Contact
Contact us

Health Data Warehouses

Securing the creation, governance and use of health data warehouses

AUMANS AVOCATS advises healthcare institutions, research organisations, companies and HealthTech stakeholders on the design, implementation and governance of health data warehouses (HDWs).

A health data warehouse makes it possible to bring together and retain large volumes of data over an extended period in order to enable their use for various purposes, including activity management, research, studies and evaluations in the field of healthcare.

Such projects raise specific legal and regulatory issues due to the sensitive nature of the data processed, the duration of their retention, the variety of their sources and the possibilities for subsequent reuse.

AUMANS AVOCATS assists its clients in defining the legal framework applicable to the warehouse, ensuring compliance with the GDPR, the French Data Protection Act and the CNIL framework applicable to health data warehouses, and defining the framework applicable to subsequent research and other reuses of the data.

Compliance
CRO support
AI & Healthcare
Training

Defining the legal framework for the warehouse

The establishment of a health data warehouse first requires a precise assessment of the nature of the project, its purposes, the categories of data concerned, their sources and the intended uses.

In particular, it is necessary to distinguish the creation of a warehouse designed to enable multiple subsequent uses of data over an extended period from the creation of a database for the purposes of a specific research project.

AUMANS AVOCATS assists its clients in particular with:

  • qualifying the project and determining whether it constitutes a health data warehouse;

  • identifying the data controller and the responsibilities of the various stakeholders involved;

  • determining the purposes of the warehouse and the applicable legal bases;

  • analysing the categories and sources of data that may be incorporated into the warehouse;

  • determining the conditions under which data may be collected, transferred to and retained in the warehouse;

  • identifying the applicable provisions of the GDPR, the French Data Protection Act and, where relevant, the French Public Health Code;

  • analysing the conditions governing the use of data originating from the French National Health Data System (SNDS) or other databases;

  • determining the prior formalities required before the CNIL;

  • conducting or reviewing the Data Protection Impact Assessment (DPIA).

Compliance with the CNIL health data warehouse framework

The CNIL has adopted a specific framework governing personal data processing activities carried out for the purpose of creating health data warehouses.

Where a project falls within its scope and complies with all its requirements, the controller may commit to complying with this framework. Where the project cannot comply with the framework, the discrepancies must be assessed and, where necessary, an authorisation application must be prepared and submitted to the CNIL.

AUMANS AVOCATS assists its clients in conducting a detailed assessment of their project’s compliance with the CNIL framework, including in relation to:

  • the purposes of the warehouse;

  • the legal basis for processing;

  • the nature and origin of the data included in the warehouse;

  • the categories of data collected;

  • recipients and conditions governing access to the data;

  • retention periods;

  • information provided to data subjects and the exercise of their rights;

  • pseudonymisation and, where applicable, anonymisation measures;

  • data hosting and security requirements;

  • logging and traceability of access and operations;

  • governance of the warehouse;

  • procedures governing subsequent reuse of the data.

The firm may also conduct a compliance audit of the warehouse against the CNIL framework, identify any gaps and assist with the definition and implementation of a remediation plan.

A question ? Contact us !

Governance of the warehouse and access to data

Compliance of an HDW does not depend solely on its legal and technical architecture. It also requires appropriate governance to control the data included in the warehouse and the projects for which such data will subsequently be used.

AUMANS AVOCATS assists its clients in defining and formalising this governance, including in order to:

  • define the roles and responsibilities of the various governance bodies;

  • organise the steering committee and relevant scientific or ethics committees;

  • define procedures for requesting access to data;

  • establish criteria for reviewing and approving projects;

  • organise the documentation and traceability of decisions;

  • define different levels of access to data;

  • regulate access granted to researchers, partners and service providers;

  • organise the monitoring of approved projects;

  • establish internal charters, policies and procedures applicable to the warehouse.

This governance should enable the scientific value of the data to be developed while protecting individuals and maintaining control over the uses made of their data.

Patient information and exercise of rights

Providing information to individuals is an essential component of health data warehouse compliance.

Data subjects must be informed of the creation of the warehouse, the categories of data that may be included, the purposes pursued, the applicable retention periods and the arrangements for exercising their rights.

