6. Data without borders: Boosting knowledge and innovation

Jillian Oderkirk, Martin Wenzl and Luke Slawomirski

Sharing data and information across borders for the advancement of human health has taken place for a long time. With the proliferation of electronic health data, cross-border collaboration is necessary as it is increasingly clear that research breakthroughs will require large, high quality datasets that describe a range of determinants of health and disease. Challenges to cross-border collaboration and sharing of health data for research and health system performance improvement include data localisation laws and policies; data security threats that discourage data sharing; lack of global standards for data content and interoperability; and commodification and sale of health data on a world market. Some countries and institutions, such as the European Union, are making significant investments in health information infrastructure, health data governance and other steps to overcome these challenges. However, broader international collaboration is needed to coordinate and unite a global effort to address challenges.

    

6.1. Introduction

To meet emerging challenges of an aging population, changing disease patterns, increasingly complex health care needs and to use scarce resources efficiently, health systems need to fundamentally transform the way they use the data available to them. This Report shows that more effective use of digital technology and electronic data can help improve the delivery of health care, make health policy more effective, improve health system governance, ensure that resource allocation is based on needs and help inform citizens and patients so that they can contribute more actively to their own health and their care. Re-purposing data can also catalyse the development of new biomedical technology and allow stakeholders to unlock knowledge about the performance of technology, so that it can be used to its best effect. All of this can contribute to improving population health and achieve other policy objectives.

However, no single country should expect to have sufficient data to continue advancing medical research and scientific progress alone. The more we know about human health and disease, the more we are aware of the underlying complexity and the more specific research questions become. This increases the value of analysing datasets that are both broad and deep.

Countries already have a history of cross-border collaboration for improving health care and health. This illustrates what is possible when data are shared. With the pace of advances in digital technology, collaboration across countries to pool data and resources is becoming not only more essential but also more possible. Only cross-border collaboration can realise the potential of the unprecedented capacity for storage and processing of data for the purposes of advancing scientific knowledge, increasing the accuracy of diagnoses and the effectiveness of treatments, as well as improving policies that benefit patients and societies. The need for collaboration is already evident for rare health conditions, for complex diseases such as Alzheimer’s disease, and for types of data whose size and complexity are already appreciated, such as genomic data.

The value of datasets that are pooled across national borders is greater than the sum of their constituent parts. This is because combining datasets increases sample sizes, which yield greater statistical power and increase the ability of research to detect rare events. Pooling of data also makes datasets richer, allowing comparative research to explore the reasons for variation between sub-groups of populations, regardless of how these are defined and stratified. For example, breast cancer is no longer considered a single condition but rather a category with more than a dozen forms, each differing from the others by genetic and hormonal factors that will respond differently to treatment options. In addition, larger-scale collaboration allows for a more concerted approach to ensuring data security and can provide greater resilience against increasingly globalised security threats.

Data therefore need to be freed up for use and re-use not only within, but also across countries. However, it is not sufficient to only make data accessible. For data to support research and the advancement of knowledge effectively, they also have to be valid and comparable, requiring adherence to shared data standards and definitions. Finally, sharing of data across borders also requires collaboration in data governance, to ensure that people’s privacy is protected. International collaboration is essential to manage the security risks associated with growing data commodification and evolving technology. A collective effort, and the sharing of knowledge and technology, are far more effective and efficient than a bespoke approach within jurisdictions.

This chapter examines the history of cross-border collaboration for the improvement of health and health care and biomedical research and innovation. The focus is on the regions of the world where cross-border projects are taking place, primarily within Europe and among a small sub-set of countries outside of Europe. The Chapter discusses recent investments by governments in health information and research infrastructure for cross-country collaborative work, and the policy environment for cross-border data exchange. It discusses the main challenges countries are currently grappling with, such as data localisation, security risks, data commoditisation and interoperability. Finally, the Chapter concludes with making a case for harmonisation toward a common health data governance framework and shared health data standards. The final section also outlines next steps supporting cross-country collaboration for improved health care quality, performance and research and innovation.

6.2. Cross-border collaboration using health data has a rich and fruitful history

The possibility – and the benefits – of sharing data, information and knowledge across jurisdictions for the advancement of human health have been demonstrated for a long time. The scope ranges from sharing general health system information to specific clinical areas, most notably cancer. Multi-country collaboration has yielded strong dividends. Consequently, institutions such as the European Union are working toward a common health information infrastructure across its member states.

6.2.1. International sharing and use of data have promoted learning and improvement

High quality, comparable data and statistics enable continued advancement in the biological sciences, support public transparency about health and health care, identify areas for policy action and support policy evaluation. They are essential for research as well as good governance. The OECD, the World Health Organisation (WHO), the World Bank and other international organisations have, for decades, compared health and health care across the regions of the world. The breadth of the investments in harmonising global health-related data is too wide to document here, but a few examples illustrate the priority governments and health system leaders place in this vital work.

• Comparable health data published by the OECD contribute to regularly published indicators of health status, health risk factors, health service utilisation, health care quality, pharmaceutical markets, and health expenditures and financing (OECD, 2019[1])

• WHO Global Health Observatory publishes annual comparable statistics on a wide range of topics related to the health status of populations, including communicable diseases, non-communicable diseases and injuries, immunisation, health personnel, reproductive health, health risk behaviours and environmental health risks (WHO, 2019[2]).

• The Institute for Health Metrics and Evaluation (IHME), an independent global health research organisation, publishes the Global Burden of Disease periodically to report on the state of health in countries and world regions regarding mortality and disability from diseases, injuries and health risk factors (IHME, 2019[3]).

• The World Bank publishes annual statistics on health and nutrition for countries across the world that contribute to monitoring poverty reduction, including indicators of communicable diseases, non-communicable diseases and injuries, reproductive health, health status, health risk factors, immunisation, health service use and health expenditures (WorldBank, 2019[4]).

• The Commonwealth Fund, a private foundation in the United States, conducts surveys and publishes comparable indicators to support health system performance. It regularly surveys adults and older adults in multiple countries regarding health care utilisation, experiences and outcomes and it has surveyed primary care physicians in multiple countries about care coordination and preparedness to care for key patient populations (CWF, 2019[5]).

6.2.2. International reporting of cancer indicators began 50 years ago

Perhaps in no other disease area have countries invested and benefited from cross-country collaboration more than in cancer. Here, international measurement and reporting has existed for over 50 years.

The International Agency for Research on Cancer (IARC) was launched in 1965 and publishes comparable indicators of cancer incidence and mortality (IARC, 2019[6]). In 2012, the IARC Global Cancer Observatory provided incidence, mortality and prevalence indicators for major cancer types from cancer registry data within 184 countries (IARC, 2019[7]). The IARC also has a biobank holding biological samples from 560 000 individuals. The majority of these are from the European Prospective Investigation into Cancer and Nutrition (EPIC), which collected biological samples as well as diet and lifestyle factors from 370 000 people in 10 European Countries from 1992 to 1999.

The CONCORD project has expanded the global surveillance of cancer to estimates of survival. The project comprises a series of global studies. The third study involved 71 countries over the period 2000 to 2014, presenting indicators of five-year net survival for 18 cancer groupings representing about 75% of all cancers (CONCORD, 2019[8]).

Several efforts in Europe are developing indicators related to cancer. These include the European Cancer Information System (ECIS) providing indicators of cancer incidence, mortality and survival, and the EUROCARE study which provides indicators of five-year relative survival (ECIS, 2019[9]) (EUROCARE, 2019[10]). The RARECAREnet study, using data from EUROCARE-5, reported comparable indicators of cancer incidence, prevalence and survival of rare types of cancer (RARECARENET, 2019[11]).

