New US federal rules requiring health care organizations to give patients access to their full health records in digital format went into effect on October 6
the day they got their health data back👇 “I naively thought that because they were all on Epic, they could easily share my records!” ~ @TheLizArmy https://www.statnews.com/... #interoperability #healthdata #opennotes https://twitter.com/... Casey Ross / @caseymross : We @statnews will be tracking compliance with the new data access rules. Patients, share your experiences via the form below this story. And data holders, friendly reminder that wild incompetence isn't an exemption under the law 👇 https://www.statnews.com/... via @statnews https://twitter.com/...
Context & Ripple Effects
This deadline closes a three-year fight over who controls American health records. Epic Systems spent early 2020 urging large hospitals to oppose the proposed access rules, and the Trump administration announced them anyway that March, letting patients pull their data into apps of their own choosing. Medical groups had warned from the start that the framework lacked strong safeguards — a critique captured in the rules' original rollout coverage.
What changed on October 6 is enforcement: the access requirement is no longer a proposal but an obligation for every covered health care organization. STAT's Casey Ross is crowdsourcing compliance reports from patients, signaling that the newsroom intends to hold data holders accountable in public rather than wait for regulators.
First-order effects
- Patients can now legally demand their complete records in digital form from any covered provider, and organizations running Epic and similar systems must deliver them or face the consequences of non-compliance under the law.
- STAT's compliance-tracking effort turns individual failures — like the Epic-to-Epic sharing gap described in the story's patient anecdote — into documented, nameable cases of institutional obstruction.
Second-order effects
- Third-party app developers gain a regulated on-ramp to clinical data at scale, reviving the privacy concerns medical groups raised when the rules were first drafted, since records will now flow to apps outside hospital firewalls.
- Epic and other EHR vendors face pressure to make cross-system record sharing genuinely seamless, because 'we're all on the same vendor' is no longer an acceptable excuse when patients can compare responses across providers.
Third-order effects
- If compliance holds, the default posture of US health IT flips from institution-held data to patient-directed access, forcing a reckoning over whether safeguards should be attached to the rules themselves rather than left to each app.
- The US mandate lands alongside moves like England's NHS plan to share 55M patient histories with third parties, pushing Western health systems toward a common question: who sets the permission boundary once records leave the provider.
The trend: Health data control is shifting from hospitals and EHR vendors to patients themselves, with government mandates — not market behavior — setting the pace of interoperability.