Health: Nice University Hospital centralizes your data, what you need to know about their protection

The University Hospital Center of Nice recently announced the launch of its Health Data Warehouse (EDS), designed to collect and centralize patients’ medical data. The objective is to develop research and innovation in health in the Azur region. This project raises a central question: are personal data really protected once integrated into the EDS? We explain.

Concretely, a Health Data Warehouse is a secure digital system that allows collecting, centralizing and preserving data produced in the context of care: demographics, patient journey, treatments administered, examinations performed, results…

The objective stated by the CHU of Nice is to improve patient care, to inform public health policies, and to structure excellence in medical research, particularly in connection with the Côte d’Azur University and Aix-Marseille University.

Pseudonymization, to be distinguished from anonymization

In terms of confidentiality, the CHU of Nice specifies that data integrated into the warehouse is “pseudonymized”. Pseudonymized data is personal data from which direct identifiers, such as name or social security number, have been removed and replaced by a code or random identifier.

Unlike truly anonymized data, which would never allow tracing back to the individual concerned, pseudonymized data remains re-identifiable. One simply needs to have the matching key between the code and the patient’s actual identity.

The CHU nevertheless affirms that it strictly oversees this system: “The EDS is deployed in strict compliance with current regulatory framework, particularly the European General Data Protection Regulation (GDPR) and the CNIL’s EDS framework. Its implementation is part of the public interest mission of the public health institution.“

What rights for patients?

Faced with this risk of re-identification, patients retain several control mechanisms. They can oppose access to their information at any time, subject to a legitimate reason, and also have a right to rectification as well as a right to limit processing of their data.

To exercise these rights, or for any other questions on the subject, patients can contact the CHU’s data protection officer, by:

• electronic means, at the following email address: dpo.eds@chu-nice.fr
• postal mail, at the following address: University Hospital Center of Nice – Archet 2 Hospital – DTNIB – 151, route Saint-Antoine de Ginestière – CS 23079 – 06202 Nice Cedex 3

Simply attach proof of identity to the request. In case of persistent disagreement, a complaint can be filed directly with the National Commission for Data Protection and Freedoms (CNIL).

Towards regional-scale sharing

This Nice launch is only a first step. The Mediterranean EDS data will soon be able to be shared with that of the Antoine Lacassagne Center and the Lenval Foundation, via certified health data hosting platforms. On a larger scale, the project aims to expand to Public Assistance-Marseille Hospitals and the Paoli-Calmettes Institute, in a logic of research at the scale of the PACA region.

For Rodolphe Bourret, general director of the CHU of Nice, the valorization of data must never be done at the expense of patients. “We are transforming this wealth into a concrete lever in service of the health of residents of the Alpes-Maritimes and Corsica. More research, more innovation, but above all direct benefits for patients,” he explains.

Prof. Marc-Olivier Gauci, who is leading the project at the regional level, also insists on this balance: “It is an essential tool that complies with very strict rules to protect patient data while ensuring innovations, particularly in artificial intelligence, that are reliable and in service of the best care.“