6.2.3. Multi-country collaborations have yielded dividends

In 2005, the Nordic Council of Ministers, including Denmark, Finland, Iceland, Norway and Sweden, established NordForsk to strengthen Nordic research across scientific domains including a Nordic Programme on Health and Welfare (NordForsk, 2019[12]). The Programme aims to increase public health and welfare in the Nordic countries through multi-disciplinary research. The collaboration supports competitive applications from Nordic researchers for European scientific advancement.

All of this is underpinned by investment in high quality information infrastructure, including the harmonisation of the population-based registries and biobanks of the participating countries to enable their data to be linked for analysis.

By pooling their nations’ data, researchers from Nordic countries have benefitted from larger sample sizes. Examples include using data from Denmark, Norway Sweden (and the Haute-Garonne district in France) to study the effects of exposure to antiviral drugs used to prevent and treat influenza during pregnancy on neonatal outcomes and congenital malformations (Graner et al., 2017[13]). Pooling of data was essential to achieve a sample of 5 800 patients over a two-year period.

Another example involved pooling data from health registries in Demark, Finland, Norway and Sweden with data from the UK Clinical Practice Research Datalink to create a multi-national sample to study cancer incidence among new insulin users (But et al., 2017[14]). Data pooling resulted in 21 000 cases of cancer that could be studied over a follow-up period of about 5 years and enabled examining risk of developing ten types of cancer.

Data from registries in Denmark, Finland, Iceland, Norway and Sweden were combined to study the effects of anti-depressant medications in early pregnancy on birth defects (Furu et al., 2015[15]). The study used data from 1996 to 2010 that yielded over 36 000 live births to women exposed to the medications. Among these births were a cohort of 2 800 siblings where one birth involved exposure to the medication and the other did not. The sibling cohort enabled examination of the potential influence of lifestyle and familial factors on the results.

Australia and Canada collaborated to produce comparable profiles of opioid use and harms in both countries. The goals of the collaboration were to learn about the differences and similarities between the countries through the exploration of five different types of opioid harm: accidental and intentional poisoning, opioid dependence, adverse reaction to opioids and other types of harm. The project was a parallel study, with analysts in each country aiming to follow common methods and share findings (AIHW, 2018[16]; CIHI, 2018[17]).

6.2.4. Global projects are establishing an international research infrastructure

The global biomedical research community has been making progress in promoting the cross-border exchange of health data for scientific research. While it is impossible to describe all of the global bio-medical research initiatives here, the following examples from the fields of genomic research, rare disease research and brain research illustrate the breadth and focus of this work.

The largest internationally collaborative bio-medical research project was the Human Genome Project (NIH, 2019[18]). Led by the US National Institutes of Health (NIH), the project plan was released in 1990 and by 2003 the project had published the full human genome sequence. The sequence constitutes the instructions for the development and functioning of a human being and forms the basis upon which we can explore genetic factors leading to health and to disease. The genetic data used in the study came from a small number of consenting individuals whose identities have been protected. The sequencing of the genome was conducted at numerous universities and research centres throughout the United States, the United Kingdom, France, Germany, Japan and China.

The International Rare Diseases Research Collaboration has established Taskforces to promote the sharing of and management of data across borders in a range of intersecting areas: developing data terminology standards, fostering the sharing of data mining tools, automating accessibility of patient consent information across datasets and creating model patient consent clauses that are valid across jurisdictions. A joint Taskforce with the Global Alliance for Genomics and Health (GA4GH) is developing a policy for participant-specific identifiers that enable the linkage of datasets while protecting data subjects’ identities (IRDIRC, 2019[19]).

Research into the brain is an area where global collaboration to share data and infrastructure is particularly important. Understanding brain function and disease is highly complex and many countries have made large investments in brain research, which could be made more efficient and more productive with greater collaboration. The International Neuro-informatics Coordinating Facility (INCF) supports brain research through the promotion of neuro-informatics and by advancing data reuse and reproducibility, two areas that have been recognised as needing improvement (INCF, 2019[20]). INCF collaborates with the International Brain Initiative, which is developing closer ties among brain research initiatives in Europe and in countries including Australia, Japan, Korea, Israel, and the United States. The aim is to promote research collaboration, data sharing and sharing of research infrastructure (Yuste and Bargmann, 2017[21]). The INCF also collaborates with the Neurodata Without Borders Initiative which focuses on international standardisation of neuroscience data and removing obstacles to data exchange (NWB, 2019[22]).

6.2.5. The European Union is developing a common health data infrastructure to promote data sharing across member states

The EU is making significant investments in elements of a pan-European information infrastructure to drive better biomedical research, health system surveillance and clinical information exchange, and improve patients’ access to quality care and their care experience. Work is underway in areas such as data infrastructure for health system performance monitoring and research, infrastructure for clinician collaboration in patient treatment decisions and research, and data and infrastructure for biomedical and genomic research.

Ensuring data quality and accessibility to advance shared policy objectives

A Joint Action on Health Information (InfAct) was launched in 2018, aiming to consolidate and progress previous EU investments to develop a sustainable health information infrastructure: the European Research Infrastructure Consortium (ERIC) on Health Information. The goal is to generate policy-relevant knowledge regarding health and health system performance (INFACT, 2019[23]). The Joint Action includes twenty-nine participating countries that work toward addressing challenges in the variability of health information quality, completeness, accessibility and comparability across countries and to improve health information governance and sustainability. InfAct aims to:

• prioritise addressing information inequalities across countries;

• improve the education and training of data analysts;

• develop a web-based health information platform (ECHI);

• develop health and health care quality indicators involving the linkage and merging of data related to health care reimbursement, hospitalisations, deaths and health and health examination survey data;

• develop a business case for ERIC; and map progress in health information interoperability, both in terms of technical interoperability and the legal and policy framework for health data governance.

InfAct builds on the EU-Bridge project (2015 to 2017), which consolidated several initiatives that aimed to improve health information infrastructure to enable inter alia population health and health system monitoring, indicator development, assessing environmental impact on health, disease registries, and clinical and administrative health data collection systems. The EU-Bridge Project demonstrated the value of multi-country research involving the linkage of hospital data to other health care datasets across the health care pathway and the pooling of hospital datasets to enable new insights about the quality and efficiency of care (Häkkinen et al., 2013[24]) (ECHO, 2013[25]).

The EU-funded CEPHOS Link project applied a common protocol to administrative data from national health care databases in six European countries (Austria, Finland, Italy, Norway, Romania, Slovenia) – all with different health care systems and varying data collection methods – to estimate psychiatric rehospitalisation rates and their predictors (Katschnig et al., 2017[26]). The project involved data acquisition, management, quality, interoperability, privacy protection and linkage methods and included local and pooled data analyses, performed with statistical methods and innovative dynamic modelling approaches.

Improving access to information for clinicians is also a priority. European Reference Networks (ERN) link health care providers in European countries, supporting them to treat patients with rare or low-prevalence complex diseases (Commission, 2019[27]). The ERN provides an ICT platform and telemedicine tools for virtual conferencing of health care providers across Europe to provide advice to a health care provider on the treatment of their consenting patient. There are 24 ERNs covering a range of disease conditions and involving specialised care units in 300 hospitals in 26 countries. Beyond supporting diagnosis and treatment decisions, ERNs aim to facilitate large-scale clinical studies of patients supporting research into new medicines, medical devices, health care models and e-Health solutions.

The EU is developing digital infrastructure for the cross-border exchange of health data. The eHealth Digital Service Infrastructure (eHDSI or eHealth DSI) facilitates data exchange among countries and includes services to exchange patient summaries and ePrescriptions (EU, 2019[28]).The aim is that by 2021, these exchange services will be available in over twenty EU countries (European Commission, 2019[29])

Large pan-European datasets are developed to bolster biomedical research

It is becoming clear that breakthroughs in biomedical research will increasingly rely on using large, high-quality datasets that describe a range of determinants of health and disease. Datasets of sufficient size can only be created by cross-border collaboration. Indeed, private pharmaceutical studies are often multi-country.

