2027 Information Blocking: A Reading Guide for Healthcare Administration Students
Co-Founder and Chief Data Scientist
Healthcare administrators help decide how patient information moves between clinicians, patients, and technology systems. A policy meant to protect privacy can also create information-blocking risk if it unnecessarily delays access.
This guide explains the 2026 rules in plain language and shows healthcare administration students what to study, which careers use this knowledge, and when a bachelor's degree, specialized master's, or MBA makes sense. Use it to evaluate programs against the work you actually want to do - not just the degree title.
Key Things You Should Know
- Information blocking generally concerns practices by covered healthcare actors that are likely to interfere with access, exchange, or use of electronic health information; a delay is not automatically a violation.
- The rules cover healthcare providers, certified health IT developers, and health information networks or exchanges, but the applicable legal standard and consequences differ by actor.
- For students, the strongest preparation combines privacy law, health information governance, workflow design, and practical decision-making; an MBA alone does not establish compliance expertise.
What is information blocking in healthcare?
Under the 21st Century Cures Act and federal regulations, information blocking is a practice by a covered actor that is likely to interfere with the access, exchange, or use of electronic health information (EHI), unless a legal requirement or regulatory exception applies. EHI is generally electronic protected health information in a designated record set, regardless of whether the organization uses certified health IT to store it. Certain information, including psychotherapy notes, is excluded from this regulatory definition.
The rule is not simply a requirement to send every record immediately. The facts matter: why access was limited, whether an exception's conditions were met, and what the actor knew. For example, a blanket policy withholding test results until a clinician calls the patient deserves scrutiny; a carefully justified restriction to prevent a qualifying risk of harm may be permitted.
Students new to healthcare operations can build a foundation in records management and patient access through accelerated bachelor's study in health services administration. A degree provides context, not a determination that a particular records policy is lawful.
Who must comply with information-blocking regulations?
The federal rules identify three categories of "actors": healthcare providers, developers of certified health IT, and health information networks or health information exchanges. Providers include more than hospitals and physicians; the regulatory definition covers a range of practitioners and healthcare organizations. Patients can request their own information, but they are not information-blocking actors merely because they make a request.
The distinction matters because the knowledge standards and enforcement mechanisms differ. For developers and networks or exchanges, the standard concerns whether they knew or should have known a practice was likely to interfere. For providers, it concerns whether they knew the practice was unreasonable and likely to interfere. Federal enforcement can involve civil monetary penalties for developers and networks or exchanges; specified federal program disincentives apply to certain providers. Those consequences should not be treated as interchangeable.
If you are comparing institutionally accredited colleges with online healthcare administration degrees, look for coursework that distinguishes a hospital's duties from those of its software vendor. Institutional accreditation speaks to the college, not to whether its graduates or an employer's systems comply with this rule.
What are the information-blocking exceptions?
Regulatory exceptions recognize that access sometimes must be limited or handled in a particular way. They have detailed conditions; naming an exception after the fact does not establish that it applies. Students should learn to read both the exception and the documentation supporting a decision.
Exceptions address preventing harm, privacy, security, infeasibility, and health IT performance. Other exceptions govern the content and manner of a response, certain fees, and licensing of interoperability technology; a TEFCA-related manner exception addresses specified exchange circumstances. In practice, a privacy review should identify the particular legal basis for withholding information, rather than assume that "HIPAA" justifies every delay. A system outage, likewise, calls for facts about the outage and the response - not an automatic infeasibility claim.
Graduate students comparing online MHA degree options and CAHME program accreditation should ask whether assignments require them to apply these conditions to realistic release-of-information cases. Accreditation alone does not confirm that a course covers every exception.
Administrators may help redesign records-release workflows, set escalation procedures, train staff, evaluate vendor contracts, or review complaints about delayed access. The most useful skill is not memorizing an exception list: it is tracing a request from intake to response, identifying who made each decision, and documenting the reason for a restriction.
Someone moving from scheduling or patient services already understands operational bottlenecks but may need formal grounding in HIPAA, EHI, and electronic health record systems. An experienced compliance analyst may instead need leadership and change-management skills to coordinate clinical, legal, and IT teams. Neither path requires assuming that a new degree alone will qualify the applicant for a senior role.
Career changers considering healthcare administration master's entry without industry experience should examine whether a program offers applied projects or employer connections that help close their specific experience gap.
Programs differ, and a course labeled "health informatics" is not proof of substantial information-blocking coverage. Relevant instruction may appear across health law, privacy and security, quality improvement, electronic records, operations, and organizational leadership. A useful case study asks students to reconcile patient access with clinical safety, technical constraints, and a defensible audit trail.
When reviewing a syllabus, look for work that moves beyond definitions. Can students map an EHI request, identify the responsible actor, evaluate a possible exception, and explain a decision to both a patient and an IT team? That combination more closely resembles administrative practice than a regulation quiz.
Speed is a separate consideration. If you are considering graduate healthcare administration study on a 12-month timetable, check whether the compressed sequence still leaves room for a substantive informatics or compliance project.
There is no universal US license to work as a healthcare administrator or to help manage information-blocking compliance. Requirements depend on the job and jurisdiction. Nursing home administrators, for example, generally face state licensure requirements; that is a different occupation from a hospital compliance analyst or health information manager.
