Skip to main content An official website of the United States government Here's how you know Here's how you know Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock Locked padlock icon ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites. Search Log in Dashboard Publications Account settings Log out Search… Search NCBI Primary site navigation Search Logged in as: Dashboard Publications Account settings Log in Search PMC Full-Text Archive Search in PMC Journal List User Guide PERMALINK Copy As a library, NLM provides access to scientific literature. Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Learn more: PMC Disclaimer | PMC Copyright Notice NPJ Digit Med . 2026 Feb 17;9:244. doi: 10.1038/s41746-025-02322-6 Search in PMC Search in PubMed View in NLM Catalog Add to search BRIDGE pilot study: a bilateral regulatory investigation of data governance and exchange Helen X Hou Helen X Hou 1 Department of Radiation Oncology, TUM University Hospital, Technical University of Munich, Munich, Germany 2 Department of Pathology, Massachusetts General Hospital and Harvard Medical School, Boston, MA USA Find articles by Helen X Hou 1, 2, ✉ , Tom Bisson Tom Bisson 3 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Institut für Medizinische Informatik, Berlin, Germany 4 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Institut für Pathologie, Berlin, Germany Find articles by Tom Bisson 3, 4 , Sophia M Leiss Sophia M Leiss 1 Department of Radiation Oncology, TUM University Hospital, Technical University of Munich, Munich, Germany 5 Department of Clinical Neuroscience, Institute of Neuroscience and Physiology, Sahlgrenska Academy, University of Gothenburg, Gothenburg, Sweden Find articles by Sophia M Leiss 1, 5 , Julia Thierauf Julia Thierauf 6 Foundation Medicine Inc, Cambridge, MA USA Find articles by Julia Thierauf 6 , Ariel D Stern Ariel D Stern 7 Digital Health Cluster, Hasso-Plattner Institute, University of Potsdam, Potsdam, Germany 8 Harvard Business School Technology and Operations Management, Boston, MA USA 9 Harvard-MIT Center for Regulatory Science, Boston, MA USA Find articles by Ariel D Stern 7, 8, 9 , Hendrik Strobelt Hendrik Strobelt 10 IBM Research/MIT-IBM AI Lab, Cambridge, MA USA Find articles by Hendrik Strobelt 10 , Felix Nensa Felix Nensa 11 Institute of Diagnostic and Interventional Radiology and Neuroradiology, University Hospital Essen, Essen, Germany 12 Institute for Artificial Intelligence in Medicine (IKIM), University Hospital Essen, Essen, Germany Find articles by Felix Nensa 11, 12 , Alena Buyx Alena Buyx 13 Institute of History and Ethics in Medicine, Technical University of Munich, Munich, Germany 14 German Ethics Council, Berlin, Germany Find articles by Alena Buyx 13, 14 , Katharina M Huster Katharina M Huster 15 Ethics Committee, Technical University Munich, Munich, Germany Find articles by Katharina M Huster 15 , Kira Furlano Kira Furlano 16 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Klinik für Urologie, Berlin, Germany Find articles by Kira Furlano 16 , Zisis Kozlakidis Zisis Kozlakidis 17 International Agency for Research on Cancer, World Health Organization, Lyon, France Find articles by Zisis Kozlakidis 17 , Sachin Gupta Sachin Gupta 18 American Society for Clinical Pathology, Chicago, IL USA Find articles by Sachin Gupta 18 , Danko Kostadinov Danko Kostadinov 19 Colorectal and General Surgery, Princess Royal University Hospital, King’s College Hospital NHS Foundation Trust, London, United Kingdom Find articles by Danko Kostadinov 19 , Peter Boor Peter Boor 20 Institute of Pathology, University Clinic Aachen, RWTH Aachen University, Aachen, Germany Find articles by Peter Boor 20 , Anna Slagman Anna Slagman 21 Charité - Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Notfallmedizinische Versorgungsforschung, Berlin, Germany Find articles by Anna Slagman 21 , Thorsten Tjardes Thorsten Tjardes 22 Department of Trauma and Orthopedic Surgery, University of Witten/Herdecke, Cologne, Germany Find articles by Thorsten Tjardes 22 , Pierre Cholet Pierre Cholet 23 Decentriq, Berlin, Germany Find articles by Pierre Cholet 23 , Nick K Schneider Nick K Schneider 24 German Federal Ministry of Health, Berlin, Germany Find articles by Nick K Schneider 24 , Thorsten Schlomm Thorsten Schlomm 16 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Klinik für Urologie, Berlin, Germany Find articles by Thorsten Schlomm 16 , Saskia Biskup Saskia Biskup 25 CeGaT und Zentrum für Humangenetik Tübingen, Tuebingen, Germany Find articles by Saskia Biskup 25 , Rainer Röhrig Rainer Röhrig 26 Institute of Medical Informatics, University Hospital RWTH Aachen, Aachen, Germany 27 TMF—Technology and Methodology Plattform for Networked Medical Research e.V., Berlin, Germany Find articles by Rainer Röhrig 26, 27 , Fruzsina Molnár-Gábor Fruzsina Molnár-Gábor 28 Bio Quant / Faculty of Law, Heidelberg University, Heidelberg, Germany Find articles by Fruzsina Molnár-Gábor 28 , Uta Schmidt-Straßburger Uta Schmidt-Straßburger 29 Master Online Study Program Advanced Oncology Ulm University Medical Faculty Division of Learning and Teaching, Ulm, Germany Find articles by Uta Schmidt-Straßburger 29 , Katharina Ladewig Katharina Ladewig 30 Center for Artificial Intelligence in Public Health Research, Robert Koch Institute, Berlin, Germany Find articles by Katharina Ladewig 30 , Marcel Weigand Marcel Weigand 27 TMF—Technology and Methodology Plattform for Networked Medical Research e.V., Berlin, Germany Find articles by Marcel Weigand 27 , Daniel Pinto dos Santos Daniel Pinto dos Santos 31 Department of Radiology, University Medical Center Mainz, Mainz, Germany Find articles by Daniel Pinto dos Santos 31 , Jason M Johnson Jason M Johnson 32 Dana-Farber Cancer Institute, Boston, MA USA Find articles by Jason M Johnson 32 , Toralf Kirsten Toralf Kirsten 33 Institute for Medical Informatics, Statistics and Epidemiology, Leipzig University, Leipzig, Germany 34 Dept. Medical Data Science, University of Leipzig Medical Center, Leipzig, Germany Find articles by Toralf Kirsten 33, 34 , Eric Sutherland Eric Sutherland 35 Organization for Economic Co-operation and Development (OECD), Paris, France Find articles by Eric Sutherland 35 , Norman Zerbe Norman Zerbe 3 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Institut für Medizinische Informatik, Berlin, Germany 20 Institute of Pathology, University Clinic Aachen, RWTH Aachen University, Aachen, Germany Find articles by Norman Zerbe 3, 20 , Albert Hofman Albert Hofman 36 Department of Epidemiology, Harvard T.H. Chan School of Public Health, Boston, MA USA Find articles by Albert Hofman 36 , Ralf Heyder Ralf Heyder 37 Charité—Universitätsmedizin Berlin, Corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin, Network of University Medicine Coordination Office, Berlin, Germany Find articles by Ralf Heyder 37 , Georg Schmidt Georg Schmidt 15 Ethics Committee, Technical University Munich, Munich, Germany 38 Department of Internal Medicine I, TUM University Hospital, Technical University of Munich, Munich, Germany Find articles by Georg Schmidt 15, 38 , Jochen K Lennerz Jochen K Lennerz 39 BostonGene, Waltham, MA USA Find articles by Jochen K Lennerz 39 Author information Article notes Copyright and License information 1 Department of Radiation Oncology, TUM