The large-scale digitization of medical data and widespread adoption of electronic health records (EHRs) in the United States provide researchers with the opportunity to use longitudinal data on participants from across their sites of care [1,2]. Yet, today, typical health care research efforts in the United States lack access to complete patient data [3-6]. US policy efforts, such as the 21st Century Cures Act and related regulations, have promoted approaches for exchanging health information among providers and payers, and with patients, including for purposes of facilitating data collection for research purposes [7-11]. To better understand existing and emerging approaches, we conducted a landscape analysis with the aim of informing researchers and policy efforts.

The capacity to conduct studies that extend beyond a single institution and are not confined to a limited network of health care providers is crucial. Without access to comprehensive data, researchers may overlook important information regarding participants’ prior health-related encounters, potentially resulting in biased outcomes [3-6]. The absence of complete data can also impede the feasibility of some kinds of studies, including those aimed at evaluating the long-term value of health care and those seeking a holistic understanding of participants’ health [12].

Data for most patients are fragmented across multiple organizations. In the United States, for example, a typical Medicare beneficiary sees a median of 2 primary care physicians and 5 specialists working in 4 different practices [13]. Beneficiaries with multiple chronic conditions have even greater levels of fragmentation. Studies that recruit patients of only 1 primary care physician will find that, on average, every 100 of their Medicare patients receive care from 53 different practices [14]. The effort required to access and link these data can be prohibitively large, even for studies enrolling only a small number of patients. Payer data also require substantial effort to collect. Patients may change health plans during a study period—one study found that 21.5% of members turned over each year [15]—further adding to the fragmentation and effort needed to assemble complete data.

The goal of assembling longitudinal patient data has long been recognized [2,16]. However, previous attempts to achieve this goal in the United States have failed. For example, one effort to create a patient-controlled “health record bank” closed due to limited enrollment [17]. Some health information exchange (HIE) organizations have assembled data from multiple health care providers within geographic regions, but many face challenges with sustainability [18]. National data exchange networks focus primarily on clinical care; their potential to facilitate data collection for research has not been examined.

We interviewed experts to identify the range of possible approaches that research teams might use to collect multi-institutional, comprehensive provider and payer data on patients enrolled in studies and to evaluate their benefits and limitations. By assessing the current landscape, this work ultimately aims to help research teams select among the options available to them for collecting data on their studies’ enrolled patients, help research teams prepare for emerging options, and inform efforts to further facilitate the complete collection of patient data for research.

Landscape analyses aim to comprehensively describe and map the current state of a domain of interest and provide an overview to inform decision-making [19-21]. This approach is particularly useful for rapidly evolving domains where formal literature may not reflect current practice or emerging innovations. This US landscape analysis had three objectives:

We focused on approaches that would support research studies in which patients provide consent for their data to be collected from multiple sources and used for research. This would include many kinds of clinical trials, implementation studies of clinical interventions, and observational studies. Approaches that do not require patient consent (eg, using data from a deidentified repository for population-level studies), involve a single source of data (eg, from one payer or one provider), or only make a narrow subset of the medical record data available (eg, clinical registries) were not included, as they would involve different research workflows.

We included health care providers and payers as data sources only because of their prevalent use in health care research studies; other sources (eg, wearables, social media, community-based organizations, and direct-to-consumer genetic testing services) were not included. We also excluded imaging data (eg, magnetic resonance imaging) because of differences in the technology and workflows needed to access these data compared with other data derived from health care encounters. We included approaches that addressed the following activities:

Approaches to identify patients for eligibility or recruitment into studies required separate research workflows and were out of scope.

We limited our scope to electronic approaches, particularly those that retrieve data using application programming interfaces (APIs) such as FHIR, because of their potential to facilitate data collection; paper- or fax-based approaches were considered out of scope. Additionally, only approaches that were considered by the research team or experts to be reasonably feasible for implementation within the next few years were included.

We identified subject matter experts (SMEs) through publications, recommendations from our professional network, and recommendations from other SMEs (ie, snowball sampling). We conducted each interview via videoconference and recorded all interviews, which lasted roughly 1 hour. If we had additional questions, we requested a second interview with the SME or exchanged follow-up emails. In some cases, 2 SMEs attended the same interview. Interviews were conducted between February 2024 and July 2025.

