Just as varied as the types of health data, of course, are the types of individuals and organizations who hold or process the data. Data are processed by:
- Clinics, hospitals, nursing homes, hospices, laboratories, independent physicians, and other primary-care and diagnostic services (breast cancer screening...)
- Pharmacies (including large commercial chains)
- Private-sector managed-care providers, healthcare services (physical therapy, speech therapy, social work...), disease-management businesses (diabetes maintenance...), and pharmacy-benefit management companies
- Blood supply systems and manufacturers of blood products, ova and sperm banks, and organ transplant and other tissue brokers
- Academic and other nonprofit health research centers
- Government organizations (healthcare providers; payors; research and statistics centers; regulators; public-health authorities; immigration, military, penal, and social-services organizations...)
- Manufacturers of pharmaceuticals, vaccines and other biotechnology products, diagnostics, and medical devices
- International quasi-governmental organizations (World Health Organization, International Red Cross and Red Crescent...)
- Health, life, and casualty insurance companies
- Nonprofit patient organizations
- Employers, schools
- For-profit research firms (contract research organizations...)
- Commercial data vendors.
Thus health data are held by a greater variety of organizations than ever before. Data flow, often at very high volume, within and among many of these organizations.
Although physicians, and staff nominally under their supervision, still collect much of the most intimate data, they are not necessarily any longer in position to control the movements, uses, or fate of the data. Data from a routine patient encounter with the healthcare system quickly are transmitted among care-providers and their local institutions, various technical support services, the paying institutions, and a variety of supervisors, inspectors, auditors, and researchers—many far removed from the data-subject, many not medically certified, and possibly many not sworn to confidentiality. Eventually the encounter may be examined in practice review, filed into statistical tabulations, recorded into ongoing registries, or scrutinized in research.