Executive Summary
Three distinct regulatory frameworks for health data are simultaneously active in 2026, each operating on a different economic logic. The EU's European Health Data Space (EHDS) creates a legal framework for secondary use of health data across member states, with governance controlled by public institutions. The US continues to operate on a market model where health data is commercially priced and traded, with Tempus AI's 2025 IPO valuing its patient data assets at USD 8.1 billion as a standalone proposition. GCC governments, particularly Saudi Arabia under Vision 2030 and the UAE, are building sovereign health data architectures that treat patient data as a national resource subject to state governance. D1: Digital Economy: frames health data as a capital asset subject to the economic dynamics of digital goods: non-rivalry (the same dataset can serve multiple analytical purposes simultaneously), network effects (more data improves model accuracy in ways that compound), and jurisdiction-dependent appropriability (who can extract value depends entirely on the regulatory regime the data lives within). The EHDS, US market, and GCC sovereign models produce different economic.
Three regulatory models for health data are active at once, and they are not converging
Three distinct regulatory frameworks for health data are simultaneously active in 2026, each operating on a different economic logic. The EU's European Health Data Space (EHDS) creates a legal framework for secondary use of health data across member states, with governance controlled by public institutions. The US continues to operate on a market model where health data is commercially priced and traded, with Tempus AI's 2025 IPO valuing its patient data assets at USD 8.1 billion as a standalone proposition. GCC governments, particularly Saudi Arabia under Vision 2030 and the UAE, are building sovereign health data architectures that treat patient data as a national resource subject to state governance.
Health data behaves like capital, but who can appropriate its value depends entirely on jurisdiction
D1: Digital Economy: frames health data as a capital asset subject to the economic dynamics of digital goods: non-rivalry (the same dataset can serve multiple analytical purposes simultaneously), network effects (more data improves model accuracy in ways that compound), and jurisdiction-dependent appropriability (who can extract value depends entirely on the regulatory regime the data lives within). The EHDS, US market, and GCC sovereign models produce different economic beneficiaries.
Under EHDS, value flows to EU research institutions and approved secondary users. Under the US market model, value flows to data aggregators and commercial AI companies. Under GCC sovereign models, value is retained domestically but may flow narrowly to state-approved actors. Healthcare organizations operating across jurisdictions face a genuinely different data economics depending on where patient interactions occur.
items:
- EU: EHDS: Value flows to EU research institutions and approved secondary users. Governance is controlled by public institutions under the European Health Data Space secondary-use framework.
- US: Market model: Value flows to data aggregators and commercial AI companies. Health data is commercially priced and traded; Tempus AI's 2025 IPO valued its patient data assets at USD 8.1 billion.
- GCC: Sovereign model: Value is retained domestically and flows narrowly to state-approved actors. Patient data is treated as a national resource subject to state governance under Vision 2030 and UAE health data strategies.
Multi-jurisdiction healthcare groups must design data value capture per jurisdiction, not as one global architecture
Healthcare executives and boards in multi-jurisdictional organizations face a data strategy question that is no longer technical: it is economic and political. The data architecture decisions made in 2026 (where patient data is stored, how it is governed, which analytics partners have access) will determine which regulatory regime's economic logic applies to each data asset. A hospital group operating in both the EU and GCC that builds a unified data platform will find that EHDS secondary-use governance and GCC sovereign data requirements are structurally incompatible. The economic implication is that data value capture strategy must be designed per jurisdiction, not as a single global data architecture.
items:
- EHDS secondary-use enforcement: EHDS secondary-use articles enter implementation in 2025–2026. How member states operationalise data access requests and approved-user criteria will determine whether the EU model delivers research value at the scale promised.
- US health data pricing litigation: Ongoing legal challenges to health data commercial use agreements: particularly following the HHS proposed rule on patient data rights: will affect the stability of the US market model.
- GCC sovereign architecture announcements: Saudi Arabia's Health Data Bank and UAE's health data strategy are in active development. Clarity on what 'sovereign' means for foreign-operated providers will determine whether GCC health data is accessible to international analytics partners.
