Health data governance
Running health data responsibly: data protection impact assessments, de-identification and pseudonymisation, matching records to the right patient, and reusing data for research with OMOP and the EHDS rules on secondary use.
Health data governance is how an organisation decides who may use which medical data, for what purpose and under which safeguards. Under the GDPR that means a lawful basis plus an Article 9 condition, a data protection impact assessment (DPIA) when processing is high-risk, data minimisation, pseudonymisation where possible and a record of every access. Reusing data for research or statistics follows separate rules, which the European Health Data Space adds to in the EU.
| Legal basis | GDPR Article 6 plus an Article 9 condition |
|---|---|
| Risk assessment | DPIA, GDPR Article 35 |
| Pseudonymised data | Still personal data under the GDPR; anonymised data is not |
| Identity | Patient matching and master patient index |
| Research reuse | Secondary use under the EHDS; OMOP CDM as a common research model |
How do you assess and reduce privacy risk?
How do you make sure a record belongs to the right person?
How can health data be reused for research?
- Secondary use of health data: the mapSecondary use means using health data collected for care for research, public health or planning.
- OMOP CDM explained, and how FHIR maps to itThe OMOP Common Data Model turns heterogeneous health records into one relational schema with standard vocabularies, so the same analysis runs across hospitals and countries.
For developers
Build on interoperable health data
Anpheros Platform is a FHIR R4 API for medical records, with patient consent, a free sandbox and SDKs for Dart, Flutter and TypeScript.