Recent developments concerning the French Health Data Hub

The French “Plateforme des données de santé”, also known as the Health Data Hub, created in 2019, aims at facilitating the sharing of health data from a wide variety of sources in order to support research. The Health Data Hub refers to both the technology platform and the public interest group - in charge of the implementation and administration of the platform, and of the accompaniment of the project leaders. 

The Health Data Hub consists in a system of databases. It will include the historical Système National des Données de Santé (“SNDS”) - called the main database, and a catalogue - a collection of databases which the Health Data hub must be authorized to make available, in addition to the main database.  In this respect, the Health Data Hub has published a first list of databases that are being considered for the catalogue.

How does it work?

Each project leader who wishes to conduct research on the basis of health data that are not completely anonymous must obtain a prior authorization from the French Data Protection Authority (the “CNIL”). Prior to this authorization, it is necessary to obtain the opinion of the Ethics and Scientific Committee for Health Research, Studies and Evaluations (the “CESREES”). In order to facilitate data access and encourage the research, the Health Data Hub is the single point of entry for requests for access to health data - applications must be submitted to the Health Data Hub who forwards it to the CESREES and then to the CNIL. In addition, when applicable, projects leaders can use simplified procedures in order to obtain the CNIL’s authorization.

Once the CNIL authorization has been obtained, the data are extracted by the Health Data Hub and then made available to project leaders in a "project space". This space allows to receive, store, process and visualize the health data necessary for the project - with no possibility of transferring the data to a local computer.

Upcoming evolution of the platform to ease access to data

The next step in the evolution of the platform is the hosting of the main database and the catalogue directly in the Health Data Hub technology platform. Then, the Health Data Hub will be able to give access to data without having to first extract them from the public databases.  

This evolution is still in progress of being implemented. In this respect, the Health Data Hub had filed an application to the CNIL to be authorized to host the main database and the catalogue in its technology platform. Nevertheless, in January 2022, the Health Data Hub temporarily withdrew its application, for various reasons. Until the authorization is obtained from the CNIL, access to data still takes time as it requires data, on a project-by-project basis, to be extracted by producers and transferred to the Health Data Hub before being made available to project leaders.

The sensitive issue of data hosting in terms of safety data

The temporary withdrawal of the above-mentioned application for authorization is closely related to the fact that the service provider appointed for hosting the health data processed by the Health Data Hub is Microsoft Azure. Indeed, this is a major and sensitive issue raised by many stakeholders in the project, such as the CNIL or the French social security system, who allege a risk that Health Data Hub’s data be accessed by U.S. authorities, due to the fact that Microsoft Azure is headquartered in the United States. In this respect, the successive invalidations of adequacy decisions between the United States and the European Union - known as the Safe Harbor and the Privacy Shield - by the Court of Justice of the European Union show that this risk does fundamentally exist.

Since 2020, different stakeholders gave their opinion on this issue, such as the CNIL who, given the sensitivity of the concerned data, recommended that hosting and management services of the Health Data Hub be reserved exclusively for entities under the jurisdiction of the European Union. Hence, at that time, the French government undertook to adopt a new technical solution offered by a provider not subject to U.S. law.

As of now, the Health Data Hub is still reviewing various offers from suppliers, notably from French ones. However, according to the French government, the official tender for the new hosting of the Health Data Hub will not be launched before the French presidential elections.