Modernizing Public Health Data Systems: Legislative Trends and Policy Approaches

Key Takeaways

Public health agencies across the country are modernizing the way they collect, share and use information. This effort-commonly referred to as public health data modernization-seeks to upgrade siloed, manual and often outdated systems with tools that enable real-time monitoring, more accurate disease tracking and better resource allocation.

Historically, public health data reporting has lagged behind technological advances. Health care providers once mailed reports or relied on telegrams, phone calls and faxes. While most providers have implemented an electronic health records (EHR) system capable of electronic records sharing, some still rely on fax and phone to transmit critical health information. These methods can delay analysis and introduce human errors, especially during emergencies when speed and accuracy are essential. Recent crises like the COVID-19 pandemic and the Flint water crisis underscored the limitations of existing systems and the potential for timely, accurate, and secure data exchange.

While the pandemic highlighted vulnerabilities in existing systems, the opportunity for improvement extends beyond infectious disease outbreaks. Data modernization may better equip agencies to respond to ongoing and future challenges such as the opioid epidemic, rural hospital closures, chronic disease and emerging infectious diseases.

Modernized systems aim to improve public health readiness and response. They allow health care providers, laboratories and public health agencies to share data electronically and in real time. This strengthens the ability to detect outbreaks earlier, allocate resources more effectively, and improve communication with the public.

According to the CDC, the overarching goal of modernization is to empower stakeholders at all levels-policymakers, providers, practitioners, researchers and patients-with timely, actionable data.

Legislative Approaches to Public Health Data Modernization

States vary in their approaches to modernizing public health data systems. State legislative action includes:

• Allocating resources for infrastructure improvements.
• Establishing governance, oversight and interagency coordination.
• Enhancing data collection and reporting.
• Strengthening health data privacy and consumer protections.

Allocating Resources for Infrastructure Improvements

Some states have dedicated funding streams to strengthen public health infrastructure. Oregon appropriated $50 million for local data system modernization, including $20 million for public health modernization.

In Montana, lawmakers extended a previous appropriation for public health IT modernization, which had been set to expire on June 30, 2025. The appropriation now continues through 2027 and incorporates federal American Rescue Plan Act funds, alongside more than $135,000 annually for strengthening public health infrastructure and data system improvements.

Establishing Governance, Oversight and Interagency Coordination

State legislatures are also creating governance structures-advisory committees, task forces or governance boards-to guide modernization efforts and improve interagency coordination. These entities are often tasked with guiding data modernization efforts and ensuring alignment with state and national requirements.

Florida created the Health Care Innovation Council within its Department of Health. The council is tasked with submitting annual reports to the governor and legislature and administering a health care innovation loan program. It brings together health care professionals, entrepreneurs, and technology experts to improve patient outcomes, increase efficiency and reduce costs.

Oregon's Public Health Division convened a subcommittee of health officials, advisory board members and community representatives to develop recommendations on data modernization. North Carolina and Colorado have formed similar advisory groups to oversee modernization efforts.

Many states are working to overcome broader interagency challenges, particularly around sharing and coordinating data across health, education, corrections, housing, and other departments. In 2017, Massachusetts created the Public Health Data Warehouse. The warehouse integrates data from diverse sources within the Department of Public Health and across agencies such as corrections, housing, veterans services, family services, and industrial accidents. Since its launch, the warehouse has been used to address a wide range of health issues within the state including substance use and COVID-19.

Utah expanded the authority of its Health Data Committee-which includes the insurance commissioner, two legislators, a data privacy advocate and other appointees- to include modernization and data sharing. The committee is responsible for specifying the types of information collected from emergency medical services and emergency departments, as well as determining how and with whom the data should be shared.

Enhancing Data Collection and Reporting

Some state legislatures are expanding the scope of data collected and/or requiring more consistency in reporting. Some laws require health systems, laboratories and public health agencies to report specific data electronically. Most laws focus on communicable diseases, such as influenza, tuberculosis, and COVID-19 while others expand reporting requirements to include chronic conditions, like heart disease or diabetes.

Illinois HB 2039, known as the Public Health Data Act, requires certain state agencies to provide the latest available data to county departments for purposes such as "preventing or controlling disease, injury or disability."

Virginia's State Office of Rural Health created the Rural Health Data Commons to collect neighborhood-level data on rural populations to inform targeted planning and resource allocation for overall health and well-being.

Strengthening Health Data Privacy and Consumer Protections

As technology continues to expand its role in health care, protecting personal health data and strengthening consumer privacy have become growing areas of focus for state legislatures. Federal laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the Affordable Care Act provide baseline protections for individuals' medical records and other identifiable health information. However, these frameworks were designed for traditional health care settings and do not fully address the range of personal health information generated today through digital tools, mobile applications, wearable devices and emerging neurotechnologies.

Many states have begun moving beyond federal requirements to address these new challenges. During 2025, seven states-Alabama, California, Connecticut, Illinois, Massachusetts, Montana and Vermont-introduced legislation specifically focused on regulating neural data privacy. Connecticut enacted SB 1295 which amended the state's Consumer Data Privacy and Online Monitoring Act, to include neural data as a protected category. Montana enacted SB 163 which expands the Genetic Information Privacy Act to include neurotechnology data, ensuring that this emerging form of health information receives the same level of protection as genetic data.

States have also turned their attention to other types of health-related information not covered under HIPAA. In recent years, Washington extended privacy protections to health data collected through digital platforms, including health-related apps. The law prohibits the use of geofencing around health care facilities-a practice that can track individuals entering or leaving a location with or without the consumer's knowledge-and requires consumer consent before health data can be sold or shared. It also establishes civil penalties for any person, business or entity (not covered by HIPAA) that collects, shares, or sells consumer health data of Washington residents without following the act's requirements. The same year, Nevada and Connecticut enacted similar measures, which grant patients the right to request deletion of their data.

Kentucky took a broader approach in 2024, enacting a consumer data protection law that includes health-related information. The law defines health data as a type of personal data which the consumer has the right to remain private and protected, including biometric data, health records and other personal health information.

Conclusion

Some states are considering public health data modernization strategies to strengthen preparedness, improve efficiency and enhance health outcomes. While approaches vary, states are considering policy levers like allocating resources for infrastructure improvements, establishing governance, oversight and interagency coordination, enhancing data collection and reporting, and strengthening health data privacy and consumer protections. Modernized data systems may empower practitioners and policymakers to respond swiftly to health threats, allocate resources effectively and improve transparency in the health system.