Building a Global Framework for Digital Health Services in the Era of COVID-19

May 26, 2020
Health data and digital technologies will be essential for improving global health outcomes beyond the COVID-19 pandemic. Low- and middle-income nations, with fledgling digital health strategies and many barriers to overcome, stand to benefit the most.
Building a Global Framework for Digital Health Services in the Era of COVID-19


The Promise of Digital Health

The Building Blocks for Digital Health

International Governance to Support the Protection, Flow, and Use of Health Data

Multilateral Governance and Support of Digital Health



Appendix: Case Studies Showing How Digital Health Can Help LMICs



Digital health—the use of information and communications technology (ICT) to provide and improve health services—holds transformational potential for health care around the world. Many digital health products are already proven, readily available, and adaptable to all kinds of countries. Digital health can help low and middle-income countries (LMICs), in particular, overcome traditional barriers to better health care, especially staffing and other physical resource constraints. Digital technologies are showing their potential during the current coronavirus crisis by facilitating collaboration between health-care researchers and reducing the need for in-person care. While health data and digital technologies are not a silver bullet to COVID-19 and other health issues, they will be crucial to improving overall health outcomes in countries around the world. LMICs need to work with international partners, such as the World Health Organization (WHO) and development banks, to marshal the resources, expertise, and strategies to help them realize the true potential of digital health.

COVID-19 underlines the importance of international cooperation and collaboration to global health.

A global digital health framework is only at a nascent stage. Understandably, policymakers in all countries are first dealing with the considerable challenge of adapting technology to their own domestic health frameworks. And international organizations are only just starting to develop the common principles, best practices, and tools to help late adaptors and developing countries catch up with leading countries. The risk is domestic frameworks will fragment away from international standards, thereby preventing health companies and research organizations from leveraging health data and digital technologies in order to provide new and better services across different countries. COVID-19 has underlined the importance of international cooperation and collaboration to global health.

LMIC policymakers and their international health and development partners must focus on foundational issues—namely, a national digital health strategy, digital skills, ICT infrastructure, and data governance—to build effective domestic and global digital health frameworks. This report aims to support these policymakers in doing this. The first section outlines the promise of digital health (the appendix includes case studies from several regions that illustrate how this is working in practice). The paper then gives an overview of core enablers for digital health, including an analysis of the importance of ICT infrastructure and digital skills, and domestic and international data governance. The paper then reviews the growing focus on digital health by multilateral organizations and other nongovernmental organizations (NGOs).

The paper concludes with general findings and recommendations, summarized below:

  • Countries should develop holistic national digital health strategies. There is wide disparity in progress in this area among LMICs, with several important countries having no formal national plans. Digital technologies will not achieve anywhere near their full potential absent a plan that provides the necessary resources, coordination, cooperation, and leadership. These plans need to be holistic, in part, as each country’s situation will be somewhat different, including the considerable complexity that comes from integrating digital technologies with legacy health systems.
  • Several multilateral organizations and private-sector initiatives have elevated the focus on digital health at the international level, such as the WHO-backed global digital health strategy. LMICs should work with WHO and other actors to mobilize the resources and expertise to help develop and implement—or improve—their own digital health strategies.[1]
  • Training and education to use digital technologies is critical, but few LMICs have integrated digital skills into their health-workforce training. Regional and multilateral health organizations, donors, and other stakeholders should prioritize efforts to help LMICs address the most pressing skills gaps.
  • There are particularly acute gaps in ICT infrastructure in LMICs, which are home to most of the people that remain disconnected from the Internet. Poor ICT infrastructure severely limits the potential of digital health. Regional and multilateral development agencies, and other donors, should fill these gaps to cover private-sector shortfalls—for example, with regard to wireless mobile coverage in rural areas.
  • LMICs need to enact a data governance framework that balances data privacy and protection with innovation. The generation, protection, use, sharing, and international transfer of high-quality data is fundamental to an effective and innovative digital health program. An overly restrictive data governance framework will limit the potential of digital health technologies.
  • Policymakers need to build interoperability into their frameworks from the start, as many of the benefits of digital health technologies require cross-border transfers of data. This is critical, as many firms and research organizations involved in digital health rely on the Internet, the free flow of data, and centralized IT facilities to easily, cheaply, and reliably access data, patients, and health-care providers around the world. The emergence of a meaningful, integrated global digital health framework will depend on national governments enabling cross-border flows of data.

The Promise of Digital Health

Simply put, “digital health” refers to the use of digital technologies for health. It is an umbrella term that includes electronic health (eHealth), mobile health (mHealth) and emerging areas such as the use of artificial intelligence (AI), big data, and genomics.[2] As populations age and noncommunicable disease burdens rise, there will be even greater pressure on health-care systems, underscoring the need to deploy current and new technological solutions.[3] WHO has stated that “universal health coverage cannot be achieved without the support of eHealth.”[4]

