Healthcare Data Liberation: What Changes When the Patient Stops Being the Integration Layer
Strategic Advisor, Insurance Growth, Medicare Distribution, and Compliance · LinkedIn
Key Takeaways
- →The patient is currently the interoperability layer - manually carrying information between organizations that already operate sophisticated electronic systems.
- →CMS explicitly used the phrase 'liberating patient data' in its 2020 interoperability rule, which required FHIR-based Patient Access APIs from Medicare Advantage, Medicaid, CHIP, and QHP payers.
- →The 2024 CMS-0057-F rule adds Provider Access APIs, payer-to-payer exchange, and electronic prior authorization requirements - major API compliance dates begin January 1, 2027.
- →The 2025 CAQH Index found automated transactions avoided $258 billion in administrative costs, with $21 billion in savings still available from remaining manual workflows.
- →95% of physicians say prior authorization delays access to necessary care; 26% report it led to a serious adverse event for a patient in their care (2025 AMA survey).
- →Connectivity alone is not enough - data must be usable and workflow-integrated to create operating value. Most economic benefit comes from the last two levels of the data maturity ladder.
- →HIPAA protections do not automatically follow data into third-party health apps. Privacy governance must be designed alongside access, not sequenced after it.
A patient sees a primary care physician, a specialist, an imaging center, a hospital, a pharmacy, and a health plan. Each organization may know something important about that patient, but the patient is often the only person who knows that all of those records exist.
They repeat their medication list. They log into multiple portals. They request records. A physician's office calls another physician's office, someone sends a fax, and a payer asks for documentation the provider believes it already submitted.
That is the operating problem behind what is increasingly described as healthcare data liberation. The phrase can sound abstract, but the goal is fairly concrete: health information should be able to move securely between the patient, providers, payers, and authorized applications without forcing the patient or a healthcare worker to manually reconstruct the record every time care moves from one organization to another.
$258B
Administrative costs avoided
Through automated transactions in 2025 (CAQH Index)
$21B
Savings still available
From remaining manual-to-electronic workflow shifts
95%
Physicians: prior auth delays care
2025 AMA Prior Authorization Physician Survey (n=1,000)
"Data liberation" did not arrive through one new law
There was no single 2026 law that suddenly gave every American ownership of all of their medical data. The federal framework developed in stages - each layer building on the last.
Gives individuals broad rights to inspect and obtain copies of health information maintained by covered providers and health plans - including billing records, claims, enrollment information, and lab results.
Made electronic information sharing an expected part of healthcare and created federal rules against information blocking - practices likely to interfere with the access, exchange, or use of electronic health information.
CMS explicitly used the phrase 'liberating patient data.' Required Medicare Advantage, Medicaid, CHIP, and QHP payers to make claims, encounter, and clinical information available through FHIR-based Patient Access APIs.
Added Provider Access APIs (patient data flows to in-network treating providers), payer-to-payer exchange requirements, and electronic prior authorization APIs. Many provisions began in 2026; major API compliance dates start January 1, 2027.
Voluntary initiative encouraging payers, providers, EHR vendors, health information networks, and patient apps to operate around common interoperability criteria. CMS coined the phrase 'Kill the Clipboard.'
Major API implementation requirements under CMS-0057-F generally require compliance by January 1, 2027, depending on payer type and requirement.
Fast Healthcare Interoperability Resources is part of the plumbing
FHIR provides common structures that systems can use to communicate, rather than every hospital, payer, EHR system, and application building its own language for exchanging information. The distinction between a static PDF and a structured FHIR API response matters operationally:
Static record delivery
- ✕70-page PDF of a medical record
- ✕Technically provides access
- ✕Requires human to read and extract
- ✕Cannot be organized by software
- ✕No structured data for downstream use
FHIR API delivery
- ✓Structured diagnoses, medications, claims, labs
- ✓Software can organize and use the data
- ✓Enables workflow integration
- ✓Supports downstream decision support
- ✓Creates operating value at scale
Connected data still has to be usable
Healthcare has made real progress connecting systems, but connectivity alone does not eliminate fragmentation. A physician facing hundreds of pages of poorly organized records has a data-access problem of a different kind - the record arrived, but the information needed for the decision may still be buried inside it. Healthcare organizations need to distinguish among five distinct capabilities:
The data value ladder - where economic benefit actually lives
Data availability
Does the information exist somewhere?
