Patient-First Health Data

A practical approach to helping patients access and transfer the data behind their diagnostic reports.

Introduction

Patients need access not only to diagnostics reports most receive in their patient portal, but also to the original, underlying data behind them. Advances in analytical methods, scientific evidence, variant classification, treatments, and clinical trials can change what original data reveal and how they may be used, sometimes within months. Yet existing legal pathways work most predictably for clinical notes, test results, and summary reports, but are less clear for underlying imaging, pathology, and genomic files, particularly when a time-sensitive decision depends on them.

This whitepaper sets out the legal and practical basis for patient-directed transfer under existing law and proposes a minimum workflow that can be tested now. Implementation may show where clearer guidance is needed and whether any material barriers require targeted legislation.

The whitepaper is the first workstream in FCCT’s broader Patient-First Health Data Initiative. The initiative will test whether needed data can be identified, generated or obtained, and delivered to the right clinical or research recipient in time to act. Accompanying draft instruments translate the framework into forms for patient-directed release, recipient use, and institutional participation.

READ THE WHITEPAPER >>

REVIEW THE INSTRUMENTS >>

EMAIL US

Whitepaper: Contents
Executive Summary
The Patient Data Lifecycle and the Continuing Value of Underlying Data
Where the Patient Data Lifecycle Breaks Down
Patient Authority and Its Limits
Existing Models of Collection, Contribution, and Reuse
A Near-Term Mechanism: Patient-Directed Releases
Strategy for Patient-First Data Movement
Immediate Implementation and Learning Pathway
Safeguards for Release and Use
Conclusion
Patient-First Instruments
References and Authorities
Appendix

Executive Summary

Patients often make cancer care decisions under time pressure. Access to underlying data used to generate patient and clinician-facing reports is especially important for complex diagnostics, such as genomic sequencing, digital pathology, and advanced imaging, and a report was generated based on choices on how the data were processed and interpreted. As analytical methods improve and new evidence, treatments, and clinical trials emerge, the same data may support a different interpretation or reveal a new option when analyzed using different parameters or newer analytical techniques. Studies of genomic reanalysis and imaging second opinions show that this occurs in some cases, although not every review changes care. A patient-first system should therefore enable patients to obtain the data behind a report or direct them to a qualified recipient while that data can still inform a decision.

Data movement has two related stages: release from the institution or company holding the data and onward sharing after the patient has obtained or assembled them. At either stage, patients may direct their data to a chosen recipient for clinical care, research, or another lawful use. Existing law provides important but bounded patient authority at each stage. Once patients obtain a copy, the Health Insurance Portability and Accountability Act (HIPAA) generally does not govern their own act of sharing it, although other laws and recipient-specific obligations may apply.

Existing law permits release, but institutions need a practical process. Underlying files may be distributed across clinical, laboratory, imaging, and information technology systems, and standard portals may not support their formats or size. Some requests will require privacy, validation, contractual, or technical review. A standard request and workflow would give institutions a consistent way to conduct that review rather than starting over with each transfer.

A structured review by Future of Cancer Care Today (FCCT) provides a practice-based view of these conditions. Among 174 cases reviewed, tumor-sequencing information was absent, limited in scope, or not fully synthesized in 65 percent of assessable cases. Of 148 cases assessed for institutional coordination, 78, or 53 percent, required coordination across at least two institutions, with some involving as many as six. Some patients also did not know whether underlying files existed or how to request them. These findings are not population estimates, but they illustrate the fragmented informational and institutional environment in which patients must obtain and direct their data.

This paper proposes an implementation-first strategy. Standard instruments and a minimum transfer workflow can be tested now under existing law. Pilot evidence can then improve the process, inform guidance, and identify barriers that require legislation.

The Patient Data Lifecycle and the Continuing Value of Underlying Data

Health data passes through a lifecycle: it is generated through testing or care, interpreted in a report, held by one or more institutions, and sometimes transferred for further analysis or use. This paper focuses on digital source files and intermediate analytical outputs, not physical biospecimens. Where access rights apply, a patient-first system should allow patients to obtain or direct those files without locating every internal custodian or managing each technical step. The files should reach the chosen recipient in a usable form, with any terms governing later use or disclosure clarified.

Underlying data may retain value because both analytical methods and the evidence used to interpret results change over time. In an analysis of 10,189 cases across 33 cancer types, the computational method used to identify tumor mutations, and the strategy used to combine results from multiple methods, materially affected the detection of cancer-driver genes and clinically actionable variants (Garcia-Prieto et al., 2022). In another study, investigators repeatedly reanalyzed tumor-sequencing data from 2,219 patients over nine months. During that period, the available therapies changed, and revisions to tumor-mutation classifications altered treatment recommendations for 124 patients, or 6 percent (Fischer et al., 2022).

