Updated 3 min read

Does stricter health data regulation mean less research?

Health data regulation exists to protect patients, and patients also benefit from research. Early evidence shows that stricter rules, as currently implemented, can shrink research instead of enabling it.

What the evidence shows

Finland was the first European country to adopt a dedicated law on the secondary use of health and social data, in force since May 2019, with a single permit authority, Findata. In 2023, new data permits for registry-based research were an estimated 47% below the number expected from the pre-2020 trend. In the United States, a cardiac registry saw consent to follow-up fall from 96% to 34% after the HIPAA Privacy Rule took effect, and other studies reported recruitment drops of a similar scale.

The mechanism is not the law alone; it is the culture the law creates. HIPAA’s architecture produced a compliance culture marked by what the Institute of Medicine called “overly conservative interpretations” of the Privacy Rule, with institutions imposing restrictions on data sharing that go beyond what the rule requires. After each breach, the dominant response is to tighten access controls further, which compounds the research access problem without addressing its structural causes.

The false trade-off

Protect patients or enable research: the choice only looks forced. The trade-off exists when consent is treated as an obstacle to route around, through de-identification, administrative authorisation, or blanket institutional permissions. Each workaround erodes protection, access, or both.

The European Health Data Space takes the administrative route for secondary use, moving much of it away from individual consent toward authorisation by Health Data Access Bodies, with an opt-out right for individuals in place of a consent. It may succeed, but the Finnish experience urges caution: moving decisions away from patients does not automatically produce more research.

There is a configuration where protection and research reinforce each other: data that is consented from the moment of collection. When each person holds their own record and grants explicit, revocable, purpose-specific access, researchers receive data that is research-grade because it is consented; nothing needs to be stripped, and no blanket institutional caution is needed, because the authorisation is individual and auditable.

Health Data Safe is built on this bet: a neutral Swiss non-profit foundation acts as Data Controller, so clinics and researchers inherit the consent, audit and compliance machinery instead of building it alone.

Related reading: GDPR, EHDS, nLPD explained and the women’s health data gap.

Sources