Data reuse in healthcare

The EU experience

The Regulation on the European Health Data Space (EHDS) was adopted in January¹ 2025. There are 2 categories of health data:

1. For primary use - the use of patient data by healthcare providers in the delivery of services.

2. For secondary use - use of health data by third parties for research, statistics, etc.

For each category, the Regulation defines lists of data types and rules for accessing them and provides for the establishment of two digital platforms for accessing such data: MyHealth@EU for the first category and HealthData@EU for the second one.

The regulation provides patients with additional data management tools beyond those² provided for in the GDPR:

1) The patient's right to refuse to allow healthcare institutions to continue to use health data that has already been collected. For example, a patient may request to stop storing data on his/her test results - the grounds for such a request are not limited.

2) The right to restrict access to collected data. For example, a hospital may use data only when there is an emergency - in the event of a pandemic.

3) The right to manage health data accessing and downloading data in machinereadable format, transferring data to another healthcare provider's system, receiving notifications about access to their data, etc.

It also provides for States to establish a system of “trusted data holders” that take over the storage, processing and provision of health data upon request. For example, if a patient comes to a new health center, their health data can be requested from a trusted holder without having to re-collect data from the patient. The goal of the new institution is to eliminate duplication of data in the information systems of hospitals and other institutions by making it the responsibility of one person to store patient data for use by different institutions.

Secondary use data includes 17 categories of data, such as electronic health data, data on expenditures for medical services, etc. There is a closed list of purposes for which access to such data may be granted: statistical research, educational purposes, scientific research (medical, technological), etc.

The New York experience

(USA)

Two bills have been introduced to regulate health information.

The first bill sets out the conditions for³ processing health-related data, including any financial or geolocation information related to physical or mental health. In other words, both health data directly and information related to this area of a person's life, such as what medications they purchase, where, how often, etc., are protected.

In the US, personal data holders are assumed to be able to sell it unless the data subject expressly prohibits its sale. However, health information is recognized as the most sensitive one for patients, so the bill proposes an explicit prohibition on the sale of such data. The bill also provides patients with the right to manage certain types of data, for example, to consent to data processing not in relation to all data but only certain data, or to withdraw consent in relation to individual data operations rather than the whole data processing.

The consent form may (but does not necessarily) include the price of the company's processing of the data, that allows companies to be compensated for the costs of processing the data. In view of the prohibition on commercialization of data. It may also specify the forms of compensation that a data processor can receive for data operations.

The second bill deals with the privacy of data collected by electronic health products, services and devices. The bill obliges the provider of devices that collect health-related data to provide detailed information about data processing. For example, the provider must obtain permission to share the data with third parties and inform the user about to whom the data will be transferred. In this way, the draft law restricts the uncontrolled dissemination of health-related data collected from medical devices (including their commercialization).

The OECD experience

The OECD has released the⁴ Telemedicine Development Report. In 2019 (before the pandemic), there was an average of 0.6 telemedicine consultations per person per year; in 2021, there were already 1.4. Analysis of healthcare data showed that online consultations do not increase the workload of first aid departments, which means that the growth of telemedicine does not overburden the healthcare system. In the aftermath of the COVID-19 pandemic, a number of countries have taken steps to develop online health services and improve health-related data management. In case of Australia the government not only collects data on health⁵ services provided through public insurance but also assigns distinctive identifiers to compare data from different sources or categories of subjects. For example, data on indigenous peoples, data on residents of residential care homes for the elderly, etc., are not included in the data on health services. Such information is not included in health data, however, classification of data according to such criteria is necessary for health research.

The WEF experience

The WEF presented the Digital Health Transformation Initiative, which aims to expand health data collection and sharing practices to more than 150 organizations, in a report on data⁶ collaboration. Initiative participants will share data such as medical records, health-related behavioral and social indicators, insurance claims data, health monitoring data, and more.

Sharing such data will have a positive impact on innovation and the healthcare system. For example, data sharing will increase early detection of diseases (especially in the diagnosis of diabetes and cardiovascular disease, which account for 20 million deaths annually), develop predictive analysis of pandemics or morbidity, and support the spread of preventive medicine.

Russia’s experience

There is a general trend in the world to develop rules for handling health data: on the one hand, in terms of accessibility of such data for research (as in the EU), and on the other hand, in terms of protection of such data from uncoordinated circulation (as in the USA). In Russia, the agenda for the development of conditions for handling such data has not been outlined. As a consequence, the economic and innovative potential of medical data collected in Russia is not realized to full extent, for example, there are difficulties in transferring health-related data for medical research.

From the monitoring issue No. 1 (13), January 2025. Download the full issue (PDF) · issue page at the Gaidar Institute