Digital health holds considerable promise.[5] It can make health information, care, and diagnosis more accessible, such as through telemedicine.[6] This is especially true for people in hard-to-reach places, given the proliferation of low-cost smart phones and medical devices. Digital health can enable health-care providers and services to become more efficient and of higher quality. In particular, the enhanced use of health data offers the prospect of more personalized and coordinated care, and better, faster treatment at a lower cost.[7] AI has advanced to the stage where it can mitigate shortages of specialists, providing reliable diagnosis and lower-cost services in fields ranging from tuberculosis to diabetic retinopathy. Similarly, AI can use the greater availability of health data to identify and prevent emerging health issues, such as epidemics. When combined with software, better, richer datasets allow health system managers to identify, plan, and allocate resources more efficiently. Digital health can also accelerate the drug development process.[8] For example, AI can integrate and analyze a broader range of “real-world” data from mobile and wearable technologies and social media, and combine it with traditional lab and clinical data.[9]

Many of these benefits are already evident, and hold particular promise for LMICs given they can be deployed at significantly lower cost than traditional brick-and-mortar health services. Indicative of this, digital health technologies are currently undergoing a surge in uptake. Globally, 44 percent of mobile users have seen a medical professional for diagnosis or treatment via their mobile device.[10] According to IQVIA (a U.S. health technology firm), the number of mHealth products and services has doubled in the past 5 years in LMICs, and there are now over 165,000 mobile applications for health services.[11] In fact, mobile health services are more popular in LMICs, with 59 percent of patients in LMICs using mHealth applications and services, compared with 35 percent in high-income countries.[12]

As populations age and noncommunicable disease burdens rise, there will be even greater pressure on health-care systems, underscoring the need to deploy current and new technological solutions.

There is potential for digital health to benefit the wider economy, not only through significant cost savings but also via increases in productivity as patients receive faster, more accurate diagnoses and treatment.[13] For example, Canada measured the cost savings generated by its digital health investments and reported an aggregate saving of US$11.2 billion since 2007.[14] Many studies anticipate considerable cost savings from digital health, such as a 2013 GSMA study that estimated mHealth technology could result in $400 billion worth of cost savings over a 5-year period in high-income countries.[15] A review of 14 evaluations of digital health interventions across a range of high-income countries found them all to be cost effective and an improvement over existing interventions.[16]

The Building Blocks for Digital Health

Despite the potential benefits of digital health, few nations have put in place the policies, programs, or strategies needed to take full advantage of it. The 2019 Global Digital Health Index assesses the state of preparedness and adoption of digital health in 22 countries of varying stages of economic development (see figure 1).[17] It also measures the readiness of the wider health system to successfully adopt and deploy digital health interventions. The Index is benchmarked according to components of the WHO and International Telecommunications Union (ITU) eHealth Strategy Framework, which uses 19 indicators in 7 policy areas: leadership and governance; strategy and investment; services and applications; standards and interoperability; infrastructure; legislation, policy and compliance; and workforce.

The Index notes that while many countries have national digital health strategies, most lack national digital health architectures, health information exchanges, and data standards, all of which undermine the potential benefits of digital technologies.[18] This section explores some of the core enablers of the Index—education and workforce training, infrastructure, and governance—in explaining what makes an effective digital health strategy.

Figure 1: 2019 Global Digital Health Index[19]

A screenshot of a cell phone

Description automatically generated

National Digital Health Strategies

Developing a national digital health strategy is a critical first step for identifying, prioritizing, and addressing barriers and shortfalls in key enablers for digital health. A comprehensive local assessment is crucial to developing a long-term plan, coordinating with development and other partners, and mobilizing the political support necessary for resourcing and implementation.[20]

An effective digital health strategy requires leadership and buy-in from federal (and regional) governments, supported by representatives from all relevant government agencies and nongovernment stakeholders, including the private sector, nonprofit organizations, and overseas development agencies. A whole-of-government approach is needed as health agencies cannot operate in a silo disconnected from ICT, economic, science, health, and innovation agencies, as well as data privacy and protection agencies.

Proper financial support is essential, especially given new programs and technologies will be layered on top of existing IT systems and organizational structures, which often means significant up-front costs. This also highlights the need for governments, development partners, and other stakeholders to invest in coordinated plans rather than ad hoc projects and policies. Unfortunately, many LMICs have already succumbed to the latter approach and face a proliferation of uncoordinated digital health projects, which is more likely to lead to unsustainable and ineffective uses of digital health tools.[21]

While many countries have recognized the importance of national digital health strategies, there are significant gaps in many regions around the world. WHO’s 2015 survey of eHealth policies revealed that 72 countries (58 percent) of the 125 member countries (that responded) have defined national digital health strategies and corresponding plans to implement them (see figure 2).[22] Notable exceptions include Brazil, India, Indonesia, and Mexico. The Global Digital Health Index observes that Malaysia, the Philippines, and Jordan are well advanced in this area, with fully costed national plans currently being implemented.[23] Malaysia in particular is lauded for its integrated digital health strategy, which has been ongoing for 15 years and is linked to the national 5-year rolling Malaysia Plans for social and economic transformation.

Thankfully, international agencies are working to help countries that have yet to develop a national strategy. For example, WHO’s International Telecommunications Union (ITU) National E-Health Strategy Toolkit aims to assist member states in the development and implementation of digital health policies and strategies, and subsequent integration with their national health-care systems. The toolkit is an expert, practical guide that provides a solid foundation and method for developing and implementing a national digital health vision, action plan, and monitoring framework.