University Hospital, Technical University of Munich, Munich, Germany 2 Department of Pathology, Massachusetts General Hospital and Harvard Medical School, Boston, MA USA 3 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Institut für Medizinische Informatik, Berlin, Germany 4 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Institut für Pathologie, Berlin, Germany 5 Department of Clinical Neuroscience, Institute of Neuroscience and Physiology, Sahlgrenska Academy, University of Gothenburg, Gothenburg, Sweden 6 Foundation Medicine Inc, Cambridge, MA USA 7 Digital Health Cluster, Hasso-Plattner Institute, University of Potsdam, Potsdam, Germany 8 Harvard Business School Technology and Operations Management, Boston, MA USA 9 Harvard-MIT Center for Regulatory Science, Boston, MA USA 10 IBM Research/MIT-IBM AI Lab, Cambridge, MA USA 11 Institute of Diagnostic and Interventional Radiology and Neuroradiology, University Hospital Essen, Essen, Germany 12 Institute for Artificial Intelligence in Medicine (IKIM), University Hospital Essen, Essen, Germany 13 Institute of History and Ethics in Medicine, Technical University of Munich, Munich, Germany 14 German Ethics Council, Berlin, Germany 15 Ethics Committee, Technical University Munich, Munich, Germany 16 Charité—Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Klinik für Urologie, Berlin, Germany 17 International Agency for Research on Cancer, World Health Organization, Lyon, France 18 American Society for Clinical Pathology, Chicago, IL USA 19 Colorectal and General Surgery, Princess Royal University Hospital, King’s College Hospital NHS Foundation Trust, London, United Kingdom 20 Institute of Pathology, University Clinic Aachen, RWTH Aachen University, Aachen, Germany 21 Charité - Universitätsmedizin Berlin, corporate member of Freie Universität Berlin, Humboldt-Universität zu Berlin, Notfallmedizinische Versorgungsforschung, Berlin, Germany 22 Department of Trauma and Orthopedic Surgery, University of Witten/Herdecke, Cologne, Germany 23 Decentriq, Berlin, Germany 24 German Federal Ministry of Health, Berlin, Germany 25 CeGaT und Zentrum für Humangenetik Tübingen, Tuebingen, Germany 26 Institute of Medical Informatics, University Hospital RWTH Aachen, Aachen, Germany 27 TMF—Technology and Methodology Plattform for Networked Medical Research e.V., Berlin, Germany 28 Bio Quant / Faculty of Law, Heidelberg University, Heidelberg, Germany 29 Master Online Study Program Advanced Oncology Ulm University Medical Faculty Division of Learning and Teaching, Ulm, Germany 30 Center for Artificial Intelligence in Public Health Research, Robert Koch Institute, Berlin, Germany 31 Department of Radiology, University Medical Center Mainz, Mainz, Germany 32 Dana-Farber Cancer Institute, Boston, MA USA 33 Institute for Medical Informatics, Statistics and Epidemiology, Leipzig University, Leipzig, Germany 34 Dept. Medical Data Science, University of Leipzig Medical Center, Leipzig, Germany 35 Organization for Economic Co-operation and Development (OECD), Paris, France 36 Department of Epidemiology, Harvard T.H. Chan School of Public Health, Boston, MA USA 37 Charité—Universitätsmedizin Berlin, Corporate member of Freie Universität Berlin and Humboldt-Universität zu Berlin, Network of University Medicine Coordination Office, Berlin, Germany 38 Department of Internal Medicine I, TUM University Hospital, Technical University of Munich, Munich, Germany 39 BostonGene, Waltham, MA USA ✉ Corresponding author. Received 2025 Jul 29; Accepted 2025 Dec 24; Collection date 2026. © The Author(s) 2026 Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/ . PMC Copyright notice PMCID: PMC13022335 PMID: 41703202 Abstract National privacy laws diverge between the European Union and United States, hindering transatlantic health data exchange and slowing AI-driven medical innovation. In response, the German Ministry of Health launched the pre-competitive Data for Health initiative , leading to the BRIDGE Pilot Study (2023–2025), a researcher-led effort to address this regulatory and legal gap. Using a mixed-methods approach, including structured surveys ( n = 56 expert responses), ranking of steps via relative importance indexing , and 4 Delphi meetings, experts co-developed a practical framework composed of 30 steps in 3 consecutive phases for legally compliant and technically interoperable EU-US health data collaboration. The framework emphasizes early data protection assessments, secure transfer protocols, and iterative governance checks. The final consensus framework provides a stepwise guide to navigate regulatory and legal complexities and operationalize cross-border research. Ongoing input from researchers and stakeholders will help ensure the framework remains adaptable and provides a clear, scalable foundation for cross-border health data exchange. Subject terms: Medical research, Risk factors Introduction Amidst a growing emphasis on domestic priorities 1 , 2 , divergences in healthcare policy are growing. The European Union (EU) and the United States (US) operate under distinct legal frameworks 3 – 5 . In the EU, the right to data protection is recognized as a fundamental right (Article 8, Charter of Fundamental Rights (CFR) of the EU), related to - but distinct from the right to privacy (Article 7, CFR of the EU) 3 . This status as a fundamental right shapes all subsequent legislation, including the General Data Protection Regulation (GDPR) 6 , the Artificial Intelligence (AI) Act 7 and the recently adopted governance framework entitled European Health Data Space (EHDS) 8 . In contrast, the US Constitution does not establish data protection as a fundamental right 3 . Privacy protections are instead implemented through statutory law, most notably the Health Insurance Portability and Accountability Act (HIPAA 9 ), evolving state-level privacy laws 10 (e.g., California Consumer Privacy Act 11 , Colorado Privacy Act 12 ) as well as ongoing attempts to craft additional federal legislation (e.g. American Data Privacy and Protection Act ADDPA 13 ). Although both jurisdictions uphold patient privacy and promote ethical data use, their definitions of key terms (e.g., identifiability, pseudonymization, and the legal basis for data processing) remain distinct (Table 1 ). These structural and normative differences illustrate a current state of misalignment. Table 1. Key Terminological Differences in EU–US Health Data Governance Selected Terms United States (HIPAA/ State Privacy Level) European Union (GDPR/EHDS) Implications for regulatory interoperability and/or data exchange Identifiability Narrow definition: “protected health information” (PHI) includes 18 specific identifiers under HIPAA Broadly defined: includes any data that can be linked to an individual, even indirectly EU considers more datasets as identifiable, triggering stricter requirements Pseudonymization Often treated as de-identified if re-identification risk is “very small” A privacy-enhancing technique; still considered personal data under GDPR US may treat pseudonymized data as non-PHI, creating legal asymmetry Anonymization Not explicitly defined in HIPAA; relies on “expert determination ” or safe harbor criteria Must be irreversible; anonymized data is no longer subject to GDPR EU rarely accepts US anonymization techniques