Written by Jolie Ritzo, CEO, Madelynn Valu, Program Director, and Karen Ostrowski, Director, Health Policy and Partnerships, Civitas Networks for Health®
Navigating federal and state requirements to enable trusted public health, research, and innovation opportunities
As the importance of having real-time health data available at the point of care becomes increasingly recognized for improving patient outcomes, health data exchange and the flow of health information have attracted growing attention. Understanding how protected health data moves and why nonprofit or state-led health information exchanges require strict oversight is essential to ensuring secure, efficient, and high-quality patient care while also allowing for expanded use cases that can lead to innovative solutions in public health and research.
Trust is the Foundation of Reliable Exchange
Health Information Exchanges (HIEs) are, at their core, essential health infrastructure. They exist to connect care, improve health outcomes, and support the public health infrastructure on which communities depend. Yet all of this relies on the trust of patients, providers, and institutions who share sensitive data because they believe it will be used appropriately and protected rigorously. And precisely because of the data HIEs hold – clinical notes, diagnoses, medication histories, records of mental health treatment and/or substance use – they operate within a governance and legal framework that determines who can access data, for what purposes, and under what conditions. Such a framework is central to what HIEs do. Data cannot and should not move without this, and it cannot move without a lawful basis for doing so. Far from stifling innovation, governance is what allows HIEs to scale responsibly, gain the public’s confidence, and explore expanded use cases.
A Robust Legal Framework
The legal architecture governing HIE data is layered, comprehensive, and specific. HIPAA establishes the national baseline for how health data can be used, shared, and protected. But HIPAA is a floor, not a ceiling, and it specifies when patients must give their explicit permission before certain data moves. Many states have laws that layer additional requirements on top of HIPAA – including stronger protections for mental health records, genetic information, HIV status, and other sensitive categories. An HIE operating across state lines must map those differences, identifywhere laws diverge, apply the most protective standard, and document the legal basis for every disclosure. Though it is not uncommon for HIEs to hear, “We want access to this data” for a multitude of reasons, it does not constitute a legal basis. Rather, new requests have to go through a rigorous governance process.
Turning Requirements into Practice
Legal requirements are made operational through governance documents. Participation agreements, data use policies, and consent frameworks turn legal and ethical expectations into everyday practice. These documents answer the basic but crucial questions: who may see what data, why, and under what safeguards? They also codify patient rights—access, amendment, restrictions—and set up the audit trails that prove those rights are honored. Without clear agreements, even the best technology can’t ensure accountability.
Technology as an Enforcement Layer
Technology enforces the rules in practice. Identity management, role-based access, encryption, and comprehensive logging keep data flowing to the right people for the right reasons. But technology alone isn’t self-regulating; governance bodies such as advisories, boards, privacy committees, clinical councils, and independent auditors, must continually review and adjust policies so controls remain fit for purpose as needs and risks evolve.
That legal complexity serves an important purpose: it protects patients, creates accountability for the organizations entrusted with their data, and defines the boundaries that make trust possible across the exchange ecosystem. When an HIE receives a request for data—whether from a researcher, government agency, public health authority, or another party—the central question is not simply whether the request is credible or well-intentioned, but whether the disclosure is lawful. Has the patient authorized or consented to information sharing? Does a recognized exception apply? Has the data been appropriately de-identified, in the case of surveillance or research? Has a data use agreement been reviewed and executed? These conditions are what make disclosure legitimate; without them, refusal is not only appropriate, but necessary.
Public Health and Research in Practice
These legal and technical guardrails become tangible in public health work and research. For public health, locally governed nonprofit or state-led HIEs can automate reporting for surveillance and outbreak response, but only when the data elements, triggers, and recipients align with state mandates. For research, HIEs provide powerful, real-world datasets, but responsible access requires clear data-use agreements, review by Institutional Review Boards (IRBs) or privacy boards, and safeguards like de-identification, limited datasets, or secure enclaves. In both cases, the governing principle is the same: the purpose of data access does not override the legal requirements for obtaining it. A legitimate research question still requires a lawful pathway, just as a public health priority still requires documented authority.
Better Governance, Better Data
Good governance also makes the data itself more useful. Standardization, provenance metadata, and stewardship practices make datasets more reliable for analytics and research while preserving a clear chain of accountability. That accountability structure allows HIEs to define tiers of access (clinical care, public health surveillance, approved research) and apply technical controls and review mechanisms that permit meaningful analysis without unnecessary patient exposure. Inclusive governance is also essential. As HIE use cases expand, governance must include all relevant stakeholders—particularly those who use the data and those affected by how it is shared and managed—to ensure policies reflect diverse needs and perspectives.
The Promise of Trustworthy Exchange
In the end, governance is what powers responsible progress in health data exchange. By translating federal and state requirements into clear contracts, operational safeguards, consent mechanisms, and active oversight, HIEs can unlock public health and research value while protecting patient privacy. That balance, between data-driven benefit and enforceable accountability, is the promise of a trustworthy health information exchange.
