To unleash healthcare innovation, the federal government is targeting “unconscionable” contracts. But in trying to slay tech Goliaths, regulators may accidentally upend the entire system. Generated from all comments mentioning “unconscionable terms.”

In the modern healthcare economy, the most formidable barrier to your medical data is rarely a firewall. More often, it is a lawyer.

For years, the federal government has pushed the healthcare industry toward a future of seamless data sharing, mandating the use of open Application Programming Interfaces (APIs) so that patient records can flow freely between hospitals, apps, and artificial intelligence systems. But as the technological doors have opened, a new bottleneck has emerged in the legal departments of the nation’s largest electronic health record (EHR) vendors.

Startups and data networks allege that dominant health tech companies are weaponizing contract negotiations—demanding exorbitant fees, claiming ownership of third-party intellectual property, and forcing sweeping indemnification waivers—as a condition of accessing patient data.

Now, the federal government is attempting to intervene. In a sweeping new regulatory proposal known as HTI-5, the Department of Health and Human Services’ technology office (ASTP/ONC) has proposed a radical shift in its “Information Blocking” rules. To qualify for regulatory safe harbors, the government says, data-sharing agreements must be at market rate, they cannot be “contracts of adhesion” (take-it-or-leave-it deals), and, crucially, they must not contain “unconscionable terms.”

The proposal has ignited a fierce debate across the healthcare sector, captured in thousands of pages of public comments. It pits scrappy AI startups and clinical innovators against the multi-billion-dollar EHR titans, while leaving non-profit health exchanges caught in the crossfire, terrified that the government’s vague definitions could invite a wave of devastating lawsuits.

The “Monopoly Playbook”

To understand the government’s proposal, one must look at the frustration boiling over in the health tech startup ecosystem.

For a third-party application—say, an AI tool that predicts sepsis, or a platform that helps patients aggregate their medical history—to function, it must connect to the hospital’s EHR. But EHR vendors hold the keys to the castle.

Under current Information Blocking rules, if a vendor and a requestor cannot agree on exactly how data should be shared, the vendor can offer an “alternative manner” to share the data. ASTP/ONC has grown concerned that dominant actors are using this “Manner Exception” as a shield, presenting third parties with draconian, unnegotiable contracts. If the third party refuses the punishing terms, the EHR vendor simply claims the two sides couldn’t reach an agreement.

Y Combinator, the Silicon Valley startup accelerator that has funded over 150 health tech companies, did not mince words in its comments to the government.

“Across our portfolio, we observe a consistent pattern: startups building innovative tools for providers and patients are unable to access EHR data through official channels,” Y Combinator wrote, quoting one of its partners who described the tactics of dominant vendors as a “classic monopoly playbook.”

Datavant, a massive health data logistics company, echoed the sentiment, telling regulators that these contracts often bear “no reasonable relationship to interoperability.” Instead, they function as “instruments of competitive control.” Datavant noted that EHR vendors frequently demand workforce non-compete restrictions, sweeping audit rights, and intellectual property assignments just to grant API access.

Innovaccer, an enterprise AI platform, reported that health systems seeking to share data are frequently handed contracts with “unilateral termination clauses allowing the EHR developer to revoke API access on short notice with no obligation to provide a technically comparable alternative.”

For these companies, the government’s proposal to explicitly ban “unconscionable terms”—defined by the agency using the Merriam-Webster dictionary as “excessive, unreasonable, or shockingly unfair”—is a long-overdue lifeline.

Medical providers agree. The American College of Obstetricians & Gynecologists (ACOG) praised the proposal, writing that prohibiting unconscionable terms “will prevent any actors from exchanging, accessing, or using [health data] in an unreasonable or unjust way,” ultimately protecting patient safety.

The Empire Strikes Back

For the architects of the nation’s electronic health records, however, the government’s foray into contract law is a step too far—and potentially illegal.

Epic and Oracle Health, the two largest EHR vendors in the country, alongside the HIMSS EHR Association (EHRA), pushed back aggressively against the proposal. Their primary argument? The government is attempting to micromanage free-market negotiations using hopelessly vague language.

