Governing Health Data Access and Secondary Use: Information Blocking, Privacy, Consent, and Hospital Accountability, a Narrative Review

The central health-data governance question is no longer whether a hospital possesses information. It is whether the hospital can explain who may access it, for what purpose, under which authority, in what form, for how long, and with what evidence of appropriate use. That question applies to a patient opening a laboratory result, a clinician retrieving an outside record, a family caregiver using delegated portal access, a researcher receiving a limited data set, a quality team building an analytic cohort, and a marketing vendor receiving web-event data. The technical act may be a transmission in every case, but the legal authority, ethical justification, and operational safeguards are not interchangeable.

Federal policy has strengthened the patient’s position. The HIPAA Privacy Rule provides a broad right to inspect or obtain protected health information in a designated record set, subject to defined limitations [33,34]. The 21st Century Cures Act prohibits certain practices that are likely to interfere with the access, exchange, or use of electronic health information, unless required by law or covered by an applicable exception [35,36]. The information-blocking regulations define electronic health information by reference to electronic protected health information that would be included in a designated record set, with specified exclusions, and place duties on health care providers and other regulated actors [36]. Substance use disorder records are also governed by 42 CFR part 2 [41]. These regimes overlap, but they do not collapse into a single rule.

The empirical record shows why governance cannot be reduced to a privacy approval queue. In a national survey, 27% of hospitals reported sometimes or often observing potential information blocking by any actor in 2023, compared with 42% in 2021; 13% of health information organizations routinely observed potential blocking by hospitals or health systems [1]. Earlier national research found information blocking to be prevalent before enforcement and identified pricing, contractual, and strategic restrictions as recurring mechanisms [2,3]. The executive challenge is therefore bidirectional: prevent unauthorized release without converting caution, convenience, vendor limitations, or market strategy into unlawful interference.

This review advances an operating premise: access is a right; secondary use requires authority. The premise does not imply that every access request must be granted or that every secondary use requires individual authorization. It means that the organization must distinguish the legal basis and safeguards applicable to each pathway. A hospital that cannot make that distinction at the point of work will produce delay, inconsistency, hidden disclosure, or all three.

This narrative review used a purposive, reproducible search strategy designed for executive and operational relevance. PubMed/MEDLINE was searched through August 13, 2026 for peer-reviewed English-language literature published from January 2000 through August 13, 2026. Search concepts included combinations of: hospital, health system, electronic health information, health data, patient portal, online record access, information blocking, 21st Century Cures Act, immediate release, test results, proxy access, caregiver, adolescent confidentiality, intimate partner violence, tracking pixel, online tracking, secondary use, health information exchange, consent, de-identification, re-identification, semantic interoperability, learning health system, privacy, governance, and equity.

Eligible evidence included empirical studies, systematic reviews, and peer-reviewed implementation reports with direct relevance to hospital governance, patient access, privacy, exchange, or secondary use. Articles were selected for recency, methodological relevance, national or multisite scope when available, and their ability to inform an executive decision or safeguard. Technical proposals without implementation evidence were not used to support effectiveness claims. Reference lists and citing articles were reviewed to identify additional relevant studies. Because the purpose was synthesis rather than pooled effect estimation, no meta-analysis was performed.

Legal research was conducted separately. Primary legal sources included 42 U.S.C. 300jj-52, 45 CFR parts 160, 164, and 171, 42 CFR part 2, relevant Federal Register rules, and official agency materials [33-41]. These sources were used only to describe legal requirements, regulatory structure, and current agency positions. Peer-reviewed studies were used for empirical and operational claims. This article does not attempt a fifty-state survey, and hospital counsel should assess state-specific confidentiality, consent, minor-access, reproductive-health, genetic-information, biometric, consumer-privacy, and breach-notification requirements.

Hospital data move through at least four governance pathways. The first is individual access: a person seeking information about themselves. The second is care delivery: treatment, payment, and health care operations under applicable law and organizational policy. The third is public-interest use, such as public health, oversight, or approved research. The fourth is discretionary secondary use, which may include product development, commercial analytics, advertising, or other activity outside the original care relationship. Each pathway may touch the same record, but it does not carry the same authority.

The HIPAA right of access reaches information in a designated record set and gives individuals rights to inspect or receive copies, including electronically when readily producible [33,34]. Information-blocking law evaluates whether a practice is likely to interfere with lawful access, exchange, or use, applying a provider knowledge standard and detailed regulatory exceptions [35,36]. By contrast, a hospital’s secondary use requires an independent basis under the Privacy Rule, another law, valid authorization, an Institutional Review Board or Privacy Board pathway, de-identification, or another legally available route. A signed technology contract is not itself a disclosure authority.

