Health Data Hub : Frequently Asked Questions 

These Frequently Asked Questions (FAQ) are the ones that are most often asked to the Health Data Hub.
 

You cannot find an answer to your question ? Please contact our team at the following email address : contact@health-data-hub.fr.

About the Health Data Hub

What is the Health Data Hub ?


In the digital era, each interaction with healthcare services enables the creation of data. All this data constitute precious and essential raw material for research. By gathering and analysing them, researchers can answer concrete questions to improve the quality of care and treatment, such as studying the side effects of prescriptions. Companies can develop new solutions, such as algorithms to detect heart failure, for example. Data heritage in France is particularly large and structured, which can be an international competitive advantage for research and innovation. Until now, obtaining access to these data has raised many difficulties for those who wish to use them in projects of public interest: - The data are scattered among multiple databases, little known and not easily understood by outsiders; - The procedures for accessing health data are complex, especially because of the sensitivity of these data, and are governed by different, sometimes discretionary, rules; - The tools and skills needed to process data securely, as required, are costly and often inaccessible to small research teams or start-ups. As a result, some projects, which could bring real benefits to patients, take several years to get off the ground, or simply don't at all. Some French start-ups, wishing to develop new solutions, are obliged to form partnerships with foreign actors to collect data. Their innovations will not necessarily be adapted to, or even available to French patients. Following the Villani Report on Artificial Intelligence, published on March 28, 2018, the President of the Republic affirmed his desire to make health one of the priority sectors for the development of artificial intelligence in France. Provided for by the 24 July 2019 Law on the organisation and transformation of the healthcare system, the Health Data Hub is a public structure whose objective is to enable project coordinators to easily access non-nominative data hosted on a secure platform, in compliance with regulations and citizens' rights. They will be able to cross-reference and analyse the data in order to improve the quality of care and patient support. To find out more about the national artificial intelligence plan for the Health Data Hub project, see the "AI for Humanity" commitments. To find out more about the digital health strategy of the Health Data Hub project, see the roadmap "Accelerating the digital shift". For more information on the creation of the Health Data Hub, see the prefiguration report. To find out more about the Health Data Hub's service offering, see the brochure. To find out more about the guarantees provided to civil society, see the Health Data Hub's commitments to civil society.




What is its legal status and governance model ?


The Health Data Hub is constituted as a public interest group, whose constituent agreement was approved by ministerial decree on 29 November 2019. The group brings together 56 stakeholders presented in the decree. It implements the major strategic orientations relating to the National Health Data System (SNDS) set by the State, in particular the Ministry of Solidarity and Health. It is financed mainly by the public sector. Before the official creation of the public interest group, the Health Data Hub project was conducted under the direction of the Ministry of Solidarity and Health (Directorate of Research, Studies, Evaluation and Statistics (DREES)) and was selected in the first call for projects of the Fund for the Transformation of Public Action (FTAP). In this context, it was granted initial funding of 36 million euros for four years. A further 40 million euros came from the national health insurance expenditure target (ONDAM). To find out more about the first call for projects of the Fund for the Transformation of Public Action (FTAP), see the portal for the transformation of public action.




What projects can be conducted through the Health Data Hub ?