Figure 2: Countries with national eHealth policies or strategies[24]

People Need the Right Skills to Leverage Digital Health

Using data and digital technologies for better health outcomes is contingent on a nation having a digitally competent workforce. The lack of digital skills is obviously not unique to the health-care sector in LMICs, but given the impact on people’s well-being, requires special attention. Skills shortages directly undermine the use of digital health interventions.[25]

Unsurprisingly, in many LMICs, there are basic digital skills shortages across both the health workforce and patients, especially in rural and remote areas. According to the 2019 Global Digital Health Index, the skills base among health-care professionals is generally low. Only 2 of the 22 countries surveyed by the Index include digital health in training for health-care professionals, with less-significant gaps among physicians, and more-significant gaps in training for nurses and community health workers. Skills gaps are particularly pronounced in WHO’s Eastern Mediterranean region, with Southeast Asia having the strongest base of skills to enable digital health.[26]

The need to improve digital skills is recognized as a key objective of WHO’s “Global Strategy on Digital Health 2020–2024.”[27] The ideal long-term solution would be introducing or bolstering digital skills at primary, secondary, and tertiary education levels. However, given resource constraints and the need for quicker results, upskilling health workforces to make them digitally competent could be a more pragmatic strategy. Best practice involves introducing digital skills into the heath education curricula for health-care workers both pre- and post-deployment, ideally for both clinical staff and community workers. This can be done as part of general capacity building efforts as well as those related to specific digital health projects, and could happen at workforce training institutions (such as for vocational training) and private-sector-led programs (such as for re-skilling). These private-sector-led training and certification schemes could bridge the digital skills gap, without people needing to go back for formal, secondary, or tertiary-type education and training.[28]

In the longer term, governments need to find a pathway for workers to pursue STEM (science, technology, engineering, and mathematics) courses and advanced digital skills. Similarly, policymakers need to ensure people in health-policy leadership positions have the skills and knowledge to develop and manage in-country digital health initiatives and strategies.[29] An example of this is the Digital Health Leadership Program, which supports African digital health leaders, particularly those in government agencies.[30]

Ghana: Digital Skills for Pharmacists to Manage Hypertension

The community-based hypertension improvement project (ComHIP), in the Eastern Region of Ghana, offers training to licensed medicine sellers in the community to screen for and provide adequate health education and information on hypertension to their clients. This model, underpinned by a comprehensive digital health platform, maximizes opportunities for screening and diagnosis of hypertension in a peri-urban area of sub-Saharan Africa, and brings chronic disease care closer to the community. The project demonstrates how targeted training of end users of digital health platforms can be effective in improving health outcomes.

Addressing the digital skills gap for health outcomes is a major challenge made more difficult by constantly evolving technology. In late 2018, the Digital Frontiers Institute convened a seminar series entitled “Digital Health: Building a Future Proof Workforce” to examine this issue, including skills needs and gaps.[31] Some of the key gaps identified include digital health leaders, managers, and policymakers; digital health program designers and implementers; architects, programmers, engineers, and data scientists; and digital health skills for health professionals including doctors, nurses, and administrators. This highlights the challenge of ensuring countries have enough personnel with the sufficient technical expertise for back-end IT system design and operations. For example, for sustainable digital health infrastructure, participants at the Digital Frontiers Institute identified the skills required to deploy and maintain hardware, software, and connectivity, as well as the ability to build basic, reusable infrastructure that generates economies of scale.[32] Specific skills that help health systems become more adaptable to changing technology include data scientists; visualization analysts; enterprise architects; data architects and modelers; machine learning and natural language processing specialists; systems networking and communications experts, including human to machine interaction; and security and cryptography experts.

The lack of digital skills is obviously not unique to the health-care sector in LMICs, but given the impact on people’s well-being, requires special attention.

WHO’s Action Plan for the Global Strategy of Digital Health 2020–2024 proposes all WHO member states commit to enhancing training capacity, including bolstering the capacity of tertiary institutions and developing relevant curricula.[33] Encouragingly, the 2019 Global Digital Health Index reports momentum toward the creation of digital health, health informatics, health information systems, and biomedical informatics degree programs, which are starting to show promising results in creating specialized digital health workers, particularly in countries such as Bangladesh, Chile, Ethiopia, Kuwait, Malaysia, Peru, Portugal, Sri Lanka, Thailand, and Uganda. However, most countries report there is not enough training to meet current demand, and digital considerations are yet to be properly reflected in the career paths of civil servants working on health issues.

Governments, donors, and other stakeholders should develop common templates for identifying and responding to the most-needed skills, and matching them with a corresponding list of best practices and programs for training and educating workers. They could be based on a “lowest common skillset” so LMICs could work to address and get over the most critical digital skills gaps. There should be many shared factors between LMICs, meaning a common template would be useful in avoiding wasting both time and money, with each country creating its own, detailed assessment. Within this template response, regional and multilateral health organizations and relevant donors and private-sector stakeholders should work with local governments to identify and prioritize the most-pressing areas that act as bottlenecks to improved outcomes.

ICT Infrastructure Defines the Limits of Digital Health Access and Use

Digital health, like every other digital service, relies on physical ICT infrastructure. People, businesses, and government agencies need to have access to reliable and affordable Internet services, whether they are broadband or mobile networks. LMICs and their development partners need to address this costly and complicated issue before they can even get to the issues around the digital applications that rely on the Internet. Therefore, closing the ICT infrastructure gap in developing countries will be critical to closing the digital health divide.

