Health data exchange without the two-year integration project

Ask a hospital CIO what stands between their organization and better use of its data, and you will rarely hear "we don't have the data." You will hear about the twelve systems that hold it, the regional health platforms that need it, the research consortium that has been waiting eight months for an extract, and the integration project that was supposed to fix all of this and is now in its second year.

Healthcare does not have a data problem. It has a data movement problem, and it keeps trying to solve it one bespoke project at a time.

Every exchange is treated as exceptional

A laboratory feed to the national platform. A referral interface with the clinic across town. An export for the research team, with consent rules attached. Each of these tends to be built as its own small project, with its own point-to-point connection, its own security review, and its own maintenance burden when a system on either end changes. The pattern is understandable, health data deserves caution, but the result is an estate where caution is re-implemented dozens of times, inconsistently.

The cost of that inconsistency is not only the delay on any single project. It is that every connection is slightly different from every other, so knowledge does not transfer, reviews start from scratch, and the tenth integration is barely faster than the first. Worse, when each exchange carries its own hand-built interpretation of consent and pseudonymization rules, the organization has no single answer to the question a regulator will eventually ask: how do you protect patient data when it moves? "It depends which interface" is not an answer that survives an inspection.

The safest exchange is not the one reviewed most heavily. It is the one that runs through controls that were reviewed once and apply everywhere.

Interoperability as infrastructure

The alternative is to treat exchange as a capability of the estate rather than a series of projects. FHIR and the older HL7 interfaces become governed APIs on a shared platform. Consent and pseudonymization rules become policies that execute on every flow that carries patient data. The audit trail that hospital compliance officers assemble by hand for each inspection becomes a standing record.

• New exchanges are configured, not built: the next partner connection reuses the same governed pathway as the last one.
• Access is granted to roles and purposes, not to network addresses, which matters when staff and systems change faster than firewall rules.
• Evidence of every disclosure exists the moment it happens, which is what both GDPR and clinical governance actually ask for.

The shift is as much organizational as technical. When exchange is infrastructure, the security review happens once, at the level of the platform, rather than being reconvened for every connection. A new partner is an onboarding, not a project. And because the controls are shared, improving them improves every exchange at once, rather than leaving a long tail of older interfaces running yesterday's rules.

Raising the bar once

Hospitals working with Waygrid have cut the lead time for a new data exchange from months to weeks, not by lowering the bar, but by raising it once and letting every subsequent project clear it by default.

That is the counterintuitive part worth dwelling on. Faster and safer are usually presented as a trade-off, and in the project-by-project model they genuinely are, every shortcut is a risk. Move the controls into shared infrastructure and the trade-off dissolves: speed comes from reuse, and safety comes from the same reuse. Care coordination should not have to wait for integration budgets. With the right foundation, it doesn't.