Big Bucks, No Whammies, Part 2: So You Won. Now What?

By STEPHEN FARBER

Part one argued that patient access was never the finish line; it was the foundation. This is about what we build now that we are standing on it.

Every good game show has a second round, and the second round is always harder. The first round was about getting health information out of the buildings that held it. Regulation, standards, and a decade of unglamorous plumbing have brought us to an important threshold. Individuals can increasingly pull records from multiple institutions into one place. The board paid out. The audience cheered.

Then a quieter and stranger question arrives. You are holding years of visits, laboratory results, medications, and discharge summaries, and you realize that having your history in one place is not the same as understanding it. Assembly was the first hard problem, but it was not the last.

The record is finally readable

This is where artificial intelligence walks onto the stage, and the promise is real. Few clinicians have time to read a patient’s entire history every time a decision must be made. Appropriately safeguarded AI can summarize years of encounters, support medication reconciliation, explain a laboratory trend in ordinary language, and surface a pattern buried across multiple providers. Large consumer platforms have already begun connecting AI assistants to medical records; Amazon’s Health AI, for example, draws on a person’s One Medical history to provide personalized explanations and guidance. Once the record can be assembled, a capable assistant can finally make more of it legible.

Legibility, however, is not reliability. The farther AI moves from explaining a record toward acting on it, the thinner the evidence becomes. A 2026 scoping review of agentic AI in healthcare found that most of the available studies were exploratory and lacked robust clinical validation, and that only one trial involved patients. An assistant working from an incomplete, duplicated, or subtly wrong record can produce a fluent and plausible conclusion that is still wrong. AI does not make data quality less important. It makes the consequences of poor data quality harder to ignore.

AI cannot read what was never written

There is a more fundamental limitation, and it has less to do with the model than with the record itself. A longitudinal record can tell us what happened, but it rarely tells us enough about why. It preserves the encounter, the diagnosis, the result, and the prescription while losing much of the reasoning that surrounded them. Why was one treatment chosen over another? What was the person hoping to preserve at that point in life? Who else was helping? What changed after the visit, and what did a family member notice before anyone thought to schedule another one?

Suppose a daughter has spent the past year helping her mother manage a handful of chronic conditions across three practices. She has done everything the first round asked of her. She has assembled the record, and she can see every visit, every result, and every prescription in one place. What she cannot find anywhere in it is the moment, sometime in the spring, when she noticed her mother was no longer quite herself: the skipped meal, the walk that got shorter, the pill organizer that stopped emptying on schedule. None of that was an event, and none of it generated a claim. By the time the record catches up, it will document the consequence, a fall or an admission, without the months of evolving context that would have made the consequence understandable and might have created an earlier opportunity to respond.

Those signals are not peripheral to health. They often determine whether a plan is realistic, whether a change is meaningful, and whether someone follows through, and they explain why a clinically complete record can remain an incomplete picture of a person. AI can analyze what it can reach, but it cannot recover context that no system collected, decide whose version of the story should govern, or determine who may act on what it finds. Those questions belong to continuity, governance, and accountability rather than to the model.

There is a further gap that I will only note here. The daughter is not the only one standing outside the record. The aide who comes three mornings a week, the care manager at the Area Agency on Aging, the pharmacist who noticed the refills slipping: most of the people who see the mother most often were never on the patient access rails at all, and their systems, where they have systems, are still in the first round. That deserves its own treatment. For now, it is enough to say that the record the daughter assembled is incomplete not only in what it captures but in who was ever able to write to it.

The real contest is who gets to act

Put these developments together and the shape of the next few years comes into focus. The assembled record is now valuable enough that something will act on it. The open questions are what will act on it, for whom, and under whose authority. The same missed refill could prompt a reminder from a daughter, an outreach call from a care team, an intervention from a health plan, or a commercial prediction by a platform.

Value invites capture. The parties that gain access to the assembled record, particularly those whose business models depend on it, will influence what that record becomes: a resource that helps an individual, family, and care team make better decisions, or an input optimized primarily for a model, marketer, underwriter, or institution. The infrastructure to assemble a record is increasingly available. The infrastructure to ensure that the record continues to work for the person whose life it describes is not.

Concentration also creates exposure, and the protections around the record can change as it moves. The largest healthcare data breach reported in 2025 involved Conduent, a business associate whose back-office services extended across healthcare organizations and government agencies; the reported number of people affected was later revised to more than 62 million. Even when records remain technically distributed, a common interface, credential, or intermediary becomes a concentrated point of access and therefore a valuable target. And when an individual directs health information to an app that is neither a HIPAA-covered entity nor a business associate, HHS has explained that the data the app receives is generally no longer protected by HIPAA. Other protections may apply, including the FTC’s Health Breach Notification Rule and state consumer health privacy laws, but the result is a different and more fragmented legal regime. The point is not to stop assembling the record but to make the tradeoffs visible, and to treat privacy, security, and governance as part of the product rather than language buried in its terms.

