APCD data trust gaps that break state claims intelligence
Eighteen states operate all-payer claims databases, but most lack enforceable data trust standards for the submissions they collect. Without provenance scoring, consent governance, and recency enforcement, APCD data quality degrades before analysts ever query it.
Eighteen states and the District of Columbia operate mandatory all-payer claims databases as of 2024. These systems collect medical, pharmacy, and dental claims from commercial insurers, Medicaid managed care plans, and, in some states, Medicare Advantage. The promise is a complete picture of healthcare utilization and cost across an entire state population. The reality is that most APCDs have no enforceable standard for whether the data submitted is actually trustworthy.
Governance in most APCD programs focuses on who submits, how often, and in what format. It rarely addresses whether a claim record carries verified provenance, whether consent for secondary use is documented, or whether the record is recent enough to support the analytic question being asked. That gap matters more now than ever, because states are increasingly using APCD data to set policy, measure provider performance, and feed predictive models.
What an APCD actually collects
An all-payer claims database aggregates administrative claims data across payers within a state. The typical submission includes professional claims (CMS-1500), institutional claims (UB-04), pharmacy claims, eligibility files, and provider reference files. Some states also collect dental claims and partial self-funded employer plan data, though the Gobeille v. Liberty Mutual Supreme Court decision in 2016 limited states' ability to mandate submissions from ERISA-governed self-insured plans.
The APCD Council, now part of the National Academy for State Health Policy (NASHP), maintains a common data layout (CDL) that standardizes submission formats across states. Version 3.0 of the CDL defines over 200 data elements across eligibility, medical claims, pharmacy claims, and dental claims files. Standardizing the format, however, does not standardize the quality of what arrives in that format.
The governance gap: submission mandates without trust standards
Most APCD enabling statutes define governance in terms of data collection authority, not data quality enforcement. A typical state law establishes a governing board, identifies mandatory submitters (usually payers above a member threshold), sets submission timelines (monthly or quarterly), and defines permitted uses of the data. What these statutes almost never define is a minimum quality threshold for a submitted record to be accepted into the database.
Consider the lifecycle of a single claim. It originates in a provider's billing system, passes through a clearinghouse, reaches the payer for adjudication, and then months later gets extracted and submitted to the APCD. At each handoff, data can degrade. ICD-10 coding accuracy rates vary between 60% and 80% depending on the clinical domain. CPT code integrity problems compound the issue. By the time a record reaches the APCD, it has passed through four or five systems, and no one has scored it for trustworthiness.
State APCD programs run validation checks, but these are structural, not substantive. They confirm that required fields are populated, that codes fall within valid ranges, and that dates are logically consistent. A claim with a valid ICD-10 code, a valid CPT code, and a valid date of service passes every automated check, even if the diagnosis code was selected for billing optimization rather than clinical accuracy. Structural validation catches malformed data. It does not catch misleading data.
Five dimensions where APCD data trust fails
| | Value (% of states affected) | |---|---| | Provenance (chain of custody unknown) | 95 | | Consent (secondary use undocumented) | 80 | | Recency (6-9 month data lag) | 75 | | Concordance (5-15% linkage error) | 85 | | Completeness (65% of workers excluded) | 90 |
APCD governance needs to address at least five dimensions of data trust that current frameworks ignore.
Provenance
Who generated this claim, through what system, and how many transformations did it undergo before reaching the APCD? Most state databases receive claims through batch file submissions from payers. The payer aggregates claims from its adjudication system, maps them to the CDL format, and submits. The APCD has no visibility into the original source system, the clearinghouse that routed the claim, or the provider's EHR that generated the encounter. Without provenance metadata, analysts cannot assess whether systematic biases in a payer's adjudication logic are distorting the population-level picture.
Consent
APCD data is collected under state statutory authority, not individual patient consent. This is legally sufficient for the primary purpose of population-level analysis. But as states expand APCD use cases to include provider-level performance reports, commercial data products, and research datasets, the consent basis becomes thinner. The Gobeille decision already constrained APCD authority over ERISA plans. Future challenges may target the secondary use of APCD data for purposes not contemplated by the original enabling statute. States that do not build consent governance architecture into their APCD programs are accumulating legal risk.
Recency
Claims data is structurally lagged. A service rendered in January may not be adjudicated until March and may not appear in an APCD submission until June. Claims data lags of 30 to 90 days are standard, but APCD submission cycles add another layer. Some states require monthly submissions; others require quarterly. The Massachusetts Health Policy Commission reported that its APCD data has a typical lag of six to nine months from date of service to availability for analysis, as documented in their 2023 data documentation. When a state uses APCD data to set provider payment benchmarks or assess network adequacy, a nine-month lag means decisions are being made on conditions that no longer exist.
Concordance
APCDs aggregate data from multiple payers, each with its own coding conventions, adjudication rules, and member identification systems. Linking records for the same patient across payers requires matching on indirect identifiers, since most APCDs do not receive Social Security numbers. The New Hampshire APCD, for example, uses a master patient index built on name, date of birth, and ZIP code. Match rates vary. A 2019 NASHP analysis found that cross-payer linkage accuracy ranged from 85% to 95% across states, meaning that 5% to 15% of patient records may be duplicated, split, or misattributed. For population health analytics, a 10% linkage error rate changes the denominator of every rate calculation.