Source imaging may likewise support a different interpretation. At one cancer center, second-opinion review of 915 outside abdominal computed tomography and magnetic resonance imaging studies identified 88 confirmed interpretive discrepancies. The secondary interpretation led to a change in treatment for 42 patients (Virarkar et al., 2022).

Together, these studies show why the data behind a report may retain value after the report is issued. That value may become time-sensitive as evidence develops, treatment options change, or clinical trials open, close, or revise eligibility. Underlying data should therefore remain accessible and transferable as science advances and the patient’s circumstances evolve.

Limits of Access and Reanalysis

Access preserves the opportunity to ask new questions. It does not ensure that the original dataset captures the full disease, that further analysis will produce a definitive answer, or that a molecular finding will lead to clinical benefit. These limitations arise at three points: the specimen, the analytical method, and the translation of a finding into care.

An underlying dataset is only as representative as the specimen from which it was generated. In a multiregion study of four renal-cell carcinomas and associated metastases, 63 to 69 percent of somatic mutations were not detectable in every sampled region. The study was small and limited to spatial heterogeneity, but it illustrates a basic constraint: reanalysis can extract new information from retained data, but it cannot recover biological variation absent from the sampled material (Gerlinger et al., 2012).

Analytical results also depend on the assay, specimen type, and reporting method. Different tests may therefore produce discordant findings that require clinical review. Access to one dataset does not make it equivalent to every other test or specimen. Additional evidence appears in the Appendix.

Clinical benefit presents a further question. In the randomized phase 2 SHIVA trial, 195 patients whose advanced cancers had progressed after standard treatment received either off-label targeted therapy selected through a predefined molecular-matching algorithm or treatment chosen by the physician. Median progression-free survival did not differ significantly between the groups. Within the boundaries of the early matching strategy and limited treatment set evaluated, the trial showed that an alteration and a proposed drug match do not by themselves establish clinical benefit (Le Tourneau et al., 2015). Later retrospective analyses show how methods for classifying and prioritizing matches may change as evidence and treatment options evolve. Further detail appears in the Appendix (Kamal et al., 2018; Moreira et al., 2019; Petak et al., 2021).

These limitations clarify the role of access: to preserve the opportunity for qualified reanalysis, with findings used to guide care still undergoing clinical review.

Where the Patient Data Lifecycle Breaks Down.

The patient data lifecycle can break at three different points. Patients may not know which files exist or where they are held. Data holders may lack a standard process for locating and releasing them. Files that are transferred may arrive late, incomplete, or in a form the recipient cannot use. These problems are especially common when underlying files must move beyond institutions already involved in the patient’s care.

01Know what files exist

02Request and locate

03Transfer and confirm

04Use with appropriate safeguards

Figure 1. The patient data lifecycle. A transfer can break down because the patient does not know what files exist, the data holder lacks a standard release process, or the recipient does not receive complete and usable files.

Patient portals have made more records available to patients, although the information often remains spread across several systems. In 2022, 59 percent of adults diagnosed with cancer within the previous five years reported having multiple portals or online records, yet only 8 percent used a third-party application to organize information across them. Among portal users with a recent diagnosis, 29 percent downloaded information and 16 percent transmitted it to a third party. The study did not examine underlying files, but its national estimates document fragmentation from the patient’s perspective (Richwine, 2024).

Underlying files introduce additional barriers. Before a transfer can begin, an institution may need to determine what files were generated, where they are stored, which formats are available, and how they can be transferred securely. Without a standard request and workflow, this may require separate coordination among clinical, medical-records, laboratory, information-technology, and legal teams.

Imaging provides a concrete example. A 2018 study of 80 hospitals found that all offered imaging on compact disc, but only six offered email delivery and three offered portal access. At 47 hospitals, cine files, which contain moving-image sequences, were handled by a department separate from diagnostic radiology. The study assessed stated procedures rather than completed transfers, but it shows how access may depend on physical media, institutional knowledge, and coordination across departments (Lye et al., 2019).

Large genomic files present a related problem. In a study involving 19 pediatric patients, raw exome-sequencing files became available to researchers an average of 9.7 weeks after the clinical report. Manual checks and inconsistent patient identifiers added complexity and risk. Although the transfers were not patient-directed, the study illustrates the difficulty of moving large genomic files without a standard process (Swaminathan et al., 2018).

