A follow-up to the previous question
Two weeks ago I wrote a piece on the ownership of out-of-clinic patient data — the argument that when four Taiwanese platforms all said "data follows the patient", what was actually moving was access, agency, and custody. The continuity layer had no real players.
A senior mentor in the industry read it and asked:
"If patient-owned data is an inevitable trend, why hasn't it happened in twenty years?"
We sat with that question for three days. This post is part of the answer.
Our answer: it's not that the trend hasn't arrived yet — it's that every attempt over the past twenty years has been blocked by the same three structural barriers, and those barriers reinforce each other. LinkedIn, between 2003 and 2018, happened to cross some version of those same three barriers in the professional world. Medical records have no LinkedIn-equivalent because the market gap is real, not because the timing is wrong.
And post-acute care — the period of rehabilitation, chronic-disease management, and post-discharge behavioral tracking — turns out to be the seam where those three barriers can most plausibly be sidestepped.
What LinkedIn did in 15 years
Let's unpack LinkedIn.
LinkedIn is not a "résumé website". What it did was move the sovereignty over professional reputation from the employer to the individual.
Before 2003, your professional identity was scattered across separate HR systems — a personnel file at Company A, a separation letter at Company B, a reference letter at Company C. To prove who you were, you had to go back to each employer. The employer was source of truth; you were the applicant.
Fifteen years later, the LinkedIn profile became the canonical version. Employers add endorsements, write recommendations, verify employment — but the profile itself belongs to you, and it travels with you across jobs, countries, and industries, locked to no single employer.
LinkedIn pulled this off with six primitives:
| Primitive | Meaning | Source |
|---|---|---|
| Profile | Self-declared identity, education, skills | User |
| Job history | Time-ordered career record | User (employer-verifiable) |
| Endorsements | One-click skill affirmation by peers | Third party (weak signal) |
| Recommendations | Attributed prose endorsement | Third party (strong signal) |
| Connections | Social graph | User + system |
| Activity feed | Longitudinal activity stream | User + system |
The key isn't any single primitive — it's the direction of sovereignty. All six anchor to the user's account, and the employer is verifier, not owner.
The medical equivalent should look like this:
| LinkedIn primitive | Medical equivalent |
|---|---|
| Profile | Health profile (history, procedures, conditions, self-reported metrics) |
| Job history | Care episode timeline |
| Endorsements | Clinician affirmation of a recovery metric |
| Recommendations | Cross-clinician, cross-institution care summary |
| Connections | Care team plus family caregiver graph |
| Activity feed | Recovery trajectory, PROM trends, visit log |
In theory, each of these should exist. Each should anchor to the patient.
In practice, no company in the past twenty years has built all six primitives anchored to the patient.
Why?
Three structural barriers — and how they reinforce each other
When we laid out every failed attempt side by side, the same three barriers showed up. They are not three independent walls; verification cost creates liability asymmetry, and together they make the bilateral network almost impossible to bootstrap.
Barrier 1: Verification cost is too high
A LinkedIn endorsement happens because a former colleague clicks "yes, you know Python" — done. Nobody verifies it; nobody bears legal exposure for the endorsement. Endorsements are weak signals, but the cost is near zero, so volume gives them meaning.
The medical equivalent is a clinician signing off that "this lab result is correct", "this diagnosis is sound", "this treatment was appropriate". Each sign-off carries clinical validity responsibility, plus the regulatory weight of HIPAA, GDPR, or local medical records law. A five-minute sign-off carries the risk of malpractice litigation.
The action looks the same — affirming a fact — but on LinkedIn the marginal cost is near zero; in medicine it is effectively unbounded. Medical endorsement cannot scale by the same mechanism.
Barrier 2: Liability asymmetry — which is what makes Barrier 1 unbounded
When your former employer endorses you on LinkedIn, the employer carries near-zero risk. The worst case is an inaccurate endorsement, and that doesn't cost the employer money.
When one clinician co-signs another's diagnosis, they effectively absorb a share of the malpractice exposure. This is the cause of the unbounded marginal cost above, not a separate fact about it. In the US, plaintiffs' attorneys watch this carefully. In Taiwan, medical-dispute litigation cites it.
So clinicians have strong incentive to avoid endorsing, co-signing, or cross-attesting — their professional survival depends on that silence. The peer endorsement network LinkedIn built between employers never grew in medicine for this reason.
Barrier 3: Bilateral network effect — which is what (1) and (2) together cause
LinkedIn could bootstrap because it is single-sided: professionals invite professionals, and every new member directly makes the network more valuable. Employers showing up is nice-to-have, not a prerequisite.
