Public health department data modernization, read from the funding record

Two true statements that sound contradictory

Public health data modernization is an active federal program with published goals, named systems, an annual strategy document and open source code shipping this month. It is also a market whose federal spending peaked and has been falling for two years. Both statements are checkable in the same public records, and a vendor who holds only one of them will either walk away from real work or walk into a bid that has no budget behind it.

Everything below comes from public sources: CDC program pages, the Federal Register, the Code of Federal Regulations, federal award records on USAspending, and CDC's own public code repositories. Figures were pulled in August 2026. Anyone can reproduce them, and anyone evaluating this market should, because these numbers move.

The infrastructure grant is the largest single lane, and it has an end date

In late 2022 CDC awarded what health departments call the Public Health Infrastructure Grant, formally titled "Strengthening U.S. Public Health Infrastructure, Workforce, and Data Systems." It runs on assistance listing 93.967. Filtering federal award records for that listing returns 111 awards to 108 distinct recipients, with award amounts totaling roughly $5.1 billion, and a period of performance that begins December 1, 2022 and ends November 30, 2027.

Recipients are state, territorial and large local health departments, plus a set of national partners. The largest individual awards sit with Texas, Florida, California, New York, Pennsylvania and Ohio. Award abstracts show the program split into three strategies: A1 Workforce, A2 Foundational Capabilities, and A3 Data Modernization. Data work is one third of a grant that also has to pay for hiring, retention, accreditation and general capacity, and in most jurisdictions the workforce strategy absorbed the early spending.

The obligation pattern matters more than the headline. Under assistance listing 93.967, federal obligations were about $3.84 billion in fiscal 2023, then $543 million in fiscal 2024, $296 million in fiscal 2025, and $266 million in fiscal 2026 through the start of August. The program front-loaded almost everything in year one. What is left is continuation funding on a five-year clock that stops in November 2027, and multi-year system procurements started in 2026 have to finish inside it or find a different funding source for their tail.

What a negative obligation means, and where it happened

The Epidemiology and Laboratory Capacity cooperative agreement, assistance listing 93.323, carried the pandemic surge. Obligations were roughly $11.2 billion in fiscal 2020 and $30.6 billion in fiscal 2021, then dropped to $552 million in fiscal 2022, $1.09 billion in fiscal 2023, and $610 million in fiscal 2024.

In fiscal 2025 the figure is negative $1.98 billion, and fiscal 2026 to date is negative $261 million. A negative obligation is a deobligation: money that was committed on paper coming back off the books. That is the pandemic supplemental unwinding, and it is the single most important context for any conversation with a health department CIO. Departments that staffed and scoped against ELC supplemental dollars have spent the last two years reducing rather than expanding, and a vendor pitching net-new platform spend into that environment is arriving with the wrong proposition.

CDC's own contract spending has contracted

The direct federal lane tells the same story. Counting CDC contract obligations under the computer systems design and related services codes (541511, 541512, 541513, 541519 and 518210), the fiscal year totals run as follows.

Fiscal 2025 came in at 62 percent of the fiscal 2024 peak. Fiscal 2026, with about ten months elapsed, sits at 24 percent of that peak. Even allowing for a heavy September, the direction is unambiguous. Incumbency is also concentrated: over fiscal 2024 through 2026, the largest CDC obligations in those codes went to i3 Federal, Peraton, Deloitte Consulting, Lantana Consulting Group, Booz Allen Hamilton, General Dynamics Information Technology, NTT Data Services Federal Government, ICF, Tanaq Management Services and CACI. A firm entering here is competing for subcontract scope under a shrinking set of prime vehicles, not for a fresh award.

Where the money that remains actually sits

Funding lane	What it pays for	What it means for a vendor
Infrastructure grant (listing 93.967)	Workforce, foundational capabilities, and data modernization at 108 recipients. Ends November 30, 2027.	The main state and local lane. Money is already obligated to the department, so you sell to the department, not to CDC.
Epidemiology and Laboratory Capacity (listing 93.323)	Surveillance and laboratory systems. Carried the pandemic supplementals.	Net negative in FY2025 and FY2026. Treat any pipeline built on it as at risk until confirmed with the recipient.
Immunization cooperative agreements (listing 93.268)	Immunization programs, including the immunization information system every jurisdiction runs. About $464M obligated across FY2025 and FY2026 to date.	Steadier than the surveillance lanes and tied to a system that cannot be turned off.
National partner agreements (listing 93.421)	Association and institute partners that redistribute funds and run shared services.	A real subcontracting route into many jurisdictions through one relationship.
Medicaid enhanced match	90 percent federal match for system design and development, 75 percent for operations.	The largest sustained pool touching health data, with its own approval calendar and its own intellectual property terms.
CDC direct contracts	Platform, integration and analytic services bought centrally.	Declining and concentrated. Realistic entry is as a subcontractor to an existing holder.

