The digitization of health care and the proliferation of electronic medical records is happening rapidly, generating large quantities of data with potential to provide valuable insights into disease and wellness and help solve challenging public health problems.

There is tremendous enthusiasm over the possibilities of leveraging this data for secondary use–i.e., a use of data that is distinct from the purpose for which it was originally collected. However, such secondary use is often subject to intersecting legal and regulatory regimes–including HIPAA, the Common Rule, and the Federal Food, Drug, and Cosmetic Act and its implementing regulations–that are not fully harmonized.  This lack of harmonization in requirements, coupled with the wide range of industry players involved–including regulators, academic medical centers, health systems, payers, technology companies, manufacturers and industry entities, research institutions, registries, and professional societies, to name a few– presents challenges that require careful planning and implementation. While regulators have recently taken significant steps to reconcile the differences among these laws and provide a path forward for harnessing the potential of big data, some specific requirements within these individual regulations continue to present challenges.

It is critical for academic medical centers and teaching hospitals, which stand at the intersection of government-funded research and industry-sponsored research, and are also paving the way in partnerships with non-traditional health care players—to understand the evolving legal framework and business and compliance imperatives behind the quest for digital health information.