FCCT observed how these barriers appear to patients. In one case, a patient knew that tumor sequencing had been performed but did not know whether it involved broad DNA sequencing, RNA sequencing, or limited testing. After delays and repeated follow-up, the patient received a file described as sequencing data and an accompanying report. The case illustrates the gap between knowing that testing occurred and knowing what data were generated, how to obtain them, and whether the files received are complete.

In another case, a patient who had received a whole-exome sequencing report learned to request the underlying files only when a personalized-vaccine organization needed them for a feasibility assessment. The case shows how data generated for one diagnostic purpose may later be needed for a different assessment, and why patients may not know to request those files until another service identifies the need.

When care spans multiple institutions, no single holder may have the complete record, and delays can narrow the window for reanalysis, second opinions, clinical-trial evaluation, or later participation in registries and research. Release is therefore not enough: files must reach the chosen recipient on time, intact, and in a usable form. That is the measure of a patient-first process.

Patient Authority and Its Limits

Patient authority changes across the data lifecycle. The right to obtain one’s own records is broader than the right to require direct transmission to another recipient. Sharing after release presents a separate question governed by the information, recipient, and intended use.

HIPAA provides the principal federal right of access. Subject to specified requirements and exceptions, patients may inspect or receive protected health information in a covered entity’s designated record set, generally including medical, billing, and other records used to make decisions about them. A personal representative recognized under applicable law may exercise this right on the patient’s behalf, subject to verification of the representative’s identity and authority.

The Health Information Technology for Economic and Clinical Health (HITECH) Act provides a narrower right to direct transmission. When a covered entity maintains the information in an electronic health record, the patient may request an electronic copy and direct it to a designated person or entity. In 2013, the Department of Health and Human Services extended this right beyond electronic health records and electronic copies. The court in Ciox Health, LLC v. Azar struck down that expansion while leaving the patient’s right to obtain their own records intact. A HIPAA authorization generally permits a covered entity to disclose records to a third party. It generally does not require the entity to make that disclosure. Patients may therefore need to obtain and forward some records themselves.

Once patients obtain a copy, HIPAA ordinarily does not govern their own act of sharing it. Other confidentiality laws, consumer-protection requirements, contracts, privacy policies, and recipient-specific rules may still apply. A patient-first process should therefore support both release and onward sharing while clearly separating the data holder’s responsibilities from those of the recipient.

Existing Models of Collection, Contribution, and Reuse

Existing programs show that individual components of a patient-first data lifecycle, such as record collection for care, research contribution, electronic transfer, and shared analysis, are already feasible. What remains missing is a common process that connects these functions across clinical and research settings.

Citizen Health and PicnicHealth help patients collect records from multiple providers and organize them into longitudinal histories. CommonHealth and the Health app on iPhone allow patients to aggregate structured records made available by participating institutions and share selected information with trusted applications or, where supported, clinicians. These services can make fragmented records more usable for care, but their coverage depends on participating sources and available data types and generally does not extend to complete underlying imaging, pathology, or genomic files.

Patient-mediated collections can also produce structured data for further analysis. In a study of 1,011 patients with breast cancer, the Ciitizen platform used patient-authorized requests to obtain and structure medical records. In a 50-patient validation cohort, the extracted data achieved 97.6 percent precision and 81.5 percent recall and supported a separate clinical-discovery analysis (Nottke et al., 2024).

Other programs focus on research contribution and exchange. Count Me In and the National Institutes of Health All of Us Research Program illustrate participant-authorized contribution of health information to research. Sync for Science supports standards-based transfer of structured electronic health record data to researchers, while Open Humans allows participants to aggregate and share data from multiple personal sources. Additional research infrastructures are described in the Appendix.

The Angiosarcoma Project illustrates both the value of patient-partnered aggregation and the burden of case-by-case retrieval. During its first 18 months, 200 of 419 requested medical records were not received. By 2026, however, the project had assembled clinical data from 254 patients, 122 tumor RNA-sequencing samples, 94 tumor exomes, and 229 germline exomes (Painter et al., 2020; Chu et al., 2026).

These programs demonstrate that individual parts of the process are feasible. There is not yet a general process for patients to direct underlying files across institutions and to clinical or research recipients over time. The proposed release mechanism is designed to fill that gap.

A Near-Term Mechanism: Patient-Directed Releases

A patient-directed release is a standard process through which a patient obtains health information from a data holder or directs it to a chosen recipient. It makes existing legal pathways usable by specifying the requested information, authority, recipient, and transfer method. The process operates within existing access and disclosure rights. Terms governing the recipient’s subsequent use can be addressed in a separate agreement.