Digital health is growing in relevance and scale as more and more people access the Internet—at the end of 2018, the ITU estimated that over half of the world’s population was using the Internet.[34] However, there is significant variation in coverage and accessibility of mobile cellular networks, especially where they are needed most: In the world’s 47 least-developed countries, more than 80 percent of the population is still offline.[35] This directly affects the ability of countries to deliver digital health programs. Not surprisingly, according to the Global Digital Health Index (which draws on the World Economic Forum’s Network Readiness Index), the maturity of digital health infrastructure has a strong correlation with a country’s stage of development.[36] However, the Index notes that some countries are focused on addressing the gap through plans to improve infrastructure for public health facilities and offices, with Bangladesh, Jordan, and Thailand particular standouts.[37]

ICT infrastructure (along with energy) attracts two-thirds of private infrastructure financing in LMICs, in large part due to the capital intensity of the sector and the clear commercial opportunities in providing Internet connectivity.[38] But this is not the case across all LMICs. This leaves gaps where national governments and development agencies have a clearer role to step in. However, development agencies have not yet deployed much capital (or attention) to improving ICT infrastructure in LMICs as part of a holistic digital development strategy. At the moment, only a small proportion of development budgets go to helping LMICs improve their ICT infrastructure. Only 1 percent of all funding provided under what are known as “Aid for Trade” programs is currently allocated to ICT solutions. Similarly, multilateral development banks are investing just 1 percent of their total investment in ICT projects.[39]

Development agencies need to consider the specific impact that gaps in ICT connectivity have on digital health plans and programs, and come up with plans and resources to help close them. It’s unlikely private-sector financing will address all gaps in connectivity, as not all projects (such as in rural areas) will be commercially viable for private firms. National governments and development partners should work together to come up with policies and resources to help build ICT infrastructure in these areas.[40] This could include new business models that aggregate demand among public buyers who want to reach marginalized and remote people, thus helping to facilitate the development of local markets for the provision of health care and other digital services—and providing incentives to make requisite investments.[41] Given those countries and communities that remain disconnected also stand to benefit the most from digital technologies, improving their connectivity should be a top priority.

Building Health Data Governance: Collecting, Protecting, and Sharing Data for Better Health Outcomes

Data lies at the center of digital health innovations. However, health data is among the most heavily restricted forms of data (in terms of collection, use, sharing, and transferring). Health data does require specific attention as it involves sensitive personal data. Yet enacting overly severe restrictions on its use does nothing to help improve health outcomes. Policymakers in countries of all stages of development have not enacted or updated laws and regulations around health data governance such that privacy and data protection concerns are addressed while ensuring there exists a clear framework for people, firms, and governments to share and use health data (in a protected and responsible manner) to achieve its maximum potential. What this shows is that there is a disconnect between policymakers (generally) recognizing the potential of digital technologies—including for health—and how it requires changes to data governance frameworks. For example, WHO’s 2015 Atlas of eHealth Country Profiles shows only 17 percent of respondents had a strategy to govern the use of big data in the health sector.[42]

The lack of supportive health data governance frameworks around the world comes amidst an explosion in the range and volume of health data and services. The proliferation of wearable technology and other smart devices has greatly expanded the volume of patient-generated health data.[43] The ubiquity of mobile phones in LMICs has changed the situation for both health systems and individuals. Already, 1 in 10 mHealth applications have the capacity to link to a sensor or device.[44] These new technologies provide opportunities to not only generate, collect, and use large amounts of real-world data related to health outcomes—defined as observational data obtained outside the context of randomized control trials and during clinical practice—but also make the delivery of new digital health services significantly cheaper and easier for a much broader range of people.[45]

The following section analyzes key issues for health data governance: improving data collection, improving data protection, and facilitating access to health data.

Using Data to Personalize Asthma Treatment

United States-based company Propeller Health has made a GPS-enabled device that tracks data about the usage of inhalers by asthma patients. The system then integrates public information from the Centers for Disease Control and Prevention (CDC) about environmental asthma triggers so health-care providers can create personalized treatment plans.

Improving Health Data Collection

A data-driven approach to health governance can address one of a government’s biggest challenges: incomplete information.[46] Digital health programs will be of limited use if they do not have the necessary data in the first place, data coverage or data quality is poor, or they do not have systems in place to update and improve on this data. It is therefore crucial that countries, and their respective regulatory agencies and international partners, include reasonable and responsible data collection efforts to ensure data is representative, complete, and useful. The private sector can play a role in helping governments and their partners understand the health of a population, such as through public-private data sharing initiatives (explored in the next section).

