The Centers for Disease Control and Prevention (CDC) published a Request for Information (RFI) on Data Intermediaries and Approaches to Strengthen Public Health Data Exchange in the Federal Register on Sept 21, 2026. Comments are due November 20, 2026. For state, tribal, local, and territorial public health agencies, this is an opportunity to describe what it actually takes to receive, trust and use data; beyond what it takes to simply connect two systems.
The CDC is examining the role of intermediaries, including health information exchanges (HIEs), health data utilities (HDUs), and Qualified health Information Networks (QHINs), in secure, scalable public health exchange. Its proposed framework has three layers: a baseline for any intermediary, additional expectations for the services it performs, and requirements specific to public health uses such as electronic case reporting, laboratory reporting, immunization exchange, and syndromic surveillance. CDC is asking where intermediaries add value, where they add burden or risk and how their performance should be assessed. That distinction matters. An intermediary may reduce the number of connections a jurisdiction has to maintain, but fewer connections do not automatically mean better data for public health. Public health still needs to know whether expected reports arrived, whether data were changed in transit, how quickly errors were resolved, and who is accountable when a report does not reach the right authority. Those are questions jurisdictions can answer from experience.
What we heard at Civitas
At Civitas, a panel with CDC, Food and Drug Administration (FDA), and Patient-Centered Outcomes Research Institute (PCORI) representatives returned to a deceptively simple question: What population does the data actually represent? HIE data can bring clinical detail and a broader view across care settings, but the usefulness of an analysis depends on understanding which facilities participate, which patients and encounters are captured, and where coverage is thin. For public health, that “denominator problem” affects how we interpret a trend, identify a reporting gap, or decide whether an apparent difference between communities reflects disease or differences in data availability.
The panel also underscored the need to describe data quality and timeliness plainly. A jurisdiction should be able to distinguish “no cases were reported” from “the feed was delayed,” and “the field was absent at the source” from “the field was lost or changed during transformation.” An intermediary that can provide that visibility offers more than transport. It helps public health decide when data are ready to use.
Standards are essential, but implementation is where trust is earned
HLN’s takeaway from our public health HL7 work is that standards give us a shared starting point, not a guarantee of identical data. HL7 standards can support consistent exchange, and the Bulk Data Access Implementation Guide provides an approach to exporting data for populations at scale. But an export can conform technically while local code mappings, incomplete source fields, record matching, or differing definitions of an encounter still produce results that are difficult to compare. An intermediary serving public health should be able to document its source coverage, terminology mappings, transformation rules, provenance, and validation results alongside the data it delivers.
The RFI is a chance to make those expectations practical. A universal baseline could require transparent routing, acknowledgments, security controls, provenance, and measurable service performance. Service profiles could then address the additional obligations of an intermediary that transforms data, matches records, manages terminology, or performs analytics. A use case profile could specify what an immunization program, an electronic case reporting workflow, or a laboratory surveillance program needs to accept and act on the information. One set of requirements for every intermediary and every public health program would miss those differences.
Considerations for public health agencies as you prepare comments
We encourage public health agencies to respond, even if they cannot address every question. CDC explicitly invites respondents to answer as many questions as they can and to identify the relevant question labels. A concrete example from an existing data flow may be more useful than a broad endorsement of intermediaries. HLN has provided a short summary of what CDC is asking about below, to potentially assist as you prepare your response.
- Where an intermediary has reduced onboarding or maintenance work, and where direct exchange is still the better fit. Describe the use case, participants, and work required on both sides. (RFI questions II.B-1 and II.E-2).
- What evidence you need before relying on a feed. Examples might include participating-source coverage, expected versus received messages, latency, completeness of critical fields, terminology mapping results, duplicate rates, rejected records, and resolution times. (Questions II.B-2 through II.B-4).
- Who has authority to route, transform, link, enrich, and disclose data. Specify which decisions belong to the public health authority, what the intermediary may do on its behalf, and how that authority is documented and audited across jurisdictions. (Questions II.D-1 through II.D-5).
- What implementation support a jurisdiction would actually use. Procurement language, data use agreement and service level templates, onboarding checklists, validation tools, and clear procedures for outages and corrective action are all within the scope of the RFI. (Questions II.E-1 through II.E-3).
- What it costs to keep the service operating after a pilot. Include ongoing staffing, security, mapping maintenance, monitoring, governance, and support for smaller or under-resourced participants—not just the initial connection. (Questions II.C-1 through II.C-4 and II.F-3).
The sustainability issue is especially tangible. A short pilot can show that an exchange is possible; it cannot, by itself, establish who will maintain mappings, onboard new participants, investigate missing data, or pay for operations year after year. CDC is asking about funding and contracting models precisely because those responsibilities need an answer before a promising demonstration becomes dependable infrastructure.
Finally, public health agencies should describe what they can give back. The RFI asks where reciprocal exchange could create value for providers and other partners. Useful possibilities may include acknowledgments, clearer reporting feedback, jurisdiction-specific guidance, and data quality tools that show partners where reports are incomplete, delayed, duplicated, or rejected and most importantly – why. Giving partners usable feedback, and a way to see whether corrections improved the data, could help address problems at the source. Public health agencies could test these approaches with each program and jurisdiction to learn what works in practice.
Comments must be received by November 20, 2026. Submit them through Regulations.gov or by the mail method specified in the notice; CDC says not to submit comments by email. Comments and attachments become part of the public record, so exclude confidential information.
CDC is holding a webinar on Wednesday, Sept 30, 1:00 PM (EDT), the session will also be recorded.
HLN is collaborating with a number of organizations on responses to the RFI and will share our comments in an upcoming blog.