The European Union is taking steps to create an enabling infrastructure and environment. A number of European initiatives are underway to enable better research using the human genome (Box 6.1). In particular, the EU is developing a large prospective cohort of data on 10 million people by 2025 to promote research and innovation in precision medicine at the EU level. This project involves a commitment from twenty-one countries to sharing genomic and clinical data across borders.

Box 6.1. Initiatives to power up bio-medical research in the European Union

The EU is aiming for 1 million sequenced genomes by 2022 and to develop a large prospective cohort of 10 million people by 2025 (including molecular profiling, lifestyle, genomics, environment and linkage to electronic health records (EHRs)). The goal is to promote research and innovation in precision medicine and treatments for rare diseases, cancer, brain function and disease prevention on a European level. Since launching the 1+ Million Genomes Initiative in September 2018, 21 countries have signed the declaration and agreed to cooperate in sharing genomic data across borders (Commission, 2019[30]). Success in this ambitious initiative will rely on a technical infrastructure throughout the Union that:

• enables secure, federated access to genomic data;

• ensures that legal requirements for data protection and ethical implications of research are clear and taken into account;

• keeps the public and policy makers updated about progress in genomics; and

• ensures that results are translated into improved care.

The EU is also developing a resource for European-wide and multi-country research involving human biological samples and bio-molecular resources and associated clinical and research data referred to as BBMRI-ERIC (Biobanking and Biomolecular Resources Research Infrastructure – European Research Infrastructure Consortium) (BBMRI-ERIC, 2019[31]). BBMRI-ERIC aims to provide expertise and services to its members to facilitate access to the resources and collections of members. Seventeen countries, most with multiple participating biobanks, are participating: Austria, Belgium, Bulgaria, Czech Republic, Estonia, Finland, France, Germany, Greece, Italy, Latvia, Malta, Netherlands, Norway, Poland, Sweden and United Kingdom.

The Adopt BBMRI-ERIC project, supported by an EU Horizon 2020 grant, fosters participation in BBMRI-ERIC and includes a demonstration case study to develop a research infrastructure for colorectal cancer (BBMRI-ERIC, 2019[32]). The study aims to collect 10 000 colorectal cancer datasets from twelve countries for research to improve the treatment of this disease. The colorectal cancer research dataset will become a permanent asset of BBMRI-ERIC. Datasets for research into other chronic conditions are envisaged and the procedures and IT tools developed for the colorectal cancer cohort aim to be re-useable for the study of other diseases.

ELIXIR is a European Intergovernmental Organisation involving 20 countries that is helping them to manage the huge increase in life sciences data, particularly data related to DNA and RNA sequencing (ELIXIR, 2019[33]). The life sciences data includes data for humans, as well as other organisms. ELIXIR offers a computer platform that is a network of supercomputing services to improve storing, transferring and analysing huge datasets. A data platform provides markers of dataset quality and an interoperability platform is standardising the way data are saved and described. ELIXIR provides researchers with tools and training to work with large and complex datasets.

The European Human Biomonitoring Initiative (HBM4EU) aims to harmonise procedures across countries to enable more comparable data on human exposure to chemical substances to coordinate and advance human biomonitoring in Europe (HBM4EU, 2019[34]). The project involves 28 countries, the European Environment Agency and the European Commission and is co-funded under Horizon 2020 from 2017 to 2021. The project also aims to explore the link between external exposure to chemicals via multiple routes and the aggregate internal exposure within individuals and the health outcomes associated with exposure.

6.3. Key challenges concern data localisation, security, commoditisation and interoperability

The major challenges to cross-border collaboration and sharing of health data for purposes such as research and health system performance can be distilled to four categories:

1. 1. data localisation laws and policies;

2. 2. data security threats that discourage data sharing;

3. 3. lack of global standards for data content and interoperability; and

4. 4. commodification and sale of health data on a world market.

This fourth challenge of data commodification, or a health data ‘gold rush’, is in many ways a direct result of the first three. Many countries have laws and policies that prevent health data from being shared for multi-country research and these restrictions are at least partly due to concerns about data security protections for multi-country studies. Even among countries where data can be shared for multi-country studies, the data are not standardised to consistent global standards for content or exchange. As a result, private-sector actors that acquire treasure troves of patient health data can develop profitable businesses cleaning and prepping data for research use and then licensing access to them. This emergence of health data vendors raises ethical concerns and calls for a globally coordinated response.

6.3.1. Data localisation laws and policies can limit cross-border sharing

Many countries are still in the process of developing national health data governance frameworks that enable data within the country to be amalgamated, linked and analysed and include mechanisms for national researchers to access data securely but also practicably. While these initiatives are important priorities, countries developing such frameworks should consider whether existing or planned legislations and policies may, expressly or inadvertently, entrench data localisation – a major barrier to cross-border collaboration.

In some OECD countries, data localisation regimes either explicitly forbid health data processors from approving the sharing of data with an organisation located outside of their country or create obstacles such as a lack of clarity about how data sharing outside of the border might be approved. Existing regimes can also result in processes to obtain approval that would be prohibitive in terms of time and resources. In federated countries, laws and policies within states, provinces or regions may entrench data localisation at a national level.

In a 2019 OECD survey on health data governance, countries were asked if de-identified data from ten key national health datasets may be shared with approved researchers working in a foreign academic or non-profit research organisation. All datasets examined were national in scope and contained personal data (i.e. records of individuals). Seven countries, Australia, Belgium, Canada, Denmark, Norway, Singapore and Slovenia, reported that de-identified data could be shared from six or more key national health datasets for approved research work (Table 6.1).

Australia noted that while such sharing is possible, no instances of such sharing are known in practice. Australian researchers who demonstrate that their work has been approved by the appropriate ethics committee should be able to access de-identified data securely. However, approval processes can be complex and lengthy in order to ensure that the use of the data would be secure and appropriate. This may be a barrier to accessing and using these data.

Canada reported that such sharing is possible at the national level but only if it is not prohibited by provincial law or by the terms of data sharing agreements with data suppliers. Germany also indicated that due to a federal structure, state data protection laws and laws governing hospitals may prohibit data sharing with foreign entities within, and outside of, national borders.1 This illustrates how the harmonisation of policy frameworks within countries is critical.

Table 6.1. Foreign academic and non-profit researchers may be approved access to de-identified personal health in some countries
Potential for access approval for 10 national personal health datasets, by country, 2019
Country	Hospital in-patient data	Mental hospital in-patient data	Emergency health care data	Primary care data	Prescription medicines data	Cancer registry data	Diabetes registry data	Cardio-vascular disease registry data	Mortality data	Formal long-term care data
Australia	Yes1	Yes1	Yes1	Yes1	Yes1	Yes1	Yes1	n.a.	Yes1	Yes1
Belgium	Yes	Yes	Yes	Yes	Yes2	Yes	Yes	n.a.	n.a.	n.a.
Canada	Yes3	Yes3	Yes3	n.r.	No	Yes	n.a.	n.a.	Yes	Yes3
Czech Republic	No	No	No	n.a.	No	No	No	No	No	n.a.
Denmark5	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	n.a.
Germany	Yes	n.a.	n.a.	n.a.	No	Yes	n.a.	n.a.	n.a.	n.a.
Ireland	n.r.	n.r.	n.r.	n.a.	n.r.	n.r.	n.a.	n.a.	n.r.	n.r.
Israel	No	No	No	No	n.a.	No	No	n.a.	No	No
Japan	No	No	No	No	No	No	n.a.	n.a.	No	No
Korea	No	No	No	No	No	No	No	n.a.	No	No
Latvia	No	No	No	No	No	Yes	Yes	n.a.	Yes	n.a.
Luxembourg	Yes4	Yes4	n.a.	No	No	Yes	n.a.	n.a.	Yes	No
Netherlands	d.k.	d.k.	n.r.	Yes	d.k.	Yes	n.a.	n.r.	Yes	Yes
Norway	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Singapore	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Slovenia	Yes	Yes	Yes	Yes	Yes	Yes	n.a.	n.a.	Yes	n.a.
Sweden	No	No	No	No	No	No	No	No	No	No
United Kingdom (Scotland)	No	No	No	No	No	No	No	n.a.	No	No
n.a. Not Applicable; n.r. Not Reported; d.k. Unknown
← 1. Potentially but we are unaware of any cases.
← 2. Data without risk of re-identification.
← 3. Except where prohibited by law or agreement.
← 4. Only the dataset of the National Health Insurance and the Directorate of Health may be shared.
← 5. Researchers not based in Denmark may obtain access to data from the national health registries provided they collaborate with a Danish research and analysis environment
Source: OECD (2019[35]), “Survey on health data governance: preliminary results”.

