ONC 21st Century Cures Information Blocking and AI Voice in 2026

Information blocking used to be about EHR exports. In 2026 it reaches the AI voice agent that schedules an appointment, the chat agent that triages a symptom, and the predictive model that flags an at-risk caller — and ONC's HTI-1 Final Rule says transparency is no longer optional.

What the rule says

The Office of the National Coordinator for Health Information Technology (ONC) finalized the Health Data, Technology, and Interoperability (HTI-1) Certification Program Updates, Algorithm Transparency, and Information Sharing rule under the 21st Century Cures Act. The rule introduces first-of-its-kind transparency requirements for predictive decision-support interventions (predictive DSIs) inside certified Health IT — a category that explicitly includes machine learning, natural language processing, and large-language-model outputs. Effective January 1, 2026, the United States Core Data for Interoperability (USCDI) Version 3 becomes the baseline, expanding the dataset to include sexual orientation, gender identity, functional status, disability status, mental and cognitive status, and social determinants of health. The rule also updates the eight information-blocking exceptions and tightens definitions of "actor" and "interference."

In December 2025, HHS published a follow-on proposed rule that would amend the broader Health IT regulatory regime. Throughout, the through-line is the same: if a developer, provider, or health information exchange withholds, slows, or distorts access to electronic health information — including AI-generated outputs that are part of the designated record — the OIG can refer civil monetary penalties up to $1 million per violation.

What AI voice/chat must do

For AI voice and chat the implications are sharp. First, every predictive DSI riding on certified Health IT must publish source attributes — training data, validation methodology, intended use, fairness metrics, exclusion criteria, and known risks — on demand. Second, anything the AI agent generates and stores in the EHR (call summary, sentiment, lead score, triage outcome, refill prediction) is electronic health information and falls inside the information-blocking framework. Third, USCDI v3 means the agent must be able to capture, transmit, and request SOGI, disability, and SDOH fields cleanly without dropping data on the floor. Fourth, any rate-limiting, fee, or technical hurdle that delays a patient's API access to those AI-generated artifacts is presumptively interference unless an exception applies.

CallSphere compliance posture

Explore a live demo and compare current plans to find the right fit for your business.

flowchart LR
A[Caller] --> B[Voice Agent]
B --> C[Predictive DSI]
C --> D[Source Attributes\nPublished]
B --> E[(healthcare_voice)]
E --> F[USCDI v3 Fields]
E --> G[FHIR API]
G --> H[Patient Access]

Compliance checklist

1. Inventory every predictive DSI that touches a patient interaction — voice triage, chat triage, lead scoring, no-show prediction, refill prediction, sentiment classifiers.
2. Publish source attributes for each DSI: training data window, performance metrics, fairness summary, intended use, known limits.
3. Capture USCDI v3 SOGI, disability, functional status, and SDOH fields in every relevant intake; do not silently coerce missing values.
4. Stamp every AI-generated record with model name, version, prompt template hash, and inference timestamp.
5. Expose AI-generated artifacts via FHIR APIs without rate-limiting that exceeds documented operational caps.
6. Map every workflow step against the eight information-blocking exceptions and document which one applies.
7. Train clinical and operations staff on the difference between "interference" and a legitimate exception.
8. Stand up a single intake for patient and third-party access requests with a 30-day SLA.
9. Log every API access decision (grant, deny, partial) for OIG-referral defense.
10. Review the December 2025 proposed amendments; track final-rule status quarterly.

FAQ

Does the AI's reasoning have to be released to the patient? The output and the source attributes are in scope. The model weights themselves are not. Publish the metadata HTI-1 enumerates and the call-summary text.

Are non-certified Health IT modules covered? Information-blocking applies to actors, not just certified modules. If your AI sits next to a certified EHR and influences EHI access, you are likely in scope.

What if a tenant restricts data sharing? You can honor a tenant configuration only if it lines up with one of the eight exceptions and is documented in writing.

Does USCDI v3 require new EHR fields? Yes. Plan a schema migration; do not stuff SOGI into a free-text note.

Sources

• ONC HTI-1 Final Rule: https://healthit.gov/regulations/hti-rules/hti-1-final-rule/
• 21st Century Cures Act Final Rule blog — ONC: https://healthit.gov/blog/21st-century-cures-act/the-cures-final-rule/
• OIG Information Blocking page: https://oig.hhs.gov/reports/featured/information-blocking/
• USCDI v3 — HealthIT.gov: https://www.healthit.gov/isa/united-states-core-data-interoperability-uscdi
• Federal Register — HTI-1 Final Rule (89 FR 1192): https://www.federalregister.gov/documents/2024/01/09/2023-28857/health-data-technology-and-interoperability-certification-program-updates-algorithm-transparency-and