Set data governance & privacy rules

Months 0–18 · UHA Chief Privacy Officer; HHS OCRDiscuss this step

Every concrete action this step requires, who is responsible, and when it happens relative to enactment.

#	Action	Owner	When	Trade-off
1.14.1	Prohibit use of UHP data for law enforcement or immigration enforcement without a judicial warrant.	Congress	Drafting	A warrant requirement protects patients' trust but limits law enforcement access to evidence.
1.14.2	Create a research data enclave with de-identified data, approved projects only, and public audit logs.	UHA	Year 1–2	A research enclave enables discoveries but carries re-identification risks.
1.14.3	Give patients a portal showing who accessed their records.	UHA	Year 2	An access-log portal increases transparency but adds infrastructure cost.
1.14.4	Require annual third-party security audits; publish results.	UHA / IG	Annual	Published audits build trust but disclose weaknesses attackers could exploit.