EHR interoperability: Standards, challenges, and solutions

EHR interoperability is the ability of electronic health record systems to exchange, interpret, and use patient data across platforms, providers, and care settings. EHR interoperability works at four levels, rests on shared standards such as FHIR and USCDI, and is enforced by federal information blocking rules.

Certified software is close to universal. ONC’s final data brief on hospital adoption put certified EHR use at 99.4% of non-federal acute care hospitals in 2024. Interoperability in EHR products lags behind that figure, so practices still repeat tests, chase medication histories, and re-key referral data by hand.

This guide is written for US private practices. Alongside the levels, standards, and 2026 rules, it includes a Practice exchange map. The map shows which rules bind a cash-pay med spa, a practice billing Medicare, and a multi-location group.

Key takeaways

EHR interoperability means systems exchange patient data and use it without re-keying, which goes further than one point-to-point interface.

HIMSS describes four levels of interoperability: Foundational, structural, semantic, and organizational.

The standards a practice meets most are HL7 v2, C-CDA, FHIR R4, Direct secure messaging, and USCDI, which lists the data elements to exchange.

The CMS Interoperability Framework is voluntary, and its criteria for CMS Aligned Networks took effect on July 4, 2026.

The Practice exchange map rule of thumb is simple: Information blocking covers licensed practitioners whatever their payer mix, while MIPS measures bind only MIPS-eligible clinicians.

Pabau, the all-in-one practice management system we build, keeps notes, consent forms, and before-and-after photos in one patient record for every exchange.

What EHR interoperability means for your practice

EHR interoperability means separate systems can exchange patient data and use it on arrival, while integration is a single connection built between two specific systems.

An EHR interface is one of those connections, such as a lab feed into your chart. Interoperability is what you get when shared standards let many interfaces behave the same way. Our guide to EHR integration workflows covers how individual connections get built.

Moving data is only the starting point. When a patient sees a specialist, the primary care record has to travel with them. It also has to arrive in a format the specialist’s system can read and act on. Without that, clinicians order tests already done elsewhere, miss medication histories, and rebuild care plans from partial information.

The cost of poor exchange shows up in ordinary places. Staff re-key referral letters, and the front desk phones another practice for a medication list. A clinician orders a test the patient had six weeks ago. Those hours rarely get measured in an independent practice until they surface as revenue leakage or patient complaints.

The four levels of interoperability

The Healthcare Information and Management Systems Society (HIMSS) defines four levels of interoperability: Foundational, structural, semantic, and organizational. Each level adds a layer between sending data and using it safely.

The HIMSS model is the most widely used framework for planning EHR interoperability. Most practices operate at level one or two.

Semantic interoperability of EHR systems is where small practices usually stall. LOINC names lab tests, SNOMED CT names clinical findings, and RxNorm names medications. When a practice codes with them, a result or prescription keeps its meaning in the receiving chart.

Organizational interoperability adds the governance layer: Data-sharing agreements, consent policies, and membership of a health information exchange (HIE). Certified EHR vendors deliver levels one and two. Levels three and four depend on decisions the practice makes, so your rung decides who has to act next.

What connected records change for providers and patients

Connected records put a patient’s medications, allergies, and recent results in front of the clinician at the point of care, preventing errors and repeat tests.

Safety is the clinical case. The operational case is just as strong, because a practice that cannot receive structured data from referring providers re-enters it by hand.

• Safer medication reconciliation: When the medication list travels with the patient, prescribers can spot dangerous interactions before writing the next prescription.
• Allergy checks that fire: An allergy recorded at another practice only triggers your EHR’s alert if it arrives coded. A scanned letter in the documents tab never reaches the interaction check.
• Fewer duplicate tests: A patient arriving at a specialist without lab results from primary care often gets retested. Shared records make those results visible instead.
• Faster referrals: A structured patient summary sent electronically beats a faxed PDF, and the specialist can triage it before the first appointment.
• Lower administrative burden: Staff spend less time on the phone chasing records when data moves between systems on its own. That time goes back to patient care.

Patients feel the change too. They fill in fewer repeat forms, and they can pull their own records into a health app. For practice managers, the operational argument usually lands hardest, because re-keying grows with every new patient.

