Federalism scholarship abounds on nearly all aspects of healthcare: on the Affordable Care Act, public health powers, licensing, and drug and device regulation. Yet it overlooks a healthcare resource as essential as money or drugs: health data. Individual-level records contain intimate details of patients’ entire lives and drive their diagnoses, treatments, and billing. Big data drives public health efforts like gun, opioid, and COVID-19 control. And groundbreaking regulation on the question of health data federalism is ongoing. This Article tells this overlooked federalism story.
Historically, states took the lead in (1) collecting health data, (2) creating networks to transmit data, and (3) curbing inappropriate data release through privacy law. However, in the last five years, the federal government has intruded into these spaces. But it does not just displace state law. Rather, as part of a general policy in this space that favors private entities, the federal government has shifted control from states to private firms. Federal law now mandates that private contracts displace state law in setting the rules of data collection. The federal government has given private entities a lead in developing data networks by shifting incentives to them from states. And it has favored allowing a private entity to preempt state privacy laws that regulated that very entity and its industry.
While health law scholars have considered bilateral tugs-of-war between the federal and state governments in other areas of healthcare, health data federalism shows how a third actor—the private sector—has entered the mix. I explore the problems this raises and offer solutions. The solutions are modeled on federalist healthcare structures like Medicaid and the Affordable Care Act that balance state, federal, and private power. First, the federal government should give states the first option to develop health networks and data collection in conformance with federal guidelines before turning to private entities. Second, the federal government should include states in consultative capacities to direct network development, privacy, and data collection efforts. And third, the federal government should delegate to states the power to carry out enforcement actions against private entities that misbehave. This federalist approach will offer an integrated, balanced solution to health data regulation.