National governments, and their partners, need to integrate health data collection into broader initiatives in order to improve the institutional capacity of local agencies to collect data—as well as undertake health-specific initiatives to improve data collection. The challenge facing LMIC governments’ traditional data collectors, such as national statistical offices and health agencies, is substantial, as many of these agencies lack resources and independence. Misaligned program incentives can also contribute to inaccurate data collection, among other issues.[47] However, international agencies are working to address this, including at the Partnership in Statistics for Development in the 21st Century and the Praia Group on Governance Statistics, as well as at the United Nations, the African Development Bank, and other multilateral institutions.[48]

A good example is the Health Data Collaborative (HDC), a joint effort by international agencies, governments, donors, and academia to improve health data.[49] HDC partners work alongside countries (such as Cameroon, Kenya, Malawi, and Tanzania) both to improve the availability, quality, and use of data for local decision-making and in tracking progress toward the health-related Sustainable Development Goals.[50] HDC shares a wide array of datasets, including information on routine health information systems, community data, facility surveys, measurement of quality of care, logistics management and information systems, disease surveillance, population data sources, household surveys, civil registrations, and other vital demographic statistics. HDC is developing a one-stop shop for health information system standards that will include guidelines for data collection, a standardized package of recommended indicators, data quality metrics, and other harmonized standards and survey tools.[51]

A data protection framework is a basic building block that remains missing in many countries.

Within data collection efforts, it is also important to ensure data collected is representative of the population.[52] Doing so helps address the emerging “data divide”—the social and economic inequalities that may result from a lack of collection or use of data about an individual or community.[53] For digital health innovations to be useful, individuals, firms, researchers, and governments must have access (within respective data privacy and protection regimes) to high-quality data about themselves and their communities. If certain groups have no data collected about them, new inequalities may emerge as individuals in these communities are left outside digital health programs and interventions. Specifically, policymakers can enact data collection initiatives that focus on hard to-reach populations, ensure that funding programs aimed at closing the digital divide consider the impact on data poverty, and help civic leaders in low-income areas understand the benefits of data and data-collection efforts.[54]

Enacting a Balanced Health Data Privacy and Protection Framework

Data privacy and protection are particularly important in health care given the sensitivity of personal health data and the massive growth of technology that can easily generate and share this data. According to the Identity Theft Resource Center, in 2018, there were 363 data breaches globally in medical and health-care organizations.[55] Given this, it’s understandable why many people and policymakers are rightly fearful of health data breaches and misuse. But addressing this issue requires ensuring governments and firms follow an effective data protection (and enforcement) framework.

A data protection framework is a basic building block that remains missing in many countries. According to the United Nations Conference on Trade and Development, most countries around the world (107, or 58 percent) have data privacy and protection legislation in place, including specific rules governing health information. However, this leaves a sizable proportion of countries, especially LMICs, without any framework in place.[56]

Privacy and security protections are important, as rules that are too weak can make users feel uneasy about adopting new technologies and services. Obviously, the priority for LMICs is setting this baseline level of rights and responsibilities for individuals and organizations around the collection, use, storage, and sharing of data, and the enforcement of these rules. However, beyond a baseline of protections, stronger privacy protections do not translate into more digital trust and therefore more digital adoption and use.[57]

As the Information Technology and Innovation Foundation’s (ITIF) report “Why Stronger Privacy Regulations Do Not Spur Increased Internet Use” shows, the relationship between consumer trust and the adoption and use of technology and regulations is not linear or stepwise, but an inverted U-curve.[58] In the first stage, which ITIF calls the “Unruly Rise,” light regulation can increase user adoption and use of Internet applications—although consumers may have low levels of trust because regulations do not add a sufficient baseline of protections. In the second state, the “Innovation Zone,” a reasonable baseline of protections promotes both trust and innovation, thereby ensuring high levels of user adoption and use of Internet applications. However, if policymakers create overly restrictive rules, the use of online services will likely fall or grow more slowly than it would otherwise due to a reduction in supply caused by costly and revenue-limiting regulations. The dangers of the third stage, which ITIF calls “Regulatory Hell,” is that overly strict rules actually harm consumers by creating excessive burdens on digital innovation.

Figure 3: Inverted U-curve showing relationship between regulation and technology adoption and use

Data protection and privacy frameworks should therefore strive to balance the need to protect privacy and encourage innovation. A regime being too restrictive clearly impacts the latter, as a Broadband Commission for Sustainable Development (a joint initiative by the ITU and the United Nations Education, Scientific, and Cultural Organization (UNESCO)) noted, citing how this balance is necessary to create a patient-centered and sustainable health-care system.[59] The impact (and cost) of enacting an overly restrictive data privacy framework can prevent the development and use of digital health technologies.[60] This is why appropriately robust, but balanced, data protection policies should be at the heart of a country’s health data governance framework.[61]

LMIC policymakers should put the principle of accountability at the heart of their data governance frameworks.[62] When it comes to handling data, companies doing business in a country should be responsible and held accountable under that nation’s laws and regulations, regardless of whether they are located inside or outside the country wherein the firms collect or manages data. This legal responsibility should cover both the firms’ own actions and the actions of their agents and business partners. As it relates to enforcement, policymakers should focus on holding these firms accountable, regardless of where they store, process, or transfer data. Focusing on accountability, and not where data is stored, is also crucial to building integrated, interoperable markets for health services.

The accountability principle is not new. It as a central feature of one of earliest international instruments on privacy: the Organization for Economic Cooperation and Development’s (OECD) Privacy Guidelines, originally published in 1980.[63] Many nations have made it a central part of their data privacy frameworks. For example, most U.S. firms must disclose certain data privacy practices and adhere to those requirements, even when processing data outside the country, as they remain responsible for the data regardless of where it is processed. U.S. companies mitigate these risks by stipulating requirements in relevant data-handling and processing contracts they implement with other companies. For example, foreign companies operating in the United States must comply with the privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA), which regulates U.S. residents’ privacy rights for health data—even if those firms move data outside the United States.