The systems you would actually be working on

Modernization is not one platform. It is a set of named systems, and knowing which one a conversation is about is the difference between a scoped proposal and a brochure.

Electronic case reporting. eCR automates the transfer of case reports from electronic health records to public health agencies. CDC reports more than 60,000 facilities actively sending electronic initial case reports. It is a joint effort of the Association of Public Health Laboratories, the Council of State and Territorial Epidemiologists and CDC. Health care organizations connect to the APHL Informatics Messaging Services platform; agencies author their reporting criteria in the Reportable Conditions Knowledge Management System. Since January 1, 2022 eCR has been required under the CMS Promoting Interoperability Program for eligible hospitals and critical access hospitals, and under the MIPS Promoting Interoperability performance category for eligible clinicians. That mandate is why eCR work keeps moving while discretionary projects stall.

The NEDSS Base System. NBS is the CDC-built surveillance and case management application used by 25 health departments, covering 20 states plus the Commonwealth of the Northern Mariana Islands, Guam, Puerto Rico, the Republic of the Marshall Islands and the U.S. Virgin Islands. It tracks more than 140 conditions and carries LOINC, SNOMED, RxNorm and HL7 vocabulary and messaging standards. CDC started building it in 2001 and the first version went live in Nebraska in January 2003, which tells you what the modernization effort is actually replacing.

Syndromic surveillance. The National Syndromic Surveillance Program runs the BioSense Platform, with ESSENCE as the analysis tool and a community of practice of more than 1,400 practitioners. CDC reports that about 85 percent of the nation's emergency department visits are available for situational awareness, most within 24 hours.

Vital records. The National Vital Statistics System modernization effort targets near real-time birth and death reporting, with e-Vitals standards work and FHIR pilots reaching into funeral home data exchange. CDC reports 69 percent of deaths available in provisional mortality data within 10 days, against 10 percent in 2010.

The central platform. The One CDC Data Platform was established in 2024 as an integration hub. CDC reports 36 CDC programs onboarded during 2025 and six core data sources now available in a single place, with a partner workspace for health departments named as a 2026 milestone.

Read the code before you write the proposal

This is the part most vendors skip, and it is the cheapest edge available in this market. CDC develops much of its modernization software in the open. The CDCgov organization on GitHub, created in April 2015, publishes 562 public repositories.

The Data Integration Building Blocks suite is there in full: an eCR viewer, an eCR refiner that reduces electronic initial case reports and reportability responses down to the necessary elements, and a query connector described as a FHIR client that lets a public health agency query health care organizations directly. Deployment repositories exist for AWS, Azure and Google Cloud. The NEDSS modernization work is equally open, under Apache 2.0, as Java microservices for data ingestion and case notification, TSQL reporting services, Helm charts and Terraform infrastructure, with commits landing this month.

Two consequences follow. First, technical claims in a proposal are verifiable against the actual code by anyone on the review panel who cares to look, which raises the cost of vagueness and rewards specificity. Second, an integration approach can be designed against the real interfaces before a contract exists, which is a materially different conversation than promising to learn the environment after award.

The rules are genuinely in flux, and saying so is the accurate position

Several things a vendor might assume are settled are not. Stating this plainly to a buyer is more useful than projecting false certainty.

The public health interoperability certification proposals were withdrawn. In August 2024, ASTP/ONC proposed a rule titled "Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability." Comments closed in October 2024. On December 29, 2025, the agency published a withdrawal of the remaining proposals from that rule that had not been finalized, effective the same day. Product roadmaps built on those proposed certification criteria no longer have a regulatory anchor.

What did get finalized was TEFCA. A final rule published December 16, 2024 and effective January 15, 2025 implemented Trusted Exchange Framework and Common Agreement provisions and added a TEFCA manner exception to the information blocking rules. TEFCA is now codified at 45 CFR part 172. The current Common Agreement is version 2.1, published in February 2025, and public health is one of six authorized exchange purposes alongside treatment, payment, health care operations, government benefits determination and individual access services. The Sequoia Project, as Recognized Coordinating Entity, publishes the current list of designated networks, which includes eHealth Exchange, Epic Nexus, Health Gorilla, KONZA Health, Oracle Health Information Network and Surescripts among others, and which changes as applicants complete onboarding.

