Putting the patient at the helm has a few wonderful effects -- among them: all of the red tape around transferring patient medical records from one doctor/institution to another pretty much disappears. They're all about making sure the patient's private data doesn't go to someone the patient wouldn't want to see it. The only reason they need all of those laws is because the patient isn't even in the loop, normally.
We have the core webapp UI; we also have a REST/JSON API for letting apps (and third parties) work with the patient's data (if given permission, of course).
It's a really interesting space to be in. (I'm sure reading the about raises lots of "but what about when" questions; we have answers ...mostly!)
Edit: I should have said: that's what we're doing w/ medical records (not with financial data)
1. Which doctors and insurance plans does PatientsKnowBest work with?
2. Where is my data stored? What happens if I decide to stop using PKB?
I should add that I didn't want to spend the time to watch the 20 second videos, but perhaps I'm not the kind of customer you're trying to capture at the moment
Have you heard of RHEx (http://wiki.siframework.org/RHEx, https://github.com/project-rhex/simple_rhex)? It's an open source implementation of hData (http://www.projecthdata.org) and provides a RESTful, secure way to transmit patient data.
There's no reason it has to be on paper, though...
That way it looks like crap by the time it gets back to you.
I think there's a huge opportunity for some sort of app that gives the customer/patient visibility of their data during its entire lifecycle and gives them controls to revoke access, delete data, etc. (Kinda like I can revoke an OAuth token.)