How to aggregate a patient's records across health data networks

The best healthcare data exchange vendors for aggregating a patient's records are the ones that also reach the providers networks miss. Query-based exchange lets you find and request a patient's data from other providers [1]. Yet networks, records vendors and portals return about 63% of a patient's visits, so judge each option on coverage first.

What a health data network does

A health data network moves patient records between organizations that have agreed to share them. ONC describes three forms of exchange [1]. Directed exchange pushes data, such as lab results or a referral, straight to another clinician [1]. Query-based exchange lets a provider search for and request a patient's data from other providers [1]. Consumer-mediated exchange lets patients gather and control their own health data [1].

For a product team, query-based exchange is the form that matters. Your system sends a patient's identity and a purpose. Each connected source that finds a match returns what it holds.

How the ways of getting records compare

Each channel answers a different question. Networks answer "who already shares data?" Direct requests answer "who holds the rest?"

Most aggregation products combine these channels. The difference between them is what happens after the networks stop answering.

How TEFCA changes network exchange

TEFCA is a federal framework that links health information networks under one common agreement [2]. ONC is responsible for TEFCA overall [2]. The first Qualified Health Information Networks were designated in December 2023 [2].

ONC's page says: "TEFCA is designed to support exchange for any purpose, but that purpose must be indicated in each request for data" [2]. The initial exchange purposes are treatment, payment, health care operations, public health, government benefits determination and individual access services [2]. For an app acting for a patient, the matching purpose is individual access services, which ONC describes as patient or caregiver access to records [1]. HIPAA separately lets a covered entity disclose records for the treatment activities of a health care provider [5].

TEFCA widens reach between networks. It does not connect a provider that sits outside every network.

Where network coverage stops

Even hospitals do not all exchange data routinely. In 2023, 70% of non-federal acute care hospitals sent, received, found and integrated outside data at least sometimes [3]. Less than half, 43%, did all four routinely [3]. About 2 in 5 rural and critical access hospitals did not reach all four even sometimes [3].

Access is also not the same as use. 71% of hospitals reported routine access to clinical data from outside providers, but only 42% said clinicians routinely use it when treating patients [3].

Across all channels, 37% of a patient's record sits outside every network and portal combined.

What the rules require of record holders

Two sets of rules shape what you can expect from a provider.

• Information blocking. ONC defines it as a practice that is "likely to interfere with the access, exchange, or use of electronic health information (EHI)," unless the law requires it or an exception applies [4]. The rule applies to providers, certified health IT developers and health information networks [4].
• The patient's right of access. A covered entity must act on a patient's access request no later than 30 days after receipt [6]. It may extend that once, by no more than 30 days, if it explains the delay in writing [6].

The right of access applies whether or not a provider belongs to a network. Neither rule makes a provider answer by a digital channel.

How to evaluate an approach to aggregating records

Ask each option the same questions, in this order.

1. Coverage. Which providers does it reach through networks, and how does it reach the rest?
2. Authorization. Does one patient authorization cover every provider, or does each channel need its own consent?
3. Request status. Can your system see each provider's status, not just a single "pending" flag?
4. Follow-up. Who chases a provider that has not answered, and how often?
5. Delivery. Do records arrive as each provider responds, or only when the whole request closes?
6. Security. Does it handle protected health information under HIPAA and sign a BAA?

A network-only approach will score well on speed for connected providers. It will leave gaps for everyone else.

How Tavrn handles the full record

Tavrn retrieves medical records from any US provider: one authorization in, complete record out, via platform, integration or API. Its directory covers around 425,000 provider organizations across all 50 states and DC.

Tavrn asks networks and portals first. Tavrn requests the rest from each provider by fax, mail, email and phone. Every open request is followed up automatically every 48 hours.

For an engineering team, the request has a clear lifecycle. You create a request with the patient's authorization. Each provider moves through its own status as Tavrn contacts it. Records arrive as each provider responds. Anything else connects over the API and webhooks: a webhook fires on every status change, or poll the request. Webhooks suit products that react to new records. Polling suits batch jobs that check in on a schedule.

Tavrn handles protected health information under HIPAA; a BAA is available on request. Records are encrypted at rest and in transit. Tavrn doesn't use the records it retrieves or your organization's data to train AI models.

What to do next

If you are building on patient records, see how the API fits your product on the health tech page.

Sources

1. What is HIE? — ONC (HealthIT.gov)
2. Trusted Exchange Framework and Common Agreement (TEFCA) — ONC (HealthIT.gov)
3. Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023 — ONC (HealthIT.gov), 2024-05
4. Information Blocking — ONC (HealthIT.gov)
5. 45 CFR 164.506 - Uses and disclosures to carry out treatment, payment, or health care operations — eCFR
6. 45 CFR 164.524 - Access of individuals to protected health information — eCFR