Patient-centered access
Once appropriately identified, patients retain access to their own information and may authorize organizations or individuals to access it.
Concept Version 0.4 · Stakeholder Review
Healthcare information that outlives an outage.
NPRR is a proposed national, participatory capability that preserves longitudinal patient information and keeps it available to patients and appropriately authorized care teams—even when the organization that originated it cannot respond.
Technology-neutral · Patient-centered · Standards-based · Resistant to misuse
The defining idea
Break the dependency between the source of a record and the continuing availability of the patient’s information.
NPRR complements—not replaces—EHRs, health information exchanges, and the TEFCA/QHIN ecosystem. Its national value lies in durable preservation, identity correlation, authorized retrieval, organizational recovery, and continuity during disruption.
Concept foundations
A continuity layer designed around people, trust, and collaboration.
Participation is encouraged rather than mandated. Every additional participant strengthens the completeness and resilience of the national capability.
National identity correlation
An NPID, MPI, and authorized cross-reference functions connect local identifiers without confusing identity matching with permission.
Durable preservation
Preserved information remains available independently of the originating organization’s operational state.
Authorized exchange
Access is purpose-bound, minimum-necessary, traceable, and comprehensively audited across organizational boundaries.
Recovery and resilience
Participating organizations can recover contributed information after ransomware, corruption, disaster, or infrastructure loss.
Technology neutrality
The Concept defines mission, outcomes, principles, and capabilities without selecting vendors, platforms, databases, or hosting models.
Canonical resilience scenario
Hospital A is offline. The patient’s history is not.
Information is preserved
Hospital A previously contributes or preserves patient information through NPRR.
A severe disruption occurs
Ransomware, infrastructure loss, disaster, corruption, or another event takes Hospital A’s services offline.
Authorized care continues
Hospital B retrieves all or an authorized subset of the preserved information through the TEFCA/NPRR ecosystem.
The authority for access can derive from patient authorization, treatment rules, emergency authority, or pre-established governance—and must not inherently depend on Hospital A being online at disaster time.
Nationwide clinical-prior prefetching
More relevant history, ready before care.
Authorized facilities can configure algorithms to discover and retrieve clinically relevant prior studies from participating organizations nationwide. DICOM provides imaging discovery and retrieval, while FHIR and TEFCA-supported mechanisms supply clinical and workflow context.
The intended outcome is simple: clinicians receive a broader inventory of relevant historical priors in time to improve comparison and treatment decisions.
Clinically relevantRules may consider modality, anatomy, diagnosis, procedure, study age, and the scheduled encounter.
Purpose-boundEvery request needs a valid authorization and purpose-of-use basis; identity correlation alone never grants access.
Minimum necessaryControls prevent speculative bulk collection and retrieval unrelated to anticipated care.
Fully traceableFacility, patient, purpose, criteria, source, records transferred, authorization, and disposition are auditable.
Version 0.4 trust requirements
National reach requires enforceable limits on power.
No agency, operator, administrator, funder, regulator, hosting provider, contractor, or security organization receives unrestricted access merely because it supports or oversees NPRR.
Uses the Concept rejects
- Government surveillance, political targeting, immigration enforcement, or population profiling without a legitimate medical purpose and valid legal authority
- Identifying or penalizing people who cross jurisdictions to obtain lawful care
- Speculative bulk searches, mass extraction, re-identification, or AI profiling unrelated to an authorized purpose
- Commercial sale, discriminatory use, insider abuse, or unauthorized access by insurers, employers, vendors, or researchers
Safeguards the Concept requires
- Purpose-bound, minimum-necessary, attributable access with case-specific authority
- Independent oversight, separation of duties, and multi-party control for exceptional actions
- Tamper-evident audit records, misuse detection, public accountability, and patient-visible access histories where safe and lawful
- No universal backdoor, master key, or single institution able to decrypt the repository, erase evidence, or silently weaken patient rights
Participation remains voluntary. Later architecture work must evaluate distributed control, customer-controlled cryptographic keys, zero-trust access, immutable external audit, segmentation, portability, and recovery without selecting a particular cloud or vendor in the Concept.
Law, standards & assurance references
Grounded in healthcare law, national exchange foundations, and recognized standards.
HIPAA is presented as an applicable legal and regulatory framework. FedRAMP High, DoD IL5, and CMMC Level 2 are Concept-level security benchmarks—not claims of certification or a prescribed platform.
TEFCA implementation
↗The governed nationwide exchange foundation that NPRR extends and participates in—not a competing network.
Official RCE resourcesHHS nationwide exchange direction
↗HHS explains TEFCA’s goals, benefits, exchange purposes, governance roles, and direction as a nationwide network-of-networks.
HHS Office of the National CoordinatorFedRAMP High
↗A high-assurance federal cloud security benchmark referenced for the program’s intended rigor.
FedRAMP.govDoD Impact Level 5
↗A benchmark for protecting sensitive unclassified mission information in applicable government environments.
DoD Cyber ExchangeCMMC Level 2
↗A cybersecurity maturity reference associated with safeguarding controlled unclassified information.
DoD CIO CMMC programHL7 FHIR
↗The preferred standards-based mechanism for clinical-data exchange where supported and appropriate.
HL7 FHIR specificationDICOM
↗The primary and continuing interface for medical-imaging storage, discovery, and retrieval—not a legacy interface.
Current DICOM StandardHIPAA
↗The federal legal and regulatory framework governing privacy, security, breach notification, and permitted uses and disclosures of protected health information.
Official HHS HIPAA guidanceProgram document path
From national mission to implementable design.
Each stage resolves the decisions appropriate to its level while preserving traceability to the approved Concept.
Concept
Defines mission, value, principles, capabilities, and boundaries. Version 0.4 is prepared for stakeholder review.
Proposal
Defines governance, program case, participation, funding, adoption, and delivery approach.
Detailed Architecture
Defines implementable technical and operational design after Proposal approval.
Supporting Documents
Requirements, decisions, security plans, policies, roadmaps, and operating procedures.
Primary source
Read the complete NPRR Concept.
The full document includes the settled Concept positions, governance principles, protections against foreseeable misuse, scope boundaries, success outcomes, and the agenda for Proposal and later work.
Download Concept v0.4 PDFContact NPRR
Join the conversation.
Questions, concerns, and constructive challenges are welcome—especially from patients, clinicians, healthcare organizations, privacy advocates, standards bodies, and public-sector stakeholders.
Your information is used only to prepare an email in your own email application. This website does not store or transmit your form entries.