To prepare for the interviews, we prepared preliminary lists of approaches and evaluation criteria, and a table applying the evaluation criteria to each approach. The research team developed these based on its existing knowledge of the landscape. We also prepared an interview guide that covered our 3 objectives. Specifically, we asked SMEs to identify and describe in detail all existing and emerging approaches with which they were familiar for collecting provider and payer data for research, identify evaluation criteria for assessing these approaches, and evaluate the approaches based on the evaluation criteria. As SMEs had expertise with different approaches, we focused the discussion on approaches with which the SME was most familiar. For SMEs with broader knowledge of the landscape, we reviewed our preliminary lists of approaches and evaluation criteria, asked them to identify anything missing, and asked them about what policy or other health care system changes may influence the assessment of approaches. Finally, we asked the SMEs to identify relevant publications or other documents that should be reviewed to understand the evolving landscape of approaches. After each interview, we updated and refined our preliminary lists of approaches, evaluation criteria, and application of evaluation criteria to approaches. We continued interviewing SMEs until we achieved saturation in terms of evaluation criteria and approaches. We aimed to include at least 1 SME with detailed knowledge of each identified approach.

We used conventional content analysis to analyze the qualitative data [22,23], inductively identifying approaches, evaluation criteria, and applications of evaluation criteria to the approaches. For each interview, one research team member summarized key points discussed and extracted relevant quotes, and a second research team member reviewed each recording and the summaries and notes (RSR and NC). Both research team members had domain experience with EHRs and digital health. Differences were resolved by consensus. To generate overall findings, after each interview, we updated a working matrix that mapped evaluation criteria against approaches, noting areas of agreement, disagreement, and uncertainty across SMEs. For evaluation criteria, we compiled all factors mentioned by SMEs, grouped conceptually similar factors, and refined descriptions through discussion until we achieved a comprehensive list, aiming to exhaustively cover all important factors for assessing the benefits and limitations of the various approaches. Evaluation criteria were not required to be mutually exclusive. For approaches, we created detailed written descriptions that included technical details, workflows, and perspectives from relevant interviews. We then applied each evaluation criterion to each approach, synthesizing assessments from SMEs. We noted where SMEs provided conflicting assessments or expressed a lack of sufficient evidence or experience to make an assessment.

To ensure rigor and trustworthiness of our findings, we used the following methods during the analysis: 2 researchers independently reviewed recordings and summaries, resolving discrepancies through consensus discussion; SMEs were selected to include a range of perspectives (eg, technology developers, policy experts, and researchers); we reviewed our preliminary findings with SMEs who had broad knowledge of the landscape; and we continued sampling until we achieved saturation. Additionally, all authors have relevant domain expertise in EHRs, interoperability, and digital health, and contributed to interpreting technical content and synthesizing results.

We strengthened the rigor of our findings and supplemented our interview data by incorporating 3 types of documents suggested by SMEs into this analysis. First, we reviewed technical documentation (eg, FHIR implementation guides and Trust Exchange Framework and Common Agreement [TEFCA] policies) to verify and elaborate on technical details described by SMEs. Second, we reviewed gray literature sources (eg, blog posts and white papers) to understand emerging perspectives. Third, we reviewed relevant peer-reviewed publications to contextualize SME assessments. These documents helped confirm factual claims and provide supplemental information.

This study was reviewed and approved by both the RAND Human Subjects Protection Committee and the Mass General Brigham Institutional Review Board (IRB) as exempt. All written and audiovisual data were stored on secure servers accessible only to the research team. Verbal consent was obtained before conducting the interviews, which included permission for identifying the individual in the publication but not attributing any quote or information to any specific individual. We chose to identify SMEs to enhance transparency and allow readers to evaluate the credibility and relevance of our sources [24]. Participants were not compensated.

We interviewed 20 SMEs (Table 1). SME expertise covered a wide range of aspects relevant to this topic, including smartphone-based approaches, FHIR, and federal and state policy.

We achieved saturation by identifying 12 evaluation criteria (Table 2). We took an inclusive approach and included even those criteria that might be challenging to apply.

We identified 8 approaches, which achieved saturation within the scope of the study (Table 3 contains summary assessments; approaches are labeled 1 through 8; Multimedia Appendix 1 contains full application of all evaluation criteria to all approaches). Five are participant-mediated approaches (1-5), in which research participants are directly involved in retrieving their data. In the remaining approaches, which included study queries of existing data exchange infrastructure (6 and 7) and aggregated data sources (8), participants’ roles were limited to providing consent. Many SMEs emphasized the benefits of participant-mediated approaches because they leverage patients’ right of access to their own data. Four of those approaches required study participants to manually identify their sources of data and use the patient or member portals at each site (1-4). In contrast, the other approaches leveraged existing national qualified health information networks (QHINs), regional HIEs (also called regional health data utilities), or aggregated data sources to identify sites of care and pull data. For these latter approaches, SMEs stated that although providers and payers, as Health Insurance Portability and Accountability Act (HIPAA)–covered entities, are legally required to release data with patient consent, rigorous governance processes are often required because of concerns about liability from errors and the lack of financial incentives to streamline data sharing.