This separation has operational value. When staff label every data movement as “sharing,” the organization loses the distinctions that determine service levels, minimum-necessary analysis, authorization, accounting, contracting, and patient choice. The better unit of governance is a use case with four registered fields: purpose, authority, scope, and proof. Purpose explains the outcome being pursued. Authority identifies the legal and organizational basis. Scope defines the data, population, recipients, duration, and permitted actions. Proof retains the decision, configuration, disclosure, audit trail, and result.

The governing covenant should be written into intake forms, architecture review, privacy analysis, data-use agreements, vendor review, API governance, portal configuration, and board reporting. If a request reaches production without those fields, the control failure has already occurred.

Immediate electronic release has materially changed patient behavior. At one academic center, switching to immediate release increased patient viewing of diagnostic results [5]. Research in radiology and oncology similarly found increased access following implementation of information-blocking provisions [9,10]. In a 2024 national survey, 70% of patients and 92% of portal users viewed results in a portal; 58% of patients viewed results before hearing from a clinician. Only 66% reported understanding what they viewed, and understanding was lower among people with lower digital literacy [11].

These findings reject two simplistic positions. First, access should not be delayed merely because information may be complex. Patients consistently express strong preferences for prompt access, including to imaging and sensitive results [21,22]. Second, posting information is not the same as communicating it. Published studies show that explanatory context, clinician encouragement, digital literacy, and portal design influence understanding [11,30]. A lawful release can still be a poor service if the patient receives unexplained terminology, no expected response time, inaccessible language, or no route to urgent clarification.

Hospitals should therefore manage access as a clinical-administrative service line. The operating standard should include release reliability, identity proofing, request completion time, format fulfillment, denial review, amendment pathways, interpretation support, language access, accessibility, and escalation. The standard should not rely on a central health-information-management team to repair every downstream configuration. Laboratory, radiology, pathology, clinical documentation, portal operations, and specialty leadership each own part of the release experience.

Equity must be measured rather than assumed. In a 2025 study of 511 hospitals in counties with substantial limited-English-proficiency populations, 29.4% offered patient-portal login pages only in English, and only 4.7% offered the most common local non-English, non-Spanish language [28]. Among admitted surgical patients, immediate release was associated with increased viewing, but older age, Spanish language, noncommercial insurance, and Black or Hispanic race and ethnicity were associated with lower portal use [29]. National survey research likewise identifies comfort with computers, internet access, privacy concerns, and preference for direct communication as modifiable barriers [30]. A hospital cannot claim successful transparency while access depends on English fluency, broadband, or a shared household credential.

Information blocking is not a synonym for any delay or failed exchange. Under 42 U.S.C. 300jj-52 and 45 CFR part 171, the analysis depends on the actor, the practice, the likelihood of interference, the applicable knowledge standard, and whether an exception is satisfied [35,36]. The current regulations include exceptions involving preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, licensing, and other defined circumstances [36]. For providers, a practice must be known to be unreasonable and likely to interfere with access, exchange, or use, unless required by law or covered by an exception [35,36].

The operational risk lies in informal, undocumented withholding. A clinician may believe release could cause harm; registration staff may see conflicting proxy identities; a privacy analyst may identify an unmet legal precondition; an interface team may face corrupted data; or cybersecurity staff may need to contain an active threat. Those concerns can be legitimate. They become governance failures when the organization has no standard to determine breadth, duration, alternative access, documentation, review, or closure.

For example, the preventing-harm exception requires more than generalized discomfort. The regulation specifies a reasonable belief that the practice will substantially reduce a risk of harm, that the practice be no broader than necessary, and that other conditions be met [36]. The privacy exception includes pathways for unmet legal preconditions, denials consistent with HIPAA access provisions, and documented individual requests not to share [36]. Hospital policy should translate these elements into operational fields without replacing case-specific legal and clinical judgment.

Identity is another source of friction. Published implementation research describes difficulties meeting patient-identity interoperability and information-blocking requirements [4]. A weak response is to choose either indiscriminate release or indefinite delay. A stronger response uses tiered identity proofing, rapid discrepancy resolution, provisional safeguards, and retained evidence of what was done. The board should see rates of failed match, duplicate records, unresolved access tickets, exception use, review reversals, and days to closure. Without those measures, leaders cannot distinguish prudent protection from habitual interference.

HHS has established provider disincentives for information blocking through federal program authorities, while OIG may impose civil monetary penalties on specified non-provider actors up to the statutory maximum per violation [35,38,39]. Compliance should therefore be managed as an operating discipline, not a once-a-year legal attestation.

