Data Sharing in Direct Contracting Agreements: What to Negotiate and What to Protect

Why Data Sharing Is the Centerpiece of Every Direct Contract

Most direct contracting conversations start with unit cost. That's the wrong place to start.

The single most important variable in a direct contract is what data you get, when you get it, and in what format. Without clean, timely data, you cannot measure whether the contract is working, identify overutilization, or benchmark performance against alternatives.

Providers know this. Some will use data opacity as a competitive moat. Your job in negotiations is to dismantle that moat before you sign anything.

---

What Data You Actually Need

Before you negotiate, know exactly what you're asking for. Self-insured employers typically need four categories of data from a direct contract partner.

Claims-level utilization data

• Procedure codes (CPT/HCPCS) and diagnosis codes (ICD-10) for every encounter
• Attending and rendering provider NPIs
• Facility charges, allowed amounts, and the actual amount paid under the contract
• Date of service, place of service, and discharge status for inpatient stays

Quality and outcomes data

• 30-day readmission rates by DRG category
• Complication rates for high-volume procedures (joint replacement, cardiac, spine)
• Patient-reported outcome measures (PROMs) if the provider collects them
• HEDIS-equivalent metrics for primary care arrangements

Cost and efficiency data

• Average length of stay versus national or regional benchmarks
• Case mix index trends over the contract term
• Implant and supply costs broken out separately from facility fees (this is often buried)

Member experience data

• Net Promoter Score or equivalent patient satisfaction data
• Scheduling wait times, particularly for specialists
• Care navigation completion rates if you've embedded a navigator

If a provider refuses to include claims-level data in the contract, that is a red flag. Full stop. You are operating blind without it.

---

The Standard Provider Pushback (and How to Handle It)

Expect resistance on three fronts.

"We'll share aggregate reports, not raw data." Aggregate reports are useful for marketing brochures. They are not useful for managing a $20 million benefits spend. Push back by specifying in the contract that you receive individual-encounter data files in 835/837 EDI format or a structured flat file delivered monthly. Aggregate summaries can supplement this, but they don't replace it.

"We have patient privacy concerns." HIPAA permits covered entities to share protected health information with plan sponsors for plan administration purposes under 45 CFR §164.504(f). The employer's plan document must include the required privacy provisions, but this is standard language your TPA or legal counsel can add in a day. This objection is almost always a negotiating tactic, not a genuine compliance concern.

"Our EHR system doesn't produce that format." Every major EHR platform—Epic, Cerner, Oracle Health—produces 835 transaction sets. If a large health system tells you their system can't export encounter data, they are telling you their IT team hasn't been asked to prioritize it. Put a data delivery timeline in the contract (90 days from signing is reasonable) and include a penalty structure if delivery is late or incomplete.

---

Specific Contract Language That Protects You

Vague data commitments are unenforceable. The following provisions should appear verbatim or in substance in your agreement.

Delivery schedule with teeth Include language requiring monthly data delivery within 15 business days of month-end close. Add a fee credit of 0.5% of monthly contract payments for each month delivery is late or materially incomplete. "Materially incomplete" should be defined as missing more than 5% of expected encounter records.

Data format specification Name the format. "Provider shall deliver encounter-level data in ANSI X12 837P/837I transaction format or a mutually agreed structured file format no less granular than the 837 standard." Leaving format undefined means you'll spend six months fighting over spreadsheets.

Audit rights Include a right to audit the provider's billing and coding records for any period covered by the contract, with 30-day written notice. Self-insured employers with 500+ employees in a direct arrangement with a health system should conduct a coding audit at least every 18 months. Studies from the Healthcare Financial Management Association consistently show upcoding rates of 3–7% in hospital billing—that's real money in a direct contract.

Data ownership State explicitly that the employer owns the data generated by its members' encounters. Providers occasionally insert language claiming co-ownership or restricting how you use the data. Strike that language. You need to be able to share the data with your TPA, stop-loss carrier, analytics vendor, and benefits consultant without asking permission each time.

Termination data transfer When the contract ends—for any reason—the provider must deliver a complete data extract covering the full contract term within 30 days of termination. This is non-negotiable. Without it, you lose historical context the moment you switch arrangements.

---

Setting Up Your Data Infrastructure Before You Sign

Negotiating the right contract language is step one. Step two is making sure your organization can actually receive and use the data.

Before signing, confirm:

• Your TPA can ingest 837 files directly from the provider or has a clearinghouse relationship to handle the translation
• You have a data warehouse or analytics platform (Innovalon, Springbuk, Garner Health's analytics layer, or a custom solution) that can normalize provider-sourced data alongside your standard claims feed
• Your stop-loss carrier's reporting requirements are compatible with the data structure you're building—some carriers will push back on non-standard formats during large claim reviews
• You have a designated internal owner for data quality, even if it's a part-time responsibility assigned to your benefits analyst

Organizations that skip this step routinely collect data they cannot use. That's a waste of the negotiating capital you spent getting the provisions into the contract.

---

Red Lines: When to Walk Away

Not every provider is a good direct contracting candidate. Walk away from the negotiation if:

• The provider refuses to include any encounter-level data in the agreement after two rounds of negotiation
• Legal review takes more than 90 days (this signals an organization not operationally ready for direct contracts)
• The provider insists on data exclusivity clauses that prevent you from sharing your own members' data with third-party analysts
• There is no data governance contact named on the provider side—if no one owns the data relationship, the commitments won't be kept

---

The Bottom Line

A direct contract without strong data provisions is just a discount arrangement with extra paperwork. The financial upside of direct contracting—typically 15–30% savings on targeted procedures compared to network rates, based on reported results from employers in the Pacific Business Group on Health and similar coalitions—depends entirely on your ability to measure and manage performance over time.

Data sharing language is not a legal formality. It is the operating mechanism of the entire arrangement. Treat it that way in negotiations, and you'll have a contract worth signing.