Stop Cleaning Your Clinical Data: A Practical Guide to Messy Interoperability

You’ve been told to clean your clinical data before you exchange it. That advice is wrong. If you wait for perfect data, you’ll never share anything—and the clock is ticking. The ONC HTI-1 final rule makes USCDI v3 the baseline data standard for certified health IT as of January 1, 2026 (ONC / HHS (HTI-1 Final Rule)). You don’t have time to scrub every allergy code by hand. This walkthrough is for the health IT lead at a small hospital or clinic who needs to get clinical data moving between systems without a million-dollar integration engine. I’ll give you a blunt, step-by-step plan that prioritizes exchange over perfection.

1. Start with FHIR R4 and US Core, not your data dictionary

Your first move is to adopt the US Core Implementation Guide (v9.0.0, STU 9), which is built on FHIR R4 and defines the minimum constraints and RESTful interactions for patient data access. Don’t reinvent the wheel. US Core profiles reflect USCDI, so they’re the closest thing to a national standard for clinical data exchange. If you’re still on HL7 v2.7 (published in 2011) for everything, keep it for high-throughput legacy workflows—HL7 v2 is still used by more than 95% of US healthcare organizations—but add a FHIR facade for developer-facing apps. FHIR R4 (version 4.0.1) was the first release with normative content, so it’s stable enough to build on. You’ll map your local codes to SNOMED CT for clinical terms, LOINC for lab identifiers, and ICD-10 for diagnoses. Yes, it’s work. Do it once, in a mapping table, and move on.

2. Pick your exchange lane: query, push, or both

You have three practical options for moving clinical data. Don’t try to do all three at once. Use the table below to choose based on your resources and timeline.

My recommendation: if you’re starting fresh, go FHIR R4 with US Core. If you have a working HL7 v2 interface, keep it and build a FHIR API alongside it. For documents, use CDA R2 for discharge summaries and pathology reports. Don’t overthink it.

3. Map to USCDI v3 and stop there

USCDI v3 has 94 data elements in 19 data classes—up from 52 elements in 16 classes in v1. You don’t need to support every element on day one. Focus on the ones your clinicians actually use: medications (RxNorm), labs (LOINC), problems (SNOMED CT), and immunizations. The ONC HTI-1 rule requires USCDI v3 for certification as of January 1, 2026, so vendors will catch up. Your job is to expose those elements via FHIR resources like Patient, Encounter, and Observation. If you’re a Medicare Advantage plan or Medicaid managed care entity, you’re already required to implement a Patient Access API using FHIR R4.0.1 under the CMS Interoperability and Patient Access final rule (CMS-9115-F). That’s your floor, not your ceiling.

4. Secure the pipe, then test with real patients

You can’t skip HIPAA. The Security Rule requires administrative, physical, and technical safeguards for ePHI. At minimum, implement unique user identification, emergency access procedure, automatic logoff, and encryption/decryption for access control. Use NIST SP 800-66 Rev. 2 (published February 2024) as your implementation guide—it supersedes the 2008 version. For authentication, verify that the person or entity seeking access is who they claim to be. Then run a pilot with 10 real patients. Pull their data via your FHIR API into a third-party app. See what breaks. Fix it. Repeat.

What can go wrong: You’ll be tempted to skip the business associate agreement (BAA) with your app vendor. Don’t. A business associate is anyone who creates, receives, maintains, or transmits PHI on your behalf. Without a BAA, you’re exposed to HIPAA penalties—up to $73,011 per violation for Tier 1-3, and $2,190,294 for Tier 4 willful neglect not corrected within 30 days (Federal Register (2026 HIPAA CMP Adjustment)). That’s not a risk worth taking.

Bottom line

Stop cleaning your clinical data. Start exchanging it. Adopt FHIR R4 with US Core profiles, map to USCDI v3, and build a simple Patient Access API. Perfect data is the enemy of good exchange. Get the pipe working, then iterate. Your patients and your clinicians will thank you.

Sources

• ONC / HHS (HTI-1 Final Rule) - https://healthit.gov/regulations/hti-rules/hti-1-final-rule/
• US Core Implementation Guide - https://hl7.org/fhir/us/core/
• HL7 International - https://www.hl7.org/fhir/
• ONC Standards Bulletin 2022-2 (USCDI v3) - https://healthit.gov/standards-onc-technology/onc-standards-bulletin/onc-standards-bulletin-2022-2/
• NIST SP 800-66 Rev. 2 (HIPAA Security Resource Guide) - https://csrc.nist.gov/pubs/sp/800/66/r2/final
• Federal Register (2026 HIPAA CMP Adjustment) - https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment