A blueprint for the creation of digitally resilient health systems in Europe

The COVID-19 pandemic has exposed the lack of investment in and adoption of digital health solutions in Europe, leaving the potential of health data untapped and making health systems and organisations more vulnerable to crises.

In this paper, DIGITALEUROPE recommends critical steps to improve the digital resilience of European health systems, including the creation of a European Health Data Space, harmonisation of health data processing rules, and increased share of digital spending in EU health funds.

Executive Summary

The digital transformation of Europe’s health systems is a political decision.

Health systems now produce as much as 30% of the world’s stored data,^[1] but most of it remains siloed in hospitals and other specific organisations. The digital technology for moving to a paperless environment is there, but adoption of Electronic Health Records is just 3% in Europe.^[2] Investment on software applications in healthcare is insufficient and trails that of many other sectors.

It is now time to change tack. Digital technologies represent the silver lining of the COVID-19 crisis. They should characterise ambitious upgrades of European health systems and be at the core of a patient-centred, interoperable, trust-based Common European Health Data Space that will propel the EU towards new predictive and preventative models of care.

DIGITALEUROPE recommends to:

• Create an EU Code of Conduct on the processing of health data for primary and secondary use containing practical guidelines helping health data actors across the data lifecycle. Industry must be a key player in it.

• Establish a central health data authority in each Member State to facilitate the secondary use of health data and design a pan-European infrastructure to enable cross-border health data use requests.

The development of Union law should be considered and carefully designed to encourage Member States to create such authorities which are compelled to share health data with one another. Union law will also be necessary to promote cross-border health data sharing and avoid the development of health data authorities with different rules, obligations, standards, or any other obstacle that can impede the sharing or exchange of cross-border health data. There should be no efforts to reopen the General Data Protection Regulation (GDPR) to do so.

The Commission should complement these efforts with the creation of a single point of contact at EU level that would act only as a facilitator to assist, in cooperation with Member States’ health data authorities.

• Issue European Data Protection Board (EDPB) essential guidance on the GDPR in collaboration with industry. It is fundamental to bring harmonisation on the use of public interest, legitimate interest and consent as legal basis. It is also crucial to to clarify the compatibility of primary and secondary use of data as well as the interaction between the GDPR and local and national regulations affecting health data processing.

• Complete before 2024 the creation of profiles giving interoperability specifications for all baseline information domains contained in the 2019 Commission Recommendation on a European Electronic Health Record exchange format.^[3]

• Ringfence 8-10% of the EU4Health budget to realise the Common European Health Data Space and make digital health a spending priority in ReactEU, European Regional Development Fund (ERDF), Digital Europe Programme and Connecting Europe Facility 2.0 Digital.

[1] Huesch, M. and T. Mosher (2017). Using It or Losing It? The Case for Data Scientists Inside Health Care.

[2] McKinsey (2019). Promoting an overdue digital transformation in healthcare.

[3] Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format.

Enabling health data-processing in the EU

80% of health data remains unstructured and untapped after it is created.^[4] We urge the EU to make the most of the vast, untapped pool of health data that sits idle in health organisations across the continent.

Now more than ever, Europe must double down on its ambition to create a Common European Health Data Space (EHDS) that has as its goal the flow of important health data and Electronic Health Records (EHRs) across the EU, and is inclusive and accessible to all health stakeholders, both public and private.

We need to:

