Health

Health data carries regulatory constraints that do not apply to most research data. It consists of personal medical information whose misuse could harm individuals. It also comes from different contexts, each with its own consent framework, regulatory requirements, and applicable standards.

Secondary use of health data

Electronic health records, prescriptions, laboratory results, medical imaging, and administrative claims are generated during patient care, not for research. Using this data for research requires a separate legal basis and specific access mechanisms. Data collected under a formal research protocol, such as a clinical trial or a prospective cohort study, is different again: it involves explicit research consent and its own regulatory framework (see Clinical Trials). Using care-setting data for research instead is called secondary use of health data. The EHDS specifically targets this at the EU level.

Data access

Health data generated in care settings cannot generally be published as open data. Re-identification risk persists even after standard anonymisation. Three access models are in common use.

• Fully anonymised data, such as brain atlas outputs and aggregate cohort statistics, can be deposited in open repositories. The Open Brain Consent framework provides pre-approved consent language for depositing open neuroimaging data under an established ethical framework.
• Data that cannot be fully anonymised is deposited in controlled-access repositories instead. These require ethics review and a data use agreement. EGA serves this role in Europe for genomic and clinical data. dbGaP and LONI IDA serve equivalent functions in the USA. In France, the Health Data Hub and SNDS operate via CESREES ethical review and CNIL authorisation.
• For sensitive datasets that cannot leave their source institution, federated secure processing environments let analysis run in place instead. The Health Data Hub Datalab and EBRAINS secure access environments follow this model.

Standards

Common data models

OMOP CDM is a common data model for secondary use of observational clinical data. It integrates heterogeneous routine clinical data from different institutions for research. It designates one or more Standard vocabularies per domain: SNOMED CT for conditions, RxNorm for drugs, and LOINC for measurements. Existing vocabularies such as ICD-10 or CCAM are mapped into these instead of being used directly. OHDSI maintains OMOP CDM and its tooling ecosystem. BBMRI-ERIC promotes it for cross-biobank data standardisation. See OMOP CDM for the full set of domain-to-vocabulary mappings.

Clinical trial data standards

OMOP CDM is designed for routine care data, not research-collected clinical trial data. CDISC governs that data instead. The FDA (Food and Drug Administration) has required CDISC since 2016, but only for trials feeding a formal marketing application: a new drug, biologics, or abbreviated new drug application (NDA, BLA, or ANDA). Most academic and investigator-initiated trials never result in such a submission. The European Medicines Agency has not mandated CDISC. It instead runs a voluntary pilot programme. The OHDSI Clinical Trials Working Group is developing conventions for converting CDISC SDTM data into OMOP CDM. This lets trial data be analysed alongside observational data, using the same tooling.

Clinical terminology

HL7 FHIR is the API standard for EHR data exchange. It is also the designated interface for primary care data under EHDS. SNOMED CT provides the clinical concept terminology underpinning both OMOP and FHIR implementations. It serves a different purpose from ICD-10. SNOMED is a relational terminology whose concepts are defined by typed relationships, supporting detailed recording at the point of care. ICD-10 is a flat statistical classification with mutually exclusive codes, suited to counting and billing. The two are reconciled through a maintained map. Care recorded in SNOMED can therefore be reduced to ICD codes for reporting.