Cancer registry data are the national data that are the most likely to be shared internationally. Eleven of eighteen countries reported that they could share de-identified national cancer registry data with approved foreign researchers in academic and non-profit organisations. Along with the rich history of international cancer research collaboration (outlined earlier), this reflects the success of creating a policy and legislative environment that enables relevant data to be available for research. It also illustrates that it is eminently possible to free up personal health data for secondary uses with the requisite political will and coordination of effort.

In some countries, however, no key national health data can be shared. Five countries, the Czech Republic, Ireland, Korea, Sweden and the United Kingdom (Scotland), would not approve sharing de-identified data from any of the thirteen key national health datasets with a foreign researcher in the academic or non-profit sectors. Privacy policies in Israel limit approval of data sharing outside of the country, but mechanisms exist to permit sharing under agreed conditions. The preference is to provide access to information.

Under the European General Data Protection Regulation (GDPR), which entered into force on 25 May 2018 and protects the personal data of residents of the European Economic Area (EEA), de-identified microdata may still be considered personal data and be subject to the same levels of protection. Ensuring that GDPR requirements are met was noted in the 2019 survey as a barrier to data sharing by Germany and the Netherlands. Belgium reported that the lack of a policy on health data sharing with foreign non-profit researchers is a barrier.

6.3.2. Emerging technologies pose data security threats that call for collaborating on innovative solutions

Health care data have a high economic value (see Section 6.3.3), raising the risk of security breaches and attacks. Concerns about data breach and re-identification risks limit health data sharing within and across borders due to concerns with preserving data security when data are, for example, uploaded to a cloud. While the concerns are certainly legitimate and need to be managed proactively, they need to be approached in the context of the benefits foregone by prohibiting secondary uses of personal health data,

Nevertheless, an environment that aims to foster cross-border projects requires on-going international collaboration to develop shared approaches to data security protection that prevent and address emerging threats. While emerging threats related to technological advancement could harm individual countries whether they engage in multi-country collaborative projects or not, the desire to collaborate should stimulate joint investment and collaboration in threat detection and response.

A United States-based law firm providing global services annually compiles information on data security among the clients that it represents, shedding light on data security threats (BakerHostetler, 2019[36]). The firm reported involvement with over 750 data breaches in 2018, 25% of which were within health care organisations including pharmaceutical and biotechnology companies. The most common types of breach were phishing attacks (37%) and network security hacks (30%). Phishing attacks most often involved an email or message that tricked individuals into providing log-in information then used to access the data. Network intrusions occurred most often when servers were internet accessible and unsecured and when devices with file transfer protocols or remote desktops were unsecured. Other reasons for data breaches included inadvertent disclosure (12%), lost or stolen records and devices (10%) and system misconfiguration (4%).

While these data security challenges are already daunting, new risks are appearing on the horizon. For example, any scaling up in the availability and use of quantum computers enables breaking the public key cryptography that the world uses now for data security for secure banking transactions, websites and web transactions (see Section 6.4.3).

6.3.3. The data ‘gold rush’ raises ethical concerns

The monetisation of health data by private sector actors is an area of ethical concern and is increasingly global in scope. Private firms develop or acquire access to patients’ health care data through acquisition of health care organisations or electronic medical record (EMR) software providers. Becoming the health care data custodian, firms may use the data directly for development of products or monetise the data by licensing access to other users, such as pharmaceutical companies and software applications developers. Often the data involved are from records created through publicly-funded service provision, and yet somehow become privately held goods.

For example, one of the most long-standing health data vendors was IMS Health, a United States-based company that bought data about individual patients from pharmacies, EMR software systems, and health insurance providers. IMS merged with Quintiles in 2016 to form IQVIA. IQVIA indicates that it can provide clients with access to data on 600 million patients from 100 countries from sources as wide ranging as EMRs, insurance claims, pharmacies, labs, medical images, genomics datasets, and social media (IQVIA, 2019[37]).

Flat Iron Health provides an illustrative example of how a private company can access and sell patient data. Flat Iron Health is an oncology focussed EMR software vendor based in the United States. Through the software, Flat Iron accesses patients’ medical data from health care providers and administrators within 200 Cancer Centres (Flat Iron Health, 2019[38]; Forbes, 2018[39]). Flat Iron data customers are pharmaceutical companies who purchase licences to access the data. Roche Pharmaceuticals acquired Flat Iron in 2018 and will access the data to identify and recruit patients to clinical trials and to facilitate access to clinical data for trial participants (Forbes, 2018[40]).

IBM has also acquired a considerable trove of patient data through acquisitions of companies in the custody of data. For example, it purchased Truven Health in 2016, adding 200 million patient records to its holdings of 100 million records (Fortune, 2016[41]). Truven offered health care data management and analytics services and reported over 8500 clients including hospitals, insurance companies and data from US and state agencies.

Patient-level health data have thus been commodified and present attractive potential profits. Unsurprisingly, technology companies, such as Google, Amazon, Microsoft, Apple and Facebook, have announced significant investments and acquisitions to gain access to health data. These range from offering smartphone Apps for people to aggregate and store their patient records, to offering health care to employees and mining their data, to acquiring and investing in health data aggregators, health social media and genomics companies, to artificial intelligence and data mining services (Computer World, 2019[42]; Businesswire, 2018[43]; Healthcare Weekly, 2019[44]).

The commodification of data raises concerns. These include whether patients’ legal rights regarding the use and management of their data are adequate and enforceable, whether data generated from public investment in health care provision are serving the public interest when they are commodified and sold to those who can afford it. Another question concerns whether trust in governments and health care providers will be eroded by the commercialisation of patients’ personal data.

6.3.4. Lack of common standards and interoperability raises risks and limits potential for collaboration

A contributing factor towards this health data gold rush is the lack of standards for health data content and data exchange, although there is work in progress on public data standards (see Section 6.4.2). This situation has created opportunities for firms to clean, harmonise and link data to produce proprietary patient-level information suitable for clinical research. With shared global standards (or mapping to shared standards) data could be more easily brought together within and among countries for approved initiatives.

The lack of common data terminology and exchange standards also creates barriers to and inefficiencies in sharing and diffusing data-driven technologies, such as software tools, apps and algorithms, among health care organisations within countries and certainly across countries.

Effectively, the bespoke approach that has often been taken to health data development causes health organisations, systems and countries to continually re-invent the wheel and is a major barrier to applying data toward modernising health care organisations, advancing research and personalising and improving health care experiences for patients.

Standards developed by the World Health Organisation have so far been diffused most widely. The WHO has, for example, developed and diffused the global standard for diagnosis coding, the International Classification of Diseases (ICD), since the creation of the WHO in 1948. The eleventh revision of this standard was developed to better suit digital health records and it will be used for national and international reporting beginning in 2022 (WHO, 2019[45]). The WHO is developing an International Classification of Health Interventions (ICHI) that will include interventions across a wide spectrum of health care including diagnostic, medical, surgical, mental health, primary care, allied health, functioning support and public health interventions (WHO, 2019[46]). The WHO also maintains the International Classification of Functioning, Disability and Health (ICF) which measures health and disability (WHO, 2019[47]) and the Anatomical Therapeutic Chemical (ATC) classification for coding of medicines (WHO, 2019[48]).

