EHI export is a feature every certified EHR has had to give its customers since December 31, 2023: a way to export all the electronic health information the system stores, for a single patient or for your entire practice, in a computable format the vendor has to document publicly. If you've ever been told "we can only give you PDFs," this is the rule that makes that answer incomplete.
It's one of the least-known rights a practice has. Here's what it covers, what it doesn't, and how to use it.
Where does the requirement come from?
It comes from the 21st Century Cures Act rules. Federal certification criterion 45 CFR 170.315(b)(10) defines the export, and a separate condition of certification says any certified product that stores electronic health information must certify to it. That same section set the deadline: developers had to provide the capability to all their customers by December 31, 2023.
ONC, the federal office that runs EHR certification, puts the purpose plainly in its fact sheet: the export "empowers providers and provider organizations to migrate all the EHI from one Certified Health IT product to any health IT system of their choosing."
What counts as "electronic health information"?
The definition ties it to HIPAA. EHI is the electronic protected health information that would be part of a patient's designated record set: in ONC's words, "the same ePHI that an individual would have the right to access under the HIPAA Privacy Rule." Two things are carved out by name:
- Psychotherapy notes, as HIPAA defines them.
- Information compiled for a legal action or proceeding.
What that means in practice: charts, notes, medications, allergies, results, scanned documents, and the billing records tied to a patient's care are generally in scope. Data that isn't about a patient's care, like staff schedules or your own internal reports, may not be. If your billing lives in a separate practice-management product, ask whether its data comes out in the same export.
Two kinds of export
The rule describes two, and they behave differently.
| Single-patient export | Whole-practice export | |
|---|---|---|
| What it covers | All EHI the system stores for one patient | All EHI the system stores for every patient |
| Who runs it | Users at your practice, at any time, with no vendor help | May need the vendor's action or support |
| Who can use it | Limited to users you designate, or to administrators | Arranged with the vendor |
| Format | Electronic and computable, with a link to the vendor's public format documentation | The same |
| Typical use | A patient's records request, a departing physician's patients | Switching EHRs, an archive, an acquisition or audit |
The single-patient export is meant to be self-service. The regulation says a user "must be able to execute this capability at any time the user chooses and without subsequent developer assistance to operate." The vendor can limit it to specific users or to administrators, but ONC's certification guide says that limit is for the practice to set and "cannot be used by health IT developers as a way to thwart" the feature.
The whole-practice export is different. The same guide says it "could require action or support on the part of the health IT developer." So for a full copy, plan on a request to your vendor, not a button.
What will the files look like?
This is where expectations go wrong. The rule requires a format that is "electronic and in a computable format," with a publicly accessible link to its documentation included with the files. It doesn't require a particular standard. ONC's guide says the format "need not be the same format used internally," and that the vendor doesn't have to publish its internal data model.
So what comes out is complete but shaped the way your vendor chose. DrChrono's version, for example, produces a spreadsheet for every table plus a folder of the underlying documents (more in our DrChrono guide). Other vendors use other layouts. Expect real work between "we have the export" and "the new system imported it."
Can the vendor charge for it?
Generally, vendors may charge reasonable fees for many things, but the information-blocking rules draw two lines that matter here. Their fees exception does not cover:
- a fee to run the certified EHI export "for the purposes of switching health IT or to provide patients their electronic health information," or
- a fee to export or convert data "that was not agreed to in writing at the time the technology was acquired."
Neither line is a blanket ban. Each means that a vendor charging that fee can't rely on the exception to show it isn't information blocking. Read your contract for any export fees you agreed to when you signed, and if a new one appears when you try to leave, that's a question for your counsel.
I'm not a lawyer, and this isn't legal advice. The information-blocking rules have several exceptions with real detail in them, and your contract matters too.
How it helps with patient records requests
Under HIPAA's right of access, a practice must act on a patient's request within 30 days, with one extension of no more than 30 more days and a written reason. The single-patient export is a ready-made way to produce an electronic copy of that patient's record. ONC's guide notes the rule doesn't require a direct-to-patient feature, so it's your staff who run it.
The export is computable, which means files, not a friendly printout. Some patients will want the PDF chart instead, and that's fine. The export is the complete version when someone asks for "everything."
How to use it before you need it
You don't want your first look at the export to be the week you're leaving a vendor.
- Find the format documentation now. Ask your vendor for the public link to its EHI export format. It has to exist.
- Run a single-patient export on a test patient. See what the files look like and who at your practice has permission to run it.
- Ask how a whole-practice export is requested, how long it typically takes, and whether practice-management data is included.
- Read the exit terms in your contract, including how long the vendor keeps your data after cancellation. Our EHR switching checklist covers the rest of that list.
- Verify any full export with counts before you cancel anything: patients, documents, open claims.
That last step is the easiest to skip and the most expensive to regret. We've planned and delivered a complete, verified export of a practice's records, and the export itself wasn't the hard part. Checking that nothing went missing, and turning the vendor's format into something the next system accepts, is where the work is.
If you're planning a switch, an archive, or just want to know what your export actually contains, our app development service and work with medical practices start with a free conversation and a written inventory, then a fixed quote for the work itself.