Health data, regulation and patient care

Lessons from France: the costs of getting data governance right 

France has considerable experience developing health data warehouses, which bring together clinical information for research and analysis. By September 2025, the French data protection authority, CNIL, had identified 125 warehouses implemented or under development since 2017. 

Their development reflects sustained investment in the infrastructure needed to make healthcare information available for secondary use. However, our team’s experience working with French healthcare institutions has identified considerable variation in how these projects are planned and managed. 

Some organisations have given greater attention than others to infrastructure costs, specialist staffing, data quality, security and the procedures for approving access to information. 

These differences have financial and operational consequences. A health data warehouse requires more than a repository of clinical records. Organisations need to establish where information originates, who can access it, how proposed uses are assessed and what security controls apply. Addressing these requirements after implementation can mean additional expenditure and delays. 

The potential financial value of health data also needs careful consideration. Direct revenue from making information available may be limited. Under the EHDS, certain fees can recover costs associated with providing data for secondary use, subject to defined conditions. For hospitals, the more substantial benefits may come from improving operational decisions, reducing inefficiencies, supporting clinical research and participating in funded partnerships. 

Those gains depend on data being sufficiently reliable and accessible to support the activity concerned. Investment in governance and infrastructure therefore needs to be considered alongside the expected clinical, research and financial benefits. 

Ireland's challenge: making systems work together 

“The systems don't talk to each other”: it's a familiar frustration among Irish clinicians when treating a patient may need information recorded by several different services. When that information is difficult to retrieve, incomplete or inconsistently recorded, it becomes harder to rely on it when making clinical decisions. 

Ireland is beginning to address this problem. The HSE's Shared Care Record provides authorised staff with a read-only view of selected patient information held across different services. It is now available across all six health regions, although the range of information and functionality continues to develop. 

The planned national electronic health record will go further, creating a common system for recording and accessing information across publicly funded hospitals and community services. The Health Information Act 2026 also establishes a legislative basis for electronic health records and information sharing, with substantive provisions subject to commencement. 

Alongside these developments, work on common clinical terminology is addressing a less visible obstacle. The HSE's Central Terminology Service supports consistent coding and definitions across healthcare systems. A mapping introduced in September 2026 also allows emergency departments using SNOMED CT to record detailed clinical information while supporting national reporting and Activity-Based Funding requirements based on ICD-10-AM. 

Clinical information often serves several purposes. Consistent terminology can reduce the need to reinterpret information for reporting and allow it to be understood across different systems. Shared standards do not resolve every integration problem. Systems must be configured to exchange information correctly, and clinicians need confidence in the records they receive. However, these developments establish some of the conditions needed for more effective information sharing within Ireland and, eventually, across Europe. 

Patient-driven, data-informed care 

Clinical confidence is central to whether these investments deliver better care. The distinction between “data-driven” and “patient-driven, data-informed” healthcare is crucial. Clinicians use information to make decisions, but care must remain focused on individual patient needs rather than the achievement of performance indicators. Reliable data can support clinical judgement. Incomplete records, inconsistent definitions or information presented without sufficient context can undermine it.  

The same principle applies as healthcare organisations explore artificial intelligence for clinical decision support, patient flow management and research. AI can identify patterns and support analysis, but healthcare organisations need appropriate safeguards, including data quality controls, system evaluation and human oversight. The AI Act establishes additional obligations for high-risk applications, with implementation dates varying by system type. 

Patients also need to understand how their information may be used, who can access it and what protections apply. Clear explanations of these arrangements are necessary if healthcare organisations expect public confidence in expanded data sharing. 

Ireland's 2021 HSE cyberattack demonstrated how quickly disruption to digital systems can affect healthcare delivery, forcing staff to rely on manual processes. As healthcare becomes more dependent on connected information, organisations need tested arrangements for maintaining safe care during outages. Resilience is not simply an IT concern. It is a patient safety imperative. 

Measuring the return on health data 

For Irish healthcare leaders, the financial case for investment should be tested against practical outcomes. Can clinicians retrieve relevant information more quickly? Has duplicate recording been reduced? Are reporting processes more efficient? Can approved research projects access suitable data without unnecessary delays? 

These are more useful measures of progress than the volume of information collected or the number of new systems introduced. 

Experience from France highlights the importance of anticipating the costs of data governance, while Ireland's clinical experience demonstrates why information must be accessible, reliable and useful at the point of care. 

As Ireland develops its national electronic health record, the decisions made about data quality, common standards, security and clinical involvement will shape the return on that investment. 

Success will ultimately be measured by whether clinicians have better information when they need it, patients receive more connected care and healthcare organisations can demonstrate that resources are being used more effectively.