AI's Role in Health Information Exchange (HIE) Systems

Health Information Exchange (HIE) systems enable the secure sharing of health data across different healthcare organizations. By connecting electronic health record (EHR) systems, HIEs give clinicians a more comprehensive view of patient history, which can improve care coordination and outcomes. The landscape has evolved rapidly: the U.S. national interoperability network TEFCA (Trusted Exchange Framework and Common Agreement) has grown from roughly 10 million records exchanged in January 2025 to nearly 500 million by early 2026, with over 12,000 organizations now connected. However, current HIE implementations still face significant challenges. Data often exists in incompatible formats or non-standard vocabularies, and data exchange alone does not ensure that information is semantically consistent or immediately usable by a receiving system. As a result, critical information can be "exchanged" but not readily interpreted or used by receiving systems, limiting the clinical value of HIE. Moreover, concerns around privacy, data security, and governance have grown as HIEs expand, especially with the introduction of advanced analytics and artificial intelligence (AI) into healthcare. This report provides a comprehensive analysis of how AI is transforming HIE systems – enhancing interoperability and data standardization, enabling real-time decision support and predictive analytics, automating administrative tasks, and addressing current limitations – while examining the attendant challenges, ethical considerations, case studies, and future directions for policy and innovation. The goal is to inform healthcare professionals and stakeholders about both the opportunities and responsibilities that arise at the intersection of AI and HIE.

Health Information Exchange (HIE) refers to the infrastructure and processes that allow health data to move electronically among disparate healthcare information systems. An HIE can be organized regionally, nationally, or even within a network of hospitals, and it typically uses standards like HL7 or FHIR (Fast Healthcare Interoperability Resources) to represent and transport data GitHub. The core function of an HIE is to facilitate the sharing of health information across different providers, ensuring that a patient's records follow them between primary care clinics, specialists, hospitals, labs, and other care settings GitHub. In doing so, HIEs seek to improve continuity of care, reduce duplicate testing, and prevent medical errors by making the right information available at the right time. In the United States, the national TEFCA framework – managed by the Sequoia Project as the Recognized Coordinating Entity – has dramatically accelerated this vision, connecting over 12,130 organizations representing 72,000+ unique connections to clinicians, hospitals, clinics, public health authorities, and more as of early 2026. Under the ONC Certification Program, API requirements apply to developers of Health IT Modules certified to specified API criteria—not to every certified EHR system. These requirements support standardized API access for the applicable certified technology, providing a foundation for data exchange and AI innovation.

Despite these aims, current HIE systems have notable limitations:

• Siloed and Inconsistent Data: Healthcare data originates from diverse sources (EHRs, lab systems, pharmacies, etc.) with varying terminologies and formats. A single patient’s record might have different representations of the same concept (e.g. medication names or diagnostic codes) across systems. As Dr. Naheed Ali notes, “inconsistent data and lack of standardized data structure” is a primary barrier to interoperability GitHub. HIEs often struggle to reconcile these inconsistencies. Many exchanges today enforce only syntactic standards (message formats) and do not harmonize the underlying medical vocabularies, essentially passing along “junk data” that receiving systems cannot fully interpret GitHub. This semantic gap means that even though data is transmitted, it may not be usable without manual reconciliation.

• Limited Semantic Interoperability: An exchange can transport data successfully while the receiving system still requires local validation, reconciliation, or terminology mapping before the information is clinically usable. FHIR is a standard for healthcare data exchange, but implementation choices and the use of common terminology remain important to semantic interoperability. AI-assisted normalization may help, but it should be validated and governed rather than assumed to correct source-data errors.

• Fragmentation and Participation Gaps: HIE networks often cover specific regions or health systems, and not all providers participate. Organizations may use more than one health IT system, and a patient who receives care across unconnected networks may not have all records available in one place. Patient identity and record matching are critical interoperability functions and depend on accurate demographic data and appropriate matching practices. These gaps can result in missing or duplicative information, undermining the promise of an HIE to present a unified health record.

• Latency and Workflow Integration: In some HIE implementations, data exchange is not truly real-time. There may be delays in updating records (e.g. batch transfers once daily), which limits usefulness in urgent care scenarios. Additionally, clinicians often have to actively query or login to an HIE portal, which can interrupt their routine. Ideally, an HIE should seamlessly integrate into the clinical workflow (e.g. auto-fetching external data and presenting it within the native EHR interface), but this level of integration is inconsistent. Without intelligent filtering or summarization, the sheer volume of exchanged data can also overwhelm providers, ironically making it harder to find relevant facts.

In summary, while HIE systems have made remarkable progress in scale – particularly through national frameworks like TEFCA and the growing adoption of FHIR APIs – they still fall short in interoperability "intelligence." They rarely interpret or enrich the data they carry. This is precisely where artificial intelligence technologies can make a difference. By layering AI on top of HIE infrastructure, we can address many of these limitations: recognizing and standardizing diverse data, routing information more smartly, and extracting insights in real-time to support clinical decisions. The December 2025 HTI-5 Proposed Rule from ASTP/ONC further signals this direction, proposing to streamline certification criteria, shift away from legacy C-CDA standards toward FHIR-first interoperability, and explicitly advance a foundation for AI-enabled interoperability solutions.

One of AI’s most promising contributions to HIE lies in data standardization and semantic interoperability – the ability of different systems not just to exchange data, but to understand and use it. Given the heterogeneous and often messy nature of healthcare data, AI techniques such as machine learning (ML) and natural language processing (NLP) are being deployed to map, clean, and normalize information across sources.