Medical terminologies that complement the WHO family of classifications are also emerging. For example, SNOMED CT codifies health and care issues with a high level of detail and enables exchange of data and subsequent cross-border research, using data entered as part of the primary workflow in health and care services. Medical terminologies are complementary to the WHO classifications in their potential to identify conditions that normally would be coded as "Not elsewhere classified" or "Not elsewhere specified". This is an important feature supporting the research use of data, particularly clinical research.

Another characteristic of SNOMED CT is its underlying ontology. An ontology means that each clinical idea has a set of relations that can be used for analytics. Big Data analytics can use these relations and other mechanisms for data mining and other forms of analytics. SNOMED CT is developed and licensed by SNOMED International, a not-for-profit organization owned by its members.

However, alignment to common data standards is weak among OECD countries as has been shown in a 2016 study of electronic health system development, data use and governance (Oderkirk, 2017[49]). In 2016, countries reported variable use of WHO and other global data standards for key elements within electronic clinical records. Further, twenty countries reported that the data content standards used differed among regions and health care organisations within their countries.

Global standards are also lacking for important elements within clinical records, such as standards for contextual information for patients about demographic and socio-economic characteristics, health and risk behaviours, family history and community support, and patient preferences and experiences – all of which are increasingly relevant data in the context of changing epidemiological trends. Standards and methods are further needed to extract key information for research uses from data that are left uncoded in text-based clinical notes inside patients’ records.

6.4. Strong governance, common data standards and a collaborative approach to data security is needed

The benefits and opportunities of sharing health data across borders in advancing global health and health system performance are clear. However, a number of technical and policy challenges stand in the way of enabling a productive global ecosystem for health data. Overcoming these challenges requires a co-ordinated global effort to set the right policy, governance and regulatory frameworks within and across countries. The key factors are ensuring common data standards and exchange formats that enable efficient sharing of various types of health data, and working together to maximise the security of personal health data and minimise the risks of privacy breaches in the face of constantly evolving threats. All of this can be achieved and a number of noteworthy initiatives are under way. But greater global co-operation is needed.

6.4.1. Appropriate regulations enable the secure and productive sharing of health data across borders

Strong governance and regulation are now accepted as foundational requirements to putting data to work – within and between countries – in a secure and ethical way. The EU is the most advanced region to promote the sharing of health data across national borders while continuing to protect privacy. The aforementioned European GDPR places personal health data in a special category with the highest standards of protection. Compliance requires that personal health data are very well organised and portable (EU, 2019[50]). For example, organisations must have data systems that allow them to fulfil individuals’ rights to access their own personal data, to rectify or restrict their processing, and to request data portability from one organisation to another; as well as to assure data are correctly categorised and to demonstrate compliance with the regulation.

Several positive consequences of the GDPR include that health data systems will become more digitised, more useable, harmonised from one country to another, more accessible to patients and better secured. Thus, there is a potential that this better data would foster EU-wide research and statistics. A more harmonised approach to data protection within the EEA through the GDPR will enhance EU-wide collaboration in health information development and use.

The GDPR also sets out clear requirements for the sharing of data between members of the EEA and non-EEA countries and international organisations. Such sharing is possible where the non-EEA country or international organisation provides a level of data protection that is considered adequate vis-à-vis the protection provided under the GDPR. Countries are further supported in determining adequacy through guidelines being developed by the European Data Protection Board (EDPB), which includes representatives from the data protection authorities of each EU/EEA member state (EU, 2019[51]).

Importantly, the EU has also established a policy framework to support the sharing of health data across borders. This includes work toward a fully interoperable EHRs for diagnosis, treatment as well as research and disease prevention, and policies promoting effective sharing of genomic datasets to advance scientific discovery and precision medicine (EU, 2019[52]). For example, the EU is aligning health data sharing with investments in high performance computing and an open science cloud to develop predictive approaches to treatment based on simulation and AI.

Beyond Europe, the aforementioned GA4GH is developing policy frameworks and technical standards to enable cross-country research projects involving the sharing of genomic and clinical data within a human rights framework, which ensures research ethics, data privacy protection, regulatory compliance and data security (GA4GH, 2019[53]). GA4GH has a current initiative providing information briefs for understanding and meeting the requirements of the EU Data Protection Regulation. Members of GA4GH include universities, hospitals, health care organisations, research institutes, and life sciences and IT companies within 71 countries.

At the country level, the United Kingdom has made progress to improve the sharing and use of health data among its countries (England, Scotland, Wales and Northern Ireland), through initiatives led by the Farr Institute and, more recently, Health Data Research UK (HDRUK, 2019[54]). Both projects promote collaboration among UK countries for secure analysis of health care, genomic, clinical and biological data by identifying and removing obstacles to collaboration in health data projects due to unnecessary differences in health data governance, such as cumbersome approval processes and data access mechanisms. The Health Data Research UK project supports UK members in engaging in joint research in artificial intelligence with the Alan Turing Institute in order to achieve breakthroughs in the diagnosis of chronic diseases.

Governments need to develop the right legal and regulatory frameworks that protect individuals and the public interest

Concerns regarding individual rights to privacy and the growing commodification of health data were outlined above. These need to be managed in a proactive and transparent manner through strong regulation and governance. The EU GDPR offers strong protection for personal health data. Under the GDPR, patient data where direct identifiers have been removed, such as names and health and social insurance numbers, may still be considered personal health data and be subject to protection. This could allow patients in EU countries to exercise rights over their personal data held by private companies, such as rights to access, rectify and restrict data uses. Further, the GDPR would limit data uses to those authorised by patient consent or by law.

Other privacy law in OECD countries may exempt data that has been de-identified from legal protection, and it is in those situations that patient-level data is most easily commodified and marketed.

However, provisions of all privacy law permit data uses with patient consent which raises issues of the adequacy of the consent process. For example, patients may have little alternative to consenting to third party uses of data, when consent is a prerequisite for accessing a needed product or service. This includes participation in social media platforms, accessing smartphone apps to acquire and share your own electronic medical records, genetic analysis of ancestry, lowering insurance premiums by using health monitoring devices, or accessing better or lower cost health care provider through an employer.

The onus is on governments to take stock of the risks and opportunities of secondary data use (within and across borders), and develop the legal and regulatory frameworks as well as incentives to protect individuals while allowing innovation and the development of new treatments and services in the public interest. As the risks are increasingly global in scope, it is increasingly necessary to harmonise toward common legal frameworks and standards.

The OECD Council Recommendation on Health Data Governance sets out the framework conditions within which countries can harmonise toward a more common approaches to both protecting health data privacy and advancing health policy objectives by fostering research and evidence (OECD, 2019[55]).

The Recommendation calls on countries to support cross-border collaboration in the processing of personal health data for health system management, research, statistics and other health-related purposes that serve the public interest. This includes identifying and removing barriers to effective cross-border collaboration in the processing of personal health data; and facilitating the compatibility and interoperability of health data governance frameworks so that cross-country collaboration is possible. It also includes a call for governments to engage with relevant experts and organisations to developing mechanisms to enable the efficient exchange and interoperability of health data including setting standards for data exchange and terminology, while ensuring – both individually and collectively – that privacy is protected and data remain secure (OECD, 2019[55]).

6.4.2. Common global health data standards are needed

Solving interoperability problems involves promoting the widespread adoption of public global standards and also filling important gaps in standards. A range of commendable initiatives are currently in play, some of which are outlined below.

