Platform

Authorization is hard.
Five layers make it simple.

Every product built on Marble inherits all five. The products never have to build them.

01  Permission

One key, every lock.

No two sources accept the same authorization. State by state, province by province, facility by facility, the rules differ. The requester captures the person's authorization in one flow; Marble carries the right authorization to each source, in the form that source requires, and checks it before anything moves.

Every source's rules met
Purpose approved per source
No work pushed to the holder
02  Verify

Prove it is the right person.

Identity is verified before any request goes out, and enriched with the identifiers each holder actually uses, so the right person is matched to the right record across sources that never agreed on an identifier.

Verified before any request
Enriched identifiers
Matched at every holder
03  Access

Reach every system of record.

Digital exchange where it exists, managed retrieval where it does not. Marble connects once to each holder, inside the national frameworks they already work in, and every product built on Marble reuses that connection.

One connection per holder
National networks
Managed retrieval
04  Normalize

Return one usable record.

Whatever a source sends back, a FHIR endpoint or a faxed chart, arrives as one structure: normalized to FHIR, de-duplicated, with the source and the authorization logged on every element.

Normalized to FHIR
De-duplicated
Provenance on every element
05  Use

Turn the records into answers.

Pre-qualification reports, criteria matching, coding inference, time-stamped chronologies and data extraction for the person reviewing it. API and MCP servers carry the same answers into the workflows and AI systems that need data they can trust.

Pre-qual and chronologies
Criteria matching
API and MCP servers
The difference

What changes when the layer is there.

Without an authorization layer

Fax, phone and portal requests, one source at a time.
Authorization collected again for every request.
Identity assumed from a name and a date of birth.
Records arrive as PDFs, faxes and scans.
Weeks of waiting with no status.
No record of who released what, or why.

With Marble

One request reaches every source, digital or managed.
Each source's own authorization rules met, checked at every release.
Identity verified, then matched at every holder.
Records arrive normalized to FHIR, de-duplicated.
Status on every request, minutes to days.
Every release logged with its authorization.

One audit, every product.

SOC 2 Type II compliant across Marble: one attestation covers SettLiT, Medchart and the Marble API, because Marble moves the data for all of them. A 100% pass rate on network audits. DirectTrust Full Member. Reports under NDA through the Trust Center.

Trust Center
DirectTrust Full MemberSOC 2 Type II, tested and attested
Purpose of use

The purpose is approved before the request is sent.

The treatment purpose of use exists so clinicians can share information with other clinicians caring for the same patient. Using it to pull records for anything else, including litigation, is a misuse of the networks, and it has drawn investigations and enforcement across the industry. Marble does not do it and does not condone it.

Every record that moves through Marble moves under a written agreement in which the data source has approved the purpose in advance. The person authorizes the request, and the request reaches each network under a purpose that network has pre-approved for that use. That is why Marble holds a 100% pass rate on network audits, why pharmacies, labs, clearinghouses, state exchanges, EHR vendors and national exchanges keep Marble connected, and why the records hold up where they are used.

It is slower and harder to build this way. It is also the only way that lasts: for the person, for the organizations that hold the records, and for the networks everyone depends on. If a vendor cannot say which purpose each of its sources has approved, ask why.

Standards

In the room where the rules are written.

Marble sits on the working groups that decide what authorization means.

DirectTrust
Full Member, co-chair
Release of Information Working Group and the Patient Enhanced Health Record Locator Service.
The Sequoia Project
Contributor
Privacy and Consent Workgroup, operationalizing automated release across state health data laws.
Carequality
Industry advisory
Pilot group on patient-authorized release of information.
CARIN Alliance
Industry advisory
Consumer-mediated exchange, consumer access, policy and the code of conduct.
Where it runs

Where Marble shows up.