The overlooked risk in government health IT modernization: protecting the legal medical record

Across federal and state health agencies, a wave of modernization is underway. New EHR implementations, system upgrades and data strategies are dominating conversations and shaping procurement priorities. Requests for Information (RFIs) and Requests for Proposals (RFPs) increasingly emphasize interoperability and artificial intelligence (AI). These ambitions are important, but in the rush to modernize, one critical piece is at risk of being overlooked: the integrity of the legal medical record.

The new pressure for interoperability 

Interoperability is no longer optional. Earlier this year, the Centers for Medicare & Medicaid Services (CMS) announced that reimbursement may be limited for hospitals that fail to meet interoperability requirements. This represents a shift in strategy. For years, regulators tried the direct approach by pressing vendors to become fully compliant with standards such as FHIR and TEFCA. Progress was uneven. Now, by tying compliance to payments, CMS is creating a financial incentive that flows through providers and back to vendors.

This change will ripple through every sector. Federal and state agencies are taking notice, as they face many of the same challenges around data sharing and record exchange. The Veterans Health Administration, for example, has struggled to receive community health records in a timely and consistent way. Interoperability is essential not only for regulatory compliance but also for improving care coordination and patient outcomes.

The allure and limits of AI

At the same time, AI has become the buzzword of nearly every modernization conversation. Agencies are eager to apply it to vast datasets, whether for research into rare diseases, predictive analytics or clinical decision support. Some applications are already proving valuable, as AI systems can flag anomalies in imaging studies, support decision-making and help detect conditions that might otherwise be missed.

But many use cases remain aspirational. AI cannot yet take a raw bucket of unlinked data and reliably reassemble it into accurate patient-level records. When data is extracted from a source system without preserving the relationships between values — for example, which lab result corresponds to which normal range — that context is lost. Neither humans nor AI can reconstruct it.

For research, normalized data models such as the Observational Medical Outcomes Partnership (OMOP) may be appropriate. But for compliance with federal standards like USCDI, records must remain intact and unaltered. Once data is over-normalized for AI purposes, the original legal record cannot be recreated. That poses significant risks in environments where regulatory requirements demand that the designated record set remain complete and authoritative.

Modernization without compliance is incomplete

Interoperability and AI are essential for the future of healthcare, but modernization must also address less visible functions that ensure integrity and accountability. These include:

• Maintaining compliance with designated record set requirements. Even when data is normalized for research or interoperability, an authoritative version must be preserved for legal purposes.
• Ensuring audit readiness. Financial and administrative systems are as important as clinical records for demonstrating compliance and accountability.
• Retaining legacy records long term. Records often must be kept for decades and remain accessible in usable formats.
• Providing rapid, secure access at the point of care. Archiving cannot mean burying records; clinicians must be able to compare past results with current data to make informed decisions.

These obligations cannot be treated as secondary. A plan that overlooks compliance today will create costly challenges tomorrow.

Challenges in the public sector environment

Government agencies face additional complexities that distinguish them from private-sector organizations. Many still rely on highly customized or homegrown systems, some of which are decades old. Extracting data from these platforms can require reverse engineering, as original developers may no longer be available and documentation may be incomplete.

Contracting adds another layer of difficulty. Agencies are experimenting with short-term, prototype-focused agreements to test emerging technologies like AI. While this allows for rapid exploration, it can make it harder to ensure that compliance and long-term requirements are addressed. 

Budgeting cycles also complicate planning. Because budgets are often set years in advance, priorities established in 2025 may not align with needs in 2027 or 2028. This makes it even more important to design modernization strategies that balance short-term innovation with long-term compliance and sustainability.

AI’s promise in practice

It is important to separate what AI is already capable of from what remains aspirational. Today, AI shows strong promise in areas such as:

• Clinical decision support: Aggregating results and recommending possible treatment pathways.
• Imaging analysis: Identifying subtle changes on X-rays or scans that warrant further review.
• Population health insights: Surfacing patterns across large datasets that can inform public health strategies.

These applications show how AI can augment decision-making, speed up analysis and reveal new insights. But they also reinforce an important truth: AI is a tool for enhancement, not replacement. It cannot take the place of careful data stewardship and compliance.

Balancing ambition with responsibility

The public sector has an opportunity to lead in setting standards for responsible modernization. Compliance must be prioritized alongside innovation as interoperability and AI bring tremendous value, but only if the underlying records remain intact. Agencies must be thoughtful about use cases: data normalized for research should be treated differently from the legal medical record, which must remain unchanged to preserve its integrity.

Modernization must also be holistic. It cannot focus only on clinical applications while overlooking financial and administrative records that are equally critical for compliance and oversight. And it must be designed for sustainability, looking beyond today’s contracts to the obligations that will still apply decades into the future, when records are needed for audits, continuity of care or legal defense.

Failing to achieve this balance risks far more than regulatory penalties. It threatens public trust and undermines the very purpose of modernization: to improve care, protect patients and make health data more usable across the entire system.

Conclusion

Modernization, interoperability and AI will shape the future of government healthcare IT. But ambition must be matched with responsibility. The integrity of the legal medical record is not a secondary concern. It is foundational.

As agencies draft RFIs, evaluate vendors and launch new implementations, compliance must remain central. Innovation without compliance is incomplete. By ensuring that modernization strategies protect the legal record while enabling interoperability and AI, agencies can create systems that are not only modern, but also trustworthy, sustainable and truly patient-centered.

Kel Pults is Chief Clinical Officer & VP, Government Strategy at MediQuant.