Two significant rules are pending. A proposed rule to strengthen the HIPAA Security Rule for electronic protected health information published January 6, 2025 and has not been finalized as of mid-August 2026. A separate ASTP/ONC deregulatory proposed rule published December 29, 2025 with comments closing February 27, 2026, and it too remains unfinalized. A CMS proposed rule published April 14, 2026 would require certain HL7 FHIR implementation guides that are currently only recommended, and would require payers to report API endpoints; comments closed June 15, 2026.

The standing permission has not changed. Under 45 CFR 164.512(b)(1)(i), a covered entity may disclose protected health information without authorization to a public health authority legally authorized to collect it for preventing or controlling disease, injury or disability, including disease reporting, vital events and the conduct of surveillance, investigations and interventions. That provision is the legal floor the entire reporting architecture stands on, and it is stable while the certification rules move.

Medicaid is the other door, with different terms

A large share of health data work at the state level is paid for with Medicaid enhanced federal match rather than public health grant money, and the terms differ in ways that matter to a vendor's balance sheet.

Under 42 CFR 433.112, federal financial participation is available at 90 percent for design, development, installation or enhancement of a mechanized claims processing and information retrieval system, but only if an Advance Planning Document is approved by CMS before the state spends the money. Under 42 CFR 433.116, operations draw 75 percent. Two conditions in 433.112 are worth reading before pricing the work: the state must own any software designed, developed, installed or improved with 90 percent match, and the Department holds a royalty-free, non-exclusive and irrevocable license to reproduce, publish or otherwise use it. Prior written approval requirements for acquisitions run through 45 CFR 95.611.

The practical consequence is timing and intellectual property. Work that depends on an approved planning document moves on a federal approval calendar rather than a state fiscal year, and a solicitation can sit dormant for months while an amendment clears. And a firm whose model depends on retaining reusable components should read the ownership language before assuming its platform survives the engagement.

Subrecipient or contractor, and why the answer changes the deal

When a health department passes infrastructure grant money to an outside organization, it must classify the relationship. 2 CFR 200.331 gives the pass-through entity responsibility for making that determination case by case, and the section is explicit that the substance of the relationship matters more than the form of the agreement.

A subrecipient carries out a portion of the federal award, makes programmatic decisions, has its performance measured against program objectives, and inherits federal program requirements. A contractor provides goods and services within its normal business operations to many purchasers. The classification decides which compliance obligations, audit exposure and reporting burdens attach. A vendor should ask for the determination in writing before signing, because the two agreements price differently and a contractor priced as a contractor but treated as a subrecipient absorbs cost it never quoted.

Who the buyers are

The market has a specific and countable shape. The infrastructure grant reaches 108 recipients. ASTHO represents chief health officials from the states, Washington DC, five U.S. territories and three freely associated states. NACCHO comprises more than 3,300 local health departments. Between those tiers sit national partners such as the National Network of Public Health Institutes, the Public Health Accreditation Board and state-affiliated research foundations, several of which hold nine-figure federal awards and redistribute them.

That structure explains why cold portal bidding underperforms here. The buying decision often sits with a program office spending grant money against a strategy commitment, not with a central procurement office running an open competition. Reaching the program office, and reaching the national partner that already touches thirty jurisdictions, is worth more than another portal registration. The portal still matters, because the paperwork has to route through it, but it is the last step rather than the first.

What we would verify before bidding

• The obligation and its end date for the specific recipient, pulled from the federal award record rather than taken from a conversation.
• Which named system the requirement attaches to, and whether that system is CDC-built, commercially licensed, or state-custom.
• Whether a federal mandate backs the work, such as the CMS Promoting Interoperability requirement behind electronic case reporting. Mandated work survives budget cycles that discretionary work does not.
• The subrecipient or contractor determination, in writing, under 2 CFR 200.331.
• Software ownership and license terms, especially where Medicaid enhanced match is the funding source.
• Whether the period of performance can absorb the schedule, given that the infrastructure grant closes November 30, 2027.
• Which prime or national partner already holds the relationship, and whether a subcontract is the faster and better-priced route.

Bottom line

This is a market with real technical need, an unusually open technical surface, and a contracting budget that has been shrinking for two years while the grant money that replaced it runs out in November 2027. The work that keeps moving is the work attached to a mandate or attached to reducing what a department already spends. The work that stalls is net-new platform ambition funded from a line that is deobligating. A vendor who can tell those two apart, name the system in question, and show up having already read the code will find a real place here. One who treats "data modernization" as a category rather than a set of named systems on named funding lines will spend a year learning that the category does not buy anything.

Frequently asked questions