In health we have already solved much of technical and semantic interoperability: HL7 FHIR, SNOMED CT and LOINC are no longer the bottleneck. What remains broken is the organizational layer of the European Interoperability Framework (EIF): who shares what, with whom, for what purpose and according to whose wishes. As long as that layer does not exist as a national agreement, every institution signs agreements one by one, and the patient, without ever asking for it, ends up as the weakest link: their consent is still signed on paper.

The EIF in brief: four layers and governance

The current EIF dates from 2017, and the European Commission is already working on its revision, which it expects to adopt in 2027 (LexisNexis, 2026). It brings together 12 principles and 47 recommendations around a layered model (Interoperable Europe Portal):

  • Legal: rules should enable exchange rather than block it.
  • Organizational: how institutions align processes, responsibilities and expectations to achieve common goals, with the user at the center (ISA²).
  • Semantic: data should mean the same thing at the source and at the destination.
  • Technical: systems should connect securely and reliably.

Above all four, the EIF places interoperability governance and integrated public service governance. In health, the eHealth Network adapted the model as the ReEIF, which splits the organizational layer into two levels: policy and care processes.

A detail that is often overlooked: EIF recommendation 26 calls for interoperability agreements at every layer, not only the technical one. In other words, the framework itself recognizes that without explicit organizational agreements there is no sustainable interoperability.

Why the organizational layer is the weakest

The organizational layer is the weakest because it is the only one you cannot download from a repository. The technical and semantic layers have global communities (HL7, IHE, SNOMED International, Regenstrief) that publish reusable artifacts; the organizational layer depends on local decisions, roles and responsibilities that nobody can standardize for us.

The four EIF layers in health. Technical, high maturity: HL7 FHIR, IHE, OAuth 2.0 / SMART on FHIR and X-Road. Semantic, medium-high: SNOMED CT, LOINC, ICD-10, WHODrug, MedDRA and national FHIR guides. Legal, medium: data protection laws, interoperability decrees and digital signature. Organizational, low: bilateral agreements, paper forms and ad hoc arrangements; it is the weakest link. Maturity is Meddyg's reading.
The four EIF layers in health. Technical, high maturity: HL7 FHIR, IHE, OAuth 2.0 / SMART on FHIR and X-Road. Semantic, medium-high: SNOMED CT, LOINC, ICD-10, WHODrug, MedDRA and national FHIR guides. Legal, medium: data protection laws, interoperability decrees and digital signature. Organizational, low: bilateral agreements, paper forms and ad hoc arrangements; it is the weakest link. Maturity is Meddyg's reading.

This is not a problem unique to our region. When it launched the EIF review in 2026, the European Commission itself acknowledged that interoperability implementation remains uneven across Member States and that public administrations lack practical guidance (LexisNexis, 2026).

There is also a common confusion: believing that a regulation solves the organizational layer. The legal layer says what is allowed; the organizational layer defines how it is done every day: who is the producer, custodian and consumer of the data, what service levels are committed to, who is accountable when an incident occurs and how the patient's wishes are recorded.

The symptom: one agreement for every pair of institutions

Without a common organizational framework, every exchange needs its own agreement. The arithmetic is unforgiving: for n institutions to all interoperate with each other, n(n − 1) / 2 bilateral agreements are needed.

With 5 institutions that is 10 agreements; with 20 it is 190; with 50 it reaches 1,225. Each one with its own drafting, its own round of legal review, its own signing deadlines, its own renewals and its own consent form.

The 2010 EIF already warned about this: interoperability is multilateral by nature and is best understood as a shared value of a community (EIF v2). A bilateral agreement solves one case; it does not build a system. In practice, this means:

  • The technical connection exists, but data does not flow until the paperwork is signed.
  • Every agreement redefines purposes, responsibilities and access rules; nothing is reused.
  • Small clinics, laboratories and practices are left out, because they lack the legal capacity to negotiate dozens of agreements.
  • A patient treated in three places is subject to three different sets of rules about their own data.
With five institutions, the mesh requires 10 bilateral agreements and leaves the patient outside the network, with their wishes on paper at each site; with a common framework and a consent manager, 5 accessions are enough and the patient decides only once. With 20 institutions it is 190 agreements versus 20 accessions; with 50, 1,225 versus 50.
With five institutions, the mesh requires 10 bilateral agreements and leaves the patient outside the network, with their wishes on paper at each site; with a common framework and a consent manager, 5 accessions are enough and the patient decides only once. With 20 institutions it is 190 agreements versus 20 accessions; with 50, 1,225 versus 50.

The patient: the weakest link without having chosen to be

The patient is today the weakest link in interoperability, and not because of anything they did. They are the one who gains the most when their data flows and, at the same time, the only actor without a digital channel to say yes, no or only for this.

What we see every day:

  • Consent is signed on paper, at the front desk, on the day of care, and stays filed wherever it was signed.
  • That paper does not travel with the data: whoever receives the information cannot verify on the spot what the patient authorized.
  • Revoking is harder than consenting, because the patient would have to go back to every place where they signed.
  • In an emergency, with no prior wishes available to check, the clinician chooses between not accessing the data or accessing it without leaving a trace.

Because there is no automated way to check the patient's wishes, institutions replace them with one-to-one agreements. The agreement ends up deciding for the patient what the patient was never able to express in due time and form.

