Partners Demo Individual Access to Health Records via TEFCA. What’s Next?
At HIMSS 2025 in Las Vegas, b.well Connected Health drew attention for demonstrating end-to-end patient data retrieval via the TEFCA network, in partnership with CommonWell Health Alliance. Last week, b.well founder and CEO Kristen Valdes and Paul Wilder, CommonWell’s executive director, spoke with Healthcare Innovation about the implications of patients being able to access their own longitudinal health data easily and the next steps they envision.
In collaboration with CommonWell and athenahealth, b.well verified the patient’s identity through CLEAR. It securely transmitted verified demographics to CommonWell, a Qualified Health Information Network (QHIN) under TEFCA. It then retrieved comprehensive patient data locations and extracted detailed health information via CCDAs. Then b.well demonstrated converting complex medical records into accessible, patient-friendly summaries, the company said.
Healthcare Innovation: Kristen, could you start by talking about some of the implications of patients being able to access their records this easily via TEFCA?
Valdes: I have a child with a rare disease. Not having access to her medical records has really shaped the time to diagnosis and the time to treatment, and medical errors have nearly cost her her life throughout our entire journey. This isn't earth-shattering from a technology perspective, but from a patient and a caregiver perspective, it is earth-shattering. Especially for those who have to see lots of specialists, or who are older, we don't remember the names of all of the doctors that we've ever seen. We haven't tracked them over time. We don't have a natural library of things that make up our healthcare. But at the same time, not having access to our information to give to physicians who are treating us or specialists who need to get involved in our care delays their ability to diagnose and treat.
The biggest friction point for consumers to accessing their medical records is that we put this concept of a portal login in the way of giving people their data. People like my daughter have 26 clinical patient portals, and there is no interoperability between portals. I don't know that there necessarily should be, but consumers should have the right to access their information and share it with whomever they perceive to add value in their care.
HCI: Can you describe a bit about what you demonstrated at HIMSS?
Valdes: The beauty in it is how elegantly simple it is, because consumers shouldn't have to understand all the handshakes and complexities and networks behind the scenes. But we do believe in advancing privacy by making this more secure. TSA-level screening of an individual to say David is who David says he is behind the device should be able to unlock where your records are, and with your consent, be able to bring them in. That's what I think we're so excited about.
We did a video demonstration at HIMSS of how easy this is with a person we called Kate. Doing the multi-factor authentication takes one minute to get set up and to get verified. We created the account, and we wanted to get her medical records, so Kate clicks on 'get medical records,' and it goes out to the CommonWell network, and using her demographics that we collected, it took about 30 seconds to find that she had records, and it starts returning them into her health summary. Then you can see all of her information historically, directly from athena, by way of CommonWell. Then there are interfaces that b.well builds in order to make that information understandable by consumers.
It took less than a minute and a half to get somebody their entire medical history from their primary care provider on athena, including signing up for IAL2-level identity. This is the frictionless experience that consumers deserve. [IAL stands for Identity Assurance Level. With NIST’s IAL2, evidence supports the real-world existence of the claimed identity and establishes the applicant as the true owner of this identity.]
HCI: So are other EHR developers and health systems interested?
Valdes: We need more adoption. While athena has said, yes you can do all of this without logging into a portal with a password to each one of your doctors, we have other EHR vendors that are saying, ‘OK we'll use the IAL2 to flow, but we still want you to put in your portal login and password, and there's no good reason for that. So we're working with the industry, and we now actually have a number of health systems that are saying they want to participate, and they're raising their hand to say, this is the way that we should create frictionless access to data for consumers.
HCI: When you get all this data back, how difficult is it for b.well to convert it into accessible, patient-friendly summaries? Do you sometimes get tons of data back about somebody, and then it's difficult to make that intelligible to the patient themselves?
Valdes: Yes, it's really difficult. FHIR APIs through the U.S. Core have gone a long way to improve that, but many people are still transacting through older, more legacy type exchange pathways like CCDAs. We have to do semantic interoperability. We have to de-duplicate, because we get the same information from multiple providers and multiple systems. We're bringing together data between payer, provider, pharmacy and lab that historically has not been merged, and it was never designed to go well together. We have something that we call the intelligence layer that we run on the raw data that comes in so we can normalize it and display it to an individual in a way where they can see whether their labs are normal or not. All of those things are incredibly complicated.
HCI: Is the hope that this will lead to an ecosystem of startup companies that provide individual access services as intermediaries to the health systems — with b.well as a prime example?
Wilder: I think you're going to see more innovation with the data, but the data is hard to work with. Kristen’s team has done a good job of that, but without releasing the data, why would anyone try and figure how to innovate on that, right? Other people are probably going to try and follow, because once you have this spigot, now you can look at the data, and now we have large language models, and you can see if they can try and figure this stuff out for you, but it's still going to be harder than it looks.
I think, b.well and those who've done this work for the last couple of years have significant runway to work with a competitive advantage. We welcome the specific application for the pre-diabetic, for instance. I assume that b.well will add things that are specific to disease states. Once you get down to unique things, I would expect unique micro-apps to appear.
HCI: Is it important that other QHINs besides CommonWell get involved in individual access services?
Wilder: I think many of them don't yet have the onboarding service to have a b.well connect. But b.well has used others over time to test various pieces and on-ramps. And for now, we're happy to be their home, and hope we can maintain that trust relationship. So I don't think there are enough participating as the on-ramps, but I've given up on fighting to force them to do it, and instead I love the idea of proving to everyone else why that stance is wrong and seeing what happens from there. Let the market influence peoples’ hearts and minds. Prove that it works. If you can get 40% of the market moved, that is enough of a voice that they can't not hear it and cannot start to react to the negative parts that they realize they're creating, either by intent or by accident. We want to educate that it's possible and it's safe.
HCI: Kristen, anything else you want to say about next steps? You mentioned working with the other health systems. Does this also involve working with more EHR vendors?
Valdes: Yes. I think Paul does the heroic effort of helping to support and demonstrate to others that this is possible and how they should be doing this from a next-step perspective — to show what we just did, but do it nationally at scale. We need more adoption of the TEFCA network. We need people to join. We also need health systems whose EHRs have not configured solutions to accept IAL to work around their EHRs and respond, because they have the ability and technology to do that. They need to respond to an IAL2 token because it is the right thing to do from a consumer perspective.
We need for all entities to understand that consumer access is a federal mandate. It is something that is here to stay, and it is something that consumers really need. So we want more people to adopt, but there also needs to be the adoption of the IAL2 token. There are a number of identity providers. B.well just happens to partner with CLEAR. They've been a phenomenal partner to us. And IAL2 is something that we need payers and providers and labs and pharmacies and healthcare stakeholders to adopt, because it's significantly more secure and more private. And IAL2 is really a gating factor that we've put onto the national networks, because we don't want anyone just coming in and being able to steal demographics.
I used to work in the Centers for Medicare and Medicaid Services’ fraud, waste and abuse area as a contractor, and you could buy a list of Medicare beneficiaries for less than $300 on the street with all of their information to identify them. As we are moving into this digital era, that detection is really important. We want to make sure that more and more people are adopting these additional privacy tools so that we can start to reduce both fraud, waste and abuse in our healthcare delivery system, but also make people feel more confident that they can collect and aggregate their records and that they're secure and used only by them.