Evidence from imaging shows that patient-directed digital exchange can work. In a pilot at four academic medical centers, 2,562 patients used an internet-based personal health record to receive imaging studies and control access to them. Among the 448 survey respondents who identified a sharing method, 96.5 percent favored direct access, and internet users more often reported obtaining images without difficulty than compact-disc users. The low response rate and academic setting limit generalizability, but the study demonstrates patient-controlled imaging exchange within a defined network (Greco et al., 2016).

Raw genomic files have also been released, although usually without a standard process. A European study of 33 sequencing institutions in 21 countries found that 12 had received requests for personal access to raw genomic data. At least 28 requests were granted, with no reported rejections. Yet only one institution had a standard process, file formats varied, and most transfers relied on external hard drives (Narayanasamy et al., 2020).

Australian cancer-genomics programs show how such practices can become formalized. Interviews with participants and stakeholders found broad support for returning raw data upon request, although few patients or families had requested them. Drawing on its experience with four family requests, the ZERO Childhood Cancer Program developed an approved policy, participant guidance, a request form, and a nine-step release process (Nielsen et al., 2026; Barlow-Stewart et al., 2025).

Together, these examples provide a practical basis for testing a common release package across institutions and file types. A pilot should evaluate whether it produces transfers that are complete, timely, usable, and manageable for patients.

A Three-Track Strategy for Patient-First Data Movement.

Patient-first data movement can begin now under existing law. The immediate task is to test a common process, then use the results to determine where clearer guidance or targeted legislation is needed. The strategy has three complementary tracks:

Test standard request instruments and a minimum transfer workflow under existing law.
Translate pilot findings into clearer federal guidance and more consistent institutional, professional, and technical practices.
Pursue narrow legislation only for material barriers that implementation and guidance cannot resolve.

This sequence turns completed transfers into the basis for broader adoption and, where necessary, policy change.

Track 1: Standard Instruments Under Existing Law.

Track 1 focuses on execution under existing law: turning available rights into a repeatable release process. Institutions can continue to use their own forms when those forms adequately address the requested files, recipient, and transfer method. A standard package should fill any gaps and connect the steps.

The package is modular:

Instrument A supports the patient’s request to the data holder.
Instruments B and C govern onward use of de-identified and identifiable data.
Instrument D provides guidance for data with a higher risk of re-identification.

Instrument A identifies the patient, data holder, requested files, recipient, and transfer destination. When needed, Instruments B and C address permitted use, security, further sharing, retention, deletion, and public release. Keeping these terms separate allows the data holder’s release responsibilities to be addressed without conflating them with the recipient’s later use.

Minimum Transfer Workflow

At minimum, the workflow should:

verify the patient’s identity and authority to act, including the authority of any personal representative;
identify the requested files and where they are held;
specify the format and required metadata, including when and from which specimen or study the files were generated;
select a secure transfer method suited to the file type, volume, and recipient’s technical capacity;
confirm receipt, file integrity, and technical completeness; and
document any recipient obligations governing use, security, retention, deletion, and further sharing.

Technical completeness means only that the expected files arrived intact; it does not establish clinical suitability or validate a later interpretation. Pilots should test institutional and standards-based transfer methods across file types and sizes, using a reusable core with transfer-specific terms. Any provision for repeated transfers should define its duration, scope, and authorized recipients.

Track 2: Guidance to Support Consistent Implementation.

Track 2 should turn pilot findings into guidance that makes patient-directed releases more predictable across institutions. Guidance is needed in three areas:

Clarify which underlying files are covered. The Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) should clarify when underlying files qualify as electronic health information under the information-blocking rules. The U.S. Department of Health and Human Services Office for Civil Rights should explain how HIPAA’s designated-record-set standard applies to imaging, pathology, genomic, and other underlying files. Because these legal frameworks differ, the guidance should distinguish their scope and identify remaining uncertainties.
Provide a model release process. The Department of Health and Human Services should develop model language or a checklist for releases to recipients within or outside the treating team. The guidance should address privacy and security considerations for recipients outside HIPAA and explain how HIPAA de-identification methods can serve as reference standards without extending HIPAA to those recipients.
Set minimum technical expectations. Guidance should establish baseline practices for points of contact, file formats, metadata and provenance, secure transfer, and large-file handling. Clinical, technical, standards, health-information-management, and institutional organizations should help develop and implement these practices. Potential partners are identified in the Appendix.

Pilot findings should inform later guidance. Existing access obligations would continue to apply while the pilots are underway.

Track 3: Narrow Legislative Backstops.

Legislation should address only barriers that completed pilots show cannot be resolved through existing rights, guidance, or changes in institutional practice.