as compliant Legal Basis for Processing of Health Data Use and disclosure of PHI is generally prohibited unless permitted under the HIPAA Privacy Rule, e.g., for treatment, payment, healthcare operations, or certain public health, research, and legal purposes without individual authorization. Processing of health data is generally prohibited under the GDPR unless a valid legal basis applies (Art. 6) and one of the specific conditions for processing special categories of data is met (Art. 2), i.e., explicit consent, provision of healthcare, reasons of public interest, or scientific research with appropriate safeguards Fundamental legal logic differs; EU consent or additional national or Union law often required when US does not Regulatory Focus and Governance Model Institution-centered: regulates duties and permitted uses of covered entities and business associates Individual-centered: defines rights of data subjects and lawful bases for controllers/processors EU consent or additional law often required where US law relies on institutional authorization Data Subject Rights More limited: access and amendment under HIPAA; broader rights emerging under state laws (e.g. CCPA) Broad: information, access, rectification, erasure, restriction, objection, portability EU mandates rights incompatible with some US research workflows Data Transfer Mechanisms Relies on organizational compliance and contractual assurances Requires adequacy decisions, SCCs, or other safeguards; DPF (2023) currently still valid Post-Schrems II scrutiny makes EU–US transfers legally fragile Open in a new tab CCPA California Consumer Privacy Act, DPF EU–U.S. Data Privacy Framework, EHDS European Health Data Space, EU European Union; HIPAA Health Insurance Portability and Accountability Act, PHI Protected Health Information, SCC Standard Contractual Clauses, US United States. Simultaneously, the AI revolution in medicine and public health depends on large, diverse, and high-quality datasets, raising critical concerns about access, equity, and responsible data governance 14 – 16 . Foundational principles such as individual rights, responsible use, and ethical guardrails are converging 17 , yet the operationalization of these ideals across jurisdictions lag 18 ; particularly in healthcare. Transatlantic collaboration now sits at a critical juncture: constrained by regulatory and legal complexities yet driven by a shared imperative to accelerate therapeutic development, streamline health system operations, foster innovation, and improve the quality, efficiency, and patient-centricity of care through broader data access 19 . The adopted EHDS framework now offers a path forward for enabling secure, lawful data transfers between public institutions 8 , 19 in Europe, whereas the Trusted Exchange Framework and Common Agreement (TEFCA) 20 provides the backbone for nationwide health-information exchange in the United States. To date, there is no practical instruction or ‘playbook’ that defines how to conduct legally compliant, ethically sound, and interoperable transatlantic health data exchange. Recognizing this, the German Federal Ministry of Health and US partners launched the precompetitive Data for Health Initiative ( www.dfh23.de 21 ) , bringing together researchers and policymakers to identify barriers and solutions. One outcome of this initiative is the BRIDGE Pilot Study ( Bilateral Regulatory Investigation of Data Governance and Exchange ; 2023–2025). Launched by researchers for researchers, this initiative defines the practical steps required for effective EU-US health data sharing. Here, we present an initial consensus-based framework to guide transatlantic collaborations through a structured, expert-informed approach. The larger context is to enable responsible, global-scale health data collaboration that accelerates research and improves care. Results Initial framework The drafting process resulted in a 30-step procedural framework (Fig. 1a and Table S1 ). The framework was structured into three phases that, in principle, reflect the progression of any research study: Phase I: preparation and development, Phase II: core data activities, and Phase III: data integration and analysis (Fig. 1b ). This initial draft served as the foundation for iterative refinement through expert input. Fig. 1. Project concept. Open in a new tab The figure outlines the four components of the study. (1) Draft: An initial 30-step framework (a) was created based on expert and large language model (LLM) input and structured into three phases (b). (2) Survey & Analysis: The framework was evaluated through a survey (c), allowing reordering of steps and qualitative feedback (d). In total (e), 56 complete responses and 42 open-ended comments were analyzed (f). (3) Delphi Meetings: Iterative virtual meetings enabled collaborative review (g), refinement, and consensus building (h) toward the finalized framework (i). (4) Dissemination: The refined framework was presented at three international conferences (j), prepared for open-access publication (k), and submitted to the German Federal Ministry of Health as input for policy-relevant recommendations (l). Survey The survey was distributed through multiple national and international societies and institutional networks to ensure broad representation. The full list of distributing societies is provided in Table S2 . A total of 178 individuals accessed the survey. After exclusion of n = 122 partial responses, n = 56 complete responses formed the basis for our analysis. The survey was composed of three main parts: demographics, ranking of items, and comments/feedback. Demographics Demographic characteristics of the 56 participants (Fig. 2 ) shows the range of professional roles, with most participants identifying as medical professionals ( n = 26, 46%) or researchers ( n = 18, 32%; Fig. 2a ). Nearly half were affiliated with academic institutions ( n = 27, 48%), followed by the public health sector ( n = 10, 18%) and non-governmental organizations ( n = 8, 14%; Fig. 2b ). Most participants reported involvement in health/patient data exchange ( n = 51, 91.1%), particularly in research implementation and regulatory work (Fig. 2c ). The participants had a cumulative postgraduate experience of over 800 years (Fig. 2d ) with an average of 17.7 years, and a median of 17.5 years per participant (range 0–48 years). Following the 10,000 h rule 24 at least n = 40 participants (71%) can be considered experts in their domain. Over half were based in Germany ( n = 30, 53.6%), followed by the US ( n = 15, 26.8%) and other countries ( n = 11, 19.6% Fig. 2e ). Although internationally distributed, all participants have direct experience in either the German/EU or US research and regulatory systems, ensuring that the framework’s EU–US focus is professionally grounded and relevant. Fig. 2. Survey participant demographics. Open in a new tab Survey participants represented a range of ( a ) professional roles and ( b ) sectors, with the majority affiliated with academia. Most participants reported exposure to health data ( c ) and the majority had over a decade of postgraduate experience ( d ). Participants reported their workplace as based in Germany and the United States ( e ). Ranking of items Participants reviewed and either confirmed or reordered