The health data sharing initiative promoted by the Trump administration has the potential to be a boon for healthcare data interoperability, but experts point out that the plan currently lacks details, and challenges such as data security, under-resourced healthcare institutions, and slow technology adoption could become obstacles to its success.

The plan, announced at the White House late last month by leaders of the U.S. Department of Health and Human Services (HHS) and the Centers for Medicare & Medicaid Services (CMS), aims to improve long-standing health data exchange challenges through partnerships with more than 60 companies, including Amazon, Google, Epic, and UnitedHealth.

The plan includes two major focus areas: encouraging adoption of a voluntary data-sharing blueprint called the "CMS Interoperability Framework," and increasing access to digital health tools such as chronic disease management and care navigation products.

CMS said these companies have committed to "deliver results for the American people" in the first quarter of next year.

But experts note that this timeline is quite tight—although the plan has set standards for the operation of the interoperability framework, it remains unclear how the plan will actually work.

"In my view, most of the work depends on these 60 signatory companies, but I'm not sure how it will all be accomplished," said Beth Mosier, director of the healthcare M&A team at consulting firm West Monroe. "It seems to be voluntary participation, and then figuring it out on your own. So, I think there is still much to be defined about how it will actually operate."

Improving data sharing is harmless

Even so, experts say that given the healthcare industry's challenges with data sharing, the plan's goals are worthwhile.

Interoperability and information sharing are long-standing industry problems, with data silos making it difficult for information to flow between healthcare institutions, and reliance on outdated technologies such as fax machines exacerbating the issue.

Many patients may see multiple healthcare institutions that use separate patient portals, so consumers have to piece together their health data from various different sources, Mosier said. Making it easier for patients to access all their information could empower them to make healthcare decisions based on data, she added.

The plan is unlikely to harm interoperability, and CMS's involvement—as the largest payer in the U.S., processing over 1 billion Medicare claims annually—could promote data sharing and access, said Alex Nisenbaum, a partner at Blank Rome law firm.

Moreover, as the industry works to shift more care toward value-based payment arrangements and adopt artificial intelligence tools, the ease of data flow is more important than ever, said Jennifer Goldsack, CEO of the Digital Medicine Association.

AI needs massive amounts of data to train. Meanwhile, in value-based care arrangements, providers need data to adequately predict risk.

Goldsack said that for participating companies, working with CMS and other signatory companies may be less risky than going it alone. Additionally, the plan and the names of its signatory companies have been made very public, which may incentivize them to commit to the project.

"If someone later wants to take their toys and leave the sandbox, that wouldn't be dignified," Goldsack said. "So, I expect there will be some commercial pressure to follow through and deliver results."

High barriers to patient access

Nisenbaum said the "million-dollar question" is how the plan will work in practice.

One possibility is that the data-sharing commitments could build on and enhance the "Trusted Exchange Framework and Common Agreement" (TEFCA), a governance framework for health data exchange that went live at the end of 2023, he said.

TEFCA has gained momentum in recent years. Ten organizations have been designated as Qualified Health Information Networks (QHINs), up from five when TEFCA launched.

Several QHINs, including CommonWell Health Alliance, eClinicalWorks, eHealth Exchange, and Health Gorilla, have committed to implementing the interoperability framework and becoming CMS-aligned networks.

However, the new plan emphasizes putting data at patients' fingertips, while TEFCA focuses more on sharing between healthcare institutions to improve care coordination, Nisenbaum said.

Mosier said expectations for patient data access are quite high. Some of the standards under the CMS framework include ensuring patients can access their electronic medical information through apps of their choice, as well as finding their claims, explanation of benefits, prior authorizations, and clinical data from current and past payers.

"BYOD (bring your own device) is basically what they're talking about, and that's hardly been elegantly solved anywhere in healthcare, right?" Mosier said. "Patient portals and provider portals exist for a reason. ... Supporting whatever device anyone might bring is a significant commitment."

Often, when BYOD is successfully implemented, it uses fairly basic interfaces, she said. And healthcare data can be complex: what if a doctor's clinical data and an insurer's data don't clearly match? What if the information is confusing?

Even if data is structured and complete, it can be difficult to understand. For example, without a clinician present to explain what a test means, lab results can be confusing.

"For most people, digesting and absorbing very complex medical data is really difficult," Mosier said. "I think this will create another layer of support needs for these healthcare consumers."

Data security and technology barriers

Additionally, there are many challenges to overcome in health data sharing, including provider resistance to adopting new technologies and concerns about data privacy, experts say.

The Trump administration wants networks to use the FHIR standard (Fast Healthcare Interoperability Resources) to facilitate data access, which defines a set of rules for how health data can be exchanged between computer systems, regardless of how the information is stored.

However, adopting FHIR can be challenging, Mosier said. Providers may implement the standard in different ways and may use different versions of FHIR—which, as versions change over time, could complicate exchange.

Data security is another concern. Some apps responsible for giving patients control over their health data may not be subject to HIPAA privacy and security laws, Nisenbaum said.

"I think this will place a responsibility on patients to really understand the commitments these companies are making regarding the collection, use, and disclosure of health information," he said.

This can be challenging for patients. A 2022 survey by the American Medical Association found that only 20% of respondents said they knew which companies and individuals could access their health data.

Additionally, companies will also bear their own burden in navigating a complex and fragmented landscape of data privacy laws. Many states have their own data laws, and some have health-specific requirements, such as California's Confidentiality of Medical Information Act.

The plan could prompt more states to enact their own privacy legislation, because it only takes a few participants using data for questionable purposes (such as advertising) to attract regulatory scrutiny, Nisenbaum said.

"Most states don't have these comprehensive privacy laws, right?" he said. "So, assuming the federal government doesn't pass some law (which it hasn't succeeded in doing for years), there is still regulatory space."

Do under-resourced providers have a seat at the table?

Several health systems and providers, including Cleveland Clinic, Intermountain Health, and Providence, have signed commitments to participate in CMS-aligned networks and electronically receive patient data.

However, the number of participating providers is small compared to the number of health systems operating in the U.S.

And several of the entrants are fairly large providers—which is not surprising, because smaller physician practices often get "dragged along" in technology adoption, Nisenbaum said.

Managing technological change in healthcare organizations can be challenging, and small clinics often look to their vendors to meet data-sharing requirements, he added.

The experience of large institutions may not match that of less-resourced health systems, such as rural providers or those in financial difficulty. These health systems often don't have the bandwidth to participate in working groups, causing their unique challenges to be overlooked, Goldsack said.

"Rural hospitals don't have chief innovation officers, chief digital officers, chief AI officers, or chief technology officers," she said. "It's the CEO handling this from their desk on a Thursday night, and their technology budgets are very small."

Next steps

For now, the plan has clarified its goals and brought together a large number of organizations that have signed commitments, Goldsack said.

One indicator of the plan's progress could center on how participating companies incorporate the plan into their development plans, Mosier said.

"If we keep hearing Amazon and UnitedHealth talking about this and what they're doing, that will guide us in one direction," she said. "If it emerges as a big deal but we hear little about it three to five months later, that will say something else."