Insights
Data trust, provenance, and what AI should be allowed to act on. Written by Jason Alan Snyder, nearly every day. Longer essays live on his Substack.
Epic and Oracle Health now control over 75% of U.S. hospital EHR installations, creating a duopoly where health data quality and trust standards are set by two vendors with fundamentally different architectures and business models. The concentration of clinical data in two proprietary systems does not guarantee that the data inside them is trustworthy, complete, or ready for AI.
Optum controls claims, pharmacy, clinical, and behavioral data on more than 150 million lives. Health systems that send data into Optum's platforms are training the analytics tools of a company that competes with them for patients, contracts, and market share. The trust question is not hypothetical. It is structural.
CVS Health's acquisition of Aetna created the largest vertically integrated health company in the United States, merging pharmacy, insurance, and clinic data under one roof. That integration concentrated more patient data in a single corporate entity than any previous transaction in healthcare history. The data trust implications are structural, not theoretical.
A patient's health record collected over 10 years is only as trustworthy as the consistency of its measurements across time. Temporal consistency failures in longitudinal health data silently corrupt AI models, producing predictions built on contradictions that no cross-sectional audit can detect. Scoring data trust across time requires explicit evaluation of measurement drift, gap patterns, and chronological coherence.
A missing BMI field drops sepsis prediction AUC by up to 0.09. A missing race field can shift readmission risk scores by 12%. Health data completeness scoring quantifies these losses before they reach a model, turning invisible gaps into measurable costs that determine whether clinical AI performs or fails.
Radiogenomics links imaging phenotypes to genomic alterations, but the data pipeline connecting DICOM files to sequencing results has no standard trust framework. Without scored provenance, temporal alignment, and consent governance across both modalities, radiogenomics AI models inherit compounded errors from two of the most complex data types in medicine.
SMART on FHIR enables third-party apps to access patient data through standardized authorization. But the protocol says nothing about the quality, provenance, or consent integrity of the data it exposes. That gap is the data trust surface area most health systems never measure.
Most Continuity of Care Documents exchanged between health systems contain structural defects that silently degrade clinical decision-making. Missing medication lists, outdated allergy records, and unmapped terminology codes pass through health information exchanges without any trust validation. The CCD document quality problem is not a format problem; it is a data trust failure hiding in plain sight.
Adverse childhood experiences data is the most sensitive dimension of social determinants of health, yet most health AI systems treat it with the same consent architecture as food insecurity screening. ACE data consent requires trauma-informed protocols, granular disclosure controls, and trust scoring that reflects the unique re-traumatization risk embedded in every query. Without these safeguards, trauma history data becomes a liability that harms the people it was collected to help.
Over 25 million people in the United States have limited English proficiency, and their health records carry systematic data quality problems that most AI systems never detect. Language concordance between patient and clinician directly shapes the accuracy, completeness, and clinical relevance of every data point recorded during a healthcare encounter. Without scoring for this concordance dimension, health AI models trained on LEP patient data inherit silent distortions that compound across populations.
Cost-effectiveness analysis models in healthcare depend on data inputs that most organizations never verify. QALY calculations, transition probabilities, and utility weights all carry embedded assumptions about data quality, yet fewer than 15% of published CEA models report data provenance. Without a trust layer beneath the inputs, the outputs are economic fiction.
ICER cost-effectiveness models depend on clinical, economic, and quality-of-life data that most organizations cannot verify for accuracy, completeness, or provenance. Without structured data trust requirements, health technology assessments inherit every upstream data quality failure. The gap between what ICER models require and what manufacturers actually submit is where billion-dollar coverage decisions go wrong.
Predictive analytics in healthcare fails not because of bad algorithms but because of unscored training data. A model trained on records with unknown provenance, stale timestamps, and broken consent chains produces predictions that no clinician should trust. Data trust scores, applied before training begins, are the missing prerequisite for model accuracy.
The FDA Adverse Event Reporting System contains over 29 million reports, but duplicate entries, missing drug fields, and inconsistent coding make raw FAERS data unreliable for drug-drug interaction analysis. Most AI models trained on FAERS never quantify these data quality failures before inference.
ECG waveform data degrades at every step between the electrode and the AI model. Noise, sampling inconsistencies, metadata gaps, and broken provenance chains make continuous cardiac monitoring data one of the most difficult signal types to trust for clinical AI. Without structured integrity scoring, AI models trained on ECG waveforms inherit errors that no algorithm can recover from.
Only 19% of federally qualified health centers consistently collect sexual orientation and gender identity data from patients. The gap is not a technology problem. It is a trust problem, and it cascades into every AI model trained on incomplete demographic fields.
Roughly 1.3 billion people worldwide live with a disability, yet most health AI training datasets lack any standardized disability status field. This absence does not just create a gap in demographic coverage. It produces models that systematically misallocate risk, mispredict outcomes, and reinforce the very health disparities disabled populations already face.
The FTC has settled with multiple health data brokers for unlawful sale of sensitive location and health data, and its enforcement model is shifting from reactive penalties to structural prohibitions. For AI vendors building on brokered health data, these actions redefine what accountability looks like, and what data trust infrastructure is now required to avoid regulatory exposure.
GDPR and HIPAA were designed for different populations, different enforcement models, and different definitions of health data. Any organization transferring health records between the EU and US must satisfy both simultaneously, and the overlap is smaller than most compliance teams assume. Without a unified trust framework that scores data against both regimes, cross-border health data transfers create liability at every handoff.
Unverified health data hits a hard ceiling in the Data Trust Index. No amount of recency, breadth, or quality improvement can push a record past Gold grade if its provenance chain includes unverified sources. The DTI Platinum ceiling is not a bug. It is the entire point of trust-scored health data.
Health data loses integrity the moment it is created. A blood pressure reading from 3 years ago, an address from a prior state, a medication list from before a formulary change: each carries a trust score that decays on a predictable curve. Data retention policies that ignore this decay feed stale records into AI models that make real clinical decisions.
Healthcare AI systems that collect everything create larger breach surfaces, higher regulatory exposure, and deeper patient distrust. Data minimization is not a privacy nicety. It is a structural requirement for any AI system that expects to operate under regulatory scrutiny and retain patient confidence.
Secondary use consent does not cover purpose limitation. A patient who consents to data sharing for treatment does not consent to that same data training a sepsis prediction algorithm, feeding a payer risk model, or populating a pharma commercial dataset. Purpose limitation is a distinct legal and ethical constraint that broad consent language cannot absorb.
When a patient withdraws consent, most health AI systems have no mechanism to propagate that revocation to downstream models already trained on the data. The gap between consent withdrawal and actual data removal creates legal exposure, trust erosion, and model integrity failures that compound across every system in the chain.
