I cannot recall what days were like before closing activity rings or feeling rested only after checking my sleep score first thing in the morning. Instagram feeds are strewn with bite-sized videos on zone 2 cardio, AI calorie counters, and Strava feeds. Sharing personal health data seems to have become a daily necessity.

We are increasingly intertwining health with technology, with widespread sharing of sensitive health data with Big Tech and potential misuse for state surveillance. Upward trends in data breaches despite compliance-first building approaches, and the new expansion of AI into the health sector only raise more questions than answers. The backlash in Kenya and subsequent suspension of health aid from the USA point to a growing global concern – the steady erosion of public trust in data-sharing systems. With increasing use of technology in health, we are at a moment in time where data sharing holds the immense potential to build better systems for people.

Building for health, in particular, carries with it a hope for more equitable digital ecosystems. However, caught in the digitisation race, we also seem to have forgotten who we are building for in the first place – people.

The unique case of health data

The health sector is relatively mature, with a strong public interest and a history of digitisation. Country-wide efforts in building integrated health systems include a strong push towards total digitisation of health records, building secure health exchanges, and creating interoperable, thriving ecosystems. However, there is highly uneven adoption across countries. There are noticeable variations across underlying motivations, state capacities, and regulatory maturity. This variation is seen even within countries with high digitalisation.

Health data is highly personal, making it uniquely vulnerable. The potential for exploitation of such sensitive data routinely subjects it to high levels of security risk, making trust central to data-sharing initiatives. Countries that depend on aid for growth in sectors like healthcare are also especially vulnerable to sensitive data being shared. The envisioned ease of medical data flow, from patient information to research, is complicated by unclear access rules, opaque re-use mandates, and recurring data breaches.

The first crucial step of health data sharing, consent, is in itself a barrier. Patients often do not understand what they are consenting to, and can also face consent fatigue due to the unfriendly nature of consent design. Regular reporting of medical data thefts and breaches further erodes public confidence. Apart from this, fragmented data, incomplete patient histories, and poor last-mile service delivery only deepen this trust deficit.

Diverse contexts, common threads

Countries have attempted to build integrated health systems in various ways. National pushes towards digitisation are a common first step, followed by diverse choices depending on varying priorities. Governance is often retrofitted after systems are built, with countries pushing for innovation first and governance to follow. Governance, when considered, is mostly tech-leaning and compliance-heavy. The original purpose of health data sharing systems – to serve people – can easily be obscured through this approach.

For instance, the United States illustrates the limitations of compliance-heavy models. While the Health Insurance Portability and Accountability Act (HIPAA) and the Trusted Exchange Framework (TEFCA) provide a strong governance foundation, concerns around access to sensitive data have been raised in the past. Patients do not have clear opt-out mechanisms and lack meaningful forms of control. Reliance on attestation models raises questions about whether trust is merely a check-box.

Recent examples of outsourcing data infrastructure to private companies through private-public partnerships have also been critiqued for eroding public trust due to a lack of transparency and potential for misuse of data. In India, schemes like Ayushman Bharat PM-JAY have been reimbursing more private hospitals than public. Indians spend 60% of health expenditure out-of-pocket, and profit-driven medical decision-making will only worsen this. In an attempt to scale quickly, privatisation without public consideration will only stifle development in the long run, worsen health outcomes, and perpetuate a lack of public trust in public health.

Choosing to embed governance early and aligning it with the overall national digital strategy has been an important note to take from models such as X-Road in Estonia. However, Estonia’s model may be difficult to replicate, particularly in lower-income settings. Further, a highly regulatory approach, often followed in the EU, can tip the global scales in unfair ways.

While the expansive nature of the EU Health Data Spaces Regulation is commendable, its aggressive guardrails have the potential to deny access to EU research, especially for countries at nascent stages of development. It also runs the risk of monopolising the regulatory narrative around data-sharing. Further, data sharing systems in the EU also face attacks on their data despite high rates of digitisation.

In contrast, Rwanda is an example of how health data systems were made, keeping in mind resource-constraints and conflict-ridden contexts. It built out Health Information Exchanges (HIEs) like in Estonia, but through the adoption of OpenHIM. Built to offer flexibility and standards alignment, this interoperability layer helps low and middle-income countries (LMICs) build systems despite their socio-economic contexts. The country’s emphasis on community-based healthcare has led to the development of a system that is more receptive to public needs, allowing for a reduction in disparate access to healthcare.

Every region brings with it unique governance challenges, united by the need to build trust. What diverse contexts need is not one model – it is one non-negotiable thread: people.

People-first: what can it entail?

As data increasingly becomes a commodity, prioritising trust cannot be solved by technology alone. Most sectors, like health, are not just technical infrastructures; they are sociotechnical systems comprised of people that form institutions, norms, incentives, and technologies. “Technologies do not exist in a vacuum: they influence and are influenced by the social contexts in which they are deployed.” There is always a two-way relationship between technologies and the people who are affected by them.

A socio-technical approach places people at the centre of the conversation. It demands well-thought-out solutions that optimise for user friendliness, ease of access, and control. It needs to successfully measure willingness to share data, knowledge about what data is being shared for, and solve problems like consent fatigue with easy-to-understand instructions and more meaningful awareness building. It acknowledges that consent is not a checkbox, but an ongoing process that requires ethical oversight, a usable interface and transparency.

It requires systems to have only context-specific solutions anchored in political will and sustained by technological and institutional support. Protection of data places privacy, autonomy, and collective rights at the centre of the conversation. For instance, there needs to be continued transparency for patients who share data, and highly auditable trails. Secondary use of sensitive data needs to be strictly prohibited and monitored more meaningfully. Innovation and experimentation need to flow into community-oriented outcomes like data co-operatives and other data stewardship mechanisms.

Towards a people-first future in health

If rooted in a socio-technical approach, health exchange systems can be blueprints for reimagining how data sharing, design, and governance can be anchored in people, contexts, and purpose rather than solely in technology. Considering diverse global needs and the existence of extreme forms of inequality, especially in LMICs, losing sight of the confluence of technology and society can lead to further complexities.

The nascent stage of health systems in LMICs is a definitive moment to rewrite the governance narrative for data sharing. The path forward begins not with resolving priority tussles, choosing the ‘right’ type of technology layer or architecture type. It begins at the beginning – why we choose to build systems in the first place and who we design them for.