What comes next is continuity infrastructure

I am not a neutral observer. HealthHive, the company I co-founded, is built around this problem. But the architectural question exists regardless of which organizations ultimately answer it, and the daughter makes it concrete.

What she needs is not a better pile. She needs a place where the clinical record is preserved as the authoritative account of the care that was delivered; where the context that only she and her mother possess can be added without silently rewriting the clinician’s account; and where the right understanding reaches the right participant at the moment a decision is being made. I think of this as continuity infrastructure: a governed, longitudinal layer of understanding that sits alongside the clinical record rather than replacing it.

Two properties of that layer are especially important. The first is that it distinguishes source from interpretation. The daughter’s observation that her mother’s walks have shortened is not a clinical finding, and it should not masquerade as one; but neither should it vanish because it lacks a billing code. Keeping the two visibly distinct, with provenance attached to each, is what allows a clinician to trust the record and the family to trust that their contribution was heard. The second is that permissions and changes are visible. The daughter’s authority to contribute and to see information should rest on an explicit role or authorization rather than on the relationship alone, and those roles change. A sibling joins the effort, a home health aide arrives, a new specialist enters the picture, and at some point, the mother herself may become less able to direct her own care. A layer that cannot make those transitions legible will either exclude the people who matter or admit everyone with no accountability at all.

AI has a real role inside this architecture. It can help the daughter prepare for her mother’s appointment without pretending she is the physician, and it can help the clinician see what changed at home without asking the family to reconstruct six months from memory. An organization can use it to recognize risk before the next encounter rather than after the next claim. What it should not do is silently become the owner of the story or the final authority over what happens next.

A continuity layer is not exempt from this danger. By making information easier to reach, it can become another concentrated and attractive point of access. It should therefore be judged not only by what it can assemble, but by what it refuses to collect, how clearly it preserves provenance, whether access is visible and auditable, and whether permissions can be withdrawn or changed without dismantling the person’s history. Otherwise, continuity becomes another name for concentration.

Why hasn’t this already happened?

A fair objection is that pieces of this layer already exist. Patient portals accept messages, patient-reported outcomes capture experience, remote monitoring brings information from the home into clinical workflows, and record aggregators can add context. Perhaps the incumbents simply absorb this function, governance and all.

That possibility cannot be ruled out. But these tools are generally governed by the institution, program, or vendor that deployed them. The information they collect does not reliably travel with the person when they change doctors, move between plans, or enter a new stage of life. Nor were most designed to preserve the family’s account alongside institutional records without confusing the two.

Context can be collected today. The test is not whether an incumbent can add these features. It is whether continuity survives when the incumbent’s relationship with the person ends. An institution can sponsor the layer, but if changing doctors, plans, employers, or vendors also changes who controls the accumulated story, the system is not longitudinal in the way that matters. A continuity layer earns the name infrastructure only if identity, permissions, provenance, and portability persist independently of any single sponsor.

Who pays is not who governs

The person whose life the record describes will not always be the paying customer, nor must they be. Health systems, health plans, employers, community organizations, and other institutions may have sound reasons to fund continuity because they benefit when people and the people supporting them make better decisions. Payment and governance are not the same thing. Sponsoring the infrastructure should not confer the right to appropriate the person’s story or quietly optimize it for a purpose the person does not understand. The economic bargain should be explicit: the sponsor is purchasing a defined service and a measurable benefit, and the person’s longitudinal story is not part of the purchase.

That boundary belongs in the product’s permissions, contracts, and technical architecture. If it depends only on the sponsor’s goodwill, “person-centered” is branding rather than governance.

The decisive question will not be which system knows the most. It will be which system remains answerable to the person after it knows.

The second round

Patient access created the possibility of something healthcare has never had: an understanding of the person that can persist across encounters, institutions, and changing relationships without belonging exclusively to any one of them. Part one called patient access a foundation rather than a finish line, and a foundation is an invitation to build, but it does not determine what goes on top. We can build intelligent tools that help individuals and the people they trust understand and steward health over a lifetime. Or we can allow the pile we worked so hard to assemble to become the most efficient input ever created for systems that were never designed to serve the person.

The second round is subtler than the first because the Whammy no longer looks like losing your data. It looks like winning it and then handing it to whoever asks first.

Big bucks. No Whammies. This time, watch the board more carefully.

Stephen Farber is Co-Founder and CEO of HealthHive, and the Vice Chair on the Board of Directors of the American Society on Aging.