Context and challenges of access to health data
According to the CNIL (French Data Protection Authority), health data are personal data relating to the physical or mental health of a person, including data revealing information about their health status or resulting from care received. They are therefore highly sensitive, strictly regulated, and protected by the GDPR and the French Data Protection Act (Loi Informatique et Libertés).
Access to this data relies on Reference Methodologies (MR), validated by the CNIL. If a project falls outside this framework, specific authorization must be issued by the institution. The MRs thus impose a strict legal and ethical framework: explicit objectives, data minimization, pseudonymization, reinforced security measures, and limited retention periods.
While essential for protecting individuals, this framework often slows down data access. This is particularly the case for start-ups, industrial players, or clinical teams unfamiliar with the procedures, often lacking internal legal support.
Several structures are attempting to regulate and facilitate data access in France, each with a specific role:
- The Health Data Hub (HDH) coordinates national requests for access to Health Insurance data via the SNDS, ensures funding, and disseminates best practices (e.g., the “DAtAE” call for projects). It also aims to streamline procedures by facilitating the acquisition of a partial copy of the file (so-called “full track” permanent access) for qualified actors, as illustrated by the recent authorization obtained by the company HEVA for its FREiA warehouse.
- University Hospitals (CHUs) structure internal clinical data in their health data warehouses (EDS), facilitating secure research and analysis. These initiatives are at different stages of maturity, with “frontrunners” among the EDS (Nantes, Reims, Toulouse, Bordeaux, HCL, Grenoble, AP-HP) pulling the entire system upward.
- Regional GCSs, such as GCS HUGO, NOVA, or HOURAA, mutualize tools, resources, and governance between establishments to streamline access to data via single windows.
Today, these different structures have a common objective: to simplify access to health data for all innovation actors, whether hospital-based, academic, or industrial. Furthermore, the challenge now goes beyond simple local structuring to move towards a true federation of data. Initiatives are emerging to break down silos, such as the FeData project, which aims to federate CHU warehouses to offer multicentric access (horizontal approach), or Unicancer, which centralizes data from Cancer Control Centers via its Harmonie project (vertical approach by specialty).
Current modalities of access and valorization
Multiple access channels, but limited clarity
Access to health data therefore relies on a mosaic of actors and portals. Data are accessible via the Health Data Hub (HDH), local EDS and GCS, specific registries (e.g., the FRANCIM cancer registry network or the REIN registry in nephrology), or national cohorts (e.g., the generalist Constances cohort or the E3N-E4N study). For example, the G_NIUS portal, piloted by the Ministerial Delegation for Digital Health, offers a directory of access counters.
However, the diversity of governances, formats, and access conditions makes the landscape complex and difficult for project leaders to grasp. Beyond access, value lies in data linkage (chaining), i.e., the ability to cross-reference distinct sources for the same patient. Major advances are underway regarding National Research Organizations (ONR), notably with Inserm’s validation of linking its data with multicentric hospital initiatives, which constitutes a real “game changer”.
The types of contracts used
Legal access modalities vary according to use cases and the nature of the partners:
- Collaboration contracts: Typical in public-private research. They imply joint ownership of the protocol, co-ownership of results, and sometimes preferential access to innovations.
- Service contracts: The public institution performs an analysis on its data. Results are delivered in the form of indicators, without transfer of raw data.
- Provision contracts: These contracts allow direct access to the data. They are framed by a favorable opinion from the institution’s ethics committee and by reinforced security clauses (pseudonymization, audit, limited duration).
A national working group led by the Health Data Hub and the Strategic Committee for Health Data recently published a standard contract for the provision of data from EDS, in order to harmonize practices and reduce negotiation times.
Access timelines and complexities
On average, access to data via major national platforms and initiatives like EDS or GCS takes between 6 and 12 months. According to reports from the Senate (2023) and the Court of Auditors (2024), these delays can reach up to 18 months or more, depending on the complexity of the project and the origin of the data.
Three major hurdles explain these durations:
- Methodological validation (verification of the scientific conformity of the protocol).
- Legal instruction (access agreement, risk analysis, ethical opinions).
- Technical operationalization (recovery, pseudonymization, specific processing).
For start-ups and companies, these excessive delays constitute a major obstacle to the rapid deployment of proofs of concept.
Examples of successful valorization
Several initiatives illustrate emerging best practices.
- Unicancer stands out today as having a mature effective valorization model. Beyond technical structuring via its “Harmonie” warehouse, the network has succeeded in creating a real economic model: it transforms its real-world data into clinical evidence (Real World Evidence), thus generating numerous scientific publications and concrete industrial partnerships.