The reuse of health data can contribute to improving the quality of care and patient support in many ways. Here are a few examples of research purposes : - Providing answers to rare pathologies: for example, sarcoma belongs to the rare tumours for which the effectiveness of isolated clinical trials is reaching its limits. For nearly 40 years, they have been conducted without being able to decide on the relevance of chemotherapy before or after surgery. In this context, the analysis of data collected from patients as part of cohorts, combined with healthcare consumption data from the French National Health Insurance system, offers a real opportunity to evaluate treatments and their performance. - Supporting healthcare professionals in an increasingly complex clinical context: prescription software already uses alert tools to notify healthcare professionals when different treatments taken by the same patient may reveal incompatibilities, and imply health risks. These can be improved, as these systems today generate so many alerts that they are often deactivated or ignored by healthcare professionals. Data analysis allows the development of tools to prioritize alerts and filter those that must be taken into account. - Better patient management as a result of new organisational methods: heart failure flare-ups account for almost 5% of hospitalisations in France. By correlating data from pacemakers with hospitalization data, it is possible to design warning tools that detect weak signals early on and enable patient management as early as possible. - Predicting individual patient trajectories and improving prevention actions: data from cohorts of patients monitored in Parkinson's expert centers, combined with data from health insurance, make it possible to study the progression of the pathology and thus improve patient monitoring. Tools could thus be developed and provided to neurologists. - Improving the understanding and transparency of the healthcare system: in 2017, nearly 82,000 adverse drug reactions were reported for 12,000 marketed drugs. The analysis of health data makes it possible to go further in understanding by calculating reporting rates, i.e. the number of adverse reactions reported in relation to the number of patients actually exposed. This figure is strategic for the authorities, healthcare professionals and patients to appreciate the importance of each side effect. Currently carried out manually, this calculation could be automated and facilitated thanks to access to large databases by the French National Agency for Medicines and Health Products Safety (ANSM). - Save medical time, improve screening and reduce diagnosis times: with an estimated 11,883 deaths in 2017, breast cancer kills more women than any other cancer in France. Early detection reduces mortality by 21%. The use of artificial intelligence could further improve organized breast cancer screening by reducing the rate of false positives and false negatives. - Offering patients the best long-term treatments: information concerning the links between taking drugs and their long-term effects is currently very incomplete, both in general and in organ transplantation cases. In the context of lifelong treatment, knowledge of these relationships is essential for optimising therapeutic strategies, the choice of doses and also the formulas of these drugs. All the research projects that will be carried out on the Health Data Hub's technological platform will be described in the project directory, which lists all the projects using health data, including when they are not carried out on the Health Data Hub's technological infrastructures. For more information on the Health Data Hub projects, see the list of laureate pilot projects from the first Health Data Hub call for projects and the list of institutional projects.





About the data available through the Health Data Hub

What data are available on the Health Data Hub’s technological platform ? Is it true the Health Data Hub will be a gigantic health database ?


The Health Data Hub covers the National Health Data System (SNDS), i.e. all the health data associated with a H-health insurance reimbursement, whether collected during a hospital treatment, a doctor’s visit, participation in a research cohort or an epidemiological or practice register, etc. All these data will not be collected in a single file - or even a single platform. The Health Data Hub will collect copies of already existing databases in which directly identifying personal information has been removed. Only a selection of the most relevant databases will be replicated and regularly updated on the Health Data Hub's technological platform. This collection of databases makes up the "catalogue", built up in a progressive and iterative way, in partnership with those responsible for the collection of the data concerned. The content of the catalogue is described on the Health Data Hub website, as well as all the projects that will be carried out as a result. To find out more about the sharing of roles and responsibilities between data controllers and the Health Data Hub, see the Health Data Hub's commitments to data controllers.




Will the Health Data Hub host nominative data ? Can’t the data be fully anonymized ?


Compliant with the security repository of the National Health Data System (SNDS), the Health Data Hub's technological platform does not receive nominative data. The data are "pseudonymised", which means that directly identifying information such as surname, first name, date and place of birth, address, etc., has been deleted. They thus do not hold any information that could directly identify a person. What is the difference with completely anonymous data? Perfectly anonymous data usually involve the aggregation of data. Examples include the number of cases, complications, medical procedures... Medical research, for example, requires access to finer data. To evaluate the effectiveness of a treatment on a typology of patients, one must look, for each patient, at the succession of events (hospitalisation, complication, improvement in clinical condition, treatments taken, etc.). Researchers do not need to know the identity of patients, but they need access to individual trajectories to analyse and compare them. It is precisely because the data are not completely anonymous, but rather pseudonymous, that important security measures are taken to ensure that their confidentiality is respected. The data are therefore not published as open data. In addition, users are prohibited from attempting to re-identify individuals and are personally bound to this by signing the legally binding General Terms and Conditions of Use of the Health Data Hub technological platform. For more information on the guarantees provided to civil society, see the Health Data Hub's commitments to civil society.




Who will access this data ? Under which conditions ?