Proxy access is where abstract privacy principles collide with family care. Care partners often need medication lists, appointments, results, discharge instructions, and messaging capabilities. Yet portal systems frequently fail to collect structured information about who is involved in a person’s care, and burdensome delegation processes encourage credential sharing [14]. In a survey of 102 hospitals, 68% offered proxy accounts for adult patients, 45% of surveyed personnel endorsed password sharing, and only 19% of hospitals with proxy access allowed patients to restrict the information visible to the proxy [15].

The governance defect is not family involvement. It is invisible identity. When a caregiver logs in as the patient, the audit trail cannot reliably show who viewed information, sent a message, changed a preference, or downloaded a record. The hospital also cannot apply role-specific limits. A mature proxy system uses separate credentials, records the relationship and authority, supports expiration and revocation, and distinguishes view, message, scheduling, billing, and download permissions.

Adolescent access requires additional safeguards because federal access rules interact with state minor-consent and confidentiality laws, guardianship, and clinical context. Multisite research has documented wide variation in pediatric and adolescent electronic data-sharing practices after the Cures Act [7]. Providers report continuing difficulty protecting confidential adolescent information in the EHR [18]. One institution reduced erroneous adolescent portal activation by comparing adolescent contact information with parent or guarantor information and routing discrepancies for review [17]. This is a useful model because it converts a privacy principle into a measurable registration control.

Safety risks extend beyond adolescence. Peer-reviewed analysis warns that multiuser records and proxy access can expose sensitive information if systems cannot distinguish users and data segments [16]. Research focused on survivors of intimate partner violence describes risks from immediate electronic access when an abusive partner controls credentials, devices, notifications, or proxy relationships [19]. These concerns do not justify categorical withholding. They justify confidential contact preferences, safe-notification modes, rapid proxy revocation, granular segmentation where lawful and technically feasible, individualized exception analysis, and workforce training that recognizes coercive control.

Secondary use includes activities beyond the immediate purpose for which information was collected. It can produce substantial public value through research, quality improvement, safety surveillance, population health, operational learning, and service design. It can also obscure accountability when a data warehouse, analytics platform, or vendor contract becomes the de facto authority to reuse whatever is technically available.

The first question is not “Can the system export it?” It is “What purpose is being authorized?” A purpose statement should be specific enough to determine which data are relevant, which population is included, who may act, how long the use lasts, whether results return to care, and what would constitute misuse. “Innovation,” “analytics,” and “improving experience” are categories, not purposes.

Purpose limitation enables proportionate scope. The HIPAA minimum-necessary standard generally requires reasonable steps to limit uses, disclosures, and requests to what is necessary for the intended purpose when the standard applies, while recognizing exceptions such as disclosures for treatment [33,37]. A governance intake should therefore record whether minimum necessary applies, how the scope was determined, and who approved an entire-record request. The same discipline is useful even where the legal standard does not apply because it reduces exposure and improves analytic clarity.

Patient trust is sensitive to the identity and purpose of the recipient. Qualitative research on health information exchange found that perceived security, noncommercial recipients, transparency, and specific consent options shaped willingness to share [31]. Experimental research found that greater patient control increased intention to consent and reduced the negative effect of privacy concern [32]. These findings do not create a universal legal requirement for granular consent. They support an executive conclusion: organizations should not assume that a legally permissible use will be viewed as legitimate if the purpose, recipient, or benefit is hidden.

Every recurring secondary use should have a named service owner, privacy or legal basis, data steward, technical custodian, retention period, downstream-use limit, patient-impact assessment, and measurable benefit. Approval without a benefit owner produces permanent data exposure and temporary accountability.

Hospital leaders often treat public websites as communications infrastructure rather than health-data infrastructure. Empirical evidence challenges that assumption. A census study of United States nonfederal acute care hospital websites found third-party tracking on 98.6% of sites, including transfers to technology companies, advertising firms, social media companies, and data brokers [12]. A later longitudinal study found that pixel tracking was common and was associated with increased breach risk, although observational association does not establish that pixels caused every breach [13].

The legal analysis is fact-specific. OCR states that HIPAA obligations apply when information collected through tracking technologies or disclosed to vendors includes protected health information, particularly on authenticated pages and in mobile applications [40]. A federal district court vacated the portion of OCR guidance that treated an IP address combined with a visit to an unauthenticated public webpage addressing specific conditions or providers as sufficient by itself to trigger HIPAA obligations; the current HHS page expressly notes that limitation [40]. Hospitals should not overstate the guidance, but neither should they treat the ruling as permission to deploy unexamined trackers.

