Disrupting the Information Order in Health Care: Institutions, Policy Regimes, and the Value of Data

The 21st Century Cures Act API Rule seeks to increase the interoperability of patients’ electronic health information (EHI) – individually identifiable patient information related to medical treatment, which can enable actors outside the institutional context and special data protections of health care to gain access to private data. We examine stakeholders’ comments during the Notice of Public Rulemaking on the Cures Act API Rule to show not only how institutional context shapes their views, but also how the change to data flows may also disrupt established institutional meanings and mechanisms. The technical change of the API Rule leads insiders to defend, while enabling outsiders to disrupt institutions in health care. We show how disruption to existing institutional logics, relationships, and the information order challenges professional control of information, threatens provider-patient relationships, and upsets the property rights and data protections of private data in ways that may threaten the existing institutional order of health care in the United States.