The data, within a well-defined scope, will be accessible to project coordinators contributing to the public interest, following an approval process involving an independent committee (CESREES) and the National Commission for Data Protection and Liberties (CNIL). Step 1. Project coordinators who wish to access the data make an access request to the Health Data Hub. They can be assisted in their request. Step 2. The request is sent to CESREES. It verifies that the subject of the study is relevant and of public interest, that the data requested is in line with the project and that the proposed methodology is scientifically robust. Step 3. On the basis of these elements, which characterize the purpose of the data processing, the CNIL is seized to give its authorization according to criteria of data protection and respect for citizens' rights. Step 4. Once the CNIL's authorization has been obtained, the Health Data Hub team consolidates the required data and prepares a secure "project space" on its technological platform, which contains only the necessary data. Step 5. Users of the technological platform have remote access to their "project space" and process the data on the platform without being able to retrieve it. The Health Data Hub can charge for access to its services. Step 6. The project results are made public on the Health Data Hub website, with due respect for academic and industrial competitiveness. Any private actor requesting access to the data will have to prove that the project is of public interest, another expression to define general interest for the benefit of citizens, in the same way as public actors. Both public and private actors are entitled to develop research and development projects with potential commercial purposes, but proof of the public interest of such research will have to be provided to the Ethics and Scientific Committee (CESREES). Specifically, the law (Article L. 1461-1 of the Public Health Code) explicitly excludes, and therefore criminalizes, any use of health data for the commercial promotion of products to health professionals. The same applies to any use that may lead to the exclusion of guarantees, changes in contributions or insurance premiums for a person or group of persons. Any infringement by the project carriers will lead to criminal prosecution. As provided for by law, the data may not be sold. For more information on the guarantees provided to civil society, see the Health Data Hub's commitments to civil society.





About information for citizens, consent and the exercise of rights

What data are available on the Health Data Hub’s technological platform ? Is it true the Health Data Hub will be a gigantic health database ?


The Health Data Hub covers the National Health Data System (SNDS), i.e. all the health data associated with a H-health insurance reimbursement, whether collected during a hospital treatment, a doctor’s visit, participation in a research cohort or an epidemiological or practice register, etc. All these data will not be collected in a single file - or even a single platform. The Health Data Hub will collect copies of already existing databases in which directly identifying personal information has been removed. Only a selection of the most relevant databases will be replicated and regularly updated on the Health Data Hub's technological platform. This collection of databases makes up the "catalogue", built up in a progressive and iterative way, in partnership with those responsible for the collection of the data concerned. The content of the catalogue is described on the Health Data Hub website, as well as all the projects that will be carried out as a result. To find out more about the sharing of roles and responsibilities between data controllers and the Health Data Hub, see the Health Data Hub's commitments to data controllers.




Will the Health Data Hub host nominative data ? Can’t the data be fully anonymized ?


Compliant with the security repository of the National Health Data System (SNDS), the Health Data Hub's technological platform does not receive nominative data. The data are "pseudonymised", which means that directly identifying information such as surname, first name, date and place of birth, address, etc., has been deleted. They thus do not hold any information that could directly identify a person. What is the difference with completely anonymous data? Perfectly anonymous data usually involve the aggregation of data. Examples include the number of cases, complications, medical procedures... Medical research, for example, requires access to finer data. To evaluate the effectiveness of a treatment on a typology of patients, one must look, for each patient, at the succession of events (hospitalisation, complication, improvement in clinical condition, treatments taken, etc.). Researchers do not need to know the identity of patients, but they need access to individual trajectories to analyse and compare them. It is precisely because the data are not completely anonymous, but rather pseudonymous, that important security measures are taken to ensure that their confidentiality is respected. The data are therefore not published as open data. In addition, users are prohibited from attempting to re-identify individuals and are personally bound to this by signing the legally binding General Terms and Conditions of Use of the Health Data Hub technological platform. For more information on the guarantees provided to civil society, see the Health Data Hub's commitments to civil society.




Who will access this data ? Under which conditions ?


