To protect health, guide programming, and facilitate public health research, state, Tribal, local, and territorial (STLT) health departments share data with a range of partners. Historically, Tribes1 and Tribal Epidemiology Centers (TECs) have encountered challenges when trying to access their data.2 This resource aims to address some common questions that come up related to Tribal data sharing. Its target audience is epidemiologists and other public health department staff who manage datasets. Attorneys who represent health departments may also find this resource relevant to their work.

Although Tribes and TECs both have responsibilities for the health and well-being of Tribal members, they are different types of entities as described in more detail in this resource. These distinctions mean that different laws may apply depending on whether a Tribe or a TEC is trying to access public health data; and the differences may determine whether data sharing can occur, whether a data use agreement (DUA) is necessary, and what terms must be included in a DUA.

1 In this document, “Tribe” refers primarily to federally recognized Tribes. According to the Bureau of Indian Affairs, there are 575 federally recognized Tribes in the United States. See Div. of Tribal Gov’t Servs., Tribal Leaders Directory, U.S. Dep’t of the Interior, https://www.bia.gov/service/tribal-leaders-directory [https://perma.cc/4EGA-4LDD] (last visited Aug. 21, 2025). Some information may also be applicable to Tribes with state recognition in the exercise of their inherent right to Indigenous data sovereignty.

2 Aila Hoss, Indigeneity, Data Genocide, and Public Health, 110 Iowa L. Rev. 1139 (2025).

Module 1

  • Tribal Sovereignty and Tribal Data Sovereignty

    Tribal sovereignty is defined as the inherent authority of Tribes to govern themselves.3 Tribes are sovereign nations and have inherent sovereign authority.4 This authority extends to matters pertaining to their reservations and to Tribal members.5 As sovereign nations, Tribes have inherent authority to engage in core public health activities.6 Tribes do not need specific statutory authority to, for example, issue a quarantine order or to collect public health data about their members.7

    Tribal data sovereignty refers to “the right of Native nations to govern the collection, ownership, and application of its own data.”8 In practical terms, Tribal data sovereignty depends on information exchange with federal, state and local public health systems that are generally ill-equipped to share data with Tribes and TECs and do not contemplate the universe of Tribal data.9

    3 Stephen L. Pevar, The Rights of Indians and Tribes 131 (5th ed., 2012).

    4 According to Cohen's Handbook of Federal Indian Law § 4.01[a], at 206 (Nell Jessup Newton ed., 2005), “[p]erhaps the most basic principle of all Indian law, supported by a host of decisions, is that those powers lawfully vested in an Indian nation are not, in general, delegated powers granted by express acts of Congress, but rather ‘inherent powers of a limited sovereignty which has never been extinguished.’"

    5 See McGirt v. Okla., 591 U.S. 894, 928 (2020); Worcester v. State of Ga., 31 U.S. 515 (1832); Cherokee Nation v. State of Ga., 30 U.S. 1, 17 (1831).

    6 Aila Hoss, Tribes are Public Health Authorities: Protecting Tribal Sovereignty in Times of Public Health Crisis, Great Lakes Inter-Tribal Council 1, 3 (Jan. 2021), https://static1.squarespace.com/static/5930883f17bffcfab9debf8d/t/5ff396bd9d513670e3c76471/1609799358131/Tribes%2Bare%2BPublic%2BHealth%2BAuthorities%2BFINAL.pdf [https://perma.cc/H7ZL-5VDS].

    7 See United States v. Wheeler, 435 U.S. 313, 322–23 (1978); 1 Cohen's Handbook of Federal Indian Law § 5.01 (2025); Aila Hoss, Toward Tribal Health Sovereignty, 2022 Wis. L. Rev. 413, 419 (2022).

    8 Native Nations Institute, Indigenous Data Sovereignty and Governance, University of Arizona (last visited Aug. 21, 2025), https://nni.arizona.edu/our-work/research-policy-analysis/indigenous-data-sovereignty-governance. [https://perma.cc/X9NR-F9SL]

    9 As the National Commission to Transform Public Health Data Systems noted: “Tribal ways of knowing are often misrepresented, overlooked, or extracted and misappropriated because of colonial and misogynistic ideologies, systemic racism, and misappropriation that permeate institutional public health data and research.” (Kristine L. Rhodes et al., Centering Data Sovereignty, Tribal Values, and Practices for Equity in American Indian and Alaska Native Public Health Systems, 139 Pub. Health Rep. 10S, 12S (2024)).