AI for Vocabulary Mapping:Machine learning algorithms can learn equivalencies between different coding systems or terminologies. For example, an AI model could be trained on large datasets to recognize that “Hgb A1c” in one system corresponds to “Hemoglobin A1c” in another, or that a medication labeled “Metformin 500mg” in one database is the same as “Metformin Hydrochloride 500 mg tablet” in another. By leveraging ontology mapping and context, AI can suggest or automatically apply standard codes (like LOINC for labs or SNOMED CT for problems) to data coming into the HIE from a proprietary system. This dynamic mapping helps create a common semantic layer, so that data forwarded through the HIE is in a uniform format and nomenclature that receiving systems understand. In essence, AI acts as a translator between disparate health IT systems.

Natural Language Processing: A significant portion of health data – clinical notes, discharge summaries, pathology reports – is unstructured free text. Traditionally, such narrative data have been hard for HIEs to incorporate meaningfully. NLP algorithms, however, can analyze free text to extract structured information (e.g. problems, medications, allergies, social history) and encode it in standardized fields. For instance, NLP could read a radiology report and capture the key diagnostic findings, or parse a physician’s note to find mentions of drug allergies or lifestyle factors. By doing so, AI enables unstructured data to travel through the HIE in a computable form, broadening the scope of exchange beyond just discrete fields. Moreover, NLP can help clean data – detecting typos, standardizing abbreviations, and even translating layperson-entered text (from patient portals) into medical terminology.

Data Cleaning and Imputation: AI can learn patterns from historical data to fill in gaps or correct inconsistencies in real time. If a certain lab feed always uses a particular unit of measure or formatting, a simple ML rule might standardize that. More advanced techniques can even predict missing values – for example, if an inbound record is missing a patient’s gender or a lab unit, AI might infer it from context or flag it for clarification. While caution is needed (we rarely want AI guessing clinical facts), augmenting data quality checks with AI can reduce the burden on HIE administrators and improve the completeness of exchanged records.

Semantic Routing and Clinical Reconciliation: Beyond standardization, AI can assist in intelligently merging records from multiple sources. When a patient’s data comes from several hospitals, an AI system can reconcile whether two entries refer to the same medication or problem. For example, if “high blood pressure” is listed in one record and “hypertension” in another, AI can merge these as one condition. It can also help match patient identities by learning from demographic patterns (though patient matching remains challenging and must be done carefully to avoid false matches). AI may assist with terminology mapping and reconciliation, but any automated mapping should be evaluated for accuracy and clinical safety in its intended workflow. By implementing rule-based and learning-based engines, future HIEs can translate or normalize message content in transit, rather than simply passing it along unchanged.

Collectively, these AI-driven approaches address the semantic interoperability issues that currently plague HIE efforts. They can help address inconsistent data formats and vocabularies across systems when they are implemented with common standards, validation, and governance. With AI-enhanced standardization, an allergy recorded in one clinic can be automatically recognized and coded correctly in another clinic’s system via the HIE, and a lab result with local codes can be converted into a universal code like LOINC before storage or analysis. This not only saves manual labor (previously, staff might spend hours reconciling data differences) but also improves patient safety and care continuity by ensuring clinicians have interpretable information.

It should be noted that AI models require robust training data to perform these tasks accurately. HIEs themselves can serve as rich training grounds, given they aggregate data from many sources. A virtuous cycle can be achieved: as HIEs feed more data into AI algorithms, the algorithms improve at standardizing and integrating data, which in turn makes the HIE’s repository more clean and useful for all participants. Proper governance (addressed later in this report) must guide this process to maintain data integrity and patient privacy.

One of the most transformative impacts of AI on HIEs is the enablement of real-time clinical decision support and predictive analytics across the continuum of care. HIEs, by their nature, contain longitudinal and comprehensive patient data that no single provider may have. This makes them a goldmine for AI-driven insights: by analyzing pooled data from multiple sources, AI can uncover patterns and make predictions that improve both individual patient care and broader population health.

Enhanced Clinical Decision Support (CDS): Traditionally, clinical decision support systems (CDSS) operate within a single hospital’s EHR, alerting clinicians to issues like drug interactions or reminding about care guidelines. By integrating AI with HIE data, CDS can be elevated to a new level. Imagine an emergency physician accessing an HIE for a patient’s history: an AI agent could summarize the patient’s cross-institutional records and highlight critical information (e.g. “this patient was seen at another hospital last week for chest pain, follow-up tests pending”) in real time. Such summarization uses NLP and reasoning over the HIE’s data. Similarly, if a clinician is about to prescribe a medication, an AI-powered CDS referencing the HIE could alert them not only of drug-allergy interactions from their own EHR, but also of any allergies documented elsewhere, or recent lab results from another facility that suggest a contraindication. In this way, AI leverages HIE’s breadth of data to provide more complete and context-aware decision support than siloed systems could. This can reduce medical errors and ensure care decisions are made with all pertinent facts at hand.

Predictive Analytics for Patient Risk: Machine-learning models may use longitudinal data available through an HIE to estimate risks such as hospital readmission, emergency use, or gaps in care. Performance cannot be assumed from access to a larger dataset: each model requires validation in its intended population and workflow, including assessment of calibration, subgroup performance, bias, clinical utility, and potential harms. AI outputs should support—not replace—clinical judgment.

Real-Time Public Health Surveillance: Aggregated HIE data, when analyzed by AI in real time, can serve as an early warning system for public health. For instance, unusual spikes in certain symptoms or lab orders across an HIE network might indicate an emerging infectious disease outbreak. AI anomaly detection algorithms could identify such patterns faster than traditional reporting. During the COVID-19 pandemic, it was systems with broad data access that could quickly identify trends in patient presentations. A well-integrated AI and HIE setup could feed de-identified regional data into predictive models that forecast flu outbreaks, identify clusters of opioid overdoses, or monitor chronic disease prevalence – information invaluable for public health response. Some health systems have begun leveraging HIE-like data for predictive epidemiology, guided by AI that can separate signal from noise in huge datasets.

