Media
The Trust Gap: Cora Han on Health Data Governance, Responsible AI, and Care Transitions
Based on Episode 11 of the Rainfall Health Podcast: Cora Han, Chief Health Data Officer at the University of California Health (UC Health) and former senior enforcement attorney in the Federal Trade Commission’s Division of Privacy and Identity Protection, in conversation with Rainfall Health founder and CEO Ahmed “Eddie” Qureshi.
Most conversations about health data start with the pipe: the API, the FHIR standard, the electronic health record integration, or the vendor portal.
Cora Han’s starts on the opposite side of the table: with trust, institutional obligation, and legal sequencing.
As Chief Health Data Officer at University of California Health — guiding health data governance across an academic health system comprising six academic health centers, dozens of clinics, and thousands of care teams — Han helps ensure patient data is protected, managed, and put to work at scale.
Her vantage point is virtually unique in American healthcare. She trained as an intellectual property attorney handling copyright, trademark, and privacy litigation before spending nearly a decade at the Federal Trade Commission’s (FTC) Division of Privacy and Identity Protection. There, she led high-stakes technology enforcement actions alongside regulatory partners at the Department of Health and Human Services (HHS), the Office of the National Coordinator for Health IT (ONC), the Office for Civil Rights (OCR), and the FDA.
At the FTC, she saw what happens when sensitive consumer and patient data is mishandled, monetized without consent, or left unprotected. At UC Health, she sees the opposite: how much clinical good that exact same data unlocks when mobilized responsibly across a care continuum.
It is really our duty to be able to use health data to improve care, to be able to improve people’s lives.
— Cora Han
That duality means Han reads neither as an organizational brake nor as an uncritical technology accelerator. For health system executives preparing for mandatory bundled models like CMS TEAM, CIOs evaluating generative AI, and digital health founders building for health systems, her counsel is fundamentally about sequencing: aligning the clinical workflow, stakeholder incentives, and governance guardrails long before signing software contracts.
What Does Health Data Governance Look Like in Practice
To outside observers, a data governance role sounds like an endless cycle of policy memos and regulatory compliance checklists. In practice, Han describes the role as fundamentally operational.
Every morning begins with a concrete problem that someone wants health data to solve:
- Operations: Enabling hospital operations teams to share resources and report on quality metrics. Track bed availability, surgical throughput, and staffing ratios across five distinct medical campuses.
- Population Health: Helping clinical quality leaders identify patients with chronic diseases who are due for preventive screenings before acute complications develop.
- Efficiency: Building tools that help healthcare leaders query health data to support operational and clinical decision-making.
- Translating Research to Bedside: Creating secure, compliant data enclaves where academic researchers and clinicians can collaborate to develop new therapeutics, validate algorithms, and test novel care pathways.
In every case, the technical capability to move the data is rarely the hardest part. The challenge is ensuring that data use serves a verified institutional need, complies with federal and state privacy statutes, and preserves patient confidence.
The Two Sides of Health Data: Obligation vs. Guardrail
In consumer software, data optimization drives clicks and ad revenue. In healthcare, the stakes are clinical outcomes and human lives. Withholding data or trapping it in clinical silos directly compromises care quality, causes duplicate diagnostic testing, delays post-acute placement, and drives up preventable readmissions.
The Clinical Obligation
The Fiduciary Guardrail
Core Imperative
Mandate
Use data to heal: Failing to mobilize patient records carries direct morbidity and financial costs. Clinicians cannot coordinate what they cannot see across fragmented care boundaries.
Boundary
Protect patient trust: Unsanctioned secondary use or commercial data leakage destroys the public trust upon which voluntary care delivery depends. Without trust, patients withhold vital symptoms.
When health system leaders treat privacy purely as a justification to say “no,” they neglect their clinical duty to use data to improve care. Conversely, when technology vendors view clinical records as training fodder for commercial foundation models, they risk devastating regulatory penalties and institutional reputational damage.
Why Do Lawyers Get Blamed for Slowing Down Innovation?
One of the most persistent refrains among health technology founders and clinical innovators is that legal and compliance teams are “where good ideas go to die.”
Han rejects that framing outright:
Lawyers don’t slow projects down. Late lawyers do.
— Cora Han
The breakdown occurs when a clinical or operational team spends nine to twelve months evaluating a software vendor, refining a pilot scope, and configuring dashboards, only to hand the completed vendor agreement to legal two weeks before the targeted go-live date.