1. Create an EU Code of Conduct (CoC) on the processing of genetic, biometric, or health data. The CoC should accelerate the access and processing of such data within the Member State in cooperation with all key public and private stakeholders, with the goal to have the possibility to process this data across all Member States. European cooperation to fight diseases and viruses, population health management at scale and support to safe cross-border travel are concrete examples of why we need a CoC. It must entail:
   • Public interest as legal basis for circumstances in Article 9.2 of the GDPR. The Code should also give a common interpretation of what is considered “public interest” by national authorities across the EU. Unjustified, restrictive Member States’ interpretations of public interest are preventing hospitals from sharing life-saving data with relevant organisations.
   • A relative anonymisation model that provides traceability back to the source records without representing a risk for subject identification. It would facilitate data sharing from institutions to researchers, between pharmaceutical companies (for example to limit the need for a placebo/standard-of-care arm in a clinical trial) as well as from pharmaceutical companies to government-funded research initiatives. Data Protection Authorities are adopting excessively strict interpretations of what constitutes anonymous or anonymised data. This hinders health data processing and makes very difficult for entities to agree on whether and how parties can use the data at issue.
2. • An opt-out model for secondary use of data in research fields with higher patient identification sensitivities. This model would suit areas like rare diseases, genomes and personalised medicine, with higher reidentification risks than normal and where complete de-identification may impact the successful research outcome. A robust ethical and security framework would build necessary patient trust in this model and guarantee that vital identifiable data for research progress is handled properly. It would entail patient rights to actively object to their data being processed. Consent in this model should be, if required, an additional “ethical” safeguard, rather than the main legal basis for processing.
3. • Very practical guidelines which can support practitioners along the healthcare value chain (including patients, physicians, healthcare managers, industry) facilitating a better, common understanding of the access, control, use and sharing of data and unlocking its potential benefits, all while adopting appropriate risk management strategies.

2. Establish a central health data authority in each Member State to facilitate the secondary use of health data and design a pan-European infrastructure to enable cross-border data use requests.

The development of Union law should be considered and carefully designed to encourage Member States to create such authorities which are compelled to share data with one another. But there should be no efforts to reopen the GDPR to do so.

All efforts should only take as a model Finland’s FinData and France’s Health Data Hub. Both examples used as legal basis the GDPR provisions of Article 9.2.i and 9.2.j, in “ensuring high standards of quality and safety of health care and of medicinal products or medical devices” and “necessary for […] scientific […] research”.

Union law will also be necessary to promote cross-border data sharing and avoid the development of health data authorities with different rules, obligations, standards, or any other obstacle that can impede the sharing or exchange of cross-border health data.

The Commission should complement these efforts with the creation of a single point of contact at EU level that would help to coordinate cross-border requests for the access to and the re-use of health data, and support the setting of interoperability standards. Such an authority would act only as a facilitator to assist and in cooperation with the Member States’ health data authorities.

For all these initiatives to succeed, it is crucial that the Commission institutes a broad definition of what constitutes scientific research. In today’s AI and big data age, many commercial activities may qualify as scientific research. This is key if we want central health data authorities to plug health data into the Common European Health Data Space.

3. Issue European Data Protection Board (EDPB) essential guidance on the GDPR in collaboration with industry. It is fundamental to bring harmonisation on the use of public interest, legitimate interest and consent as legal basis, and to clarify the compatibility of primary and secondary use of data as well as the interaction between the GDPR and local and national regulations affecting health data processing.

Different Member States’ interpretation of the GDPR and additional, stricter national rules to process genetic, biometric and health data are seriously denting the applicability of the GDPR. We recommend that the EDPB issue related guidance in order to encourage further harmonisation amongst national DPAs and their respective data protection frameworks.

4. Fulfil the ambitions in the Commission Recommendation on a European Electronic Health Record exchange format. ^[5] The Common European Data Space must ensure data systems are interoperable and citizens have control of their personal data at any time. The Commission must complete by 2022 the exchange of electronic patient summaries and ePrescriptions between various Member States.

It should also not lose sight of the other baseline domains identified in the Recommendation. We need profiles providing specifications for interoperability also for laboratory results, medical imaging and reports, and hospital discharge reports. These information domains showed to be vital in the fight against COVID-19 across Europe. The Commission should complete these profiles before 2024 and support their practical implementation to meet clinical needs.

Existing Fast Health Resource Interoperability (FHIR) specifications should be used as reference to enable data exchanges between health applications. They are consistent, easy-to-implement information models used by all major cloud providers. They also build on similar specifications in related ICT health solutions.

[4] Kong, Hyoun-Joong. (2019). Managing Unstructured Big Data in Healthcare System. Healthcare Informatics Research.

[5] Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format

Capacity building for resilient health systems

We strongly support the proposed EU4Health programme. It seeks to assert a stronger role for the EU on public health.

Policy-makers should now realise that investing in digital is a precondition to achieve the programme’s priority of making Europe’s health systems more resilient. Digitalising hospitals – for instance, by moving to a digital documentation system and integrating data into it – enables a systemic approach to prevention, treatment and care of cross-border health threats to the Union.