There is no “one-size-fits-all” approach to data privacy and protection, but there are common principles and processes, such as the OECD privacy principles.

Unfortunately, some LMICs are misguidedly copying and pasting other countries’ models for data governance without analyzing whether individual provisions, as well as the overall frameworks, are suitable for their specific country or their objectives.[64] The clearest reference models are the European Union, with its complex, onerous, and restrictive General Data Protection Regulation (GDPR), and China (with its restrictive “cyber sovereignty”). Countries often do this to save time, due to their attraction to certain parts of foreign models (such as government control of and access to data), and to pursue short-term goals (such as an EU “adequacy” determination to allow flows of EU personal data).

There is no “one-size-fits-all” approach to data privacy and protection, but there are common principles and processes, such as the OECD privacy principles.[65] This is where the focus should be. Each country’s data governance framework should be based on these shared international principles, but also reflect its own specific context, goals, and level of development. It would be costly (both economically and socially) for LMICs to think they have to replicate the EU’s approach before pursuing digital health and other objectives. LMICs should not have to wait to achieve a certain harmonized approach to data privacy before seeking to use and transfer health data. LMICs’ data protection frameworks should evolve alongside their efforts to pursue digital development, including for health outcomes. International health and development agencies should provide the resources and expert advice to help policymakers in LMICs find and enact the models that best fit their situations and objectives.

Facilitating Health Data Sharing and Access

To get the most out of health data, policymakers need to pay more attention to rules that facilitate the sharing of data. At the moment, most health data laws and regulations focus on individuals’ ability to restrict the use of their medical data, with scant attention paid to supporting their ability to share personal data for the common good.

Few countries have established norms and best practices for sharing health data. WHO’s 2015 Atlas of eHealth Country Profiles shows only 34 percent of surveyed countries have a legal or policy framework to manage the sharing of data through electronic health records (EHRs) between health professionals in the same country, and only 22 percent with regard to EHRs sharing between countries.[66] Furthermore, only 54 percent of countries have EHRs, which are a critical format for potential sharing.[67] Policies to support the sharing of data for research purposes are even rarer, with only 39 percent of countries having a framework to govern the sharing of personal and health data between research entities.[68] Only 17 percent of survey respondents had a strategy to govern the use of big data in the health sector.[69] This lack of governance only hinders the development and delivery of data-driven health solutions.

Figure 4: Countries allowing sharing of personal and health data between research entities (left) and between health professionals (right)[70]

Indicative of this situation, the failure to share timely data was cited as one of the key impediments to mounting an effective response to the Ebola virus outbreak in Africa.[71] Governments and stakeholders had major issues trying to access and share call-data records (which include callers’ identities, the times of the calls, and the phone towers that handled them) during the outbreak.[72] Stakeholders ran into issues surrounding cooperation with phone companies, technical standards for requests, privacy protections, and contracts specifying who can access the data and for what use.[73] This is why countries and international organizations need to develop frameworks to facilitate the sharing of data at the regional and international levels before an international health crisis such as Ebola or COVID-19 emerges.[74]

Governments can also promote access and sharing of public data through “open-data” regimes.[75] A growing numbers of countries recognize the value in ensuring nonconfidential publishable data, including metadata, be made available free of charge online and in a format that is machine readable. By allowing open data, government agencies can foster data-driven innovation by government, private-sector organizations, civil society, academia, and individuals. Access to data has clear implications for health, particularly in the management of infectious disease outbreaks, and the allocation of resources according to factors such as disease prevalence, etc.

Open-data regimes can also maximize access to taxpayer-funded research data, ensuring it is available for reuse as quickly as possible. For example, in February 2013, the White House Office of Science and Technology Policy released a memorandum directing each federal agency with over $100 million in annual research and development (R&D) expenditures to develop a plan to increase public access to the results and data produced as a result of federally funded research.[76] Giving researchers access to study data as rapidly as possible helps maximize the benefits of data, allowing researchers to reuse the data for new research.[77]

Governments can promote access and sharing of public data through “open-data” regimes.

However, open data policies are still relatively new and underutilized in LMICs. For example, the progress of countries in sub-Saharan Africa toward enacting broad, consistent, and reliable open-data frameworks is slow overall and varied in practice (with cases of progression, but also regression, across the region).[78] Many countries lack the capacity, finances, or agreements to facilitate access to public and privately held data.[79] Open data in many LMICs is also hindered by state-centric cultures within which it is considered sufficient to have public institutions alone responsible for controlling and monitoring data collection.[80] Thankfully, LMIC policymakers have access to a growing range of supra-national institutions (such as United Nations agencies, the World Bank, and the African Development Bank) and NGOs that offer resources and advice specifically on open data and related issues.