Personalized Medicine and Alerts: With AI, HIEs can also enable more personalized alerts and care pathways. For example, if a patient’s data (spread across primary care and specialists via HIE) indicates worsening kidney function and the patient is on a medication that can affect kidneys, an AI could generate a proactive alert to the prescribing doctor to adjust the dose. Or consider precision medicine: AI could scan an HIE’s database to find patients with genetic markers or rare disease patterns and alert clinicians for tailored interventions or clinical trial opportunities. These scenarios move beyond the one-size-fits-all rules towards data-driven, individualized insights harnessing the full spectrum of a patient’s health data.

Importantly, these analytics need to be delivered in real time or near real time to be clinically useful. Advancements in computing and data architectures (like in-memory databases and fast query interfaces like FHIR) are making it feasible for an AI service layered on an HIE to analyze relevant data on-demand when a query comes from a point of care. In practice, this means when a clinician searches the HIE for a patient, they might not just retrieve raw documents but also see an AI-generated risk score or care suggestion. For example, “Based on combined data, this patient has a 25% risk of hospital admission in the next 6 months; consider care management referral.” Such a prompt could come directly from predictive models validated on the HIE population.

These ideas remain implementation-dependent. Connecting an analytics platform to exchanged data does not establish that a model is clinically valid, improves outcomes, or can be safely embedded in a workflow; those questions require evaluation in the intended setting. TEFCA's growing network may expand opportunities for appropriately permitted data exchange, but it does not by itself establish an AI-analytics capability or outcome. In December 2025, HHS published a Request for Information on accelerating AI adoption in clinical care. The RFI seeks public feedback on actions HHS could take to accelerate clinical-AI adoption, including where enhanced interoperability could widen opportunities; it does not create an AI-HIE integration program or mandate.

Of course, integrating AI into clinical decisions must be done carefully. Predictions and alerts should be explainable and have high specificity to avoid alarm fatigue. Clinicians remain the final arbiters of care; AI’s role is to support, not replace, their judgment. Nevertheless, used appropriately, AI-driven decision support and predictive analytics multiply the utility of HIEs: the HIE becomes not just a static repository of information, but a learning health system component that actively generates knowledge and recommendations to improve care in the moment and for the future.

Whenever sensitive health information and advanced analytics converge, issues of privacy, data governance, and security take center stage. HIEs are custodians of large volumes of personally identifiable information (PII) and protected health information (PHI) spanning multiple organizations. Introducing AI into this ecosystem amplifies both the potential risks and the need for robust governance frameworks. In this section, we explore how AI impacts privacy and security in HIE, and what measures are being taken to ensure patient data remains protected and used ethically.

Enhanced Security Needs: AI algorithms often require substantial data for training and operation. This can create new attractive targets for cyberattacks, as consolidated HIE data used in AI models could be vulnerable if not properly secured. The healthcare sector continues to face major data-breach risks. OCR received notifications of 663 breaches of unsecured PHI affecting 500 or more individuals that occurred in calendar year 2024, affecting approximately 242.9 million individuals. OCR received 742 large-breach reports through its portal during 2024, but some concerned breaches that did not occur in 2024. OCR identified the largest hacking/IT incident as affecting approximately 192 million individuals. IBM's 2025 Cost of a Data Breach Report found that healthcare had the highest average breach cost, at $7.42 million. Each breach undermines patient trust and can lead to identity theft or financial harm. As AI systems integrate with HIEs, the attack surface may expand (for instance, through new API endpoints or data pipelines for AI services). This makes it imperative that HIEs employ state-of-the-art cybersecurity defenses. HIPAA requires regulated entities to implement appropriate administrative, physical, and technical safeguards for ePHI, including technical measures to guard against unauthorized access during transmission. The Security Rule is risk-based and does not prescribe AES-256, TLS 1.3, or a particular security architecture; organizations should select and document reasonable and appropriate controls for their environments. This approach, combined with rigorous network security and monitoring (intrusion detection systems possibly augmented by AI itself), is crucial to prevent unauthorized access or data exfiltration from AI databases.

The voluntary NIST AI Risk Management Framework offers a structured way to identify and manage AI risks. It emphasizes context-specific assessment of trustworthy-AI characteristics, including validity and reliability, safety, security and resilience, accountability and transparency, explainability, privacy enhancement, and fairness with harmful bias managed. HIE operators can use such frameworks alongside applicable legal and security obligations when evaluating AI systems.

Data Governance and Consent: Governance in the context of AI and HIE refers to policies determining how data can be used, by whom, and for what purposes. Given that HIE data originates from many sources and was collected under certain patient consents, using it to train AI or to run new analytics may raise legal and ethical questions. It is essential to maintain transparency and adherence to consent – patients should not be surprised by how their data is being used. Many HIEs operate under an opt-in or opt-out consent model for data sharing; extending those models to cover AI analysis is an area of active policy development. For example, if an HIE’s data is used to develop a predictive risk model that benefits all providers, do patients need to be informed or give permission for that secondary use? The consensus leans toward de-identification and aggregation as key strategies: AI models should be trained on de-identified datasets whenever possible, and any identifiable data used should be under the same strict access controls as regular HIE queries, with audit logs and accountability.