Data access
Can an authorized person or system retrieve it?
Interoperability
Can different systems exchange it using compatible standards?
Usability
Can the recipient quickly identify the information needed for the decision?
Workflow integration
Does the information appear at the point where someone needs to act on it?
Most of the economic value comes from levels 4 and 5.
Source: VHealth Partners analysis of CAQH Index and CMS interoperability framework.
The scale of manual work is now measurable in dollars
Dr. Mancini described spending 39 minutes on a call related to what she considered an erroneous Medicaid denial - including 31 minutes on hold - simply to request a physician discussion. Later in the conversation, she described the continued use of faxed documentation during payer-provider disputes and expressed frustration that a missing fax can still interfere with a clinical decision in 2026.
That example is not an outlier. The 2025 CAQH Index, drawing on data from 600 provider organizations and health plans covering roughly 63% of insured lives, quantified the cost of exactly this kind of manual record-moving at industry scale.
Administrative cost avoidance through automation (2025 CAQH Index)
600 provider organizations and health plans, ~63% of insured lives
The $21 billion is not a technology forecast. It is the visible cost of manual record-moving, priced at industry scale.
Source: CAQH 2025 Index, February 2026.
Prior authorization is where the operating cost is most visible
The 2025 AMA Prior Authorization Physician Survey, covering 1,000 practicing physicians, produced numbers that describe a process still running largely on phone calls, faxes, and manual documentation review.
95%
Prior auth delays access to necessary care
92%
Prior auth negatively impacts patient clinical outcomes
26%
Prior auth led to a serious adverse event for a patient in their care
Source: 2025 AMA Prior Authorization Physician Survey, 1,000 practicing physicians, reported May 2026.
CMS' interoperability rules increasingly connect clinical information with electronic prior authorization. A well-designed workflow could determine documentation requirements earlier, submit the necessary information electronically, track the request, and return the decision to the provider's workflow - materially different from a staff member moving between an EHR, a payer portal, email, fax, and telephone.
What changes for each stakeholder
Less manual record retrieval
Staff should spend less time calling other offices, requesting records, and moving documents manually.
Better information before the encounter
Medication history, diagnoses, recent encounters, and other authorized information can potentially arrive before the clinician sees the patient, improving medication reconciliation.
Better prior authorization workflows
Electronic prior authorization can determine documentation requirements earlier, submit electronically, track the request, and return the decision inside the provider's workflow.
Fewer documentation-related denials
Better information exchange can reduce a category of denials caused by missing information and incomplete documentation - not all denials, but a measurable subset.
Better revenue-cycle visibility
Eligibility, coverage, authorization status, and documentation all influence whether a service turns into a clean claim or a lengthy exception workflow.
More complete clinical context
Claims are valuable, but they do not always tell the entire clinical story. Appropriate access to clinical information provides additional context for care coordination, utilization management, and quality programs.
Better member transitions
CMS' payer-to-payer requirements are intended to improve continuity when people move between health plans. The new payer should not have to reconstruct a member's healthcare history from zero.
More efficient prior authorization
Structured electronic exchange can reduce manual requests, missing documents, telephone calls, and repeated submissions, and creates better visibility into the authorization lifecycle.
Better support for value-based care
Value-based models require information across settings. A payer and provider cannot manage a population effectively if each has only a partial picture of utilization, clinical activity, and care gaps.
Repeat themselves less often
Demographics, medications, insurance information, and medical history should not need to be reconstructed every time care moves to a new organization.
Better access to their own history
Patients can potentially use applications that organize information across several sources rather than opening multiple disconnected portals.
Easier caregiver coordination
A caregiver helping an aging parent should have an easier way, when properly authorized, to understand medications, recent encounters, and follow-up requirements.
Less friction changing plans or physicians
People changing physicians or health plans should face less friction carrying information with them. Emergency and specialty-care clinicians may be able to see important information faster.
CMS is now trying to move from regulation into an operating ecosystem
In July 2025, CMS launched its Health Technology Ecosystem - a voluntary initiative building on the regulatory interoperability foundation. CMS coined the phrase "Kill the Clipboard" to describe the goal: a patient who has already provided their demographics, medications, and medical history should not have to reconstruct that information every time they enter another part of the healthcare system.