Three of the approaches we identified required study participants to access their patient and members’ portals to retrieve data using Substitutable Medical Applications and Reusable Technologies (SMART) on FHIR (Table 3; approaches 1-3). To avoid repetition, we describe the assessment of this component here. Benefits of this approach include the high availability of patient and member portals. Patient portals have become increasingly used since the COVID-19 pandemic and are required to support patient access to data via SMART on FHIR, which addresses security concerns and allows patients some granular control over their data. Payer member portals are also widely available, although usage rates are not known. Additionally, these approaches align with federal policy goals. Facilitating patient access to their own health data has been a primary policy objective and a driver of certification programs and functionality for many years [25,26] and continues to be a priority [27]. Some SMEs pointed to more recent plans by Centers for Medicare & Medicaid Services (CMS) to advance digital identity solutions in health care and were optimistic that substantial progress toward the use of single sign-on (SSO) to patient portals, and potentially member portals, was occurring as complex issues such as price transparency and antitrust issues were being addressed [26,28].

There are 2 limitations to relying on patient and member portals for collecting data for research. First, the burden on study participants to log in to each portal is substantial. Patients may not remember prior locations of care, may have trouble finding login information, or lack portal access at some locations, and may be unwilling to spend time registering. This may result in incomplete data. However, adoption of SSO technologies could reduce this barrier substantially and is part of the CMS Interoperability Framework [29-31]. Additionally, studies may need to rely on participants for the timing of data retrieval, which may introduce variability.

Second, approaches that rely on patient and member portals must register with FHIR endpoints and establish a searchable directory for participants. The process of registering varies by EHR vendor or, in many cases, by individual site. One SME described the challenges: “It’s kind of a nightmare. We rely on a combination of reaching out to providers where the data is really messy and communicating with the EHR vendors who are only partially motivated to have that information be correct.” One SME estimated that “maybe about 10% of providers actually care about this… make sure that [metadata] is correct.” A recent FHIR standard called “User-access Brands and Endpoint” is designed to help users locate their data sources but has not been widely adopted, although recent regulation requires certified EHR vendors to make endpoint lists available in FHIR format [32,33]. Support from vendors and providers is also variable: “Sending email into the void is a common thing.” Some vendors have needed to develop automated tools and dedicate teams to monitoring endpoints. Recent CMS commitments to “building a dynamic, interoperable national provider directory” may help address these barriers [34].

Payer member portals have their own unique challenge, such as a lack of compliance with FHIR standards, missing data fields, delays in making data available, and technical issues resulting in downtime. SMEs noted that only CMS-regulated plans are required to support individual access to payer data, and only a minority of commercial plans have opted to offer this service voluntarily, though several states have begun efforts to extend this requirement to all payers. Some SMEs suggested that, for payers operating both commercial and CMS-regulated plans, it would be technically easier to offer all their members access to their data, but some are investing substantial resources to make this service available only to members with plans that require it. Even for those that require it, SMEs suggested that many payers were not investing sufficiently, resulting in poor service: “They were more concerned about compliance and getting penalized. And now that they have done a shoddy job for 2 years and nothing has happened, they have developed comfort to say ‘whatever.’” SMEs hoped that when payers are required to share their data with other payers, they will also make that data available to individuals because the same FHIR endpoints would be used: “It is one thing when 5 or 6 app makers call you up and complain that your API is non-conformant but when 300 payers call you and complain I think it will probably be a different story.”

We identified 8 approaches that would facilitate research team access to data from multiple providers and payers for participants in US studies, and 12 evaluation criteria. There were clear benefits and limitations for each approach. Participant-mediated approaches have the major advantage of bypassing the need for complex governance and privacy management processes, but they burden the participant, require effort or costs for the study team, and have incomplete connectivity to data sources, especially payers. Approaches involving queries of data exchange infrastructure are robust in some regions but vary substantially in terms of the data available and their ability to support research, and they may be challenging to implement at a national scale. Aggregate data sources allow for queries of national-level data in a way that addresses privacy management and governance issues but have limits in the scope of data sources. The benefits and limitations of each approach will likely change as the landscape evolves, driven largely by public policy.

