The export you should test before you need it

How do I get my records out of an EHR?

Ask your vendor for an export, and if the answer is delay, a paywall unrelated to actual cost, or a format nobody can open, you may be looking at information blocking. Under the 21st Century Cures Act, an EHR vendor and its healthcare-provider users are both "actors" who may not unreasonably interfere with access to, exchange of, or use of electronic health information, subject to eight defined exceptions 1Ref 1Office of the National Coordinator / ASTP (2026).Information Blocking.That the 21st Century Cures Act prohibits practices interfering with access, exchange, or use of electronic health information, subject to eight defined exceptions, and that clinicians are actors under the rule.. Most systems expose some export path — bulk or per-patient, usually rendered as C-CDA, CSV, or PDF.

The gap that catches solo practices is not the legal right; it is never having exercised it. A menu option that has sat untouched for years may not do what the vendor's marketing page says. The only way to know is to run it.

What the information-blocking rule actually covers

The rule reaches practices, not just vendors — a clinician who refuses to share a record for reasons the rule does not recognize can be an actor engaging in information blocking too 1Ref 1Office of the National Coordinator / ASTP (2026).Information Blocking.That the 21st Century Cures Act prohibits practices interfering with access, exchange, or use of electronic health information, subject to eight defined exceptions, and that clinicians are actors under the rule.. The eight exceptions are narrow and specific: preventing patient harm, protecting privacy, securing the system, technical infeasibility, reasonable content-and-manner limits, reasonable fees, licensing terms, and a health-IT-performance exception for planned maintenance. "We've always done it this way" is not one of them.

When a vendor cites an exception to slow-walk an export, ask which one and hold them to its actual terms — infeasibility and content-and-manner are the two most often stretched past their real scope.

Run the test now, not during a crisis

Schedule an export test on a fixed cadence — annually is reasonable for most solo practices — rather than waiting for the day you actually need the file. Export one full chart and one bulk sample, then check three things: the record count matches what you expect, the file opens in a viewer you do not depend on your vendor for, and the clinical content is complete rather than a truncated summary.

Write down who in your practice has the administrative right to trigger an export and how. A solo clinician is often the only person who knows this, which means the knowledge dies with a bad week unless it is documented somewhere outside the EHR itself — a password manager entry or a printed instruction sheet in a locked drawer, not a memory only you carry.

Time the test too. A vendor's export tool that quietly times out on a large chart, or that emails a download link which expires before you get to it, is a problem you want to discover on a slow Tuesday, not the week a subpoena arrives.

Formats you'll get: C-CDA, CSV, PDF

Each format solves a different problem, and c-cda, csv, pdf are not interchangeable despite often being offered from the same button. A C-CDA is a structured clinical document meant for exchange with another certified system — useful for a receiving EHR, less useful for a human reading on a screen. A CSV is a flat data dump, good for a spreadsheet audit of what you have but stripped of clinical narrative. A PDF is the most human-readable and the least reusable by another system.

If your export test only produces one of the three, ask whether the others exist. A closure or a malpractice-carrier request may specify a format you have never actually generated.

Your vendor is a business associate — the contract should say export is a live right

An EHR vendor that creates, receives, maintains, or transmits protected health information on your behalf is a business associate, and the agreement governing that relationship has to address the arrangement, not just breach notification 2Ref 2HHS Office for Civil Rights (2026).Business Associates.That an EHR vendor creating, receiving, maintaining, or transmitting PHI on a practice's behalf is a business associate requiring a BAA covering the relationship.. Read your business associate agreement for what it says about data portability and export on termination — some vendor contracts are silent, which leaves you negotiating access after the relationship has already soured.

If you are choosing a new system, ask about its participation in national exchange networks before you sign. TEFCA establishes a national floor for network-to-network exchange through Qualified Health Information Networks, and a vendor's posture toward that floor is a reasonable proxy for how seriously it takes getting data out later 3Ref 3Office of the National Coordinator / ASTP (2026).TEFCA — Office of the National Coordinator for Health Information Technology.That TEFCA establishes the national floor for network-to-network health information exchange via QHINs, relevant to evaluating a vendor's exchange posture..

A missing export clause is worth raising with a vendor before signing, not after. Ask specifically what happens to your data on termination, whether export triggers a fee, and how long the vendor retains a copy once you leave — three questions a sales call rarely answers unprompted.

The right of access sets a floor independent of your export button

A patient's own right to their records is a separate legal track from your practice-level export, and it can be the one that actually gets tested first. Under the HIPAA right of access, a patient may inspect and obtain a copy of their record within 30 days, with one 30-day extension, in the form and format they request where you can readily produce it, for a reasonable cost-based fee 4Ref 4HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients have a right to inspect and obtain copies of their records within 30 days (one 30-day extension), in the form and format requested where producible, for a reasonable cost-based fee.. If your EHR's patient-facing export cannot hit that timeline, you are exposed on access grounds even if your practice-level bulk export works fine.

Build the habit of testing both paths — the one you use for yourself and the one a patient triggers — because they sometimes run through different parts of the same system.

When you'll actually need this: migration, closure, a departure, a dispute

The moments this matters rarely come with much notice. The ehr migration to a new system is the obvious one — you cannot evaluate a replacement's import tooling until you know what your export actually looks like. Leaving employment at a group practice raises a parallel question about who controls the record and how it travels with you. Chart ownership disputes, a request tied to when a patient dies, and a payer or malpractice-carrier audit can all land on your desk with a short deadline attached.

Each of those situations goes faster when the export has already been tested once, calmly, with nothing riding on the outcome. Retention obligations under §164.316 and your state's schedule keep running underneath all of this regardless of which system holds the file 5Ref 5Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The §164.316 documentation-retention rule that continues to apply regardless of which system currently holds the exported file..