Additionally, AI systems themselves can inadvertently leak information or exhibit bias if not carefully governed. A model trained on HIE data might, for example, be biased against certain racial or socioeconomic groups if the input data reflected historical inequities. Governance frameworks must include provisions for algorithmic fairness and bias monitoring. Organizations should clearly document AI systems and their intended uses and validate performance across relevant patient populations. The voluntary NIST AI Risk Management Framework identifies transparency, privacy enhancement, and fairness with harmful bias managed among characteristics of trustworthy AI. HIE organizations may establish data governance committees that include ethicists and patient representatives to oversee AI initiatives, ensuring they align with community values and legal standards (such as GDPR in Europe, which has strict rules on automated decision-making and data usage).

Patient Privacy and AI Ethics: AI’s hunger for data can conflict with the privacy principle of data minimization (using only what’s necessary). A delicate balance must be struck: we want AI to glean insights that improve care, but not at the expense of exposing more personal data than needed or inferring sensitive attributes without consent. For example, an AI might infer mental health conditions or genetic predispositions from patterns in data – things a patient might consider highly private. Ensuring patient privacy in this context involves technical measures like differential privacy (adding noise to data to prevent re-identification in population statistics) and contractual/data use agreements that forbid re-identification of de-identified data. Moreover, any AI application that provides decision support should be carefully scoped so that it does not disclose another individual’s data inappropriately. An HIE AI could alert a doctor that “your patient was seen elsewhere for issue X,” but it should not expose details about other patients or providers that are not part of the patient’s care.

Regulators are keenly aware of these issues. Many jurisdictions are updating health data laws to account for big data and AI. For instance, in the U.S., the Office for Civil Rights has provided guidance on how HIPAA permits the use of PHI for healthcare operations and quality improvement, which can encompass certain AI analytics, but it emphasizes safeguards and the minimum necessary standard. On a broader scale, the EU AI Act entered into force in August 2024 and applies on a staggered timetable. The rules for high-risk AI systems listed in Annex III apply from 2 December 2027, while the rules for high-risk AI embedded in regulated products, including medical devices, apply from 2 August 2028. Whether a particular healthcare AI system is high-risk depends on its intended purpose and legal classification; organizations should assess the applicable requirements rather than assume that all healthcare AI is high-risk.

Lastly, maintaining trust is paramount. If patients fear that AI analyses of their HIE data could be used against them (for example, by insurers or employers) or leaked, they may opt out of HIE participation altogether, which would be detrimental to care continuity. Surveys consistently show patients support data sharing for treatment and research if privacy is protected and the purpose is clear. Therefore, HIEs employing AI must communicate the benefits to patients (e.g. “we use advanced tools to improve your care by catching problems early”) and the protections in place. Robust security measures, as discussed earlier, form the foundation – without security, there is no privacy. In summary, AI does not alter the fundamental obligations of HIEs to protect patient data; rather, it heightens the importance of comprehensive security and governance programs that evolve with technological advancements.

Healthcare is rife with administrative tasks that consume valuable time and resources – from insurance verification and billing to documentation and quality reporting. HIEs, by connecting systems, have already streamlined some administrative processes (for example, auto-populating a patient’s history instead of faxing records). AI can take this further by automating and accelerating many routine workflows related to data exchange, thereby reducing the administrative burden on healthcare staff and organizations. This not only yields cost and time savings, but also frees up clinicians to focus more on patient care rather than paperwork.

Revenue Cycle and Billing Automation: AI-enabled tools may assist with eligibility checks, claims preparation, coding suggestions, and error detection. These are generally EHR or revenue-cycle functions rather than HIE functions. Organizations should validate results, maintain appropriate human review, and follow payer requirements and applicable billing rules.

Downstream in the revenue cycle, AI is assisting with medical coding and billing. Natural language processing algorithms can analyze provider notes or HIE-sourced clinical documents to suggest accurate billing codes (ICD-10, CPT, etc.) GitHub. This helps ensure that when records flow through the HIE, they carry proper coding for diagnoses and procedures, which in turn streamlines billing across facilities. Health centers using AI for coding support have seen reductions in coding errors and compliance issues GitHub. Additionally, before claims are submitted to insurers, AI can audit and scrub claims for errors – checking for missing information, incompatible codes, or documentation gaps. By catching these issues pre-submission, AI improves the “clean claim” rate, leading to faster reimbursements GitHub. For example, if an HIE-fed billing system notices that a procedure code from one provider’s submission lacks a required modifier or justification that is present in another part of the HIE record, an AI could flag that or even append the needed information (if rules allow), thus preventing claim rejections.

Prior authorizations and referrals: Administrative AI may help staff organize information for authorization or referral workflows. These functions are usually performed in EHR, practice-management, payer, or referral systems; access to exchanged clinical information does not establish that an HIE itself performs the authorization workflow or improves approval outcomes.

Documentation, reporting, and patient communications: Digital documentation tools, quality-reporting tools, and scheduling or reminder systems are adjacent healthcare-AI applications. They may consume information exchanged through interoperable systems when appropriately permitted, but they should not be described as HIE functions unless a specific deployment documents that integration and its results. San Ysidro Health's call-center example is discussed later as an adjacent use case.

Administrative forecasting and workforce management: Forecasting appointments, patient flow, staffing, and finances is an operational analytics use case. It may draw on data available to an organization, but it should be evaluated as an operations application rather than represented as a standard HIE capability.

In summary, AI’s role in automation is turning HIE-linked systems into more than passive conduits of information – they become active agents in administrative workflows. The net effect is a reduction in manual, repetitive tasks. A table below highlights some key AI applications addressing administrative burdens in HIE contexts and their benefits:

Administrative AI may reduce work in particular validated workflows, but those effects should not be attributed to HIEs without direct evidence of the integration, governance model, and measured outcomes. In this area, HIEs are principally a means of permitted information exchange; the automation is ordinarily supplied by adjacent clinical, administrative, or revenue-cycle systems.