The data, within a well-defined scope, will be accessible to project coordinators contributing to the public interest, following an approval process involving an independent committee (CESREES) and the National Commission for Data Protection and Liberties (CNIL). Step 1. Project coordinators who wish to access the data make an access request to the Health Data Hub. They can be assisted in their request. Step 2. The request is sent to CESREES. It verifies that the subject of the study is relevant and of public interest, that the data requested is in line with the project and that the proposed methodology is scientifically robust. Step 3. On the basis of these elements, which characterize the purpose of the data processing, the CNIL is seized to give its authorization according to criteria of data protection and respect for citizens' rights. Step 4. Once the CNIL's authorization has been obtained, the Health Data Hub team consolidates the required data and prepares a secure "project space" on its technological platform, which contains only the necessary data. Step 5. Users of the technological platform have remote access to their "project space" and process the data on the platform without being able to retrieve it. The Health Data Hub can charge for access to its services. Step 6. The project results are made public on the Health Data Hub website, with due respect for academic and industrial competitiveness. Any private actor requesting access to the data will have to prove that the project is of public interest, another expression to define general interest for the benefit of citizens, in the same way as public actors. Both public and private actors are entitled to develop research and development projects with potential commercial purposes, but proof of the public interest of such research will have to be provided to the Ethics and Scientific Committee (CESREES). Specifically, the law (Article L. 1461-1 of the Public Health Code) explicitly excludes, and therefore criminalizes, any use of health data for the commercial promotion of products to health professionals. The same applies to any use that may lead to the exclusion of guarantees, changes in contributions or insurance premiums for a person or group of persons. Any infringement by the project carriers will lead to criminal prosecution. As provided for by law, the data may not be sold. For more information on the guarantees provided to civil society, see the Health Data Hub's commitments to civil society.





About the Health Data Hub’s technological platform

What are the security measures in place ?


The Health Data Hub guarantees a very high level of security and data protection on its technological platform, in compliance with the texts applicable to the processing of health data, such as the GDPR, the State's Information Systems Security Policy and more specifically the National Health Data System (SNDS) security referential. The security context of the Health Data Hub's technological platform was defined as part of a process conducted in collaboration with the National Agency for the Security of Information Systems (ANSSI) and the Senior Official for Defence and Security of the Ministry of Solidarity and Health. Both organizational and technical security measures are implemented to protect access to health data, such as : Encryption: data is stored in an encrypted format, as well as all storage space and flows. The Health Data Hub generates its own master encryption keys using its own proprietary hardware security module, or "Hardware Security Module (HSM)", with internationally recognised certifications. The encryption keys are secret and the host is prohibited by law from providing any third party with the encryption key part used on the technological platform. Segmentation of operating rights: the technological platform is only operated by Health Data Hub agents, called operators, who have defined and compartmentalised roles so that any possible malicious act can be contained. Secure management of accounts and permissions: any access to the technological platform is controlled through a "strong" authentication procedure based on a combination of several authentication factors to prevent identity theft. Rights are defined so that no single person can access and process data on the technology platform or add new users. The provision of a secure workspace: after logging on, users have access through a virtual office to an isolated space dedicated to their project on which they have neither administrative rights nor internet access and where only the data validated beforehand and necessary for the proper conduct of their work is available. Only anonymised results can be exported from the technological platform, after requesting authorisation from a Health Data Hub operator. The use of independent technical security bricks: the architecture of the technological platform presents several levels of security, according to the principle of "defence in depth", based on independent and certified solutions, such as flow filtering solutions, malware detection, encryption key generation, etc. Trace analysis, or "logs": the Health Data Hub records all the actions carried out by users and operators on the technological platform, analyses them, and seals them on a daily basis with a trusted French third-party archiver to ensure their probative value. Hosted in the European Union: in accordancewith the security repository of the French National Health Data System (SNDS), the health data on the Health Data Hub's technological platform is hosted in the European Union. More specifically, the data is currently stored in Microsoft data centres in the Netherlands, who are certified as "Health Data Hosts". The security of the technological platform is subject to a certification process and is frequently tested and reviewed through technical audits conducted by independent service providers qualified by ANSSI.




What services does the Health Data Hub use on its technological platform?


Today, functionalities are implemented through the use of around 50 services on the Health Data Hub's technological platform, coming from a variety of vendors. More than half of these services are related to securing the platform and enable the implementation of the security measures mentioned in the question "What security measures are in place?" of these FAQ. The table below shows a subset of services deployed on the technological platform. In addition to covering the functional requirements, these solutions were chosen based on multiple criteria, including the level of integration, management and maturity, which need to favor the management of security for every level of every element of the technological platform, the robustness of the technological platform, the reduction of maintenance time in operational condition and the reduction of the integration load. For an equivalent integration effort, the most reversible solution is preferred. Transversally, the Health Data Hub must implement efficient, controlled and proven means to generate secure and isolated work environments, in line with the pace of user arrival on the technological platform. The automation of the platform deployment as well as the detailed management of rights and flows are two of the means currently being used to meet this challenge.





© 2019 Health Data Hub

Hébergé chez Wix.com