Balancing the Need for Data Accessibility and Interoperability with Stringent Privacy and Security Requirements

In order for our patients to receive the best care possible, it is vital that their data is accessible and that we have well-established interoperability. However, with the sensitive nature of what we do, it is also just as vital that we maintain high privacy and security standards. So how do you balance these two, seemingly contradictory, standards?

We reached out to our wonderful Healthcare IT Today Community to ask — how do organizations balance the need for data accessibility and interoperability with stringent privacy and security requirements? Their answers are below.

Brittney Harrell, Head of Information Security at Nabla
Healthcare organizations shouldn’t view data accessibility and security as competing priorities; this means building security into the entire product lifecycle, from inception to production. Data accessibility in the uniquely complex healthcare system is a huge pain point, which means concepts like FHIR are vital for building privacy-by-design workflows. When you bring teams along for that journey, security becomes a shared responsibility, and proactive risk management becomes the foundation for responsible healthcare innovation.

Jeremy Carriger, Chief Information Security Officer at Arcadia
Healthcare organizations shouldn’t have to choose between interoperability and security. As data moves more freely across providers, payers, cloud platforms, and third-party applications, the focus must shift from restricting access to ensuring the right people have secure, governed access. Strong identity management, continuous monitoring, and clear governance policies enable organizations to support seamless data exchange without compromising patient privacy or system integrity.

The key is building security into interoperability rather than layering it on afterward. Organizations that embed security controls into APIs, vendor integrations, and data-sharing workflows can enable the collaboration required for better care while reducing the risk that expanded connectivity becomes an expanded attack surface.

Srinivas Attipalli, SVP, Head of AI & Data at Definitive Healthcare
As healthcare data becomes increasingly interconnected and AI is embedded into more workflows, balancing accessibility, interoperability, privacy, and security has become increasingly complex, and the potential to expose sensitive information is greater than ever. Organizations must continue to thoughtfully govern how data is maintained, accessed, and used, or risk eroding patient trust.

Achieving this requires more than technical interoperability standards such as FHIR and USCDI. The industry needs a pragmatic trust architecture: one that’s built on strong data and AI governance, clear data stewardship, transparent data practices, and controls that enable secure, responsible data sharing at scale as systems and technologies evolve.

Jenn Johnson, Chief Privacy Officer at LANES
Security and privacy should act as enablers of data accessibility and interoperability.

Interestingly enough, a lot of people think HIPAA is primarily a law about security and privacy. In reality, the bulk of HIPAA is about the interoperability and administrative simplification of health information within systems.

The Security Rule and the Privacy Rule were written to accompany the HIPAA code to ensure that as the use of digital technologies increases in healthcare, so does the safeguarding of that data in a manner that appropriately facilitates and protects the collection, use, and transfer of protected health information.

Scott Anderson, Chief Technology Officer & General Manager of Managed Services at Cantata Health Solutions
In behavioral health, where organizations must navigate stringent privacy requirements such as 42 CFR Part 2, the goal is not to limit access to data, but to ensure the right information is shared with the right people at the right time. Organizations can balance interoperability and privacy by giving patients greater control over how sensitive data is shared while embedding security safeguards directly into clinical workflows.

Striking this balance starts with moving away from all-or-nothing data sharing and adopting a more multifaceted approach to consent and access. Granular data segmentation allows organizations to align patient-directed consent with information sharing, ensuring sensitive data remains protected without interrupting care team access.

By automating these access controls within EHR workflows, organizations minimize human error and reduce friction in data exchange. They can expand clinical access and strengthen care coordination without adding risk.

Ron Cherry, Director, Cloud Cybersecurity & GRC at Nordic
Healthcare delivery depends on timely access to patient data, regardless of where care is delivered. And today, care can be delivered almost anywhere. The challenge is enabling that accessibility without expanding risk. Restricting access only makes healthcare delivery more difficult. Smarter controls driven by Zero Trust principles have proven to be an effective strategy.