EHR interoperability standards your practice runs into

The EHR interoperability standards a private practice meets most are HL7 v2, C-CDA, FHIR, Direct secure messaging, and USCDI.

Each one covers a different job. HL7 v2 carries lab messages, C-CDA packages referral summaries, and FHIR powers app connections. Direct moves documents between practices like secure email. USCDI, the United States Core Data for Interoperability, is ONC’s list of data elements that certified systems must exchange.

Vendors often list their standards, certification, and API details on one page, so these names are worth recognizing. The last column below shows which ones a small practice touches day to day.

Older standards, such as HL7 v2 on its own, still deliver lab results. They struggle with referrals and patient apps, which is why FHIR now sits at the center of the federal rules.

FHIR R4: The API standard behind patient data access

FHIR stands for Fast Healthcare Interoperability Resources, the HL7 standard that lets apps and other systems request patient data from an EHR through web APIs.

Older HL7 versions needed custom integration work for every connection. FHIR uses RESTful APIs, the same approach behind consumer apps, so connections are quicker to build. The full specification is published by HL7 International. Certified EHRs must expose FHIR R4 APIs under the 21st Century Cures Act.

So how do you get EHR data out? Patients use the certified patient access API, usually through an approved app or the practice portal. Practices have three routes:

• FHIR API: Pulls one patient’s structured record, for a referral or a connected app.
• Bulk FHIR: Exports data for a whole patient population, which suits analytics or a reporting partner.
• EHI export: Produces the full electronic health information (EHI) file for one patient or the entire database.

ONC required certified EHRs to offer the EHI export, without developer help, by December 31, 2023. That export is your exit route if you leave a vendor, so test it before you sign a contract.

EHR interoperability challenges in private practice

The biggest EHR interoperability challenges for a private practice are data silos, inconsistent standards, patient matching errors, interface fees, and security worries about outside connections.

The challenges of interoperability in healthcare look different at practice scale. A hospital has an integration team, while a five-clinician practice has a vendor support line.

• Data silos: When each site or discipline runs a separate system, records stay fragmented. One patient seen by a physician, a physical therapist, and a dietitian can end up with three records that never meet.
• Inconsistent standards and data quality: Two EHRs can both claim HL7 support and still implement it differently, which causes mapping errors on transfer. Free-text medication lists and uncoded diagnoses make it worse.
• Patient matching: Without a national patient identifier, systems match on name, date of birth, and address. A typo or a maiden name can attach a result to the wrong person or create a duplicate chart.
• Interface and API fees: Some vendors charge per connection, per app, or per interface. A solo practitioner cannot always justify the spend without a clear return.
• Privacy and security: Every new connection widens the attack surface, so each one needs a security review and an update to your HIPAA risk analysis. Documented safeguards are what make a connection defensible.
• Vendor information blocking: Some EHR vendors limit data portability to raise switching costs. The 21st Century Cures Act prohibits that under 45 CFR Part 171.
• Legacy systems: Older EHR installations may not support modern API standards at all. You either upgrade or add a middleware layer to bridge them.

How to choose a healthcare interoperability solution for a private practice

For most private practices, the best healthcare interoperability solution is the certified EHR they already have, connected to a health information exchange or Direct network.

A health information exchange (HIE) is an organization, often regional or state-run, that lets member providers query and share patient records under one governed agreement. Many states run HIEs that independent practices can join. Middleware such as Mirth Connect or Rhapsody earns its place only where a legacy system cannot be replaced yet.

The table pairs each challenge from the section above with its fix and the party that owns it.

Vendor choice is where most of this gets decided. Put these eight questions to any EHR vendor in writing. A specific answer is a pass, and a vague one is a fail.

1. Do you charge for FHIR API access or per-app connections? A pass is a published fee schedule.
2. Is your FHIR API read-only, or can approved apps write data back?
3. What format and price apply to a full-database EHI export if we leave? A pass names the file format and quotes the cost.
4. Does every clinician get a Direct address, and is it included in the subscription?
5. Which HIEs and QHINs do you connect to today, and at what cost?
6. Which USCDI version does your certified API support? A pass is version 3 or later.
7. What is your certification ID on the Certified Health IT Product List?
8. Can we export the audit log showing who viewed and changed each record?

