By December 31, 2022, every developer of certified health IT in the US had to give its customers a standardized FHIR API for patient data. In February 2023, ONC reported that more than 95 percent of certified developers met that deadline. On paper, an AI application can now ask any certified EHR for a patient's record in the same format.
What comes back is another matter. ONC's analysis of the 2023 American Hospital Association IT survey found that 70 percent of non-federal acute care hospitals engaged in all four domains of interoperable exchange (sending, receiving, finding, and integrating outside records) at least sometimes. Only 43 percent did all four routinely.
That gap is the decision this article is about. A health system with budget for one AI project and one data project has to decide which comes first. The answer depends on how much of the AI's promised value rests on records the system cannot yet see.
Why the data still does not flow
The vocabularies exist. SNOMED CT, LOINC, RxNorm, and ICD-10 cover diagnoses, lab tests, drugs, and billing codes. The trouble is local implementation. Two hospitals can both "use LOINC" and still map the same lab test to different codes, or keep a local code the other has never seen.
Much of the most useful clinical information sits in free-text notes. Notes have no standard structure. A model that needs smoking history, functional status, or the reason a drug was stopped will often find it only in prose.
Incentives also played a part. A closed record makes switching vendors harder, and outside data raises liability questions for the clinician who acts on it. Congress addressed the first problem directly: the 21st Century Cures Act of 2016 prohibits information blocking.
Finally, most health systems run EHRs that were bought and configured before current standards. Reworking them costs capital and disrupts clinical operations, so the work is deferred.
What FHIR changes, and what it does not
FHIR (Fast Healthcare Interoperability Resources) defines standard data models, called resources, for things like patients, conditions, medications, observations, and encounters. It exchanges them through ordinary web APIs. An application that speaks FHIR correctly can make the same request to Epic, to Oracle Health (formerly Cerner), or to a small ambulatory vendor.
For an AI vendor, that means one integration pattern instead of a custom interface per hospital. For a health system, it means the cost of trying a second AI tool should fall, because the plumbing is shared.
The certification criterion requires FHIR Release 4 and a defined minimum data set. It does not require every field a model might want. Structured data such as labs, medications, and problem lists comes through more reliably than notes. Recent data is usually more complete than historical data. And the API returns what the local EHR holds, so it inherits every local mapping problem described above.
Who enforces information blocking
A common claim is that ONC fines organizations for information blocking. ONC wrote the definitions and exceptions. It does not impose the money penalties.
The HHS Office of Inspector General can impose civil money penalties of up to $1 million per violation on health IT developers, health information networks, and health information exchanges, for conduct from September 1, 2023. Health care providers face a different mechanism: disincentives under CMS programs, which a February 2026 Holland & Knight alert dates to July 1, 2024. HHS announced in September 2025 that it would step up enforcement. In early 2026, ASTP (ONC's current name) said it had begun issuing notices of investigation of potential nonconformity to health IT developers.
We could not find a publicly announced OIG information-blocking penalty as of early 2026. The practical reading for an AI buyer: your right to request data is now backed by investigations and potential penalties. The quality of the data that comes back is not.
The exchange networks and payer APIs
TEFCA, the national framework for exchange between health information networks, went live on December 12, 2023, with five Qualified Health Information Networks (QHINs). ASTP's TEFCA history page lists 11 QHINs as of November 2025 and says more than 71,000 sites or organizations participate. Joining through a QHIN is how a health system reaches records held by organizations it has no direct interface with.
Claims data is the other route to a longer patient history. Under CMS's Interoperability and Prior Authorization Final Rule (CMS-0057-F), impacted payers (Medicare Advantage organizations, Medicaid and CHIP programs and managed care plans, and issuers of Qualified Health Plans on the federal exchanges) must generally stand up Provider Access, Payer-to-Payer, and Prior Authorization APIs by January 1, 2027. Claims are coarse, but they show care that happened elsewhere.
Outside the US
The EU's European Health Data Space is Regulation (EU) 2025/327, published in March 2025. It was not "approved in 2024", as earlier summaries said. Most of it applies from March 2027. The rules on secondary use, which cover research and the training of algorithms, apply from March 2029, with further stages in 2031 and 2035. Any AI plan that depends on EHDS data access in Europe should be dated accordingly.
India's Ayushman Bharat Digital Mission specifies health data exchange through FHIR R4 profiles that NRCeS publishes for the National Health Authority. That gives vendors a documented target. It does not tell you how complete the records are in a given state or facility.
Elsewhere, assume nothing. Ask each data source which standard it exposes, which version, and which fields are actually populated.
Deciding which comes first
The question is whether to fund the AI tool now or the data work first. Five steps answer it for a specific use case.
- List the model's inputs, field by field. Get the list from the vendor in writing. For each field, mark where it lives: in your EHR as structured data, only in notes, only at outside organizations, or nowhere.
- Test the API itself. Pull a sample of real records through your FHIR endpoint in a test environment. Count the fields that come back empty.
- Find out how much care happens elsewhere. If many of your patients' admissions, tests, or prescriptions happen at organizations you do not exchange with, the model sees a partial history.
- Price the gap. An illustrative example, with made-up numbers: a readmission model is validated on complete histories, but a third of your patients' prior admissions are at hospitals you do not exchange with. For those patients the model is running on a history it was not validated on. Connecting through a QHIN may be worth more than the model, and it serves the next model too.
- Accept "not yet" as an answer. If most inputs are missing or sit in free text, defer the AI purchase and fund the exchange and data quality work. That is a valid result.
Data flows need matching controls: consent management, audit logs, and de-identification for any secondary use. What your obligations are under HIPAA, state law, or the EHDS depends on your situation. Put those questions to your privacy counsel before records move, not after.
Start with one use case. Ask the vendor for its input list this week and run step 2 against your own endpoint before the next budget meeting.
GradeCircle builds and runs six products of its own: AfroSynergy, CallerBridge, HealthSquire, Heyzl, Lexfora, and LukeAPI, two of them in beta. The assumptions in our models come from operating those systems, not from a framework. See what we run.
If you have a specific decision in front of you, scope it in five questions and see the engagement, price band, and timeline before sharing contact details.