Getting this balance right takes structured governance. Leaders across clinical, operational, and IT teams must work together to ensure security is embedded into every major technology initiative in a way that supports, rather than restricts, clinical workflows. Interoperability is a complementary solution, enabling more seamless access to the information clinicians need when and where they need it, through connected data infrastructures designed with both security and operations in mind. That only works when organizations build secure interfaces that reduce unnecessary risk and eliminate the need for workarounds.

Chirag Shah, Global Information Security Officer & DPO at Model N
Honestly, most access problems aren’t access problems; they’re leftover access problems. We give people what they need, then never take it back. The fix is boring but effective: least privilege, time-bound access, and an owner on every integration. Interoperability doesn’t have to mean permanent, wide-open pipes.

Vipin Varma, SVP and Head of Cybersecurity Practice at CitiusTech
Healthcare data is recognized as an invaluable resource by the entire ecosystem. Multiple new SaaS platforms and internal applications focus on monetizing & harnessing insights from integrated data from multiple sources. Moreover, this data is no longer accessed only by human personas. Applications, analytics platforms, and increasingly AI agents are interacting with sensitive information across hybrid environments. Security therefore must move beyond static permissions to context-aware and dynamic access controls that evaluate who or what is accessing data, from where, and for what purpose.

Liron Levy, Director of Product Management at AU10TIX
Healthcare organizations need to give clinicians and employees fast access to critical systems without treating every interaction as equally risky. A risk-based approach applies stronger identity checks at sensitive moments, such as account recovery or unusual access requests, while allowing trusted users to work without unnecessary friction.

Dr. Scott Schell, Chief Medical Officer at Cognizant
The future of healthcare depends on making data more available, not less. The challenge is ensuring that the right people, systems, and applications can access the right information at the right time without exposing organizations to unnecessary risk. Rather than viewing interoperability and security as competing priorities, leading organizations are designing both into their workflows through strong governance, standardized APIs, role-based access, encryption, and continuous monitoring. Accessibility succeeds when trust is designed into the exchange rather than added afterward.

Ben Winokur, Co-Founder and CEO at Subsalt
Data access has historically been confined to small groups of highly-privileged employees. AI fundamentally changes the requirements for data accessibility by expanding the possible demand for users to both new employees who use AI tools to do their work and agentic systems that are not easily analogized to employees in a role-based system. The existing mechanisms to provide expanded access, which tend to revolve around data request intake forms, committee reviews, and manual approvals, can’t handle the number and diversity of new requests.

So Health IT leaders are turning to established, but underutilized regulatory pathways to expand data access. Notably, this is driving new investments in data de-identification, which confers privacy compliance to all downstream data use cases. This helps organizations stand on firm, well-established legal ground while innovating at the technology layer.

Tabrez Naqvi, Director, Cybersecurity and CISO at Health Gorilla
Accessibility and security aren’t opposing forces; they’re both requirements the architecture must satisfy at once. Done right, security is what makes broad data sharing trustworthy enough to happen. You classify data so controls are proportional to sensitivity, exchange within governed frameworks like TEFCA rather than ad hoc, and enforce minimum-necessary access through strong identity. The goal was never ‘all data to everyone’. It’s the right data, to the right party, for a legitimate purpose.”

Rachel Dunscombe, CEO at Health Level Seven International (HL7)
Interoperability and security are often framed as competing priorities, but they’re actually mutually reinforcing. Healthcare shouldn’t have to choose between making data accessible and keeping it secure. The real objective is trusted data exchange: giving the right people access to the right information at the right time, with appropriate identity, consent, and governance built in. As healthcare becomes increasingly connected and AI-enabled, organizations that treat interoperability and security as complementary capabilities, rather than separate initiatives, will be best positioned to innovate safely and at scale.

What great answers! Huge thank you to everyone who took the time out of their day to submit a quote to us! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

How do you think organizations balance the need for data accessibility and interoperability with stringent privacy and security requirements? Let us know over on social media, we’d love to hear from all of you!