Hospital Use of APIs to Enable Data Sharing Between EHRs and Apps

The 2020 ONC Cures Act Final Rule implements provisions of the 21st Century Cures Act to require secure access to patient health information through application programming interfaces (APIs), with the goal that more patients would be able to access and engage with their health information through software applications (apps). These requirements include a new ONC Health IT Certification Program Standardized API criterion that went into effect at the end of 2022.

This data brief highlights findings from the 2020 (fielded in 2021) and 2022 American Hospital Association (AHA) Information Technology (IT) Supplements to measure, after the publication of the 2020 ONC Cures Act Final Rule, the proportion of non-federal acute care hospitals using patient and provider-facing APIs to share data with apps to enable patient access, submission of patient generated health data (PGHD), and inform clinical practice. The 2022 AHA Health IT supplement contained new questions to assess hospital use of APIs to enable clinician apps to write data to and read data from the EHR, as well as read non-EHR data. Descriptive statistics for these questions are presented for the first time below.

Highlights

• Nine in ten hospitals used APIs to enable apps to grant patient access to EHR data, and 6 in 10 used APIs to allow patients to submit data through apps.
• More than two-thirds of hospitals reported using a HL7® Fast Healthcare Interoperability Resource (FHIR®) API to enable patient access to data in 2022, an increase from the prior year.
• Four in five hospitals used APIs to enable apps to write data to the EHR and read EHR data, respectively. Half of hospitals used APIs to enable apps to read non-EHR data.
• Despite year over year improvements, disparities persist among hospitals’ use of APIs to enable interoperability when stratifying by EHR developer, hospital size, and hospital system affiliation.

About 9 in 10 hospitals reported using APIs to support patient access through apps, and about 6 in 10 reported using APIs to enable patient generated data submission through apps.

Findings

• More than two-thirds of hospitals reported using a HL7® Fast Healthcare Interoperability Resource (FHIR®) API to enable patient access to data in 2022, an increase from the prior year.
• 69% and 45% of all non-federal acute care hospitals reported using standards-based APIs (either alone or alongside another API) to enable patient access and patient generated data submission, respectively. This accounts for a large majority of hospitals that use patient APIs to enable these functionalities. The data do not offer the granularity to distinguish the types of data patients could access or submit using these APIs.

Figure 1: Percent of all non-federal acute care hospitals that reported using APIs to enable patient access and data submission from an app, 2022

2 in 3 hospitals reported using a FHIR API to enable patient access to data through apps in 2022, representing a year-over-year increase of 12 percentage points.

Findings

• Hospital use of a FHIR API to enable patient access to data increased notably between 2021 and 2022, but hospital use of only a non-FHIR API for the same purpose and any API to support patient generated health data (PGHD) submission stayed nearly level.
• One in six hospitals did not use a FHIR API to enable patient access to data through apps in 2022.

Figure 2: Percent of hospitals that reported using APIs to enable patient access and submit patient-generated data to apps, 2021-2022

The percentage of hospitals offering patient access to health information through apps using a FHIR API has increased year-over-year across all stratifications of hospital and health IT characteristics.

Findings

• Hospitals using a market leading (top 3) EHR, that are large, or system affiliated consistently reported patient access to data using a FHIR API and support of patient generated data submission through any API more frequently than their counterparts.
• Use of a FHIR API to enable patient access grew faster among hospitals that are small, compared to larger hospitals (by 13 versus 10 percentage points).
• Use of a FHIR API to enable patient access grew slower among hospitals using a non-market leading EHR than hospitals using a market-leading EHR (by 6 versus 9 percentage points) and slower among independent hospitals compared with system-affiliated hospitals (7 versus 14 percentage points).

Table 1: Percent of hospitals that reported using APIs to enable patient access and submit patient-generated data to apps by hospital and health IT characteristics, 2021-2022

Among all hospitals, about 4 in 5 reported using APIs to enable clinician-facing apps to write data to the EHR and read EHR data, respectively, and half reported using APIs to enable apps to read non-EHR data.

Findings

• Although about the same number of hospitals reported using APIs to enable apps to write data to the EHR and read data from the EHR, more hospitals reported using only standards-based APIs to enable apps to read compared to write.
• Most hospitals reported using non-standards based APIs alone or in tandem with standards- based APIs across all API functionalities.
• The survey data provide no specific insights into the types of data hospitals share with apps through these APIs.

Figure 3: Percent of all non-federal acute care hospitals that reported using APIs to exchange data with apps, 2022

Among hospitals that enable data sharing with apps, they report a mix of methods to support these functionalities

Findings

• Among the three methods of data exchange with apps (standards-based APIs, proprietary APIs, and data integrator service) reported by hospitals, they reported any use of standards- based APIs at the highest rate. The survey did not contain questions to assess the share of data exchanged via each method or the exact types of data being exchanged.
• Half of all hospitals enabled apps to read EHR data using standards-based APIs only. About 1 in 3 enabled apps to write to the EHR and read non-EHR data using standards-based APIs.

