Quick answer
SNFs and nursing facilities can be information-blocking actors regardless of whether their EHR is certified. Route each request through EHI scope, permissible disclosure and actual interference analysis. Document the facts and conditions of any claimed exception; “security,” “policy” or “our vendor cannot” is not a complete determination.
Keep the provider and product questions separate
A SNF receives a request to send electronic records to another provider. Staff believe information-blocking rules apply only to vendors of certified EHRs. ONC's actor guidance expressly includes skilled nursing and nursing facilities in the healthcare-provider definition. Certification status is a separate question.
Under 45 CFR 171.103, the healthcare-provider standard concerns a practice the provider knows is unreasonable and likely to interfere with access, exchange or use of EHI, except as required by law or covered by an applicable exception. A request queue should preserve facts needed for that assessment rather than automatically equating every delay with a violation or every policy with an exception.
Route the request through four decisions
First identify the requester, resident, purpose, requested information and means of exchange. Second determine legal authority, permissions and restrictions. Third identify the information and systems in scope. Fourth assess the proposed response, any interference and the conditions of a relevant exception.
45 CFR 171.102 defines EHI by reference to electronic protected health information that would be in a designated record set, with specified exclusions. Do not limit the search to a convenient summary document or assume that every internal electronic file is EHI.
An original triage record can include:
| Decision | Evidence to retain | Common incomplete answer |
|---|---|---|
| Request and authority | Actual request, identity and applicable disclosure basis | “Another provider asked” |
| Information scope | Systems, objects, date range and reviewed exclusions | “Everything is in the portal” |
| Delivery capability | Available methods, format and dependencies | “Vendor limitation” without investigation |
| Interference or restriction | Specific practice, reason, alternatives and reviewer | “Our policy says no” |
| Resolution | Information supplied, timing, remaining issue and communication | Ticket closed without a usable result |
Examine a security restriction on its facts
Suppose a requester proposes a transfer method the facility believes exposes EHI. The security exception in 171.203 requires a practice directly related to safeguarding EHI, tailored to the specific risk and implemented consistently and without discrimination. It also requires the applicable written-policy or particularized-determination conditions.
The reviewer should identify the actual risk and less-interfering alternatives where relevant. In a synthetic test, the facility declines one insecure transfer path but can provide the requested information through an available appropriate path. The case should show the proposed alternative and follow-through, not stop at “security denied.” Whether the exception's full conditions are met requires qualified review.
Test barriers inside the organization
Evaluate requests spanning current records, billing and an archive. Check whether staff can escalate a missing format, excessive internal approval loop or supplier dependency. Record when a request was received and what caused delay. A maximum time permitted under another rule should not be assumed to settle every information-blocking question.
Use a request from a resident, another treating provider and an authorized third party, with differing facts. Confirm that privacy restrictions such as Part 2 receive appropriate handling. The output should be a reasoned decision and a usable response, not a generic instruction to release everything immediately.
Buy visibility into the response
Ask suppliers which export and exchange methods are supported, what information they cover, how limitations are documented and how requests involving unavailable functionality are escalated. Preserve the facility's decisions separately from supplier status messages.
The procurement result is a practical response process that joins legal review to technical capability. It helps the operator recognize and resolve unnecessary barriers while respecting applicable privacy and security conditions.
Questions & answers
Does using uncertified software exclude a SNF from actor status?
No. Healthcare-provider actor status is separate from whether the provider uses certified health IT.
Does information blocking require disclosure prohibited by privacy law?
No. Determine the lawful disclosure basis and applicable restrictions. The information-blocking analysis does not erase privacy requirements.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.