Short answer: Not a guarantee that any particular app will connect, but real protections apply. HIPAA gives you a right to copies of most of your records, and the Cures Act information blocking rules (45 CFR Part 171, in force since April 5, 2021) generally prohibit providers and certified health IT developers from practices likely to interfere with your access, including through apps, unless the law requires it or an exception applies. HHS enforces those rules. If records are withheld, ask in writing, then report through HealthIT.gov.
Three sets of federal rules work together when you ask for your records in an app. First, the HIPAA right of access (45 CFR 164.524) gives you the right to inspect and get a copy of most of your health information held by a HIPAA-covered provider or health plan, in the electronic form and format you ask for if it is readily producible, and to have a copy sent to a person you designate in a signed written request. Since a 2020 federal court ruling (Ciox Health v. Azar), that third-party request applies to electronic copies of records in your electronic health record.
Second, the 21st Century Cures Act, signed on December 13, 2016 (Public Law 114-255). Section 4004 of the Act added section 3022 to the Public Health Service Act (42 U.S.C. 300jj-52), which defines 'information blocking' in part as a practice that, except as required by law or specified by HHS through rulemaking, is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information. The definition also has a knowledge element, described below.
Third, the HHS rule that carries this out, the ONC Cures Act Final Rule published in the Federal Register on May 1, 2020 (85 FR 25642), created 45 CFR Part 171. After a COVID-19 extension published on November 4, 2020 (85 FR 70064), Part 171 says health care providers, developers of certified health IT, and health information networks and exchanges are subject to it on and after April 5, 2021 (45 CFR 171.101). The same 2020 rule also requires electronic health record software certified to the federal standardized-API criterion (45 CFR 170.315(g)(10)) to include a patient-access API that apps can use.
These rules limit what providers and health IT companies may do, and HHS enforces them. They do not give you a right to sue, and they do not guarantee that a particular app will connect to a particular provider. The rules cited on this page are the current text on eCFR as checked on October 25, 2026.
Part 171 applies to 'actors' in three categories: health care providers; health IT developers of certified health IT (companies that develop or offer the certified electronic health record software your provider uses); and health information networks or exchanges, which the rule defines together (45 CFR 171.101 and 171.102).
The knowledge test differs by actor. A developer, network or exchange commits information blocking if it knows, or should know, that a practice is likely to interfere with access, exchange or use. A health care provider commits information blocking only if it knows that the practice is unreasonable and is likely to interfere (45 CFR 171.103). 'Interfere' means to prevent, materially discourage, or otherwise inhibit (45 CFR 171.102).
The rules cover 'electronic health information' (EHI): electronic protected health information to the extent it would be in a HIPAA designated record set, whether or not the holder is a HIPAA covered entity. Psychotherapy notes, and information compiled in reasonable anticipation of, or for use in, a civil, criminal or administrative action or proceeding, are excluded (45 CFR 171.102).
Consumer apps you choose are generally not among the actors the rules list. The rules govern how your provider and its health IT respond to your request; they are not the rules that govern what an app does with your copy afterward. For that side, see is it safe to connect third-party apps to MyChart.
Electronic health record software certified to the standardized-API criterion must offer a patient-access API, but the obligation binds the software developer; whether your provider has turned it on, and for which apps, varies (see which patient portals let you connect a health app). The Office of the National Coordinator for Health Information Technology (ONC), the HHS office that runs HealthIT.gov, has published examples of how the information blocking rules treat this route. These are HHS guidance and examples of practices that could be information blocking, not binding findings; each case is judged on its facts.
Security vetting of the app you picked. In an FAQ last updated September 12, 2025 (IB.FAQ51.1.2023MAY), HHS says that because certified patient-access APIs carry built-in security requirements and focus on read-only responses to patient-directed requests, there would generally not be a need to 'vet' the security of a third-party app chosen by a patient to receive their EHI from API technology certified to the standardized-API criterion, and such vetting would likely be an interference. The FAQ covers that certified API only. It also notes that providers can vet app developers that would be their HIPAA business associates.
Delay. In an FAQ last updated September 12, 2025 (IB.FAQ22.1.2021MAR), HHS lists a delay in providing a patient's EHI via an API to an app the patient has authorized as an example that would likely be an interference. A delay that is necessary, for example to make sure a release complies with state law, is unlikely to be an interference as long as it is no longer than necessary. An organizational policy that holds lab results for any period so a clinician can review them first would likely be an interference.
Other examples. HHS's October 2024 fact sheet 'Information Blocking Reminders Related to API Technology' lists a non-exhaustive selection of practices that could implicate the information blocking definition, several drawn from the 2019 proposed rule. They include: a provider choosing not to enable patients to send their EHI directly to a third party when its EHR's patient portal offers that capability; a provider that can give same-day access but takes several days; demanding a HIPAA business associate agreement when HIPAA does not require one; and refusing to register an app that lets a patient access their EHI, which HHS calls highly suspect in the patient-access context.