Policymakers can also experiment with new institutional models, such as public-private partnerships, to improve data collection and access.[81] Governments can work cooperatively with private-sector firms on facilitating access to their specific country’s data so as to improve understanding of their nation’s residents, economy, and society—and their ability to address public policy issues, such as in health. However, absent some market failure, this needs to be done on a voluntary basis, given forced access to data would otherwise undermine the commercial incentive for firms to generate and use data in the first place. Policymakers need to partner with private-sector firms to ensure their proprietary, legal, and competition concerns are addressed.[82] Thus far, the structures for sharing such proprietary data are not standardized, so private data in most existing public-private partnerships is only made available on an ad hoc basis.[83]

Governments, especially public research agencies, can also encourage voluntary and mutually beneficial data sharing among private firms, researchers, and medical organizations—which may involve creating the technical architecture. For example, the U.S. Department of Health and Human Services (HHS) recently announced proposed new rules that would facilitate access to patient data by both patients and the health-care industry, in part by mandating the use of open application programming interface (APIs), which allow different software and databases to exchange data.[84]

Governments may need to step in to encourage firms in particular areas to voluntarily share data. Although there is a net benefit from data sharing to patients and researchers, there is not always a short-term benefit to companies for making their data available to their competitors. A model effort is the Accelerating Medicines Partnership, a U.S. National Institute of Health-led drug discovery collaboration among 10 drug makers, wherein participating companies have created a shared database that exceeds the capabilities of any individual company’s data holdings.[85] Similarly, some pharmaceutical firms have recognized that sharing is in their collective interest and have participated in data-sharing programs, including the Accelerating Medicines Partnership and a GlaxoSmithKline-led initiative to share patient-level clinical trial data with other participating pharmaceutical companies.[86] In other areas, such as medical device manufacturing, wherein data sharing has been a more difficult prospect, policymakers should conduct a review to identify factors preventing companies from sharing data with one another.[87] And HHS recently announced proposed new rules that would facilitate access to patient data by both patients and the health-care industry, by mandating the use of open APIs.[88]

Unfortunately, private-sector engagement in developing and creating these types of data-sharing frameworks and partnerships is very low in many LMICs.[89] There are examples wherein private-sector firms help provide data-driven insights that support health outcomes, such as MedAfrica using open data to improve access to health information. Similarly, the cell phone company Orange has an open-data challenge “Data for Development.”[90] Similarly, GovLab (based at New York University) helps different stakeholders—firms, research organizations, governments, and others—increase the availability and use of data by facilitating the exchange of data between different stakeholders.[91] It has facilitated dozens of projects that involve health-related data.[92]

Finally, policymakers should ensure patients themselves have access to the data they generate, and allow them to share it. At present, in most countries, there is no simple way for patients to contribute their personal data for use in medical research.[93] This type of policy tool, similar to the Blue Button initiative for general health data in the United States, would give individuals insights into their own health and allow them to authorize third parties to create applications using that data, which holds the promise of helping their health in the future through better treatments.[94]

These data-sharing efforts will help advance patient care in LMICs. Policymakers need to include these types of public and private data-sharing initiatives in their digital health strategies, as they will be crucial to achieving the end goal whereby respective parties can reasonably and responsibility access, share, and coordinate the full range of medical information—including medical histories, genomic data, behavioral data, and other sources—in order to provide better care to individual patients.

International Governance to Support the Protection, Flow, and Use of Health Data

International data governance that allows the movement of health data and services across borders will be crucial to building an integrated and effective global digital health framework. Just as diseases such as Ebola, malaria, and COVID-19 don’t stop at nations’ borders, health-care researchers and providers need to be able to effectively move data about these and other health challenges across borders in order to prevent and treat them.[95] The benefit of health data flows returns to the host country in the form of better, quicker, and cheaper health services and outcomes. Some examples of digital health programs that take advantage of the international flow of data are detailed in the appendix, for example Portal Telemedecina in Brazil, which uses cloud computing and AI to speed up diagnoses for patients living in remote areas; and U.S.-Chinese collaborations in using AI and machine learning to accelerate the process of drug discovery.

The following sections analyze the building blocks for an effective international health data governance framework: barriers to transfers of health data and the need to build interoperability between data protection frameworks.

Forced Health Data Localization Undermines Global Digital Health

Despite the significant benefits for companies, consumers, and national economies that arise from the ability of organizations to easily share data across borders, dozens of countries—across every stage of development—have erected barriers to cross-border data flows, such as data-residency requirements that strictly confine data within a country’s borders (a concept known as “data localization”).[96] Unfortunately, several countries have enacted barriers to the transfer of health data. This prevents firms from transferring data overseas for analysis or service delivery—as firms typically rely on cloud-based IT systems to provide services for operations around the world. Aside from explicit rules for local data storage, countries have also enacted de facto data localization requirements by mandating individual consent for cross-border transfers of data, thereby making them harder and more expensive, if not impractical and impossible.

Some examples of enacted and proposed data localization requirements that affect health data and related services include:

  • In 2012, Australia enacted the Personally Controlled Electronic Health Records Act, which requires personal health records be stored only in Australia.[97]
  • Two Canadian provinces, British Columbia and Nova Scotia, have implemented laws mandating personal data held by public bodies such as schools, hospitals, and public agencies must be stored and accessed only in Canada, unless certain conditions are fulfilled.[98]
  • China has one of the widest sets of data localization policies in the world, including for personal, financial, mapping, and health data.[99] Most recently, in May 2019, China enacted rules that not only force firms to store genomic data locally, but also mandate all processing has to take place locally and by local firms—as foreign organizations are explicitly prohibited from managing Chinese genomic data.[100]
  • India’s draft data protection bill permits the government to classify any sensitive personal data as critical personal data and mandate its storage and processing exclusively within India.This highlights the potential for localization, which would be consistent with both India’s recent decision to require localization for payments data and its potential application for other types of data.[101] Furthermore, for other types of personal data, firms must store a copy in India (known as data mirroring) before transferring data overseas (but only under certain conditions).
  • In 2015, Russia enacted a Personal Data Law that mandates data operators that collect personal data about Russian residents must “record, systematize, accumulate, store, amend, update and retrieve” data using databases physically located in Russia.[102]
  • Countries also enact de facto barriers to transfers of health and genomic data that make it harder and more expensive, if not impractical, for firms to transfer it overseas. For example, South Korea and Turkey require firms to get explicit consent from residents in order to transfer sensitive data such as genomic data overseas.[103]

Some policymakers use forced data localization policies in a misguided attempt to achieve enhanced privacy or security. The location of data can affect how organizations respond to lawful government requests for data. But controlling where organizations store data does not impact how organizations collect and use data (privacy), or how they store and transmit the data (security). The notion data must be stored domestically to ensure it remains secure and private is false.[104] With regard to security, while certain laws may impose minimum security standards, the security of data does not depend on the country in which data is stored, but rather only on the measures used to store it securely. With regard to privacy, data owners—whether they are individuals or businesses—rely on contracts and laws to limit voluntary data disclosures so data stored abroad receives the same level of protection as data stored domestically.

Beyond misunderstandings about data privacy and protection, some policymakers see data localization as a tool for “digital protectionism” that offers a quick way to force high-tech economic activity to take place within their borders—similar to how countries use local content requirements and tariffs to protect local manufacturing operations.[105] Given traditional trade-protection tools—such as tariffs—do not work as readily on digital economic activity, countries pursuing digital protectionism are reverting to “behind-the-border” regulations and technical requirements, such as data localization. One expected benefit is forcing companies to store data inside a country’s borders will produce a boom in domestic data-center jobs. In fact, while data centers contain expensive hardware (which is usually imported) and create some temporary construction jobs, they employ relatively few staff.[106] Data centers are typically highly automated, which allows a small number of workers to operate a large facility.[107]

The use of data localization is not only misguided, it’s actively harmful to a country’s economy and ability to facilitate innovation, as it’s likely to affect the price, availability, and range of all ICT services.[108] Localization of health and related data affects the cost and availability of countries’ health services and products—especially in LMICs, where the additional IT and operational costs of complying with localization more than likely outweighs the potential market opportunities, leading firms to avoid or leave those countries altogether. Small and medium-sized firms are the most affected, as they are the least able to deal with the cost and complexity of employing duplicative IT services in multiple markets. The impact goes beyond setting up or using a single data center, and whether firms want to deal with the complexity of setting up multiple centers for redundancy purposes and figuring out how (or if) they can adapt global data analytics platforms for local IT facilities (and how the two connect, or not). For example, IBM Watson—which combines a supercomputer, AI, and sophisticated analytical software—requires customized hardware for each application (such as health), so it is unrealistic to assume IBM would deploy an independent Watson application in each and every country that enacts barriers to transfers of health data.[109] As firms weigh the cost-benefit of entering a particular market, data localization will increasingly be a factor.

Diseases and viruses (such as COVID-19) do not stop at national borders, meaning data needed to find cures needs to cross them.[110] The presence of localization influences if and where firms conduct clinical trials and data-driven health research. Powerful data analytics applied to bigger global datasets helps speed the development of cures.[111] The rarer the diseases, the more important it is to build bigger datasets. By erecting barriers to the exchange of medical information—even anonymous data—countries’ protectionist policies harm not only their own residents, but also people around the world, all of whom benefit from advances in medical research that may be possible from the aggregation and analysis of health and genomic data.

Interoperability Is the Key to Functionality, Cooperation, and Scale

International interoperability between different countries’ data governance frameworks—thus allowing information, and the digital products it represents, to move between jurisdictions—is important in maximizing the benefits of health data. These data flows allow organizations to aggregate larger, more valuable datasets for research, and leverage cloud storage services to deliver health services across borders. For firms involved in developing and delivering digital health products, international interoperability is critical to their competitiveness, as it builds economies of scale. For policymakers and individuals, this means greater health-sector competition, and access to a larger range of health services. This is why policymakers need to think regionally and globally when looking at domestic digital health and data governance policies.

Within digital health, interoperability at the domestic level refers to technical and legal issues that make it difficult for different organizations to collect, share, and analyze data because they often exist in non-standardized formats and reside across isolated databases and incompatible software systems. This is a related, but separate, issue to international interoperability within digital health. The objective of improved domestic interoperability is to ensure seamless communication across different IT systems through common data standards, which is similar to international interoperability, except it is to ensure data transfers between different countries.

Data localization needs to be avoided as businesses use data to create value—and many can only maximize that value when data can flow freely across borders. The movement of data is crucial to the application of AI and big data for innovative health and drug research, the generation and use of real-world data from personal devices such as smart watches, international virus and disease surveillance, the remote delivery of health services to smart phones via apps, and doctor-patient communications (see figure 5). In the case studies, the many firms and organizations that operate across multiple countries show how cross-border data flows are essential to their operations.

Figure 5: How interoperability improves digital medicine[112]