At that late stage, in-house counsel uncovers fundamental structural flaws:
- Overbroad data rights that run afoul of HIPAA or state privacy statutes (such as California’s CMIA).
- Inadequate cybersecurity protocols or undisclosed downstream sub-processors.
- Ambiguous data retention, re-identification, or secondary model-training clauses.
- Workflow assumptions that create regulatory or clinical liability under Medicare programs.
When legal raises these critical flags, the project grinds to a halt. The operational champions blame legal for obstruction. In reality, the initiative stalled because governance was treated as an afterthought rather than a primary architecture requirement.
How to Build Multidisciplinary Alignment
To avoid the late-lawyer trap, health systems must establish a structured, multidisciplinary table from day one:
- Dedicated Governance Forums: Convening clinical champions, IT security engineers, and legal counsel on a recurring schedule so evaluations do not stall in scheduling purgatory.
- A Shared Vocabulary: Clinicians, data scientists, and attorneys must learn enough of each other’s domain to communicate without suspicion. Compliance concerns must be specific and grounded, not used as a generic veto.
- A Single Problem Statement: Defining precisely what clinical friction is being resolved, why existing systems cannot solve it, and what minimal data set is required.
Why Does Real-World Interoperability Break Down Between Hospitals and SNFs?
Under CMS’s mandatory Transforming Episode Accountability Model (CMS TEAM), 721 hospitals are held financially accountable for total Medicare Part A and B spending across a 30-day post-discharge window following five major inpatient surgical episodes:
- Lower-extremity joint replacement (LEJR)
- Surgical hip and femur fracture treatment (SHFFT)
- Coronary artery bypass graft (CABG)
- Major bowel procedures
- Spinal fusion
Because the majority of complications, readmissions, and spending occur after the patient leaves the acute care hospital — in skilled nursing facilities (SNFs), inpatient rehabilitation facilities, and home health agencies — TEAM is, in practice, a distributed care coordination and data-sharing mandate.
When asked why data does not flow smoothly across this continuum, Han chooses a precise word: uneven.
| Care Continuum Setting | Technology Infrastructure | Dedicated Resources | Primary Operational Focus |
|---|---|---|---|
| Acute Care Hospitals | Enterprise EHR (Epic/Cerner), real-time HL7/FHIR feeds, automated clinical alert systems | In-house legal counsel, data security engineers, clinical informaticists | Acute stabilization, surgical intervention, throughput, bed capacity |
| Skilled Nursing (SNFs) | Fragmented point-of-care EHRs, manual portal data entry, legacy software | Lean administrative teams, high nursing turnover, outsourced IT | Functional rehabilitation, ADL recovery, medication administration |
| Community Organizations | Paper charts, spreadsheets, unscheduled phone calls, secure faxes | Social workers, patient navigators, family caregivers, case managers | Social drivers of health (SDOH), housing, nutrition, transportation |
The friction across this care continuum does not stem from a lack of goodwill. Surgeons, hospital case managers, SNF directors of nursing, and home health coordinators all want the patient to heal without complication. The breakdown stems from four structural disparities:
- Storage Disparities: Legacy EHR platforms that do not speak the same clinical dialects or format transition summaries consistently.
- Process Fragmentation: Incompatible handoff timelines, referral documentation standards, and medication reconciliation workflows.
- Resource Asymmetry: Large medical systems possess multi-million-dollar health informatics teams; post-acute facilities often rely on single-person contracted IT support.
- Data Capture Variance: The acute-care chart captures surgical minutiae; the post-acute facility needs functional mobility, wound status, and social support availability.
As Eddie Qureshi emphasized during the discussion, health policy cannot assume an idealized world where every nursing home runs the same infrastructure as an academic medical center. Technology must meet providers where they operate today.
It’s Not the Pipes. It’s the Trust.
For more than two decades, the healthcare industry has treated interoperability as a plumbing problem: deploy FHIR APIs, connect to regional health information exchanges (HIEs), establish Direct secure messaging protocols, and data will flow.
Yet data sharing across acute and post-acute care remains persistently fragmented. Why?
Asked for the biggest challenge, she offers one broad word: There is a trust gap. It’s not the pipes. It’s the trust.
— Cora Han
Han dissects this trust gap across two operational planes:
1. Trust Between Institutional Care Partners
Hospital–post-acute partnerships depend on sharing information while balancing competitive market dynamics with the collaborative requirements of bundled payment models. When a hospital requests direct access to a post-acute partner’s clinical records, immediate questions arise:
- How will you use the clinical information we share, and who will have access to it?
