I think you might be arguing for data access rights, saying that any application where the data cannot be exported at any time and for no cost by the user is evil.

There is not any new threat here that hasn't been around since before EMR was a buzzword.

For starters, all-browser-based is not the full picture. An application does not have to be browser-based for the data to be inaccessible to the practitioner. I can come up with the following scenarios, all of which are "hosted" applications for the practitioner where obtaining the data might be controlled or carry a cost.

1) Hosted desktop applications accessed over Terminal Services or Citrix where the application and data reside on hardware that is in a separate location than the practitioner. The practitioner may or may not "own" or have control of that hardware. The full environment may be hosted for them by a vendor.

2) Hosted desktop applications that run on local workstations, but where the data is stored off-site on separate hardware. Again, control and ownership of the hardware where the data is stored would have some ramifications on whether the data could be exported freely or not. Whoever "owns" the hardware might actually want paid if exporting the data requires some effort, or they might provide tools to export data on your own.

3) Hosted on the Internet or a private network by a vendor, and accessible with a browser only. This is the scenario you mention, but data access ability is really no different than scenario 2. The only difference is that the application renders with HTML in a browser instead of drawing itself using desktop software techniques.

4) Hosted on a server in the practitioner's office and accessible with a browser only. That server might be fully serviced by the vendor, FOSS or not. The practitioner may have no more access to the data than they did in the above scenarios. Even if they have access (= freedom) they may know nothing about how to "export" that data and may even trigger clauses in their service agreement for touching it.

Your last sentence gives examples of FOSS products, OpenEMR, and ClearHealth/MirrorMed. However, the business model of those vendors is one based on service and support. Free source code or not, I bet they get "paid" if the practitioner wants time spent to copy all their data copied off the servers that are being cared for under contract.

And, let's not forget the advantages of having the data reside on servers that are outside of the control of the practitioner. The data is immune to viruses and "evil" staff or outside tech support personnel that could otherwise affect that data if it were in an office. That's a huge benefit with insurance companies wanting "HIPAA privacy" insurance now on top of all the other insurance that practitioners already have.

As long as a "hosted" offering provides tools to export the data and contractual verbage that the customer always "owns" the data, then the data is safe and secure and accessible. Whether it is freely accessible in terms of cost or not is another matter entirely, and most likely to be dependent on the effort required to copy that data.