Summary

  • CDC’s September request asks stakeholders to shape a layered framework for public-health data intermediaries; it is an information request, not a new mandate or procurement.
  • The open questions reach beyond software: who may direct data flows, how local authority and oversight fit, and who pays for shared infrastructure.

CDC has made data intermediaries a design question for the next phase of its public-health data strategy. In a Federal Register notice published on 21 September, the agency asked how trusted organizations, networks, platforms or governed services could support secure, standards-based exchange between data sources and public-health authorities. Comments are due by 20 November.

The request arrives alongside CDC’s stated work on a national intermediary framework. The agency says it is building on existing infrastructure and considering models such as health information exchanges, health data utilities, TEFCA and CMS-aligned networks. The notice permits centralized and decentralized arrangements, and recognizes that services may operate at local, state, tribal, territorial or national scale. It does not identify a preferred provider or require jurisdictions to use one network.

CDC is seeking input on a framework with several layers: a baseline for any intermediary serving public health; added expectations for services such as routing, aggregation, record linkage or analytics; and profiles for particular programs or data flows. A maturity model could distinguish initial participation from repeatable production and more advanced capabilities. The questions about metrics, testing and evidence show that CDC is asking how to evaluate the layers, not announcing final standards.

The governance section is unusually concrete. It asks how duties should vary with an intermediary’s function, data and jurisdiction; what authority an intermediary should have to receive, access, route, transform, enrich or disclose data; and who should audit, correct, suspend or terminate a service. It also asks how the framework should accommodate different reporting laws, consent rules, data-use agreements and public-health powers.

That matters because the intermediary is more than a pipe. A service that routes information or transforms it for use can affect which data arrive, how quickly they arrive and which organizations can participate. CDC asks whether an intermediary adds cost, latency or governance burden compared with direct exchange, and how public funding and contract terms could support portability, competition and open standards without locking agencies into one vendor. The notice also asks who bears the costs of shared infrastructure and who receives its benefits.

CDC’s May data-modernization page describes a national framework grounded in local governance, prior investment and real public-health use cases. The RFI is a step in that work, not proof that the framework is adopted. CDC’s FAQ says it is not a new requirement, funding opportunity or procurement. The agency says submissions will be posted to Regulations.gov; commenters are told not to include personal health, proprietary or other information they do not want made public.

The distinction in Heng Lu’s Note 4, “On Data Sovereignty: Technical vs Practical Realities,” is useful as an editorial lens: technical ability to route or hold data does not itself settle legal authority. The notice does not resolve that authority question. Its significance is that CDC has put delegation, oversight, jurisdictional variation and financial responsibility into the same design exercise as interoperability.

Sources: Federal Register notice, 21 September 2026; CDC RFI FAQ; CDC Data Modernization at CDC; Heng Lu, Note 4 (editorial lens).