Completeness
The Gobeille decision created a structural gap in APCD completeness. Self-insured employer plans, which cover roughly 65% of covered workers according to the 2023 Kaiser Family Foundation Employer Health Benefits Survey, are exempt from state APCD mandates unless they voluntarily submit. In states with large self-insured employer populations, the APCD may capture less than half of the commercially insured population. Any analysis that treats the APCD as a complete picture of commercial healthcare utilization is working from a biased sample. Some states have secured voluntary submission agreements, but compliance is inconsistent and coverage rates are rarely published.
What the APCD Council's CDL does and does not solve
The Common Data Layout standardizes field names, code sets, and file structures. Version 3.0 includes over 200 data elements and aligns with X12 transaction standards. This makes cross-state comparison possible in theory. In practice, states customize the CDL, add state-specific fields, and apply different validation rules. The CDL is a format standard, not a trust standard.
A format standard tells you that the diagnosis code field should contain an ICD-10-CM code. A trust standard tells you whether that code was assigned by a certified coder, whether it was modified during adjudication, how recently it was validated, and whether it is concordant with the codes submitted by other payers for the same patient. APCDs need both.
How other health data programs handle quality differently
Other federally governed health data programs enforce quality standards that APCDs do not. The HEDIS measure system requires health plans to meet specific data completeness thresholds before a measure is reported. CMS requires Medicaid managed care plans to pass encounter data validation studies before their submissions are used for rate setting. The FDA requires real-world evidence data to meet provenance and quality standards before it can support regulatory submissions.
APCDs have no equivalent enforcement mechanism. A payer that submits structurally valid but substantively unreliable data faces no consequences. There is no score, no rating, and no public reporting of submission quality by payer. This means that the analysts, researchers, and policymakers who rely on APCD data have no way to assess the trustworthiness of the records they are querying.
What trust-scored APCD governance looks like
| | Value (%) | |---|---| | Provenance | 25 | | Consent | 20 | | Recency | 15 | | Quality | 10 | | Concordance | 10 | | Validation | 10 | | Breadth | 5 | | Stability | 5 |
A trust-aware APCD governance framework would add three requirements to existing submission mandates.
First, every submitted record would carry provenance metadata: the originating system, the number of transformations, and the adjudication status. This does not require payers to expose proprietary logic. It requires them to document the chain of custody for each claim.
Second, every submission would receive a trust score across standardized dimensions before it enters the analytic database. Records below a defined threshold would be flagged, not necessarily excluded, but marked so that downstream analysts can weight their analyses accordingly. This is the approach that the Data Trust Index framework uses: scoring records across provenance, consent, recency, quality, concordance, validation, breadth, and stability.
Third, APCD governing boards would publish payer-level data quality reports. If a state's largest commercial insurer submits claims with a 70% concordance rate while a smaller insurer achieves 95%, that difference should be visible to anyone using the data. Transparency creates accountability.
The downstream cost of unscored APCD data
When APCD data feeds policy decisions without trust scoring, the consequences are concrete. Provider performance rankings based on cost and utilization data shift when coding accuracy varies by payer. Network adequacy assessments miss gaps when self-insured plan data is absent. Price transparency tools built on APCD data mislead consumers when the underlying claims reflect negotiated rates from incomplete payer populations.
Colorado's Hospital Transparency and Affordability Report, published by the Department of Health Care Policy and Financing using APCD data, drives legislative attention and public spending decisions. Oregon's APCD feeds its cost growth target program, which sets binding limits on healthcare cost growth. If the data underlying these programs carries undetected quality problems, the resulting policy targets may be miscalibrated.
The same risk applies when APCD data feeds AI models. A predictive model trained on APCD data inherits every coding inconsistency, linkage error, and completeness gap in the source data. Without a trust score on the input records, the model has no way to distinguish a high-confidence claim from a low-confidence one. Health data completeness scoring is not optional when the output drives clinical or policy decisions.
The path forward for state APCD programs
The structural components of APCD governance are well established. Submission mandates, data layouts, and use case frameworks exist in nearly twenty states. What is missing is the trust layer: a systematic, scored, transparent assessment of whether the data in the database is reliable enough for the purpose it is being used for.
This is not a technology problem. The analytic infrastructure exists. The scoring frameworks exist. What is required is a governance decision: that data quality is not just a technical concern to be handled by the APCD vendor, but a policy concern that the governing board owns and enforces.
States that make that decision will have APCDs that can support credible price transparency, defensible provider performance measurement, and AI-ready datasets. States that do not will continue to build policy on data they have never verified.
The DTI Engine scores every record 0 to 100 across eight dimensions before your AI model sees it. If your team is building analytics on APCD data, evaluating claims quality for policy research, or preparing state health data for AI training, talk to the SuperTruth commercial team. Schedule a conversation or call (215) 918-4140.
Further reading:
Sources
Jason Alan Snyder
Co-founder of SuperTruth and Artists & Robots, and an inventor on the Data Trust Index patents. Twenty-plus years building technology inside Interpublic Group. He writes here nearly every day on data trust, provenance, and what AI should be allowed to act on, and publishes essays on his Substack.
About SuperTruth · LinkedIn · Substack · jasonalansnyder.com
See it in practice
Provider data that holds up under NCQA audit.
DTI scoring for credentialing, CMS CRUSH, and No Surprises Act.