While the integration of AI into HIE systems offers many benefits, it also introduces complex challenges and ethical dilemmas that must be managed. These concern not just technical issues, but fundamental questions of trust, fairness, accountability, and the role of automation in healthcare. Below we outline some of the key challenges and ethical considerations when using AI for HIE, and discuss approaches to address them.

Data Bias and Health Equity: AI systems can produce harmful or uneven outcomes when the data, design choices, deployment context, or evaluation processes do not adequately account for affected populations. Before use, organizations should evaluate performance in the intended population and workflow, document relevant fairness risks, and monitor for harmful bias after deployment. The NIST AI Risk Management Framework identifies fairness with harmful bias managed as a characteristic of trustworthy AI. The ethical mandate is clear – we must ensure that AI does not exacerbate the “digital divide” or existing healthcare disparities. To tackle this, developers are adopting techniques like bias audits of AI algorithms, ensuring training datasets are inclusive, and sometimes even adjusting algorithms to account for social determinants of health. The voluntary NIST AI Risk Management Framework identifies fairness with harmful bias managed, accountability and transparency, explainability, privacy enhancement, and security and resilience as characteristics of trustworthy AI. Ethically, healthcare AI should be subject to rigorous validation in different subpopulations before deployment, and regulatory oversight may be required to enforce this. The principle of justice in bioethics compels us to distribute AI’s benefits fairly and prevent harm to disadvantaged groups.

Transparency and Explainability: Many AI models, especially deep learning ones, operate as “black boxes” – they might predict that a patient has a high risk of, say, sepsis in the next 24 hours, but not easily explain why. In an HIE context, if such a prediction influences clinical decisions, lack of explainability can be problematic. Clinicians and patients have the right to know the basis of recommendations that affect care. Moreover, unexplainable alerts might be ignored by providers, limiting effectiveness. Ethically, the principle of autonomy ties into explainability: patients should be informed (to a reasonable extent) how AI uses their data and how conclusions are drawn, especially if AI outputs could influence their treatment. To address this, researchers are developing explainable AI (XAI) techniques – for instance, highlighting which factors (age, lab results, prior diagnoses from the HIE record) contributed most to a risk score. Some AI systems produce human-readable explanations like “Patient’s risk is high due to recent hospitalization and rising blood sugar levels.” This not only aids clinician trust and understanding but also helps detect if the AI might be drawing on spurious correlations. Regulatory guidelines in some regions may require a level of explainability for AI decisions in healthcare, aligning with the ethical stance that AI should augment human decision-making, not mystify it.

Consent and Patient Autonomy: HIE data is used by AI in ways that patients might not fully anticipate when they consent to data sharing. There’s an ethical question: should patients have the ability to opt out of certain AI analyses on their data? For instance, a patient might be comfortable with their data being shared for direct care via HIE, but uneasy about it training an AI model for predictive analytics that they don’t directly benefit from. On one hand, population-level analytics promise to improve healthcare for all (public beneficence), but on the other hand individual autonomy suggests people should have a say in how their data is used. Achieving the right balance is tricky. Many HIEs are moving toward greater transparency with patients about secondary data use. Some approaches include public posting of AI projects, community advisory boards, and even patient portals where one can see how their data has contributed to research or AI tools. From an ethical standpoint, involving patients in governance of HIE data (i.e., participatory governance) can ensure their values guide the use of AI. When possible, using de-identified data for AI can mitigate some consent concerns, but as noted, de-identification is not foolproof and must be handled carefully to truly protect privacy.

Liability and Accountability: If an AI integrated with an HIE makes an incorrect prediction or a harmful recommendation, who is responsible? The physician who acted on it? The hospital that deployed it? The vendor that developed the AI? This is a legal and ethical gray area. Clear accountability is needed to ensure there is recourse and learning from mistakes. Ethically, the principle of non-maleficence (do no harm) implies that AI in HIE should undergo extensive testing to minimize risks. When errors do occur, there should be transparent investigation and systems in place to prevent recurrence (just as there are morbidity and mortality conferences for human errors). Some institutions have formed AI ethics committees to oversee deployment and respond to incidents involving AI. Additionally, developers are encouraged to implement AI with a “human in the loop,” meaning final decisions rest with human clinicians, and AI outputs are advisory. This helps keep accountability with clinical professionals while AI remains a tool. However, as AI gets more autonomous, this balance will need continuous reevaluation. Policies and possibly legislation will be required to clarify liability; in the interim, collaboration between HIEs, clinicians, and AI vendors on shared accountability models (like agreements on responsibilities and malpractice coverage for AI-related decisions) is prudent.

Integration Challenges and Human Factors: On a practical level, one challenge is ensuring that AI recommendations are integrated into workflows in a way that augments rather than hinders clinicians. Poorly designed AI alerts can cause alert fatigue, distraction, or confusion. Ethically, this ties to the concept of beneficence – we introduce AI only if it truly benefits care and does not inadvertently lead to new errors (like a doctor overlooking something because they relied on AI or ignored an alarm after too many false positives). Therefore, usability testing and human-centered design of AI interfaces are crucial. Clinicians should be trained to understand the strengths and limitations of AI tools (digital literacy), and AI systems should gracefully handle uncertainty by perhaps not giving a result when confidence is low (rather than a misleading one). The ethics of AI also dictate that we continuously monitor outcomes after deployment – does the AI actually improve patient outcomes and workflow efficiency as intended? If not, we must be willing to recalibrate or even withdraw the tool.

