For years, health care interoperability has existed in two realities at once.
In one, it has been a policy conversation. Lawmakers, regulators, vendors, health systems, and industry groups have spent years working through governance, privacy, security, and the mechanics of how data should move. That work laid the foundation for what is possible now.
In the other, interoperability is immediate. Physicians need the information required to treat a patient without delay. Patients want those records to follow them across settings of care, without having to arrive with a grocery bag full of printed paperwork or call a previous physician to ask for a fax.
The federal government has spent years convening stakeholders, setting expectations, and pushing the market toward implementation. Through efforts like the CMS Health Tech Ecosystem, that work is now helping catalyze real progress.
Much of the debate has focused on privacy and security. Those concerns are legitimate. A more connected system can create greater exposure to unauthorized access if the right protections are not in place. But health care should not treat that as a reason to limit information flow altogether. Other sectors do not respond to cybersecurity risk by shutting down digital exchange. They invest in safeguards that allow secure exchange to happen.
Any interoperability strategy worth taking seriously should embed privacy and security from the beginning — not as a one-time compliance exercise, but as an ongoing architectural commitment.
We are the first EHR vendor to migrate 100 percent of our eligible clinicians to TEFCA, a milestone that reflects both scale and consistency of our approach. Today, more than 100,000 clinicians are live on the network, with record sharing enabled by default for every patient unless they choose otherwise. Through TEFCA, we automatically connect with more than 125,000 provider sites via CommonWell Health Alliance, significantly expanding access to critical patient information. We currently receive approximately 45 million documents per month and make a similar volume available for partners and customers to securely retrieve through the network. In 2025 alone, more than 32 billion API calls enabled seamless data exchange.
We have also continued to build the connections that expand how patients and clinicians access and use health information across settings — through our collaboration with b.well, which lets patients aggregate their health records and share them at the point of care via QR code during intake; through our integration with Google’s Fitbit Personal Health Record and Google Wallet, which gives patients another trusted, familiar pathway to share their clinical and wellness data at check-in; and through additional integrations now underway.
We have also gone further than governance requires on the security side, and we are not shy about saying so. athenahealth has voluntarily implemented several administrative and technical controls designed to ensure that our healthcare provider clients are only making queries to networks for Treatment purposes. We only initiate a query where there is a demonstrated relationship between patient and provider. Queries are only sent in advance of a scheduled appointment or when the provider is actively reviewing a patient chart. These additional measures are not required by any law or TEFCA governance rule. We built it because it is the right thing to do.
The barrier to interoperability today is not technology, not privacy, and not security — it is business models, and the lack of will among certain participants to allow data to move in ways that do not serve their competitive interests. That is the harder conversation, but it is the honest one.
Independent ambulatory practices feel the consequences of that reality most directly. They operate closest to patients and furthest from the resources that large health systems often take for granted. They cannot negotiate proprietary data access. They cannot absorb the cost of chasing records across disconnected systems. And their patients do not stay in one place.
Interoperability, at athenahealth, is an operational responsibility, not a positioning strategy — and we are working with any personal health app, any partner, any platform willing to meet us there.
Health care does not need more believers in interoperability. It needs more builders.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