CMS Health Technology Ecosystem - participating requirements
CMS Aligned Networks
Respond to authorized patient and provider requests
EHR systems
Make structured and certain unstructured information available
Payers
Make claims information accessible to aligned networks
Patient-facing apps
Secure identity verification, FHIR-based transmission, connectivity to CMS Aligned Networks
Medicare App Library
Applications completing specified interoperability, security, privacy, and review processes
CMS reporting (2026)
Impacted payers report Patient Access API usage metrics including unique patients whose data transferred to a health app
TEFCA adds a national exchange layer
The Trusted Exchange Framework and Common Agreement (TEFCA) establishes a common governance and technical framework letting health information networks exchange information nationally - rather than requiring organizations to build separate connections with every other network. TEFCA supports Individual Access Services, which can allow people to access, inspect, obtain, or transmit their own health information.
How the layers fit together
Portability creates a new privacy responsibility
Greater access creates another issue that deserves equal attention. HIPAA protections do not automatically follow health information everywhere it goes. When an individual directs protected health information to a third-party application that is neither a HIPAA-covered entity nor a business associate, the information may no longer be protected by HIPAA once the application receives it.
What patients should understand before authorizing a health app
- →Who is receiving their information
- →What is being requested and why
- →How long the data will be retained
- →Whether it can be shared with third parties or used for advertising
- →How authorization can be withdrawn
- →What happens if the company is sold or shuts down
The FTC updated its Health Breach Notification Rule in 2024 to clarify its application to many health apps outside HIPAA. A system that makes data portable without making privacy understandable creates a different form of risk.
Interoperability will not fix bad data
Moving inaccurate data faster does not improve healthcare. Organizations still need controls for patient matching, duplicates, outdated information, inconsistent coding, incomplete documentation, and conflicting records.
Data governance requirements that must accompany interoperability
Patient matching
Which John Smith belongs to which record?
Provenance
Where did this information originate?
Auditability
Who accessed or changed information, and when?
Identity verification
Healthcare cannot safely become easier to exchange with weak identity controls.
Consent management
Especially for information patients may reasonably consider sensitive.
Data quality controls
Duplicates, outdated information, inconsistent coding, incomplete documentation.
Third-party app governance
Clear rules for retention, sharing, advertising use, and what happens if the company is sold.
Audit trails
Organizations need to understand who accessed or changed information.
Three practical moves healthcare organizations can make now
Map where humans are still moving information between systems
Look for faxing, downloading, re-uploading, copying data between portals, telephone verification, spreadsheet tracking, and patients being asked to supply information another healthcare organization already has.
Where to look:
- →Fax volume between provider offices and payers
- →Staff time spent calling for records before visits
- →Patients asked to bring records from other providers
- →Manual eligibility verification calls
- →Spreadsheet-based authorization tracking
Connect data exchange to specific operating decisions
Do not treat FHIR implementation as an isolated technology project. Identify where data should trigger action. The value comes from changing the workflow around the information, not from moving the same manual process onto a faster pipe.
Where to look:
- →Before a visit: medication reconciliation, care gap alerts
- →During eligibility verification: coverage and authorization status
- →Before a prior authorization request: documentation requirements
- →When a patient changes plans: payer-to-payer transfer
- →When a claim is likely to fail: early documentation flag
Build governance alongside access
Every interoperability program needs clear rules for identity, consent, security, provenance, data quality, third-party applications, retention, and audit trails. Patient access and privacy should be designed together, not sequenced.
Where to look:
- →Identity verification before API access
- →Consent workflows for third-party app authorization
- →Data retention and deletion policies
- →Audit trail requirements for all exchanges
- →Third-party app review and approval process
Measure whether the underlying work disappears
- →Time spent retrieving outside records
- →% of outside records available before the visit
- →Fax volume
- →Calls related to missing documentation
- →Prior authorization turnaround time
- →Denials from missing documentation
- →Duplicate patient-record creation
- →Repeat diagnostics from unavailable records
- →Electronic vs. manual authorization volume
- →Provider calls on authorization status
- →Repeat requests for clinical information
- →Member use of Patient Access APIs
- →Successful payer-to-payer transfers
- →Appeals from missing documentation
- →Patient Access API usage (CMS-required 2026)
- →Unique patients whose data transferred to a health app
The next phase is operational
The United States already has much of the policy foundation for health-data portability. HIPAA established access rights. The 21st Century Cures Act challenged information blocking. The CMS interoperability rules created standardized payer APIs. TEFCA networks are building national exchange infrastructure.
