Disrupting the information order in health care: Institutions, policy regimes, and the value of data

This study analyzes how U.S. healthcare organizations view regulatory changes to the accessibility of patient health information as part of the 21 st Century Cures Act . Rulemaking for the Cures Act recommended a technical change that would enable vendors in the consumer marketplace outside the institutional context and special data protections of health care to gain access to private patient data. We examine organizational stakeholders’ comments during the Notice of Public Rulemaking to show how organizational actors both inside and outside of health care use the institutional values and relationships of health care versus the market to evaluate the impact of the technical change. Healthcare insiders use professional ethics and doctor-patient relationships to defend the status quo of data protections in health care. Outsiders, such as consumer health apps, use the logic of the market to try to disrupt established institutions in health care, challenging clinical control and use of patient information, as well as the institutionalized property rights and data protections of private health data. The technical change alone cannot disrupt and redistribute the control and value of patient data, but it creates an opening that enables outsiders to challenge the existing meaning and management of information in health care in the United States. • The 21 st Century Cures Act API Rule increases sharing of patient health information • Health apps outside healthcare can gain access to previously protected patient data • Healthcare insiders defend the status quo to protect patients and themselves • Tech company outsiders seek to disrupt the status quo to profit from patient data • Disruption to data governance challenges professions, privacy, and property rights