Key Details
The OECD’s Assessing the Public Interest in the Secondary Use of Health Data draws together criteria from existing national guidance and cases. Its concern is that different interpretations of public interest, sometimes by several bodies reviewing the same request, can delay valuable uses of data.
Consideration | What a Review Body Examines |
|---|---|
Population health and planning | Whether the proposed use could meaningfully improve care, surveillance or health-system decisions |
Research and innovation | Scientific merit, researchers’ capability, independence and plans to share findings |
Ethics and risk | Whether the data requested are necessary and the privacy safeguards proportionate |
Health equity | Whether benefits reach neglected conditions and underserved groups |
Public communication | Whether people are clearly informed and the use accords with reasonable expectations |
These are considerations for assessment, not a new OECD legal test or a general permission to use patient data without consent.
Health Data Have Uses Beyond the Care for Which They Were Collected
Secondary use means using information collected during patient care for another purpose. Clinical records and registries, sometimes combined with other information, can help researchers study treatments, support disease surveillance and service planning, and develop AI tools for health services.
Identifiable records remain subject to applicable privacy law. Consent is commonly used, but obtaining it may be impossible, impracticable or incompatible with a proposed public-interest purpose. Where the law provides an alternative route, a review body may assess the proposed benefit and safeguards. Data that meet the applicable standard for anonymisation may be treated differently.
A Worthwhile Aim Is Not Enough if the Data Cannot Support It
The OECD asks reviewers to examine not only what a project hopes to achieve, but whether its data are complete, reliable and representative enough to produce useful findings. That matters for research across patient groups and for AI tools intended to work in different care settings. Reviewers must also consider the size and likelihood of the benefit, the sensitivity of the data requested and whether less intrusive access would suffice.
This assessment becomes harder when records sit with different organisations or a project spans countries. Misaligned criteria and repeated approvals can delay research; a quicker process, however, still needs a clear basis for deciding whose data may be used and why.
Private Access Requires Continuing Scrutiny
A French case shows that a private company can establish a public-interest purpose. France’s data protection authority authorised a warehouse of pharmacy-dispensing data for health research, while requiring each study using it to demonstrate its own public-interest purpose. The brief also notes later findings of transparency and security shortcomings: initial authorisation did not settle how the data would be governed over time.
A Finnish court reached the other side of the distinction. It rejected access for an industry-funded study despite qualified researchers and an adequate formal plan because scientific independence and freedom to publish all resultshad not been sufficiently established. Private funding was not disqualifying; the unresolved influence of the funder was.
Clearer Reviews Need Not Mean Weaker Protection
The OECD calls for clearer guidance to applicants, defined roles where several bodies assess a request and decisions made in time for beneficial research to proceed. Secure ways to analyse data may reduce risk, but they do not replace scrutiny of a project’s purpose, data fitness, independence and public communication.
What is the Secondary Use of Health Data?
It is the use of information gathered for one health purpose — such as treating a patient — for another, such as studying treatment outcomes or planning services. Whether consent or another authorisation is required depends on the data, proposed use and applicable law.
Policy Relevance
For India, the brief offers a way to think about access to health data as digital records become more useful for research and planning. It does not assess Indian law or establish a route around consent requirements. Where reuse is legally permissible, reviewers need to be able to judge both the proposed public benefit and the quality of the evidence likely to result — particularly for tools intended to serve diverse patient populations.
The governance question extends beyond the initial decision. Who reviews each subsequent use, checks researchers’ independence, explains the use to patients and responds if safeguards fail will shape whether access delivers public value without losing trust.
Follow the Policy Brief Here: Assessing the Public Interest in the Secondary Use of Health Data