AI in Healthcare Diagnostics: Algorithms, Health Data Rights, and the FHIR Standard

Artificial intelligence in diagnostic medicine is no longer a research curiosity — it is an operational reality inside major health systems. As of 2026, the FDA has cleared or authorised over 900 AI and machine learning-based medical devices, the vast majority concentrated in radiology and cardiovascular imaging. These tools are reading chest X-rays, detecting early-stage cancers in mammograms, flagging retinal changes indicative of diabetic complications, and triaging large vessel occlusion strokes in minutes rather than hours. The shift is structural: AI does not replace radiologists or pathologists, but it changes the volume and speed at which they can process cases, and it surfaces findings that human attention, under pressure, can miss.

Three broad categories of AI are now embedded in diagnostic workflows. First, deep learning models for medical imaging — convolutional neural networks trained on millions of labelled scans to detect lesions, anomalies, and measurements with high sensitivity. Second, natural language processing systems that parse the enormous volume of unstructured clinical text — physician notes, discharge summaries, operative reports — to extract diagnoses, extract medication changes, and flag adverse event signals. Third, predictive algorithms that synthesise structured EHR data (lab values, vital signs, medication lists, prior diagnoses) to forecast clinical deterioration events such as sepsis onset, hospital readmission, or acute kidney injury, enabling preventive intervention before the event occurs.

The clinical stakes of AI diagnostic performance are high. A false negative in a cancer screening tool withholds treatment that could be curative. A false positive triggers unnecessary biopsies, patient anxiety, and cost. Regulatory frameworks — the FDA's Digital Health Center of Excellence in the US, CE marking and MDR processes in Europe — exist specifically to validate that AI diagnostic tools meet minimum performance thresholds before entering clinical use. Understanding which tools are cleared, for which indications, and at what performance specifications is essential for any clinician, patient, or health system evaluating AI adoption.

Medical imaging is the most mature domain for clinical AI. IDx-DR, cleared by the FDA in 2018 under 510(k), was the first fully autonomous AI diagnostic system approved in the United States — meaning it can produce a diagnostic output without a clinician reviewing the underlying images. Deployed on retinal photographs taken with a standard fundus camera, it detects diabetic retinopathy at a sensitivity of 87.2% and specificity of 90.7%, sufficient to refer or discharge patients without requiring an ophthalmologist present. This is particularly significant for primary care settings and community health clinics where specialist access is limited.

In radiology, Viz.ai's large vessel occlusion (LVO) detection algorithm ingests CT angiography images, identifies suspected stroke-causing occlusions, and pushes real-time alerts to the on-call neurology team's mobile device. In pivotal studies, Viz.ai reduced door-to-treatment time (groin puncture) by an average of 52 minutes. For stroke, where every 15-minute delay in reperfusion costs approximately 300 million additional neurons, the clinical impact is substantial. iCAD's ProFound AI for digital breast tomosynthesis received FDA De Novo authorisation and has shown a 7.5% increase in invasive cancer detection rate while simultaneously reducing false-positive recalls — improving both sensitivity and specificity simultaneously, which is unusual in screening contexts.

Pathology is the next frontier. FDA-cleared digital pathology AI tools from companies including Paige and PathAI can analyse whole-slide images of tumour biopsies to characterise cancer subtype, grade, and biomarker expression. These tools are particularly valuable in oncology centres handling high volumes of slides, where AI pre-screening focuses pathologist attention on the most diagnostically ambiguous cases. The limitation common to all imaging AI tools is that they are trained on specific imaging equipment, patient demographics, and imaging protocols — performance can degrade significantly when deployed on a different scanner model or in a population that differs from the training cohort.

An estimated 80% of all clinically relevant health information exists in unstructured text — physician notes, radiology reports, nursing assessments, discharge summaries, pathology narratives — trapped in formats that neither traditional databases nor basic rule-based systems can query reliably. Clinical natural language processing changes this. At its most basic level, clinical NLP uses named entity recognition (NER) to extract medical concepts: diagnoses coded to ICD-10, medications mapped to RxNorm, procedures coded to CPT. At a more sophisticated level, contextual NLP models understand negation ("no signs of pneumonia"), uncertainty ("possible early fibrosis"), and temporal relationships ("prior to the 2023 admission").

GatorTron, developed at the University of Florida, represents the current state of the art in clinical LLMs. Trained on over 82 billion words of de-identified clinical text from 2 million patients at UF Health, it uses a 90-billion parameter transformer architecture — at the time of its 2022 publication in npj Digital Medicine, significantly larger than any prior clinical language model. GatorTron outperformed both general-purpose LLMs (including GPT-3) and prior clinical NLP systems on five benchmark NLP tasks: clinical concept extraction, medical relation extraction, semantic textual similarity, natural language inference, and clinical question answering. Critically, GatorTron-S — a distilled 345-million parameter variant — is deployable on standard GPU infrastructure within health system data centres, enabling on-premises inference that keeps patient data within the institutional firewall.