- How will the data be transmitted, and who assumes financial liability if a breach occurs?
- Who is legally liable if a missed notification or incomplete transfer leads to an adverse patient event?
Without bounded, pre-negotiated legal frameworks, providers default to defensive data withholding.
2. Trust With Patients
Patients are acutely aware of the commercialization of personal information. If patients fear their surgical details, biometric readings, or health status will be shared with data brokers, commercial insurers, or advertisers, they withhold sensitive details from their doctors.
True interoperability unlocks only when both planes are resolved: institutions agree on purpose-bound operational scopes, and patients know their information is guarded by enforceable institutional commitments.
How Should Hospitals on 0.75% Margins Evaluate Healthcare AI?
With median health system operating margins hovering around 0.75%, hospital leadership teams have zero financial tolerance for software shelfware. Every dollar committed to a technology vendor should deliver measurable clinical or operational return.
Whether evaluating internal development or third-party commercial software, Han outlines the eight critical questions that should be resolved before signing:
Governance Domain
Core Evaluation Question
Q1: Clinical Need
Problem Definition
What exact need is this product trying to serve — and do our operational and clinical leaders agree that we actually have this need?
Evaluation Standard
Reject features searching for a problem. If the frontline clinical workflow does not actively demand it, procurement stops immediately.
Q2: Comparative Value
Efficacy & ROI
Will it solve that need measurably better than the way our care teams solve it today?
Evaluation Standard
Software that adds clicks without reducing episode complications, replacing manual labor, or mitigating downside risk is a net negative.
Q3: Data Scope
Data Minimization
What exact data elements does the tool require — and is only that data in scope?
Evaluation Standard
Enforce purpose-bound minimization. Blanket requests for entire patient charts or retrospective enterprise dumps should be rejected.
Q4: Data Retention
Lifecycle Management
What are the retention and deletion policies governing that data once the episode or contract concludes?
Evaluation Standard
Contracts should specify strict timelines and verified certification of data purging upon episode completion or agreement termination.
Q5: Secondary Use
Model Training Covenants
How do we ensure data is not shared downstream or used to train commercial foundation models without explicit authorization?
Evaluation Standard
Standard Business Associate Agreements (BAAs) often do not address generative AI. Express non-training covenants are non-negotiable.
Q6: Model Drift
Oversight & Change Notice
How will our system be notified when the vendor’s underlying model or software updates?
Evaluation Standard
SaaS vendors regularly deploy silent model updates. In clinical decision support or triage, silent model drift introduces catastrophic liability.
Q7: Ongoing Auditing
Monitoring & Bias Audits
How will we conduct continuous monitoring, bias audits, and adverse event reporting post-deployment?
Evaluation Standard
Governance does not end at procurement. Metrics for diagnostic accuracy, algorithmic fairness, and clinical impact should be reviewed regularly.
Q8: Cybersecurity Controls
Security Architecture
Are the vendor’s cybersecurity controls, certifications, and incident response timelines enterprise-ready?
Evaluation Standard
SOC2 Type II, HITRUST certification, robust encryption at rest and in transit, and immediate breach disclosure obligations are mandatory table stakes.
What Makes a Health Tech Vendor a True Partner?
For technology companies seeking to partner with health systems, Han shares three core principles that accelerate enterprise adoption far more effectively than a slide deck of software features:
1. Respect the Existing Clinical Workflow
Software must integrate natively into established daily workflows.
2. Explain Plainly How the Technology Works
Proprietary “black-box” algorithms will not pass clinical governance committees. Vendors must be capable of demonstrating to medical directors and ethics boards why a model generates specific recommendations, what validation datasets were used, and how algorithmic bias was measured and mitigated.
3. Answer Security Questionnaires Fast and Fully
Nothing stalls health system procurement faster than a half-filled security questionnaire or vague answers regarding sub-processors. Vendors that arrive with standardized, pre-packaged SOC2 Type II reports, penetration testing summaries, and architectural diagrams build immediate trust.
A Car Is Not a Fast Horse: Why AI Will Redefine Care Delivery
As the conversation concluded, Eddie Qureshi and Cora Han turned to the long-term trajectory of artificial intelligence across American healthcare.
When the automobile first appeared, early observers described it as a “horseless carriage.” The metric of success was straightforward: does it pull a carriage slightly faster or cheaper than a horse? Only years later did society recognize that automobiles fundamentally transformed urban planning, commerce, supply chains, and public health.