The remaining questions are operational: whether a physician can get the right information before a decision, whether a payer can evaluate an authorization without repeatedly chasing records, and whether a patient can change doctors or health plans without rebuilding a medical history from scratch. Better information flow can improve financial visibility, eligibility matching, documentation quality, claims support, prior authorization workflows, revenue integrity, and audit readiness.
The test for progress
"If the patient is still serving as the interoperability layer, the system is not finished. The next measure of progress should be how much manual work, delay, and avoidable friction disappears when healthcare information can reliably follow the person it describes."
Frequently asked questions
What does healthcare data liberation mean?
Healthcare data liberation refers to making health information easier for patients and authorized organizations to access, exchange, and use electronically. CMS used the phrase 'liberating patient data' in its 2020 CMS-9115-F interoperability rule.
Did a new law give patients ownership of their medical data?
No single recent law established universal patient ownership of medical records. Federal law provides substantial rights to access, obtain electronic copies of, and in many circumstances direct the transmission of health information. Ownership of the underlying record is a different legal question.
What is FHIR in healthcare?
Fast Healthcare Interoperability Resources (FHIR) is a healthcare data standard designed to make electronic information easier for different systems and applications to exchange and use. CMS requires impacted payers to make data available through FHIR-based APIs.
What is TEFCA?
The Trusted Exchange Framework and Common Agreement (TEFCA) establishes a common national governance and technical framework for health information networks to exchange electronic health information, including Individual Access Services that allow patients to access their own records.
Can patients use an app to access health information?
Yes. CMS rules require certain payers to make specified information available through standardized Patient Access APIs that can connect to applications chosen by patients. CMS is also developing the Medicare App Library to help beneficiaries identify applications that have completed specified review processes.
Is a third-party health app automatically protected by HIPAA?
No. If an application is not a HIPAA-covered entity or business associate, information sent to it at a patient's direction may fall outside HIPAA after the application receives it. The FTC's Health Breach Notification Rule, updated in 2024, may apply to many health apps outside HIPAA.
When do the newer CMS interoperability requirements take effect?
Several operational provisions of the 2024 CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) began in 2026. Major API requirements — including Provider Access APIs and payer-to-payer exchange — generally have compliance dates beginning January 1, 2027.
Sources
- 1.CMS. 2020 Interoperability and Patient Access Final Rule, CMS-9115-F. cms.gov
- 2.CMS. Interoperability and Prior Authorization Final Rule, CMS-0057-F. cms.gov
- 3.ONC. Cures Act Final Rule and Information Blocking. healthit.gov
- 4.HHS. Individuals' Right under HIPAA to Access their Health Information, 45 CFR 164.524. hhs.gov
- 5.CMS. Health Technology Ecosystem. cms.gov
- 6.ONC. Trusted Exchange Framework and Common Agreement (TEFCA). healthit.gov
- 7.CAQH. 2025 CAQH Index. Administrative cost avoidance and remaining savings opportunity, February 2026. caqh.org
- 8.AMA. 2025 Prior Authorization Physician Survey, reported May 2026. ama-assn.org
- 9.FTC. Health Breach Notification Rule. ftc.gov
- 10.CISA. Healthcare and Public Health as a Critical Infrastructure Sector. cisa.gov
- 11.Becker's Healthcare. From Connection to Coordination: Charting the Next Chapter of Interoperability. May 27, 2026. beckershospitalreview.com
- 12.Insurance Marketing Coalition discussion with Dr. Sheri Mancini, surgeon and physician advisor, September 2026. insurancemarketingcoalition.com
- 13.KFF. Prior Authorization Metrics Provide New Insights into Insurer Practices, But Gaps Remain. August 2026. kff.org
Related reading
Get new VHealth insights in your inbox
Operations, compliance, AI implementation. No noise.
Admin — Notify Subscribers
Enter admin password to send notifications.