Medicine is the opposite: both patients and clinicians need to onboard before the network has value. Patient data without clinician verification is monologue; clinician data without patient longitudinal context is a single snapshot. Once barriers 1 and 2 have made the clinician side unwilling to attest, the bilateral network cannot form. Chicken-and-egg — most attempts died before reaching critical mass on either side.
| Barrier | How LinkedIn crossed it | Why medicine still can't |
|---|---|---|
| Verification cost | Endorsement = one-click, near-zero cost | Clinician sign-off carries legal + compliance burden |
| Liability asymmetry | Employer endorsement = near-zero risk | Clinician co-sign absorbs malpractice exposure |
| Bilateral network | Single-sided (professionals) bootstrap | Patient + clinician chicken-and-egg, amplified by (1) and (2) |
Taken together — and they cannot be taken apart — those three explain why LinkedIn crossed the wall while medical records stayed stuck for twenty years.
Twenty years of attempts — an honest audit
No attempt in the past twenty years built a full LinkedIn-equivalent for medical records. But each one solved a piece:
| Attempt | What they got right | What blocked them |
|---|---|---|
| PatientsLikeMe (2004+) | Profile + Activity feed + Connections (community layer); produced structured patient-reported outcomes still used in research | No verification layer — clinicians never adopted it as a record source |
| Apple Health Records (2018+; 800+ US health systems) | Aggregation infrastructure scaled across thousands of institutions | Architecture still treats the hospital EHR as canonical; the iPhone is the viewer, not the source of truth |
| 23andMe | Single domain (genome) with the user as primary record-holder — actually worked, ~14M reported users | Never expanded beyond genomics |
| DigiMe (UK 2014+) / Patientory (2017–2022, blockchain) | User-as-record-holder architecture was directionally right | Never reached critical mass — orphan problem of demand < supply |
| EU EHDS (in force March 2025) | Regulatory direction is correct and binding | Implementation phases in over 2029–2031; at-scale operation is still ahead, not behind us |
| Estonia X-Road / Australia My Health Record / Taiwan 健康存摺 | National-scale was achieved | Data stays at the institution; the state provides a viewer — the architecture still places the canonical version with the institution |
One-sentence summary: the market is open — the right wedge has not appeared.
The cultural ones (PatientsLikeMe) lacked verification; the infrastructure ones (Apple) didn't shift sovereignty; the regulatory ones (EHDS) are still phasing in; the scale ones (national platforms) didn't change the architecture.
No attempt in twenty years solved all three barriers at once — which makes sense, because (as above) the three barriers reinforce each other.
A calibration: an observation from China
In that same afternoon conversation, a senior mentor mentioned offhand: "In China, when patients are discharged, they get all their records bundled up to take with them — and many digital health companies are helping with the handoff."
We did the due diligence afterwards. The conclusion: the Chinese "discharge bundle" is real, but it is not patient-as-primary-record. It is institution-issued portable copy — a half-step between institutional custody and true patient sovereignty.
Two things to look at:
First, what actually changes hands. Patients receive a paper or PDF discharge summary plus copies of clinical records — not a structured FHIR-equivalent portable bundle. The source of truth remains at the issuing hospital. This is a manual paper/PDF workaround for the lack of system-to-system interoperability, not a superior digital ecosystem. China's Personal Information Protection Law (PIPL, in force November 2021) classifies health information as sensitive personal data, and medical-record copying is a statutory right; the rest is convention.
Second, the role of digital health companies. WeDoctor, JD Health, Alibaba Health, and Ping An Good Doctor are primarily online consultation plus pharmacy commerce. Internet hospitals do operate discharge follow-up centers (ward nurses making post-discharge calls, online re-examination), but this is institution-extended continuity, not a patient-as-broker model.
Why is "bundling" more routine in China than in the West? China's primary-care gatekeeping has historically been weaker and less structurally binding than the UK NHS, the Danish GP system, or many US managed-care networks. Patients can go directly to secondary or tertiary hospitals, across cities, without referral. The domestic cross-regional care dynamic — patients traveling from smaller cities to flagship hospitals — has, over twenty years, trained patients to carry their own past test reports.
This structural condition is what creates the bundling demand. Where primary-care or insurance networks structurally absorb the patient's motivation to carry data themselves, the demand never surfaces.
Put differently:
China is not ahead; it is exposed differently. Weaker referral gatekeeping creates stronger patient-carried-copy demand, while the source of truth still remains institutional.
This gives us a calibration:
- "Patient-owned data is an inevitable trend" — the direction is right, but 'inevitable' is too strong. Thirty years of HIPAA, three decades of EMR evolution, and the West still hasn't actually reached patient-as-primary-record.
- Whether patient-as-primary-record can land is decided not by regulation or technology, but by market structure and actor incentives.
- Without an external force breaking the "institution holds the canonical record" pattern, the West will stay stuck: the law permits it, the implementation isn't there, and Apple Health holds it together as an institutional aggregator.
