National legislative and regulatory assessment tool
Landscape assessments of national health data governance
Landscape assessments of national health data governance
This tool supports document-based reviews of legal and regulatory landscapes pertaining to health data governance. The template helps link the Core Elements of the Health Data Governance Principles (HDG Principles), the principles’ most detailed level, to sample text demonstrating how, and to what extent, the principles are represented in legislative and regulatory documents. This tool is meant to be used for single-country inquiries.
A three-step approach maps the HDG Principles to national legislation and guides the analysis across a text review and key informant interviews.
Step 1 – Country-Specific Legislation
This step provides a framework to identify and categorise the different legal documents to be reviewed related to health data governance. It include broad domains of data protection, health, human rights, and emerging technologies. Other domains may be added as desired.
- Determine necessary documents
- Gather single-use or repeat documents for assessment shortlist
Country
For country reviews, please note the country you are aiming to conduct the assessment for in this column.
Legislation topic
Pre-populated drop-down list of legislation and regulation type. To be filled out by framework user. Potential options: General Data Protection, Cybercrime and Cybersecurity, Primary Health Care, Health Insurance, Universal Health Care (UHC), General Health Care, Digital Health, Health Data Governance (specific), Emerging Tech, Anti-Discrimination and Human Rights
Specific Act Name
Format User should include the formal titles of legal documents to be reviewed, ideally with a hyperlink to the online version.
Year
The year law came into force or the state ratified or acceded to an international instrument (charter, convention, treaty)
Description
Pre-populated drop-down list of legal document implementation stages. To be filled out by framework user for each document included in the HDG landscape analysis. Potential options for Stage of implementation: Approved Regulation, Approved Legislation, Bill Introduced, Drafting Legislation, Planning (consultation, calls for an act), No Planned Legislation
Worksheet preview:
| wdt_ID | wdt_created_by | wdt_created_at | wdt_last_edited_by | wdt_last_edited_at | Country | Legislation Topic | Specific Act Name | Year | Stage of Implementation |
|---|---|---|---|---|---|---|---|---|---|
| 1 | hdg-staging | 26/11/2024 05:36 PM | hdg-staging | 26/11/2024 05:36 PM | Afghanistan | General Data Protection | Example legislation | 1995 | Approved Regulation |
| 3 | hdg-staging | 26/11/2024 05:52 PM | hdg-staging | 26/11/2024 05:52 PM | |||||
Step 2 – Country-Specific Detail
This step is the most granular level of the framework and helps the user trace where the concepts in the HDG Principles’ Core Elements are reflected in the reviewed texts. It lists each of the 50 Core Elements under their associated Principle and contains details on how the Core Element may be interpreted for the purpose of the review. Column F can be filled in with the corresponding texts identified in Step 1, and relevant sample text can be recorded in Column G.
Illustrative examples of text and and interview findings are included for Core Element 1.1.1 (Row 5)
Worksheet preview:
| wdt_ID | wdt_created_by | wdt_created_at | wdt_last_edited_by | wdt_last_edited_at | HDG Principles: Main Objectives | Principles | General Focus of Principle-Level Text Analysis | Core Elements | Detailed Interpretation Guide | Source document name | Sample Text |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 17/12/2024 09:27 AM | Objective 1: Protect People | 1.1 Protecting Individuals and Communities | Consent requirements; protection of and service to marginalized groups; content around collective risk. Data minimization requirements. Requirements around data sharing, transfer, storage, and retention requirements; safety and security. Articulation o | 1.1.1. Address individual and collective risk | |||
| 2 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.2. Collect data with a defined purposes | ||||||
| 3 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.3. Collect personal or sensitive data only when necessary and with informed consent | ||||||
| 4 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.4. Use secure data collection and storage mechanisms | ||||||
| 5 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.5. Use de-identification and anonymisation | ||||||
| 6 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.6. Define inappropriate uses of health data | ||||||
| 7 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.7. Institute safeguards against discrimination, stigma, harassment and bias | ||||||
| 8 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.1.8. Provide guidance specific to marginalised groups and populations | ||||||
| 9 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2 Building Trust in Data Systems | Defined exceptions to consent. Requirements for documentation or public access to data management and use processes. Requirements or defined processes for appropriate use of data. Goals or articles around data quality for the health system. | 1.2.1. Align with best practices for data protection and privacy | ||||
| 10 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.2. Ensure consent is informed and understood in all its complexities | ||||||
| 11 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.3. Obtain collective consent where appropriate | ||||||
| 12 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.4. Define concrete exceptions to informed consent | ||||||
| 13 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.5. Ensure data quality, availability, and accessibility | ||||||
| 14 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.6. Reinforce health data governance with evidence | ||||||
| 15 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.7. Establish transparent and accessible processes and systems | ||||||
| 16 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.2.8. Institute feedback and accountability mechanisms | ||||||
