Trusted Data Governance

Managing health data responsibly, transparently, and in ways that protect patients while enabling innovation.

While technology can create tremendous value in healthcare, its effectiveness depends on access to trusted data. Protecting patient privacy requires a combination of strong cybersecurity controls, privacy-preserving technologies, responsible data governance, and compliance with regulations such as HIPAA.

HDGC works to enable the healthcare sector to foster a trusted healthcare data ecosystem where patients and stakeholders have confidence that health information is protected, governed responsibly, and used transparently to support innovation, advance AI-enabled healthcare technology, improve outcomes, and deliver value while maintaining privacy, security, and ethical stewardship.

The Issue

This pillar focuses on establishing clear governance frameworks that define accountability, clarify roles and responsibilities, and promote consistent stewardship of health data across the healthcare ecosystem. Strong governance helps ensure that innovation can advance while maintaining privacy protections, safeguarding patient rights, and preserving public trust.

Key priorities include addressing questions around data ownership and control, promoting accountable and trustworthy stewardship of health information, and increasing transparency and accountability regarding how data is collected, shared, and used, including for AI development and deployment. As technology becomes more prevalent, organizations must be able to clearly communicate what data is being used, how it is being protected, who has access to it, and what safeguards are in place to ensure responsible use.

Additionally, technology is changing the way we think about data ownership, shifting the conversation away from simple privacy and consent, and toward data stewardship, transparency, and patient empowerment. As a result, healthcare leaders increasingly focus on data governance and stewardship rather than pure data ownership.

Policy
Considerations

An effective health data governance framework establishes clear accountability, safeguards privacy, ensures transparent and ethical data use, and supports responsible stewardship of health information. Other elements of a strong data governance framework include:

  • Patient consent and an understanding of how their health information is collected, used, shared and analyzed.
  • Vendor oversight to ensure compliance with data governance standards.
  • Auditability and transparency to help build public trust in the use of emerging technology.
  • Ethical review and governance committees to ensure compliance with regulatory and ethical standards.

Technical safeguards help protect sensitive patient information from unauthorized access, cyberattacks, and misuse while ensuring reliability, transparency, and compliance with privacy and security regulations:

  • Adopt robust technical safeguards, including data encryption,
  • Require strict access controls, multi-factor authentication, audit logging, and privacy-enhancing technologies, to protect health data, mitigate security risks, and support the responsible use of technology across the healthcare ecosystem.

An effective regulatory system protects privacy, establishes clear rules for responsible use of technology.

  • HIPAA establishes requirements for the use, disclosure, and safeguarding of protected health information (PHI).
  • While state privacy laws may impose additional requirements, one federal standard rather than a patchwork of 50-state laws and regulations would be the most beneficial.

Relevant News, Letters & Events

Confidentiality Coalition and HLC response to Health Data, Technology and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity (HTI-5) proposed rule
The Healthcare Leadership Council and the Confidentiality Coalition submitted comments on the proposed HTI-5 rule supporting efforts to reduce unnecessary regulatory burdens while emphasizing that...
Confidentiality Coalition letter to House Homeland Security Committee on ransomware hearing
The Healthcare Leadership Council (HLC) and the Confidentiality Coalition submitted this letter to ASTP/ONC regarding the proposed HTI-5 rule. The letter recommends changes to the...
HLC and Confidentiality Coalition response to House Energy and Commerce Committee Data Privacy Working Group RFI
The Healthcare Leadership Council (HLC) and the Confidentiality Coalition urge Congress to create a federal, comprehensive, harmonized data privacy and security law that preempts state...
HLC and Confidentiality Coalition Response to RFI on AI
The Healthcare Leadership Council (HLC) and the Confidentiality Coalition provide formal comments to the National Science Foundation and NITRD in response to a Request for...
HLC and Confidentiality Coalition comments to CMS on the NPRM entitled, “HIPAA Security Rule to Strengthen the Cybersecurity Protected Health Information
The Healthcare Leadership Council (HLC) and the Confidentiality Coalition support strengthening cybersecurity for electronic protected health information (ePHI) but argue that the proposed HIPAA Security...
Confidentiality Coalition response to the Federal Communications Commission on their proposal to update data breach reporting requirements.
In this letter to the FCC, the Confidentiality Coalition asks the agency to coordinate its data breach reporting rules with HHS, CISA, the FTC, and...