  • Public Health Data Sharing and Tribes

    Data sharing with Tribes is not like sharing data with academic or non-profit institutions and instead is analogous to sharing data with another state, or with the federal government. Tribes have a well-established government-to-government relationship with the federal government, but government-to-government relationships with states must be affirmatively established and vary widely depending on state legislation.

    State law may explicitly require the state’s health agency to cooperate with Tribes. This includes entering into collaborative agreements with them to engage in data sharing for public health activities.10 States may also pass Executive Orders requiring state agencies to consult and collaborate with Tribes in the development and implementation of new policies.11 State agencies can collaborate with Tribes above and beyond what they are obligated to do under state law.  

    When states share public health surveillance data with Tribes, both the state agency and the Tribe are functioning within a complex legal framework that includes federal Indian law, federal health privacy statutes, state public health laws, and Tribal public health laws.12 Tribes are defined as public health authorities under the Health Insurance Portability and Accountability Act (HIPAA).13 Entities designated as public health authorities have the legal power to collect or receive protected health information (PHI) to fulfill their public health responsibilities. Given this complexity, data use agreements can help Tribes and partner jurisdictions to clarify parties’ expectations related to public health data sharing arrangements.

     

    10 For example, see Wis. Stat § 250.03(1)(a), (k) (2025) and Cal. Health & Safety Code § 128766 (2025).

    11 Minn. Exec. Order No. 03-05 (Apr. 9, 2003), www.leg.mn.gov/archive/execorders/03-05.pdf [https://perma.cc/RG39-VLLF].

    12 For a more detailed description of the complex legal framework that governs Tribes’ public health surveillance activities, see A. Hoss, Indigeneity, Data Genocide, and Public Health, 10 Iowa L. Rev. 1139 (2025).

    13 45 C.F.R. § 164.501 (2025) (Definition of public health authority).

  • Success Story: The Tulalip Tribes and the Washington State Department of Health

    Despite the complicated legal framework, states and Tribes can collaborate successfully on data sharing agreements. In 2025, the Washington State Department of Health (WADOH) and the Tulalip Tribes14 signed the first Tribal-specific data sharing agreement in the state.15 Before executing the agreement, the Tribe’s data sovereignty service committee and WADOH spent two years clarifying each entity’s needs and priorities in order to expand an existing agreement addressing Tribal data in the state’s healthcare system.16 The new agreement authorizes the Tribe to oversee the collection and use of Tribal members’ data and includes notification and consent provisions for the Tribe before outside parties can obtain the data of Tribal members.17 Tribal leadership emphasized that Tribes have an inherent right to own their data and to determine how the data is collected, shared, and used.18 When explaining the value of this agreement to the State of Washington, the health department’s leadership noted that when people are given access to their own data, it raises the visibility of health issues and helps to identify solutions which benefit all the State’s residents.19

    Among other things, this agreement:

    • Furthers the state’s government-to-government relationship with Tribes and reinforces that Tribes need access and ownership of their own health data to protect the health and welfare of their communities;20
    • Gives the Tribe access to the state’s disease reporting system, allowing Tribal public health staff to extract certain types of data directly;21 and  
    • Memorializes the fact that the state health department has to inform the Tribe before using Tribal data for analysis or publication.22

    The American Indian Health Commission (AIHC) has created a training based on the Tulalip Tribes’ experience to disseminate the lessons learned to other Tribes and Health Departments.23

    14 The Tulalip Tribes is a federally recognized Tribe and successors in interest to the Snohomish, Snoqualmie, Skykomish, and other allied Tribes and bands that signed the 1855 Treaty of Point Elliott. For more information about the Tribe, see https://www.tulaliptribes-nsn.gov/WhoWeAre.

