Move the message, not the medical record

Every few months a hospital president in our region is offered something free: a consumables platform, a pharmacy automation service, an analytics dashboard for department heads. The software costs the hospital nothing, the supplier hosts it, and the hospital's technical team is spared another system to run. What the offer usually requires in return is a copy of data the hospital holds about its patients: which implant went into which patient, which medicines a patient collected and when, sometimes the diagnosis that justified them.

I have seen this offer from both sides. As director of information at a large teaching hospital in Chengdu, I received a dozen such requests a year from distributors and vendors. As a distributor's CIO, I have been asked by my own colleagues to make similar offers, because competitors make them and they win tenders. My view is that a supplier should not hold copies of patient-linked records in order to provide a supply service, and that integration between hospitals and their suppliers should be designed to move the minimum message a transaction needs, not the record behind it.

The free cloud has a price

The economics of a free platform are not mysterious. A supplier pays for it because the data, the dependence or both are worth more than the hosting. Sometimes the value is legitimate: a supplier that sees consumption can replenish more efficiently. Sometimes it is not: data gathered for supply can inform sales conversations with clinicians, or become the basis for services the hospital never agreed to.

The law has also changed what the hospital is accepting. The Personal Information Protection Law treats medical and health information as sensitive personal information. Processing it needs a specific purpose and strict protection, and providing it to another party needs a lawful basis the patient can understand. Health-sector rules have long expected population health information to stay on servers inside China, and the multi-level protection scheme expects a hospital's core systems to be protected to a defined grade. A hospital that copies patient-linked data into a supplier's cloud extends all of those obligations to a party it does not control, usually under a contract the supplier wrote.

When we began offering hospital supply services in 2019, our strongest competitor offered exactly this: a free cloud platform holding each hospital's consumables usage linked to patient billing. Our own commercial team wanted to match it. We did not, and we lost four of eleven tenders in 2020, three of them on price.

What a supplier actually needs to know

The argument for copying data is usually that the supplier needs it. That claim is worth testing item by item, because the honest answer is nearly always narrower than the request.

To replenish a ward cupboard, a supplier needs to know what was taken, from which cupboard and when. It does not need to know the patient. To invoice a hospital for consumables used, it needs item, quantity, batch and the hospital's own reference. It does not need the diagnosis. To support a recall, it needs to know which batch went to which hospital store; the hospital can identify the patients itself, and should. Even a manufacturer's legitimate interest in how its product performs can usually be met by aggregated results that the hospital chooses to share.

Our catalogue at Shuheng now classifies 1,140 data items by sensitivity and permitted recipient. When colleagues or customers ask for new data flows, roughly a third of the requests are met with aggregated or de-identified data instead of what was first asked for. The other two-thirds were already narrow. I have yet to meet a supply process that genuinely required a patient's identity in order to work.

The same test applies inside a supplier. Our own sales colleagues once asked to see which implants each surgeon used, department by department. The question had a commercial logic, but replenishment did not need it, so the answer was no, and the request has not come back.

Integration that leaves the record at home

The practical consequence is a different design for integration. Our consumables service runs inside each hospital's network, within its protection grading, and connects to the hospital's clinical and resource-planning systems through the hospital's own integration platform. Patient-linked records stay with the hospital. What leaves the hospital is a message: item, quantity, batch, location, time and a hospital reference that means nothing outside its walls.

This design costs more. A deployment inside a hospital costs us about RMB 2.1 million against about RMB 0.8 million for a shared cloud, and takes around fourteen weeks instead of six. Each hospital's environment is slightly different, and our integration team spends time it would not need on a single platform. I report these costs to our board every year, because a design that costs more should keep having to justify itself.

It has also earned something a free platform cannot. After the Personal Information Protection Law took effect, hospital information departments began asking suppliers exactly where patient-linked data sat. Between 2022 and 2024 nine hospitals that had chosen hosted services re-tendered their supply contracts, and we won seven. We now run the service in 58 hospitals. The hospital information directors who chose us gave the same reason: they did not have to explain to their own committees why a supplier held their patients' records.

There are limits to the argument. Some services genuinely need patient-level data, such as a specialist pharmacy dispensing high-cost medicines direct to a patient, and the answer there is purpose, consent and protection rather than avoidance. Hospitals with very small technical teams sometimes cannot run software locally at all; for them, a hosted service in which patient data is separated and contractually walled off may be the realistic option.

But the default should be clear. A supplier should be able to explain, for every field it receives, what it will decide with that field. If it cannot, the field should stay in the hospital. That rule costs some efficiency and some tenders. It keeps the record where the patient was treated, which is where the patient would expect it to be.