A study by a team of scientists advising the United States government on weaknesses in health care interoperability in the United States recommended overcoming gaps by using a public Application Programming Interface (API) based on Fast Healthcare Interoperability Resources (FHIR) (AHRQ, 2014[56]). An API is a software that acts as an intermediary or translator enabling two different software applications to talk to each other (send and receive information). FHIR is a draft standard describing data formats and elements for exchanging electronic health records. The standard was created by the Health Level Seven International health-care standards organization (HL7). SMART on FHIR is an open, standards-based platform for medical apps that breaks down existing barriers for electronic health record systems to be able to benefit from existing medical apps (Smart, 2019[57]). FHIR standards may reference existing terminologies, classifications and coding standards, such as ICD or SNOMED.

Several global interoperability initiatives exist. LOINC, for example, is a standard for coding laboratory data maintained by members within the non-profit research community (LOINC, 2019[58]) and Health Level 7 International (HL7) which is a non-profit entity with a global membership developing standards for the exchange and sharing of electronic health information (HL7, 2019[59]).2

The private sector is also active in this space. The Argonaut Project, an initiative that ran from 2014 to 2018, involved a consortium of health technology companies and health care organisations in the United States, which developed FHIR implementation guidelines for use cases identified as high priorities for patients, providers and industry (HL7 FHIR, 2018[60]). The work included guidelines for data query for individual patients including a common clinical dataset, integrating apps into EHR records, provider directories, scheduling health care appointments, access to text-based clinical notes, accessing clinical data for a roster of patients (dataset creation), and integration of simple questionnaires into EHRs. Another initiative is the Da Vinci project (Box 6.2).

Both the Argonaut and DaVinci projects address the interoperability challenges within the United States where these are particularly acute due to a fragmented landscape of health care provision and reimbursement. Nonetheless, the guidelines help to establish standards that may have broad international applicability and could support objectives of greater global interoperability of health care data.

In Europe, the GO FAIR Initiative, funded by the Ministries of Science in the Netherlands, Germany and France, promotes the practical international application of FAIR principles (FAIR, 2019[61]). FAIR guiding principles standardise the management and stewardship of digital data so that they may be re-used for future research. The four FAIR principles are findability, accessibility, interoperability and reusability. FAIR principles are increasingly required as part of publicly funding scientific grants (Wilkinson, 2016[62]) (Wilkinson et al., 2016[63]).

An implementation network of the GO FAIR Initiative is a consortium of academic centres and private sector companies who are developing secure data accessibility technology called the Personal Health Train. This is a technology enabling data custodians, such as health care providers, health authorities, researchers, governments, and individuals to enable access to and use of the data within their custody by third parties without having data ever leave the custodian. Data queries are submitted over secure data tracks, mobile workflows using virtual machines, connecting the stations (data custodians). Stations set the rules upon which data access is permitted or restricted. Personal Health Trains are developing in Netherlands, Germany and Switzerland (GOFAIR, 2019[64]).

The European Health Data and Evidence Network (EHDEN) is a private and public sector shared investment in developing an approach to standardising a wide range of health data in Europe (administrative, clinical, and patient-reported outcomes data). It aims to create a common data model to facilitate health statistics, monitoring and research undertaken by governments, universities and private sector entities, such as for pharmaceutical research (EHDEN, 2019[65]).

EHDEN is the new flagship project of the EU Innovative Medicines Initiative (IMI2) planned from 2018 to 2024. The IMI is a public-private partnership with funding from the public sector through an EU Horizon 20/20 research grant and the private sector through the European Federation of Pharmaceutical Industries and Associations (EFPIA). EHDEN is mapping a diversity of clinical, administrative and other health data including patient-reported outcome measures to a common data model permitting cross country medical research and research into outcomes-based health care. EHDEN is a federated network of data custodians and data sources across the EU and aims to map 100 million health records within its first mandate.

Work is also underway among the International Consortium for Health Outcomes Measurement (ICHOM), Intermountain Healthcare in the US and the Ministry of Health in the Netherlands, to facilitate the interoperability of patient-reported outcome measures and the implementation of standardised outcomes measurement in clinical workflows. The objective is to develop a ‘common language’ of health outcomes that will ensure that the semantic meaning of outcome data is preserved as data are interpreted across different technical platforms. This interoperability will facilitate global benchmarking of patient-reported outcomes.

However, an emerging – and unintended – risk is that the multitude of initiatives will actually exacerbate the challenge they are trying to solve. The work that has taken place to date needs to be consolidated, and countries should agree and gather consensus on standards for the growing range of data relevant to health that can and should be shared across borders to advance local and global health policy objectives. This effort needs to be coordinated globally and to involve a range of stakeholders in data development and use in both the public and private sectors. An international organisation such as the WHO or the OECD could facilitate this needed collaborative work.

Box 6.2. The DaVinci Project

The DaVinci project is a private sector initiative involving health IT professionals and health care industry leaders who are developing FHIR implementation guides (IG) for health care payers and providers to enable appropriate clinical data sharing and metrics for data sharing between payers and providers in support of value-based health care (HL7 International, 2019[66]). Payers, health systems, and other industry participants identify use cases involving clinical and administrative health data sharing. The objective is to minimize the development and deployment of hundreds of customised solutions between payers and providers by developing national standards, implementation guides and reference implementations to promote interoperability among all payers and providers. The project began in January 2018 and includes, for example, the following key components:

1. 1. Proof of 30-day medication reconciliation post hospital discharge. An important quality of care metric increasingly required for value-based payment incentives in the United States. Developing implementation guides for this indicator involves sharing data at multiple levels: from the inpatient discharge records, discharge medications list, the exchange of the discharge medications list with the responsible provider, such as a primary care provider, and inclusion of the list within the responsible provider’s electronic medical record (EMR), to reconciliation of all medications and an attestation of reconciliation.

2. 2. Exchange of clinical data (CDex). Exchanges of clinical data from EHRs about patients’ prior, current or planned health care services are necessary to more effectively manage patient care. These exchanges may be among providers, between providers and payers, or between providers, payers, and a third party, such as quality management organisations involved in value-based care. Implementation guides are being developed and tested to standardise the method and formal representation of these exchanges.

3. 3. Gaps in care and information. Implementation guides are being developed for two types of gaps that affect patient outcomes and value-based health care: First, disparities between claims and clinical records that make it hard to tell if best care practices have been followed. Such as missing A1C test results for diabetes patients, or prescription of insulin to a patient missing a diagnosis of diabetes. Secondly, incomplete health care information, such as a referral for cancer treatment that is missing the date of diagnosis and stage at diagnosis will affect care coordination. The guide aims to enable bi-directional, real-time FHIR-based communication that reconciles payer information with clinical EHR data.

4. 4. Chronic Illness Documentation for Risk Adjustment. Exploratory work toward potential guidelines is underway. Guidelines would enable payers and providers to use a standard protocol for exchanging information about chronic illnesses and a common terminology to describe chronic illnesses in order to exchange and use this information for risk adjustment and health care quality indicators.

5. 5. Patient Cost Transparency. Exploratory work is underway for guidelines that support providers and patients access in real time, through the EHR system, to view the costs of prescription medicines, medical devices and medical services from payers so that this information could be taken into account during conversations related to medical care.

6. 6. Laboratory results. Exploratory work is underway toward guidelines that would enable exchange of information about lab results. These guidelines are particularly challenging due to the high number of laboratories and wide array of laboratory tests in the US.

6.4.3. Data security in the digital era is greatly enhanced by global collaboration

Concerns about data breach and re-identification risks limit health data sharing within and across borders. Recommendations for reducing risk of data breaches and cyber-attacks included training staff about data security and phishing risks and implementing two-factor authentication for staff access to systems. It is also essential to have good cyber security around all the points of access to data, such as internet accessible servers and protocols for file transfers and remote data access.

New forms of encryption are being used that can protect data in transit between authorised parties and while they are within a cloud. In particular, a technique called Homomorphic Encryption can allow data held in a cloud to be analysed without first being decrypted. This technique has been tested to allow clinical sites to share aggregated data with multiple researchers at other sites without potential exposure to hacking by untrusted third parties (Raisaro et al., 2018[67]). The technique has also been tested and found able to be used in analysis predicting 30 day hospital readmissions from data within EHR systems (Chou et al., 2018[68]).