the original 10 procedural steps within each of the three framework phases (Fig. 3 ; Table S3 ). In the Preparation and Development Phase , n = 18 out of 56 participants (32%) agreed with the original order, n = 38 (68%) reordered at least one item. In the Core Data Phase , n = 27 participants (48%) retained the proposed order, n = 29 (52%) made changes. In the Data Integration and Analysis Phase , n = 20 participants (36%) agreed with the initial sequence, n = 36 (64%) made modifications (Fig. 3a ). Across phases, the Preparation and Development Phase retained the original sequence (Fig. 3b ). The Core Data Phase showed relatively minor reordering concentrated in lower-ranked steps (i.e., steps II: 7, 8 and 9). In contrast, the Data Integration and Analysis Phase showed substantial shifts in sequence, reflecting greater variability in later stage analytical workflows (i.e., steps III: 3-9). The final order of steps was established by the RII for each phase (see Table S4 ). Fig. 3. Survey results on step sequence across three project phases. Open in a new tab a Bar charts indicate the levels of agreement and disagreement with the originally proposed step order, along with the number of comments received for each phase. b Based on survey input, the original steps were re-ordered within each phase to reflect a consensus-driven final sequence. The revised framework integrates these adjustments across all three phases. Comments Participants were invited to suggest missing steps and provide open-ended feedback. This generated 42 written comments for the three phases (Figs. 1 e, 3a ). The following summary reflects key feedback points (for a full list see Table S5 – S7 ). In the Preparation & Development Phase (Phase I ; Table S5 ) , there was strong support for early planning of data protection impact assessments, consultation with data protection authorities, and consideration of interoperability standards such as Fast Healthcare Interoperability Resources (FHIR). One participant advocated for a two-step ethical approval process in transatlantic collaborations. Another proposed appointing a Chief Data Officer to coordinate multi-step compliance and communication. In the Core Data Phase (Phase II ; Table S6 ) , participants highlighted the need for secure data transmission, early testing to identify process vulnerabilities, and parallelization of steps to optimize timelines. Several participants emphasized the integration of regular feedback loops and quality checks. In the Data Integration and Analysis Phase (Phase III ; Table S7 ) , there was repeated emphasis on the importance of conducting exploratory data analysis earlier in the sequence to ensure data readiness. Participants also commented on model validation, especially in evolving datasets, and promoted the use of data visualization and re-validation strategies. Additional suggestions included planning for data archiving, and dissemination strategies to non-technical stakeholders. The number of steps participants chose to move increased across the survey phases (Fig. 3b ), whereas the number of written comments decreased (Phase I: 18, Phase II: 14, Phase III: 11; Fig. 3a ). Notably, participants already made substantial rearrangements in Phase I, as reflected by the rank-sum of deviations (n = 229 in Phase I vs. n = 193 in Phase II and n = 272 in Phase III). Despite these shifts, the final RII-based order remained essentially unchanged. Similarly, Phase I showed that 68% of participants disagreed with at least one step (Fig. 3a ); however, these alterations did not manifest in the RII-based final order either. Delphi meetings We hosted four modified Delphi meetings, with n = 22, n = 14, n = 9, and n = 8 attendees, respectively. Of note, we recruited n = 11 participants through the survey (opt-in question). Attendance and session outcomes were documented for each meeting (Table S8 ). The meetings addressed several topics: participant demographics, item lists per phase (I, II, III) alongside the comments, as well as review and discussion of the finalized RII-based framework, manuscript, tables, and figures. Many comments were discussed in depth during the Delphi meetings and informed the final refinement of the framework. For example, one suggestion during a meeting was to compile the specific list of stakeholders responsible for each step in the final framework, whether cross-coordination across EU-US would be necessary, and their relation to specific study types. This table was constructed, reviewed and is provided as Table S9 . During several meetings, data integrity was highlighted as a core concept, particularly the ALCOA principle (Table S10 ). One additional suggestion was to initiate the collection of relevant web resources; now provided as Table S11 . Key elements from these collaborative review sessions helped shape this publication, tackled contextualization of our results, and emphasized the need for further tailoring based on specific study topics. We also incorporated feedback from presentations at three international conferences that collectively re-emphasized the need for a practical framework. Discussion Here, we report the results of the BRIDGE Pilot Study, a transatlantic effort to co-develop a stepwise, consensus-based framework for legally compliant, ethically sound, and technically interoperable health data exchange between the EU and the US. This study is the first to systematically map the procedural requirements for cross-border data collaboration using a mixed-methods approach that combines expert surveys, procedural step-ranking, and iterative Delphi consensus. By integrating diverse stakeholder perspectives and resolving conflicting priorities, the study delivers a practical, adaptable blueprint that addresses long-standing and evolving regulatory and operational gaps. The resulting 30-step framework reflects not only current legal requirements but also offers a scalable structure for future policy alignment and research implementation. Cross-border access to high-quality health data is becoming increasingly essential for enabling AI-driven research, accelerating therapeutic development, and responding to global public health challenges; yet no established roadmap exists for how to do this in a compliant, ethical, and interoperable manner. The context of transatlantic health data sharing is shaped by three interrelated forces: (1) the growing reliance on AI in medicine and public health, (2) the persistent legal misalignment and different operational implementations between the EU and US, (3) and the direct experience of researchers navigating these complexities. Recent developments underscore the importance of similar projects 19 , 21 , 25 . Practical interoperability continues to be limited by regulatory and legal divergence. The GDPR and HIPAA, in particular, differ in their legal bases for processing, scope of protections, and definitions of identifiable data 26 – 28 . These differences have previously disrupted transatlantic collaboration, most notably after the Schrems II ruling 29 , 30 , which invalidated the EU-US “Privacy Shield” in 2020 due to concerns over US surveillance practices. The 2023 EU-US Data Privacy Framework (DPF) 31 was introduced to address these concerns, and as of 2023, was approved by the European Commission