Timely and accurate public health data is essential to the advancement of public health, and identification and reduction of health disparities. Today, public health agencies routinely rely on high-quality public health data for surveillance and other public health functions through electronic laboratory reporting (ELR), electronic case reporting (ECR), syndromic surveillance, immunization information systems (IIS) and other systems. These and other data streams can be used to target public health interventions, prepare for emergencies, and identify disparities, such as in infection rates or vaccination rates, by race, ethnicity, sex or zip code.

The use of data intermediaries, such as health information exchanges (HIEs), has become an increasingly powerful tool to accelerate the flow of public health data. The Centers for Disease Control and Prevention (CDC) recently announced a public request for information (RFI) on how data intermediaries can be better used to support public health data exchange. The RFI presents an important opportunity for public health agencies, community-based organizations (CBOs) and others to help shape the governance, funding, and equitable benefits of intermediaries.

Data Intermediaries and Their Role in Public Health

CDC defines public health data intermediary as “a trusted organization, network, platform, or governed service that enables secure, standards-based exchange and stewardship of health-related data among data sources and public health authorities….” These intermediaries provide “shared technical, operational and governance capabilities” and may provide additional services. Intermediaries include HIEs, health data utilities (HDUs), Qualified Health Information Networks (QHINs) and public health data hubs, all of which can play an important role in moving public health data within the public health ecosystem.

Strong Data Governance to Support Neutrality, Oversight and Equitable Implementation

CDC seeks public input in several data-intermediary categories: standards and technical capabilities, sustainable funding, governance, implementation, and evaluation of CDC’s intermediary framework over time. Governance, in particular, brings to the surface questions of law and policy in the exchange of public health data. CDC seeks insight on a governance framework for data intermediaries covering “accountability, neutrality, authority, oversight, and equitable implementation.”

While CDC does not expressly define equitable implementation, the RFI raises issues such as (1) who bears the cost of using data intermediaries to support public health services and who actually receives the benefits, and (2) how financial barriers to participation in intermediaries might be reduced for rural providers, under-resourced public health jurisdictions, Tribal entities and CBOs. Although not called out in the RFI, equity considerations in the intermediary context might also include whether lower-resourced entities have the opportunity to participate, whether the data is representative of all communities, and whether communities represented in the data have a meaningful say in governance. 

Law, Policy and Data Governance Insights Sought

CDC seeks insights on several data governance questions, including how governance frameworks can address roles, delegated responsibilities, authorized uses and disclosures, and dispute resolution. Not surprisingly, law and policy are a recurring theme within the governance discussion. For example, the RFI asks whether a jurisdiction’s laws and authorities should shape governance and accountability expectations placed on data intermediaries. What’s more, CDC seeks input on how differences in “law, reporting mandates, privacy, consent, data use agreements and public health authority” should be factored into a governance framework while “supporting equitable participation.”

These questions highlight the pivotal role of law and policy in the implementation of data intermediaries and public health data modernization generally. Data intermediaries handle vast amounts of data and transport it across jurisdictional boundaries. Law and policy requirements and protections around public health data vary, a fact that is evidenced by disparate laws protecting gender affirming care data and reproductive health data. Reporting requirements similarly vary. Immunization data reporting, for example, is subject to jurisdiction-by-jurisdiction law and policy requirements, resulting in almost universally mandated reporting of immunization data in some jurisdictions, and strict opt-in-only rules in others. Secondary uses of data also bring to the surface law and policy considerations in the intermediary context, such as when the consent used to share the data through an intermediary was limited in scope, or the data was initially shared for a limited purpose. Each of these examples help illustrate how law and policy in many ways drive an intermediary’s ability to receive, access or route data.

Submitting Comments

Comments in response to the Request for Information (RFI) may be submitted via the Federal eRulemaking Portal, www.regulations.gov, or via mail to the Office of Public Health Data, Surveillance, and Technology, Centers for Disease Control and Prevention. 1600 Clifton Rd. NE, MS H21-8, Atlanta, GA 30329. Input should be identified by the docket number CDC-2026-1519 and must be submitted by November 20, 2026.

Join us for a three-day virtual summit for insights and guidance on navigating an ever-shifting U.S. public health data legal landscape. Get valuable information on legal frameworks and agreements for public health data exchange, the disparate confidentiality protections that apply to public health data, and current enforcement, rulemaking and other developments. Sessions will also examine the role of law and policy in supporting justice and community power in data and data technology, including AI. Learn more and register

---

This post was written by Stephen Murphy, J.D., Director, Network for Public Health Law—Mid-States Region.

The Network promotes public health and health equity through non-partisan educational resources and technical assistance. Materials provided are solely for educational purposes, do not constitute legal advice nor create an attorney-client relationship with you or any other person, and are subject to the Network’s Disclaimer. 

Support for the Network is provided by the Robert Wood Johnson Foundation (RWJF). The views expressed in this post do not represent the views of (and should not be attributed to) RWJF.