Stop Hoarding Patient Data

1,500+ complaints, new warning notices, and clearer enforcement—plus what it could mean for health systems, payers, and health IT vendors as interoperability and patient access expectations tighten.

⚡️ NIMITZ HEALTH NEWS FLASH ⚡️ 

Transforming Health Care with Data: Improving Patient Outcomes Through Next-Generation Care”

Senate HELP Committee

March 5th, 2026 (recording linked here)

WITNESS

  • Thomas Keane M.D., M.B.A.: Assistant Secretary for Technology Policy (ASTP) and National Coordinator for Health Information Technology (ONC), United States Department of Health and Human Services

QUICK SUMMARY

  • The hearing was about making medical records move easily and safely between doctors, hospitals, and patients—especially through a national “network of networks” (TEFCA).

  • The witness said the government was finally cracking down on “data hoarding,” citing 1,500+ complaints and new warning letters to organizations suspected of blocking record-sharing.

  • Lawmakers hammered “prior authorization” delays, and the witness said new tech standards were meant to let approvals happen faster—ideally while the patient was still in the doctor’s office.

  • AI came up as the next wave, but the big unresolved issues were who regulated it, who was liable, and how patient data would be protected once it left traditional health systems.

  • Cyberattacks and hidden prices were framed as system-wide problems, with pushes to modernize security rules and make real prices easier to see at the point of care

🐘 Republicans

  • Patients should own their medical records, and the system should be forced to share them.

  • Cut delays and costs caused by bureaucracy.

🫏 Democrats

  • Technology is moving fast, so patient safety and privacy guardrails have to keep up.

  • Use better data sharing to improve public health and reduce waste.

MEMBER OPENING STATEMENTS

  • Chair Cassidy (R-LA) said that patient care had increasingly moved outside the exam room through digital tools like phones and online portals. He explained that digital access to health records had improved convenience and could have been lifesaving, especially when patients needed emergency care while traveling or sought second opinions. He said Congress had created ONC in 2009 to accelerate a fully digital healthcare system and that the hearing had examined ONC’s work to standardize data sharing and strengthen patient control. He emphasized that information blocking had remained a concern, referenced prior efforts to outlaw it in the 21st Century Cures Act, and said the committee had also pursued privacy and cybersecurity measures while aiming to expand the benefits of digital health and limit its downsides.

WITNESS OPENING STATEMENTS

  • Dr. Keane testified that HHS had worked to improve outcomes by expanding the exchange, access, and use of health data. He said his clinical experience in rural and urban settings had shown both persistent challenges and major advancements in health information exchange over the past two decades. He stated that his top priority had been “data liquidity,” and he described efforts to build secure nationwide exchange infrastructure through TEFCA, which he said had connected tens of thousands of locations and supported nearly 500 million exchanged records. He argued that information blocking had remained a major barrier despite improved technology and said his office had advanced enforcement actions, updated rules to improve real-time prescription drug information for cost savings, and proposed modernizing certification standards to reduce burden and strengthen interoperability while pursuing a future in which people could manage and share health information as easily as finances or travel.

QUESTION AND ANSWER SUMMARY

  • Sen. Marshall (R-KS) said Medicare Advantage patients had faced delayed care because prior authorization had been used to slow approvals. He asked how ONC and the administration had advanced real-time prior authorization. Dr. Keane said the July 2025 HTI-4 rule had set standards for electronic prior authorization at the point of care and that ONC had worked with CMS and payer commitments aimed at real-time decisions for most requests, though adoption still had to catch up.

    Sen. Marshall questioned whether insurers had been cooperating. Dr. Keane said the main barrier had been getting payers and EHRs to connect cleanly through shared standards, while also highlighting real-time prescription benefit tools that had let clinicians compare patient-specific drug alternatives and costs to improve affordability and adherence.

  • Sen. Kaine (D-VA) asked how HHS had addressed lagging EHR interoperability among behavioral health, long-term care, and social service providers that had not received HITECH incentives. Dr. Keane said ONC had prioritized behavioral health through a joint initiative with SAMHSA, new interoperability data elements for behavioral health and related social needs, and pilots in nine states connecting multiple exchange partners for post-crisis handoffs.

