Health data sovereignty: who owns patient data and where it lives
Health data sovereignty is the principle that health data remains under the legal authority and practical control of the country, and the organisation, that collects it. It has three parts: ownership (who decides how the data is used), jurisdiction (whose law applies to where it is stored and processed), and capability (whether the owner can retrieve, move and audit the data without depending on a supplier). A ministry secures it through national law, governance and, above all, the terms of its contracts.
Every ministry of health that digitises care faces the same set of questions from its legal office, its parliament and its development partners. Who owns the records? Where are they stored? Can a foreign supplier, or a foreign government, see them? What happens to the data if the contract ends? These questions are sometimes treated as obstacles to digital health. They are better treated as design requirements, because a system that cannot answer them clearly will eventually lose the trust of clinicians and patients.
What the international framework says
The WHO Global strategy on digital health 2020 to 2025 provides the reference point most ministries use. Its first guiding principle commits countries to adopting digital health in a way that respects their sovereignty [1]. It states that health data are to be classified as sensitive personal data requiring a high safety and security standard, and it stresses a strong legal and regulatory base to protect the privacy, confidentiality, integrity and availability of data [1]. It asks Member States to establish national data governance mechanisms [1].
The same strategy also discusses health data as a global public good [1]. The tension is deliberate. Health data has value beyond the facility that records it: for surveillance, research and planning. Sovereignty is not the refusal to share; it is the authority to decide when, with whom and under what conditions sharing happens.
The World Bank's World Development Report 2021, Data for Better Lives, frames the same balance as a social contract for data: data should be reused for economic and social value, that value should be shared fairly, and people should be able to trust that they will not be harmed [3]. It recommends regulating personal data within a human rights framework, and proposes an integrated national data system that enables safe data flows among stakeholders [3].
Ownership, custody and control are different things
Much confusion arises because "owning" health data is used to mean several different roles. A contract should name each one.
| Role | Who usually holds it | What it means in practice |
|---|---|---|
| Owner or controller | The facility, health authority or ministry that collects the data | Decides purposes, access, sharing and retention |
| Custodian | A named unit within the owner, such as health information management | Maintains quality, responds to requests, keeps records |
| Processor | The software supplier and any hosting provider | Processes data only on the owner's instructions |
| Data subject | The patient | Holds rights to access, correction and, where law provides, consent over sharing |
The Principles for Digital Development describe the patient's side of this relationship as allowing people and communities to retain control of, and derive value from, their own data [7]. They call for explicit and informed consent before data is collected, used or shared, and for secure data histories that people can move from one service provider to the next [7].
A supplier should never appear in the owner row. Where a contract is silent, ownership can be contested later, often at the worst moment, such as a change of supplier or a request from a research partner.
The state of national law
Many countries procure health systems before their data protection law is complete. UNCTAD's 2020 survey found that 66 per cent of countries had data protection and privacy legislation and another 10 per cent had draft legislation; among least developed countries the share with legislation was 43 per cent [2]. Where the law is incomplete, the contract and the system design must carry protections that legislation would otherwise provide.
Where specific rules exist, they vary considerably:
- Data localisation for national records. Australia's My Health Records Act 2012 contains a section titled "Requirement not to hold or take records outside Australia" [9], an example of a national health record law that sets a location requirement in statute.
- Conditional cross border transfer. The European Union's General Data Protection Regulation devotes a chapter to transfers of personal data to third countries, including transfers on the basis of an adequacy decision [10].
- Regional frameworks. The African Union Data Policy Framework, released in July 2022, affirms the right of states to formulate digital rules in line with their national interests, while advising that localisation must be evaluated against potential harms to human rights and generally cautioning against it [8]. It proposes a regional cross border data flow mechanism with reciprocity as a central principle [8].
The lesson for a ministry is that hosting location is one control among several. Law determines which location requirements apply. Governance determines who may access data wherever it sits. Contracts and technical design determine whether those decisions can be enforced.
International governance is still being written
There is not yet a global instrument on health data governance. The Health Data Governance Principles, developed by Transform Health in 2021 and 2022 with input from more than 200 experts, are organised around three objectives: protect people, promote health value, and prioritise equity [4]. Transform Health reports that more than 170 organisations and governments have endorsed them [5].
Health data governance was placed on the agenda of the 158th WHO Executive Board in February 2026, under an item on harmonising regulatory approaches, governance and standards for data, digital health and artificial intelligence in the health sector, to be carried forward to the World Health Assembly in May [5]. Advocates have called for a global framework, endorsed through a World Health Assembly resolution, setting common standards for the collection, storage, use and disposal of health data and for sharing across countries [6].
In the Western Pacific, WHO notes that many countries still need institutional support to build systematic digital health governance and enterprise planning, and has committed tailored support to Pacific Island countries and areas in developing national digital health strategies [11]. For smaller health systems this makes contract terms and system design even more important, because they must work before national frameworks are finished.
