It depends on what type of email it is. Information blocking will likely occur if the email contains the result that the patient is requesting or if you have a policy in place not to release results until the provider reviews them first. Withholding or disabling an email that contains the result that is ready is likely not information blocking as long as the result can be viewed by the patient.

According to the Office of the National Coordinator for Health Information Technology (ONC) if a provider's policy states that results are being withheld "for any period of time" to allow the provider who ordered the test to review the results first, it is considered information blocking. With the Department of Health and Human Services (HHS) declaring that they will begin enforcing information blocking in September 2025, the consequences can lead to penalties on payments to providers that participate in certain Medicare programs. This will occur once the HHS Office of Inspector General (OIG) issues a finding.

Information blocking also becomes a risk the quicker the results are being released to the patient. The Paubox 2026 Healthcare Email Security Report states that there were 170 email related breaches reported to the HHS in 2025. Approximately 2.5 million individuals were affected according to data from Paubox. Results that are released in a timely manner need to be secured when they reach the patient's inbox.

 

What makes a lab result delay information blocking

45 CFR 171.103 defines information blocking as a practice that is likely to interfere with the access, exchange. If you are a healthcare provider your practice must be one that you know would be considered unreasonable. Lab results are considered EHI and the patient is the most likely individual to request the results.

According to ONC there are circumstances where a delay may not be considered interference with a patient's ability to access their results. If there is a reason why a patient needs to wait to access their results it likely is not information blocking. If a patient logs into their patient portal and does not have access to their final results for any period of time, is most likely considered information blocking.

Different organizations have come to different conclusions about the topic Researchers at the University of California San Francisco believe that there are barriers to the implementation due to "local interpretations of allowable exceptions to Cures information blocking." When evaluating if your email may be information blocking, ask yourself: Is the email the cause for your patient to not have access to their results?

Related: Cures Act Information Blocking Rule explained

 

Is the email the result or a notice about the result?

The ONC believes that none of these rules require the actor to notify the patient of new EHI. Altering or halting notifications to the patient that they have new information available is likely not information blocking in most cases. So if your patient receives an email stating that their results are ready, and it takes a while to be delivered, you probably are not committing information blocking.

Researchers in a JAMIA study wanted to see what effect notifying patients about their results would have. By increasing notifications to all results, patients were reviewing their results before their provider 4 times more often. Once a policy was put in place to notify the patient of their results, the patients who reviewed their results before their provider decreased by 2.4%. The researchers believe that giving patients the option to be notified of their results "provides patients flexibility to indicate their preferences." Only one medical center in the US was studied for this research.

If the email contains the result and is your means of sending the result to the patient, then it is a different story. If you have a telehealth practice that sends results by email to your patients, you are controlling access to those results through email.

 

When email is how the patient asked to receive results

You can provide your patients their results by email if they ask under the HIPAA right of access rules. According to HHS, if a patient understands the risks of sending their results by email and still wants the information, you must provide them the information.

Patients want their results quickly. When asked how soon they would like to receive their test results, 95.7% of patients and care partners wanted their results released immediately. Of those patients who had nonnormal test results, 95.3% wanted immediate release of their results. A JAMA Network study stated that "most respondents preferred to receive test results via the patient portal." There was an 18.8% response rate, and the majority of respondents spoke English, with a median age of 64 years.

The vendor you are using to send these emails can also play a role. 28% of email-related healthcare breaches in 2025 were through the email of vendors and business associates. Using an encrypted email that has a BAA in place will allow you to provide the patient with their results promptly.

 

When the patient asks you to wait

ONC states that if you are withholding the results at the patient's request, you are likely not engaging in information blocking. You will need to know if there was an agreement between the patient and provider on when the results will be released or if there are any conditions the patient may have placed. Once those conditions are met, the results should be released to the patient without any further delay.

Most patients are not given the option to have their results held from their provider. According to a 2026 Journal of Medical Internet Research study that looked at the Health Information National Trends Survey, 58% of US adults who had received results through a portal had accessed those results before their provider was notified. Only 28% of those patients were given the option to have their results communicated in a certain way. "Substantially fewer patients report being given the option to decide how results are communicated." The authors of this study work for ONC.

