Access Delayed is Access Denied

Last week, I kept running into the same story from 3 different directions. One headline out of Texas described a lawsuit against a major medical records company accused of gatekeeping patient data. Another reported that a telehealth company admitted it had been providing medical records to lawyers in ways that raised serious questions. A third showed just how much control a small number of companies have over access to medical information. Different facts, same underlying truth. Control of data has become concentrated, and the people who need it most are often last in line.

Let’s be clear: Individuals should have control of their own medical records, period. If it is your body, your care, your history, it is your information. Yet the system behaves as if access is conditional, delayed, and sometimes negotiated. If you have ever tried to gather records, you know the routine. Requests go out. Weeks pass. Files come back incomplete. Another request follows. Sometimes there is a fee. Sometimes the format does not work. Meanwhile, the reason you needed the records in the first place sits still. The promise of digital health was speed and access. The reality is often delay and friction. Inside Social Security disability, this gap shows up every day. A decision cannot be made without medical evidence, but the evidence does not move easily. An SSA Office of Inspector General report made that plain. After more than a decade of effort, only 11 percent of medical records were received through health IT systems as of fiscal year 2020. The rest still came through paper or older electronic processes. It’s not much better today. That means fax machines, scanned files, and manual review are still doing the work in a system that serves millions. And that is at a cost of over $40 Million to Health IT providers. This is not just inefficiency. It is structure. This year, I attended the 2026 ASTP Annual Meeting, where the rules around Health IT are made. A big theme was information blocking. Those sessions made clear that a small number of companies sit in the middle and control how data flows. They influence who gets access, how long it takes, and what it costs. And they are not passive players. And here is the uncomfortable question. Where is the enforcement? Congress spoke clearly in the law. Penalties of up to $1 M per violation apply to actors who interfere with access to health information. Yet we see lawsuit after lawsuit, report after report, and still very little visible enforcement from HHS or CMS. When rules are not enforced, they stop being rules. They become suggestions. Access should follow the individual. Not the vendor. Not the platform. Not the contract. The individual. Until enforcement matches the law, we will keep seeing the same stories play out. And the people who can least afford to wait will keep waiting the longest.