This isn’t a story about a hacker creating another data breach – although there are a lot of those out there right now. No, this narrative addresses a more daunting protagonist – the EHR vendor who’s holding protected health information (PHI) hostage. In a time where options constantly ebb and flow, it’s inevitable that healthcare organizations are going to reevaluate which EHR vendors provide the best fit. Usually, when an organization chooses to pursue a different vendor, the transition happens without instance. But sometimes, the termination of an EHR vendor contract can incite difficulties for the healthcare organization seeking the break. By law, upon termination of a contract, EHR vendors are required to return PHI to the covered entity in a reasonable and useable data format. However, sometimes EHR vendors will withhold PHI, attempting to either sway providers from switching vendors, or charging a large sum to access it. There have also been instances in which the availability of data is purposefully slowed down or delivered in an unusable format – all actions that directly conflict with the law. Does your healthcare organization have PHI being held hostage by an EHR vendor? Beyond filing a complaint with the U.S. Department of Health and Human Services, you can also start with these steps to help with the process of gaining rightful access to your data: Familiarize yourself with the HIPAA Covered Entity portion of the gov website for additional information on how the vendor may be in violation of the HIPAA Privacy Rule. Formally communicate to the vendor that they are legally required to provide access to your ePHI. If you’ve already considered the above and still feel like you need additional guidance and tools to help facilitate dialogue to gain access to your PHI, consult with Harmony Healthcare IT. We provide additional tools to help you continue to navigate conversations with your vendor around successfully accessing your PHI. We’re ready to talk about the best approach that will lead to your PHI residing where it should – with you and your organization.