Information blocking enforcement is entering a stricter phase this year, and the rule that carries it, HTI-5, is expected to be finalised in August 2026. If your practice moves records by fax because the other end has no API, the exposure is not encryption. It is whether your open source fax server software can prove a record left, when, and to whom.
What HTI-5 changes, in plain terms
ASTP and ONC published the proposal on 29 December 2025, and it does two things at once. It cuts certification criteria for health IT developers, which is genuine deregulation. It also narrows the exceptions that let an actor decline a request for electronic health information, which is the opposite direction. One law firm summary called it a paradox, and that is fair.
Two changes matter if fax is part of your workflow. The infeasibility exception loses its third-party-modification condition. And the manner exception gets amended so that arrangements at non-market rates, contracts of adhesion, or unconscionable terms no longer shelter under it. Read together, the space for saying “we can only do it this way” got smaller.
Enforcement is already moving ahead of the final rule. In February 2026, ASTP and ONC issued letters of nonconformity to certified EHR developers over API performance and potential information blocking. That is the signal worth paying attention to, more than the rulemaking calendar.
Information blocking is not HIPAA, and the difference matters
Plenty of practices treat these as one compliance surface. They are not. HIPAA asks whether you protected the record. Information blocking asks whether you released it. You can satisfy one and fail the other with the same fax server.
The penalty structure splits by who you are. Developers of certified health IT and health information exchanges face civil monetary penalties up to $1 million per violation. Health care providers face disincentives applied through federal payment programs after an OIG referral. If you run a self-hosted fax server for your own practice, you sit in the provider column, which means the damage shows up quietly in payment terms rather than as a press release.
That quietness is exactly why it gets deprioritised. A breach makes noise. A records request that went nowhere makes none until someone complains.
Where a fax queue turns into an allegation
Roughly three quarters of medical communication still moves by fax, because not every provider sits on a shared exchange. So fax is not a legacy embarrassment here. It is the fallback that keeps requests moving when TEFCA connectivity does not reach.
A small orthopaedic clinic I would describe as typical runs a self-hosted fax server, sends maybe forty records a day, and has nobody assigned to the failed queue. Retries exhaust overnight. Nobody notices for a week. From inside the practice that is a monitoring gap. From the requester’s side it is indistinguishable from refusal, and the complaint gets written from their side.
Silent negotiation failures are worse still. A T.38 session that drops mid-page without producing a confirmation leaves you with no record and no alert. If you have not read up on why this happens, our explainer on T.38 based open source faxing covers the negotiation path in detail.
Then there is format downgrade. Sending structured data as a flat scanned image when a feed existed is the kind of thing the manner exception used to be stretched to cover. Under HTI-5 that stretch gets harder, and my view is that this is the change most likely to bite practices that default to fax out of habit rather than necessity.
What your fax server has to be able to produce
Forget policy documents. The question is what you can pull up eighteen months later when someone alleges a request went unanswered. Six things:
- Receipt timestamp. When the request arrived, not when someone got to it. These are frequently days apart and only the first one counts.
- Queue entry and dispatch times. The gap between them is your actual turnaround, and it is the number that will be quoted back at you.
- Per-attempt outcome. Not just final status. Four failed negotiations followed by a success tells a very different story than one clean send.
- Confirmation page or equivalent. The remote station identifier and page count, retained as data rather than as a printout somebody filed.
- Destination number as dialed. Transcription errors in fax numbers are common, and being able to show the number you actually sent to separates your fault from theirs.
- Operator identity. Who released the record. This one is a HIPAA requirement anyway, so most setups already have it.
Self-hosting gives you an advantage here that cloud fax does not. Every one of those fields exists somewhere in your own logs, on your own disk, under your retention policy. You are not filing a support ticket with a vendor hoping they kept enough. The tradeoff is that nobody else is going to build the report for you, and the fax API is usually the shortest path to pulling these fields into whatever your practice already uses for audit.
A hardening pass you can do this week
None of this needs a project. Half a day, honestly.
Start by alerting on the failed queue rather than watching it. If a fax has not succeeded after its retry budget, something should page a human the same day. Most installations ship with the queue visible in an interface, which is not the same as anyone looking.
Next, check your retention window against your complaint window. If logs roll at ninety days and information blocking complaints arrive a year out, the logs are decorative. Extend the retention on the delivery records specifically, which are small, even if you rotate the media aggressively.
Then write down your turnaround target and measure against it. Not because a regulation names a number, but because “we respond promptly” is not a defensible statement and “our median is 31 hours, here is the distribution” is. Teams that measure this are usually surprised by the tail rather than the median.
Finally, keep a short list of requesters who can accept something other than fax. Every one you move off fax is a request that stops depending on a negotiation succeeding. If you are standing up a new instance to do this properly, the ICTFax installation guide walks through the FreeSWITCH and SpanDSP setup end to end.
Frequently asked questions
Is sending records by fax itself information blocking?
No. Fax is a legitimate manner of exchange, and with three quarters of clinical communication still travelling that way it would be absurd to treat it otherwise. The risk arises when fax is used to avoid an available electronic path, or when it fails silently and nobody follows up.
Does the manner exception still let us insist on fax?
It is narrower under HTI-5 than it was. The exception now excludes arrangements at non-market rates, contracts of adhesion and unconscionable terms. Insisting on fax when a certified API sits idle is a weaker position than it was two years ago.
Who actually enforces this against a small practice?
Complaints route to OIG, which investigates and refers. Providers do not face the $1 million per violation penalty that applies to developers and exchanges. They face disincentives through federal payment programs, which is a slower and less visible consequence.
How long do we need to keep fax delivery logs?
There is no single number written into the information blocking rules, so anchor it to your HIPAA documentation retention instead and treat six years as a safe floor. Delivery metadata is tiny compared with the images themselves, so keeping it longer than the documents costs almost nothing.
Does open source help or hurt here?
It helps, on balance. You control retention, you can query the database directly, and there is no vendor between you and your own evidence. The cost is that the monitoring and reporting are yours to build, and that is where most self-hosted installations are thin.
Should we be moving off fax entirely?
Not on this timeline. FHIR based exchange is where the regulation is pushing, and it will get there, but the practices at the other end of your referral network are not all ready. Run both, and make the fax path the one you can evidence.
Related resources
- ICTFax installation guide
- Fax API tutorial
- Open source faxing software based on T.38
- ICTFax software features
- Download ICTFax
Where to start
If your delivery logs would not survive a records complaint, that is the thing to fix first, ahead of any migration plan. ICTFax is a self-hosted fax server built on FreeSWITCH and SpanDSP, which means the audit trail lives on infrastructure you control rather than inside somebody else’s retention policy. If you want a hand mapping your current logging against what a complaint would ask for, raise it through the support portal.