In summary, the introduction of AI into HIE amplifies existing ethical responsibilities and creates new ones. The healthcare community is aware of these issues – indeed, major organizations and government bodies have been actively developing guidelines to ensure safe, effective, and equitable AI in health. NACHC’s recommendations to the U.S. Administration called for focusing on bias mitigation, data privacy safeguards, and balanced innovation with guardrails GitHub. Similarly, the World Health Organization (WHO) has released guiding principles for AI in healthcare (first in 2021, with subsequent updates), emphasizing inclusivity, safety, and transparency. These principles have been reinforced by concrete regulatory action, including the EU AI Act's risk-based framework. Whether a healthcare AI system is high-risk depends on its intended purpose, product status, and the applicable provisions. Upholding these principles will be as important as the technical innovations themselves. In practice, this means multidisciplinary oversight (clinicians, technologists, ethicists, patient advocates) of AI-HIE initiatives, ongoing training for users, and an organizational culture that treats AI as a support tool that is continuously evaluated and improved.

Directly documented evaluations of AI integrated with HIEs remain limited in this article. The example below is an adjacent healthcare-AI use case and should not be interpreted as evidence that an HIE integration improved clinical or operational outcomes.

San Ysidro Health Center – AI-Enhanced Patient Communications: San Ysidro Health, a community health center in California, provides a documented example of AI-assisted call-center automation; it should not be treated as evidence of AI integration with an HIE. Faced with high call volumes and the need to serve a bilingual patient population, San Ysidro implemented an AI virtual assistant (using the Kore.ai platform) as part of its call center operations GitHub. NACHC describes HealthAssist as using training data from the center’s Uniform Data System, EHR, English- and Spanish-language sources, and recorded call-center data; this is not documentation of an HIE integration. HealthAssist was intended to support call-center operations, including improving response rates, patient scheduling, and appointment reminders. The NACHC account does not document identity confirmation, record lookup, lab-result status, or fully autonomous handling of these tasks. The impact was significant: the clinic reported that call abandonment rates dropped substantially, meaning far fewer patients hung up before being helped GitHub. Additionally, the number of “unassigned” patients (those not yet linked to a primary provider) decreased, as the AI assistant efficiently triaged and routed them for follow-ups GitHub. Staff noted improved operational costs and better responsiveness in patient scheduling and reminders. This example illustrates a targeted operational use of AI for patient communications; it does not establish outcomes for AI-enabled HIEs. It’s essentially an automation success story that other health centers have started to emulate, especially those serving multilingual communities. The San Ysidro case also underlines the importance of using the right training data – they incorporated data from the HIE/EHR (like HRSA’s Uniform Data System indicators and prior call transcripts) to ensure the AI was context-aware and culturally competent GitHub.

International Examples and Pilot Programs: Beyond the U.S. and UK, several countries and health systems have embarked on AI-HIE integration:

• International pilots: Linked health-data systems can provide settings for evaluating AI-supported population-health, adherence, and screening workflows. Specific program outcomes should be reported only with direct documentation from the responsible health authority or original peer-reviewed evaluation; otherwise, they should be described as proposed or exploratory uses.

• European Union Cross-Border Health Data: The European Health Data Space (EHDS) Regulation was published in March 2025 and entered into force on 26 March 2025. It establishes a common framework for the use and exchange of electronic health data in the EU, including primary use and specified secondary uses. Its application is gradual: key primary-use provisions for cross-border exchange of patient summaries and ePrescriptions/eDispensations are scheduled to apply from March 2029, while additional priority categories are scheduled for March 2031. The regulation includes interoperability and security requirements for EHR-system manufacturers, but it did not require all healthcare providers and EHR vendors to certify their systems by January 2026. AI proposals for cross-border exchange should be evaluated against the EHDS implementation timetable and applicable data-protection requirements.

The documented example underscores a common theme: AI can extract new value from shared health data, but success requires careful implementation, evaluation, and trust-building. The San Ysidro case focused on a defined operational problem—call handling—rather than making unsupported claims about clinical outcomes.

It is also evident that many of these projects started as pilot programs or research trials. This staged approach (pilot -> evaluate -> scale) is wise for AI in HIE, as it allows measurement of impact and adjustment before broader rollout. For instance, NACHC has advocated for funding pilot projects in AI for health centers to explore different approaches and build evidence GitHub GitHub. In line with that, government and private grants in the U.S. have started supporting HIE-based AI pilots (for example, using HIE data to identify opioid overdose hotspots and intervene with community programs).

In conclusion, the case studies illustrate both the versatility of AI applications in HIE (from admin to clinical to public health uses) and the universality of certain best practices (stakeholder engagement, strong data governance, incremental scaling). They serve as learning opportunities for other organizations considering similar initiatives. As more success stories emerge, they will likely fuel increased adoption and confidence in AI-augmented HIE systems worldwide.

Looking ahead, the intersection of AI and health information exchange is poised to deepen. To fully realize AI’s potential in creating a truly interoperable, learning health system, several developments, innovations, and policy actions are on the horizon. This final section outlines future directions and provides recommendations to policymakers, healthcare leaders, and technologists on fostering a beneficial and responsible AI-HIE ecosystem.

