Advancing a Healthier Wisconsin · WIN
The WIN Initiative
Draft for comment · WIN working group.
Advancing a Healthier Wisconsin × Forward Health Group Draft for comment · WIN working group
← Back to the WIN initiative

Who touches WIN's data,
and what lets them.

An initial draft, put up so it can be corrected. Every arrow in this initiative is a transfer of somebody's health information, and every transfer needs a piece of paper behind it. This page names the actors, the data each one creates, the flows that will actually occur, and the agreement that allows it. Where the answer is not yet known, it says so rather than guessing.

Built September 2026 Grounded in Draft 1 of the WIN matrix Not yet reviewed
What this is. Coming out of our session this week with Karen, Anthony and Devarati, we said we would put the data-agreement picture together. This is that, as a first draft. It takes the six rows of the draft matrix and puts them on a map, because the questions the draft leaves open are questions about who signs with whom, and a table cannot show that.

The nearest use for it is the Froedtert redlines. It is built so Toni Hofhine can see on one screen which agreements Froedtert is being asked to sign, which already exist, who sits on the other side of each, and which lines need no agreement at all. That is what the redlines are really about.

One  ·  The five agreements, and what each one is for

Five pieces of paper do all the work, and a sixth answer is that no paper is needed. Naming the sixth matters as much as the other five: an initiative that cannot say where an agreement is not required will keep drafting agreements forever.

MSA
Master Services Agreement
The commercial frame between two organizations. Scope, term, fees, liability, ownership. It says we work together and here are the rules; it says nothing about health information.
Needed when money or services move, or could later. An MSA can be written at zero dollars purely to put the frame in place.
BAA
Business Associate Agreement
Governs use and disclosure of identifiable PHI handled on behalf of a HIPAA covered entity. Required of anyone who creates, receives, maintains or transmits PHI for a health care organization.
Needed when the data is identifiable and the work is care delivery or operations — device readings, patient identifiers, care notes.
Sub‑BAA
Subcontractor BAA
The same obligations, flowed down one link. When a business associate hands PHI to its vendor, that second vendor signs a subcontractor BAA with the first, not with the covered entity.
Needed when a chain forms. This is the one most often missed, because the covered entity never sees the second hop.
DUA
Data Use Agreement
Governs a defined data set for a stated purpose: research, analytics, quality improvement, benchmarking. It is signed by the organization that owns the data and the organization that will use it — not by a vendor working with that data in between.
Needed when one organization wants to use another's data for a purpose beyond direct treatment. A business associate working with that data needs a BAA, not a seat on the DUA.
NDA
Non-Disclosure Agreement
Confidentiality, separate from privacy law. It covers what partners may say about WIN's data and findings, not what they may do with the records.
Proposed across all partners, so nothing is disclosed without explicit permission of WIN leadership.
— none —
The null edge
Two actors appear on the same map and never exchange data. The honest entry is no agreement required, recorded deliberately so nobody re-opens it every quarter.
Needed when a relationship is organizational rather than informational. Write it down; a blank cell and a decided null look identical on a page and mean opposite things.
Most WIN vendors need two, not one. A BAA for the identifiable data they touch while the work is happening, and a DUA governing what they may do with that data once it is aggregated, de-identified, or used beyond direct care. The draft matrix says this explicitly, and it is the sentence most likely to be skipped.
The correction the draft needs most: FHG is not a party to the DUA. The matrix puts a DUA on FHG's row with four health care organizations. That is the wrong pairing. FHG is a business associate. We build the measurement from the organization's data, on its behalf. We do not own that data and we are not the party using it for research. The DUA belongs between the health care organization and AHW, and AHW should be the party to many of them: Sixteenth Street and AHW, say, governing the flow of Sixteenth Street's data through FHG to AHW, to support AHW's research. What FHG signs is the BAA.

And that answers the question the draft asks three times. “Does that cover data sharing with Steering Team members?” sits on the FHG, WCHQ and WHIO rows. The permitted audience is a term of the HCO-to-AHW DUA, not of anything a vendor holds. Settle it once, there, and all three question marks close together.

