Why health data can't just cross borders — and how research happens anyway

On the morning of July 16, 2020, thousands of data-transfer arrangements between Europe and the United States stopped being legal at once. The Court of Justice of the European Union had struck down the Privacy Shield framework — the second transatlantic transfer deal it had killed in five years — and legal teams on both continents spent the rest of the year discovering how much of their infrastructure had been resting on it.

Health researchers felt it acutely. A multi-country cohort study is, legally speaking, a chain of cross-border transfers — and every link had just gotten weaker.

The default is no

Under the GDPR, sending personal data outside the European Economic Area is prohibited unless a specific mechanism makes it lawful — that is the blunt logic of Chapter V, beginning at Article 44. Three doors exist: an adequacy decision, where the European Commission finds the destination country's protections essentially equivalent; appropriate safeguards, usually standard contractual clauses between sender and recipient; or derogations — narrow exceptions such as explicit consent for a specific transfer.

Health data makes each door heavier. It is special-category data, so the underlying processing already needs the elevated justification we walk through in what GDPR Article 9 really permits — and regulators read transfer mechanisms most skeptically exactly where the data is most sensitive. The transfer question is never separate from the sensitivity question; they compound.

Schrems II and a decade of legal whiplash

The case that reset everything, Schrems II, held that US surveillance law gave EU citizens no essentially equivalent protection, so Privacy Shield fell — as Safe Harbor had fallen in 2015. Standard contractual clauses survived, but with a sting: exporters must now assess, destination by destination, whether local law undermines the clauses, and bolt on supplementary measures — encryption the recipient cannot reverse, pseudonymization with keys kept at home — where it does. The European Data Protection Board turned that holding into detailed recommendations that have shaped transfer practice since.

A successor deal, the EU–US Data Privacy Framework, arrived in 2023 with a fresh adequacy decision from the European Commission — and challenges to it began almost immediately. The pattern is the lesson: transfer mechanisms are weather, not climate. Anyone whose research pipeline assumes a particular legal channel will stay open for a decade is making a bet the last decade argues against.

Localization: the rest of the world's answer

Outside Europe, a growing list of countries skipped the equivalence debate and simply ordered data to stay home. China's Personal Information Protection Law treats health data as sensitive and routes significant cross-border transfers through state security assessments — and its separate rules on human genetic resources are stricter still. Russia has required personal data on its citizens to be stored domestically since 2015. India, Indonesia, Saudi Arabia, and others have localization provisions of varying reach, a trend the OECD has tracked across its members and partners for years.

For a global study, the implication is stark: there is no future in which one consolidated database lawfully holds patient-level records from Frankfurt, Shanghai, and São Paulo. The records are staying where they are. The question is what research looks like once you accept that.

Move the question, not the data

The durable answer is architectural: stop transferring records and start transferring questions. In a federated study, each site keeps its data in place; the analysis — a query, or the full analysis code — travels to each site, runs locally, and returns only aggregate results: counts, rates, model coefficients. The full pattern is laid out in federated analytics: research the data without moving the data.

This is proven practice, not a proposal. The OHDSI community has run network studies this way for years: a common data model and shared analysis code let one protocol execute across dozens of databases on several continents, with no patient-level data crossing a border. And regulation is converging on the same shape — the European Health Data Space builds secure processing environments and a federated infrastructure into law, as we describe in our EHDS explainer.

The legal force of the pattern comes from a single fact: statistics that no longer relate to an identifiable person are no longer personal data, so transfer restrictions stop applying. But that holds only if the aggregates truly cannot be shrunk back into individuals — a count of three is a person wearing a number. This is why federated systems need hard minimum group sizes, the logic we unpack in k-anonymity, explained: the k-floor is what keeps an aggregate an aggregate.

Built for borders

Mithras Health takes the fourth row as a founding constraint rather than a workaround. Patient records stay in their region; federated queries run in-region and return aggregates only; and a hard k ≥ 5 floor — not configurable, for anyone — guarantees that what crosses a border can never be a person in disguise. Every query and every refusal lands on an append-only, cryptographically anchored audit trail, so the claim "no record left the region" is checkable, not rhetorical.

That architecture is also why one platform can be designed for HIPAA, GDPR, UK GDPR, the EHDS, and Washington's My Health My Data Act at once. Those regimes disagree about many things, but none of them objects to data that never leaves home — and a patient's revocable, per-study consent travels with the query logic, honored identically in every region.

Every legal mechanism for moving health data across borders has been invalidated, renegotiated, or restricted within the past decade. The architecture that never moves it has only grown stronger. When the law keeps telling you the same thing in five languages, the wise response is to design as if you believe it.