as a valid adequacy decision 32 . However, the DPF applies only to private-sector entities and excludes public institutions such as universities and government agencies processing health data 33 . Moreover, given the history of prior adequacy frameworks being invalidated, questions remain about the long-term stability of the DPF and its suitability for research collaborations. In the EU, the adoption of the EHDS Regulation 25 , 34 in March 2025 aims to standardize the use and exchange of electronic health data across member states, enhancing individuals’ access and control over their personal data while facilitating reuse for inter alia research and innovation 35 . The EHDS introduces a sector-specific model that may enable health-related data sharing across borders, potentially sidestepping broader adequacy debates between the EU and US 19 . However, as highlighted by Lalova-Spinks et al., the success of this approach will depend on several factors: (a) whether the European Commission, through its implementing acts, provides a clear pathway for the applicable GDPR transfer mechanisms; (b) whether US authorities are willing to participate in the EHDS infrastructure by designating a national contact point; and (c) whether sovereign immunity concerns can be addressed through this contact point 19 . In addition, secondary use of health data through the common ‘HealthData@EU’ governance infrastructure 36 will only be applicable as of March 2029 and other countries will only be able to participate as of March 2035. Concurrently, the US Department of Health and Human Services (HHS) has proposed significant updates to the HIPAA Security Rule to strengthen 37 cybersecurity for electronic Protected Health Information (ePHI) 38 . These changes require covered entities to implement encryption, multifactor authentication, and updated risk assessments. While intended to improve data security, these reforms may further complicate compliance and delay or hinder coordination in cross-border data exchange. Given these dynamics, the BRIDGE Pilot Study delivers more than a procedural framework. We offer a shared foundation for trust-building and a “playbook” for operational alignment in a conceptually distinct regulatory landscape (Table 1 ). By elevating practitioner insights into a structured, consensus-driven model, the study helps translate abstract legal principles into actionable guidance. Its pragmatic orientation fills a critical void between high-level policy ambition and the day-to-day realities of international research collaboration. We are also sharing this framework as input for policymakers, regulators, and legislators: i.e., as concrete bottom-up insights from researchers (Table S12 ). By sharing results of initiatives such as BRIDGE, policymakers can gain direct insight into the practical challenges and solutions of transatlantic health data sharing. Although formal adoption in Germany and the US has not yet occurred, these early efforts lay the groundwork for constructive dialogue and eventual regulatory integration (i.e., top-down; Table S12 ). Policymakers can use this foundation to develop legally compliant and operationally feasible policies aligned with real-world research practices. The America’s AI Action Plan 39 similarly encourages regulators to evaluate how existing law applies to emerging technologies. Sustained dialogue between policymakers and researchers remains essential to resolve legal and regulatory barriers. Strengthening this engagement may involve integrating policymaker into transatlantic working groups, highlighting the policy relevance of research outputs, and fostering trusted pre-competitive collaborative research communities. We note that the concerns raised by legal departments extend beyond our specific approach, particularly regarding engagement with the U.S., where the lack of effective legal remedies and GDPR restrictions on data sharing without valid consent remain unresolved issues. While Hussein et al. 25 , and others 40 – 42 have provided toolkits for specific research questions or use cases, we are not aware of a previously published general framework. Our study creates space for bilateral alignment between two important regulatory ecosystems (Germany and the US) while offering a template that can be adapted across jurisdictions. We acknowledge that Germany’s federal structure leads to regional variation in the implementation of EU and national laws; nonetheless, our framework offers procedural guidance designed to be adaptable to local and institutional settings. As legal frameworks evolve and digital health infrastructures mature, such practical instruments will be essential to ensure that compliance does not become a barrier to progress, but a channel through which global health data collaboration can responsibly scale. Several limitations of this study must be acknowledged. First, the framework was developed through expert consensus and has not yet been tested in a live cross-border data exchange, meaning its practical utility in specific institutional or national contexts remains to be validated. Applicability will vary across settings due to local legal and infrastructural conditions, underscoring the need for adaptation and testing. Thus, a key limitation of any new general framework, including BRIDGE, is the initial lack of evidence for its practical applicability. Second, the survey relied on voluntary participation, introducing potential selection bias and limiting the generalizability of findings beyond the primarily German and US-based respondent pool. Third, the survey design required participants to select only one professional role, which may not fully capture individuals concurrent or prior roles and thus likely underrepresents the diversity of professions. Furthermore, the increasing number of step changes over the course of the survey (Fig. 3b ) may reflect growing familiarization with the sorting interface, while the decline in comments suggests emerging survey fatigue 43 . In addition, it seems counterintuitive that 68% of participants in Phase I disagreed with the initial order while the final order remained unchanged. However, the rank-sum of deviations indicates that participants did meaningfully reorder items–even though these individual changes did not substantially alter the final order based on the relative importance index (Fig. 3b Phase I). While this may suggest a potential limitation or bias in the relative importance index, we provide the raw data to enable alternative analytical approaches. Fourth, while the Delphi process enabled iterative refinement, it was conducted virtually and without formal anonymity, which may have influenced group dynamics or constrained dissenting perspectives. Fifth, although there are emerging technical approaches to data federation 44 , synthetic data generation 45 , and privacy-preserving computation 46 , these were not the focus of this pilot. We intentionally worked under the premise that, in some research scenarios (e.g., event traceability or regulatory decision-making), the exchange of actual individual-level health data remains necessary. Finally, the framework reflects the regulatory environment as of mid-2025; given the rapid pace of legal and technological change (particularly with respect to EHDS, HIPAA