If you’re comparing systems, our guide to the best EMR software ranks vendors on certification, API access, and export options.

Regulatory framework: ONC, CMS, and the 21st Century Cures Act

Information blocking is any practice likely to interfere with the access, exchange, or use of electronic health information, unless a law or exception allows it.

The rule binds three actors: Health care providers, developers of certified health IT, and health information networks or exchanges, per ONC’s information blocking guidance. Developers and networks face civil penalties of up to $1 million per violation. Providers face Medicare disincentives, such as a zero Promoting Interoperability score.

The CMS Promoting Interoperability Program attaches payment adjustments to specific measures. The data itself is standardized too. Under the HTI-1 final rule, certified health IT has had to support USCDI version 3 since January 1, 2026.

Read the table as a timeline. Each row is a rule, the date it took effect, and what it costs or requires.

The CMS Interoperability Framework and CMS Aligned Networks

The CMS Interoperability Framework is a voluntary CMS blueprint for health data networks and apps, with criteria in effect from July 4, 2026.

A network that meets the criteria can be listed as a CMS Aligned Network in the CMS National Provider Directory. CMS states on the CMS Interoperability Framework page that the effort is not intended to create new regulatory burdens. The criteria fall into five groups:

• Patient access and empowerment
• Provider access and delegation
• Data availability and standards compliance
• Network connectivity and transparency
• Identity, security, and trust

The technical bar is specific. A CMS Aligned Network must offer FHIR APIs built on the US Core implementation guide with USCDI version 3 or later. Chart notes come back as FHIR attachments, and FHIR subscriptions send encounter notifications. A record locator cuts query load across networks.

Sign-in must meet IAL2 identity proofing and AAL2 authentication, such as passkeys. Networks also keep HITRUST certification or an equivalent, which does not replace the HIPAA Security Rule.

For a practice, taking part stays optional. If your EHR or network joins, clinicians with verified credentials can retrieve records for treatment, and patients can share data from their apps.

CMS pledge categories such as Kill the Clipboard aim to replace paper intake with that data. One-year use cases added in July 2026 include Modern Scheduling, Real-Time Benefits, and Bulk FHIR.

2026 Promoting Interoperability requirements: What practices need to know

The CMS Promoting Interoperability category requires MIPS-eligible clinicians to report a set of measures each year, worth 25% of the final MIPS score.

Clinicians fall outside MIPS if they bill $90,000 or less in Medicare Part B allowed charges. The same applies at 200 or fewer Part B patients, or 200 or fewer covered services. For 2026, the measures still center on electronic prescribing, health information exchange, provider-to-patient exchange through FHIR APIs, and public health reporting.

The CY 2026 rule added three changes worth knowing:

• The Security Risk Analysis measure now needs an extra attestation that you acted on the risks you found.
• The High Priority Practices self-assessment uses the 2025 SAFER Guides.
• A new optional Public Health Reporting Using TEFCA measure counts toward the public health bonus points.

Compliance in 2026 comes down to four steps:

1. Confirm your EHR is certified to the current edition.
2. Enable the patient access API.
3. Report every required measure for the performance period.
4. Keep the supporting documentation for audit.

Check the current measure specifications on CMS.gov before you report, since they are updated annually.

Which interoperability rules apply to your practice

Your payer mix decides which interoperability rules carry penalties: MIPS measures bind only MIPS-eligible clinicians, while information blocking covers physicians and other licensed practitioners.

Two more facts shape the answer. Information blocking penalties for providers currently attach only through Medicare programs. CMS Aligned Network participation is voluntary for everyone.

HIPAA works differently. Under HHS rules, a provider becomes a covered entity only when it sends health information electronically in a standard transaction, such as an insurance claim. A strictly cash-pay med spa may fall outside HIPAA, though state privacy laws still apply.

The Practice exchange map below turns those rules into a plan by practice type. Find your row, then work left to right.

In practices we onboard, the first exchange problem is usually internal: One patient with a separate file at each location. Fix that row first, because every outside connection inherits whatever duplicates the internal record holds.