Two  ·  The map

Colour says what an actor does with data. Outline says whether it does work or only receives. Switch the view to see the same picture four ways. What moves is directional, and the colour of each arrow is the class of data on it, and the kind of data is what decides which agreement you need. What authorizes it drops the arrowheads and becomes the agreement layer the 2025 slides drew — lines drawn between the two organizations that sign, with the agreement named on the line, and the deliberate nulls named rather than left blank. What exists today colours the same lines by how much of that paper actually exists. The matrix drops the picture entirely and lays the same architecture out as a table, in swim lanes, so it can sit beside Draft 1 row for row. Click an actor to isolate it, click a type below to take a whole class out.

View
All actors shown
The map scrolls sideways.
Actor types · click a type to take it out of the map, click again to bring it back Named, not established
Arrows · what moves, and what that class of data requires Identifiable PHI → BAA Limited data set → DUA Aggregate, de-identified → DUA Money or undefined, not data
Select an actor on the map to see what it creates, what it receives, and what paper it needs.
Look at the third view and count the solid green. Almost everything settled today sits on the left of the map, close to the device and the chart. Nearly everything on the right — the reporting, the dashboard, and who is allowed to see it — is dashed. The measurement half of this initiative is the half without paper, and it is the half the enrollment dates depend on.

Three  ·  Where the paper actually stands

The matrix records what each actor should have. This records what it has. The distance between those two tables is the work.

RelationshipAgreementStatusWhat is actually true
Validic → the four HCOsBAA + DUAIn placeThe draft records both as in place, with the DUA covering sharing to the Steering and implementation teams.
WHIO → participating HCOsBAAIn placeRecorded as in place with all participating HCOs. The matching DUA is still listed with a question mark on other participating HCOs.
FHG → MCWMSA + ISOWsIn placeThe commercial frame exists and predates WIN. It is not a substitute for HCO-level BAAs.
FHG → Froedtert ThedaCareNDA + BAADrafted, not sentVersion 4 went back to MCW counsel on August 26. Nothing has reached the health system itself.
FHG → Sixteenth StreetBAANot startedNothing in motion. Sixteenth Street is also marked TBD on every row of the enrollment timeline.
FHG → AscensionBAAAssumedAppears on FHG's row of the draft. There is no counterparty relationship behind it; it arrives as an assumption inside someone else's document.
FHG → Advocate AuroraBAAAssumedSame as above. Both should be confirmed or struck before the matrix is treated as settled.
WCHQ → participating HCOsBAA + WIN DUAOpenThe draft asks for both. WCHQ does not feed the WIN dashboard. It provides statewide views of the metrics across all its member organizations, de-identified by HCO, to inform the spread of WIN. Whether that needs WIN paper of its own is open.
FHG → ValidicSub-BAA?OpenReadings are to populate Epic and FHG. Whether that second destination needs paper of its own, or sits under each HCO's BAA, has never been decided.
WISHIN → participating HCOsSub-BAAProposedNot on the draft at all, and it moves identifiable data across organizations every night. Our proposed path is a subcontractor BAA entered on behalf of WIN.
Each HCO → MCW / AHWDUAMissing from the draftThe agreement that actually governs research use of the data, and it is on nobody's row. It names the permitted purpose and the permitted audience, including whether the Steering Team sees results.
YMCA of Milwaukee??UnansweredThe draft carries two question marks. The Community Navigators will hold limited patient data, so the answer is not none.
Wisconsin Women's Health Foundation—BlankBoth cells empty. The same work, the same data, no proposal at all.
All partnersNDAProposedRaised in the draft's preamble as a confidentiality layer over everything else. Nothing circulated yet.

Four  ·  Current state, desired future state, and what is left

Splitting the same map three ways is the device that made the earlier work land. It separates arguing about the destination from arguing about the next step, and it shrinks a frightening list into a short one.