Figure 4: Among those that enable each capability, the percentage of hospitals that report each method to enable apps to write data to the EHR, read EHR data, and read non-EHR data.

Hospitals using a market leading EHR, as well as those that are larger in size or system affiliated, more frequently reported using APIs to enable apps to write data to the EHR, read EHR data, and read non-EHR data.

Findings

• The largest disparities in hospital adoption of APIs to enable apps to write data to the EHR, read EHR data, and read non-EHR data functionalities exist for hospitals using a non-market leading EHR, as compared to those using one of the top 3 EHRs by market share.
• Regardless of health IT and hospital characteristics, fewer hospitals reported using APIs to enable apps to read non-EHR data, as compared to reading and writing EHR data to and from apps.

Table 2: Percent of hospitals that used APIs to enable apps to write data to the EHR and read EHR and non-EHR data, by hospital and health IT characteristics, 2022

Summary

The Centers for Medicare & Medicaid Services (CMS) EHR Incentive Programs, launched in 2011, led to nearly all hospitals storing healthcare data in an electronic format, but the ability to access that data through interoperable external apps is not as ubiquitous1,2,3,4. One of the goals of the 21st Century Cures Act in 2016 was to build off of the successes of these programs to improve electronic health information exchange to increase patient and provider access to and engagement with data5. The 2020 ONC Cures Act Final Rule (Cures Rule) included provisions to improve interoperability between EHRs used by hospitals and apps used by patients and clinicians through use of standards-based APIs, with a specific focus on the ability for apps to read information from the EHR. Our findings from the 2022 AHA IT supplement data indicate broad use of apps to inform care delivery and to connect patients to their electronic health information. However, the data show mixed use of methods to interoperate between EHRs and apps, including proprietary and standards based EHR APIs, as well as big differences in app and API use across hospital characteristics.

In 2022, 4 in 5 non-federal acute care hospitals used an API of any type to enable patient access to their health information through an app. About 70% of hospitals enabled access to patient data through a standards-based API. These APIs largely meet the specifications of the “Standardized API for Patient and Population Services” certification criterion, which adopts the FHIR and USCDI standards to standardize the API interaction and payload. Fewer hospitals reported providing patients the ability to submit patient generated health data from an app (61%), but most reported enabling this through a FHIR app. The results show wide use of APIs and apps to enable these patient-facing services, but the survey data limits our understanding of the exact types of data patients may submit through an app. Furthermore, the survey data do not provide insight into the share of data exchange or types of data exchanged across standards-based and non-standards-based APIs.

Hospital use of patient APIs for data sharing has increased year-over-year. Regardless of hospital and health IT characteristics, hospital use of a FHIR API to grant patient access to data through apps increased by 12 percentage points between 2021 and 2022. In comparison, exclusive use of non-FHIR APIs did not increase for several hospital types and only increased by 2 percentage points overall. Use of any API to allow patients to submit patient-generated health data (PGHD) to apps increased by 5 percentage points. However, this trend was not consistent across all groups of hospitals when stratifying by hospital and health IT characteristics. No statistically significant increases in use of any API to submit PGHD were observed for hospitals using non-market leading EHRs or for independent hospitals.

We also measured hospital use of clinician APIs, specifically, for the first time in 2022. Four in five hospitals reported use of APIs to enable apps to write to the EHR and read EHR data, respectively, and about 1 in 3 used standards-based APIs to support these functionalities. A smaller portion of hospitals reported use of APIs to enable apps to read non-EHR data (1 in 2), and 17% of all hospitals reported use of standards- based APIs for this purpose. Of note, hospitals were modestly less likely to report using a standards-based API to write data to the EHR than to read data from the EHR.

A notable portion of hospitals using clinician APIs to enable apps to write data to the EHR (36%), read EHR data (45%), and read non-EHR data (36%) used only a standards-based API for these purposes. Another substantial percentage of hospitals used a standards-based API alongside one or more other methods to enable these same functionalities, but limitations in the data make it difficult to distinguish the share of data exchanged via standards and non-standards-based APIs among hospitals that use both. Overall, there is a mix of APIs and methods used by hospitals to support these capabilities through apps.

Despite overall advancements in hospital use of APIs after the Cures Rule, hospitals that use a non-market leading EHR, that are smaller, and that are not system affiliated trail behind their counterparts in use of APIs for interoperable exchange. We note that these hospitals are less likely to use a FHIR API for patient access and any API to enable PGHD submission compared to their counterparts, as well as to enable apps to read EHR data, write data to the EHR, and read non-EHR data. This trend is something we intend to follow as part of future AHA surveys and the continued implementation of Cures Rule requirements.

An overwhelming majority of hospitals have adopted APIs to allow patient access to data and enable clinician-facing apps to share data with the EHR, indicating some initial successes to advance API adoption and use and pave the way for further interoperability. However, we highlight challenges faced by some hospitals to use these APIs to enable more efficient information exchange. Future data collection and research will aim to provide further insight into the types of data exchanged between EHRs and apps, as well as further understand hospitals’ barriers and needs to adopt and use this technology. This data shall inform work to further advance APIs to meet interoperability needs and overcome barriers.