Fill demonstrated gaps in access. If pilots show that patients cannot reliably obtain or direct defined categories of underlying files, legislation could establish an explicit right to receive or transfer those files in a usable format within a specified period, subject to defined exceptions.
Resolve documented liability barriers. If liability concerns prevent otherwise lawful transfers, legislation could protect data holders that act in good faith on a valid patient direction, verify identity and authority, and use reasonable safeguards. That protection should not extend to reckless conduct, willful misconduct, or failure to follow the patient’s instructions.
Address material state-law conflicts. Recipient agreements and state-specific addenda should be used first. Federal harmonization or preemption should be considered only if state-law differences materially prevent transfers or make a common process impracticable.

Immediate Implementation and Learning Pathway

Implementation should begin with a focused package and bounded pilots, then expand based on evidence from completed transfers.

Finalize the core instruments. Develop the institutional request and separate recipient agreements with counsel, patients and caregivers, data holders, laboratories, and prospective recipients. Initial legal review should focus on the jurisdictions, data types, parties, and uses involved in the first pilots, with state-specific addenda added as needed.
Launch bounded pilots. Work with willing cancer centers, laboratories, and other institutions to process patient-directed requests. Data should move directly from the holder to the patient or designated recipient, avoiding the need for an intermediary to take custody. For each request, record the recipient and intended use; whether and when the transfer was completed; the cause of any delay; whether the files were technically complete and fit for use; and the time, effort, and cost required of patients and institutions. The first pilots should identify where the common process works and where it stalls. They need not cover every possible transfer scenario.
Refine, then expand. Use the findings to improve the instruments, workflow, transfer methods, patient guidance, and recipient terms. Expand to additional institutions, file types, and recipients as the process becomes more reliable.
Address remaining policy barriers. Seek guidance on ambiguities documented through implementation. Pursue legislation only when a material barrier cannot be resolved through existing law, guidance, or a practical workflow change.

Building Toward Equitable Access

Equity should guide expansion without delaying the initial pilots. A nationally representative 2022 survey found that Black and Hispanic adults were less likely than White adults to report using a portal or being offered portal access. Among those offered or encouraged to use one, however, use did not differ significantly by race or ethnicity, suggesting that access opportunities remain uneven (Richwine, 2023).

Initial pilots should provide basic assistance and document where patients need additional support. As the process expands, it should incorporate language assistance, disability accommodations, caregiver and proxy pathways, technical support, and non-digital options. This approach allows testing to begin while building a process that more patients can use.

Safeguards for Release and Use

Recipient requirements should reflect the intended use. Research analysis and clinical interpretation may require different qualifications, and findings intended to guide care may require confirmation through a validated clinical process.

Privacy risk rises as data become more identifiable or broadly shared. Public disclosure is difficult to reverse because contractual terms cannot reliably prevent copying, linkage with other sources, re-identification, or redistribution. Genomic data warrant particular caution because they reveal biological relationships and may enable identification through relatives. Research using large consumer-genomics databases has demonstrated this possibility, although the findings were population-specific and did not involve clinical oncology records (Erlich et al., 2018).

Safeguards should be proportionate to the risks presented by the data, recipient, and intended use. The release process should pair lawful patient direction with clear notice, recipient-specific terms, stronger protections for identifiable or readily re-identifiable data, and clinical confirmation where appropriate. The safeguards should reflect the data, recipient, and intended use, including potential risks to biological relatives.

Conclusion

A diagnostic report reflects an interpretation at a particular point in time. The underlying imaging, pathology, and genomic files may remain useful as a patient seeks a second opinion, researchers ask new questions, or methods and evidence change. Yet patients may not know which files exist, where they are held, or how to transfer them.

This paper proposes a practical way to close that gap. Standard request instruments and a minimum transfer workflow would give patients and data holders a common process for identifying the files sought, the legal pathway for release, the intended recipient, and the transfer method. Separate terms would address the recipient’s subsequent use of the data.

The process can be tested now through focused pilots under existing law. Completed transfers can show where the workflow succeeds, where clearer guidance would improve consistency, and whether any remaining barrier warrants targeted legislation. Focused pilots can proceed under existing law without establishing a federal data repository or comprehensively revising health privacy law.

The longer-term aim is a health system in which data can continue to serve patients after the initial report. Where a legal pathway applies and the requested files are available, patients should be able to direct them to a chosen recipient through a reliable process that delivers them complete, on time, and in a usable form. Not every transfer will affect care. The aim is to keep information already generated available for later use as medicine advances, so that a failed transfer does not foreclose an opportunity for care or discovery.

Patient-First Instruments

Instrument A: Patient Health Data & Tissue Release

Provides a common form through which a patient may request or authorize the release of medical records, imaging, genomic and laboratory data, and, where available and permitted, pathology materials and biological specimens. It is designed to address the requirements for a valid HIPAA authorization under 45 C.F.R. & 164.508.