reforms, and AI governance), ongoing revision will be necessary to maintain its relevance and applicability. Looking ahead, the BRIDGE framework can serve as a living tool to support evolving policy efforts and research practices. As institutions prepare for the operationalization of the EHDS and respond to shifting US data protection standards, including recent executive actions that signal a more restrictive stance on certain cross-border data flows, there is a critical opportunity and growing need to pilot and refine the framework in real-world settings. Its application will also require both procedural and technical resources, including integration into existing (local) governance structures, secure infrastructures, and standardized templates. To support this, we provide a table with useful resources in the supplement (Table S11 ). In parallel, we are working on concrete transatlantic data exchange use case projects that apply elements of the framework to test and refine its practical applicability. Future work should further validate the framework across diverse legal, technical, and cultural contexts, while promoting dialogue and shared infrastructure development 19 . To strengthen the framework’s responsiveness to evolving legal and regulatory conditions, we explicitly incorporated adaptability into its structure (Table S13; Modifiable Bridge Framework Document). The presented BRIDGE framework also includes a proposed quality management system (QMS; Fig. 3 Step 31). Briefly, the QMS is organized in 7 modules to orchestrate periodic review, legal alignment, and versioning (Table S13). We also provide additional considerations and practical example questions for local refinement. Adaptability is thereby operationalized through scheduled review triggers, branching logic for alternative regulatory conditions, and explicit integration of legal–policy expertise at key decision points. These additions ensure that the framework can evolve as the EHDS secondary acts are adopted, as US Executive Orders or federal privacy initiatives emerge, and as institutional interpretation of GDPR/HIPAA requirements shifts over time. As a result, and if resource permit, the BRIDGE framework can transition from a static proposal to a living procedural tool with clearly defined mechanisms for continuous alignment with regulatory change. A modifiable version of the BRIDGE framework is provided as a supplement. The BRIDGE Pilot Study delivers a consensus-based, stepwise and adaptable framework intended to support ethical, legally sound, and technically feasible health data exchange between the EU and the US. While its ultimate applicability will depend on further testing and validation, it provides timely procedural guidance amidst regulatory uncertainty and offers a practical foundation for researchers and policymakers to build scalable, trustworthy international data collaborations. Methods Study design This pilot study applied a mixed methods design to develop a framework for compliant transatlantic health data exchange. The study is structured into four key sections: (1) Draft, (2) Survey and Analysis, (3) Delphi Meetings, and (4) Dissemination. Draft The initial framework (Fig. 1a,b ) was developed based on the professional experience of the authors, including clinicians, policymakers, researchers, and experts in medical law and medical informatics from both the EU and the US. To enhance clarity and consistency, we also used a large language model (LLM; OpenAI GPT-4.0) for proofreading and cross-checking. Survey and analysis A structured survey was created using Qualtrics (Qualtrics, Provo, UT) and distributed through national and international societies and institutional networks (Fig. 1c ). The survey was conducted between Nov 8 th , 2024 and Apr 8th, 2025. The primary aim of the survey was to gather expert input by having participants reorder 30 procedural steps, suggest missing elements, and provide open-ended feedback based on their practical experience (Fig. 1d ). In addition, we provided an opt-in page to join subsequent meetings (Delphi process; see below). A total of 56 complete responses and 42 qualitative comments were collected (Fig. 1e ). Analysis of demographic variables included gender, country of residence, professional role, employment sector, years of postgraduate experience, board certification status (if applicable), and involvement in health data governance; all data were analyzed using Microsoft Excel for macOS (version 16.94). Frequencies and percentages were reported for categorical variables (Fig. 2 ). We distinguished between agreement (for all steps) and disagreement (with at least one step) for calculation of overall agreement/disagreement percentages. We defined the rank-sum of deviations (from original order) as the total absolute difference in positions between each item’s original rank and its new rank after participant reordering–summed across all items (and participants). This provides a single numeric summary of how much a cohorts ranking deviated from the original order. During the analysis we assessed the relative priority of each procedural step using the Relative Importance Index (RII) calculated from participant rankings. RII was computed using the formula RII = Σ(W × X) / (A × N), where W is the weight assigned to each rank (inversely proportional to position, with rank 1 receiving weight 10), X is the number of respondents assigning that rank, A is the highest possible rank (10), and N is the total number of respondents. This normalization results in a score between 0 and 1, where values closer to 1 indicate steps generally placed earlier in the process (Fig. 1f ). Delphi meetings Survey results were reviewed through a series of four online meetings (Mar 21st, 2025; Apr 14th, 2025; May 5th, 2025; Jun 4th, 2025), using a modified Delphi method to refine the procedural framework and reach expert consensus (Fig. 1g ). The Delphi approach is particularly well suited for contexts where definitive evidence is limited, and expert opinion plays a critical role. Meetings brought together members of the initial project group and survey participants, enabling structured discussions of conflicting priorities and qualitative feedback (Fig. 1h ). We followed established reporting guidance for the Delphi process 22 , 23 and documented the number of participants, activities conducted, and discussion outcomes at each stage. Each session was recorded, independently reviewed by two authors (HXH and JKL), and all expert comments and clarifications were tracked and circulated to the authors, forming the basis for iterative refinement. Relevant input was collected by e-mail and incorporated in subsequent meetings, the manuscript and, when applicable, accompanying study documentation (Fig. 1i ). The framework was shaped through an open, iterative process in which drafts were circulated to policy and legal experts at international meetings and through individual consultations. Their comments were transparently logged, reviewed, and incorporated into successive revisions, ensuring that specialist expertise is embedded in the final version. Dissemination and feedback The study was disseminated through multiple channels to maximize visibility and impact. This included presentation at three international