1. Universal Data Standards and Open APIs: A critical foundation for AI in HIE is the use of modern, uniform data standards that make data accessible and machine-readable across systems. Under the ONC Certification Program, developers of Health IT Modules certified to applicable API criteria must meet the associated standardized API requirements; this does not impose a universal requirement on all EHR systems. HIEs and health systems may expose standardized data endpoints that AI developers can use, subject to applicable permissions and safeguards, to train models or deliver decision support. The December 2025 HTI-5 Proposed Rule goes further, proposing to remove legacy C-CDA certification criteria in favor of FHIR-first interoperability, reduce 34 of 60 existing certification criteria, and explicitly advance a foundation for AI-enabled interoperability solutions – projected to save health IT developers 1.4 million hours in the first year and an estimated $1.53 billion in total savings over time. Additionally, ASTP/ONC released draft USCDI v7 on January 29, 2026, proposing 29 new data elements to strengthen nationwide interoperability. HIE architectures are now actively shifting from point-to-point interfaces to API-driven data sharing, enabling more real-time data flow. Policymakers should continue to encourage and enforce interoperability standards – not only FHIR, but also standardized terminologies (SNOMED, LOINC, ICD) – as this greatly reduces the data wrangling effort for AI and ensures that innovations can scale across systems. Internationally, alignment of standards (through bodies like ISO or WHO) will help AI tools be transferable between countries' HIE systems. Recommendation: Governments and standards organizations should fund and support the expansion of open data standards, including developing implementation guides for AI (for example, defining how an AI service can query an HIE for a dataset and return results in a standardized format).

2. Federated Learning and Privacy-Preserving AI: One innovation to watch is the rise of federated learning and other privacy-preserving AI techniques in healthcare. Federated learning allows AI models to be trained across multiple data sources (like multiple hospital databases or HIE nodes) without centralizing the data. Instead of pooling patient data in one place (which raises privacy risks), the model is sent to each source, learns from local data, and only the model updates (not the raw data) are shared and aggregated. This approach could be transformative for HIE networks, especially those spanning multiple institutions that are hesitant to share identifiable data. For example, an HIE could coordinate a federated learning project where each hospital’s EHR system trains part of a model to predict, say, ICU admission risk, and the combined model becomes very robust without any hospital ever directly sharing its raw patient records. This technique, along with differential privacy and secure multi-party computation, represents a maturing approach to AI that respects data minimization principles. Federated learning is a prospective privacy-preserving approach for multi-institutional health-data research. Any claimed HIE deployment or outcome should be supported by direct documentation of the participating network, data-governance model, and evaluation results. Policy should encourage research and pilot programs in these techniques, potentially providing regulatory sandboxes so that institutions can test them without fear of violating privacy laws (as long as certain safeguards are met). The EU's EHDS Regulation, which entered into force in March 2025, explicitly supports secondary use of health data for research and AI development while emphasizing privacy-enhancing technologies – providing a regulatory foundation for federated approaches across all 27 member states. The goal is to enable collaborative AI development on a global scale – imagine AI models for rare diseases that require data from around the world, trained in a federated way that complies with each country's privacy regulations.

3. Strengthening AI Governance and Ethical Oversight: As AI becomes integrated into everyday HIE operations, governance mechanisms must keep pace. This includes establishing clear accountability frameworks for AI outcomes, as discussed earlier, but also routine processes like AI validation, auditing, and re-certification. One future direction is the creation of independent audit bodies or “AI review boards” for healthcare, analogous to an Institutional Review Board (IRB) for research or an accreditation body. Such entities could certify algorithms (especially high-risk ones) for use in HIEs, ensuring they meet standards for bias, accuracy, and security. On the policy side, governments should update healthcare quality and safety regulations to explicitly cover AI tools – for example, integrating AI performance metrics into quality reporting programs, or requiring that HIEs using AI have an AI ethics policy in place. For AI-enabled device software functions, FDA's final guidance describes how manufacturers may include a predetermined change control plan (PCCP) in an existing 510(k), De Novo, or PMA marketing submission. A PCCP must describe planned modifications, development and validation methods, implementation, and the impact on safety and effectiveness; it is not a general faster approval pathway for HIE-based AI. The EU AI Act is now in force, but its obligations apply on a staggered timetable. Annex III high-risk AI rules apply from 2 December 2027, and rules for high-risk AI embedded in regulated products apply from 2 August 2028. Ethical guidelines, like the WHO's principles for AI ethics, should be translated into practical toolkits that HIEs and hospitals can apply (covering things like how to obtain patient consent for AI, how to communicate AI-driven insights, and how to involve communities in AI design). Recommendation: Healthcare organizations should form multidisciplinary AI committees to oversee AI projects and document context-specific risk management, evaluation, monitoring, and accountability practices. The voluntary NIST AI Risk Management Framework can inform this work; it does not itself impose a regulatory requirement.

4. Workforce Training and Change Management: Even the best AI system will fail if users are not prepared or willing to use it. The future of AI in HIE calls for significant investment in training the healthcare workforce – not just clinicians, but also IT staff, data analysts, and administrators – on AI literacy. This includes understanding AI outputs, knowing its limits, and being able to communicate with patients about it. As AI takes over routine tasks, workforce roles will also shift; for example, medical coders might evolve into documentation auditors or AI trainers. Policymakers and educational institutions should incorporate health informatics and AI into medical and nursing curricula, and provide ongoing professional development. NACHC’s commentary reflects that many health centers lack internal expertise and need technical assistance and training to implement AI effectively, requesting support for workforce development in AI GitHub GitHub. Recommendation: Government grants or public-private partnerships could establish AI training programs for healthcare, especially targeting smaller clinics and safety-net providers, so they are not left behind due to lack of expertise. Additionally, change management efforts (like involving clinicians in AI tool design, pilot-testing, gathering feedback) should be formalized as part of any HIE-related AI rollout.

