Regulations and Funding to Create Enterprise Architecture for a Nationwide Health Data Ecosystem

Abstract

The COVID-19 pandemic highlighted the United States’ lack of a nationwide infrastructure for collecting, sharing, and using health data, especially for secondary uses (e.g., population health management and public health). The federal government is taking several important steps to upgrade the nation’s health data ecosystem—notably, the Centers for Disease Control and Prevention’s Data Modernization Initiative and the Office of the National Coordinator for Health Information Technology’s Trusted Exchange Framework and Common Agreement.

However, substantial barriers remain. Inconsistent regulations, infrastructure, and governance across federal and state levels and between states significantly impede the exchange and analysis of health data. Siloed systems and insufficient funding block effective integration of clinical, public health, and social determinants data within and between states.

In this analytic essay, we propose strategies to develop a nationwide health data ecosystem. We focus on providing federal guidance and incentives to develop state-designated entities responsible for the collection, integration, and analysis of clinical, public health, social determinants of health, claims, administrative, and other relevant data. These recommendations include a regulatory clearinghouse, federal guidance, model legislation and templated regulation, funding to incentive enterprise architecture, regulatory sandboxes, and a 3-pronged research agenda. (Am J Public Health. 2024;114(2):209–217. https://doi.org/10.2105/AJPH.2023.307477)

COVID-19 exposed long-standing problems with the US health data infrastructure, with consequent impacts on public and population health. By mid-2021, 36 states did not publicly report COVID-19 cases, hospitalizations, and deaths regularly.¹ Despite US Department of Health and Human Services’ (HHS’s) 2020 guidance on collecting and reporting race and ethnicity data, the Government Accountability Office found that states and jurisdictions were missing these data for almost half of vaccine recipients, raising concerns over equitable vaccine delivery.^2,3

The inability to rapidly collect and share meaningful data hampered the pandemic response. Public health agencies’ inability to electronically receive and use data was the biggest barrier to hospitals reporting electronic surveillance data, followed by interface issues and problems extracting data from electronic health records (EHRs).⁴ Recognizing these gaps, the President’s COVID-19 Health Equity Task Force recommended a nationwide data ecosystem to improve public health and health equity.⁵ Many government agencies, independent bodies, and networks of experts made similar recommendations^5–14 (Appendix A, available as a supplement to the online version of this article at https://www.ajph.org). Although each emphasizes different priorities and use cases, they fundamentally advocate the same thing: a nationwide health data ecosystem that can routinely and systematically collect, share, and use health data for secondary uses (i.e., uses of health data not directly at the individual patient level, including but not limited to population-level analysis, research, quality or safety measurement, and public health).¹⁵

Even before the pandemic, barriers to the collection and utilization of health data contributed to costly challenges. The Council of State and Territorial Epidemiologists highlights barriers to timely and broad health information exchange, with negative health consequences across multiple case studies: the opioid epidemic, infectious disease surveillance, natural disaster response, and foodborne illness surveillance.¹¹ Data issues contribute to the $760 to $935 billion in wasted health care spending, or roughly 25% of all health care spending in the United States.¹⁶ (We use “health information exchange” [HIE] to refer to the act of information exchange and “health information organization” [HIO] when referring to organizations that conduct and coordinate exchange.)

This article discusses the importance of a “nationwide health data ecosystem,” by which we mean a system with appropriate enterprise architecture and governance to routinely and systematically collect, integrate, and analyze clinical, public health, social determinants of health (SDOH), claims, administrative, and other relevant data. This nationwide ecosystem would retain existing authorities for state, tribal, local, and territorial (STLT) agencies to manage their health data but would have consistent architecture to allow data sharing across and between STLT jurisdictions, agencies, and the federal government. In particular, it would be supported by a single designated entity in each state (and tribal and territorial jurisdictions, as needed) with the authority and capabilities to provide a common set of core functions. This approach to a nationwide health data ecosystem is consistent with the World Health Organization’s recommendation that countries develop “exchanged digital health architecture.”¹⁷ In saying “nationwide” rather than “federal,” we mean an ecosystem encompassing the entire country, which requires infrastructure development, standards implementation, and leadership at the federal and STLT levels.

BENEFITS OF A NATIONWIDE HEALTH DATA ECOSYSTEM

Before assessing how to achieve a nationwide health data ecosystem supported by state-designated entities, we consider whether developing such an enterprise-wide system is justified. Based on the available information, we unequivocally believe that it is, but that further research is needed to quantify economic and health benefits.