In addition to the three steps of our focus (identifying the location of the data, retrieving the data, and sharing the data with research studies), SMEs emphasized the value of a fourth step: preparing the data for research. Many SMEs emphasized the value of these services, including normalization, conformance testing, and quality checks. As FHIR is a relatively new format for health data, most researchers are not accustomed to analyzing it. Many researchers may benefit from working with organizations familiar with the data’s idiosyncrasies, and that can produce an analytic dataset tailored to the needs of the research project. There are active efforts to make FHIR data easier to validate [54] and analyze [55], which may mitigate this concern.

The value of synergies between payer and provider data (eg, leveraging payer data to identify and retrieve data from providers that a participant has visited previously) is only beginning to be explored and has the potential to provide a feedback loop in this process. For example, payer data can identify gaps in provider data and locations to target for data collection.

This complex landscape is the result of the fragmented structure of the US health care system, which produces the data used in research, wherein patients receive care from many different providers who use different EHR systems and are covered by different payers. Within this landscape, each research study will need to consider the best option to address its data needs within study budgets. Studies may consider multiple approaches to obtaining as complete a dataset as possible. For example, a study might use a participant-mediated approach for Medicare claims data in combination with working with a local HIE or aggregate data source for EHR data.

To our knowledge, this is the first study attempting to describe the US landscape of approaches to collect data from multiple providers and payers for research. Our results provide a comprehensive comparison of the benefits and limitations of each approach, allowing research teams to understand existing and anticipated future options and policymakers to target areas for improvement.

We found only 1 publication that discusses how a participant-mediated approach was used to collect data for a study [41]. Other studies may have used this approach but have not described or assessed it. Sayeed et al [37] assessed the potential for using FHIR standards for multiple research tasks, including collecting EHR data, as part of the People Heart Study. We did not find any assessments of the use of TEFCA IAS. HIEs and aggregated data sources have been used for studies involving consented patients, but we did not find a systematic examination of these approaches.

This study was limited to a US focus; the landscape in other countries regarding the collection of comprehensive data for research will likely differ and would be worth investigating in future work. Our data relied on SMEs and may not have included all relevant perspectives. The landscape of approaches is rapidly evolving, and some of our findings may become outdated, especially as new policies are implemented. Additionally, we did not conduct a systematic literature review, as our primary objective was to gather expert views to inform our analysis. However, we did review relevant literature identified by the research team and SMEs, who likely were aware of influential publications. Our scope was limited to one use case: the collection of provider and payer data for consented participants. We excluded other study workflows (eg, recruitment) and other types of studies (eg, population-level analyses of deidentified data).

Complex and evolving trade-offs exist among the approaches we identified for collecting comprehensive electronic health data for research in the United States. We did not find a clear “winner”—the optimal approaches will likely vary considerably based on factors specific to a study. Continued development, exploration, and evaluation of all approaches are warranted.

Policies supporting participant-mediated exchange could greatly improve those approaches by making FHIR endpoints more findable (eg, through a national public directory), making it easier for researchers to broadly register an app (eg, requiring a central location for all of an EHR vendor’s customers), and ensuring that FHIR APIs are conformant with standards (eg, automated testing). Conformance requirements for FHIR APIs and data standards are particularly needed for private payer endpoints and are more efficient than expecting each research team to deal with the data issues individually. Advances in digital identity and the use of SSO across providers and patients may facilitate portal signup and the ability for study participants to sign in and pull records. Ongoing conformance evaluation of FHIR endpoints and assessments of participant ability to find and share data from prior sites of care would help inform improvement efforts.

Policies may also support queries of the data exchange infrastructure. Some regional HIEs have demonstrated the feasibility and value of using their existing infrastructure to pull data for research [50,56-58]. These HIEs have distinct advantages, such as coverage of most relevant local data sources, familiarity with state and local privacy laws, established governance processes, and knowledge of their members’ data quality issues. Some are more advanced in supporting research than others, and there is room for additional innovation. Policies could support establishing HIEs in regions that lack them, developing more capabilities to support research, and facilitating the sharing of best practices and evaluation. National efforts to make data available for research are still in their infancy, and it is not clear if or how the trust issues among data holders can be resolved, especially considering recent litigation [59,60]. The IAS may be the most promising approach that uses the national networks, but it will require clarifying the liability rules for data holders when they respond to requests. Evaluations should assess retrieved data in comparison with data obtained using a treatment purpose of use.

As these approaches evolve, ongoing rigorous evaluation and benchmarking of the benefits and limitations of each approach would empower research teams to make better decisions for study data collection.