The most striking part is that the law does not require paper. In Costa Rica, article 5 of Law 8968 requires consent to be given in writing, but accepts both physical and electronic documents, and allows it to be revoked the same way (Law 8968). With digital signature available since Law 8454, the obstacle is neither legal nor technical: it is organizational.

The result is a paradox. We have FHIR to move a laboratory result in milliseconds, but the authorization to move it takes weeks and lives in a filing cabinet.

What it looks like when the organizational layer does exist

Where the problem has been solved, consent stopped being a clause in each agreement and became a shared service, governed by a multilateral agreement. Three pieces make it possible.

Consent as data, not as a document. The FHIR Consent resource expresses who authorizes, whom, for what purpose, over which data and for how long. That way, a policy decision point can evaluate it at the moment of each request. IHE has already defined the actors to record, store and query it in its Privacy Consent on FHIR (PCF) profile. We explain it in more detail in consent management.

The Netherlands: a national registry and a system of agreements. With Mitz, the patient records their preferences once for all care sectors. Mitz does not expose the consents: it answers permit or deny to a closed question about who is requesting, about which patient and from what type of custodian (Generic Functions IG). What is decisive is not the technology but the afsprakenstelsel: a framework of agreements that each participant joins once. Even the conflict rules are agreed, for example, that an objection prevails over an equally specific consent. The model has also been criticized for its centralization and its granularity, which confirms that these are organizational decisions, not technical ones.

European Union: the patient's wishes as an actionable right. The European Health Data Space (EHDS) Regulation requires Member States to offer free electronic services so that people can exercise their rights. Among them: restricting professionals' access to all or part of their data and, where the State so provides, opting out of the exchange in a reversible way (Ringholm, EHDS).

AspectPaper consent (today)Consent as a service
Where it livesIn each institution's filesIn a registry every participant can query
Who checks itNobody, at the time of the exchangeThe system, on every request
RevocationGoing back to every place where it was signedA single action, effective for everyone
EmergenciesAccess without traceability, or no accessAgreed and audited emergency access rules
AuditManual, if it existsA record of who accessed, when and why

A proposal for Costa Rica

Costa Rica now has the legal basis: the executive decree on health interoperability, signed in October 2026, creates the National Health Interoperability Model. What is missing is turning that basis into an organizational layer that works without an agreement for every pair of institutions.

X-Road will solve secure transport and traceability of messages between institutions. But X-Road does not know whether the patient agrees; that answer has to come from the organizational layer. We propose six pieces:

  1. A multilateral accession framework. A single participation agreement that defines roles (producer, custodian, consumer), permitted purposes, service levels and responsibilities. Each institution joins once and is enabled with all the others.
  2. A national consent manager. A registry where the patient expresses, revokes and checks their wishes, modeled with FHIR Consent and the IHE PCF actors, and queried as a decision point in every exchange through the HIE: neither consumers nor custodians query it on their own.
  3. Digitally signed consent. Signing the FHIR resource with a certified digital signature (for example, with JAdES over JSON) to give it the same evidentiary value as paper, as article 5 of Law 8968 already allows.
  4. Agreed emergency access rules. A common break-the-glass protocol, with mandatory justification and later audit.
  5. A channel for the patient. A digital way to see who accessed their data, when and why, and to change their decision.
  6. Framework governance. A body that keeps the agreement alive: versions, changes, accessions and conflict resolution, as EIF recommendation 26 calls for.
How the six pieces fit together. The patient records or revokes their decision in a national consent manager (FHIR Consent, IHE PCF actors, digitally signed with JAdES). Within a multilateral accession framework, consumers, producers and custodians do not query the manager on their own: everything goes through the HIE. The consumer requests the data from the HIE with a declared purpose; the HIE asks the manager who is asking, about which patient and why; the manager answers permit or deny; if permitted, the HIE requests the data from the custodian, which returns it in HL7 FHIR, and the HIE delivers it to the consumer. X-Road provides secure, traceable transport between all of them. The patient sees who accessed, when and why. Emergencies follow agreed, audited break-the-glass access, and governance keeps the framework alive.
How the six pieces fit together. The patient records or revokes their decision in a national consent manager (FHIR Consent, IHE PCF actors, digitally signed with JAdES). Within a multilateral accession framework, consumers, producers and custodians do not query the manager on their own: everything goes through the HIE. The consumer requests the data from the HIE with a declared purpose; the HIE asks the manager who is asking, about which patient and why; the manager answers permit or deny; if permitted, the HIE requests the data from the custodian, which returns it in HL7 FHIR, and the HIE delivers it to the consumer. X-Road provides secure, traceable transport between all of them. The patient sees who accessed, when and why. Emergencies follow agreed, audited break-the-glass access, and governance keeps the framework alive.

Interoperating with the patient, not in spite of them

Health interoperability will not be unlocked by yet another technical standard; it will be unlocked when the patient's wishes become data that everyone can query. Until that happens, we will keep signing agreements one by one and filing consents on paper, with the best technology in the world waiting behind them.

At Meddyg we help producers, custodians and consumers of health data take that step: organizational maturity assessment with the EIF, design of accession frameworks, FHIR Consent profiling and digital signature integration. If your institution is preparing to join the National Health Interoperability Model, let's talk.

References