Fees. Under the fees exception (45 CFR 171.302(b)(2)), a fee based in any part on electronic access to your EHI by you, your personal representative, or someone you designate is not covered by the exception. 'Electronic access' there means an internet-based method that makes the information available at the time it is requested with no manual effort. A fee outside the exception is not automatically information blocking; it is judged on the facts.
A practice is not information blocking if it is required by law or meets all the applicable conditions of an exception in 45 CFR Part 171. HHS also says that failing to meet an exception does not automatically make something information blocking; each case is judged on its facts (HealthIT.gov information blocking overview; FAQ IB.FAQ46.1.2022FEB). The table summarizes the main exceptions as they apply to a patient's own request. Each has more conditions than fit in a table; follow the citation for the full text.
| Reason a provider may give | What the rule requires (summary) | Rule |
|---|---|---|
| Preventing harm | A reasonable belief the practice will substantially reduce a risk of harm, no broader than necessary. For your own records, the harm must be one that would justify a HIPAA denial: access reasonably likely to endanger the life or physical safety of you or another person. Where it rests on a licensed professional's individualized judgment, the provider must honor your right to have it reviewed to qualify. HHS says holding results for clinician review does not qualify. | 45 CFR 171.201; 164.524(a)(3)(i) |
| Privacy | For example: a legal precondition (such as a required consent) has not been met; the information falls within HIPAA's unreviewable denial grounds; or you yourself asked the provider not to share. | 45 CFR 171.202; 164.524(a)(1)-(2) |
| Security | Directly related to safeguarding the information, tailored to the specific risk, and applied consistently and without discrimination. | 45 CFR 171.203 |
| Infeasibility | For example: a disaster or outage, or records that cannot be cleanly separated from information that may lawfully be withheld. To rely on this exception, the provider must give the requester the reason in writing within ten business days of receiving the request. | 45 CFR 171.204 |
| Health IT performance | Temporary downtime for maintenance, or action against an app that is degrading the system, no longer than necessary and applied consistently. | 45 CFR 171.205 |
| Protecting care access | Limited withholding tied to reproductive health care and a good-faith belief about risk of legal action. When done to protect the patient, the patient can override it by explicit request. | 45 CFR 171.206 |
| Manner | Fulfill the request in the manner asked, unless technically unable or unable to reach agreeable terms; then offer alternatives in a set order, starting with certified technology the requester specifies. | 45 CFR 171.301 |
| Not EHI at all | Psychotherapy notes, and information compiled in reasonable anticipation of, or for use in, a legal action or proceeding, are outside the definition. | 45 CFR 171.102 |
1. Ask the provider directly, and do it in writing so you have a record. Say what you want (for example, your lab results or a full copy of your record), how you want it (for example, through the app you chose, or an electronic copy), and keep a dated copy. If an app connection is the problem, check the basics first: Epic's MyChart help says the organization might not have turned on support for that app, or the name you searched might not match exactly. Under HIPAA, a provider must act on an access request no later than 30 days after receiving it, with at most one 30-day extension that requires a written explanation and a completion date (45 CFR 164.524(b)(2)). That is an outer limit: under the information blocking rules, HHS has said shorter delays can still be an interference when faster access is possible.
2. Ask for the reason in writing. A provider relying on the infeasibility exception must give the reason in writing within ten business days (45 CFR 171.204(b)). If a provider denies a HIPAA access request, the written denial must give the basis, any review rights, and how to complain to the provider and to HHS (45 CFR 164.524(d)(2)).
3. Report possible information blocking to HHS. HealthIT.gov's Information Blocking Portal is the route HHS calls preferred in its September 4, 2025 enforcement alert, which also says you do not need health care or IT expertise to file and may file anonymously. HealthIT.gov says that, by law, information that could identify who submitted a claim is exempt from mandatory disclosure under the Freedom of Information Act, and that someone you choose can file on your behalf. HHS's October 2024 API fact sheet says every claim of potential information blocking is shared with the HHS Office of Inspector General (OIG) without first assessing its merits. Reports can also go to the OIG Hotline online or at 1-800-HHS-TIPS (1-800-447-8477).
4. If a provider denies, ignores or delays your HIPAA access request, or overcharges for a copy, you can also file a HIPAA complaint with HHS under 45 CFR 160.306. It must be filed within 180 days of when you knew or should have known of the problem, unless HHS waives that limit for good cause. For a step-by-step request letter, see how to get records from a provider not on MyChart.