Download
Instrument B: De-identified Patient Data Use Agreement

Governs a recipient’s use of data intended for de-identified use. It requires de-identification using an agreed method before use or further disclosure and establishes terms for any public release authorized by the patient.

Download
Instrument C: Identifiable Patient Data Use Agreement

Governs a recipient’s use of data that remains identifiable. It addresses privacy and re-identification risks, patient review before publication, and the terms of any public release. Because public disclosure may be irreversible, the agreement is intended for use only after the patient has considered those risks.

Download

About Future of Cancer Care Today

Future of Cancer Care Today (FCCT), a non-profit incubated by the Sijbrandij Foundation, helps cancer patients and families organize case information, identify important gaps, explore options beyond standard care, and prepare for discussions with clinicians, all at no cost to the patient. This paper translates observations from that work into a testable framework for patient-directed data release.

References and Authorities

Empirical Evidence

García-Prieto CA, Martínez-Jiménez F, Valencia A, Porta-Pardo E. Detection of oncogenic and clinically actionable mutations in cancer genomes critically depends on variant calling tools. Bioinformatics. 2022;38:3181–3191. doi:10.1093/bioinformatics/btac306.
Fischer CG, et al. Artificial intelligence-assisted serial analysis of clinical cancer genomics data identifies changing treatment recommendations and therapeutic targets. Clinical Cancer Research. 2022;28:2361–2372. doi:10.1158/1078-0432.CCR-21-4061.
Virarkar M, et al. Clinical importance of second-opinion interpretations of abdominal imaging studies in a cancer hospital and its impact on patient management. Clinical Imaging. 2022;86:13–19. doi:10.1016/j.clinimag.2022.03.014.
Gerlinger M, Rowan AJ, Horswell S, et al. Intratumor heterogeneity and branched evolution revealed by multiregion sequencing. New England Journal of Medicine. 2012;366:883–892. doi:10.1056/NEJMoa1113205.
Kuderer NM, Burton KA, Blau S, et al. Comparison of two commercially available next-generation sequencing platforms in oncology. JAMA Oncology. 2017;3:996–998. doi:10.1001/jamaoncol.2016.4983.
Le Tourneau C, Delord J-P, Gonçalves A, et al. Molecularly targeted therapy based on tumour molecular profiling versus conventional therapy for advanced cancer: the SHIVA randomized phase 2 trial. Lancet Oncology. 2015;16:1324–1334. doi:10.1016/S1470-2045(15)00188-6.
Kamal M, Tarcic G, Dureau S, et al. Revisited analysis of a SHIVA01 trial cohort using functional mutational analyses successfully predicted treatment outcome. Molecular Oncology. 2018;12:594–601. doi:10.1002/1878-0261.12180.
Moreira A, Masliah-Planchon J, Callens C, et al. Efficacy of molecularly targeted agents in SHIVA01 according to the ESMO Scale for Clinical Actionability of Molecular Targets. European Journal of Cancer. 2019;121:202–209. doi:10.1016/j.ejca.2019.09.001.
Petak I, Kamal M, Dirner A, et al. A computational method for prioritizing targeted therapies in precision oncology: performance analysis in the SHIVA01 trial. npj Precision Oncology. 2021;5:59. doi:10.1038/s41698-021-00191-2.
Richwine C. Access and Use of Electronic Health Information by Individuals with Cancer: 2020–2022. ASTP Health IT Data Brief No. 73; August 2024. healthit.gov.
Lye CT, Forman HP, Gao R, et al. Assessment of U.S. hospital compliance with regulations for patients’ requests for medical records. JAMA Network Open. 2018;1. doi:10.1001/jamanetworkopen.2018.3014.
Lye CT, Krumholz HM, Eckroate JE, et al. Evaluation of the patient request process for radiology imaging in U.S. hospitals. Radiology. 2019;292:409–413. doi:10.1148/radiol.2019190473.
Swaminathan R, Huang Y, Miller K, et al. Transferring exome sequencing data from clinical laboratories to healthcare providers: lessons learned at a pediatric hospital. Frontiers in Genetics. 2018;9:54. doi:10.3389/fgene.2018.00054.
Nottke A, et al. Validation and clinical discovery demonstration of breast cancer data from a real-world data extraction platform. JAMIA Open. 2024;7. doi:10.1093/jamiaopen/ooae041.
Painter CA, Jain E, Tomson BN, et al. The Angiosarcoma Project: enabling genomic and clinical discoveries in a rare cancer through patient-partnered research. Nature Medicine. 2020;26:181–187. doi:10.1038/s41591-019-0749-z.
Chu H, Hollyer M, Borden BA, et al. Patient-partnered multiomics reveals the molecular architecture of angiosarcoma. Nature Communications. 2026;17:9032. doi:10.1038/s41467-026-75810-2.
Greco G, Patel AS, Lewis SC, et al. Patient-directed internet-based medical image exchange: experience from an initial multicenter implementation. Academic Radiology. 2016;23:237–244. doi:10.1016/j.acra.2015.10.012.
Narayanasamy S, Markina V, Thorogood A, et al. Genomic sequencing capacity, data retention, and personal access to raw data in Europe. Frontiers in Genetics. 2020;11:303. doi:10.3389/fgene.2020.00303.
Nielsen JL, Wakefield CE, McWhirter R, et al. Regulatory guidance for the return of raw genomic data to research participants: a qualitative interview study. Journal of Law, Medicine & Ethics. Published online 2026:1–12. doi:10.1017/jme.2026.10267.
Barlow-Stewart K, Courtney E, Cowley MJ, et al. Returning raw genomic data to research participants in a pediatric cancer precision medicine trial. npj Genomic Medicine. 2025;10:12. doi:10.1038/s41525-025-00470-y.
Everson J, Hendrix N, Phillips RL, et al. Primary care physicians’ satisfaction with interoperable health information technology. JAMA Network Open. 2024;7. doi:10.1001/jamanetworkopen.2024.3793.
Sinha S, Bedgood M, Puttagunta R, et al. Variation in pediatric and adolescent electronic health-data-sharing practices under the 21st Century Cures Act. Journal of the American Medical Informatics Association. 2023;30:2021–2027. doi:10.1093/jamia/ocad172.
Everson J, Healy D. Information-blocking trends following regulatory action. Journal of the American Medical Informatics Association. 2025;32:665–674. doi:10.1093/jamia/ocaf007.
Erlich Y, Shor T, Pe’er I, Carmi S. Identity inference of genomic data using long-range familial searches. Science. 2018;362:690–694. doi:10.1126/science.aau4832.
Richwine C. Progress and persistent disparities in patient access to electronic health information. JAMA Health Forum. 2023;4. doi:10.1001/jamahealthforum.2023.3883.

