CHIEF Programme

DIGA

A structured view of data protection, data governance and interoperability readiness for health data holders.

Data protection, interoperability and governance

One assessment across connected requirements

DIGA 2.0 is a CHIEF assessment tool for health registries and information systems that manage sensitive data. It brings together three dimensions that are often examined separately: data protection and privacy, data governance and ethics, and interoperability and preparedness for the European Health Data Space (EHDS).

The tool is designed as a translation layer between complex legal and technical requirements and a structured set of assessment questions. Its components are a questionnaire, a scoring framework and analysis software. Responses can be reviewed at the level of an individual data holder and across the participating sample, making it possible to identify both local practices and shared gaps.

DIGA builds on earlier privacy and governance assessment work in BIRO, EUBIROD and BRIDGE Health. For version 2.0, the questionnaire was revised and reviewed with an international multidisciplinary panel, including experts from the Italian Data Protection Authority, the French Health Data Hub and Sciensano. The report records 104 amendments during this validation process.

The three assessment areas and output structure of DIGA 2.0
Figure 1. DIGA 2.0’s three connected assessment areas and its questionnaire, scoring and reporting outputs. Synthesised from the CHIEF report.

Survey on the Implementation of Privacy/Data Protection, Data Governance, Interoperability and Ethics

Twenty European registries and health information systems

The validated questionnaire was used in a survey of 20 institutions handling sensitive information. The participating group included population-based and research-oriented systems, with different geographic coverage, data sources and operating arrangements. The results describe those respondents; they are not a census of every European registry or a country ranking.

Each response was converted to a score expressed as a percentage of the maximum attainable score. DIGA reports results for individual factors and the three wider areas, using summary statistics such as medians to reduce the influence of very high or low values. The report also shows distributions, allowing readers to see whether centres cluster around a score or differ widely.

80%Median score for GDPR data-protection requirements
72%Median score for data governance and ethics
53.5%Median score for EHDS preparedness
25%Median score for registry and health-system interoperability
Distribution of DIGA survey responses across five EHDS preparedness factors
Figure 2. Distribution of scores across selected EHDS preparedness factors in the participating sample. Source: CHIEF final report, Figure 11.
DIGA radar profiles for participating centres across EHDS preparedness factors
Figure 3. Radar profiles for the participating centres across EHDS preparedness factors; mean and median are shown for comparison. Source: CHIEF final report, Figure 12.
DIGA centre score and sample average with confidence intervals across EHDS preparedness factors
Figure 4. A centre-level dot plot compares one institution’s scores with sample averages and confidence intervals. Source: CHIEF final report, Figure 13.

What the results show

Strong areas and uneven readiness

Data-protection requirements had the highest area median in the survey, but variation between institutions remained substantial. Anonymisation had a median score of 50%, with responses spanning the full scale. Data linkage also varied, reflecting differences in secure infrastructure, identifiers, legal constraints and local capacity.

For governance and ethics, the median was 72%. The report identifies training and awareness as a gap, with median compliance below 60%, and openness and transparency at a median of 50%. These results point to differences not only in formal policies but also in how consistently practices are explained and supported in day-to-day work.

EHDS preparedness had a median of 53.5%. Registry and health-system interoperability scored a median of 25%, while data quality and utility scored 67%. EHR content and the European Electronic Health Record Exchange Format had a median of 58%; secondary use of health data had a median of 64%. Together, these results show why a single overall score is not enough: the area and factor profiles reveal which dimensions are stronger, weaker or more variable across the participating institutions.

Scientific paper and related manuscript

DIGA research outputs

  1. Di Iorio CT, Ronchi E, Pristas I, Buble T, Nicholson N, Carinci F. Data Protection, Interoperability and Governance Assessment (DIGA) Tool: results from a proof-of-concept survey. Frontiers in Digital Health. 2025;7. Full text.
  2. Di Iorio CT, Carinci F, Štotl I, Pristas I, Buble T, Nicholson N, Ronchi E. How ready are data holders for the European Health Data Space? Results of an international survey using a refined version of Data Protection, Interoperability and Data Governance Assessment (DIGA). Submitted, 2026.

Reading the profiles

How the survey describes readiness

The 20 participating systems covered different organisational settings. In the final report, 85% were population-based; 55% operated outside academic environments and 55% had national coverage of more than 10% of their target population. Most reported continuous collection (70%) and use of digital EHR or mHealth sources (85%). These characteristics provide context for interpreting the results; the sample is not presented as a representative census of European data holders.

Scores are expressed as a percentage of the attainable score. The report classifies performance as excellent (90–100%), very good (80–89%), good (70–79%), fair (50–69%) or poor (below 50%). The centre-level profiles complement area medians: they show where a specific institution differs from the group and how factors within the same area can move in different directions.

All survey outputs were produced with open-source R software. In combination, the distributions and centre-level views make the assessment useful both for internal review and for describing shared patterns without identifying other participating institutions.

References

Selected references

  1. Di Iorio CT, Carinci F, Oderkirk J, et al. Assessing data protection and governance in health information systems: a novel methodology of privacy and ethics impact and performance assessment. Journal of Medical Ethics. 2020. doi:10.1136/medethics-2019-105948.
  2. Di Iorio CT, Carinci F, Brillante M, et al. Cross-border flow of health information: is privacy by design enough? Privacy performance assessment in EUBIROD. European Journal of Public Health. 2013;23(2):247–253. doi:10.1093/eurpub/cks043.