Whole-Patient Care and Data Sharing

During the past decade, health systems have increasingly 

recognized the value of integrated continuums of care through 

close collaboration among multiple providers. Caring for the 

“whole person”—from assessment/diagnosis through multiple 

stages of treatment, recovery, and other needed supports—is 

possible only if the individual’s history, medications, 

treatment plan, and other relevant information are shared in a 

standardized and timely fashion across multiple provider and 

payer organizations.

Emerging Approaches to Health Data: 

“Patient First”

As person-centered practices take hold in health systems, there 

have been parallel changes in how health data is viewed by 

policymakers and healthcare providers. Whereas earlier 

approaches to protected health information (PHI) focused on 

enforcing security and preventing unwanted access, there’s 

been a recent shift to protecting the rights of individuals to 

access and control their own health data. There’s increasing 

awareness that the individual is the owner of their health data 

while providers and payers are “data stewards” rather than 

owners. 

Recent Policy Changes: Easier Access, New 

Data Protection Technologies

There are changes to health data protection regulations that 

align with the “patient first” principle by facilitating 

individuals’ access to their health data and increasing ease of 

access by multiple providers collaborating on or coordinating 

an individual’s care. In addition to individuals’ rights to access 

their own PHI, new regulations also give individuals the right 

to authorize disclosure of their data to specific organizations 

under most circumstances. These provisions necessitate easily 

accessible IT solutions that prevent unwanted access while 

upholding privacy and informed consent. The following are 

important policy changes in this direction:

The 21st Century CURES Act final rule calls for increased 

transparency and easier data access by patients, hospitals, 

provider organizations, and payers through an innovative data 

security IT environment. 

HIPAA Privacy Rule revisions brought changes to allow 

disclosure of PHI to case managers, care coordinators, 

community-based organizations, and social service agencies.

The Interoperability and Patient Access final rule issued in 

2020 by the Centers for Medicare & Medicaid Services (CMS) 

provides a roadmap for easing access to health data for 

patients, providers, and payers by enhancing compatibility 

across multiple health data systems. 

Sharing Behavioral Health Data

Health information related to substance use disorders has

special privacy protection regulations and strict consent 

procedures due to the potential criminal justice implications of 

substance use. These are articulated in the regulations labeled 

42 CFR, Part 2 (Confidentiality of Substance Use Disorder 

Patient Records). In response to the opioid epidemic, these 

regulations were recently revised to facilitate care 

coordination across multiple providers while continuing to 

protect confidentiality. HIPAA Privacy Rule revisions also 

include special provisions for behavioral health providers to 

access and disclose health data in the best interest of the 

individual and to prevent or reduce harm to individuals with 

substance use disorders and serious mental illness. 

Benefits of Data Sharing

In addition to facilitating crisis responses, empowering 

patients and families, and improving care through better 

coordination and collaboration, data sharing streamlines 

services and reduces costs. For example, a report by the 

American Hospital Association found that, “fully 

interoperable health information...reduces costs in time and 

resources for patients and insurers by avoiding duplicative 

services, as well as for clinical and administrative staff by 

devoting fewer hours to these tasks” (p. 4). 

Health Data Sharing to Improve 

Collaborative Care 

August 2021
Success Story from an Area Agency

CICOA Aging & In-Home Solutions, an Indiana Area Agency

on Aging, established a mutually beneficial data sharing 

agreement with the Indiana Health Information Exchange

(IHIE). Now, Indiana’s hospitals and other healthcare 

providers are able to share patient information with a social 

service provider, enhancing their ability to provide timely 

transition services for their discharged patients. Furthermore, 

access to real-time health information allows CICOA staff to 

provide supportive services in a timely fashion when one of 

their clients is admitted to the ER, reducing the risk of 

preventable complications resulting in re-hospitalization. 

Timely response to service requests makes an impact on 

clients’ health and wellbeing. For example, when CICOA 

quickly intervenes in the care of individuals who are at risk for 

falls, an area of great interest to their healthcare partners, the

fall rate among these individuals drops from 25% to 5%. 

Partnership with IHIE has also increased CICOA’s community 

outreach capacity. The Director of Health Care Collaborations

said that before the connection, “a 20% contact rate was 

considered good. Today, ... we have a contact rate as high as 

70% or 80%.” 

Technological Advances Facilitating Data 

Sharing

The biggest barriers to sharing PHI have been the strict 

privacy rules and the different ways that various agencies 

designed their data systems to meet privacy regulations. The 

multiple data platforms used by different health systems—and 

by different agencies within the same system—are difficult 

and costly to harmonize in a manner that allows for data to 

freely travel across agencies. This has resulted in “information 

silos” that hinder collaboration among providers and payers 

through the entire continuum of services and supports that an 

individual receives. The past decade witnessed initiatives, 

supported by multiple federal agencies, to break health 

information silos through scalable, affordable IT strategies, 

including those described in the following list.

 The Direct Project: This is an effort launched in 

2010 to specify a simple, secure, scalable, standardsbased way for participants to send authenticated, 

encrypted health information directly to known, 

trusted recipients over the internet. It makes the 

exchange of secure information among trusted 

partners as easy as sending an email, with security 

that meets federal regulations. Interested providers 

can get involved by contacting the project’s 

community of practice for implementers. 

 Application Programming Interfaces (API): 

These are applications that function as “translators” 

to help different software programs communicate 

with one another. They have been an important 

feature in online transaction applications since the 

1990s. Their use in health data sharing is a recent 

development, following the formulation of standard 

privacy protection criteria in line with federal PHI 

regulations, specifically for these applications. The 

use of APIs in health data systems, provided they

comply with these criteria, is now supported and 

encouraged by federal regulators. ONC and CMS 

have adopted API certification criteria for electronic 

health records to help enable access to health 

information for clinical and patient-facing uses. This 

technology has made it possible for communities to 

establish Health Information Exchanges (HIE), such 

as the San Diego system. Federally certified APIs for 

PHI sharing are commercially available. 

Additional Resources

 ONC’s Health IT Playbook addresses many questions 

that a provider might have about data sharing 

 CONNECT is an open-source software and user 

community for secure, electronic health data 

exchange among healthcare providers, insurers, 

government agencies, and consumer services

 The Network for Public Health Law provides legal 

information for community health organizations on 

health-related topics that include information security 

and data sharing. They offer webinars, toolkits, 

trainings, and an online Legal Assistance Library

Implementing a Data Sharing Process 

with Partner Organizations