Search

Since 2000, federal regulations have affirmed that patients have a right to a complete copy of their health records from their physicians and hospitals. Today, providers across the nation use electronic health records and electronic information exchange for health care, and patients are choosing digital health apps to help them manage their own health and health information. Some doctors and health systems have voiced concern about whether they may transmit a patient’s data upon the patient’s request to the patient or the patient’s health app. This hesitation impedes shared information and care coordination with patients. It impairs patients’ ability to use the state-of-the-art digital health tools they choose to track and manage their health. It undermines the ability of patients’ family caregivers to monitor health and to work remotely to provide care by using the nearly unique capabilities of health apps on people’s smartphones. This paper explains that sharing data electronically with patients and patients’ third-party apps is legally consistent under the Health Insurance Portability and Accountability Act (HIPAA) with routine electronic data sharing with other doctors for treatment or with insurers for reimbursement. The paper explains and illustrates basic principles and scenarios around sharing with patients, including patients’ third-party apps. Doctors routinely and legally share health data electronically under HIPAA whether or not their organizations retain HIPAA responsibility. Sharing with patients and patients’ third-party apps is no different and should be just as routine.

Background Health systems have recently started to activate patient-facing application programming interfaces (APIs) to facilitate patient access to health data and other interactions. Objective This study sought to ascertain health systems’ understanding, strategies, governance, and organizational infrastructure around patient-facing APIs, as well as their business drivers and barriers, to facilitate national learning, policy, and progress toward adoption. Methods We performed a content analysis of semistructured interviews with a convenience sample of 10 health systems known to be leading adopters of health technology, having either implemented or planning to implement patient-facing APIs. Results Of the 10 health systems, eight had operational patient-facing APIs, with organizational strategy driven most by federal policy, the emergence of Health Records on iPhone, and feelings of ethical obligation. The two priority use cases identified were enablement of a patient’s longitudinal health record and digital interactions with the health system. The themes most frequently cited as barriers to the increased use of patient-facing APIs were security concerns, an immature app ecosystem that does not currently offer superior functionality compared with widely adopted electronic health record (EHR)–tethered portals, a lack of business drivers, EHR vendor hesitation toward data sharing, and immature technology and standards. Conclusions Our findings reveal heterogeneity in health system understanding and approaches to the implementation and use of patient-facing APIs. Ongoing study, targeted policy interventions, and sharing of best practices appear necessary to achieve successful national implementation.