Costa Rica's Constitutional Chamber recent ruling on the Digital Antimicrobial Prescription Regulation should be read carefully. Not just as a ruling about a specific platform, nor merely as a win or loss for one institutional actor, but as an underlying signal: Costa Rica urgently needs to resolve how it governs, protects and interoperates people's health data.
According to public reports, through ruling 2026-015323 the Constitutional Chamber declared unconstitutional subsections l), m) and n) of Article 13 of Executive Decree 44714-S, which required recording information such as the clinical diagnosis, the date and result of swabs or cultures, and the patient's drug allergies in the electronic digital prescription form. The action was brought by Costa Rica's College of Physicians and Surgeons and the Costa Rican Chamber of Physicians and Surgeons Association, arguing that requiring this sensitive data to be recorded on a platform run by third parties violated patients' fundamental rights.
The critical point isn't whether diagnoses, allergies, lab results or clinical history should exist digitally. In health, that data is essential. Without it there's no continuity of care, no clinical traceability, no robust pharmacovigilance, no modern epidemiological surveillance, and no real interoperability. The real problem is something else: under what rules, for what purpose, on what legal basis, with what controls, by whom, for how long, and with what degree of patient control that data is handled.
Law 8968 on the Protection of Individuals with Regard to the Processing of Their Personal Data recognizes health-related data as sensitive data. But that same law shouldn't be read as an absolute ban on using clinical information. In fact, it includes exceptions when processing is necessary for prevention, medical diagnosis, healthcare, medical treatment or managing health services, always under conditions of confidentiality, legitimate purpose and duties equivalent to professional secrecy.
That's where the country's real dilemma lies: we can't build modern digital health by treating clinical data as untouchable, but we also can't treat it as just another set of mandatory fields inside a technology platform. Health data isn't the operational property of an institution, a technology vendor or a national architecture. It's highly sensitive information about people, and how it's handled must be subordinate to rights, safeguards, governance and trust.
This ruling can create uncertainty if read in isolation. It could lead public and private actors to shy away from capturing, storing or exchanging clinical data that care actually requires. But it can also be an opportunity if read correctly: the discussion shouldn't be “clinical data, yes” or “clinical data, no”; the discussion should be about consent, governance, proportionality, security, traceability, auditing and accountability.
Costa Rica already has a National Digital Health Strategy that, among its goals, calls for implementing a national health information exchange architecture that enables interoperability, standardization and data governance in line with international best practices. That strategy also recognizes areas such as standards and interoperability, regulation, compliance, data governance, digital identity and secure, patient-centered systems.
The region is also moving toward initiatives such as the Pan-American Digital Health Route, where interoperability aims to let electronic prescriptions, clinical history and other data follow the patient even across countries, to improve continuity of care and quality.
That's why the answer can't be locking data away in institutional vaults, nor letting it circulate without control. The answer has to be building a national layer of trust for handling health data.
At a minimum, that layer should include a digital health consent model, clear rules on purpose of use, robust identification of patients and professionals, access traceability, non-repudiation, auditing, interoperability standards, and mechanisms for patients to grant, limit or revoke access permissions as appropriate.
This isn't something Costa Rica has to invent from scratch. HL7 FHIR already has the Consent resource for representing health consent agreements, including conditions on who can access data, for what purpose and under what restrictions. IHE has also developed profiles such as Privacy Consent on FHIR, designed to support privacy consent and access control in FHIR-based health information exchanges.
Until we resolve this, we'll keep seeing high-risk practices: lab results sent over WhatsApp, discharge summaries shared by email without sufficient verification, screenshots containing sensitive data, clinical platforms with no clear certification, access with no effective traceability, and technology third parties handling clinical information without a framework that's understandable enough for patients, professionals and institutions.
Paradoxically, the risk often isn't in interoperating. The risk is in not interoperating well.
A country that doesn't enable secure, auditable, consented channels for sharing clinical information ends up pushing people toward informal, insecure channels instead. And that violates rights too.
The underlying question should be: how do we guarantee that every person has timely, secure access to their clinical history, without that access becoming undue exposure of their privacy?
To answer it, Costa Rica needs to move forward on a concrete agenda:
- Define a national digital health consent policy.
- Establish differentiated rules for capturing, storing, querying, exchanging, using for secondary purposes, and analyzing population-level clinical data.
- Certify or accredit digital health platforms that process sensitive data.
- Require traceability, auditing, access management and non-repudiation in systems that handle clinical information.
- Adopt international standards such as HL7 FHIR and IHE not just to exchange data, but to govern permissions, consent and privacy.
- Create a national dialogue table involving the Ministry of Health, CCSS, professional associations, the private sector, academia, technology vendors, digital law specialists, interoperability experts and, above all, patients.
The Constitutional Chamber's ruling shouldn't become a brake on digital health transformation. It should be the starting point for a more mature discussion: how to protect patients' fundamental rights without giving up the possibility of safer, more continuous, interoperable, people-centered care.
Costa Rica has the talent, the reference frameworks and the standards available to get this right. What's missing is the country-level decision to move from regulatory reaction to a real architecture of trust for health data.
Because the goal isn't for clinical data to be locked away. The goal is for it to be available when it saves lives, protected when it exposes privacy, and always governed by clear, verifiable, patient-centered rules.