US Government and Tech Giants Team Up for Health Data Platform Launch

Published Date : 8/1/2025 

The U.S. Centers for Medicare and Medicaid Services (CMS), in partnership with the White House and over 60 leading health technology companies, is set to revolutionize how Americans access and manage their medical data. However, the initiative has raised concerns about privacy and data security. 

The U.S. Centers for Medicare and Medicaid Services (CMS), in coordination with the White House and more than 60 leading health technology companies, is embarking on a sweeping transformation of how Americans access and manage their medical data. There’s just one catch, critics say. And that is the initiative could significantly weaken privacy safeguards by extending medical data into commercial ecosystems not bound by the Health Insurance Portability and Accountability Act (HIPAA).

Technical shortcomings in app security, consent complexities, lack of auditability, and potential misuse for non-health purposes all contribute to concerns that the system may expose patients to harm rather than protection.

President Donald Trump announced the launch of this initiative during an event with company CEOs at the White House on Wednesday, promising that it will make it easier to access health records and monitor wellness. It was the Biden administration though which originally proposed a long-term vision for health IT modernization, but it is the Trump administration that has accelerated it toward a 2026 implementation deadline.

The core of this effort is the development of a nationwide interoperable platform that allows patients to retrieve and manage their health records through consumer-facing applications, many of which are owned or operated by private industry players such as Apple, Google, Amazon, and UnitedHealth Group.

Coinciding with Trump’s announcement, CMS announced its “voluntary blueprint for a modern health data exchange” that calls on companies to voluntarily adhere to a CMS Interoperability Framework that enables seamless, secure data exchange across disparate systems, with patients at the center.

Under this framework, applications must support identity-proofing standards, consent management protocols, and Fast Healthcare Interoperability Resources (FHIR)-based APIs that allow for real-time retrieval of medical data across participating systems. The goal, according to CMS Administrator Chiquita Brooks-LaSure, is to create a “unified digital front door” to a patient’s health records that are accessible from any location, through any participating app, at any time.

This unprecedented public-private initiative builds on rules first established under the 2016 21st Century Cures Act and expanded by the CMS Interoperability and Patient Access Final Rule. This rule mandates that CMS-regulated payers such as Medicare Advantage organizations, Medicaid programs, and Affordable Care Act (ACA)-qualified health plans make their claims, encounter data, lab results, provider remittances, and explanations of benefits accessible through patient-authorized APIs.

Finalized in 2020, the rule was criticized for lacking enforcement clarity and creating gaps in data security oversight. But with the new push toward third-party app integration, the stakes have grown exponentially.

Under the new CMS framework, patients will no longer need to log into multiple provider portals to access their health information. Instead, after completing identity verification at Identity Assurance Level 2 (IAL2) using credentials such as a verified mobile driver’s license (mDL) or a digital identity issued by a certified provider, users can authorize a participating commercial app to retrieve their longitudinal health records from across CMS-aligned networks.

These networks include hospitals, insurance companies, electronic health record vendors, and technology firms that voluntarily comply with CMS’s data-sharing standards. The transformation is being pitched as a revolution in digital health access.

One of the most prominent partners in the CMS health tech ecosystem is Clear, a biometric identity platform. Clear has positioned itself as a trusted provider of secure, reusable digital identity credentials compliant with NIST’s IAL2/AAL2 standards and is being integrated with leading health platforms such as Epic and Surescripts.

Company leaders hailed the CMS initiative as a way to “kill the clipboard” and give patients seamless control of their health data. But the growing reliance on commercial biometric platforms backed by CMS and the controversial Department of Government Efficiency (DOGE) has raised concerns among privacy advocates about surveillance risks and unchecked data flows.

ID.me, another key identity verification provider participating in the CMS initiative, has also positioned itself as foundational to the interoperability framework. The company touts its IAL2/AAL2-compliant digital identity wallet as a gateway to streamlined healthcare access. Through one-time verification, users can access a range of services across providers and government agencies without repeatedly proving their identity.

ID.me argues that its federated identity model can reduce patient record mismatches and administrative duplication, and claims that its platform improves access and equity by supporting underserved populations and offers adaptive verification methods including video chat and in-person enrollment.

While ID.me’s commitments to security, fraud prevention, and user privacy are emphasized, the company’s deep integration into federal systems has drawn scrutiny. Critics warn that the broader incorporation of such platforms into national healthcare infrastructure must be accompanied by enforceable oversight mechanisms to ensure civil liberties and user autonomy are preserved.

Beneath the private sector optimism over the CMS plan lies a host of unresolved questions and a thicket of privacy concerns that are growing louder as implementation nears. Chief among them is the regulatory gray area that surrounds many of the technology companies involved in the initiative.