Legal and Policy Authorities

HIPAA Privacy Rule, 45 C.F.R. §§ 164.501, 164.502, 164.508, 164.514, and 164.524.
Health Information Technology for Economic and Clinical Health Act § 13405(e), 42 U.S.C. § 17935(e).
Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, 78 Fed. Reg. 5566 (Jan. 25, 2013).
CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports, 79 Fed. Reg. 7290 (Feb. 6, 2014).
21st Century Cures Act § 4004, 42 U.S.C. § 300jj-52; 45 C.F.R. pt. 171.
Ciox Health, LLC v. Azar, 435 F. Supp. 3d 30 (D.D.C. 2020).
HHS Office for Civil Rights. Individuals’ Right Under HIPAA to Access Their Health Information; Personal Representatives. Accessed September 7, 2026.
HHS Office for Civil Rights. Important Notice Regarding Individuals’ Right of Access to Health Records; Liability When Records Are Directed to a Third Party. Accessed September 7, 2026.
HHS Office for Civil Rights. Guidance on HIPAA De-identification; Health Information on Personal Devices. Accessed September 7, 2026.
ASTP/ONC. Information Blocking; Understanding Electronic Health Information. Accessed September 7, 2026.
Federal Trade Commission. Health Breach Notification Rule, 16 C.F.R. pt. 318.
Regulation (EU) 2025/327 on the European Health Data Space, O.J. L, 2025/327 (Mar. 5, 2025). EUR-Lex.
California Department of Health Care Access and Information. California Data Exchange Framework. Accessed September 7, 2026.

Selected State Authorities

California Confidentiality of Medical Information Act, Cal. Civ. Code §§ 56–56.37.
Washington My Health My Data Act, Wash. Rev. Code ch. 19.373.
New York Civil Rights Law § 79-l; Public Health Law art. 27-F; Mental Hygiene Law §§ 33.13 and 33.16.

Programs, Platforms, and Standards

Program websites accessed September 7, 2026.

Patient record collection and organization: Citizen Health; PicnicHealth; CommonHealth; Apple, Download Health Records and Share Health Data.
Research contribution and exchange: Count Me In; All of Us Research Program; Sync for Science; Open Humans.
Research infrastructure: Childhood Cancer Data Initiative; AACR Project GENIE; Genomic Data Commons.
Technical and trust frameworks: DICOM Standard; HL7 FHIR; GA4GH Products; CARIN Alliance Code of Conduct.