China is not a "better" model — PIPL's government-centric paradigm is, in fact, a larger obstacle to patient-owned data, and cross-border data flow is even more restricted. The value of looking at China is that it makes the West's bottleneck visible: when you remove the gatekeeper buffer, the portable-copy demand surfaces immediately, but the architecture still gets stuck at institution-issued — unless someone rebuilds it from the patient-generated end.
Why post-acute behavioral data is the wedge
Back to the three barriers. We think post-acute care — the behavioral layer — is exactly where those three reinforcing barriers can be sidestepped. The reason is that the data here originates in a different place than data from ER visits, hospitalizations, or surgical procedures.
Sidestepping Barrier 1 (verification cost): the patient is the origin
The core post-acute data — post-operative PROM scores, wound photos, exercise adherence, pain diaries — originates with the patient themselves. The patient is the source of truth.
We don't need a costly clinician sign-off attesting that "this PROM is correct", because the patient reported it. The clinician's role becomes reading the trend and making a clinical judgment, not attesting line by line. Verification cost drops by an order of magnitude — from "sign every record" to "read the trend".
Sidestepping Barrier 2 (liability asymmetry): behavior is not diagnosis
The fact that "this patient did four 30-minute knee-flexion sessions this week" is not a diagnostic statement. The clinician's judgment looking at the trend is still their clinical responsibility, but they don't need to co-sign that the behavioral record itself is accurate.
Honesty matters here: sidestepping is not elimination. Once a patient-uploaded wound photo, pain escalation, or missed-medication signal is surfaced to the clinician, clinical duty can still attach. The point is that the marginal liability per record is far lower on the behavioral side, not that it is zero. We design around the trend, not around line-by-line attestation, precisely because the line-by-line model is what makes Barrier 2 unbounded.
Sidestepping Barrier 3 (bilateral network): the caregiver replaces the provider side
The practical move here. In post-acute scenarios, the family caregiver typically interacts with the patient more frequently than the clinician — family sees the patient daily; the clinician sees them every few weeks or months.
We designed caregiver co-signature as part of the social-proof layer. A family member attesting "this patient actually did exercise this week" is roughly an order of magnitude easier to scale than asking the clinician to sign every record. The bilateral network becomes "patient + caregiver + clinician (asynchronous verification)" — and the caregiver side scales much more easily than the provider side.
Stack those three workarounds, and that is why post-acute behavioral data is the wedge.
Who pays for this layer is a separate question — value-based care contracts, Remote Patient Monitoring reimbursement, and direct-pay caregiver products are all candidate incentive engines, and different markets will likely converge on different mixes. The point of this post is the architectural argument; the reimbursement argument is the natural sequel.
It is not ownership — it is architecture
Looking back at the six primitives.
To be honest, I didn't start with "let's build LinkedIn for medicine" in mind. What I've focused on for the past 18 months is much simpler: build a tool that patients and family caregivers can actually use, so clinicians and patients can talk using objective data — to deliver care continuity with objective data.
Of the missing primitives we mapped — health profile, care episode timeline, clinician affirmation, cross-clinician recommendations, care network with family caregivers, and recovery trajectory, plus functional-capacity scores and patient-mediated cross-institution verification — most are now live in iRehab; a few core elements (full attestation, verifiable credentials across institutions) are in flight.
Is the alignment with LinkedIn's primitives a coincidence? Partly. But looking back, when you keep pushing on "can patients and family caregivers actually use this?" and on "let clinicians and patients talk with objective data", these primitives grow on their own. The alignment was not strategic calibration; it emerged from the constraints.
Back to the close of the previous post:
A patient doesn't need to physically hold every record. What a patient needs is the agency over the care journey — agency to keep the record alive, to revoke access, to carry it with them.
What this post adds is: what is really changing is not "who owns the data" — it is "where the canonical version lives" — not just whether one can revoke or carry the data, but whether the health record, care journey, clinician affirmations, cross-clinician recommendations, and care network all anchor to the patient.
Nobody has done this in twenty years. China surfaced the portable-copy demand earlier than the West because its referral gatekeeping is weaker — but what patients receive is still a hospital-issued paper copy, not patient-as-primary-record. The EU just put EHDS into force, but at-scale obligations phase in through 2029–2031. Apple Health Records scaled aggregation across hundreds of US health systems but still treats the hospital EHR as canonical. The four Taiwanese platforms each do half of the answer.
The missing LinkedIn for medicine will not start with the hospital record. It will start with the recovery record patients already create after they go home.That is the wedge we are building on.
This post continues the argument in "The ownership of out-of-clinic patient data: from 'institution holds' to 'patient-mediated continuity'". DD details on the China case and primary sources are organized in an internal strategic positioning spec; only the conclusions are referenced here.