Cures Act and information blocking for health apps
What the 21st Century Cures Act and ONC's information blocking rule mean for a health app: certified FHIR APIs, USCDI, who the rules cover and what you still have to do.
The 21st Century Cures Act and ONC's rules built on it give patients the right to get their electronic health information through any app, without special effort: certified EHRs must expose standard FHIR APIs, and providers, health IT developers and health information networks must not block access without a listed exception. For a health app this means you can build on standard APIs instead of private deals, as long as the patient authorizes the access.
The rules in one table
Piece
What it does
For an app developer
21st Century Cures Act (2016)
Law that bans information blocking and requires APIs "without special effort"
The legal basis for patient-directed access
ONC Cures Act Final Rule (2020)
Defines information blocking (45 CFR Part 171) and the certified API criterion
Sets which APIs EHRs must offer
Certified API, § 170.315(g)(10)
FHIR R4 with US Core, SMART App Launch and Bulk FHIR in every certified EHR
A predictable API across EHR vendors
USCDI
The minimum data set those APIs must expose (USCDI v3 for certified EHRs from 2026)
What data you can expect
Information blocking exceptions
Narrow cases where withholding is allowed (privacy, security, infeasibility, preventing harm and others)
Why a request can still be refused
Who is covered
Information blocking rules apply to actors: health care providers, health IT developers of certified health IT, and health information networks or exchanges. A consumer app is usually not an actor, but it benefits from the rules: an actor that refuses a patient-authorized app without a valid exception can face penalties (civil monetary penalties for developers and networks; disincentives for providers).
What you can rely on
A standard FHIR API. Certified EHRs expose US Core resources (conditions, medications, allergies, lab results, vital signs, immunizations, clinical notes and more) behind SMART App Launch. See SMART on FHIR with Epic and Oracle Health.
Patient choice. The patient can direct their data to the app they choose. Providers may warn patients about an app's privacy practices but should not block it for that reason alone.
No special fees for patient access through these APIs.
What you still have to do
Register your app with each EHR vendor or health system, as their program requires.
Get the patient's authorization with OAuth 2.0, keep tokens safe and stop when access is revoked.
Publish a clear privacy policy. Patients and providers will read it; regulators (the FTC for consumer apps) enforce it.
Plan for exceptions. A request can be refused when, for example, it is technically infeasible or a security risk; handle these cases in your interface.
Where Anpheros fits
Anpheros Platform gives your app one FHIR R4 record per person, so the data a patient pulls from different providers' APIs ends up in one place, with provenance (which system, which author) on every write and an access log. Other apps and clinicians read it only with the person's consent, by scope and for a set time.
Anpheros is hosted in the EU. A US data region and a HIPAA business associate agreement (BAA) are available on request for production customers; production for US patient data starts only after the BAA is signed. Start on the free sandbox with synthetic patients.
Frequently asked questions
What is information blocking?
A practice by a provider, certified health IT developer or health information network that is likely to interfere with access, exchange or use of electronic health information, unless it is required by law or fits one of the exceptions in 45 CFR Part 171.
Does the Cures Act apply to my consumer health app?
Usually not as an "actor". Your app benefits from it, because certified EHRs must offer standard APIs and actors must not block a patient-authorized app without a valid exception. Your own privacy duties come from your privacy policy, state laws, the FTC and, if you handle data for a covered entity, HIPAA.
Which FHIR APIs does the Cures Act rule require?
Certified EHRs must support the § 170.315(g)(10) standardized API: FHIR R4, US Core, SMART App Launch for single patients and Bulk FHIR for populations.
Can a hospital refuse my app because of privacy concerns?
It can inform the patient about your app's privacy practices, but refusing a patient-directed request needs a valid exception, such as a real security risk.
