Health Data Governance for the Digital Age

1. Background

Health data are necessary to improve the quality, safety and patient-centredness of health care services, to support scientific innovation, to enable the discovery and evaluation of new treatments and to redesign and evaluate new models of health service delivery. The volume of personal health data in electronic form is already very large and is growing with technological progress including electronic health and administrative records; behavioural and environmental monitoring devices and apps; and bio-banking and genomic technologies. The scale, capabilities and methodologies of health data gathering, aggregation and analysis are also radically evolving.

When personal health data are linked and analysed, an exponential gain in information value can be attained to serve the health related public interest, such as improving diagnosis, particularly for rare diseases; identifying optimal responders to treatment and personalising care for better patient outcomes; detecting unsafe health care practices and treatments; rewarding high quality and efficient health care practices; detecting fraud and waste in the health care system; assessing the long-term effects of medical treatments; and discovering and evaluating new health care treatments and practices.

Emerging technologies including Big Data analytics, for example, can utilise enhanced computing power to process broad ranges of data in real time, that when applied to health can improve patient-care and further the discovery of disease markers and disease‑specific solutions. Emerging technologies can also support and enhance privacy and data security.

Personal health data are sensitive in nature and fostering data sharing and use increases the risk of data loss or misuse that can bring personal, social and financial harms to individuals and can diminish public trust in health care providers and governments. Appropriate reconciliation of the risks and benefits associated with health data use is necessary if the interests of both individuals and societies are to be best served. This requires transparency, an understanding of the reasonable expectations of individuals and the development of a shared view of how best to serve the public interest in both the protection of health data privacy and in the benefits to individuals and to societies from health data availability and use.

OECD Initiative to Strengthen Health Information Infrastructure

The Working Party on Health Care Quality and Outcomes (HCQO) (and its predecessor the Health Care Quality Indicators (HCQI) Expert Group) has led an OECD initiative to support countries in strengthening their health information infrastructure since 2011. The impetus for this work was a call from OECD Health Ministers that was received in October 2010 to make more effective use of health data to improve health sector performance and quality of care.

By 2013, the Health Care Quality Indicators Expert Group (HCQI) (which became in 2017 the Working Party on Health Care Quality and Outcomes) [COM/DELSA/DSTI(2016)1/REV4] had published its first report on Strengthening Health Information Infrastructure (OECD, 2013[1]). The report documented a wide variation across surveyed countries in the development and use of health data. In particular, the study found that key health datasets in countries were often held in silos by the organisations collecting them and there were uncertainties about how the potential benefits of new analytic techniques could be achieved while ensuring the implementation of existing data protection standards and procedures. The report showed that many OECD Members lacked a co‑ordinated public policy framework to guide health data use and sharing practices to protect privacy, enable efficiencies, promote quality and foster innovative research.

The report led to a follow-on study to continue monitoring progress in health information systems and to uncover and document promising health data governance practices (OECD, 2015[2]). The study, published in 2015, identified eight key health data governance mechanisms that maximise benefits to patients and to societies from the collection, linkage and analysis of health data while, at the same time, minimising risks to the privacy of patients and to the security of health data.

A second follow-on study, published in 2017, looked in-depth at the foundation of health information infrastructure, which is the development and use of data within electronic health record systems (Oderkirk, 2017[3]). The study found that countries are at very different stages of implementing and using EHRs, and that only a limited sub-group of countries have both strong technical and operational readiness to extract data from these systems for statistics and research, coupled with a health data governance framework and investments supporting data use.

The HCQO study results have been widely disseminated including within other OECD reports and academic literature exploring the development and impact of big data in societies, the development of health data governance principles, the impact of new health technologies and developing new analysis and research to advance care and treatment (Anderson and Oderkirk, 2015[4]; OECD, 2015[2]; Di Iorio, Carinci and Oderkirk, 2013[5]; Oderkirk, Ronchi and Klazinga, 2013[6]).

Development of the OECD Recommendation on Health Data Governance

The work of the OECD to support strengthening health data infrastructure and governance and to protect privacy and data security culminated in the OECD Recommendation on Health Data Governance [OECD/LEGAL/0433] (hereafter, the “Recommendation”), which provides guidance for building national governance frameworks that enable personal health data to be both protected and used towards public policy goals.

The studies described in the previous section were a catalyst for the development of the Recommendation, which was jointly developed by the Committee on Digital Economy Policy (CDEP) and the Health Committee (HC) with the advice of their respective relevant subsidiary bodies, the former Working Party on Security and Privacy in the Digital Economy (SPDE) (renamed since 2019 as the Working Party on Data Governance and Privacy) and the former Health Care Quality Indicators Expert Group (HCQI).

The development of the Recommendation also involved the advice of experts in privacy, law, ethics, health, government policy, research, statistics and Information Technology and extensive consultations with civil society (the Civil Society Advisory Committee, CSISAC) and business and industry (Business and Industry Advisory Committee, BIAC). The Recommendation was adopted by the OECD Council on 13 December 2016 [C(2016)176] and that was welcomed by OECD Health Ministers at their meeting in Paris on 17 January 2017 (OECD, 2019[7]; OECD, 2017[8]).

The Recommendation applies to the access to, and the processing of, personal health data for health-related public interest purposes, such as improving health care quality, safety and responsiveness; reducing public health risks; discovering and evaluating new diagnostic tools and treatments to improve health outcomes; managing health care resources efficiently; contributing to the progress of science and medicine; improving public policy planning and evaluation; and improving patients’ participation in and experiences of health care.

The Recommendation recommends that Adherents establish and implement a national health data governance framework to encourage the availability and use of personal health data to serve health-related public interest purposes while promoting the protection of privacy, personal health data and data security.