Current state
  • Validic holds BAAs and DUAs with the four health care organizations.
  • WHIO holds BAAs with participating HCOs and already returns state-level claims measures.
  • FHG holds a master agreement with MCW and has delivered under it.
  • The HIE feed is live and refreshes nightly, independent of any WIN-specific agreement.
Desired future state
  • Every actor that touches identifiable data holds a BAA with each HCO whose data it touches.
  • Each health care organization holds a DUA with AHW naming the permitted purpose and the permitted audience, including whether the Steering Team sees results. The vendors in between hold BAAs, not DUAs.
  • The Community Navigators have agreements of their own rather than a question mark.
  • Each vendor-to-vendor hop is named, and each one either has a subcontractor BAA or a written null.
  • One confidentiality layer over the whole partnership.
To be completed
  • Send the Froedtert ThedaCare paper that has been sitting in draft since August.
  • Start Sixteenth Street, where nothing is in motion.
  • Confirm or strike Ascension and Advocate Aurora.
  • Decide what the Community Navigators sign.
  • Answer whether the readings reaching FHG need their own paper.
  • Write the HCO-to-AHW DUA and settle the audience question inside it — the draft asks that three times, on three vendor rows where it cannot be answered.
One move unblocks several of these. A master agreement can be executed at $0.00 purely to put the commercial frame in place, so the privacy paper has something to hang from and no one has to price the relationship first. That is exactly the move made in the earlier collaboration below, and it is the reason its paperwork closed while the money was still open.

Five  ·  The gaps, named as the draft names them

These are not criticisms of the draft. They are the specific places it asks for help, reproduced faithfully so they can be closed rather than rediscovered.

Does a DUA reach the Steering Team? Answerable.

The same parenthetical sits on three vendor rows. It cannot be answered there, because those vendors are not DUA parties. The permitted audience is a term of the DUA between each health care organization and AHW. Write it once, there.

one answer closes all three
Is WHIO a conduit too?

WCHQ is settled: it is not on the path to the WIN dashboard. It provides its own statewide view, de-identified by organization, to inform the spread of WIN. WHIO is still open. It holds an all-payor claims database of its own, so it may be a data owner in its own right rather than a pass-through. Not assumed either way here.

WCHQ answered  /  WHIO open
The Community Navigators have no path

One is two question marks; the other is blank. Both will hold limited patient data for the same work, and there are further tracking layers inside the HCOs themselves.

YMCA: ??  /  WWHF: (empty)
Two health systems appear without a relationship

Ascension and Advocate Aurora sit on the analytics row. Neither is a counterparty today. Either they are joining and the paper should start, or the row should be corrected.

confirm or strike
The second destination for device readings

Readings populate the clinical record and the measurement platform. The first hop is covered. The second has never been written down either way.

sub-BAA, ride the HCO BAA, or null
Which organizations count as participating

Three rows say “all participating HCOs” and one row lists four by name. Those are different sets unless someone says they are the same.

define the set once
A named actor with no row

The data and reporting subgroup names an organization that appears nowhere in the matrix and nowhere in this Project. It is on the map as undefined rather than omitted.

establish what it does, then give it a row or a null

Six  ·  Where this method comes from

The structure above is not invented for WIN. It is the shape of a set of documents built in 2025 to walk a national medical association, a device-data company and FHG through the same problem. Reading them in date order shows a method maturing: the teaching gets shorter, the placeholders get replaced by real names, and the question shifts from what is the architecture to what is left to sign.

May 6–7, 2025
Generic architecture
15 panels · 5 actors

Actors introduced one at a time, then agreements overlaid one actor at a time, then the money as its own pass. Health systems are placeholders. The payor is a category, not a company.

The device worth stealingEdges are labelled TBD (probably null) and TBD (potentially null) — uncertainty and absence written down as findings instead of left blank.
June 27, 2025
A real payor, and a path removed
7 panels · distribution dropped

Collapses from fifteen panels to seven. The market-education opening is gone; a named health plan replaces the placeholder and gets its own money pass. The intermediary distribution route is dropped from the architecture entirely.

What it provesThe teaching panels were scaffolding. Once the audience understood the architecture, only the agreements and the money were left.
July 30, 2025
A real provider, reorganized by state
9 panels · 4 actors + 1 future

A named health system replaces the placeholder. The payor drops out of the live set and returns as one potential future actor. The panels reorganize from per-actor to current state → desired future state → to be completed, and the closing panel reframes the device company as data acquisition rather than distribution.

The figureOne number appears on the whole map: a master agreement at $0.00. It sits in current state and in the future state, and it is absent from the to-be-completed panel — because putting the frame in place at zero dollars is what took it off the list.
What that lineage says to WIN. Draft 1 of the matrix is at the May stage: the right actors, the right agreements, and placeholders standing where relationships have not been confirmed. The useful next move is the July one. Stop asking each actor what it needs in the abstract, split the same picture into what exists, what is wanted, and what is left, and put a zero-dollar frame under the relationships that are stuck on commercial terms rather than on privacy.