Indigenous Data Sovereignty

“Decolonizing Data: 1) Reclaiming the Indigenous value of data collection, analysis, and research. 2) Data for Native people, by Native people. 3) Recognizes the inherent strength of Indigenous people.” – Urban Indian Health Institute

Indigenous Data Sovereignty

“The right of each tribe to govern the collection, ownership, and application of data, information, and knowledge about its peoples, lands, and resources. Indigenous data sovereignty derives from the inherent right of Native nations to govern their peoples, lands, and resources, which is acknowledged in treaties and other legal mechanisms negotiated on a nation-to-nation basis with settler-colonial governments.”

Tribes are sovereign nations and one of the many ways that Tribes have the right to exercise their sovereignty is with respect to data. 

Indigenous (or Tribal) data sovereignty means that tribes have a right to control the collection, ownership, and use of their own data.

When working with Tribes on public health issues, it is important to remember that Tribes should be able to control data on their members – regardless of who currently holds the data. 

Federal, state, and local jurisdictions should integrate Indigenous Data Sovereignty into their laws, policies, and relationships with tribes. 

For data sovereignty to be meaningful, it must be addressed before data are collected. Most jurisdictions have not done this. States collect data without explicit permission from Tribes. 

There are technical challenges to identifying tribal members in data and to coordinating with multiple Tribes. 

However, states should involve Tribes in the decision-making process regarding the collection and use of data, including how to identify Tribal members. 

At a minimum, Tribes should be consulted in the development of data collection and use practices in the health department and any data collected that is needed by Tribes to perform their public health obligations should be provided to them. 

Tribes may also have processes for collecting their own data and honoring Native data practices and wisdom outside of the United States public health system. 

Tribal Data

The term “Tribal data” generally refers to data on specific tribal members or data that is representative of a Tribe or Tribes. For example, the COVID-19 test positivity rate for a specific Tribe could be considered “Tribal data”.  Because of Indigenous Data Sovereignty, Tribes should control this data. 

“Tribal data” is not, generally, the only data Tribes need to perform their public health obligations.  

  • For example, if there is an outbreak of a disease in a tribal community, the Tribe would need to know who has the disease – regardless of if those people are tribal members or not. 
  • Similarly, Tribes may need information on people living off the reservation. For example, Tribes may have an obligation to provide public health services to members living in a community off the reservation. To monitor public health threats, Tribes need member and non-member data as well. 
  • HIPAA allows for PHI to be shared with tribes [Link to Tribal Public Health Authority page] and it is not limited to Tribal data. Tribes can receive any available information they need to perform public health activities and fulfill their public health obligations including data on non-tribal members, non-AI/AN people, and people living off of Tribal lands. 
  • As PHAs, Tribes and TECs can define which data they require to perform their public health functions. This practice is consistent with the minimum necessary rule and guidance from HHS/OCR for all PHAs public health data collection or requests.

     

    Further details are described in the Data Collection section of this toolkit. 

     

    Tribal Affiliation

    Each Tribe sets its own criteria for tribal enrollment or membership. Enrollment in a federally recognized Tribe obligates the Tribe, as a government, to that person, just as being a US citizen obligates the United States to provide certain protections and rights. 

    Individuals may also identify as a member of a Tribe, but not be enrolled in a Tribe. 

    • Federal rules allow you to only be enrolled in a single Tribe, so if someone has parents from two different tribes, they may be enrolled in one but strongly identify with the other as well. 
    • In some instances, an individual may be connected culturally to a Tribe but be unable to enroll in that Tribe. They may identify with the Tribe even if they are not enrolled. 

      There are ongoing discussions on how best to collect this information, but, generally, AI/AN race is used to identify possible tribal members. For specific Tribes, AI/AN race combined with geography (for example, a zip code on a reservation) is often used to identify “Tribal members”, although this method is flawed. 

      Regardless of how “tribal members” are identified, Tribal governments are able to receive data on requested populations, not just Tribal members. 

       

      Tribal Public Health Authority

      “In the context of public health, tribes have inherent authority as sovereign nations to protect and promote the health and welfare of their citizens, using methods most relevant for their communities. Tribal inherent authority is a ‘plenary and exclusive power over their members and their territory, subject only to limitations imposed by federal law’.” – CDC Public Health Law

      HIPAA

      Tribal, federal, and state law may govern public health practice and data sharing. At the federal level, HIPAA outlines the requirements for the use and protection of health information. HIPAA allows for PHI to be shared with Tribes and it is not limited to Tribal data. Tribes can receive any available information they need to perform public health activities and fulfill their public health obligations including data on non-tribal members, non-AI/AN people, and people living off of Tribal lands.

      Health Insurance Portability and Accountability Act

      Key Definitions

       

      • Covered entity: A clinic, health insurance company, laboratory, etc. that generates or uses protected health information (PHI) in the care of a patient. . 
      • Protected Health Information (PHI): Individually identifiable health information that is protected by the Privacy Rule. To fall under the Privacy Rule, PHI must be “held or transmitted by a covered entity or its business associate”. 
      • Public health authority: An entity that can receive PHI under HIPAA without patient authorization. Includes state health departments, Tribes, and TECs. 

      HIPAA allows PHI to be given by covered entities to PHAs without patient authorization for public health purposes. State health departments rely on HIPAA and the Privacy Rule to collect PHI from covered entities without patient consent.

        • For example, clinics that provide information on reportable diseases to state health departments can do so because of the Privacy Rule in HIPAA. There may also be state laws that aim to compel covered entities to submit data on certain diseases or conditions, but the authority to collect the information is provided by HIPAA. 

      For the purposes of HIPAA, all public health authorities are equivalent. There is no distinction between Tribal and non-Tribal PHAs. HIPAA allows for the release of data to any PHA for public health activities. 

      If your state health department is a covered entity, HIPAA applies to the release of data, which allows for disclosure of PHI to PHAs. Although HIPAA is often used as standard for the release of PHI, if your health department is not a covered entity, HIPAA does not apply to the release of data – you are not “covered” by HIPAA. 

        • Some state health departments are public health authorities AND covered entities. These are called “hybrid entities”. Hybrid entities are also allowed to disclose PHI to PHAs for public health purposes. 

      States or local jurisdictions may have laws to require covered entities to provide PHI to the state for certain conditions (“mandatory reporting” or “reportable diseases”). But these laws are not necessary for the state to receive PHI. Covered entities can provide PHI to PHAs without a state law requiring submission.  

        • Similarly, Tribes and TECs can receive PHI for public health purposes without having specific laws to collect or receive PHI because they are also PHAs. 
        • TECs are not governments and cannot make laws but they are PHAs and can receive PHI for public health purposes. 

      Other state laws may govern how PHI of state residents is handled and released by the state. 

        • Conflicts may exist between state and federal laws. 
        • When there is uncertainty, experts in tribal law should be included in the interpretations. 

       

      Equity in Data Sharing

      Public health officials should treat all public health authorities the same with respect to data sharing, access, and requests. 

      Federal law defines PHAs. States should not treat non-Tribal PHAs differently than Tribal PHAs. Differences in treatment not only perpetuate structural racism and health inequities, but it could also open the state to discrimination lawsuits. 

      States should ensure that Tribal PHAs do not face higher barriers to accessing necessary data than non-Tribal PHAs

       

      Continue The Toolkit 

      Data Is Essential

      Tribal Background

      Cultural Humility

      Sovereignty & Health 

      Data Collection & Access

      Tools & Resources