Healthcare is currently navigating its “fast horse” era of AI. Systems are deploying tools to draft patient portal replies slightly faster, summarize visit notes a few minutes quicker, or automate routine scheduling calls.
Don’t stop at making existing things go faster. Ask how technology might change the way care is provided. It is really kind of our duty to think in the big picture about what the large-scale potential could be.
— Cora Han
When true care-continuum infrastructure is established — connecting acute hospitals, post-acute facilities, and community health workers through shared governance and accountability — healthcare will stop trying to make fragmented, analog processes run faster. It will finally deliver the continuous, proactive care transitions that patients deserve.
Frequently asked questions
What does a Chief Health Data Officer do at a major health system?
A Chief Health Data Officer (CHDO) guides health data governance, security, and utilization strategy. At institutions like UC Health, the CHDO bridges clinical operations, IT engineering, research data enclaves, and legal compliance to ensure patient data is used effectively to improve clinical outcomes while safeguarding privacy and institutional trust.
Why do care transitions fail between acute hospitals and skilled nursing facilities (SNFs)?
Care transitions between hospitals and SNFs typically break down due to structural disparities in health IT infrastructure, incompatible workflow handoffs, and a lack of pre-negotiated trust agreements. While both parties want the patient to heal, defensive data withholding and fragmented EHR systems prevent clinical teams from accessing actionable patient information in real time.
How does health data governance affect compliance under the CMS TEAM model?
Under CMS TEAM, hospitals are held financially accountable for all Medicare Part A and B spending across a 30-day post-discharge window. Because post-acute providers deliver the majority of care during this period, hospitals may need to establish secure, compliant, and purpose-bound data agreements to track patient progress, prevent complications, and avoid readmission penalties without violating HIPAA.
Why do health system lawyers get a reputation for slowing down technology adoption?
As Cora Han explains, “Lawyers don’t slow projects down. Late lawyers do.” When operational or clinical teams negotiate software contracts for months before bringing in legal counsel, lawyers are forced to halt deployments to resolve critical privacy, cybersecurity, and secondary data-use vulnerabilities that should have been addressed during initial scoping.
What should health system CIOs ask before procuring healthcare AI software?
CIOs and clinical executives should evaluate eight fundamental governance domains: clinical necessity, comparative clinical efficacy, data minimization, data retention policies, secondary model-training restrictions, model drift notification protocols, ongoing algorithmic auditing, and enterprise cybersecurity certifications (SOC2 Type II, HITRUST).
Download the eBook
Executive Policy eBook
The Trust Gap: Health Data Governance with Cora Han
Full executive transcript, governance frameworks, and care continuum models in PDF format.
Get your free CMS TEAM analysis
Rainfall Health will review your 2024 and 2025 Medicare billings and build an individualized view of upside opportunity and downside risk under the CMS TEAM mandate.
- Schedule a demo and free analysis: /schedule-a-demo/
- TEAM product: /team/
- CJR-X guide: /cjrx/
Further reading
- CMS TEAM Guide: Participating Hospitals, Rules, and Strategy
- Safety Net Hospitals and CMS TEAM: Dr. Sandra Scott
- Compliance Risk Hiding in Plain Sight Under TEAM
- Why CMS TEAM Turned Mandatory: Dr. David Shulkin
- AI Leverage in Care Coordination: Mark Adams
- Podcast and press
References
- University of California Office of the President. Center for Data-driven Insights and Innovation (CDI2) — UC Health systemwide analytics, UC Health Data Warehouse, and health data governance (Chief Health Data Officer: Cora Han, JD).
- Centers for Medicare & Medicaid Services. Transforming Episode Accountability Model (TEAM) — mandatory episode accountability program overview.
- Centers for Medicare & Medicaid Services. (2024, August 28). Medicare Program: Hospital Inpatient Prospective Payment Systems… FY2025 IPPS Final Rule, Section X — TEAM Model (42 CFR Part 512). Federal Register, 89(166), 68986–69178.
Cora Han is Chief Health Data Officer at the University of California Health (UC Health) and former senior enforcement attorney in the Federal Trade Commission’s Division of Privacy and Identity Protection.
Ahmed “Eddie” Qureshi is Founder and CEO of Rainfall Health and host of the Rainfall Health Podcast.
This article is for informational purposes only and is not legal, financial, or clinical advice. It reflects a Rainfall Health podcast conversation. CMS TEAM track rules, episode windows, and post-discharge benchmarks reflect Rainfall Health’s analysis of CMS regulations. © 2026 Rainfall Health.