Health Affairs February 15, 2019
In 2015, when the Office of the National Coordinator for Health IT (ONC) – where I served as chief privacy officer at the time — started planning what would become the “open specification API” rule of ONC’s 2015 Edition Certification Rule, we purposefully grounded that rule, and the corollary CMS rule (now called “promoting interoperability”), on an individual’s right to get, use and send their protected health information. We did so because this right cannot lawfully be denied. Unlike information sharing between health care businesses (B2B), which is permitted but not required, disclosure to an individual is required. Driven by the vision that this strategy would help APIs take root and flourish in healthcare, we hoped that over time, apps...