conferences (Fig. 1j ). Specifically, the German American Conference 2024 (Boston, Nov 14–16th 2024), the Robert Koch Institute (RKI) AI in Public Health Research Symposium (Berlin, May 14–15th 2025), and the European Congress of Digital Pathology (ECDP) 2025 (Barcelona, Jun 25–28th 2025). The agreed upon study design included an open access, peer-reviewed publication (Fig. 1k ) and ultimately will entail sharing of the published results through the Data for Health community and associated stakeholder groups to support ongoing policy discussions and promote sustainable transatlantic collaboration (Fig. 1l ). Ethics approval and consent to participate This study collected survey data and expert input through a Delphi-style process. In accordance with applicable guidelines for minimal-risk, non-clinical online research, formal review by an ethics committee was not required. All participants were informed about the study purpose, voluntary participation, and data protection measures consistent with the General Data Protection Regulation (GDPR). Completion of the survey was taken as indication of informed consent. Specifically, after completion, participants could voluntarily provide their name and email address if they wished to be included in subsequent Delphi meetings; this information was collected separately from survey responses to ensure confidentiality. Supplementary information supplementary tables (2.6MB, xlsx) supplementary information (1.8MB, docx) Acknowledgements We like to thank all stakeholders of the various societies that have helped us distribute the survey. The Data for Health initiative was funded by the German Federal Ministry of Health. Tom Bisson received partial funding from the German Federal Ministry of Health (Förderkennzeichen 2524DAT001). The authors received no specific funding for this work. Author contributions Conceptualization: H.X.H., T.B., S.M.L., J.T., E.S., N.Z., A.H., R.H., G.S., J.K.L.; Methodology: H.X.H., T.B., J.K.L., G.S.; Software; H.X.H., J.K.L.; Validation: H.X.H., J.K.L., T.B., S.M.L.; Formal Analysis and Investigation: J.K.L., H.X.H.; Resources: H.X.H., T.B., S.M.L., J.T., A.H., G.S., J.K.L., N.K.S., T.S.; Data Curation: H.X.H., J.K.L., T.B., S.M.L., J.T.; Writing–Original Draft: J.K.L., H.X.H.; Writing–Review & Editing: H.X.H., T.B., S.M.L., J.T., A.D.S., H.S., F.N., A.B., D.R., K.H., K.F., Z.K., S.G., D.K., P.B., A.C.S., T.T., P.C., N.K.S., T.S., S.B., R.R., F.M.G., U.S.S., K.L., M.W., D.P.D.S., J.M.J., T.K., E.S., N.Z., A.H., R.H., G.S., J.K.L.; Visualization: H.X.H., T.B., J.T., J.K.L.; Supervision: A.H., R.H., G.S., J.K.L.; Project Administration: A.H., J.K.L.; Funding Acquisition: J.K.L., A.H. Funding Open Access funding enabled and organized by Projekt DEAL. Data availability All data generated or analyzed during this study are included in this published article and its supplementary information files. Recordings of Delphi meetings are available upon request. Code availability Not applicable Competing interests J.K.L., employment BostonGene. N.K.S., employment German Federal Ministry of Health. J.T., employment Foundation Medicine. Where authors are identified as personnel of the German Federal Ministry of Health, the authors alone are responsible for the views expressed in this article and they do not necessarily represent the decisions, policy or views of the German Federal Ministry of Health or Federal German Government. Where authors are identified as personnel of the International Agency for Research on Cancer/WHO, the authors alone are responsible for the views expressed in this article and they do not necessarily represent the decisions, policy or views of the International Agency for Research on Cancer/WHO. Footnotes Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. Supplementary information The online version contains supplementary material available at 10.1038/s41746-025-02322-6. References 1. Elsamadony, M., Pileggi, S. F., Liu, J. & Fujii, M. Crafting a resilient and sustainable future amid major crises. J. Clean. Prod. 511 , 145583 (2025). 2. Chitondo, L., Thelma, C. C., Gilbert, M. M. & Madoda, D. The paradox of a world aspiring for peace amidst pervasive conflicts. Int. J. Res. Innov. Soc. Sci. 8 , 2471–2484 (2024). [ Google Scholar ] 3. De Bruin, R. A comparative analysis of the EU and U.S. data privacy regimes and the potential for convergences. Hastings Sci. Tech. L. J. 13 , 127–157 (2022). [ Google Scholar ] 4. Movius, L. B. & Krup, N. U. S. EU privacy policy: comparison of regulatory approaches. Int. J. Commun. 3 , 169–187 (2009). [ Google Scholar ] 5. Hinde, S. Privacy legislation: a comparison of the US and European approaches. Comput. Security 22 , 378–387 (2003). [ Google Scholar ] 6. European Parliament & Council. Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Protection Regulation). Official Journal of the European Union L 119 (2016). 7. European Parliament & Council Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence and amending certain Union legislative acts (Artificial Intelligence Act). Off. J. Eur. Union L 1689, 1–155 (2024).. 8. Regulation (EU) 2025/327 of the European Parliament of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847. Official Journal of the European Union (2025). 9. Health Insurance Portability and Accountability Act of 1996 (HIPAA) https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html (1996). 10. Botero, D. US State Privacy Legislation Tracker, https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ . 29 September 2025 . 11. California Department of Justice. California Consumer Privacy Act (CCPA). Office of the Attorney General. https://oag.ca.gov/privacy/ccpa (2018). 12. Colorado Department of Law. Colorado Privacy Act. Office of the Attorney General. https://coag.gov/resources/colorado-privacy-act/ (2021). 13. U.S. Congress. American Data Privacy and Protection Act, H.R. 8152, 117th Cong. https://www.congress.gov/bill/117th-congress/house-bill/8152/ (2022). 14. Vaid, A. Why predictive modelling in health care is a house of cards. Nature 642 , 864–866 (2025). [ DOI ] [ PubMed ] [ Google Scholar ] 15. Hattab, G., Irrgang, C. & Ladewig, K. The way forward to embrace artificial intelligence in public health. Am. J. Public Health 115 (2025). [ DOI ] [ PMC free article ] [ PubMed ] 16. Panteli, D. et al. Artificial intelligence in public health: promises, challenges, and an agenda for policy makers and public health institutions. Lancet Public Health 10 , e428–e432 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 17. Adams, L. et al. Artificial intelligence in health, health care, and biomedical science: an AI code of conduct principles and commitments discussion draft. NAM Perspect . (2024). [ DOI ] [ PMC free article ] [ PubMed ] 18. Fjeld, J., Achten, N., Hilligoss, H., Nagy, A. C. & Srikumar, M. Principled Artificial Intelligence: Mapping Consensus in Ethical and Rights-Based Approaches to Principles for AI. Berkman Klein Center Research Publication 2020-1 https://ssrn.com/abstract=3518482 (2020). 19. Lalova-Spinks, T., Valcke, P., Ioannidis, J. P. A. & Huys, I. EU-US data transfers: an enduring challenge for health research collaborations. NPJ Digit. Med. 7 , 215 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 20. The Trusted Exchange Framework and Common Agreement, Official Website of the Assistant Secretary for Technology Policy, Office of the National Coordinator for Health IT, https://www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca . accessed: 10/01/2025. 