5. Infrastructure and Investment for Scalable AI: Scaling AI solutions from pilot to production across an HIE or a nation’s health system requires robust infrastructure – both technical (computing power, data storage, network capacity) and organizational (leadership buy-in, processes for continuous improvement). Cloud computing will likely play a big role, as many HIEs and hospitals turn to cloud platforms to host large datasets and AI services on demand. Edge computing may also emerge, where AI models run directly where data is generated (e.g., at a hospital or even on a wearable device) for real-time analysis, sending only insights to the central HIE. Governments can facilitate these by investing in health IT infrastructure, particularly for under-resourced areas. For example, ensuring rural hospitals have high-speed internet and secure data exchange capabilities is foundational for them to benefit from AI. International aid organizations might consider funding regional data hubs and AI labs in low- and middle-income countries so they can leapfrog into the era of AI-driven health exchange. Recommendation: Policymakers should consider AI-readiness grants for HIEs and health centers, covering infrastructure upgrades and the initial costs of AI tool adoption. NACHC has suggested that helping health centers acquire advanced infrastructure and funding pilot projects would allow them to keep pace with technology GitHub. Such investments will pay off in efficiency and better health outcomes down the line.

6. Equitable Access and Avoiding a Digital Divide: As AI in healthcare advances, there’s a risk that well-funded health systems reap most benefits while resource-limited settings fall behind – creating a new kind of digital divide. This would be counterproductive to the ethos of HIE, which is to ensure all patients’ data and care can be improved. Future policy should emphasize inclusive innovation: incentivize AI development for the needs of underserved communities, ensure that AI tools are affordable and accessible (for example, open-source AI models for common tasks, or pricing that scales to clinic size), and that they can function in low-resource environments (offline modes, support for older IT systems) GitHub. For instance, an AI chatbot might need to work via simple SMS for communities with limited smartphone usage. Governments could negotiate or subsidize enterprise AI solutions so that small clinics aren’t priced out of the market. Also, continuing to expand broadband and 5G coverage in rural areas is a non-negotiable foundation for digital health equity, as highlighted by the correlation between lower-income or rural populations and lack of reliable internet GitHub. Recommendation: Tie health IT funding to equity goals – for example, grant programs that specifically fund AI and HIE projects which address health disparities (such as AI for rural telehealth via HIE, or analytics targeting diseases prevalent in marginalized groups). This ensures that AI doesn’t just trickle to those who can pay, but is directed to pressing public health challenges.

7. Continuous Learning Health System: Finally, an aspirational but achievable direction is transforming HIEs into central nodes of a continuous learning health system. In such a system, data from routine clinical care (collected via HIE) is constantly analyzed by AI to generate new insights, which are fed back to improve care – essentially closing the loop between practice and learning. This could accelerate medical knowledge discovery: for example, detecting off-label drug benefits or early side effects signals, by analyzing aggregated data faster than traditional clinical trials or studies. It also means that guidelines and best practices could be updated in near-real time as evidence emerges from AI analysis of HIE data. Achieving this will require close collaboration between clinicians, researchers, and HIE organizations, along with frameworks to quickly validate and implement findings (so that an AI-detected pattern is verified and then translated into a decision support alert or policy change). Policymakers can encourage this by streamlining data sharing for research via HIEs (with appropriate privacy safeguards) and funding large-scale collaborations between academic centers and HIE networks on AI research. The recently increasing focus on real-world evidence by regulators (e.g., FDA’s use of RWE for drug approvals) aligns well with leveraging HIE data for continuous learning.

In summary, the future of AI in health information exchange is bright but demands proactive steps today. The policy recommendations can be summarized as follows:

• Continue to enhance interoperability standards (such as FHIR) and open, secure APIs for health data, building on API requirements that apply to relevant certified Health IT Modules and on proposed FHIR-first policy directions.

• Promote privacy-preserving AI methods (federated learning, de-identification) through supportive regulations and pilot programs.

• Update regulatory and accreditation frameworks to include AI governance, requiring risk management and fairness checks for clinical AI GitHub.

• Invest in training and technical assistance for healthcare workers to use AI tools effectively, ensuring change management is part of AI deployment GitHub.

• Fund infrastructure and innovation, particularly targeting underserved areas, to level the playing field for AI capabilities GitHub GitHub.

• Maintain a strong focus on ethics and equity – involve patients and communities in AI design, and measure the impact of AI on health disparities continuously, adjusting course as needed GitHub.

By following these directions, stakeholders can harness AI to make HIEs not only conduits of data but engines of insight and improvement. The marriage of AI and HIE has the potential to revolutionize how we deliver care: imagine a future where a global network of HIEs, all interfaced with intelligent algorithms, collaboratively learn from each patient encounter to better the next. Achieving this vision will require diligent work – building trust, ensuring fairness, and keeping the focus on patient benefit. With careful stewardship, AI-driven HIE can lead to safer, smarter, and more equitable healthcare for all.

• HL7 International. FHIR Overview. HL7.

• National Association of Community Health Centers (NACHC). (2023). Rapid Expansion of AI and Tech Tools Serve Health Center Communications. NACHC.

• U.S. Department of Health and Human Services, Office for Civil Rights. (2025). Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2024. HHS.

• ASTP/ONC. (2025). Certification Companion Guide: § 170.404 Application Programming Interfaces. (Describes API conditions and maintenance requirements for developers of Health IT Modules certified to specified API criteria) ^[1].

• U.S. Department of Health and Human Services. (2026). TEFCA, America's National Interoperability Network, Reaches Nearly 500 Million Health Records Exchanged. ^[2].

• ASTP/ONC. (2025). HTI-5 Proposed Rule: Deregulatory Actions to Unleash Prosperity. ^[3].

• European Commission. (2025). European Health Data Space Regulation (EHDS). EC Health.

• HIPAA Journal. (2025). Healthcare Data Breach Statistics. (Updated breach data through 2024 and 2025) HIPAA Journal.

• UK Government. (2025). New Commission to Help Accelerate NHS Use of AI. GOV.UK.

• HHS. (2025). Request for Information: Accelerating the Adoption and Use of Artificial Intelligence as Part of Clinical Care. Federal Register.