    15 Wash. State Dep’t of Health, DOH and Tulalip Tribe sign historic Tribal-specific data sharing agreement (Jan. 21, 2025), https://doh.wa.gov/newsroom/doh-and-tulalip-tribe-sign-historic-tribal-specific-data-sharing-agreement. [https://perma.cc/2M8U-69DR]

    16 Kalvin Valdillez, First Tribal Data Sharing Agreement Signed Between the Tulalip Tribes and the Washington Dept. of Health, Tulalip News (Jan. 22, 2025), https://tulalipnews.com/2025/01/22/first-tribal-data-sharing-agreement-signed-between-the-tulalip-tribes-and-the-washington-dept-of-health/ [https://perma.cc/E43T-C7U6].

    17 Id.

    18 Wash. State Dep’t of Health, DOH and Tulalip Tribe sign historic Tribal-specific data sharing agreement (Jan. 21, 2025), https://doh.wa.gov/newsroom/doh-and-tulalip-tribe-sign-historic-tribal-specific-data-sharing-agreement. [https://perma.cc/2M8U-69DR]

    19 Id.

    20 Id.

    21 Nada Hassanein, Tribes, Long Shut Out from Their Own Health Data, Fight for Access and Sovereignty, Wash. State Standard (Mar. 28, 2025), https://washingtonstatestandard.com/2025/03/28/tribes-long-shut-out-from-their-own-health-data-fight-for-access-and-sovereignty/ [https://perma.cc/5WV4-XRWA].

    22 Freddy Monares, WA Health Dept. Gives Tulalip Tribes More Control Over Its Health Data, KNKX Public Radio (Jan. 28, 2025), https://www.knkx.org/government/2025-01-28/wa-dept-of-health-gives-tulalip-tribes-more-control-over-its-health-information-data [https://perma.cc/6GUB-4K8J].

    23 Heather Erb, Tribal Data Sovereignty and the Critical Role of Data in Public Health Governance, Am. Indian Health Comm'n for Wash. State (2025), https://bja.ojp.gov/doc/tribal-data-sovereignty-presentation.pdf [https://perma.cc/6A7T-ZGJT].

  • Module 2

  • Public Health Data Sharing and Tribal Epidemiology Centers

    In 1992, the federal government established TECs to improve the health and well-being of Tribal members and strengthen Tribal public health capacity.24 There are 12 TECs covering different regions across the United States. TECs have specific legal authority related to public health data sharing.

    HIPAA recognizes TECs as public health authorities, noting that they are “responsible for public health matters as part of [their] official mandate[s].”25 Congress has designated TECs as public health authorities for specific purposes defined in statute. Federal law authorizes TECs to perform seven core functions which include:

    TECs Core Functions Under Federal Law

    • collecting and monitoring data on the health status objectives of IHS, Indian Tribes, Tribal organizations, and urban Indian organizations;
    • evaluating delivery and data systems that impact Indian health;
    • assisting Tribes, Tribal organizations, and urban Indian organizations to determine health status objectives and services needed to meet those objectives; and
    • providing disease surveillance and promoting public health.26 

    The United States Government Accountability Office (GAO) emphasized that TECs are to be treated as public health authorities in a recent report on TECs and data sharing.27 The considerations below may be helpful in shaping data sharing agreements in which TECs are one of the parties.

    Considerations for Sharing Data with TECs

    • DUAs that are intended for non-governmental or academic organizations are not appropriate for use with TECs because they do not account for TEC statutory authority.28 If the agreement is between a state and a TEC, consider whether the agreement appropriately reflects the relationship between the two parties. TECs are legally mandated to collect data and perform public health functions in coordination with and on behalf of Tribes, and Tribes have inherent sovereign authority to protect the public health of their members. This is an important distinction from data sharing with other third parties, such as non-governmental organizations and academic partners.
    • Consider whether requests of a TEC regarding data sharing, use, and disclosure are similar to those the State requires of its local health departments or other state or federal agencies. As noted above, data sharing with TECs is different from sharing with non-governmental third parties. Although there are important distinctions, data sharing with TECs is analogous to data sharing with a local, state, or federal health agency. Thus, it may be important for TECs to understand whether the requirements being asked of them are also being asked of other governmental data sharing partners.

    24 Overview of Tribal Epidemiology Centers, Ctrs. for Disease Control & Prevention, https://stacks.cdc.gov/view/cdc/45461/cdc_45461_DS1.pdf [https://perma.cc/G6PG-RUN2] (last visited Aug. 21, 2025).