21. Baumgart, D. C. An intriguing vision for transatlantic collaborative health data use and artificial intelligence development. NPJ Digit. Med. 7 (1), 19 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 22. Spranger, J., Homberg, A., Sonnberger, M. & Niederberger, M. Reporting guidelines for Delphi techniques in health sciences: A methodological review. Z. f.ür. Evidenz, Fortbild. und Qualitat im. Gesundheitswesen 172 , 1–11 (2022). [ DOI ] [ PubMed ] [ Google Scholar ] 23. Niederberger, M. et al. Delphi studies in social and health sciences -Recommendations for an interdisciplinary standardized reporting (DELPHISTAR). Results of a Delphi study. PLoS One 19 , (2024). [ DOI ] [ PMC free article ] [ PubMed ] 24. Gladwell, M. Outliers: The Story of Success . Little, Brown and Co. (2008). 25. Hussein, R., Gyrard, A., Abedian, S., Gribbon, P. & Martínez, S. A. Interoperability framework of the European health data space for the secondary use of data: interactive European Interoperability Framework-Based Standards Compliance Toolkit for AI-Driven Projects. J. Med Internet Res 27 , e69813 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 26. McGraw, D. & Mandl, K. D. Privacy protections to encourage use of health-relevant digital data in a learning health system. NPJ Digit. Med. 4 (1), 2 (2021). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 27. Theodos, K. & Sittig, S. Health information privacy laws in the digital age: HIPAA doesn’t apply. Perspect. Health Inf. Manag. 18 , 1 (2020). [ PMC free article ] [ PubMed ] [ Google Scholar ] 28. Ahmed, A., Shahzad, A., Naseem, A., Ali, S. & Ahmad, I. Evaluating the effectiveness of data governance frameworks in ensuring security and privacy of healthcare data: A quantitative analysis of ISO standards, GDPR, and HIPAA in blockchain technology. PLoS One 20 (5), e0324285 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 29. Hallinan, D. et al. International transfers of personal data for health research following Schrems II: a problem in need of a solution. Eur. J. Hum. Genet. 29 , 1502–1509 (2021). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 30. Court of Justice of the European Union. (2020). Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (Schrems II), Case C-311/18, Judgment of 16 July 2020. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62018CJ0311 . 31. Tschider, C., Compagnucci, M. C. & Minssen, T. The new EU-US data protection framework’s implications for healthcare. J. Law Biosci. 11 (2), lsae022 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 32. European Commission Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate protection of personal data under the EU-US Data Privacy Framework. Off. J. Eur. Union 231 , 110 (2023). [ Google Scholar ] 33. Office of the European Union, P. Commission Implementing Decision EU 2023/… of 10 July 2023 Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the Adequate Level of Protection of Personal Data under the EU-US Data Privacy Framework , (2023). Available at: https://ec.europa.eu/newsroom/ . 34. Gyrard, A. et al. Lessons learned from European health data projects with cancer use cases: implementation of health standards and Internet of Things semantic interoperability. J. Med. Internet Res. 27 , e66273 (2025). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 35. Office of the European Union L-, P. & Luxembourg, L. REGULATION (EU) 2025/327 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 11 February 2025 on the European Health Data Space and Amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (Text with EEA Relevance) Setting out Criteria for Establishing and Evaluating European Reference Networks and Their Members and for Facilitating the Exchange of Information and Expertise on Establishing and Evaluating Such . Available at: http://data.europa.eu/eli/reg/2025/327/oj . 36. European Commission, Directorate-General for Health and Food Safety (DG SANTE). HealthData@EU. https://acceptance.data.health.europa.eu/?locale=en . 37. Demoss, L. C. & Lipham, S. V. Changes Proposed by HHS to Strengthen HIPAA Security Rule Related Professionals https://www.Maynardnexsen.Com/Printpilot-Publication-Changes-Proposed-by-Hhs-to-Strengthen-Hipaa-Security-Rule.Pdf?1751483496 (2025). 38. U.S. Department of Health and Human Services. Proposed changes to the HIPAA Security Rule to improve cybersecurity: Notice of Proposed Rulemaking (NPRM) fact sheet. https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html (2024). 39. The White House. America’s AI Action Plan. The White House (2025). 40. eHealth Action Joint Action. Interoperability Guide. eHAction. http://ehaction.eu/interoperability-guide/ (2021). 41. ID4D Practioner’s Guide (English). Identification for Development Washington, D.C.: Word Bank Group. 42. Marcus, J. S., Martens, B., Carugati, C., Bucher, A. & Godlovitch, I. The European Health Data Space Publication for the Committee on Industry, Research and Energy (ITRE), Policy for Economic, Scientific and Quality of Life Policies, European Parliament, Luxembourg , (2022). 43. Ghafourifard, M. Survey fatigue in Questionnaire Based Research: the issues and solutions. J. caring Sci. 13 (4), 214–215 (2024). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 44. Karargyris, A. et al. Federated benchmarking of medical artificial intelligence with MedPerf. Nat. Mach. Intell. 5 , 799–810 (2023). [ DOI ] [ PMC free article ] [ PubMed ] [ Google Scholar ] 45. Kaabachi, B. et al. A scoping review of privacy and utility metrics in medical synthetic data. NPJ Digit Med 8 , (2025). [ DOI ] [ PMC free article ] [ PubMed ] 46. Li, D. et al. Pmir: an efficient privacy-preserving medical images search in cloud-assisted scenario. Neural Comput Appl 36 , 1477–1493 (2024). [ Google Scholar ] Associated Data This section collects any data citations, data availability statements, or supplementary materials included in this article. Supplementary Materials supplementary tables (2.6MB, xlsx) supplementary information (1.8MB, docx) Data Availability Statement All data generated or analyzed during this study are included in this published article and its supplementary information files. Recordings of Delphi meetings are available upon request. Not applicable Articles from NPJ Digital Medicine are provided here courtesy of Nature Publishing Group ACTIONS View on publisher site PDF (1.3 MB) Cite Collections Permalink PERMALINK Copy RESOURCES Similar articles Cited by other articles Links to NCBI Databases Cite Copy Download .nbib .nbib Format: AMA APA MLA NLM Add to Collections Create a new collection Add to an existing collection Name your collection * Choose a collection Unable to load your collection due to an error Please try again Add Cancel Follow NCBI NCBI on X (formerly known as Twitter) NCBI on Facebook NCBI on LinkedIn NCBI on GitHub NCBI RSS feed Connect with NLM NLM on X (formerly known as Twitter) NLM on Facebook NLM on YouTube National Library of Medicine 8600 Rockville Pike Bethesda, MD 20894 Web Policies FOIA HHS Vulnerability Disclosure Help Accessibility Careers NLM NIH HHS USA.gov Back to Top