Data sovereignty

Why it matters

The WHO Global strategy on digital health 2020 to 2025 commits countries to adopting digital health in a way that respects their sovereignty, and asks for health data to be treated as sensitive personal data requiring a high safety and security standard [1]. Sovereignty is not the refusal to share; it is the authority to decide when, with whom and under what conditions sharing happens.

Key points

• Many countries procure health systems before their data protection law is complete. UNCTAD found in 2020 that 66 percent of countries had data protection and privacy legislation, against 43 percent of least developed countries [2].
• Some national laws set a location requirement in statute; Australia's My Health Records Act 2012 contains a section on the requirement not to hold or take records outside Australia [3].
• Where the law is incomplete, the contract must state ownership, hosting location, access, export rights and what happens to the data at the end of the agreement.
• Sovereignty depends on the practical ability to take a complete copy of the data in a standard format.

In Moana

In Moana, the organisation that collects the data owns it, and FHIR bulk export provides a complete copy in a standard format.

Sources

1. Global strategy on digital health 2020 to 2025, World Health Organization, 2021
2. Data and privacy unprotected in one third of countries, despite progress, UNCTAD, 2020
3. My Health Records Act 2012, Federal Register of Legislation, Australian Government, 2025