    25 See 25 U.S.C.A. § 1621m(e)(1) (West 2025).

    26 Indian Health Care Improvement Act, Pub. L. No. 94-437, 90 Stat. 1400 (1976).

    27 U.S. Gov’t Accountability Off., GAO 22-101498, Tribal Epidemiology Centers HHS Actions Needed to Enhance Data Access (2022). 

    28 See 25 U.S.C.A. § 1621m(e)(1) (West 2025).

  • Success Story: The Great Plains Tribal Epidemiology Center and the South Dakota Department of Health

    States have successfully negotiated data sharing agreements (DSAs) with TECs that respect Tribal data sovereignty and strengthen relationships between states and their Tribal partners. An agreement signed in 2024 by the Great Plains Tribal Epidemiology Center and the South Dakota Department of Health serves as an example.

    The Great Plains Tribal Epidemiology Center struggled for many years to get the public health data it needed to support the 17 Tribes it was established to serve.29 In 2022, the COVID-19 pandemic and a syphilis epidemic that disproportionately affected Native American residents of South Dakota underscored how much the agency needed county-level and identifiable public health data.30 Syphilis, a disease that had almost disappeared in the United States by the end of the twentieth century, reemerged in 2022. In the neonatal intensive care unit in Rapid City, South Dakota, doctors confirmed a new infection every week and a half, on average.31 That year, the TEC and the South Dakota Department of Health met to discuss draft language for a data sharing agreement.32

    Despite the public health emergency posed by the syphilis outbreak, it would take two more years for a DSA to be executed. In 2024, after years of discussion and negotiation, the state health department signed a DSA with the TEC that provides almost immediate access to data on reportable conditions for American Indians and Alaska Natives.33 Once the health department provided data to the Great Plains Tribal Epidemiology Center, Tribally led public health teams (which included staff from Tribes, the TEC and CDC) were able to locate and treat 62 individuals including six expectant mothers, preventing potentially deadly congenital syphilis cases.34

    To assist other TECs and states with the development of DSAs, the South Dakota Department of Health has posted a summary of the process they engaged in with the Great Plains Tribal Epidemiology Center on their website.35 It includes a timeline and a copy of the data sharing agreement. The Department notes that “[c]entral to the agreement is a shared commitment to Tribal data sovereignty—the right of Tribes to control their data and how it is used. [The Department’s] willingness to share data respectfully and transparently reflects a deepening trust and alignment with Tribal public health initiatives.”36

    Public health data are at the core of responsive public health interventions. While the legal framework that governs data sharing with Tribes, TECs, and federal, state, and local governments is complex, recent examples illustrate that effective data sharing partnerships which respect Tribal sovereignty while complying with relevant state and federal laws are possible.

    29 See GPTEC Success Story: Access to Data,Great Plains Tribal Epidemiology Ctr. (May 1, 2024), https://tribalepicenters.org/gptec-success-story-access-to-data/ [https://perma.cc/5DTR-KUBV]; Meghan Curry O’Connell, Tribal Health Equity Requires Tribal Data Equity, 41 Issues in Sci. & Tech. 28 (2024), https://issues.org/tribal-health-data-equity-oconnell/ [https://perma.cc/UKN6-T2EB].

    30 Keren Landman, How a Fight Over Data Made South Dakota’s Bad Syphilis Outbreak Worse, Vox (Dec. 19, 2023), https://www.vox.com/24006120/south-dakota-syphilis-congenital-indigenous-tribal-native-american-meghan-oconnell-health-board [https://perma.cc/WSR7-DPTZ].

    31 Id.

    32 Achieving a Data Sharing Agreement: A Collaborative Journey with South Dakota Tribes and the Great Plains Tribal Epidemiology Center, S.D. Dep't of Health, https://doh.sd.gov/topics/american-indian-health/data-sharing-agreement/ [https://perma.cc/7TA7-8CUS] (last visited Aug. 21, 2025).

    33 Id.

    34 O’Connell, supra at 29.

    35 Achieving a Data Sharing Agreement, supra note 32.

    36 Id.

  • Module 3

  • Resources on Public Health Data Sharing and Tribal Data