    Sen. Kaine raised long-term care and then pandemic lessons, and Dr. Keane said ONC had pushed interoperability-focused certification reforms to spur more tailored LTC solutions and had built a public-health-focused USCDI “plus” to make EHR-to-public-health reporting more consistent.

    Sen. Kaine emphasized that siloed data across jurisdictions had limited public health impact.

  • Chair Cassidy (R-LA) pressed on how patient-controlled health data could have been uploaded and used by AI for clinical decision support, and he asked about governance, privacy, liability, and whether ONC or FDA would have overseen that kind of tool. Dr. Keane said ONC had sought public input via a December 2025 AI RFI, had limited what TEFCA individual access services could do with data (such as resale and marketing), and had viewed FDA as the main regulator of clinical decision support, while noting patients could still choose to share their own data broadly.

    Chair Cassidy then asked whether Cures Act API requirements had been undermined by information blocking or misuse. Dr. Keane said reports had varied, ONC had received 1,500+ complaints, had referred matters to OIG, and had begun issuing nonconformity notices with corrective action pathways that could have led to certification consequences.

  • Sen. Hickenlooper (D-CO) argued that opaque pricing had prevented employers and patients from shopping and had weakened competitive pressure to reduce costs, and he linked this to his “Patients Deserve Price Tags Act.” Dr. Keane agreed that point-of-care price visibility had improved decision-making and adherence, and he said ONC had been working to bring both PBM-derived and direct-to-consumer cash pricing into EHR workflows so patients could see cheaper options when copays exceeded cash prices.

  • Sen. Hickenlooper also raised rural hospital stability in light of proposed funding cuts, and Dr. Keane said health IT could have helped close rural gaps and offered technical assistance.

  • Sen. Alsobrooks (D-MD) emphasized that rapid digitization and embedded AI had raised stakes for safety, privacy, and clinical trust. She asked why centralized coordination across HHS had mattered and what guardrails ASTP should have provided. Dr. Keane said ONC’s coordinating function had focused on aligning standards to protect privacy and safety, while cybersecurity incident response had primarily involved ASPR and national security partners.

    Sen. Alsobrooks then asked whether federal authorities were sufficient for AI governance. Dr. Keane said ONC had used the December AI RFI to identify gaps, asserted ONC had authority over certification and network oversight, and said the agency had coordinated with CMS and FDA while deferring to them on their regulatory scope.

  • Sen. Marshall (R-KS) said interoperability had remained the biggest EHR failure and asked why major systems, including DoD and VA, still had not reliably exchanged records, and how ASTP had dealt with organizations that blocked exchange. Dr. Keane said interoperability depended on clear standards, conformance testing, and enforcement, and he pointed to nonconformity notices and OIG referrals as the escalation path for information blocking.

    Sen. Marshall pressed whether dominant EHR vendors had been bad actors and whether cases had moved forward, and Dr. Keane said ASTP had engaged parties first and then issued nonconformity notices, but he could not discuss OIG investigations.

    Sen. Marshall then pushed for truly patient-controlled records usable in emergencies. Dr. Keane said TEFCA’s Individual Access Services had aimed to put records on patients’ phones and that ASTP had been improving patient matching and tightening security controls to increase trust in sharing.

  • Sen. Murkowski (R-AK) warned that Alaska’s remote communities could have benefited most from digital modernization while having the least connectivity. She asked whether interoperability planning had aligned across federal systems like VA and IHS given the state’s veterans and tribes. Dr. Keane said IHS had been the first government participant in TEFCA and that ASTP had worked closely with IHS on modernization, including routine consultations and vendor/contractor support, to improve exchange with other providers.

    Sen. Murkowski emphasized tribal data privacy and sovereignty, and Dr. Keane said TEFCA’s privacy and security protections were central and that he wanted to work with her office to mature tribal and IHS exchange.

  • Sen. Hawley (R-MO) asked how cyberattacks on rural hospitals had harmed care and what ASTP had done to keep defenses current as threats evolved. Dr. Keane said rural facilities had been especially vulnerable and that HTI-5 had aimed to shift certification toward a risk-based approach aligned with the HIPAA Security Rule and capable of adopting newer security controls as they emerged. He said stronger authentication and more modern standards had been part of that direction and cited his own experience with a hospital cyber incident that had disrupted operations.