- Projects led by regional GCSs, such as HUGO with the Ouest Data Hub, favor the secure sharing of hospital data for research and artificial intelligence projects, conducted within a strict ethical and contractual framework.
These examples show that effective operational models are possible. However, not all initiatives are at the same level of maturity. Data quality, warehouse completeness, interoperability, and the availability of human resources to support projects remain very heterogeneous across regions or institutions. The absence of a clear business plan (costs, financing model, governance) sometimes limits their long-term impact, hence the crucial interest of a federated approach: by mutualizing resources and costs (the “Run”), it allows reaching a critical size and building a more robust and sustainable economic model.
Opening perspectives and accelerating valorization
Creating conditions conducive to early access
Accelerating access to health data requires more agile experimentation environments.
- “Data challenges” allow project leaders to test their models on synthetic data. The AP-HP initiated this movement by regularly organizing them around AI or decision-support use cases. This dynamic has since been joined by other major players such as the French Society of Radiology (SFR), Foch Hospital, or the University Hospitals of Strasbourg.
- Some CHUs, GCSs, and public bodies are experimenting with controlled test environments (sometimes called “sandboxes” or experimentation spaces) allowing actors, particularly start-ups and researchers, to test tools on simulated or anonymized data before any access to real data.
- In Occitanie, an initiative associating the University of Montpellier, Inserm, Inria, and the CHU of Montpellier relies on the national supercomputer located in Montpellier (CINES) to support the training and evaluation of AI tools.
Stimulating cooperation and transparency
Better cooperation between actors requires the standardization of tools and contractual practices.
- The development of standard contract models, led by the Health Data Hub and the Strategic Committee for Health Data, aims to harmonize frameworks for different use cases (clinical research, AI, economic valorization) and facilitate public-private partnerships.
- Organization in federated networks, whether horizontal or vertical. This is the case of the FeData project, which aims to provide a unified multicentric response across CHUs, or specialty approaches (verticals) like the Brain & Mind Biocluster, which develops a common database for neuroscience reference centers.
- Documentation of successful projects helps anchor shared references, contributing to a common culture of responsible openness.
- The tracking and publication of performance indicators (average access times, data completion rates, scientific outcomes) is essential. Their publication would strengthen the transparency of the system and feed into the strategic choices of stakeholders.
The EHDS, an opportunity for convergence
The European Health Data Space (EHDS), whose entry into force is scheduled for 2025 with progressive implementation until 2029, opens up major perspectives at the European level:
- It will establish a common European framework for secondary access to data for research, innovation, or public policy purposes.
- Requests will be processed by “national health data access bodies” designated in each country, on the model of “Health Data Access Bodies”, rather than by simple “data permits”.
- It will make possible the interconnection of national platforms (like the HDH) and the portability of requests between Member States, within the framework of the European network HealthData@EU.
To realize these ambitions, it will be necessary to anticipate technical interoperability, harmonization of standards, mutual recognition of authorizations, and legal protection of cross-border flows. French and European actors will then have to adapt their tools, simplify their processes via a multicentric approach, and evolve their governance models by integrating the imperative of digital sovereignty. This dimension, having become central in current structures, is now guiding choices towards European solutions and actors.
While France has a solid foundation to become a key player in health data in Europe, the construction phase (“Build”) is now over. To realize this potential, the urgency is to successfully navigate the shift to exploitation (“Run”) by acting now on several levers: clarifying access modalities with single windows capable of centralizing requests, stabilizing contractual frameworks to save time, strengthening support for project leaders, and mutualizing resources through federation logics.
In the longer term, the preparation for the EHDS imposes a change of scale: harmonization of standards, interconnection of platforms, adapted governance, and protection of cross-border exchanges. This requires strategic alignment between territories, public structures, and industrial partners.
Finally, the valorization of health data cannot be conceived sustainably without integrating ecological issues: the environmental impact of their collection, processing, and storage must be measured, regulated, and integrated into technical choices. It is about thinking of a valorization model that is responsible, useful, secure… and sustainable.
Alcimed accompanies General Management, IT Departments (DSI), and Clinical Research & Innovation Departments (DRCI) of hospitals, as well as medico-social establishments and Skills Operators (OPCO), to transform their digital initiatives into truly operational roadmaps. We intervene throughout the project lifecycle, from design (“Build”) to exploitation (“Run”) and scaling conditions, in order to secure appropriation, economic sustainability, and deployment. By combining strategic analysis, field feedback, multicentric benchmarks, and work on use cases, we structure sustainable, mutualizable, and sovereign models, adapted to the concrete challenges of healthcare actors. Don’t hesitate to contact our team.
About the author,
Alix, Consultant in Alcimed’s Innovation and Public Policy team in France