EHR interoperability in day-to-day practice

A common example of interoperability in healthcare is a referral summary that files medications and allergies straight into the specialist’s EHR, with nobody re-typing them.

These six scenarios show what changes once records move between systems on their own.

• Hospital network referrals: Epic and Oracle Health, formerly Cerner, are two of the largest EHR vendors in the US. Both use FHIR APIs to share patient summaries. The receiving clinician sees the referring notes, medication list, and recent labs before the appointment starts.
• State HIE data sharing: A cardiologist in a state with an active HIE can query the network for a patient’s recent emergency department visits. No phone call to the ED, no waiting on faxed records.
• Lab result automation: Practices connected to lab networks receive structured results directly into the patient record. The result maps to the correct field and triggers any configured follow-up workflow.
• Results across locations: A patient has bloods drawn at one site and sees a clinician at another site the following week. With one shared record, the result filed at the first site is already in the chart at the second.
• Telehealth integrations: Practices using telehealth software that connects to the main EHR document a video consult straight into the patient record. The next clinician sees it there.
• Patient-controlled health apps: Under the 21st Century Cures Act, patients can authorize third-party apps to pull their records from any ONC-certified EHR. Someone managing a chronic condition can gather records from several providers in one app.

Where EHR interoperability is heading

Three shifts will shape data exchange for private practices over the next few years.

TEFCA (Trusted Exchange Framework and Common Agreement) is the national framework for health data exchange across the US. The Sequoia Project, which coordinates TEFCA, lists 11 designated Qualified Health Information Networks (QHINs) as of October 2026. A practice whose EHR participates through a QHIN reaches exchange that was once limited to large hospital systems.

The CMS Interoperability Framework adds pressure from the app side, as covered above. Its use cases, such as Modern Scheduling and Bulk FHIR, push networks toward patient-facing FHIR access.

AI-driven data harmonization is being applied to the semantic problem at scale. Machine learning models can map inconsistent terminology, flag duplicate patient records, and normalize data from different coding systems with less manual review.

Value-based care data requirements are turning interoperability into a financial necessity. Payers increasingly tie reimbursement to outcomes data that only connected systems can collect. Practices that invest now are better placed to join alternative payment models as those expand.

How Pabau supports data exchange for private practices

Private practices carry the same data duties as hospital systems, without an IT department. Pabau solves the internal half of that problem first. In the practice management app, appointments, treatment notes, consent forms, prescriptions, and before-and-after photos sit in one patient record.

Digital intake forms capture structured answers from first contact, so referral letters start from data other systems can read. Pabau’s API, open to every customer, lets developers read and write appointments, patient records, invoices, and clinical forms. Over 30 native integrations come with every subscription, and Zapier or Make cover the rest.

Every location reads the same file, whichever practitioner the patient saw last. Your team stops re-keying intake data, and each outside exchange on your Practice exchange map starts from one complete record.

Keep one patient record ready to share

Pabau keeps notes, consent forms, and before-and-after photos in one patient record, with an open API for the systems you connect. See it with your own workflows.

Book a demo

Conclusion

Start with the Practice exchange map, not a vendor brochure. Your row tells you which rules carry penalties and which exchange route repays the setup time.

Then fix the internal record. A practice with duplicate files and free-text medication lists can’t reach semantic interoperability, whatever network it joins. Clean, coded data at intake moves you up the four levels faster than any new interface.

The trade-off is a few weeks of cleanup now against years of re-keying. Book a demo to see how Pabau keeps one patient record ready for every exchange route your practice needs.

Continue your research

Want to understand how EHR integration fits your practice’s tech stack? EHR integration workflows covers the connection points between practice management systems and external platforms.

Planning a move to a new system? EHR implementation walks through the stages, the data migration decisions, and the staff training that keeps a rollout on schedule.

Still pinning down the terminology? EHR meaning explains what an electronic health record holds and how it differs from an EMR.

Considering a move to paperless clinical records? Going paperless in your practice explains the workflow changes and compliance points involved.

Checking what a system should do before you buy? EHR features lists the capabilities worth testing in a vendor demo before you sign.

Frequently asked questions