After a nine-year regulatory journey spanning four presidential administrations, the US Department of Health and Human Services (HHS) has initiated active enforcement of penalties against healthcare organizations and IT vendors blocking patient access to electronic health records. Violators face up to $1 million fines per incident and Medicare disincentives, finally implementing key provisions of the 2016 21st Century Cures Act.