $1 million per violation for certified health IT developers. (Fierce Healthcare · The HIPAA Journal · Nextgov/FCW)

03Why this matters to dental practices

Vendor switching should be smooth

Many dental practices use cloud-based PMS systems that store e‑PHI. If a vendor tries to delay or block data exports—especially under billing or operational pretenses—that may now violate HHS rules.

No lock-in tactics allowed

Any attempts to restrict data as leverage—whether technical or contractual—could expose vendors to significant regulatory risk.

Proactive reporting encouragedHHS urges patients and providers alike to report suspected data blocking through ASTP/ONC's reporting portal. (The HIPAA Journal · HealthIT.gov)

04Additional context: regulatory momentum building

In December 2024, HHS finalized the "Protecting Care Access Exception", clarifying when withholding data is permissible—particularly in sensitive-care situations like reproductive health. (The HIPAA Journal · American Hospital Association)
The Cures Act and subsequent rulemaking have long positioned interoperability and patient access as cornerstones of digital health modernization, but recent enforcement makes compliance non-negotiable. (Federal Register · The HIPAA Journal · Ropes & Gray)

05What Darkhorse Tech recommends for your practice

A
Evaluate your cloud PMS and agreementsEnsure your PMS vendor contract explicitly supports data portability upon termination or migration. Ask: How quickly can you receive your full e‑PHI export if you leave?
B
Include IT transition safeguardsWork with IT providers to build transition clauses ensuring access continuity, even amid invoicing or staffing changes. Make data handoff and password sharing a standard exit process.
C
Stay alert for vendor-induced frictionWatch for delayed file exports, obstructive technical support, and hidden fees for data exports. If encountering resistance, you may have legal recourse under the new HHS enforcement framework.
D
Partner with Darkhorse Tech for secure, compliant transitionsWe're well-versed in drafting contracts that safeguard your rights to access and transfer e‑PHI, orchestrating seamless vendor transitions (including cloud PMS or IT partners), and educating staff and leadership on compliance best practices.

Switching PMS vendors or IT providers?

We'll make sure your contracts protect your right to your data and handle the transition so nothing gets held up.

Schedule a Consultation

The bottom line

The HHS crackdown on information blocking isn't just regulatory—it's transformative for how healthcare data is handled. For dental practices, especially those using cloud PMS systems and external IT vendors, it's a green light to demand transparency, portability, and compliance.

Don't let data hold your practice hostage—reach out to Darkhorse Tech to ensure your systems, contracts, and vendor relationships put your practice—and your patients—first.