What Is Health Information Exchange?

Health information exchange is the sharing of patient health information between organisations — hospitals, clinics, laboratories, pharmacies, public health bodies — so that care can be delivered with a fuller record.

The clinical case is strong and the security consequence is direct: sharing increases the number of organisations holding the data, which increases the number of places it can be lost.

The models

Directed exchange — one provider sends information to another for a specific purpose, which is the simplest and most controllable. Query-based — a provider searches for records about a patient across participants.

Consumer-mediated — the patient controls sharing through an application. The models differ substantially in who decides what is disclosed, which is where most of the governance difficulty sits.

Consent models and their consequences

Opt-in means information is shared only where the patient agreed. Opt-out means sharing occurs unless they object. Some jurisdictions permit sharing for treatment purposes without explicit consent.

The model is usually set by legislation rather than chosen. What the organisation controls is whether consent decisions are recorded accurately and honoured technically, which is where failures actually occur — a recorded objection that the system does not enforce is worse than no consent mechanism.

What the security problems actually are

Authentication of participants, so records are disclosed only to genuine providers. Authorisation, so a participant can see what their role justifies rather than everything.

Audit, so patients and regulators can establish who accessed a record. Identity matching, where errors merge two patients' records or split one — which is a patient safety problem as much as a privacy one.

Inappropriate access is the realistic threat

The characteristic failure is not an external breach but a clinician looking up a record they had no reason to see — a neighbour, a colleague, a public figure. Exchange participation widens the population of records reachable that way considerably.

Which makes access monitoring and periodic review the control that matters, alongside role-based restriction. Several jurisdictions treat this as a reportable breach regardless of what the person did with the information.

Participation agreements carry obligations

Joining an exchange means accepting terms about security controls, incident notification, audit cooperation and permitted use. Those obligations are frequently signed at an executive level without technical review.

They also work in both directions: your organisation's breach becomes a notification obligation to the exchange and its participants, which is worth understanding before it happens.

Interoperability standards and their security assumptions

Modern exchange rests on interface-based standards that assume authentication, authorisation and transport security are handled correctly by each participant. The standard specifies the data exchange, not how strictly you check who is asking.

Which means implementation quality varies widely between participants while the data format is identical. For an organisation joining an exchange, the security question is about the weakest participant rather than about the standard. See API security.

Where to start

Establish whether access to records obtained through exchange is logged and reviewed. Inappropriate internal access is the realistic risk, and monitoring is the only control that addresses it.

See HIPAA. GuardsArm delivers HIPAA compliance.