Since December 31, 2023, developers of certified EHRs have had to give customers a way to export all of a single patient's electronic health information, and the whole patient population's, in a computable format. If you are planning a move, that export is the first thing to test, not the last.
What counts as EHI
Federal information blocking rules define electronic health information, or EHI, in 45 CFR 171.102. It means electronic protected health information to the extent it would be included in a designated record set.
The definition leaves out 2 categories: psychotherapy notes, and information compiled in reasonable anticipation of a civil, criminal or administrative proceeding.
The export your vendor owes
Certification criterion 170.315(b)(10) has 2 parts. A single-patient export must be available whenever the user chooses, without the developer's help. A population export must cover all EHI the product can store at the time of certification.
Both exports must be electronic and in a computable format, and each must include a public link to documentation of the format. The practice can limit who is allowed to run a single-patient export, and the developer must keep the format documentation up to date.
Ask your current vendor where that documentation is published, and send the link to your new vendor before you sign. It tells both sides what the data will look like on arrival.
ONC's 2023 guide notes that the population export can involve developer support. It also says the criterion places no regulatory requirements on clinicians; the duty sits with developers.
The October 2026 final rule kept the requirement that developers provide this certified export to all their customers. If your current product is not certified, your contract is what governs your exit, so read it now.
Your patients' rights continue
A migration does not pause the HIPAA right of access. Under 45 CFR 164.524, you must act on a request no later than 30 days after receiving it.
You may take one extension of up to 30 more days, but only if you tell the patient in writing, within the first 30 days, why you need it and when you will finish.
If the record is kept electronically and the patient asks for an electronic copy, you must provide it in the form and format they request if it is readily producible. Any fee must be reasonable and cost-based.
Patients can also direct you, in a signed written request, to send a copy to another person they name. Expect some of those requests during a move, and handle them on the same clock as any other.
Information blocking cuts both ways
Under 45 CFR 171.103, information blocking is a practice likely to interfere with access, exchange or use of EHI, unless required by law or covered by an exception.
The knowledge standard differs by who is involved. A developer of certified health IT is covered if it knows, or should know, that a practice is likely to interfere. A health care provider is covered if it knows the practice is unreasonable.
Providers are not exempt. HHS issued a final rule in 2024 setting disincentives for providers found by the HHS Office of Inspector General to have committed information blocking. If an export stalls, or a patient request gets caught in the move, talk to your compliance advisor.
A migration checklist
- Run a test export from your current system early, and read the format documentation
- List what must arrive as structured data, such as problems, medications, allergies and vitals, and what can move as documents
- Pick a cut-over date and freeze template changes in the old system
- Keep read-only access to the old system for as long as your record retention policy requires
- After import, spot-check at least 20 charts against the source, including signed notes and addenda
- Confirm how you will retrieve old audit logs if you ever need them
- Keep a log of patient record requests received during the move
Confirm your record retention obligations with your compliance advisor before you shut anything off.
EMR MD writes every chart export to its audit log, so the export side of your records stays traceable after you settle in.
Sources
- 45 CFR 171.102: Definitions (information blocking) Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 171.103: Information blocking Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 170.315: 2015 Edition health IT certification criteria Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 164.524: Access of individuals to protected health information Electronic Code of Federal Regulations (eCFR), 2026
- Getting Ready for EHI Export: A Quick Guide HealthIT.gov (ONC), 2023
- Information Blocking HealthIT.gov (ONC), 2026
- Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity (final rule, 91 FR 67916) Federal Register via GovInfo, 2026
This article is general information, not legal or medical advice. Rules change; check the source and your compliance advisor before acting.