Definitions

Interoperability: The ability of a system to exchange electronic health information with and use electronic health information from other systems without special effort on the part of the user.

Standards-based API: The application programming interface or API uses a standard or standards that provide known and consistent technical requirements to support data exchange and the content of the data being exchanged. ONC requires the Health Level 7 Fast Healthcare Interoperability Resources (FHIR) and ONC United States Core Data for Interoperability (USCDI) standards for the Standardized API for Patient and Population Services certification criterion.

Read EHR data: Providing data from a hospital’s EHR to third-party applications used by clinicians in the same hospital/health system, i.e. third-party applications are capable of reading data from the EHR. See Appendix Table A1.

Write to EHR: Integration of data from a third-party software into a hospital’s EHR, i.e. third-party software is capable of writing data to the EHR. See Appendix Table A1.

Read Non-EHR data: Providing data from sources other than the EHR to third-party applications used by clinicians at a hospital or health system. See Appendix Table A1.

Top 3 EHRs: The “Top 3” represent the three health IT developers with the most hospital clients. These developers are Cerner Corporation, Epic Systems Corporation, and MEDITECH. The market share is based off hospital responses to the 2022 survey.

Small hospital: Non-federal acute care hospitals of bed sizes of 100 or less.

System affiliated hospital: A system is defined as either a multi-hospital or a diversified single hospital system. A multi-hospital system is two or more hospitals owned, leased, sponsored, or contract managed by a central organization. Single, freestanding hospitals may be categorized as a system by bringing into membership three or more, and at least 25 percent, of their owned or leased non-hospital pre-acute or post- acute health care organizations.

Data Sources and Methods

Data are from the American Hospital Association (AHA) Information Technology (IT) Supplement to the AHA Annual Survey. Since 2008, ONC has partnered with the AHA to measure the adoption and use of health IT in U.S. hospitals. ONC funded the 2022 AHA IT Supplement to track hospital adoption and use of EHRs and the exchange of clinical data.

The chief executive officer of each U.S. hospital was invited to participate in the survey regardless of AHA membership status. The person most knowledgeable about the hospital’s health IT (typically the chief information officer) was requested to provide the information via a mail survey or secure online site. Non- respondents received follow-up mailings and phone calls to encourage response.

This brief reports results from the 2020 and 2022 AHA IT Supplements. Due to pandemic-related delays, the 2020 survey was not fielded until April 2021 to September 2021. Since the IT supplement surveys instruct respondents to answer questions as of the day the survey is completed, we refer to responses to the 2020 IT supplement survey as occurring in 2021. The response rate for non-federal acute care hospitals (N = 2,359) in the 2020 survey was 54 percent. The 2022 survey was fielded from July 2022 to December 2022 and the response rate for non-federal acute care hospitals (N = 2,541) was 59 percent. A logistic regression model was used to predict the propensity of survey response as a function of hospital characteristics, including size, ownership, teaching status, system membership, and availability of a cardiac intensive care unit, urban status, and region. Hospital-level weights were derived by the inverse of the predicted propensity.

Missing responses were removed from the sample for all weighted averages.

References

1. Vincent, Adam. EHR Incentive Programs: 2011 Meaningful Use Census. RTI International.2012.
2. Johnson C, Richwine C, & Patel V. Individuals’ Access and Use of Patient Portals and Smartphone Health Apps, 2020. Office of the National Coordinator for Health Information Technology. Data Brief: 57. 2021.
3. Pylypchuk Y., J. Everson. Interoperability and Methods of Exchange among Hospitals in 2021. Office of the National Coordinator for Health Information Technology. Data Brief: 64. 2023.
4. Office of the National Coordinator for Health Information Technology. National Trends in Hospital and Physician Adoption of Electronic Health Records. Available from: https://www.healthit.gov/data/quickstats/national-trends-hospital-and-physician-adoption-electronic-health-records. [2023 Apr 17].
5. United States of America. H.R. 34 – 21st Century Cures Act. [Internet]. Washington D.C.: Congress.gov; 2016 [2023 Apr 17]. Available from: https://www.congress.gov/bill/114th- congress/house-bill/34.

Acknowledgements

The authors are with the Office of Technology, within the Office of the National Coordinator for Health Information Technology. The data brief was drafted under the direction of Mera Choi, Director of the Technical Strategy and Analysis Division, and Vaishali Patel, Deputy Director of the Technical Strategy and Analysis Division.

Suggested Citation

Strawley C., Everson J., Barker W. Hospital use of APIs to Enable Data Sharing Between EHRs and Apps. Office of the National Coordinator for Health Information Technology. Data Brief: 68. 2023.

Appendix

Appendix Table A1: Survey question used to define data sharing functionalities

Appendix Table A2: Percent of hospitals that reported using FHIR and non-FHIR APIs to enable patient access to apps, 2021-2022

Appendix Table A3: Percent of hospitals by use of APIs to enable apps to read EHR data, write data to the EHR, and/or read non-EHR data.