Employers may value credentials in health information management, privacy, compliance, or healthcare quality, but a voluntary certification is not a federal information-blocking license. Review actual job postings before paying for one: some roles emphasize a credential, while others prioritize experience with records workflows, audits, or EHR systems.
A doctorate is also not a compliance license. Even readers considering healthcare administration doctorate completion timelines should first decide whether their target work calls for advanced research or executive preparation rather than more directly applicable experience.
Choose a degree by the gap between your current skills and the role you want. The comparison below describes typical educational emphasis, not a guarantee about any particular school's curriculum or hiring outcomes.
| Path | Potential fit | Main limitation for information-blocking work |
| Bachelor's in healthcare administration or health information management | Building a foundation for operations, records, or compliance-support roles | May not provide advanced regulatory analysis or leadership experience |
| Master of health administration (MHA) | Developing healthcare-specific management and systems knowledge | Depth in privacy and informatics varies by program |
| MBA with healthcare coursework | Adding finance, operations, and change leadership to existing healthcare experience | A general management core is not a substitute for health-law or records expertise |
| Specialized health informatics or health information graduate study | Deepening expertise in data governance and information systems | May offer less broad organizational management training |
For a student targeting a dedicated compliance or information-governance position, relevant coursework and supervised experience may matter more than whether the degree carries an MBA label. Compare total tuition and fees with the scope of training; affordable MHA and healthcare administration master's options provide a starting point, but verify current prices and required credits directly with each school.
First verify the institution's recognized accreditation and that the specific degree is available in the advertised online format. Then examine the curriculum rather than assuming that institutional accreditation, business-school accreditation, and healthcare-management program accreditation mean the same thing. CAHME, for example, accredits qualifying healthcare management graduate programs; it does not accredit every bachelor's program or certify individual compliance specialists.
Before enrolling, ask for a current course sequence and sample descriptions of health law, informatics, privacy, and applied projects. Confirm whether classes are live or asynchronous, whether placements or campus visits are required, and what the full tuition-and-fee obligation will be at your intended pace. Ask career services which employers recruit online students and what support is available for students seeking their first healthcare role.
For an undergraduate comparison, affordable online healthcare administration degrees can narrow the price search. A lower advertised tuition figure is useful only after checking fees, transfer-credit rules, and whether the curriculum addresses your career goal.
Job titles vary by employer. Release-of-information specialists process and track requests; health information management staff oversee record integrity and disclosure procedures; privacy or compliance analysts review policies and incidents; informatics managers coordinate how systems support clinical and administrative workflows. Senior governance leaders may set organization-wide priorities, but those roles typically require substantial operational experience.
For an entry-level applicant, records operations or compliance support can provide direct exposure to request handling. For a clinician or experienced administrator, a move into informatics leadership may instead require stronger systems, vendor-management, and cross-team communication skills. Read postings for the actual duties: "compliance" can refer to billing, privacy, quality, or several functions at once.
Experienced leaders considering comparing online accelerated doctoral routes for healthcare leaders should treat doctoral study as a separate leadership or research decision, not the normal entry route into health information governance.
What salary and job outlook can healthcare administration graduates expect?
There is no single salary for an information-blocking specialist or a healthcare administration graduate. Pay depends on the occupation, employer, location, experience, and level of responsibility. As broad context, the US Bureau of Labor Statistics reports a May 2025 median annual wage of $126,520 for all management occupations. That figure includes managers across industries; it is not an expected starting salary for a healthcare administration graduate or a measure of the value added by a degree.
BLS projects management occupations overall to grow faster than the average for all occupations from 2025 to 2035. That broad outlook should not replace research into local postings for records, privacy, informatics, and healthcare management roles. Compare the qualifications and pay ranges attached to jobs you could realistically pursue next - not only to executive titles you may pursue later.
If speed is part of your education decision, planning an accelerated master's in healthcare management should include a cost and workload check. A shorter timetable can reduce time in school, but it does not establish a salary increase or substitute for relevant experience.
Other Things You Should Know About Healthcare Administration
Yes. Patients can submit a report through the federal information-blocking reporting process. Keep dates, request details, responses, and any stated reason for a delay; a report does not itself establish that a violation occurred.
No. Access to EHI and amendment of a record are different issues. Patients can use applicable record-amendment procedures, including rights under HIPAA, to request a correction.
It depends on whether the electronic information falls within the regulatory definition of EHI and who holds it. A research label alone does not answer that question; review the record's status and applicable privacy rules.
Read current federal rule text and agency guidance, then test what you learn against a concrete request scenario. Rules, enforcement policies, and health IT standards can change after a course or textbook is published.
- 45 CFR Part 171 -- Information Blocking | ecfr.gov https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-171
- Information Blocking - ONC https://healthit.gov/information-blocking/
- Summary of the HIPAA Privacy Rule | hhs.gov https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
- Patient-led data sharing for clinical bioinformatics research | nih.gov https://pmc.ncbi.nlm.nih.gov/articles/PMC8449625/
- 21st Century Cures Interoperability & Information Blocking Rules FAQs | LeadingAge https://leadingage.org/21st-century-cures-interoperability-information-blocking-rules-faqs/
- New Information Blocking Rules | ACS https://www.facs.org/advocacy/regulatory-issues/digital-health/new-information-blocking-rules/