The executive control is a verified data-flow inventory. It should identify each script, tag manager, software development kit, cookie, pixel, session-replay tool, analytics endpoint, advertising recipient, and configuration across public sites, scheduling pages, portals, telehealth, mobile applications, recruitment platforms, and donation pages. The inventory must capture the actual data transmitted, not the vendor’s product description.

Deployment should require a purpose, recipient, field-level data map, authenticated-versus-unauthenticated classification, privacy and security analysis, contract, retention limits, configuration owner, and removal date. Marketing cannot own this decision alone because the consequences reach privacy, security, legal, reputation, patient safety, and consumer protection. Procurement cannot rely solely on a business-associate agreement because a contract does not cure a disclosure that the Privacy Rule does not permit.

The board-level question is simple: can the organization name every third party receiving data from its digital front door? If the answer requires a new scan each time it is asked, governance is not operating.

De-identified information is central to research and analytics, but the term is often used imprecisely. Under HIPAA, information meeting the Privacy Rule’s de-identification requirements is not protected health information under that rule [33]. The two regulatory pathways are the safe-harbor method and expert determination [33]. Both require disciplined implementation. Neither supports the claim that re-identification is conceptually impossible.

The evidence is more nuanced than common warnings. A systematic review of re-identification attacks found high average rates across a small and heterogeneous literature, but only two attacks used data de-identified under existing standards, and the authors concluded that the evidence was insufficient to judge those standards broadly [24]. Earlier multisite work demonstrated that statistical de-identification can preserve more useful demographic detail while maintaining risks no greater than safe harbor in the studied settings [23]. A 2026 systematic review found rapidly evolving methods across free text, images, and tabular data, along with persistent limitations in generalizability, multilingual data, and reproducibility [25].

Hospital policy should therefore treat de-identification as an evidence-backed process tied to context. Risk depends on the data’s dimensionality, rarity, free text, image pixels, geography, dates, linkability, recipient capability, public auxiliary data, and downstream permissions. High-dimensional data can be identifying even after obvious fields are removed. Expert determination should document anticipated recipients and controls rather than evaluate a dataset in a vacuum.

Contracts should prohibit re-identification, redisclosure, and unauthorized linkage; require safeguards and incident reporting; define retention and destruction; and preserve audit or verification rights. These controls do not transform a deficient de-identification method into a compliant one. They add accountability to a technically and legally valid release.

Data availability is not the same as usable information. Semantic interoperability requires that exchanged data retain meaning across systems. A systematic review identified terminology, information models, standards, governance, and implementation context as recurring elements of semantic interoperability [27]. If a hospital releases data that are technically complete but clinically ambiguous, inconsistent, or detached from provenance, the patient and receiving organization inherit a new safety burden.

Learning health systems also require distributed trust. The Cumulus platform illustrates a federated model using Fast Healthcare Interoperability Resources to support multisite learning without centralizing every source record [26]. The design is important not as proof that one architecture fits all hospitals, but as evidence that governance and technical structure can reduce unnecessary data movement while enabling research and public-interest analysis.

Hospital leaders should require provenance, common definitions, data-quality thresholds, and ownership for every enterprise data product. A denominator called “active patient,” “avoidable admission,” or “portal user” should not change silently between analytics teams. Semantic drift creates legal risk when a stated purpose and minimum scope no longer match what the data product actually represents.

The stewardship model should distinguish source-system ownership, data-product ownership, and use-case accountability. Source owners maintain integrity and lineage. Product owners maintain definitions, transformations, and fitness for use. Use-case owners justify purpose, authority, and benefit. No single role can substitute for the others.

The Data Covenant is an operating model, not a mission statement. It places four tests before every material data movement:

1. Purpose: What patient, clinical, operational, research, public-health, or legally required outcome will this access or use serve?
2. Authority: Which right, permission, duty, exception, authorization, contract, or approved research pathway permits the action?
3. Minimum scope: Which people, fields, dates, systems, recipients, functions, and retention period are necessary and proportionate?
4. Proof: What evidence will show who approved, what moved, who received it, what controls operated, what benefit resulted, and when the use ended?

The governing body should assign one accountable executive, supported by privacy, legal, compliance, clinical, health-information management, security, digital, research, analytics, marketing, procurement, and patient-experience leaders. The accountable executive is not expected to make every decision. The role ensures that decisions occur at the right level, use one vocabulary, and close with evidence.

