Who owns your EHR data? Enforcement just arrived

The kill switch is real. Regulators had to address it by name, using that name. HHS’s Office for Civil Rights says plainly that a business associate blocking a covered entity’s access to the health information it holds “has engaged in an impermissible use under the Privacy Rule.” The example OCR reaches for is an EHR developer that “activates a ‘kill switch’ embedded in its software that renders the data inaccessible to its provider client” to resolve a payment dispute.

Agencies do not write guidance about things that never happen. The FAQ exists because vendors were using chart access as a bargaining chip in contract disputes.

That FAQ settled the ownership argument as far as the government is concerned. What it never had was teeth. Those arrived this year, and they change what a PT owner should tolerate from a current vendor and demand from the next one.

Who owns the data in your EHR?

Your practice does, in every way that matters against the vendor. Under HIPAA, an EHR vendor is a business associate: it stores patient records on your behalf, and those records do not become its property because they sit on its servers. The OCR guidance above is blunt about the consequences. When the contract ends, the vendor returns the records or keeps them accessible to you, and access cannot be held as collateral for a fee dispute.

So the real problem was never ownership. It is that possession beats ownership when the only copy of eight years of charts lives in someone else’s database. A vendor did not need to flip a kill switch to get its way; it just needed to be slow. Quote a steep export fee, deliver the data in an unusable format, drag the timeline past your go-live date. Until recently, nothing in the enforcement record made that a bad strategy.

What is the information blocking rule?

Congress banned information blocking in the 21st Century Cures Act back in 2016. The rule that grew out of it covers any practice likely to interfere with access, exchange, or use of electronic health information. HHS’s enforcement alert from September 2025 spells out who is exposed: health IT developers, health information networks, and providers. For developers, the Office of Inspector General can impose civil monetary penalties of up to $1 million per violation.

Then the paper tiger grew claws. ONC publishes a running tally of what lands in the federal portal: 2,450 possible claims of information blocking out of 2,563 submissions as of July 31, 2026. The penalty is not the only exposure either. The same enforcement alert says ONC “can ban a developer of certified health IT that information blocks from the ONC Health IT Certification Program and may also terminate the certification of health IT involved in information blocking.”

The rule runs both ways. A practice that blocks data faces Medicare payment disincentives in programs like MIPS rather than fines, per the same HHS alert. But for a 2-15 provider PT clinic squeezed by a stalling vendor, the position that matters is the one filing the complaint, not receiving it.

Can your vendor charge you for a data export?

Yes, within limits. The rule’s fees exception lets an actor recover reasonable, cost-based fees for fulfilling a request. What it does not permit is a fee designed to make you give up. Where that line sits is now a question a federal investigator can ask, and the vendor has to answer.

Fees are only half the stall. ONC’s EHR contract guide describes the other half in its chapter on switching. Absent a contractual obligation, an outgoing vendor may take the position that it can hand over “all historical records in a format that is inconvenient or impractical,” or deliver them “in multiple batches over a period of weeks or even months” while your new system waits. The same guide notes that “very few EHR vendors include any transition provisions in their standard form contracts.” That silence works for one side. A contract that says nothing about leaving makes leaving expensive.

What should you demand before signing the next contract?

ONC’s guide puts the selection principle in one sentence: “An EHR vendor’s willingness to agree to reasonable transition services should be a significant factor in your selection of an EHR.” In practice, that means four things go in writing before any demo charm wears off:

• A transition-services clause obligating the vendor to cooperate with your next system, whoever that is.
• Export in a standard, generally accepted format, with a stated deadline, not batches at the vendor’s convenience.
• Transition fees fixed or capped at signing, so you never negotiate the price of your own charts after announcing you are leaving.
• Continued read access to the old records after the contract ends, for audits, records requests, and the accounts receivable your biller will still be working.

The exit terms are a character test you get to run while the vendor still wants your signature. A vendor that squirms at the leaving question is telling you how every future dispute will go. It is also the stance behind how switching works at Orion. Your current EHR stays live and billing while you prove the new system on your own workflows, nothing migrates until you decide, and the exit stays clean at every checkpoint. A vendor confident you will stay has no reason to lock the door.

What if your vendor is stalling right now?

Put the export request in writing, name the format and the deadline, and keep the replies. Under the current enforcement posture, a vendor that delays needs its conduct to fit a regulatory exception, and a paper trail of vague answers fits none of them. If the stall continues, file at the Report Information Blocking Portal, which accepts anonymous complaints; nearly 1,600 are already in the queue ahead of yours.

And structurally, stop letting any single vendor be the only place your practice exists. Running a new system in parallel with the old one means there is never a moment when a vendor dispute can take your schedule and your charts down together. We ran the numbers on what an exit actually costs in the real cost of switching your PT EHR. The short version: the fees written into the contract are smaller than the risks left out of it.

The records were always yours. For the first time since Congress said so, the government is acting like it. Reread the transition clause in the contract you have, and make the next vendor sign one worth reading.