“The term ‘analogous’ is ambiguous and difficult to operationalize,” the EHRA wrote, addressing the government’s attempt to force vendors to offer the same terms to similar companies. The association called the government’s assumption that health IT developers are abusing the rules “unnecessarily contentious” and “inflammatory.”

Epic argued that prohibiting standardized contracts (which the government labels “contracts of adhesion”) would grind the industry to a halt. “Epic executed over 6,000 consultant and outsourcer agreements and over 300 new vendors enrolled in our Vendor Services developer program” in a single year, the company noted. Forcing bespoke, ground-up negotiations for every single data connection would increase transaction costs exponentially.

Oracle Health warned that the proposal “introduces an unnecessary level of interpretation… that will lead to complication and confusion.” What is “shockingly unfair” to a small startup might simply be standard corporate risk mitigation to a multi-national software vendor.

Furthermore, legal experts warn that in a post-Chevron legal landscape, the government is cruising toward a buzzsaw.

Rohan Sharma, a health AI policy expert at the Aspen Institute, warned that defining “market rate” and “unconscionable terms” invites immediate judicial scrutiny under the Supreme Court’s recent Loper Bright decision, which stripped federal agencies of the presumption of deference.

“By venturing into economic regulation and contract law interpretation without explicit statutory delegation, the agency risks vacatur of the entire Information Blocking framework,” Sharma wrote.

The Collateral Damage

Perhaps the most alarmed voices in the public record belong not to the tech giants, but to the non-profit Health Information Exchanges (HIEs)—the regional, community-governed networks that securely shuttle data between local hospitals, clinics, and public health departments.

To function at scale, HIEs rely on universal “participation agreements.” Every hospital or clinic in the network signs the exact same contract. It ensures that everyone is playing by the same privacy and security rules.

But under the government’s proposed definitions, a non-negotiable, standardized participation agreement perfectly fits the definition of a “contract of adhesion.” If the ONC finalizes the rule as written, these non-profits fear their foundational contracts will suddenly be viewed as presumptive violations of federal law.

The eHealth Exchange, a massive national network, calculated the catastrophic financial impact this could have. To individually renegotiate its 300-plus standardized participation agreements to prove they aren’t “contracts of adhesion,” the non-profit estimated it would cost them between $12 million and $16 million in direct legal fees alone.

The proposed rule, eHealth Exchange wrote, leaves organizations operating under a “Damoclean sword of civil monetary penalties looming for guessing wrong.”

Contexture, a regional HIE serving Arizona and Colorado, pleaded with the government to change course. “Requiring custom negotiations with every participant would increase complexity and cost for nonprofit, community-based HIEs and HDUs, and could undermine the very interoperability the rule seeks to promote,” the organization wrote.

Even The Sequoia Project, the federally recognized coordinating entity for national health data exchange, urged the government to “clarify how the concept of a ‘contract of adhesion’ applies in participatory governance… by distinguishing unreasonably coercive contracting practices from trust agreements that support broad participation.”

A Search for a Middle Ground

Faced with the reality that their proposal could accidentally outlaw the very data networks they rely on, ASTP/ONC did offer an “alternative proposal” in the draft rule.

Instead of trying to define and police “unconscionable terms” and “contracts of adhesion,” the government could simply eliminate the Manner Exception’s contracting loophole entirely, forcing all data-sharing agreements to comply with already-established federal exceptions for “Fees” and “Licensing.”

Almost every entity outside of the startup sphere begged the government to take this alternative route. It would bypass the messy business of defining what makes a contract “shockingly unfair,” while still preventing vendors from charging outrageous, non-cost-based fees.

As the Department of Health and Human Services reviews the feedback and prepares the final HTI-5 rule, regulators face a delicate tightrope walk. They must find a way to stop dominant tech companies from using legal fine print to suffocate digital health innovation, without accidentally dismantling the legal frameworks that allow doctors to share life-saving information today.

As HTD Health, a technology consultancy, bluntly advised the government regarding the quagmire of adjudicating contract disputes: “If the goal is deregulation, having fewer regulatory constructs is the way to achieve it.”