Routine cases should be standardized. Patient access requests, common treatment exchanges, established quality reports, recurring public-health submissions, and approved research extracts should move through tested pathways. Novel or high-risk cases should escalate based on defined triggers: commercial purpose, sensitive data, new linkage, external model development, unclear authority, patient-safety risk, broad population scale, or inability to verify downstream use.

The operating rhythm should include a weekly review of unresolved access and exception cases, monthly review of high-risk secondary uses and trackers, quarterly review of performance and incidents, and annual board assurance. Exceptions should have owners and expiration dates. A permanent exception without periodic review is policy drift.

During the first three months, the organization should establish accountability and visibility. Name the executive owner. Inventory patient-access pathways, information-blocking policies, portal release rules, proxy arrangements, secondary-use approvals, external data recipients, tracking technologies, de-identification methods, and key contracts. Resolve any active access backlog or unidentified tracker rather than waiting for the inventory to be perfect.

Months four through nine should standardize decision rights. Implement the four-field intake, codify exception documentation, establish proxy and adolescent identity controls, classify sensitive uses, create a secondary-use register, and require field-level data maps for new vendors. Define service levels for access and review. Update contracting templates to address purpose, downstream use, re-identification, retention, incident reporting, and verification.

Months ten through eighteen should integrate the controls into technology and work. Configure auditable release rules, proxy roles, consent and authorization capture, API registration, lineage, role-based access, tracker management, and expiration. Build equity measures by language, age, disability, payer, race and ethnicity, geography, and access channel where lawful and methodologically appropriate. Train staff through scenarios, not policy recitation.

Months nineteen through twenty-four should verify benefit and retire exposure. Test whether patients receive timely, understandable access. Sample exception decisions. Reconcile the vendor and tracking inventories with network observations. Review whether secondary uses delivered stated benefits. Destroy or return data when purpose ends. Present the board with evidence, unresolved risks, and corrective actions.

An effective program expects challenge. Privacy, compliance, internal audit, information security, research oversight, patient advocates, ethics, and legal counsel should be able to test whether the registered purpose matches actual use. Independence matters most when a high-revenue partner, strategic transaction, or public commitment creates pressure to approve.

Incident response should begin with containment but not end there. A tracking disclosure, proxy misuse, inappropriate download, failed access request, or unauthorized secondary use should be traced to the governing defect: unclear authority, excessive scope, identity failure, configuration drift, unmonitored vendor behavior, weak training, or missing closure. Corrective action should address the pathway, not only the individual event.

Patients need understandable notice and recourse. Access denials should identify the basis and any review rights. Delegation should be visible and revocable. Secondary-use transparency should describe meaningful categories and recipients rather than hide behind a generic privacy notice. Where notification is legally required, the hospital should meet the applicable rule and avoid language that minimizes uncertainty or harm.

Annual assurance should ask whether the hospital can prove five facts: lawful access is timely; exception use is bounded; external recipients are known; secondary uses remain within purpose; and corrective actions close. A presentation of policies is not proof.

This review integrates recent peer-reviewed evidence with current primary United States legal authorities and translates them into an executive operating model. It distinguishes empirical findings from statements of law and emphasizes hospital decision rights, service design, and verification.

Several limitations apply. The literature is heterogeneous and includes cross-sectional surveys, observational studies, qualitative research, implementation reports, and systematic reviews with different settings and outcomes. Findings from single health systems may not generalize. Some secondary-use and de-identification research is technical or international, and this review did not use unvalidated technical proposals as evidence of effectiveness. Regulatory interpretation continues to evolve, including information-blocking implementation, health-data tracking guidance, reproductive-health privacy, Part 2 alignment, and state privacy law. The search was purposive rather than systematic, and no risk-of-bias instrument or pooled analysis was used. This article is not a comprehensive survey of state law and does not provide legal advice.

Health-data governance fails when access and privacy are assigned to separate silos with no shared decision model. Patients experience the result as delay, confusion, hidden disclosure, or loss of control. Hospitals experience it as rework, regulatory exposure, vendor dependence, and strategic distrust.

The solution is not maximal release or maximal restriction. It is accountable movement. Patient access should operate as a reliable service. Information-blocking exceptions should be specific, bounded, documented, and reviewable. Proxy identity should be explicit. Secondary use should begin with purpose and authority. Tracking technologies should be inventoried as data flows. De-identification should be treated as managed residual risk. Interoperability should preserve meaning. Boards should receive proof of lawful access, controlled use, patient benefit, and corrective action.

Every disclosure needs purpose, authority, minimum scope, and proof. That covenant makes transparency and privacy mutually reinforcing rather than administratively opposed.