National health data governance frameworks should provide for:

• Engagement and participation of stakeholders in the development of a national health data governance framework;

• Co‑ordination within government and co‑operation among organisations processing personal health data to encourage common data-related policies and standards;

• Reviews of the capacity of public sector health data systems to serve and protect public interests;

• Clear provision of information to individuals about the processing of their personal health data including notification of any significant data breach or misuse;

• The processing of personal health data by informed consent and appropriate alternatives;

• The implementation of review and approval procedures to process personal health data for research and other health-related public interest purposes;

• Transparency through public information about the purposes for processing of personal health data and approval criteria;

• Maximising the development and use of technology for data processing and data protection;

• Mechanisms to monitor and evaluate the impact of the national health data governance framework, including health data availability, policies and practices to manage privacy, protection of personal health data and digital security risks;

• Training and skills development of personal health data processors;

• Implementation of controls and safeguards within organisations processing personal health data including technological, physical and organisational measures designed to protect privacy and digital security; and

• Requiring that organisations processing personal health data demonstrate that they meet the expectations set out in the national health data governance framework.

These 12 principles set the parameters to encourage greater cross-country harmonisation among the health data governance frameworks of Adherents so that more countries can use health data for research, statistics and health care quality improvement.

The Recommendation also recommends that Adherents support trans-border co‑operation in the processing of health data for purposes that serve the public interest. It further recommends that Adherents engage with relevant experts and organisations to develop mechanisms that enable the efficient exchange and interoperability of health data.

Finally, it encourages non-governmental organisations to follow the Recommendation when processing personal health data for health-related purposes that serve the public interest and invites non-Adherents to take account and to adhere to the Recommendation. As of the finalisation of this Report, no Non-Members have adhered to the Recommendation.

The Recommendation instructs the Health Committee, in co‑operation with the Committee on Digital Economy Policy, to serve as a forum to exchange information on progress and experiences with respect to the implementation of this Recommendation, and to monitor the implementation of this Recommendation and report to the Council within five years of its adoption. The present Report aims at fulfilling the Council’s instructions.

Methodology

To monitor the implementation, dissemination and continued relevance of the Recommendation, the Health Care Quality and Outcomes Working Party undertook three surveys: the 2019/20 Survey of Health Data Use and Governance, the 2021 Survey of Electronic Health Record Systems Development, Use and Governance, and the 2021 Survey of Health data and Governance Changes during the COVID‑19 pandemic.

The 2019/20 Survey of Health Data Development, Use and Governance measured elements of national health data governance including the implementation of national health data governance frameworks and related regulations and policies. The survey included a detailed review of data development, quality, accessibility, sharing and data security and privacy protections among the custodians of 13 key national health datasets. HCQO delegates, who are officials of health ministries or national health data authorities, co‑ordinated the completion of the questionnaire within each of their respective countries.1 Co‑ordination of the completion of the questionnaire was more challenging in countries with decentralised health systems. For example, in the United States responses have been provided by various divisions within the Department of Health and Human Services (HHS) and by the National Center for Health Statistics (NCHS) based on their portfolios and may not be reflective of the entirety of health data governance in the United States health system. Twenty-two Adherents participated in the 2019‑20 survey: Australia, Austria, Belgium, Canada, the Czech Republic, Denmark, Germany, Estonia, Finland, France, Ireland, Israel, Japan, Korea, Latvia, Luxembourg, the Netherlands, Norway, Slovenia, Sweden, the United Kingdom (Scotland) and the United States. In addition, Singapore, which participates in work of the HCQO WP and in the CDEP, responded to this survey even though it is not an Adherent.

The OECD 2019‑20 survey was completed by all respondents before the onset of the COVID‑19 pandemic in early 2020. As a consequence of the pandemic, all respondents made improvements in health data to support monitoring and managing COVID‑19. In July 2021, the OECD conducted a Survey of Health data and Governance Changes during the COVID‑19 pandemic. This survey examined the state of health data availability, timeliness, access and sharing and the need for and benefits of improved and harmonised approaches to health data governance that were adopted since March 2020. HCQO delegates were responsible for co‑ordinating the completion of the questionnaire in their respective countries. Twenty-one Adherents responded to this 2021 “COVID‑19 Survey” including: Australia, Austria, Belgium, Costa Rica, the Czech Republic, Italy, Japan, Korea, Latvia, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Portugal, Slovenia, Spain, Sweden, Turkey, the United Kingdom, and the United States.

The OECD also conducted a 2021 Survey of Electronic Health Record System Development, Data Use and Governance in February 2021 (“EHR Survey”). Electronic health record (EHR) systems were surveyed separately because they represent a highly relevant and relatively new source of data on patients’ health care journeys and are often managed by different national ministries or agencies from those responsible for national health data. This 2021 survey followed up on a previous 2016 survey on the same topic and measured the governance of clinical data within EHR systems and the technical and operational readiness to utilise electronic clinical records for statistical and research purposes. HCQO delegates were responsible for co‑ordinating the completion of the questionnaire in their respective countries. Respondents to the 2021 EHR survey were officials of health ministries or national authorities responsible for electronic health record systems. Twenty-six Adherents participated in this 2021 survey: Australia, Belgium, Canada, Costa Rica, the Czech Republic, Denmark, Estonia, Finland, Germany, Hungary, Iceland, Israel, Italy, Japan, Korea, Lithuania, Luxembourg, Mexico, the Netherlands, Norway, Portugal, Slovenia, Sweden, Switzerland, Turkey and the United States. In addition, the Russian Federation, which participates in work of the HCQO WP and CDEP, responded to this survey even though it is not an Adherent.

Note

← 1.  See Annex A, Table A.A.1 within Oderkirk (2021[10]) for the names, positions and organisations of the persons who co‑ordinated the completion of the questionnaire within each country.