Choosing where data is hosted
Hosting decisions involve trade offs between legal control, resilience, cost and operational capacity.
| Option | Strengths | Questions to settle |
|---|---|---|
| Government data centre in country | Clear jurisdiction; aligns with localisation rules | Power, cooling, backup, staffing and disaster recovery |
| Commercial data centre in country | Jurisdiction in country with professional operations | Provider ownership, certification, contract with the ministry |
| Regional hosting | Shared cost for small states; professional operations | Applicable law, transfer agreements, reciprocity |
| International cloud region | Resilience, scale, security certifications | Transfer permission under national law, provider jurisdiction, key management |
Two points are often missed. First, physical location does not settle jurisdiction on its own; the legal domicile of the hosting provider and the supplier also matters. Second, a hospital that keeps a copy of its working data on site has more practical control during an outage, whatever the primary hosting choice. Systems designed for unreliable connectivity already work this way, as explained in designing health systems for unreliable connectivity.
Sovereignty is written into the contract
The most effective protection a ministry has is a precise contract. The following clauses should appear in any health system agreement.
| Clause | What it should say |
|---|---|
| Ownership | The collecting organisation owns all data and derived data; the supplier acquires no rights |
| Purpose limitation | The supplier processes data only to deliver the contracted service |
| Location and subprocessors | Where data is stored and processed, and a list of every subprocessor, with notice of changes |
| Supplier access | Supplier staff access only for support, with approval, and recorded in the audit log |
| Export | Complete export at any time in documented standard formats, such as FHIR bulk export [12] |
| Exit | A transition period, full data return and certified deletion |
| Breach notification | Defined notification times and responsibilities |
| Secondary use | Research and analytics only with the owner's approval and applicable ethics review |
| Audit rights | The owner may audit compliance and review access logs |
Export deserves particular attention. FHIR Bulk Data Access defines a standard, authorised way to export data for a whole system, all patients or a defined group, in a documented format [12]. A ministry that can retrieve its data in that form does not depend on its supplier's goodwill to change systems, run independent analysis or respond to an inquiry. The standard is explained in FHIR R4 explained for ministries of health.
How Moana approaches data sovereignty
Moana's position is simple: the organisation that collects the data owns it. Moana Digital Health supplies the platform; it is not the owner of the records held in it.
That position is supported by the design of the platform:
- Access control and accountability. Role based access limits each user to the data their role requires. Two factor authentication protects sign in. Break glass access to a record outside a clinician's normal assignment is audited. Every access and change is written to the audit log, which the data owner can review. Details are on the trust page.
- Protection of data. Data is encrypted, and consent for sharing is recorded so that sharing follows the patient's permission and national policy.
- Standard export. The record is available through FHIR R4, and FHIR bulk export allows the owner to retrieve population level data in a documented format at any time. Codes follow international standards (ICD 10, ICD 11, LOINC and SNOMED CT), so exported data remains meaningful outside Moana.
- Controlled secondary use. MOANA Clinical Research supports cohort discovery and feasibility counts with small counts suppressed, consent and a full audit trail, so research proceeds only under the owner's governance, as described on the research page and in clinical trial recruitment from routine health records.
- National reporting under national control. Aggregate indicators are reported into DHIS2, and MOANA Surveillance provides national dashboards to the ministry that owns the data.
The hosting arrangement is set out in the contract with each organisation, in line with the national law that applies. For governments, the governments solutions page describes how Moana works with ministries at national scale.
Key questions for procurement
Does health data sovereignty require all data to be hosted in country?
Not necessarily. It requires that national law is followed and that the owner retains control. Some laws set location requirements for particular records [9]; others permit transfers under conditions [10]. Ministries should confirm the legal position first, then choose a hosting model that meets it.
Who should own the data in a public private arrangement?
The organisation that collects the data, usually the facility, health authority or ministry. The supplier should be a processor acting on instructions, with no independent rights to the data or to anything derived from it.
How can a ministry be sure it can leave a supplier?
By requiring complete export in documented standard formats, such as FHIR bulk export [12], together with a transition period, full data return and certified deletion. Exit should be tested during implementation, not at the end of the contract.
Can patient data be used for research under sovereignty rules?
Yes, under the owner's governance. Research access should require approval, ethics review where applicable, consent where the law requires it, suppression of small counts in aggregate results and an audit trail of every query.
What if the country has no data protection law yet?
Use the contract to carry the protections. UNCTAD found that a third of countries lacked data protection legislation in 2020 [2]. The WHO strategy's call for national data governance mechanisms [1] gives ministries a basis for setting those terms in policy while legislation develops.
Sources
- Global strategy on digital health 2020 to 2025, World Health Organization, 2021
- Data and privacy unprotected in one third of countries, despite progress, UNCTAD, 2020
- World Development Report 2021: Data for Better Lives, World Bank, 2021
- Health Data Governance Principles, Transform Health, 2022
- A critical moment for global action on health data governance, Transform Health, 2026
- A global health data governance framework: maximising public value of health data whilst protecting individual rights, UN World Data Forum, 2024
- Establish people first data practices, Principles for Digital Development, 2024
- The African Union's Data Policy Framework: context, key takeaways and implications, Future of Privacy Forum, 2022
- My Health Records Act 2012, Federal Register of Legislation, Australian Government, 2025
- General Data Protection Regulation, Chapter V: transfers of personal data to third countries, European Union, 2016
- WHO global and regional strategy on digital health, PHIN meeting paper, World Health Organization and Pacific Community, 2023
- Bulk Data Access implementation guide, export specification, HL7 International, 2020
