Transport, integration, and use are different states
Interoperability is often declared when two systems can exchange a document or call an API. That establishes transport. A safe receiving system must also parse the payload, understand codes and units, reconcile identity, preserve provenance, apply access policy, incorporate the information into workflow, and support correction. Each step can fail independently. A scanned summary may be readable but not computable; a structured result may carry a local code that changes meaning; an integrated medication list may duplicate discontinued therapies.
The 2023 US hospital survey makes this distinction measurable. Seventy percent of non-federal acute-care hospitals reported at least sometimes engaging in all four tracked domains: send, receive, find, and integrate. Only 43% did so routinely. Seventy-one percent said necessary external information was routinely available, while 42% said clinicians often used it at the point of care. These are self-reported hospital measures in one country, but the gap between availability and use is a useful engineering signal.
FHIR is a grammar, not a complete agreement
HL7 FHIR defines resources and interfaces for exchanging health information using established web patterns. Its normative foundation enables systems to represent objects such as Patient and Observation and to expose RESTful interactions. That common grammar is valuable, but base resources are intentionally general. Implementations still need profiles, terminology bindings, required fields, cardinality constraints, search behavior, version policy, and conformance testing for a specific use case. Two syntactically valid implementations can remain semantically incompatible.
A laboratory should therefore begin with an exchange contract. It names the decision supported, minimum dataset, source of truth, terminology and unit systems, permissible extensions, identifier rules, timestamp semantics, provenance fields, error responses, and service-level objectives. Test fixtures should include missing values, contradictory records, unit conversions, amended results, merged identities, revoked permissions, and late-arriving data. Conformance is demonstrated against these cases, not inferred from use of the FHIR label.
Identity and provenance are clinical safety functions
A perfectly coded result attached to the wrong person is not interoperable. Identity resolution must handle demographic change, transliteration, multiple identifiers, newborns, duplicate records, and jurisdictional constraints without relying on a universal identifier that may not exist. Matching policies need calibrated thresholds, human review for ambiguous cases, merge and unmerge procedures, and auditable correction. Error rates should be measured by subgroup and setting because naming conventions and data quality vary.
Provenance answers a different set of questions: who created or transformed the record, when, under which system and method, and whether it supersedes an earlier value. Derived variables should link to inputs and algorithm version. Clinical documents need author, attester, facility, and status. Audit logs record access and change, but should not be mistaken for proof that the underlying observation is true. Together, identity and provenance allow a recipient to judge fitness for a particular decision and to trace an error to its source.
Consent must be executable and understandable
Consent is frequently stored as a signed form while access decisions are made by unrelated application logic. HL7’s FHIR Consent resource models choices to permit or deny actions by recipients or roles for specified purposes and periods, including treatment, information sharing, and research. The resource remains at Trial Use maturity in FHIR R5, so local legal and technical validation is essential. Nevertheless, its structure illustrates the required dimensions: subject, grantor, grantee, purpose, data class, action, period, policy, and lifecycle status.
A usable consent service should show people what is active in plain language, allow granular changes where the governing law and care context permit, propagate revocation, and explain exceptions. Enforcement points must evaluate current policy rather than copy a stale flag. Every consequential decision should record policy version and reason. The architecture must also accommodate legal bases other than consent; pretending every processing activity rests on an individual toggle is neither accurate nor fair. HHS’s HIPAA access guidance, for example, establishes a right of access with a general 30-calendar-day response deadline, distinct from research authorization.
The long tail defines system quality
Exchange is strongest between organizations with resources and established relationships. In the 2023 US data, only 16% of hospitals reported sending summaries to most or all long-term and post-acute-care providers, and 17% reported the same for behavioral-health providers. Smaller, rural, critical-access, and independent hospitals also reported less routine interoperability than better-resourced peers. A design optimized for a tertiary network can therefore widen discontinuity at exactly the transitions where medication, functional, and behavioral context matter.
Equity requirements belong in procurement and testing. Systems should support low-bandwidth and intermittent environments, affordable implementation profiles, multiple languages and scripts, assisted access, and organizations without large interface teams. Data-minimization and segmentation controls must not render essential information invisible in emergencies. The OECD’s health-data-governance recommendation places availability for public-interest purposes alongside privacy and security, emphasizing that governance must enable responsible use rather than choose between access and protection.
Measure the handoff, not the interface count
A rigorous programme evaluates an end-to-end handoff. Technical measures include delivery completeness, terminology-conformance rate, identity-match precision and recall, latency, and policy-decision correctness. Operational measures include reconciliation time, information found without duplicate work, and failure recovery. Clinical safety measures include wrong-patient events, missed or duplicated medications, delayed escalation, and corrections reaching downstream copies. Patient measures include access, comprehension, consent changes honored, and burden of repairing records.
WHO’s digital-health strategy, extended through 2027, identifies interoperability, governance, equitable access, and workforce capacity as linked foundations. That linkage is decisive. An API can reduce friction, but only institutions, shared standards, trained users, and accountable policy turn exchange into continuity. The mature claim is not that a platform unifies all health data. It is that a specified information set moved between named parties, under a valid authorization, retained its meaning and provenance, and measurably improved a defined handoff.
Scope and limitations
The hospital statistics are US self-reported survey estimates and should not be generalized to other countries or interpreted as patient-outcome effects. FHIR conformance does not by itself satisfy local privacy, consent, medical-record, or cybersecurity law; the Consent resource cited is Trial Use. Legal bases and access rights differ by jurisdiction. The proposed measures are an engineering framework, not legal advice, and deployments require local clinical, patient, standards, security, and regulatory participation.
References
Source review: 20 August 2026. Quantitative values retain their original definitions, periods, and boundaries.
- 01Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023
Office of the National Coordinator for Health IT · 2024
healthit.gov ↗ - 02FHIR R4 RESTful API and base resource specification
HL7 International · 2019
hl7.org ↗ - 03FHIR R5 Consent resource
HL7 International · 2023
hl7.org ↗ - 04Health Data Governance for the Digital Age
OECD · 2022
www.oecd.org ↗ - 05Individuals’ Right under HIPAA to Access their Health Information
US Department of Health and Human Services · 2025
www.hhs.gov ↗ - 06World Health Assembly extends the Global Strategy on Digital Health to 2027
World Health Organization · 2025
www.who.int ↗