What happens next is up to HHS. OIG can investigate claims against any type of actor. As the September 4, 2025 enforcement alert describes, the statute (42 U.S.C. 300jj-52) lets OIG impose civil money penalties of up to $1 million per violation on certified health IT developers, entities offering certified health IT, and health information networks and exchanges, and ONC can ban a developer from its certification program or terminate certification. For health care providers, a final rule published July 1, 2024 (89 FR 54662) lets CMS apply disincentives after an OIG finding to hospitals and critical access hospitals, MIPS eligible clinicians, and Medicare Shared Savings Program ACOs and their participants (45 CFR 171.1001); providers outside those programs are not currently subject to a federal information blocking disincentive. Filing a claim is a report to regulators, not a lawsuit, and it does not by itself get your records released.
When you connect MyChart to an app, the app sends you to your health system's own MyChart sign-in page, you approve what the app may read, and your health system then lets the app read those parts of your record. This uses the HL7 SMART App Launch framework over the HL7 FHIR standard. The step-by-step version for one app is in connect Epic MyChart to PatientPower.
Your health system may warn that the app may not be covered by HIPAA. That warning is about what protects your copy after it reaches the app. For apps that receive records through a certified patient-access API, HHS's FAQ above says a provider generally should not require security vetting of an app you choose; whether the app deserves your trust is your call, and is it safe to connect third-party apps to MyChart walks through what to check.
PatientPower (beyondmychart.com) is a personal health record app whose Epic MyChart connection is live and was approved for use on 16 September 2026. That approval is not an Epic endorsement; PatientPower is independent and not affiliated with Epic. PatientPower only reads the records you approve and never changes anything in MyChart.
Records you connect may be incomplete, delayed or contain errors, so verify important details with your care team. PatientPower is for education and organization; it does not diagnose conditions and is not medical advice. This page explains federal rules in plain language; it is not legal advice.
On December 29, 2025, HHS published a proposed rule (90 FR 60970) that, in its own words, seeks to address reported misuse and abuse of information blocking definitions and exceptions, among other deregulatory changes. It proposes changes to conditions of two exceptions summarized above, infeasibility (45 CFR 171.204) and manner (45 CFR 171.301), and would also remove subpart D, which holds the TEFCA manner exception (45 CFR 171.403). Comments closed February 27, 2026. A proposed rule does not change the law until a final rule is published and takes effect. The text cited on this page is the current eCFR text as checked on October 25, 2026; check the eCFR link below for any later change.
Related: Connect your Epic MyChart records to PatientPower · Is it safe to connect third-party apps to MyChart? · Which patient portals let you connect a health app? · How to get records from a provider not on MyChart · How to download your MyChart records.
Not a guarantee that any particular app will connect, but real protections apply. HIPAA gives you a right to copies of most of your records, and the Cures Act information blocking rules (45 CFR Part 171) generally prohibit providers and certified health IT developers from practices likely to interfere with your access, including through apps, unless the law requires it or an exception applies. HHS enforces those rules; they do not give you a right to sue.
Under 45 CFR 171.103, it is a practice by a health care provider, certified health IT developer, or health information network or exchange that is likely to interfere with access, exchange or use of electronic health information, except as required by law or covered by an exception. For providers, it also requires that the provider knows the practice is unreasonable.
For an app you choose that receives your records through API technology certified to the federal standardized-API criterion, HHS guidance (FAQ IB.FAQ51.1.2023MAY) says there would generally not be a need to vet the app's security, and such vetting would likely be an interference. Other exceptions, such as preventing harm or an unmet legal precondition, can still apply in specific cases.
HHS's FAQ IB.FAQ22.1.2021MAR says an organizational policy that delays the release of lab results for any period so a clinician can review them first would likely be an interference. A delay that is necessary, such as to comply with state law, is unlikely to be one if it lasts no longer than necessary.
Ask the provider in writing first and ask for any refusal reason in writing. Then file through the Information Blocking Portal on HealthIT.gov, which HHS calls the preferred route. You can file anonymously, someone you choose can file for you, and claims are shared with the HHS Office of Inspector General.
The information blocking fees exception does not cover a fee based in any part on electronic access to your information by you or someone you designate (45 CFR 171.302(b)(2)). A fee outside the exception is not automatically information blocking; HHS judges it on the facts.
Consumer apps you choose are generally not among the actors listed. Part 171 applies to health care providers, certified health IT developers, and health information networks or exchanges. What an app does with your copy is generally governed by its privacy policy and consumer-protection law.
HHS proposed changes to the information blocking definitions and exceptions on December 29, 2025 (90 FR 60970). A proposed rule does not change the law until a final rule is published and takes effect. This page cites the current eCFR text as checked on October 25, 2026.