GPT-4 has also been integrated into clinical NLP workflows by a number of academic medical centres, primarily for clinical note summarisation and EHR data extraction. Microsoft's Azure OpenAI Service offers a HIPAA Business Associate Agreement (BAA), making GPT-4 API calls eligible for use with protected health information in compliant deployments. However, general-purpose LLMs trained on internet text have known failure modes on clinical content — hallucinating drug interactions, misidentifying rare diagnoses — making domain-specific fine-tuned models like GatorTron preferable for high-stakes NLP tasks where output is used for clinical decision support.

Sepsis kills approximately 270,000 Americans annually, and its hallmark clinical feature is deceptive subtlety in early stages — vital sign changes that individually fall within normal ranges but collectively signal impending deterioration. Early warning scores like SOFA and qSOFA were the first generation of algorithmic sepsis tools; they are simple point-based scoring systems that clinicians apply manually. The second generation — machine learning early warning systems that continuously analyse streaming EHR data — represents a fundamentally different capability: automated, real-time, and tuned on hospital-specific patient populations.

Dascena's Continuum sepsis prediction platform, which received FDA breakthrough device designation, uses gradient-boosted machine learning trained on over 800,000 ICU patient records. Published validation studies showed an AUROC of 0.86 for sepsis prediction, with a mean lead time of 12 hours before clinical sepsis onset — a window in which early antibiotics and fluid resuscitation have the highest probability of preventing organ failure. Epic Systems' Sepsis Prediction Model, deployed across thousands of hospitals using Epic's EHR, operates similarly, though independent validation studies have found considerable variability in real-world performance across different health systems, with some analyses reporting AUROC values as low as 0.73 in external validation cohorts.

The performance gap between internal validation and real-world deployment is a persistent problem in clinical AI. Algorithms trained on data from one institution can perform significantly worse when deployed at another hospital with different patient demographics, documentation habits, and clinical protocols. This is the core problem that FHIR-based interoperability and federated learning approaches aim to address — enabling algorithms to be trained across multiple institutions simultaneously without centralising patient data, thereby producing more generalisable models.

FHIR — Fast Healthcare Interoperability Resources — is a health data standard published by Health Level 7 International (HL7). Its purpose is to define a common language and structure for health information so that different electronic health record systems, payer platforms, laboratories, pharmacies, and patient-facing apps can exchange data without proprietary, point-to-point integration work. Before FHIR, health data interoperability relied primarily on HL7 v2 messages (a 1987-era pipe-delimited format) and HL7 v3 / CDA documents — standards that were technically functional but practically difficult to implement consistently, resulting in fragmented data that rarely moved reliably across institutional boundaries.

FHIR addresses this by modelling clinical information as discrete resources — self-contained JSON or XML objects representing specific clinical concepts. A Patient resource contains demographics. An Observation resource contains a lab value, a vital sign, or a clinical finding. A MedicationRequest contains a prescription. A DiagnosticReport links a set of Observations to an imaging study or laboratory panel. Each resource has a defined structure, a set of mandatory and optional fields, and a stable identifier. Resources are accessed via standard RESTful HTTP APIs — the same architectural pattern used by modern web services — which makes FHIR accessible to software developers without specialised health informatics training.

FHIR R4, published in 2019, is the first normative release — 120 core resource types are now stable and will only receive backward-compatible changes. This stability matters enormously for AI development. Prior FHIR versions (STU1 through STU3) were draft standards with breaking changes between releases, meaning AI systems trained on STU3-structured data required significant rework to use R4 data. With R4 normative, AI developers can invest confidently in FHIR-native data pipelines knowing the data contract will not change beneath them.

In the United States, FHIR R4 became federally mandated for CMS-regulated payers under the Interoperability and Patient Access Rule (CMS-9115-F, finalized 2020). Payers covered by Medicare and Medicaid Advantage must provide a FHIR R4 Patient Access API and Provider Directory API. Additionally, the ONC's 21st Century Cures Act Final Rule requires certified EHR technology to support FHIR R4 APIs for third-party app access by patients and providers. These mandates created the first large-scale, legally enforced FHIR deployment in the world, generating structured health data at a scale that makes population-level AI model training practical.

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) is the primary federal law governing protected health information (PHI). Under HIPAA's Privacy Rule, patients have the right to inspect and receive copies of their medical records from covered entities — hospitals, physician practices, clinical laboratories, health insurance plans — within 30 days of a request (extendable by 30 days with notice). Covered entities may charge reasonable, cost-based fees for producing copies. HIPAA does not limit what format records are provided in, though the 21st Century Cures Act's information blocking rules have changed this in practice.

