Under the Interoperability and Patient Access Rule (CMS-9115-F), health plans are required to improve electronic access to health information for members and providers. This rule empowers members by giving them greater access to and control over their health data.

What Does This Mean for Harbor Health Members?
Starting in 2026, members can use third-party applications (apps) of their choice to access certain health plan data, including:

Claims information (medical, pharmacy, and encounter data)
Clinical data (if maintained by the plan)
Provider directory information
Formulary data

This access is available through secure, standards-based APIs (application programming interfaces). Once an app is authorized by the member, the app can retrieve their data directly from the health plan’s system.

Important Considerations Before Using a Third-Party App
Before choosing an app to access your health information, it’s important to understand how your data may be used. While Harbor Health protects your information under strict federal and state privacy laws, third-party apps may not be held to the same standards.

We encourage you to take a few moments to review the app’s privacy policy and terms of use. Ask yourself: Who will have access to my data, and how it will be used? Some apps may share or even sell your data to advertisers or other companies. Others may use your information for marketing purposes, or store it in ways that don’t meet healthcare-grade security standards.

Understanding your rights is essential. For example, if you decide to stop using the app, will it delete your data or keep it? Does it let you control how your data is shared? And does it protect your information from unauthorized access?

We recommend asking these questions before using any health app:

Will my personal health data be shared with other companies or advertisers?
Will the app use my data to send me marketing messages?
Can I delete my information if I choose to stop using the app?
What steps does the app take to keep my data secure?

By taking these precautions, you can make informed choices about how your health information is accessed and used outside of Harbor Health.

How to Access Your Data
Members will be able to access their health data by connecting an authorized app. If you need help or have questions about your health data access, please contact us at:

Email: compliance@harborhealth.com

Covered Entities and HIPAA Enforcement
The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security, and Breach Notification Rules. Harbor Health is subject to HIPAA as are most healthcare providers, such as hospitals, doctors, clinics, and dentists. You can find more information about your rights under HIPAA and who is obligated to comply with HIPAA for individuals.

How to File a Complaint
To learn more about filing a complaint with OCR related to HIPAA requirements, visit the U.S. Department of Health & Human Services website.

Apps and Privacy Enforcement
An app generally will not be subject to HIPAA. An app that publishes a privacy notice is required to comply with the terms of its notice but generally is not subject to other privacy laws. The Federal Trade Commission Act protects against deceptive acts (such as an app that discloses personal data in violation of its privacy notice). An app that violates the terms of its privacy notice is subject to the jurisdiction of the Federal Trade Commission (FTC). The FTC provides information about mobile app privacy and security for consumers . If you believe an app inappropriately used, disclosed, or sold your information, you should contact the FTC. You may file a complaint with the FTC, using the FTC complaint assistent.

Technical Details for Developers
Starting in 2026, we will provide third-party app developers with access to the appropriate API. Our APIs conform to the HL7® FHIR® standard, as required by CMS, and include the following endpoints:

Patient Access API
Provider Directory API
Formulary API

Please note we will update this section and provide links when there is available member data in 2026. Developers must register their applications and comply with outlined security and privacy practices.

Explore the Harbor Health Benefit Plan