The Trump administration and the US Centers for Medicare and Medicaid Services (CMS) have announced plans to begin building a new digital health information system, in collaboration with a growing list of private-sector companies. Dubbed the CMS Digital Health Ecosystem, the new program aims to make it easier for patients to access their own medical records and health data.

In a [1]press release announcing the plan, US Health and Human Services Secretary Robert F. Kennedy, Jr., claimed "bureaucrats and entrenched interests" have for decades blocked access to medical data. The CMS was more reserved in its [2]assessment , saying the problem was more rooted in "outdated infrastructure and disconnected data."

Government and private companies both have a bad track record for respecting privacy

For now, the CMS's initiative is still in its nascent stages. But the long-term goal is to enable a range of apps that will allow individual patients more control over who can access their medical data and when. The apps are broadly divided into categories including conversational AI assistants, "kill the clipboard" apps for eliminating paper forms, and apps for managing obesity and diabetes.

Companies said to have signed up as partners in the scheme include medical records giants Epic Systems and Oracle Health (formerly Cerner, which Oracle acquired in 2022); tech titans such as Amazon, Anthropic, Apple, Google, Microsoft, and OpenAI. For-profit healthcare and insurance providers like Citizen Health, Polygon Health, and UnitedHealth Group are also aboard, as are data networks including CommonWell Health Alliance, CRISP, and eHealth Exchange.

A full list of current signees, dubbed "early adopters," can be found on the [3]CMS website .

[4]

President Trump, speaking at a press conference at the White House on Wednesday, said "The benefits to millions of Americans will be enormous. We will save time, we'll save money, and most importantly, we'll save lives."

[5]

[6]

At the same press conference, officials assured Americans that once developed the system will be "strictly opt-in" and that "no centralized government database" will exist. However, the announcement has already raised concerns about security and data privacy among some quarters. The Electronic Frontier Foundation, for one, cautioned that trading in medical data can be a fraught proposition.

"Any initiative that proposes to collect sensitive data, particularly vast amounts of health information and medical records, must ensure that no one uses that information in ways people don't expect," Hayley Tsukayama, Associate Director of Legislative Activism at EFF, told The Register . "This goes double for partnerships between the government and private companies, which both have a bad track record for respecting people's privacy."

Balancing competing interests

CMS Administrator Dr. Mehmet Oz argued that any such concerns must be balanced with the pressing need to modernize aging healthcare systems. "For too long, patients in this country have been burdened with a healthcare system that has not kept pace with the disruptive innovations that have transformed nearly every other sector of our economy," he said in a statement.

The US already regulates medical data strictly. Most notably, the Health Insurance Portability and Accountability Act (HIPAA), passed in 1996, makes it a crime to wrongfully disclose patient medical information to unauthorized parties.

[7]

And yet, such incidents do happen. Earlier this year, US health insurance giant Blue Shield of California accidentally [8]let slip health data belonging to some 4.7 million of its members, thanks to a SNAFU involving Google Analytics and Google Ads.

In today's Digital Health Ecosystem press release, the Office for Civil Rights, a division of the US Department of Health and Human Services, assured Americans it understood these concerns, saying, "If an individual receives another individual's electronic protected health information in error, generally, OCR's primary HIPAA enforcement interests are ensuring that the affected individual and HHS receive timely HIPAA breach notification."

But HIPAA only applies to "covered entities," including health insurers, healthcare providers, and related services — not to patients themselves. One of the proposed uses of Digital Health Ecosystem apps is to allow patients to pass on their own data to new providers or resources, perhaps using QR codes or some other means, which presumably would be legal under HIPAA.

[9]

As described, there seems to be little to prevent patients from using their newfound freedom unwisely. Unscrupulous medical providers, cranks, and outright frauds abound, and making it easier to hand them your own data sounds dicey, particularly for those who are uneducated or suffering from mental conditions such as dementia.

Despite such concerns, dragging the US healthcare system kicking and screaming into the digital age has been a long-time goal of many players in both the public and private sectors. Owing to the healthcare industry's complex, fragmented, and market-driven nature, healthcare providers, in particular, have long been among the businesses most reluctant to upgrade their aging systems, with some even still preferring paper records.

For now, it remains unclear when Americans can expect the first changes envisioned by the Digital Health Ecosystem initiative to be implemented, and no formal timeline has been announced. ®

Get our [10]Tech Resources



[1] https://www.cms.gov/newsroom/press-releases/white-house-tech-leaders-commit-create-patient-centric-healthcare-ecosystem

[2] https://www.cms.gov/health-tech-ecosystem

[3] https://www.cms.gov/health-tech-ecosystem/early-adopters

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIrqRjSDfC_4SyVw9YQN8gAAAEw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIrqRjSDfC_4SyVw9YQN8gAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIrqRjSDfC_4SyVw9YQN8gAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIrqRjSDfC_4SyVw9YQN8gAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2025/04/23/blue_shield_leaked_info_google/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/publicsector&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIrqRjSDfC_4SyVw9YQN8gAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[10] https://whitepapers.theregister.com/