CDC, HHS lack data collection authority

Amid notable debates about changes to utilizing telehealth and prescribing controlled substances at the end of the public health emergency (PHE), one issue has flown under the radar. With PHE restrictions now lifted, pre-pandemic limits on public health data reporting requirements are back in effect.  

At face value, the rollback appears minimal. The Department of Health and Human Services “no longer [has] the express authority” to require labs to report COVID-19 testing data, hospital reports are now required weekly and not daily, and states are no longer required to report vaccine administration data to the Centers for Disease Control and Prevention (CDC).  

However, a Health Affairs commentary pointed out the rollback sheds a light on the “structural limitations” federal agencies faces in gathering public health data from states, counties, cities, or tribal groups.  

Without the authority to mandate data sharing, HHS and the CDC must rely on voluntary agreements. As such agreements lack teeth, data comes to federal agencies in whatever form they can get it – sometimes even by hand – and whenever state or local agencies get around to it. This makes it difficult to coordinate a national response to protect public health, as the nation saw in the early days of COVID-19 as well as the mpox outbreak of spring 2022 – and may have seen if Ebola had reached the nation’s shores last year, former CDC Director Rochelle Walensky said.  

The CDC supports a strategy it describes as locally driven and centrally coordinated data. The agency says this would give the agency a clear picture to drive national decision-making and help local authorities target interventions where needed.  

But the CDC needs Congress to grant this authority, and Congress has punted, instead prioritizing efforts to develop data sharing infrastructure and standardize data collection. While laudable, this is a tall order, according to Health Affairs. Public health data comes in disparate formats, from birth and death records to symptoms reported in emergency departments – and, increasingly, from wastewater data (which showed where COVID-19 remained prevalent) and environmental data (which may show where poor air quality poses a health risk).  

Limited federal authority also gives states the right to refuse to share data. This was the case when states declined to provide individual vaccine records (which could be used for immigration enforcement), and it could be the case if states are asked to turn over reproductive health data (which could be used to file criminal charges against patients and physicians). States could also refuse if they feel the federal government’s public health response will be contrary to their best interests.  

Before granting federal agencies the authority to mandate data reporting, and to satisfy federal and state stakeholders, five things need to happen, Health Affairs said. 

• Governance of data exchange that accounts for the types of data needed, the multitudes of entities providing it, and the desire to avoid data-sharing delays during an emergency. 
• Consensus on data de-identification that balances sensitivity about how personal health information is used with standards set by the Health Insurance Portability and Accountability Act, which doesn’t apply to public health authorities. 
• Limitations on data use that explicitly state data will only be used to support public health decision-making or will otherwise be deidentified before other federal agencies can access it. 
• Clearly defined data retention requirements to ensure only the necessary data is shared with federal agencies and is retained for a pre-defined period (such as a public health emergency). 
• Harmonization of cybersecurity standards at the federal and state levels, particularly for data breach notification. 

 Brian Eastwood is a Boston-based writer with more than 10 years of experience covering healthcare IT and healthcare delivery. He also writes about enterprise IT, consumer technology, and corporate leadership.