Health data governance

What it is

There is no single definition. One international reference is the OECD Council Recommendation on Health Data Governance (OECD/LEGAL/0433), adopted on 13 December 2016. It recommends that governments establish and implement a national governance framework that encourages the availability and use of personal health data for health-related public interest purposes, while promoting the protection of privacy, personal health data and data security.

The OECD's twelve elements

1. Engagement of a wide range of stakeholders, including public consultation.
2. Co-ordination within government and cooperation among organisations, with common data elements and formats, quality assurance and interoperability standards.
3. Review of the capacity of public sector health data systems.
4. Clear information to individuals, including timely notification of breaches.
5. Informed consent and appropriate alternatives.
6. Review and approval procedures for uses of the data.
7. Public transparency about purposes, approval criteria and implementation of the framework.
8. Using technology to enable the use of the data while protecting privacy and facilitating individuals' control.
9. Monitoring and evaluation mechanisms.
10. Training in privacy and security.
11. Controls and safeguards: accountability, risk management, and technological, physical and organisational measures.
12. Requiring organisations to demonstrate they meet national expectations, for example through certification or accreditation.

The Recommendation also calls for supporting cross-border cooperation and compatibility between countries' governance frameworks.

Primary and secondary use

Primary use is patient care; secondary use is research, statistics or management. Some frameworks set up authorities for secondary use: the European Health Data Space makes it conditional on a permit issued by a health data access body, and Finland has had Findata, which grants such permits, since 2019.

Not to be confused with interoperability governance

In the European Interoperability Framework, interoperability governance refers to decisions on frameworks, structures, roles, policies and agreements to ensure interoperability. Data governance answers a different question: who uses which data, for what and with what safeguards. In practice they support each other.

Common misconceptions

• Reducing it to data protection compliance. The OECD frames it as enabling public interest uses, not only as restricting them.
• Treating it as an IT topic. OECD elements such as engagement (1), review and approval procedures (6), transparency (7) and training (10) are not technical.
• Assuming consent is the only basis. The OECD expects alternatives and safeguards where processing is not based on consent.
• Leaving it for later. The OECD's 2022 Report to Council notes that many Adherents are still working toward implementation.