Send the question, not the extract
Hospitals have long shared research data by sending pseudonymised extracts to their partners. I argue that the extract should become the exception: partners bring their analysis to a controlled environment, and only checked results leave it.
For most of the past decade, a research partner who wanted data from a French hospital received a file. The project was approved, an agreement was signed, a data manager wrote the query, and a pseudonymised extract left the hospital by encrypted transfer, or occasionally by less careful means. At the end of the project the partner sent a letter certifying deletion. In 2022 Aurevalle sent 21 such extracts to universities, cooperative cancer groups and pharmaceutical sponsors. It was normal practice, and it was lawful when done properly.
In October of that year one extract, describing 1,180 patients, was emailed to the wrong researcher at a university partner. The recipient deleted it and told us within a day. We notified the CNIL inside the 72 hours the GDPR allows, and the authority closed its file without action. Nothing measurable went wrong. But when I tried to count how many copies of our patients' records then existed outside the group, on which servers and held by whom, nobody could tell me, including me. That is the position I now want hospitals to leave behind.
Pseudonymised data is still personal data
The case for the extract rests partly on a misunderstanding. Removing names, replacing identifiers with codes and coarsening dates make re-identification harder. They do not make the data anonymous. Under the GDPR pseudonymised data remains personal data, and health data belongs to the special categories that require additional protection. Lawyers know this. In practice, though, a file that carries no names often feels anonymous to the people handling it, and it is treated with the informality that feeling invites.
Hospital records are also unusually easy to re-identify. A rare diagnosis, a date of admission and a town of residence may be enough to point to one person, particularly outside large cities. In one of our hospital catchments a particular sarcoma subtype affects two or three people a year. An extract that includes them, however carefully coded, describes those people to anyone who knows the town.
Once an extract leaves us, our protections become contractual. We can require security standards, forbid onward sharing and ask for deletion, and most partners honour those terms scrupulously. But we cannot see whether they do. We cannot tell a patient where her record is. And each extract is a fresh copy, so the number of places where a breach could occur grows with every project we approve.
What changes when the analysis comes to the data
Since April 2024 external researchers who want our data work inside an analysis environment that we run. They connect remotely to a workspace containing only the variables their approved project needs. They can write and run code, fit models and produce tables. What they cannot do is download row-level data. Every output they want to take away is checked by one of two trained data stewards, who look for small cells, unusual combinations and anything else that could identify a person. We suppress counts below ten, and every session is logged.
The objections were serious, and some proved right. Partners said the environment would be slow, and at first it was. Sponsors said their validated pipelines required specific software versions, and two sponsors left in 2024 because we could not yet support them. Academic colleagues worried about reproducibility, since a journal's reviewer might ask to rerun an analysis after the project had closed. We answered that by keeping each project's code and a frozen copy of its data inside the environment for an agreed period, so that a reviewer's request can be met without a file ever leaving. One sponsor walked away from a €1.4 million study rather than accept the arrangement at all.
The results since then have persuaded most of the doubters. In 2025, 38 external projects ran in the environment, 24 of them academic, and partnership income reached €2.6 million, more than in any year of extracts. No row-level record has left the group since the environment opened. Output checking has stopped several tables that would have exposed individuals, including one that would have identified three patients with a rare cancer in a small town. And for the first time I can answer a patient who asks where her data is: it is here, and these are the projects that have used it, listed on our public register.
Europe is moving the same way. The European Health Data Space regulation, adopted in 2025 and applying in stages over the coming years, will channel much secondary use of health data through national health-data access bodies, which issue permits and expect the analysis to take place in secure processing environments. The details will matter, and I do not want to overstate what any single hospital's practice anticipates. But the principle is the one we chose: the data stays in a controlled place, and the analysis travels to it.
When I would still release rows
I am not arguing that no row-level data should ever leave a hospital. Some cases justify it. A clinical trial's own data, collected under a protocol and the patient's consent to that trial, must reach the sponsor and, through the sponsor, the regulator. A patient who chooses to share her own record with a registry or a research cohort should be able to do so. And some registries receive data under a legal basis that does not depend on our preferences.
My argument is that the extract should be an exception that has to be justified, not a default that has to be resisted. A partner who wants rows should explain why the analysis cannot be done where the data lives, and the data-access committee should weigh that reason as carefully as it weighs the scientific question. Federated approaches, in which a model visits several hospitals' environments in turn, will make the justification harder to sustain as they mature.
There are costs to this position, and I would rather name them. An analysis environment costs money to build and to staff. Our stewards are a bottleneck in busy months. Some partners will always prefer a hospital that simply sends a file, and they will take their projects elsewhere. I accept those costs. A hospital's ability to support research rests on patients agreeing that their records may be reused, and that agreement depends on our being able to say, without hesitation, where those records are.