Civitas Networks for Health® (Civitas) and the Consortium for State and Regional Interoperability (CSRI) have an established, longstanding partnership, with both shared and delineated roles, that, among other things, has been instrumental in advancing the concept of the Health Data Utility (HDU) model. Through both individual and joint educational, knowledge sharing, and advocacy efforts, Civitas and CSRI have worked to align the health data industry and other key stakeholders on what an HDU is and how state-based and local health infrastructure can be used to optimize the collection, analysis, and exchange of health data to improve health care delivery and system efficiency, reduce disparities, and modernize public health data infrastructure.
By Madelynn Valu, Program Director, Civitas Networks for Health and Marc Overhage, CEO, Consortium for State and Regional Interoperability
Purpose
This article explains why local networks—health information exchanges (HIEs) and their evolved form of Health Data Utilities (HDUs)—are essential trust infrastructure, and how they complement national exchange frameworks (e.g., TEFCA) and other national-scale implementers.
Key Takeaway: Trust is Built Locally
HIEs are grounded in local communities and governed by transparent policies and trust principles that protect patient privacy, security, consent, and data integrity. National networks and implementers of national exchange frameworks decide who may join and, therefore, who can gain broad access to patient data; as policy moves toward greater automation and scale, the distinction between trust at the community/state level and trust at the national level becomes more consequential. Local networks operationalize accountability; national frameworks extend reach and conceptually make great sense—but without careful oversight, can also amplify misuse and downstream uncertainty, particularly if processes bypass local guardrails.
Why Local HIEs Build Trust (and Why HDUs Extend It)
Local governance and accountability matter. State and regional HIEs bring local stakeholders—providers, payers, public health, behavioral health, social services, and patients—to the table and translate policy and technical rules into governance that is credible in the community. That accountability supports enforceable privacy and use policies, builds public confidence, and enables rapid policy implementation when state leaders refine consent or appropriate-use rules.
HIEs function as neutral, community-trusted intermediaries. As widely trusted neutral brokers for data exchange, HIEs reduce friction among disparate systems and help resolve disputes about appropriate use. Their neutrality is reinforced by public scrutiny (consumer advocates, legislators, Medicaid, and public health partners) and by business models that generally do not depend on downstream monetization of patient data.
HIEs have proven operational scale, service reliability, and data quality feedback loops. They process high volumes of transactions daily and support care coordination, reduce duplicative testing, reduce medication errors, and improve public health reporting. For example, the Michigan Health Information Network (MiHIN), a state-designated HIE includes 13 million patients and covers 99% of statewide hospital admissions. Likewise, the Chesapeake Regional Information System for our Patients (CRISP), Maryland’s HIE connects all 47 acute care hospitals in the state, maintaining a Master Patient Index of over 18 million individuals and routing more than 250 million documents and clinical data elements annually. In terms of data quality, many HIEs act as a “universal translator”. For example, the Indiana Health Information Exchange (IHIE) automatically translates proprietary clinical codes from various stakeholders into national standards like LOINC. Just as importantly, HIEs can identify data-quality issues (missingness, mismatches, stale demographics) and drive remediation with local participants—an ability national routing networks typically cannot enforce.
HIEs connect parts of the health care ecosystem that EHRs do not fully serve. Vendors did not design EHRs to support the full range of public health, behavioral health, long-term care, rural provider needs, and many community programs. HIEs have made many of those connections, enabling a more complete patient view by integrating non‑EHR systems and community providers.
State-based infrastructure enables granular privacy controls, including sensitive data exchange. Many state HIEs can track patient consent in a way that supports careful sharing of 42 CFR Part 2 data (and other sensitive classes) with the appropriate care team. This capability is difficult to implement at a national scale.
Local networks protect competition and patient agency. By aggregating data across multiple sources, state HIEs reduce vendor lock‑in and ensure that smaller, rural, and independent providers can access the same breadth of information as large systems. Many also offer patients access to their aggregated record—positioning them to safely enable patient-directed apps and emerging AI-based health agents under a trusted governance model.
A Key Variable: Attribution Rather than Assertion
Attribution-based queries strengthen trust. Attribution-based queries require verifiable evidence of an existing care relationship (e.g. an audit trail or a documented reason for access). This model supports patient identity verification, consent management, and retrospective accountability, proving that access was appropriate both before and after the exchange.
Assertion-based queries can weaken trust at scale. Assertion-based queries grant access based on a requester’s claim to be treating the patient. Without strong local verification, enforceable policies, and auditability, assertion-based models are more likely to erode trust. This is especially true when paired with broad national onboarding as these models lack evidence-based guarantees of appropriate relationship and purpose.
HIEs and HDUs: Moving Beyond Exchange to Accountable Data Stewardship
Longstanding HIEs are the foundational platform from which HDUs are built. They are essential to whole‑person care, accelerated value‑based transformation, and modernized public‑health data systems. HDUs build on and broaden core HIE strengths—advanced technical capacity, deep local partnerships, interoperable services—anchored by trusted governance and rigorous patient‑data protections that enable secure, equitable community‑wide data use.
National frameworks differ in control and scale and should not substitute for local trust. Implementers of national networks control onboarding and technical access. That control can enable broad, efficient exchange, but also concentrates who can gain widespread access to patient data. Relying solely on national approaches risks losing local context, enforceable oversight, and critical connectivity to under-resourced sectors.
The Solution is Complementary
TEFCA, national networks, HIEs, and HDUs should be viewed as complementary rather than mutually exclusive. Local entities provide granular governance, sensitive-data consent operations, community trust, and quality enforcement; national frameworks extend reach across regions and states. A resilient, trustworthy national ecosystem needs both: local accountability to create trust and national connectivity to move data when patients and care cross boundaries.
Recommendations
Preserve and invest in HIEs, accelerating their evolution into HDUs as critical public-interest infrastructure while integrating them with national frameworks. This includes policy and funding actions that encourage states to partner with HIEs to support Medicaid, public health, social determinants of health, behavioral health, rural health connectivity, and other state/local use cases. This also includes direct investments in HIE infrastructure including modern interfaces (FHIR/APIs), secure exchange services, analytics platforms, and long‑term sustainability mechanisms so HIEs can meet state data needs.
Design national onboarding and access controls to require alignment with local governance and enforceable trust principles; national auditability, policy purpose, account limitations, and meaningful consequences for misuse. Account for use cases whose ceiling of effectiveness is state or local (public health surveillance, behavioral health, Medicaid operations, rural connectivity), and for national use cases that depend on trustworthy local data (quality measurement, preparedness, research).
Bottom Line
HIEs are the locally rooted trust engines of health data sharing in the U.S.; HDUs extend that trust into broader data stewardship and public-purpose analytics. National frameworks can scale connectivity, but they cannot replace the local governance, consent operations, and accountability that make sharing trustworthy. A trustworthy national ecosystem requires both secure national frameworks and strong, well-governed local HIEs and HDUs that bridge policy, technical standards, and community expectations.
About
Civitas Networks for Health®
Civitas Networks for Health® is a national collaborative comprised of member organizations working to use health information exchange, health data, and multi-stakeholder, cross-sector approaches to improve health.
Consortium for State and Regional Interoperability
The Consortium for State and Regional Interoperability (CSRI) is a coalition focused on HDU advancement comprised of some of the nation’s largest and most robust nonprofit health data networks. The organization serves as a platform for collaboration, knowledge sharing, and the development of model capabilities to advance CSRI’s vision that every state should have a statewide HDU.