Economic Benefits

To our knowledge, the most comprehensive analysis of the benefits of standardizing exchange of health information is the US Regulatory Impact Analysis from the Office of the National Coordinator for Health Information Technology’s (ONC’s) Cures Act Final Rule. It found that the benefits of improved access, exchange, and use of electronic health information for primary use cases resulting from this rule range from $1.2 to $5 billion (Appendix B, Table A, available as a supplement to the online version of this article at https://ajph.org).¹⁸ However, to our knowledge, there is no comprehensive analysis of the economic benefits of secondary uses of health data in the United States. The European Union commissioned an impact assessment for its proposed European Health Data Space, which aims to support primary and secondary uses of data through secure data exchange.^19,20 That report estimates €5.4 billion in economic benefit over 10 years from improved secondary uses (Appendix B, Table B).²¹

Public Health Situational Awareness

Well-executed sharing of electronic health information via HIOs improves public health situational awareness. For example, in Indiana, the statewide HIO infrastructure enabled the rapid development of a COVID-19 dashboard. It collected clinical and administrative data from 117 hospitals, 18 486 medical practices, commercial laboratories, and public health departments, and a notifiable condition detector sent COVID-19 alerts to public health agencies. The COVID-19 dashboard harmonized and integrated these data to identify local outbreaks and reveal disease dynamics.²²

Maryland’s Department of Health partnered with the Chesapeake Regional Information System for Our Patients to route positive COVID-19 test results to the state’s contact tracing platform. Between June and September of 2021, it pushed more than 530 000 records to the state within an hour of receipt, with 99% of those eligible for investigation having a phone number on record, facilitating rapid outbreak investigations by the state.²³

New York City’s Department of Health and Mental Hygiene and New York University developed the NYC Macroscope, a surveillance system that collected data from a large EHR network to estimate prevalence for 8 conditions, and treatment and control indicators for 3.²⁴ It enabled the health department to monitor the health of 1 in 6 New Yorkers, compare provider outcomes, highlight opportunities for delivering preventive services, and guide policy and programs.

Population Health Management and Care

Health systems across the country also rely on HIE for population health management for a range of diseases. Two systematic reviews identified multiple studies that demonstrate beneficial impact on patient outcomes, health care utilization, and quality of care in multiple settings.^25,26 These benefits resulted from reductions in repeat interventions or imaging, improvements detecting medication discrepancies, decreased laboratory and radiology tests per patient, and better decision-making and patient transitions. We note specific examples here.

The Veterans Health Administration system leveraged the Veterans Administration HIE and partnered with a New York’s regional HIO to identify patients with COVID-19 symptoms seen or diagnosed in non‒Veterans Administration hospitals and alert Veterans Health Administration clinicians to initiate follow-up care.^27,28

One study in Louisiana found that exchange between health care delivery and public health improved HIV patients’ engagement in follow-up care, HIV-related health care utilization, and disease progression indices.²⁹ Another study from California found that HIE between ordering physicians and laboratory staff was associated with doubling the odds of antiretroviral therapy use, decreasing racial disparities in its use, and increasing the odds of viral suppression.³⁰

A nonprofit HIO working in one of the poorest counties in California served as a 1-stop information portal for county agencies working with chronically homeless populations. A care coordination platform was linked to the HIE system used by county hospitals and clinics and received data from mental health facilities, probation officers, and the county jail. This allowed social workers and case managers to coordinate care for patients experiencing health inequities, without having to search in clients’ physical documents or direct outreach to another agency. This approach led to a 60% decrease in psychiatric hospitalizations and a one-third decrease in emergency department admissions.³¹

Real-World Evidence

HIE can also support real-world evidence studies. For example, during the pandemic, the VISION network, a collaboration between 7 health care systems and research centers with integrated health records across 9 states, enabled the Centers for Disease Control and Prevention (CDC) to assess the effectiveness of COVID-19 vaccines in reducing hospitalizations, intensive care unit admissions, and emergency department or urgent care visits.³²

The Indiana Network for Patient Care created a specialized registry that extracted electronic claims and clinical data on more than 236 600 patients with traumatic brain injury, spinal cord injury, and stroke, and these data strengthened the evidence linking traumatic brain injury and ischemic stroke risk.³³

CHALLENGES AND ROOT CAUSES

Achieving a nationwide health data ecosystem for secondary uses will need to overcome multiple challenges, which have several root causes.

