That's what we're doing at PatientsKnowBest.com -- patient-centered medical records where the patient can decide who can see their records, and revoke access if they want. No one can revoke the patient's access.

Putting the patient at the helm has a few wonderful effects -- among them: all of the red tape around transferring patient medical records from one doctor/institution to another pretty much disappears. They're all about making sure the patient's private data doesn't go to someone the patient wouldn't want to see it. The only reason they need all of those laws is because the patient isn't even in the loop, normally.

We have the core webapp UI; we also have a REST/JSON API for letting apps (and third parties) work with the patient's data (if given permission, of course).

It's a really interesting space to be in. (I'm sure reading the about raises lots of "but what about when" questions; we have answers ...mostly!)

Edit: I should have said: that's what we're doing w/ medical records (not with financial data)