My contribution to a board
A board overseeing a healthcare business now has to judge risks that seldom appear clearly in its papers: whether patient data is being reused on a basis patients would recognise, whether an algorithm bought last year still performs as it did when it was tested, and whether evidence offered to a regulator or a payer can bear the weight placed on it. I have worked on each of those questions from more than one side, as a statistician at a contract research organisation, as a sponsor buying hospital data and now as the executive accountable for a hospital group's records. I can usually tell a director which question to ask, and I can usually tell when an answer was written to reassure rather than to inform.
I would bring three things. The first is a critical reading of data-protection and cyber-risk reporting: what a breach register leaves out, which concerns the data protection officer has raised and seen overruled, and whether consent and objection rules are enforced in systems or only in policies. The second is a method for questioning AI and analytics: which population a model was measured on, who monitors it after purchase, and what would make the company switch it off. The third is experience of declining income when the terms were wrong: a sponsor's study, an offer of equity and a grant payment, each refused for reasons I could explain to a patient.
I am not an accountant, and I would not present myself as an audit committee's financial expert. I would join an audit and risk committee as a member for its data, cyber and research-integrity agenda, and after a year I would be ready to chair a technology and data committee, or a quality and patient-safety committee if the board has one. Under the governance codes used in France and the United Kingdom, the board itself assesses each director's independence and explains its view to shareholders.
Judgement in practice
01Notifying a breach the data protection officer judged borderline
In October 2022 an extract of 1,180 patients' pseudonymised records was emailed to the wrong researcher at a university partner. The recipient deleted it within a day and confirmed the deletion in writing. Under the GDPR a breach must be notified to the supervisory authority within 72 hours unless it is unlikely to result in a risk to the people concerned, and our data protection officer thought the case could be argued either way. I recommended notifying the CNIL and informing the board's audit and risk committee that week. The records included rare diagnoses in small towns, and a hospital should resolve doubt in its patients' favour. The CNIL closed its file without action. On a board I would ask to see every borderline call, not only the ones that were notified.
02Declining equity in return for exclusive access to our imaging archive
In 2022 a French imaging-AI start-up offered the group a 4 per cent shareholding and free use of its future products in return for exclusive access to 1.2 million of our imaging studies to train its models. Two members of our executive committee saw a rare chance for a non-profit to share in the value its data helps to create. I recommended declining. Exclusivity would have shut other researchers out of the same images, the shareholding would have given us a financial interest in a supplier whose products we might later have to evaluate, and I could not explain the bargain to a patient in one sentence. The board agreed. Since 2025 we have offered non-exclusive, priced access inside our analysis environment, and two companies use it. The question I would bring to any board is who gains which rights, for how long, and who loses them.
03Making patient objections apply to studies already approved
Before the warehouse opened to research in 2023, the foundation board had to approve its governance rules. Patients must be informed about research reuse of their records and may object to it; the open question was whether an objection should also remove a patient from studies already under way. The chair of the medical committee warned that such exclusions would bias long-running cohort studies and frustrate investigators. I recommended that an objection take effect in every query from the day it is recorded, approved studies included, with the resulting exclusions reported in each study's methods. The board accepted the recommendation. Since 2023, 3,140 patients have objected, about one in a thousand of those in the warehouse, and no study has had to stop. As a director I would ask how the rights a company promises its patients or customers are enforced in its systems, not merely described in its policies.
My first year on a board
I would treat the first year as an apprenticeship with a written programme. Before my first meeting I would ask for two years of board and committee papers, the data protection officer's annual reports, the register of personal-data breaches and near misses, and a list of every algorithm or analytic model that affects patients or customers, each with a named owner. I would read them for what recurs rather than for what is dramatic.
During the first two quarters I would visit the places where the company's data is created, which in healthcare means a laboratory, a clinic or a contact centre rather than a dashboard at head office. I would ask the data protection officer and the head of internal audit to brief me without management present.
In the second half of the year I would expect to ask sharper questions and fewer of them. At its end I would write the chair a short note on which of my questions had led to action and which had produced only paper, and ask for a frank reply.
Conflicts and their management
Aurevalle buys software and imaging equipment, sells research access to its data, works with universities and sponsors, and competes with other hospital groups for staff and regional contracts. Each of those relationships could compromise my judgement on another board, so before any conversation I would rule out four kinds of company: suppliers of clinical software, imaging equipment or algorithms to Aurevalle; pharmaceutical companies and contract research organisations that sponsor research at our hospitals or use our analysis environment; hospital and clinic groups operating in Hauts-de-France; and any company that has bid for an Aurevalle contract in the previous three years. My directorship of Association Belvérine, a non-profit cancer registry that receives data from our hospitals, would be declared to any future board.
For a company that passed those tests, I would list every relationship I know of between it and Aurevalle and ask Aurevalle's directeur général and board chair to consent in writing. A relationship that began after I joined would be declared at the next meeting; I would leave any discussion or vote it touched, and offer to resign if it became material. Winter strains every hospital group, so I would also fix the board calendar a year ahead.
My independence statement
I am a salaried executive of a non-profit hospital group and own no shares in any healthcare company. Whether I can be independent on a particular board turns on that company's dealings with Aurevalle, with Association Belvérine and with me personally, and I would put all of them in writing before terms were discussed. The board would then reach its own view under whichever governance code it applies. Until it had, I would not call myself independent.
Board and committee exposure
Presented to the Board or a committee
Fondation Hospitalière Aurevalle
Foundation board: data strategy, the warehouse and analysis-environment investments, secondary-use policy and imaging AI
March 2021–present
Presents whenever data is on the board's agenda, five to seven times a year; not a member of the board and holds no vote.
Reported to a committee
Fondation Hospitalière Aurevalle
Audit and risk committee of the foundation board: data protection, cyber risk and research integrity
September 2021–present
Reports twice a year alongside the data protection officer, including the 2022 breach notification and the results of output checking.
Member of a committee
Fondation Hospitalière Aurevalle
Data-access committee, the management committee that approves research use of patient records
January 2023–present
Voting member alongside clinicians, an ethicist and a patient representative, with the data protection officer as adviser; the committee approved 64 projects in 2025.
Served as a director
Association Belvérine
Board of a non-profit regional cancer registry; chair of its data-access committee
June 2022–present
Non-executive director of the association, and chair of the committee that decides researchers' access to registry data.
Presented to the Board or a committee
Tornvig Pharma A/S
Board science committee: evidence strategy for the rare-disease medicine
November 2019
Presented the feasibility review and the recommendation to withdraw the external control arm; not a member of the committee.