FCCT Internal Evidence

Future of Cancer Care Today. Case Records and Pilot Observations, March–August 2026. Unpublished internal materials.

Appendix: Additional Evidence, Policy Context, Implementation Partners.

This appendix provides supporting evidence and implementation context for the framework described in the main text.

Assay Variation and Clinical Benefit.

Different assays may produce different reports. In a nine-patient comparison of tissue-based and circulating tumor DNA tests, only 10 of 45 alterations detectable by both platforms were reported by both, and only 9 of 36 recommended drugs overlapped. Because the study compared separate tests rather than reanalysis of the same data, it could not establish which result was more accurate. It nevertheless shows why reports from different assays are not interchangeable (Kuderer et al., 2017).

Retrospective analyses of the SHIVA trial asked whether the strength of the alteration-treatment match affected outcomes. A 12-patient analysis associated functionally matched treatments with longer progression-free survival. A reclassification of 153 patients found no significant progression-free-survival difference across actionability tiers, but overall survival was poorest when treatment relied on an alteration type different from the one supported by prior evidence. A computational analysis of 113 patients would have ranked a different therapy first for 75 percent when considering 631 agents.

Because the alternative treatments were not tested prospectively, these retrospective analyses do not overturn the original trial result or establish that another treatment would have improved outcomes. They do indicate that analytical methods, evidence standards, and the available treatments can affect how findings are interpreted and prioritized (Kamal et al., 2018; Moreira et al., 2019; Petak et al., 2021).

Implementation Under Common Requirements.

Institutions can implement the same access requirements in different ways. A 2017 simulated-patient study of 83 highly ranked U.S. hospitals found variation in the records offered, delivery formats, costs, and processing times. The study examined stated procedures rather than completed transfers, but it illustrates how the same access right can be implemented differently across institutions (Lye et al., 2018).

Information that moves may also be difficult to use. In a 2022 survey of 2,088 U.S. family physicians, 23 percent reported that outside information was very easy to use, falling to 8 percent when it came from a different electronic health record vendor (Everson et al., 2024).

Implementation of the federal information-blocking rules has likewise varied. Ten pediatric health care organizations adopted different approaches to portal access, proxy accounts, and sensitive information under the same requirements (Sinha et al., 2023). Nationally, the share of hospitals reporting that they sometimes or often observed potential information blocking by any actor declined from 42 percent in 2021 to 27 percent in 2023. These reports reflect institutional perceptions, not adjudicated violations, and do not establish that regulation caused the decline (Everson and Healy, 2025).

Although these studies did not examine patient-directed transfers of underlying files, they document variation in how institutions implement common legal requirements. The findings support further work on operational guidance, standard instruments, and institutional adoption.

Comparative Policy Context.

Other jurisdictions show how common requirements can be paired with phased implementation. The European Health Data Space entered into force in 2025 and distinguishes exchange for care from secondary use for research and other purposes. Its requirements will take effect in stages beginning in 2029. Provisions addressing the primary exchange of medical images, test results, and discharge reports, together with secondary use of genomic and other omic data, follow in 2031. The treatment of some underlying and derived files will depend on implementing acts and technical specifications (Regulation (EU) 2025/327).

California’s Data Exchange Framework combines participation requirements with agreements, policies, and technical guidance. Patient-directed releases under existing law do not depend on either framework. Their approaches to common formats, phased implementation, and separate governance for care and reuse provide useful points of reference.

Related Data Models.

The National Cancer Institute’s Childhood Cancer Data Initiative and Genomic Data Commons, together with the American Association for Cancer Research’s Project GENIE, provide infrastructure for aggregating, harmonizing, governing access to, and analyzing research data. These infrastructures support downstream research uses. They do not create a general process for patients to direct underlying files across clinical and research settings.

Potential Implementation Partners.

The initial pilots should involve organizations with expertise relevant to the data types and transfers being tested. Agreement from every potential participant is not necessary at this stage. Potential contributors include:

Imaging: American College of Radiology and the Digital Imaging and Communications in Medicine Standards Committee.
Pathology and molecular data: College of American Pathologists and Association for Molecular Pathology.
Structured health-data exchange: Health Level Seven International.
Genomic and phenotypic data: Global Alliance for Genomics and Health.
Consumer-directed exchange and recipient trust: CARIN Alliance.
Health-information management and institutional adoption: American Health Information Management Association, American Hospital Association, and The Sequoia Project.

Partners should be matched to the data types, transfer methods, and recipients involved in each pilot. Testing can begin with willing institutions and the organizations most relevant to the initial transfers.

GET IN TOUCH WITH US

POORNIMA@SIJBRANDIJFOUNDATION.ORG