Challenges

The United States has made significant progress in its health information technology infrastructure, but challenges remain to achieve a nationwide health data ecosystem with appropriate, harmonized enterprise architecture. These include the following:

• •Siloed public health and health care data
• •Variability in HIOs
• •Patchwork digitization
• •Variability in all payer claims databases (APCDs)

Siloed public health and health care data

Health care and public health systems operate in digital siloes with limited data exchange between them. Only about one third of state health agencies can conduct bidirectional data reporting and exchange as of 2016, with 65% having shared data with local health departments, 49% with clinical providers, and 32% with other states.³⁴ Fewer than half of local health departments receive electronic data from physician practices, and only 60% receive data from hospitals. Fewer than 60% of local health departments have implemented technology to link with EHRs, and only 20% have links to HIOs. Data sharing rates are similarly low with government partners and schools, who can serve as sources of data and sites for delivering care.³⁵

As of 2019, fewer than 1 in 5 primary care physicians electronically exchanged (sent or received) electronic health information with public health authorities,³⁶ and a top challenge to reporting to public health is a lack of capacity for electronic exchange among hospitals and public health agencies.³⁷ Moreover, public health information technology systems may struggle to accommodate evolving requirements for EHR data (e.g., new data elements).

Variability in health information organizations

HIOs are designed to facilitate data sharing among multiple entities, typically within a defined geographic region. Unfortunately, as of 2019, only half of HIOs were financially viable. HIOs also provide highly variable services, with only half providing any kind of value-added services (e.g., analytics for population health or quality management). Only two thirds participate in at least 1 nationwide “network of networks” (e.g., eHealth Exchange), and planned participation rates in the Trusted Exchange Framework and Common Agreement are unclear, including because of financial and operational barriers.³⁸

Patchwork digitization

Many providers have not yet fully transitioned to digital records, partly because they were not eligible for funding and assistance under the Health Information Technology for Economic and Clinical Health Act. For example, a 2022 assessment of California’s health information technology landscape found that while 96% of hospitals and 79% of office-based physicians have adopted EHRs, only 32% of skilled nursing facilities and 18% of substance abuse treatment facilities have adopted exclusively electronic means to store and maintain health records.³⁹ As of 2021, nonelectronic methods remained the most common way to send and receive a summary of care records by nonfederal acute care hospitals, and 72% of hospitals reported challenges exchanging data across vendor platforms.^37,40 Moreover, while accountable care organization models promoted SDOH-informed care, an assessment of a national sample of 22 accountable care organizations found that they frequently lacked data required to make well-informed care decisions—namely, patient SDOH data and information about community partners to address patients’ care.⁴¹

Variability in all payer claims databases

APCDs strengthen health data capacities and support policymaking at the state and federal levels. As of 2022, 18 states have implemented an APCD, and 32 states have not. These gaps limit analytic capabilities within these states and the ability to perform cross-state, regional, and national analyses. Heterogeneity in how data users access state APCD data and in state APCD data standards also creates barriers to cross-state or regional analyses and to the utilization of the state’s APCD for broader use cases and impact.⁴²

Root Causes

Inconsistent laws and regulations, and fragmented, insufficient funding both cause the challenges described previously.

Inconsistent laws and regulations

A core barrier to collecting, sharing, and using data within and among STLT agencies is the inconsistencies in laws and regulations between federal and STLT levels, and across STLT jurisdictions. These inconsistencies drive variation in jurisdictions’ ability to properly use health data and unnecessary inefficiency in sharing data within states, across states, and with the federal government. States have the greatest authority to mandate and regulate data collection and sharing, and how health data are regulated by states invariably impacts how they are used.¹⁰ Given state authority and cross-state inconsistencies, a Kafkaesque web of state regulations and rules challenges the development of a nationwide health data ecosystem.

On the one hand, certain laws and regulations can enable effective collection, integration, and utilization of health data from multiple sources. One study found that HIE increased by 18% in states with regulations that made data protection less costly, and 16% in states where legislation specifies opt-out HIE consent for patients.⁴³ Another study found an increased likelihood of HIE associated with 3 state-level laws: state HIO authorization, financial and nonfinancial incentives for HIE, and enforcing “opt-out” patient consent requirements.⁴⁴ Appropriate laws also facilitate data sharing among state agencies.⁴⁵

On the other hand, fragmentation and complexity of state laws pose a burden to the collection, use, and exchange of health data. As of 2015, 40% of states did not have a law authorizing the public health authority to access HIO data, and 80% of states did not have a law requiring providers to contribute to HIO data.^43,46,47 State laws and requirements from Medicaid agencies related to HIOs face significant ambiguity and variability, such as variations in consent policies and requirements for participation.^46–49 These variations create a number of issues. For instance, some state HIE laws may reference privacy, security, or confidentiality without specifying legal requirements, causing confusion about what the law requires. In other states, a lack of mandates or weak incentives limits the total number of users exchanging data, potentially preventing states from achieving critical mass in participation.⁴⁶ The federal government (HHS) often has to rely on states voluntarily sharing their data for aggregation at the federal level.⁵⁰

Regulatory fragmentation and inconsistencies also hamper public health use cases for personally identifiable information. For example, a total of 28 bills were enacted across 17 states on public health information and reporting in 2022.⁵¹ The most recently published survey of state regulations found that only half of states have general use provisions and general release provisions for personally identifiable information for public health use cases.⁵² This creates confusion and a reluctance to use or release data out of caution by government officials.