The EU has a moral duty to make use of existing, well-tested digital technologies  and build capacity for the Common European Health Data Space. It needs to:

• Establish world-reference AI testing facilities. New excellence centres across the EU should partner with healthcare actors to test AI solutions in real operational environments. This is key for health organisations to attract and retain the best talent. Regulators must also keep in mind that there are strong risk-assessment processes in place for AI-based health solutions intended for medical purposes such as diagnosis, prevention or treatment of diseases, which fall under the scope of the Medical Device Regulation (MDR) 2017/745 and In Vitro Diagnostic Regulation (IVDR) 2017/746. These regulations contain well-defined risk classifications based on the potential risk of harm posed by the device.^[6]

• Ringfence at least 8-10% of the EU4Health budget to realise the Common European Health Data Space. In synergy with the Digital Europe Programme (DEP), EU4Health should scale up successful Innovative Medicines Initiative (IMI) projects for the secondary use of data, like the European Health Data & Evidence Network (EHDEN), and boost digital tools and computing capacity to host the data space. This should include funding for the development and implementation of relevant data exchange profiles, following the examples of the Integrating the Healthcare Enterprise (IHE) funds or the Smart Open Services for European Patients (EPSOS) initiatives in the past.

• Carve out a bigger role for telehealth in EU4Health and new EU digital health policies. COVID-19 brought telehealth to the forefront in many countries. In France, it surged by 40% in recent weeks.^[7] This trend is here to stay.
  • EU4Health should promote investments for telehealth technologies. Telemonitoring of chronic diseases, telecare, virtual conference tools and AI chatbots are all examples of how we can ease the ever-growing pressure on hospitals and the entire healthcare system. The Commission recognises most EU countries have an inadequate IT infrastructure to integrate even existing telemedicine tools today.^[8]
  • Connecting Europe Facility (CEF) 2.0 Digital should boost connectivity in rural areas. In several EU countries, rural areas can rely on half or less than half the number of doctors available in urban areas per 1000 inhabitants.^[9] Connectivity is critical for telehealth to help address doctor shortages in remote communities. CEF 2.0 Digital must quickly build infrastructure for health in coordination with EU4Health, lest Europe will be stuck in the low gear when the next crisis hits.
  • The Commission should also explore more robust coverage, payment and reimbursement for telemedicine and teleconsultations together with Member States.

• Build digital acumen and skills among health professionals. ICT specialists are just 1% of healthcare workforce. Up to 70% of health professionals do not use digital solutions due to gaps in knowledge and skills in data analytics.^[10]
  • Member States must prepare tomorrow’s healthcare talent with digital-ready university curricula. Data science and artificial intelligence should be at the centre of a major reform of education systems in Europe, supported by the EU. No health system can be resilient without digital literacy and the necessary digital skills among health professionals.
  • The Commission should deploy Digital Europe Programme (DEP) funding for urgent healthcare workforce upskilling. DEP’s Digital Innovation Hubs, AI testing facilities and competence centres must also appeal to doctors, nurses and other healthcare practitioners, not just industry and researchers. These centres should partner with healthcare actors to test AI solutions in real operational environments.

• Introduce an ambitious target for digital health spending in the new ReactEU programme and guarantee ERDF funding flows into hospital digital upgrade. Spending on software, databases and ICT services in health has been comparatively modest for too long in.^[11] COVID-19 exposed all the digital infrastructure weaknesses of our health systems.

Introducing a target on minimum ReactEU investments on digital equipment and tools for hospitals would act an insurance policy against the next pandemic outbreak. The Commission must also negotiate ambitious ERDF Operational Programmes with national governments and guarantee with all its energies that investments for health systems resilience are really prioritised.

[6] DIGITALEUROPE’s comments on the European Commission’s AI White Paper elaborate further on this aspect (pg. 27)

[7] Widoobiz (2020). Le coronavirus fait exploser la télémédecine en France

[8] European Commission (2018). Market Study on telemedicine

[9] European Data Journalism Network (2018). Europe has a shortage of doctors

[10]OECD Health Policy Studies (2019). Health in the 21st Century: Putting Data to Work for Stronger Health Systems.

[11] OECD Health Policy Studies (2019). Health in the 21st Century: Putting Data to Work for Stronger Health Systems.