AUMANS AVOCATS assists its clients with:

  • defining the patient information strategy;

  • drafting and reviewing privacy notices;

  • organising information where data is collected directly or indirectly;

  • establishing a transparency portal covering the warehouse and projects carried out using its data;

  • defining procedures for the exercise of data subject rights;

  • organising the right to object where applicable;

  • coordinating information relating to the warehouse with information required for subsequent research projects.

Data subject information should be addressed from the design stage of the warehouse in order to facilitate the subsequent implementation of research projects within a legally secure framework.

Governing subsequent research and reuse

The creation of the warehouse and the conduct of research using data contained in the warehouse constitute two legally distinct stages.

Compliance of the warehouse with the CNIL framework, or the authorisation obtained for its creation, does not therefore in itself permit all contemplated research to be carried out freely using the data it contains.

Each research, study or evaluation project requires a specific assessment in order to determine its legal framework and the applicable formalities.

AUMANS AVOCATS assists its clients in:

  • qualifying each research or data reuse project;

  • determining the applicable legal basis;

  • identifying any applicable Reference Methodology;

  • assessing compliance with MR-001, MR-003, MR-004 or other relevant frameworks;

  • preparing the required declarations of compliance;

  • preparing CNIL authorisation applications where necessary;

  • analysing data subject information requirements for each project;

  • establishing an appropriate framework for data extraction and disclosure;

  • organising secure access to data;

  • drafting and negotiating Data Access Agreements, Data Transfer Agreements and other necessary agreements;

  • governing projects involving several institutions or partners;

  • analysing international research projects and associated data transfers.

This approach makes it possible to integrate, from the design stage of the HDW, a governance process for subsequent research, facilitating the qualification, approval and implementation of future projects.

Security, pseudonymisation and access control

The sensitive nature and volume of data retained in a warehouse require a high level of security and rigorous access governance.

The firm assists its clients, in cooperation with their DPOs, CISOs, IT departments and technical service providers, in integrating legal data security and protection requirements into the architecture of the warehouse.

This includes in particular:

  • pseudonymisation measures;

  • distinguishing pseudonymised data from anonymised data;

  • management of permissions and access rights;

  • user authentication;

  • logging and monitoring of access;

  • separation of environments;

  • health data hosting requirements;

  • relationships with hosting and technical service providers;

  • incident and personal data breach management procedures;

  • data protection by design and by default measures.

Contracts, partnerships and data sharing

HDWs are frequently developed in environments involving several healthcare institutions, research organisations, industry stakeholders, technology providers or other partners.

AUMANS AVOCATS assists its clients in qualifying the relationships between these different stakeholders and in drafting and negotiating the agreements required for the operation and use of the warehouse.

The firm advises in particular on:

  • partnership agreements;

  • joint controllership agreements;

  • data processing agreements;

  • Data Processing Agreements;

  • Data Access Agreements;

  • Data Transfer Agreements;

  • data sharing agreements;

  • agreements governing multicentre research projects;

  • agreements with hosting and technical service providers;

  • international data transfers.

A question ? Contact us !

Anticipating the European Health Data Space

The creation and governance of HDWs must now be considered within the broader context of the European Health Data Space (EHDS).

The new European framework will progressively strengthen and harmonise the conditions governing access to electronic health data and its secondary use for purposes including research, innovation, public health and policymaking.

AUMANS AVOCATS assists its clients in assessing the consequences of this new framework for their warehouses, governance structures, data access procedures and research projects.

This forward-looking approach makes it possible to integrate into current legal, organisational and technical choices relating to the HDW the developments that will progressively shape access to and reuse of health data at European level.

Legal support throughout the HDW lifecycle

AUMANS AVOCATS assists health data warehouse operators from the initial design of the project through to its operational implementation and the subsequent reuse of data.

Our approach combines data protection expertise, knowledge of health research regulation and an understanding of the operational issues associated with data governance and value creation.

The firm may therefore assist with the design of a new warehouse, the preparation of a declaration of compliance or CNIL authorisation application, the audit of an existing warehouse, the implementation of its governance framework, the regulation of research carried out using its data, and the adaptation of the HDW to developments in French and European regulation.

A question ? Contact us !

Follow the latest news from the firm on Life Sciences law…

Our Life Sciences Blog