You could allow the patient to place this request when ordering a lab panel. If they want to receive their lipid panel results only after speaking with a nurse, your office could allow that. Having the patient place this request for themselves is different than a default that you apply to all patients.

 

When a clinician believes a specific result could cause harm

If you are a licensed clinician that has a relationship with the patient and you believe that a result may be harmful to the patient, you can delay the release of those results. Under 45 CFR 171.201 if you are going to delay results from being released to the patient, you must believe that it will cause harm to the patient's life or physical safety. You will need to have this practice documented and allow the patient to have that determination reviewed.

If you have a policy that all results must be reviewed by the provider first, this does not meet the criteria for this exception. Providers feel that there are reasons why they should be able to review results before the patient sees them. A JAMIA study presented that in 2018, before the Cures Act was implemented, there was a patient at the University of Colorado who was notified of her fetus's death through her portal. The provider did not have time to notify her of the ultrasound results. The authors stated that "patients could potentially be distressed by receiving upsetting results through an electronic portal." Your email program should allow you to withhold a result that you believe will harm your patient.

 

Delays caused by state law, system timing, and after-hours release

If there is a state law that is preventing you from releasing a result to a patient, you are not committing information blocking. As long as you are releasing the information to the patient promptly after the state law requirement has been met. If your system does not automatically send results, and you have to access one system and send the result to another system, you are likely not committing information blocking.

Time of day can affect whether the patient sees their results before the provider. An Elsevier study that took place in Iowa at an academic medical center showed that it "shifted a higher proportion of result/report release to weekends." Patients had their results released to them on the weekends 15.3% of the time versus 3.2%. Another research study at UT Southwestern looked at 850 results of liver imaging. They found that if results were released to patients outside of normal business hours, the patient was 1.54 times more likely to access their results before the provider. These research studies were at one medical center each.

If you are a lab and you want your employees to have results released at 8am the following business day you are withholding information from your patients. ONC would consider this information blocking if you are sending those results to the patient by email.

 

Protecting the result email once it leaves

More results are going to be sent to your patients now that you are allowing them to view their results before you speak with them. There will be more messages coming from your patients to your providers about their results. All of these messages are protected by HIPAA.

Paubox found that 74% of breached healthcare organizations did not have effective DMARC. When looking at the healthcare organizations that were breached, 53% had email-related breaches on Microsoft 365. The HIPAA Security Rule states that you must have safeguards in place when transmitting this information. Encryption is addressable, and you will need to look at your risk assessment to see if you need to encrypt the information you are sending to your patients.

Paubox Email API allows you to send emails to your patients automatically when their results are ready. It will allow you to keep those emails protected with a BAA on all plans and TLS 1.2 or higher encryption when sending the email to your patient. By using an email program, you are helping to ensure that your patients can receive their results as soon as they are ready.

 

What a secure email workflow cannot settle

As we've learned, information blocking can happen in a variety of ways, and it's still something that HHS is trying to define. When HHS finalized the HTI-5 rule on October 26, 2026, they stated that they are still reviewing the rule for information blocking.

Using an email program that allows your patient to receive their results can help prevent your emails from being breached but there are still things that can go wrong. It is important to know why you may be holding back results from your patients and if it may be considered information blocking. Patients may want to have different results released to them at different times. A research study at the University of Pennsylvania looked at 153 patients who had results from hereditary cancer testing. 18% of patients who were notified immediately of their results would want to continue to have their results released to them immediately. The researchers believed that "provider involvement may benefit patient disclosure experience."

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

Do the information blocking rules apply to a telehealth practice with no patient portal?

They apply to healthcare providers whether or not they offer a portal, so for a portal-free practice the result email becomes the access channel regulators would examine.

 

How soon does a provider have to make a requested lab result available?

The rules set no fixed deadline, but ONC expects requested results to be available at about the same time the ordering clinician receives them, with any delay lasting no longer than necessary.

 

Does a patient's request to delay results need to be in writing?

The rules do not require a written request, although a provider who documents the agreed timeframe or condition has clear evidence the delay followed the patient's wishes.