Most exchanges are in the business of exchanging health information, not storing or maintaining data from exchange participants to perform secondary actions like data mining. It's more likely you would find an organization participating in a HIE that is interested in running analytics or performing data mining on the data than the HIE providing such a service. In theory with appropriate data use agreements or other legal contracts in place, a HIE could provide such services, but in practice there are a lot of regulatory hurdles to overcome, particularly if the HIE is government-run or government-sponsored. There are provisions in HIPAA and other relevant regulations stipulating the conditions under which a covered entity or business associate can use health data for purposes that might be supported by data mining or other forms of analysis, including fraud detection, research, and even marketing, but unless the data has been de-identified (another potential service that I don't think many HIEs are able or interested to provide) then the organization wanting to do the data mining would need to obtain consent from the individuals whose data is going to be analyzed.

Most exchanges are in the business of exchanging health information, not storing or maintaining data from exchange participants to perform secondary actions like data mining. It's more likely you would find an organization participating in a HIE that is interested in running analytics or performing data mining on the data than the HIE providing such a service. In theory with appropriate data use agreements or other legal contracts in place, a HIE could provide such services, but in practice there are a lot of regulatory hurdles to overcome, particularly if the HIE is government-run or government-sponsored. There are provisions in HIPAA and other relevant regulations stipulating the conditions under which a covered entity or business associate can use health data for purposes that might be supported by data mining or other forms of analysis, including fraud detection, research, and even marketing, but unless the data has been de-identified (another potential service that I don't think many HIEs are able or interested to provide) then the organization wanting to do the data mining would need to obtain consent from the individuals whose data is going to be analyzed.