| 17 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.3 Ensuring Data Security | Data processing requirements. Consideration for architectures or technical designs that enhance security. | 1.3.1. Require strong technical security measures for data processing | ||||
| 18 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.3.2. Mitigate risks related to security threats | ||||||
| 19 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.3.3. Ensure transparency around data breaches | ||||||
| 20 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 1.3.4. Consider federated data systems | ||||||
| 21 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | Objective 2: Promote Health Value | 2.1. Enhance Health Systems and Services | Stated goals for data use in health system for decision-making and health system outcomes. Considerations or requirements for monitoring and evaluation of health systems; data use to improve systems. Consideration for community rights and ownership of d | 2.1.1. Evaluate the benefits of health data | |||
| 22 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.1.2. Use data to enhance health services for individuals and communities | ||||||
| 23 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.1.3. Encourage a culture of data-led insights and action | ||||||
| 24 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.1.4. Address health system efficiency, effectiveness, and resilience | ||||||
| 25 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.1.5. Strengthen community ownership of health data | ||||||
| 26 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.1.6. Enable and empower frontline health workers | ||||||
| 27 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2. Promote Data Sharing and Interoperability | Considerations for consent and appropriate use of data in legally-binding data sharing agreements. Requirements for sharing data outside the health sector or with non-government partners. Technical requirements of architecture, standards, and protocols | 2.2.1. Establish data sharing rules and guidelines | ||||
| 28 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2.2. Validate informed consent before sharing data | ||||||
| 29 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2.3. Promote interoperability of data systems | ||||||
| 30 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2.4. Define common data structures across health systems | ||||||
| 31 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2.5. Define multiple levels of data access | ||||||
| 32 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2,6 Use common definitions and global standards | ||||||
| 33 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.2.7. Support multi-sector partnerships | ||||||
| 34 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.3.Facilitate Innovation Using Health Data | Considerations for data management, ownership, and IP in regulation or policy around AI and data-driven technology innovations. Consideration of non-health data in requirements around data use and use of data for health system planning. | 2.3.1. Apply health data governance to emerging technologies | ||||
| 35 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.3.2. Address the use of non-health data in health contexts | ||||||
| 36 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.3.3. Build public health data infrastructure | ||||||
| 37 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 2.3.4. Employ policy innovation | ||||||
| 38 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | Objective 3: Prioritise Equity | 3.1. Promote Equitable Benefits From Health Data | Considerations for representative data in AI models, requirements for impact evaluations, language on anti-discrimination safeguards. Presence of health equity in stated goals of health system functions and responsibilities. | 3.1.1. Represent all groups and populations equitably in data | |||
| 39 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.1.2. Consider the unique needs of marginalised groups and populations | ||||||
| 40 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.1.3. Mitigate data bias | ||||||
| 41 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.1.4. Use accessible language and plug knowledge gaps | ||||||
| 42 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.1.5. Implement inclusive data feedback mechanisms | ||||||
| 43 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.1.6. Promote equitable impact and benefit | ||||||
| 44 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.Establish Data Rights and Ownership | Consideration of data ownership in data-driven services (e.g., data used in AI diagnostics). Reference to human rights principles or documents in legislative texts. | 3.2.1. Apply a human rights lens to health data governance | ||||
| 45 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.2. Define clear governance roles and responsibilities | ||||||
| 46 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.3. Codify data rights and ownership | ||||||
| 47 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.4. Extend data rights and ownership to products and services | ||||||
| 48 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.5. Develop health data trusts and health data cooperatives | ||||||
| 49 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.6. Employ participatory data governance mechanisms | ||||||
| 50 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | 3.2.7. Connect to broader accountability mechanisms | ||||||
| 51 | hdg-staging | 26/11/2024 05:42 PM | hdg-staging | 26/11/2024 05:42 PM | Cross cutting |
Step 3 – Country-Specific Summary
This step enables the user to create a summary view of the detailed analysis conducted in the previous step. It visualises what reviewed documents reflect which Core Elements, and where Core Elements are not referenced in reviewed texts.
Check-marks: Indicate that reviewed legal text contains content consistent with HDG Principle Core Element in the respective document category.
To create a summary analysis, framework users can:
– Grey out whatever columns are NOT applicable for the country being researched, and
– Check-mark the document categories where sample text has mapped to Core Elements in the “Country-Specific Detail” step.
