CDC Is Writing the Rules for Who Gets Paid to Move Public Health Data. Comments Close November 20.

On September 21, the CDC published a Request for Information at 91 FR 59777 titled "Data Intermediaries and Approaches To Strengthen Public Health Data Exchange." Comments are due November 20, 2026, under docket CDC-2026-1519. The notice comes out of the Office of Public Health Data, Surveillance, and Technology, with Abigail Viall, Acting Lead of the Technology Implementation Office, as the contact, under the general public health service research authority at 42 U.S.C. 241 and the public health emergency preparedness authority at 42 U.S.C. 247d-4.

The notice says plainly that it is not a funding opportunity and not a procurement. It is a general solicitation of public comments.

Skip it on that basis and you will misread what is happening. CDC is not asking an academic question. It is assembling the definitional and governance scaffolding for a national intermediary framework, and one of the six sections of questions in the RFI is specifically about funding models, revenue sources, cost allocation, and reducing financial barriers for under-resourced entities. Organizations that expect to be paid to carry public health data over the next five years are being invited to write the criteria they will later be judged against.

What CDC Means by "Intermediary"

The RFI defines a public health data intermediary as a trusted organization, network, platform, or governed service that enables secure, standards-based exchange and stewardship of health-related data among data sources and public health authorities, by providing shared technical, operational, and governance capabilities — with the stated goals of reducing connectivity burden and improving data quality, timeliness, and usefulness while protecting individual privacy and confidentiality.

Unpack that and you get the strategic problem CDC is trying to solve. Today, a hospital that must report to public health builds and maintains a separate connection for each obligation and each jurisdiction: electronic case reporting here, syndromic surveillance there, laboratory results somewhere else, cancer registry reporting on its own track. Every one of those connections is a point-to-point integration with its own onboarding, its own credentials, and its own failure modes. Multiply by thousands of facilities and dozens of programs and you get the connectivity burden the definition names.

An intermediary collapses that. One connection to a trusted middle layer, which then routes to the appropriate public health authority under an agreed governance regime.

The notice names the candidate categories explicitly: Health Information Exchanges, Health Data Utilities, Qualified Health Information Networks operating under TEFCA, CMS-Aligned Networks, and Health Center Controlled Networks — with the One CDC Data Platform on the receiving end. That list is the competitive field. CDC is asking whether all of these should count as intermediaries, which functions each should be required to perform, and how the whole arrangement should be paid for.

The Sequencing Is the Story

Read this RFI next to CDC's own 2026 Public Health Data Strategy milestones and the timing stops looking coincidental. One of those milestones commits CDC to establishing minimum functional requirements and standards for public health intermediaries — health data utilities among them — and piloting their application in at least five jurisdictions.

That is the pattern: define the intermediary, publish minimum functional requirements, pilot in five jurisdictions, then scale. An RFI that asks the field to help write the definition and the requirements is step zero of a process whose later steps involve money.

CDC has also described the national intermediary framework as building on existing infrastructure — including AIMS, the APHL Informatics Messaging Services platform that already moves a large volume of laboratory and case data between clinical sources and public health agencies — while exploring pathways through TEFCA, HIEs, health data utilities, and CMS-aligned networks. That framing is important for anyone deciding whether to comment. CDC is not proposing to build something new from nothing. It is proposing to decide which of the existing pipes count, and on what terms.

If your organization operates one of those pipes, the minimum functional requirements CDC eventually publishes will determine whether you are in the framework or outside it. Requirements written without your input tend to encode someone else's architecture.

Why the Funding Section Deserves Your Attention

The funding and sustainability section of the RFI asks about sustainable funding models, revenue sources, cost allocation, and approaches to reduce financial barriers for entities with fewer resources.

CDC is asking this question now because the money that built the current generation of public health data capacity is visibly tapering. The Public Health Infrastructure Grant, whose three strategy areas are workforce, foundational capabilities, and data modernization, has been the primary vehicle. Its national-partner component alone — flowing through organizations including ASTHO, the National Network of Public Health Institutes, and the Public Health Accreditation Board — has moved more than $382 million cumulatively: roughly $155 million in FY23, $185 million in FY24, $21 million in FY25, and just over $20 million in FY26.

Look at that trajectory. From $185 million to $21 million between FY24 and FY25 is not a trim; it is the end of a build phase. The advocacy community has been asking for $340 million annually for CDC public health data modernization, plus $55 million for the One CDC Data Platform through the Response Ready Enterprise Data Integration effort and $100 million for the Center for Forecasting and Outbreak Analytics — figures that describe the gap between the build-out and what is actually appropriated.

An intermediary framework is, among other things, a way to make data exchange sustainable when the grant-funded build phase ends. Some portion of the cost has to shift to recurring mechanisms: fee-for-service arrangements, state general funds, payer participation, Medicaid administrative match. The RFI's funding section is where CDC decides which of those mechanisms it will endorse and design around. Organizations whose business model depends on one of those mechanisms and who do not describe it in a comment are letting other respondents define the revenue model.

The Nearer-Term Money

There is a more immediate opportunity running alongside the RFI. The Data Modernization Implementation Center program, administered with ASTHO, relaunched a second wave in 2026 focused on four priority use cases: chronic disease, maternal and child health, cancer reporting, and biothreat radar detection. Wave 2 supports targeted one-year pilot projects, and the program directs interested parties to express interest through the implementation-center channel rather than through a conventional posted notice of funding opportunity.

Those four use cases are not arbitrary. They are the specific exchange problems CDC wants demonstrated, and a jurisdiction or intermediary that runs a successful Wave 2 pilot in one of them arrives at the five-jurisdiction intermediary pilot with evidence rather than a proposal. If you intend to be in the intermediary framework, a Wave 2 pilot is the cheapest available way to build the track record.

How to Actually Write the Comment

Federal RFI comments get read, catalogued, and quoted in the preambles of the documents that follow. The ones that influence outcomes share a few properties.

Answer the numbered questions in order, by number. The RFI organizes its questions into six sections — definition, standards and technical capability, funding and sustainability, governance, implementation, and evaluation. A comment that tracks that structure is far easier for staff to synthesize than a narrative letter, and synthesis is where influence happens.

Bring operating numbers. How many facilities do you have connected? What is your median onboarding time for a new data source? What does a single interface cost you per year to maintain? CDC is trying to quantify connectivity burden; a respondent who supplies real figures is supplying the evidence base.

Say what would exclude you. If a plausible minimum functional requirement — full QHIN designation, say, or a specific FHIR version — would put your organization outside the framework despite your carrying substantial public health volume today, name it and explain the consequence. Unintended exclusion is the failure mode agencies most want to hear about before they publish, and least want to hear about after.

Address sustainability concretely. Name the revenue mechanism you rely on, its legal basis, and what CDC would have to do for it to keep working. Vague endorsements of "sustainable funding" contribute nothing.

Do not skip because you are small. The RFI explicitly seeks input across intermediary types, jurisdictions, and organizational sizes. A single-state HIE serving a rural population has standing here, and the financial-barriers question was written with exactly that respondent in mind.

Comments go to Regulations.gov under docket CDC-2026-1519, or by mail. Word, Excel, and PDF are accepted. No fax. The deadline is November 20, 2026, and unlike a grant deadline, there is no resubmission cycle — the framework gets written once.