Well-meaning but uncoordinated efforts by states to standardize how and what health data are collected can lead to differences without meaningful distinctions across states. For example, New Jersey has written into its legislation specific terms for the collection of race, ethnicity, sexual orientation, and gender identity electronic data elements by clinical laboratories.⁵³ Similarly, California has written into its regulations the use of the US Core Data for Interoperability version 2.⁵⁴ By “hard-coding” data standards, states may inadvertently make it more difficult to update standards as they evolve. Certain states have restrictions on what data they share with CDC, thereby limiting analysis and interpretability.⁵⁵

Fragmented, insufficient funding

CSTE and the Healthcare Information and Management Systems Society found that between $7.84 billion for 5 years and $36.7 billion for 10 years is needed to modernize public health data infrastructure.^56,57 According to CDC’s Web site, as of March 2023, CDC has only reported $500 million in Cures Act funding, $300 million through the American Rescue Plan, and $175 million in annual appropriation in the fiscal year 2023, although additional funding may be available through the Prepare for and Respond to Existing Viruses, Emerging New Threats (PREVENT) Pandemics Act.⁵⁸ Furthermore, these cost estimates do not necessarily include costs for enterprise-wide data sets and use cases since they focus primarily on traditional public health use cases only. Indeed, federal funding to STLT often has significant restrictions that prevent investing in a true enterprise architecture approach to health data.⁵⁹

Recognizing these challenges, the Health Information Technology Advisory Committee made several recommendations to the ONC in 2021 on funding mechanisms for the development and maintenance of public health data systems. They specifically focus on the importance of investing in disease-agnostic infrastructure and financially sustainable HIOs that can contribute to public health goals.

POTENTIAL PATHS FORWARD

Despite the importance of ongoing federal initiatives such as Trusted Exchange Framework and Common Agreement and CDC’s Data Modernization Initiative, there is an opportunity for additional efforts to directly address the 2 root causes described previously.^60,61

Changes to legislation and financial incentives are required to establish the appropriate enterprise architecture and governance for health data at the federal and STLT levels. In particular, federal leadership, guidance, and incentives can help each state designate a single entity responsible for the collection, integration, and analysis of clinical, public health, SDOH, claims, administrative, and other relevant data. Such an approach would help each state-designated entity capitalize on the benefits of HIE described previously.

Of course, any change involving health data is politically sensitive and should be designed to preserve patient privacy and security. Therefore, patients, caregivers, and respective advocacy groups are critical constituencies to engage on the following options.

Promoting Consistency Across Jurisdictions

“Clearinghouse” for health data laws and regulations

Promoting transparency on existing regulations and governance structures, and identifying inconsistencies, could help harmonization efforts. A “clearinghouse” could show current laws, regulations, and governance at the federal and STLT levels, identifying variances and opportunities for harmonization. This clearinghouse would track progress among jurisdictions to adopt legislation, regulations, and governance that conform with, or at least do not contradict, federally recommended standards and evidence-based best practices. While the National Council of State Legislatures has searchable databases that track numerous state bills and laws, they do not compare these bills and laws or benchmark them against best practices. We propose creating a clearinghouse to regularly track and compare state health data laws and regulations against one another and to best practices. It would serve as the basis for identifying needed changes to legislation, regulation, governance, and standards at the STLT level. Such an effort could build upon previous research that effectively developed clearinghouses with point-in-time snapshots of laws at the federal and state levels.^43,46,48,49

Federal guidance, model legislation, and templated regulation

Federal guidance, model legislation, and templated regulation could help expedite regulatory development in states and avoid unnecessary divergence. Templated guidance could also be developed where existing regulations support (or do not hinder) data exchange (e.g., the Health Insurance Portability and Accountability Act).⁶²