For example:
Worksheet preview:
| wdt_ID | wdt_created_by | wdt_created_at | wdt_last_edited_by | wdt_last_edited_at | Principle | Core Elements | Data Protection and Privacy | Cybercrime and Cybersecurity | General Health | Digital Health-Specific | International Instruments | Emerging Technologies | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1 Protecting Individuals and Communities | 1.1.1. Address individual and collective risk | |||||||
| 2 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.2. Collect data with a defined purposes | ||||||||
| 3 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.3. Collect personal or sensitive data only when necessary and with informed consent | ||||||||
| 4 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.4. Use secure data collection and storage mechanisms | ||||||||
| 5 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.5. Use de-identification and anonymisation | ||||||||
| 6 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.6. Define inappropriate uses of health data | ||||||||
| 7 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.7. Institute safeguards against discrimination, stigma, harassment and bias | ||||||||
| 8 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.1.8. Provide guidance specific to marginalised groups and populations | ||||||||
| 9 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2 Building Trust in Data Systems | 1.2.1. Align with best practices for data protection and privacy | |||||||
| 10 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.2. Ensure consent is informed and understood in all its complexities | ||||||||
| 11 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.3. Obtain collective consent where appropriate | ||||||||
| 12 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.4. Define concrete exceptions to informed consent | ||||||||
| 13 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.5. Ensure data quality, availability, and accessibility | ||||||||
| 14 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.6. Reinforce health data governance with evidence | ||||||||
| 15 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.7. Establish transparent and accessible processes and systems | ||||||||
| 16 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.2.8. Institute feedback and accountability mechanisms | ||||||||
| 17 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.3 Ensuring Data Security | 1.3.1. Require strong technical security measures for data processing | |||||||
| 18 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.3.2. Mitigate risks related to security threats | ||||||||
| 19 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.3.3. Ensure transparency around data breaches | ||||||||
| 20 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 1.3.4. Consider federated data systems | ||||||||
| 21 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.1. Enhance Health Systems and Services | 2.1.1. Evaluate the benefits of health data | |||||||
| 22 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.1.2. Use data to enhance health services for individuals and communities | ||||||||
| 23 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.1.3. Encourage a culture of data-led insights and action | ||||||||
| 24 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.1.4. Address health system efficiency, effectiveness, and resilience | ||||||||
| 25 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.1.5. Strengthen community ownership of health data | ||||||||
| 26 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.1.6. Enable and empower frontline health workers | ||||||||
| 27 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2. Promote Data Sharing and Interoperability | 2.2.1. Establish data sharing rules and guidelines | |||||||
| 28 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2.2. Validate informed consent before sharing data | ||||||||
| 29 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2.3. Promote interoperability of data systems | ||||||||
| 30 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2.4. Define common data structures across health systems | ||||||||
| 31 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2.5. Define multiple levels of data access | ||||||||
| 32 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2.6 Use common definitions and global standards | ||||||||
| 33 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.2.7. Support multi-sector partnerships | ||||||||
| 34 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.3.Facilitate Innovation Using Health Data | 2.3.1. Apply health data governance to emerging technologies | |||||||
| 35 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.3.2. Address the use of non-health data in health contexts | ||||||||
| 36 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.3.3. Build public health data infrastructure | ||||||||
| 37 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 2.3.4. Employ policy innovation | ||||||||
| 38 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.1. Promote Equitable Benefits From Health Data | 3.1.1. Represent all groups and populations equitably in data | |||||||
| 39 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.1.2. Consider the unique needs of marginalised groups and populations | ||||||||
| 40 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.1.3. Mitigate data bias | ||||||||
| 41 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.1.4. Use accessible language and plug knowledge gaps | ||||||||
| 42 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.1.5. Implement inclusive data feedback mechanisms | ||||||||
| 43 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.1.6. Promote equitable impact and benefit | ||||||||
| 44 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.Establish Data Rights and Ownership | 3.2.1. Apply a human rights lens to health data governance | |||||||
| 45 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.2. Define clear governance roles and responsibilities | ||||||||
| 46 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.3. Codify data rights and ownership | ||||||||
| 47 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.4. Extend data rights and ownership to products and services | ||||||||
| 48 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.5. Develop health data trusts and health data cooperatives | ||||||||
| 49 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.6. Employ participatory data governance mechanisms | ||||||||
| 50 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | 3.2.7. Connect to broader accountability mechanisms | ||||||||
| 51 | hdg-staging | 26/11/2024 05:44 PM | hdg-staging | 26/11/2024 05:44 PM | Cross cutting |