THE LAW
What the 21st Century Cures Act Actually Gives You
You have a federal right you didn't know you had.
3 min read
·
May 7, 2026
In 2016, Congress passed the 21st Century Cures Act. It's not sexy. Nobody talks about it at dinner. But buried in that law is something radical: a federal guarantee that every American can access their own medical records electronically, on demand, for free.
That's it. That's the right.
Your doctor doesn't own your records. Your hospital doesn't own them. Your insurer doesn't own them. You do. The law made that official.
The catch? Almost nobody knows it exists.
Why Congress had to write this law
Congress understood something most patients don't: your medical history is scattered across thousands of separate computer systems. Your pediatrician from twenty years ago, the urgent care clinic from 2018, the specialist you saw once, the pharmacy you switched to, the hospital that admitted you. They all have records. None of them automatically talk to each other. Your current doctor has no way to see them unless you specifically request them and hand them over.
So Congress said: that ends now. You get access. You get it electronically. And anybody who blocks you is breaking federal law.
What the law actually covers
The law covers everything: visit notes, lab results, imaging studies, prescriptions, pharmacy records, insurance claims, vitals, diagnoses. If it's in a system and it's about you, you have the legal right to get it.
The enforcement is real. The Office of the National Coordinator for Health IT investigates complaints. Penalties are financial. Information blocking by providers or insurers is a federal violation.
What this means for you
You can actually assemble your complete medical history. You can bring it to a new doctor. You can catch gaps, prevent duplicate tests, and spot drug interactions your current provider never saw. You can make better decisions about your own care.
All you have to do is ask.
FREQUENTLY ASKED QUESTIONS
Common questions
What is the 21st Century Cures Act?
The 21st Century Cures Act is a federal law signed in December 2016 that, among other provisions, requires healthcare providers, electronic health record vendors, and health information exchanges to make electronic health information available to patients without delay, without unreasonable cost, and in the format the patient requests. The information blocking rule that implements this requirement took full effect between 2021 and 2022.
What is information blocking?
Information blocking is any practice by a healthcare provider, EHR vendor, or health information exchange that is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information. Charging unreasonable fees, imposing unreasonable conditions, delaying delivery without a valid reason, or refusing to provide records in the requested format can all constitute information blocking under 45 CFR Part 171.
How is the Cures Act different from HIPAA?
HIPAA's right of access (45 CFR § 164.524) was the original federal right to your records, giving 30 days for delivery and allowing reasonable cost-based fees. The Cures Act expanded that right by covering all electronic health information (broader than HIPAA's 'designated record set'), prohibiting practices that interfere with access, and creating new enforcement authority for the HHS Office of the National Coordinator.
Who enforces the Cures Act?
The HHS Office of the National Coordinator for Health Information Technology (ONC) investigates information blocking complaints and refers violations to the HHS Office of Inspector General (OIG), which can levy civil monetary penalties up to $1 million per violation against EHR vendors, health information exchanges, and healthcare providers.
How do I file an information blocking complaint?
Submit your complaint through the ONC information blocking portal at healthit.gov/feedback. Provide details about the provider, EHR vendor, or HIE involved; what records you requested; when you requested them; how the entity responded; and any documentation you have. ONC reviews complaints and refers credible violations to OIG for enforcement.
What electronic health information does the Cures Act cover?
The Cures Act applies to electronic health information as defined in 45 CFR § 171.102, which includes essentially all electronic protected health information (ePHI) in a designated record set, plus other electronic health information that providers and EHR vendors maintain. Coverage expanded to all electronic health information in October 2022.
Does the Cures Act apply to my doctor's office?
Yes, if your provider is a healthcare provider as defined in the Cures Act, which includes most physicians, hospitals, clinics, and other providers who use a certified electronic health record. Practices that still use only paper records may not fall under all Cures Act provisions, but they still must comply with HIPAA's right of access.
Can my provider charge me for electronic records under the Cures Act?
Only reasonable, cost-based fees are permitted, and the Cures Act and HHS guidance limit what counts as reasonable. Per the 2020 Ciox Health v. Azar ruling, providers cannot charge per-page or flat retrieval fees for electronic records delivered directly to you. Patient portal downloads and email deliveries should generally be free.