While HIPAA governs data handling by covered entities such as doctors, hospitals, and insurance plans, many wellness apps and commercial technology platforms fall outside its scope. Once a patient authorizes the transmission of their health data to an app not directly controlled by a HIPAA-covered entity, that data may no longer enjoy the same protections.

Privacy advocates warn that this creates a dangerous loophole. Sensitive information such as reproductive health records, mental health diagnoses, genetic profiles, and substance abuse history could be downloaded into apps that do not clearly state whether or how they will use that data. Without strong enforcement mechanisms, these records could be repurposed for marketing, sold to data brokers, or used in ways that patients did not anticipate or fully understand.

The Federal Trade Commission (FTC), which has limited jurisdiction over deceptive data practices in the commercial sector, has brought enforcement actions against some health apps in recent years. But critics argue that piecemeal actions are no substitute for systemic regulation.

In 2023, the FTC fined GoodRx and Flo Health for sharing user health data with advertising platforms, including Facebook and Google, despite promises to keep that data private. Both cases demonstrated how easily consumer-facing health platforms can betray user trust, even when they display privacy policies that appear transparent.

In the case of the CMS initiative, the interoperability standards require participating applications to clearly describe their data use policies to patients before they consent. However, enforcement of these requirements falls to the app developers themselves, not to CMS or another centralized body. CMS requires applications to attest to compliance with the Interoperability and Patient Access Rule, but there’s currently no formal pre-certification or audit mechanism.

This fragmented oversight has led some experts to warn that the CMS model could result in a de facto commercialization of health data infrastructure. In effect, government-backed APIs could enable the mass migration of sensitive health data into the hands of private firms, many of whom have strong commercial incentives to monetize user behavior. Some apps may comply with the spirit of interoperability while simultaneously collecting metadata, location data, or behavioral data that can be analyzed for targeted advertising or algorithmic modeling.

Technical risks also loom large. While CMS requires API connections to meet certain encryption and authentication standards, academic studies have found that many health apps lack end-to-end security.

A study published in the Journal of the American Medical Informatics Association found that a significant number of mobile health apps failed basic security standards. Over 45 percent transmitted sensitive health data without encryption, and nearly a quarter lacked essential safeguards like access controls or session timeouts, leaving them vulnerable to breaches and unauthorized access.

The findings underscore the risks of integrating third-party apps into national health data platforms without strict oversight or enforceable security requirements. These vulnerabilities make apps ripe targets for malicious actors, especially if they become centralized points of access for consolidated medical records.

Compounding the problem is the issue of consent fatigue. As patients are bombarded with authorization requests, many may approve data sharing without fully understanding the scope or permanence of their decisions. And once data leaves the CMS-aligned environment and enters a commercial database, it may be impossible to revoke access or trace how that information is used downstream.

Complicating matters even further is the role of DOGE, which has had personnel embedded inside CMS during the development and coordination of this initiative. While framed as an effort to streamline agency operations and promote cross-agency alignment, DOGE’s presence inside CMS has raised significant questions about political interference, transparency, and data governance.

DOGE is staffed largely by political appointees with mandates to centralize data systems and push agencies toward “market-based efficiency models.” Its involvement in an initiative that grants unprecedented access to sensitive health data by private industry has drawn concern from both civil liberties organizations and former CMS officials.

Critics argue that DOGE’s influence could compromise CMS’s independence, particularly when it comes to decisions about which companies are included in aligned networks, how interoperability rules are enforced, and whether certain privacy protections are weakened in the name of efficiency.

Several watchdog organizations have called for a public accounting of DOGE’s role in shaping the CMS interoperability strategy, especially given the agency’s silence on whether it has implemented any internal firewalls to prevent undue influence or conflict. 

Frequently Asked Questions (FAQS): 

Q: What is the main goal of the CMS initiative?

A: The main goal of the CMS initiative is to create a nationwide interoperable platform that allows patients to retrieve and manage their health records through consumer-facing applications, making it easier to access and monitor health information.

Q: Who are the key partners in this initiative?

A: The key partners in this initiative include the U.S. Centers for Medicare and Medicaid Services (CMS), the White House, and over 60 leading health technology companies such as Apple, Google, Amazon, and UnitedHealth Group.

Q: What are the main privacy concerns associated with this initiative?

A: The main privacy concerns include the potential weakening of privacy safeguards, technical shortcomings in app security, lack of auditability, and the risk of data misuse by non-HIPAA-covered entities.

Q: How does the CMS Interoperability Framework ensure data security?

A: The CMS Interoperability Framework requires applications to support identity-proofing standards, consent management protocols, and FHIR-based APIs. However, enforcement of these requirements falls to the app developers themselves, not to CMS or another centralized body.

Q: What role does DOGE play in this initiative?

A: DOGE (Department of Government Efficiency) has had personnel embedded inside CMS during the development and coordination of this initiative. Critics argue that DOGE’s influence could compromise CMS’s independence and data governance. 

More Related Topics :