The global health data ecosystem is undergoing its most significant structural shift in a decade, driven by converging regulatory pressures, AI adoption, and a growing patient-led demand for data portability. This week, three developments underscore the velocity of change: the U.S. Department of Health and Human Services (HHS) announced final rules for the Trusted Exchange Framework and Common Agreement (TEFCA) 2.0, the European Health Data Space (EHDS) entered its implementation phase for secondary use, and a coalition of academic medical centers published a landmark study on bias in large language models trained on electronic health records (EHRs).

TEFCA 2.0: From Voluntary to De Facto Standard

The HHS rule, published on Monday, mandates that all federally qualified health centers and Medicare Advantage plans connect to TEFCA’s Qualified Health Information Networks (QHINs) by Q3 2026. This moves the framework from a voluntary opt-in model to a default requirement for federal payers. “TEFCA 2.0 effectively ends the era of proprietary data silos in the U.S. acute care sector,” said Dr. Elena Vasquez, chief health informatics officer at the Mayo Clinic Platform, in a press briefing. “The new ‘query-once, retrieve-many’ protocol will reduce the average time for cross-institutional record retrieval from 11 days to under 48 hours, based on our pilot data.”

Industry analysts note that the rule also introduces a controversial “patient access API” requirement—all QHINs must expose a FHIR R4-based endpoint that allows patients to export their complete longitudinal record, including unstructured clinical notes, in a machine-readable format within 24 hours of request. Privacy advocates have expressed concern about the lack of mandatory audit trails for third-party apps, but HHS maintains that the new “break-the-glass” consent override logs will suffice.

EHDS: Secondary Use Moves from Pilot to Production

Across the Atlantic, the European Commission confirmed that the EHDS’s secondary use module—governing access to anonymized health data for research, public health, and algorithm training—will begin accepting first applications from certified data holders in January 2025. The key change: data holders must now provide a “minimum viable dataset” (MVD) for every condition code, not just high-prevalence diseases. This includes imaging data, genomic variants, and social determinants of health fields, which were previously optional.

“The MVD requirement is a double-edged sword,” commented Professor Ingrid Larsen, director of the Copenhagen Institute for Health Data Science. “It promises unprecedented statistical power for rare disease research, but it also forces hospitals to reconcile legacy coding systems with the OMOP Common Data Model. Our own compliance cost is projected at €4.2 million—most of it for data quality engineering, not infrastructure.” Larsen’s concern echoes a broader industry trend: a recent survey by the European Federation of Health Data Managers found that 68% of hospital CIOs rank “data harmonization” as their top budget item for 2025, surpassing cybersecurity.

The AI Bias Reckoning Arrives

Perhaps the most consequential academic news this week comes from a multi-institutional study published inNEJM AI, which analyzed 14 open-source and proprietary LLMs fine-tuned on EHR data from 12 U.S. health systems. The study found that models trained on datasets where minority patients were underrepresented (less than 15% of records) showed a 22% higher false-negative rate for sepsis prediction in Black patients, and a 31% higher false-positive rate for opioid use disorder in Hispanic patients.

“This is not a technical bug; it’s a data governance failure,” said Dr. Marcus Chen, lead author and director of the Center for Clinical Data Science at Johns Hopkins. “The models are accurately reflecting the historical inequities embedded in the source data. The solution is not merely more data—it’s curated, adversarially debiased data with explicit representation targets.” Chen’s team proposes a new certification standard, “FairML-Health,” which would require model vendors to disclose the demographic composition of training data and to run continuous post-deployment bias audits. The FDA has not yet endorsed the standard, but a spokesperson confirmed that the agency is “monitoring the framework closely” for its forthcoming AI-enabled device predetermination program.

Market Trends: Consolidation and the Rise of Data Cooperatives

Amid these regulatory shifts, the commercial landscape is consolidating. In the past 30 days, three major health data aggregators—Verana Health, Roivant’s Datavant, and Truveta—announced strategic mergers or acquisitions of smaller analytics firms specializing in social determinants data. The combined market share of the top five data brokers now exceeds 55%, according to a report from the Health Data Consortium.

However, a counter-movement is gaining traction: patient-led data cooperatives. The “MyData, MyTerms” initiative, launched by a coalition of patient advocacy groups and the Linux Foundation’s Open Health Stack, has signed up 1.2 million patients who agree to pool their EHR data for research, but only under strict usage contracts that prohibit re-identification attempts and require revenue sharing if a drug or device is developed. “We are seeing a pivot from ‘data extraction’ to ‘data partnership,’” said Priya Raman, CEO of the cooperative’s operational arm. “Health systems are realizing that trust is a currency. The cooperatives offer a way to access longitudinal data without the reputational risk of a breach.”

Expert Outlook: The Next 18 Months

Dr. Vasquez, speaking at the HIMSS pre-conference webinar, outlined three predictions for the sector: First, that TEFCA and EHDS will converge on a “global patient identifier” standard by 2026, using a hashed combination of birth date, sex, and biometric-derived keys—though she admitted that “the political hurdles are massive.” Second, that the FDA and EMA will jointly release a “Data Quality Maturity Model” for AI training datasets, likely in Q4 2025, which will make bias audits a prerequisite for regulatory submission. Third, that the largest health systems will begin hiring “chief data ethics officers” as a C-suite role, mirroring the rise of chief privacy officers in the 2010s.

The common thread across these developments is a fundamental redefinition of health data—not as a byproduct of care delivery, but as a core clinical asset with its own governance, economics, and ethical obligations. As interoperability mandates lower technical barriers, the remaining differentiators will be trust, transparency, and the ability to prove that data-driven insights benefit all populations equally. For stakeholders, from hospital CIOs to startup founders, the message is clear: the era of passive data collection is over. The era of accountable data stewardship has begun.