The 21st Century Cures Act, passed in 2016 and implemented via the ONC's Final Rule (2020), introduced the prohibition on "information blocking" — actions by health care providers, health IT developers, health information networks, and health information exchanges that are likely to interfere with the access, exchange, or use of electronic health information. Violations carry civil monetary penalties of up to $1 million per information blocking practice for health IT developers and networks, and up to $100,000 per violation for providers. The practical effect is that health systems can no longer refuse to provide machine-readable EHR data to patients or their authorised apps, a significant shift from prior practice where many institutions used proprietary formats or excessive fees to discourage data portability.

A critical limitation: HIPAA's protections apply only to covered entities and their business associates. Data generated by consumer health devices — Apple Watch, Fitbit, WHOOP, Oura Ring, continuous glucose monitors used outside a clinical setting, mental health apps, period tracking apps — is not PHI under HIPAA. It is governed solely by each company's privacy policy and terms of service, which frequently permit sharing with advertising partners, data brokers, and third-party analytics providers. The FTC has some authority over deceptive health data practices under Section 5 of the FTC Act, and has brought enforcement actions against several health app companies, but this is a far weaker protection than HIPAA's structured rights regime.

In the European Union, health data is classified as a special category of personal data under GDPR Article 9, receiving the highest level of protection. Processing health data requires explicit consent, a substantial public interest ground, or a medical treatment necessity. Individuals hold rights under GDPR Articles 15 (right of access), 16 (right to rectification), 17 (right to erasure — with exceptions for healthcare purposes), and 20 (right to data portability — receiving data in a structured, commonly used, machine-readable format). The European Health Data Space (EHDS) regulation, in advanced implementation stages as of 2026, creates an additional EU-specific framework for both primary use (individual care) and secondary use (research, AI development) of health data across member states, with federated access to health data under national data protection oversight.

The consumer health technology market generates an enormous volume of physiological data that sits entirely outside HIPAA's protective framework. A patient whose blood glucose is measured in a hospital laboratory generates PHI covered by HIPAA. The same patient's blood glucose measured by a consumer CGM device synced to a smartphone app does not — unless the data is transmitted to a covered entity as part of a clinical encounter. This distinction creates a significant regulatory gap that has material consequences for patient privacy.

Data from fitness trackers, smartwatches, and wellness apps is routinely shared with third parties under terms that most users never read. A 2021 Journal of the American Medical Association study audited 24 of the top-ranked health and fitness apps on the iOS App Store and found that 19 of them shared user data with at least one third party, with advertising networks and analytics platforms being the most common recipients. Period tracking apps came under particular scrutiny following the US Supreme Court's Dobbs decision in 2022, when legal scholars and privacy advocates noted that menstrual cycle data shared with third parties could be subpoenaed by state authorities in states with abortion restrictions. Several major period tracking app providers subsequently moved to change their data retention and sharing practices.

For patients using AI-powered health tools, understanding which data pipeline their information flows through — whether it enters a HIPAA-covered clinical system or remains in a consumer app ecosystem — is essential for making informed privacy decisions. The practical test is whether the service has signed a HIPAA Business Associate Agreement with the healthcare provider, and whether data is stored in a system covered by the provider's Notice of Privacy Practices. If neither condition is met, HIPAA protections do not apply regardless of how "medical" the data appears.

The most significant near-term development in clinical AI is federated learning — a training paradigm in which AI models are trained across multiple institutions without centralising patient data. Instead of sending raw EHR records to a central server, federated learning sends the model to each participating institution's local environment, where it trains on local data and returns only model weight updates — not patient records — to the coordinating system. The central model aggregates these updates into an improved global model. This approach allows AI developers to access the statistical diversity of large, multi-site patient populations while complying with data residency requirements, HIPAA, and GDPR — all of which restrict cross-border or cross-institutional transfer of identifiable health data.

Patient-controlled health data infrastructure is also advancing. Projects including the Solid Protocol (developed by Sir Tim Berners-Lee at MIT) and Apple's Health Records API allow individuals to store their health data in personal data pods or on-device — and grant granular, revocable access to specific providers or research platforms. This shifts the data ownership model from institutional default-possession toward explicit patient consent for each use case. Combined with FHIR R4 APIs mandated by the 21st Century Cures Act, these technologies create the technical foundation for a future in which patients — rather than hospitals or insurers — are the primary custodians of their longitudinal health records.

For AI diagnostics specifically, this matters because a complete longitudinal health record — one that integrates a patient's entire history across providers, including wearable data, genomic data, and social determinants of health — is the ideal training corpus for personalised diagnostic AI. The technical and regulatory infrastructure is converging to make this possible. Whether the economic incentives align — whether health systems, insurers, and technology companies will support true patient data sovereignty rather than the current institutional data hoarding model — remains the open political and commercial question that will determine how quickly AI diagnostics can reach their full potential.