Federal guidance, model legislation, and templated regulations should offer well-researched options for standardizing the collection, sharing, and use of health data within and between the federal government and states. It should encourage each state to designate a single entity responsible for the collection, integration, and analysis of clinical, public health, SDOH, claims, administrative, and other relevant data. This guidance and model legislation could draw on the emerging concept of a health data utility, defined as “single organization or a jointly governed cooperative of a small number of organizations, ideally operated by a not-for-profit organization with multi-stakeholder governance which, through its mission and function, seeks to meet the comprehensive health data and health data analytics needs of both the public and private sector within a state.”^63(p3) It could include, but not be limited to, the following guidance for state-designated entities: the purposes and scope of data sharing, minimum data collection and reporting requirements, permitted data uses and disclosures, governance and authorities over data, including the (types of) entities with formal authority for data sharing, privacy and security safeguards, data governance and architecture, master patient indexing approach, and strategies for integrating health data with social services data. Of course, many STLTs have different needs based on their populations and political contexts, and they require the flexibility to structure their health data for those needs. Federal guidance and model legislation could be tiered in regulatory intensity or present various options that allow states to enact laws that are well-suited for their needs and also maximize uniformity with other state and federal laws.

Model legislation has been utilized for state public health laws and, notably, can be spearheaded by federal government agencies, such as CDC or ONC, or by nationwide organizations, such as the Association of State and Territorial Health Officials, the National Council of State Legislatures, or the National Governor’s Association. One of the most noteworthy examples in public health is the Turning Point Model State Public Health Act.^64–66

To our knowledge, at least 1 piece of model legislation has been recently developed about governance and standards for health data exchange at the state level.⁶⁷ While many components of this model legislation are relevant to our recommendations, it is critical for model legislation to be developed by a nonpartisan national body with transparent funding, mandate, and processes to ensure evidence-based recommendations.

Funding and financial incentives for enterprise architecture for health data

The Health Information Technology Advisory Committee recommends funding disease-agnostic public health data systems for states and stresses the importance of sustainable financing for HIOs.¹⁴ We agree with these recommendations and believe that they can go further to encourage funding and incentives for an enterprise architecture across all relevant health data types via a state-designated entity. The federal government would incentivize state-designated entities to develop the capabilities set forth in federal guidance, as described previously. The federal government could create a maturity model for performance-based milestones in which state-designated entities can demonstrate capabilities to receive, aggregate, integrate, analyze, and share data, and ability to maintain appropriate data use agreements with third parties.

Promoting Innovation With Regulatory Sandboxes

Regulatory sandboxes permit time-limited pilots to test emerging technologies, services, and business models. Under a set of rules and safeguards, innovations can be tested at the edge or outside the existing regulatory frameworks. This allows for pilot testing at lower costs, reduces barriers to entry for innovators, and informs future regulatory actions.^68–70 Regulatory sandboxes would enable states to experiment with HIE innovations, value-added services, and technologies that have yet to be tested at a national level, and generate the required evidence base for state policy.

For example, the Massachusetts Digital Health Sandbox Program encompasses 10 sandboxes providing a variety of testing and validation environments for new health technologies.⁷¹ It includes the 1up Health Digital Sandbox, which provides digital health apps to request access to medical records for more than 280 million patients via a network of 10 000 hospitals and health centers. It also includes access to more than 1.2 million synthesized patient records for testing.

Building a Body of Evidence and Business Case

To our knowledge, no comprehensive estimate of the benefits of improving the usage of health data for secondary uses in the United States exists. We recommend a 3-pronged research program be supported by government (e.g., CDC, ONC) and other funders to establish evidence in support of investing in a nationwide health data ecosystem, especially for secondary uses:

• 1.Retrospective analysis of previous efforts: Additional research using methods drawn from legal epidemiology and related fields is needed to study the health, economic, and systems impacts of health data regulation. This would provide more evidence-based guidance for states on how to structure their health data and HIE laws.
• 2.Economic modeling of projected benefits: This modeling would draw on point estimates of the benefits of standardizing the collection, sharing, and use of health data to project nationwide benefits, particularly from secondary uses.
• 3.Monitoring and evaluation of future efforts: As the federal and state governments take steps to improve the nation’s health data infrastructure, research should formally evaluate the costs and benefits of these changes. Indeed, changes in state regulations coupled with prospective research designs could help better elucidate the impacts of certain laws and regulations.

CONCLUSION

Despite significant technological and policy advances that have improved the collection, sharing, and use of health data, the COVID-19 pandemic highlighted significant, long-standing deficiencies with our health data infrastructure, particularly for secondary-use cases. We present potential future directions, with specific emphasis on providing federal guidance and state-designated entities responsible for the collection, integration, and analysis of clinical, public health, SDOH, claims, administrative, and other relevant data.