Emerging risks, such as quantum computing, also need to be addressed collaboratively. Research by governments in the United States and United Kingdom has sought to find a solution for quantum computers breaking public key cryptography (NSA, 2016[69]; Campbell, Groves and Shepherd, 2014[70]). It is possible to combine quantum devices with classical computers to enhance security and, in the longer term, to use quantum computers to offer greater security than classical computers can provide (Wallden and Kashefi, 2019[71]).

A technique called lattice cryptography, where data are encrypted inside mathematical lattices, has been developed by IBM and may be unbreakable, even with quantum computers while still being efficient when compared with public key cryptography. This technique is a form of fully homomorphic encryption and therefore it can be used to perform analysis on an encrypted file without first decrypting the data. As quantum computing will become increasingly used over the next decade, moving toward encryption solutions that work today and that will be future proof is worth exploring (Lyubashevsky, 2016[72]).

International cooperation is absolutely essential to harness the value of emerging technologies and techniques in order to foster a safe and productive data sharing environment. Implementing harmonised governance frameworks as set out in the OECD Council Recommendation calls on countries to maximise the potential and promote the development of technology as a means of enabling the availability, re-use and analysis of personal health data while, at the same time, protecting privacy and security and facilitating individuals’ control of the uses of their own data ( (OECD, 2019, p. Section III.8[55]). Security threats are increasingly global in scope, and global cooperation toward risk mitigation would be mutually beneficial.

6.5. Conclusion

Cross-country collaborations involving sharing health data contribute to research, innovation and to improving health and health care. Changing disease patterns, scientific advances and knowledge of the complexity of disease make the pooling of data and sharing of information across countries more important than ever. Digital technology has created the technical basis to do so. However, risks are also evolving. Countries need to work together to lay the essential groundwork for governance of multi-country projects involving health data and for investment in infrastructure for multi-country initiatives, including in the quality and standardisation of key health data and in data security.

International collaboration on specific topics and diseases has a rich and fruitful history. A growing number of governments and international organisations are investing in health information and research infrastructure for cross-country data exchange and collaborative work. This requires an enabling policy environment that addresses the challenges outlined in this Chapter, including threats to data security and impacts upon health systems of the commodification of patient health data. Collaboration is needed to develop harmonised approaches to health data governance, including protection of patient privacy and data security, and to invest together in standards to improve health data content and interoperability for high priority research and statistical work in the public interest. Only such cooperation will create the environment that is necessary for discovery and innovation to address complex health problems that are global in scope.

The OECD Council Recommendation on Health Data Governance calls on countries to identify and remove barriers to effective cross-border cooperation in the processing of personal health data (OECD, 2019[55]). To support countries in this work, the OECD could serve as a coordinator for a global effort to address challenges that limit cross-border collaboration in research and monitoring with health data. In particular, OECD can support the development of global standards for data content and exchange, support global collaboration for the identification and response to data security threats, and foster a harmonised approach to health data governance to facilitate multi-country projects.

The OECD will also continue to support countries through on-going monitoring of progress toward research infrastructure that is truly global in its scope, that fosters research in the public, non-profit and private sectors and that yields benefits for patients and health systems.

References

[56] AHRQ (2014), A Robust Health Data Infrastructure, AHRQ, http://www.ahrq.gov.

[16] AIHW (2018), Opioid harm in Australia and comparisons between Australia and Canada, AIHW, http://www.aihw.gov.au.

[36] BakerHostetler (2019), Managing Enterprise Risks in a Digital World, Baker Hostetler, US, https://f.datasrvr.com/fr1/419/17257/2019_BakerHostetler_DSIR_Final.pdf?cbcachex=990603.

[32] BBMRI-ERIC (2019), Adopt BBMRI-ERIC: Colorectal Cancer Cohort, http://www.bbmri-eric.eu/scientific-collaboration/colorectal-cancer-cohort/ (accessed on 11 July 2019).

[31] BBMRI-ERIC (2019), BBMRI-ERIC, http://www.bbmri-eric.eu/ (accessed on 11 July 2019).

[43] Businesswire (2018), Amazon, Berkshire Hathaway and JPMorgan Chase and Co. to Partner on US Employee Healthcare, Businesswire, https://www.businesswire.com/news/home/20180130005676/en/Amazon-Berkshire-Hathaway-JPMorgan-Chase-partner-U.S.

[14] But, A. et al. (2017), “Cancer risk among insulin users: comparing analogues with human insulin in the CARING five-country cohort study”, Diabetologia, https://doi.org/10.1007/s00125-017-4312-5.

[70] Campbell, P., M. Groves and D. Shepherd (2014), Soliloquy: A cautionary tale, CESG, Cheltenham, UK, https://docbox.etsi.org/workshop/2014/201410_CRYPTO/S07_Systems_and_Attacks/S07_Groves_Annex.pdf.

[68] Chou, E. et al. (2018), A Fully Private Pipeline for Deep Learning on Electronic Health Records.

[17] CIHI (2018), Types of Opioid Harms in Canadian Hospitals: Comparing Canada and Australia, CIHI, Toronto, https://www.cihi.ca/sites/default/files/document/types-opioids-harm-report-can-aus-nov2018-en-web.pdf.

[30] Commission, E. (2019), European 1+ Million Genomes Initiative, https://ec.europa.eu/digital-single-market/en/european-1-million-genomes-initiative.

[27] Commission, E. (2019), European Reference Networks, https://ec.europa.eu/health/ern_en (accessed on 11 July 2019).

[42] Computer World (2019), Q and A: Christiana Care Health CIO talks up Apple’s Health Record App, https://www.computerworld.com/article/3365242/qa-chistina-care-health-cio-talks-up-apples-health-record-app.html (accessed on 11 July 2019).

[8] CONCORD (2019), CONCORD - Global Surveillance of Cancer Survival, https://csg.lshtm.ac.uk/research/themes/concord-programme/ (accessed on 11 July 2019).

[5] CWF (2019), Surveys, https://www.commonwealthfund.org/publications/surveys (accessed on 11 July 2019).

[25] ECHO (2013), European Collaboration for Healthcare Optimisation, http://echo-health.eu/ (accessed on 11 July 2019).

[9] ECIS (2019), European Cancer Information System, https://ecis.jrc.ec.europa.eu/ (accessed on 11 July 2019).

[65] EHDEN (2019), European Health Data and Evidence Network, https://www.ehden.eu/ (accessed on 11 July 2019).

[33] ELIXIR (2019), ELIXIR, https://www.elixir-europe.org/about-us (accessed on 11 July 2019).

[28] EU (2019), eHDSI Mission, https://ec.europa.eu/cefdigital/wiki/display/EHOPERATIONS/eHDSI+Mission (accessed on 10 October 2019).

[50] EU (2019), EU General Data Protection Regulation, https://gdpr-info.eu/ (accessed on 11 July 2019).

[51] EU (2019), European Data Protection Board, https://edpb.europa.eu/ (accessed on 11 July 2019).

[52] EU (2019), Transformation of Health and Care in the Digital Single Market, https://ec.europa.eu/digital-single-market/en/european-policy-ehealth (accessed on 11 July 2019).

[10] EUROCARE (2019), EUROCARE - Survival of Cancer Patients In Europe, http://www.eurocare.it/ (accessed on 11 July 2019).

[29] European Commission (2019), Electronic Cross-border Health Services, https://ec.europa.eu/health/ehealth/electronic_crossborder_healthservices_en.

[61] FAIR (2019), GO FAIR Initative, https://www.go-fair.org/go-fair-initiative/ (accessed on 11 July 2019).

[38] Flat Iron Health (2019), Flat Iron Health, https://flatiron.com/.