Three developments will decide how each model plays out
Three near-term factors: EHDS enforcement timelines, US health data pricing litigation, and a third developing variable: will determine whether each jurisdiction's model delivers on its economic logic.
- EHDS secondary-use provisions enforcement timeline: the EHDS secondary-use articles enter implementation in 2025-2026; how member states operationalise data access requests and approved user criteria will determine whether the EU model produces research value at the scale promised.
- US health data pricing litigation: ongoing legal challenges to health data commercial use agreements (particularly following the HHS proposed rule on patient data rights) will affect the market model's stability.
- GCC sovereign health data architecture announcements: Saudi Arabia's Health Data Bank and UAE's health data strategy are in active development; clarity on what "sovereign" means for foreign-operated healthcare providers will determine whether GCC health data is accessible to international analytics partners.
Sector Context: Health Data Is Becoming an Economic Infrastructure
Healthcare data was historically treated primarily as a clinical record and compliance obligation. AI, precision medicine, population analytics, and secondary-use frameworks are changing that role. Longitudinal health data can support multiple research, operational, and commercial uses without being consumed by any one of them. That makes governance of access and reuse an economic design question as well as a privacy question.
The three models examined in this brief differ because they allocate rights differently. They determine who can authorize reuse, which organizations can combine datasets, where data must remain, how value can be captured, and what public-interest obligations attach to that value.
Four Forces Turning Data Governance into Strategy
AI increases the value of scale and longitudinal depth. Larger and more representative datasets can improve model development and validation, making access to governed health data a strategic capability.
Secondary use is becoming institutionalized. Research, public health, service planning, and commercial innovation increasingly depend on mechanisms that allow data to be reused beyond the original care interaction.
Sovereignty is shaping architecture. Jurisdictions are imposing different expectations around localization, approved access, public control, and cross-border transfer. A technically unified platform can therefore conflict with the legal model governing the underlying data.
Value capture is separating from data ownership. The organization holding the record may not be the organization that captures the economic value. Platforms, AI companies, research institutions, governments, and patients can occupy different positions in the value chain.
The Structural Shift: From Data Repository to Governed Capital System
D1 is the anchor because the issue is how digital assets create and distribute value under different institutional rules. The same dataset can produce different economic outcomes depending on the rights attached to access, reuse, combination, and commercialization.
D3 supports the analysis because data value depends on platform architecture: identity, consent, interoperability, provenance, access controls, and secure analytical environments. D4 matters because multinational healthcare groups must sequence architecture around jurisdictional constraints. D2 becomes relevant when data feeds learning systems that continuously influence clinical or operational decisions.
Opportunities and Risks
Well-designed health data regimes can accelerate research, improve population insight, support AI development, and create new public or commercial value without requiring the underlying data to be sold outright. Sovereign architectures can also strengthen national capability and bargaining power.
The risks include privacy loss, exclusion, biased datasets, concentration of value, incompatible cross-border architectures, and public distrust if economic use outruns legitimacy. Overly restrictive regimes can create the opposite problem by preventing socially valuable research and innovation. The strategic challenge is therefore not maximum openness or maximum restriction, but governed reuse with an explicit value-allocation model.
Five Executive Priorities
Map data assets by jurisdiction and permitted use. Do not assume one global policy can govern storage, secondary use, model training, and cross-border access.
Separate clinical custody from economic rights. Clarify who can authorize reuse, who can benefit, and which obligations follow each form of access.
Design modular data architecture. Use federated or jurisdiction-aware patterns where legal regimes cannot be reconciled in one physical or governance model.
Make provenance and consent operational. Access decisions should be enforceable through the platform and reconstructable for audit and patient trust.
Define the value-sharing position explicitly. Boards should decide whether the organization intends to be a data custodian, research partner, platform participant, AI developer, or some combination, and design governance accordingly.
Closing Perspective
The central issue is structural rather than technological. The organizations that create durable advantage will be those that turn the capability described in this brief into part of the operating model, with clear ownership, reusable architecture, measurable outcomes, and governance that persists beyond an individual project. The leadership question is therefore not whether to adopt another tool or launch another initiative. It is whether the sector's operating architecture is being redesigned so that each investment strengthens the next one.
