When an AI Agent Has the Same Data Rights as Your Doctor

Most companies building AI for healthcare run into the same obstacle, and it isn’t the model. It’s the electronic health record. The data lives there, the clinical workflow lives there, and getting a third-party tool to plug in and actually work is where things stall. So it was worth hearing from someone who helps write the rules for that chokepoint.

Jeff Smith is at ONC, the office at HHS that certifies electronic health records and shapes how AI reaches clinical care. He’s the first government official we’ve had on the show. He isn’t selling a product; he’s shaping the rules of the game. And he’s doing it at a moment when those rules are in real flux.

The “user” redefinition

The change that deserves the most attention might seem like inconsequential semantics if you don’t listen closely, but it packs a punch. ONC’s proposed HTI-5 rule clarifies that “access and use” of health information includes automated technologies, including robotic process automation and autonomous AI systems. Smith’s framing: “it doesn’t matter if it’s a human trying to access and exchange and use or a robotic process automation or agent. Those things should still be able to engage with the electronic health information.”

Put plainly: if an EHR blocks an authorized AI agent from reaching data, that’s information blocking, the same violation as blocking a patient or a clinician. We’ve spent a decade litigating whether humans can get their data out. We’re now starting to ask whether the software acting on their behalf has the same right.

The direction reverses (maybe, and in the future)

For years, interoperability meant getting data out of the EHR. Smith is raising the opposite question: is it information blocking to prevent data from being written back in? The standards already allow it. FHIR supports create, update, and delete. But as Smith pointed out, “the current regulations right now, as they stand, are very much focused on the capability to read and search.” That gap between what the technology can do and what certification requires is where a lot of the next few years will play out, from wearables writing in glucose data to AI-drafted notes flowing back to the chart.

The limits

What kept the conversation grounded was Smith’s candor about what a regulator can and cannot do. ONC certifies EHRs, but certification is voluntary. CMS is the agency that incentivizes how the technology gets used. “We can make the certified technology be capable of handling all of the USCDI data elements,” Smith said, “but we can’t make providers share that information.” His conclusion is that the real lever is coordination across ONC, FDA, CDC, and CMS, not control from any single one.

Steve put the tension bluntly: technology moves at warp speed, government at snail speed, and the two are incompatible. Smith didn’t argue the point. His answer was that the goal is regulation that is “fit for purpose,” cognizant of where the future is arriving fastest. Or, in the line that closed his thinking: the future “is now, but it’s not evenly distributed. And the same is very true of care.”

For health system leaders, the practical message is uncomfortable but clear. Nobody is going to hand you a finished rulebook. Governance of the AI already running in your EHR is landing, to a real degree, on you.

Listen to the full conversation: https://practicalaiinhealthcare.com/episodes/#S1E40

You Might Also Enjoy

• S1E27 with Charlie Harp — Harp argues that data quality itself is an interoperability issue, a natural companion to Smith’s information-blocking framing.
• S1E30 with Amy Price — Price’s work on participatory medicine and AI governance comes at the same access questions from the patient’s side.
• S1E33 with Edward H. (Ted) Shortliffe — Shortliffe’s long view on clinical informatics gives historical context to where health IT policy is heading next.