[39] Forbes (2018), Flatiron health acquisition a shot in the arm for roches oncology real world evidence needs, https://www.forbes.com/sites/reenitadas/2018/02/26/flatiron-health-acquisition-a-shot-in-the-arm-for-roches-oncology-real-world-evidence-needs/#75219f1e3f60.

[40] Forbes (2018), The Deeply Human Core of Roches 2-1b Tech Acquisition and Why They Did It, https://www.forbes.com/sites/davidshaywitz/2018/02/18/the-deeply-human-core-of-roches-2-1b-tech-acquisition-and-why-they-did-it/#2ea1e55429c2.

[41] Fortune (2016), Why IBM Is Dropping $2.6 Billion on Truven Health, https://fortune.com/2016/02/18/ibm-truven-health-acquisition/.

[15] Furu, K. et al. (2015), “Selective serotonin reuptake inhibitors and venlafaxine in early pregnancy and risk of birth defects: population based cohort study and sibling design”, BMJ, Vol. 350/apr17 3, pp. h1798-h1798, https://doi.org/10.1136/bmj.h1798.

[53] GA4GH (2019), Global Alliance for Genomics and Health,, https://www.ga4gh.org/ (accessed on 11 July 2019).

[64] GOFAIR (2019), Personal Health Train, https://www.go-fair.org/implementation-networks/overview/personal-health-train/.

[13] Graner, S. et al. (2017), “Neuraminidase inhibitors during pregnancy and risk of adverse neonatal outcomes and congenital malformations: Population based European register study”, BMJ (Online), https://doi.org/10.1136/bmj.j629.

[24] Häkkinen, U. et al. (2013), “Health care performance comparison using a disease-based approach: The EuroHOPE project”, Health Policy, https://doi.org/10.1016/j.healthpol.2013.04.013.

[34] HBM4EU (2019), European Human Biomonitoring Initiative, https://www.hbm4eu.eu/ (accessed on 11 July 2019).

[54] HDRUK (2019), Health Data Research UK, https://www.hdruk.ac.uk/ (accessed on 11 July 2019).

[44] Healthcare Weekly (2019), How the “Big 4” Tech Companies Are Leading Healthcare Innovation, https://healthcareweekly.com/how-the-big-4-tech-companies-are-leading-healthcare-innovation/.

[59] HL7 (2019), HL7, http://www.hl7.org/ (accessed on 15 July 2019).

[60] HL7 FHIR (2018), The Argonaut Project: Accelerating FHIR.

[66] HL7 International (2019), Da Vinci Project, http://www.hl7.org/about/davinci/ (accessed on 11 July 2019).

[6] IARC (2019), Cancer Incidence in Five Continents, http://ci5.iarc.fr/Default.aspx (accessed on 11 July 2019).

[7] IARC (2019), Global Cancer Observatory, https://gco.iarc.fr/ (accessed on 11 July 2019).

[3] IHME (2019), Global Burden of Disease (GBD), http://www.healthdata.org/gbd.

[20] INCF (2019), International Neuroinformatics Coordinating Facility, https://www.incf.org/ (accessed on 11 July 2019).

[23] INFACT (2019), INFACT Joint Action on Health Information, http://ec.europa.eu/chafea/news/news577.html (accessed on 11 July 2019).

[37] IQVIA (2019), IQVIA Core, https://www.iqvia.com/about-us/iqvia-core.

[19] IRDIRC (2019), International Rare Diseases Research Consortium, http://www.irdirc.org/irdirc-goals-2017-2027-new-rare-disease-research-goals-for-the-next-decade/ (accessed on 11 July 2019).

[26] Katschnig, H. et al. (2017), Comparative Effectiveness Research on Psychiatric HOSpitalisation by record LINKage of large administrative data sets in six European countries Final Scientific Report for Objectives 1, 2 and 3, THL, Helsinki, https://thl.fi/documents/189940/2732416/CEPHOS-LINK+final+scientific+report+2017-03-31+export.pdf/6f206810-5919-415c-82a1-884795732186.

[58] LOINC (2019), LOINC, https://loinc.org/about/ (accessed on 15 July 2019).

[72] Lyubashevsky, V. (2016), Preparing for the Next Era of Computing With Quantum-Safe Cryptography, https://securityintelligence.com/preparing-next-era-computing-quantum-safe-cryptography/.

[18] NIH (2019), Human Genome Project, https://www.genome.gov/human-genome-project/ (accessed on 11 July 2019).

[12] NordForsk (2019), Nordic Programme on Health and Welfare., https://www.nordforsk.org/en/programmes-and-projects/programmes/nordisk-program-om-helse-og-velferd (accessed on 11 July 2019).

[69] NSA (2016), Commercial National Security Algorithm Suite and Quantum Computing FAQ 2, National Security Agency Information Assurance Directorate, Washington DC, US, https://doi.org/MFQU/OO/815099-15.

[22] NWB (2019), Neurodata Without Borders, https://www.nwb.org/.

[49] Oderkirk, J. (2017), “Readiness of electronic health record systems to contribute to national health information and research”, OECD Health Working Papers, No. 99, OECD Publishing, Paris, https://dx.doi.org/10.1787/9e296bf3-en.

[1] OECD (2019), Health Statistics, http://www.oecd.org/health/health-statistics.htm (accessed on 11 July 2019).

[55] OECD (2019), Recommendation of the Council on Health Data Governance, OECD Publishing, Paris, https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0433.

[35] OECD (2019), Survey on health data governance: preliminary results.

[67] Raisaro, J. et al. (2018), “Feasibility of Homomorphic Encryption for Sharing I2B2 Aggregate-Level Data in the Cloud.”, AMIA Joint Summits on Translational Science proceedings. AMIA Joint Summits on Translational Science.

[11] RARECARENET (2019), Information Network on Rare Cancers, http://www.rarecarenet.eu/ (accessed on 11 July 2019).

[57] Smart (2019), Smart - An App Platform for Health Care, https://smarthealthit.org/ (accessed on 12 July 2019).

[71] Wallden, P. and E. Kashefi (2019), “Cyber security in the quantum era”, Communications of the ACM, https://doi.org/10.1145/3241037.

[48] WHO (2019), ATC, https://www.who.int/medicines/regulation/medicines-safety/toolkit_atc/en/ (accessed on 15 July 2019).

[45] WHO (2019), ICD-11, https://icd.who.int/en/ (accessed on 15 July 2019).

[47] WHO (2019), International Classification of Functioning, Disability and Health (ICF), https://www.who.int/classifications/icf/en/ (accessed on 15 July 2019).

[46] WHO (2019), International Classification of Health Interventions (ICHI), https://www.who.int/classifications/ichi/en/.

[2] WHO (2019), World Health Statistics, http://www.who.int/gho/publications/world_health_statistics/en/.

[62] Wilkinson, M. (2016), “FAIR guiding principles”, Nature, https://doi.org/10.1038/sdata.2016.18.

[63] Wilkinson, M. et al. (2016), “Comment: The FAIR Guiding Principles for scientific data management and stewardship”, Scientific Data, https://doi.org/10.1038/sdata.2016.18.

[4] WorldBank (2019), Health, Nutrition and Population, http://datatopics.worldbank.org/health/ (accessed on 11 July 2019).

[21] Yuste, R. and C. Bargmann (2017), Toward a Global BRAIN Initiative, https://doi.org/10.1016/j.cell.2017.02.023.

Notes

← 1. These entities may be in another country or in a different Federal State of the German Republic to where the data were generated or the data subject resides.

← 2. Global health data standards also require an accompanying definition of contents. For example, FHIR has several internal, restricted value sets to define content. But more frequently FHIR references terminologies, classifications or coding standards. These may be LOINC, SNOMED CT, ICD or others. There is in fact a growing trend towards referencing internationally accepted terminologies in different data standards, like FHIR, DICOM etc. To accommodate this development SNOMED International has released the Global Patient Set (GPS) for use under a free license. The GPS aims at meeting the main need for an information content standard in FHIR data standards.