From digital archives siloed on hospital computers, social security agencies’ databases, or on laboratory servers, health data has — in just a few years — become one of the most strategic assets in the world. Medical records, imaging, genomes, data from connected devices — humanity has never produced so much information about the state of its own health.
These platforms also make it possible to conduct research on rare diseases, which cannot be studied at scale in a single country due to an insufficient number of patients. They also make it easier to anticipate health crises (as the Covid-19 pandemic showed) during which the rapid use of data shaped the effectiveness of public policies.
The benefits of consolidation
Currently, health information systems are organised on national, even regional bases, with technical standards that are sometimes incompatible. The conditions for accessing data differ strongly from one country to another, both legally and operationally. The lack of a unified market for health data prevents the rapid emergence of European actors with global scale. From an industrial perspective, this situation is worrying. Whilst health-tech startups in Europe run into internal regulatory barriers, large American groups benefit from privileged access to enormous volumes of data. In 2024, 95 per cent of office-based physicians in the United States adopted an electronic health record system. Some hospital ecosystems rely on single platforms covering tens of millions of patients. This solution thus offers big digital groups a breadth of data that is difficult to replicate in Europe.
A unified health data market allows companies to quickly access very large volumes of data, indispensable for training AI systems that are competitive globally. A common framework also makes the market more legible to investors, encouraging the emergence of a community of European actors capable of rivalling American and Chinese giants. With many hospitals still relying on non-European clouds to store, backup, and run critical medical services, the European Union can only try to impose rules to ensure data remains hosted in Europe and subject to their regulations.
In economic intelligence terms, this situation reveals a strategic imbalance: Europe produces a lot of data, but still controls its value creation imperfectly.
Brussels also wants to harmonise practices. In each country, one-stop shops dedicated to health data will serve as the mandatory interface for researchers. This will help companies that request health data at the European Union scale, and will no longer require navigating a mosaic of opaque and contradictory procedures. By imposing common formats and shared standards, the Union seeks to make data accessible across member states regardless of national digital maturity, within The European Health Data Space (EHDS). Officially, the objective is clear: promote research, improve the quality of care, and strengthen cooperation amongst member states. Unofficially, it is a defensive strategy against global digital powers.
What is the EHDS?
The EHDS is the cornerstone of the EU’s strategy for medical data, aiming to create a common framework in which health information can circulate more freely between EU nations in a legally secure and technologically interoperable environment.
The project rests on two major pillars. The first concerns the primary use of data; it will allow patients, when traveling across Europe, have their medical information accessible to health professionals, avoiding breaks in care pathways and redundant tests. The second pillar concerns the secondary use of data; large-scale access to this data makes it possible to develop more powerful algorithms and optimise clinical trials. For Brussels, it can be perceived as a sovereignty project — ensuring European health data does not become a free raw material captured by foreign digital giants.
Innovation is driving the push for health-data integration, but it also exposes who holds the real technological and strategic leverage. Innovative companies are at the heart of this ecosystem. Startups, pharmaceutical laboratories, medical software publishers, and digital industry players are investing massively in the exploitation of health data.
The applications range from earlier detection and more efficient care pathways to predictive medicine, virtual clinical trials, and personalised therapies. But this economic momentum also raises strategic questions: Who controls the algorithms? Where is the data hosted? Which legal regimes apply to the companies that process this ultra-sensitive information?
There are pros and cons
Greater connectivity can unlock major benefits, but it also concentrates on hidden risks, especially when sensitive health systems become exposed to cyber threats. Large-scale networks of health data mechanically increases exposure to cyberattacks. As data flows, the attack surface expands, and recent incidents highlight the fragility of the IT hospital systems.
In 2019, Rouen University Hospital (CHU de Rouen) was paralysed by ransomware, leading to a complete shutdown of certain services and the postponement of surgical procedures. This ransomware demanded the equivalent of 40 bitcoins (one bitcoin ≃ €7,500 in 2019), or about 300,000 euro. In 2021, Paris’ public hospital system suffered a massive data theft involving around 1.4 million patients who had been tested for Covid-19. This information then circulated on clandestine forums. These attacks may be opportunistic acts of cybercrime, but they also underscore the strategic value of medical data for influence and intelligence purposes.
Within the EHDS framework, the risk is potentially systematic. Such vulnerability could trigger a domino effect on a European scale — an intrusion into a hospital or national authority could become an entry point to corrupt or exfiltrate data which circulates throughout the sharing system, resulting in a massive theft affecting multiple member states.
That is the reason why securing data has become a central pillar of the European EHDS strategy. Without a very high level of protection, the promise of control given to citizens would remain largely theoretical. European institutions are therefore relying on stronger encryption to secure sensitive health data.
The European Health Data Space is intended to be an instrument of sovereignty. But reality is more complex. Cloud infrastructures, algorithms, and analytics tools are still largely dominated by American and Chinese players. This technological dependence constitutes a major strategic vulnerability for Europe. Through this project, Europe wants to prove that a digital power can be built not on the brute capture of data, but on a balanced model combining technological performance, respect for fundamental freedoms, and strategic control of critical infrastructure.
The outcome of this health-data battle will largely determine Europe’s ability to carry weight in digital power relations, whether in setting the rules of the game, protecting its critical infrastructures, or defending its model of society.
