Privacy has been built as a body of law. The next decade will demand that it also become a layer of architecture: governance anchored to the person, carried with the data relationship, and evaluated continuously as that data moves between systems, organizations, and AI models.
Picture the system working exactly as designed. A hospital wants to share data with a research partner under a signed contract. A governance committee has reviewed the request. An audit log will record every access. Everyone involved is acting in good faith. And the answer is still no, because nobody in the chain can demonstrate, at the moment it matters, that the sharing is safe, purposeful, and authorized. That is the paradox at the center of healthcare data today: the institutions of trust exist, and the system still cannot move.
Healthcare is on the threshold of something genuinely transformative: care that is faster, more precise, and more proactive than anything the current system can deliver, not because clinicians will be replaced, but because technology can process information at scale so clinicians can focus on what only humans do well. That future depends on data flowing continuously across many organizations and systems. A diagnostic AI model requires access to data it can process to provide value. A personalized care pathway requires records spanning decades and institutions. Population health management requires data from millions of people, shared across systems never designed to talk to each other.
We do not yet have the trust infrastructure to make that data flow legitimately. Today, most healthcare data sharing happens within narrow, pre-agreed boundaries: a clinician requesting prior records, a hospital sharing data with one research partner under one contract. Anything beyond that runs into legal uncertainty, compliance caution, and institutional risk aversion, not because the sharing would be harmful, but because there is no reliable way to demonstrate that it is safe, purposeful, and authorized.
The consequence is a healthcare system that cannot scale intelligently. We cannot deliver personalized care by scaling the workforce to meet every individual need. Technology, and the data it requires, is not optional. But technology without trust is a liability, not a solution. This article is about building that trust: not privacy as a compliance exercise, but the architecture of trust that intelligent healthcare requires. That architecture already has a precedent. Cybersecurity faced this exact maturity gap two decades ago, and identity management more recently. Privacy is the discipline still catching up, and the rest of this article follows that path.
For much of the digital age, privacy has been treated primarily as a legal problem, and understandably so. Regulatory frameworks such as the GDPR [1] established real foundations: organizations must justify their processing, document lawful bases, report breaches, and give individuals rights over their information. That was significant progress over what came before.
Yet most people still experience digital privacy as something happening around them rather than with them. A patient may disclose information to a provider for direct care, and that information can then legitimately flow into shared care systems, regional exchanges, population health platforms, research environments, and AI-assisted diagnostic tools. Each step along that path can be individually defensible: a legal basis exists, a contract covers it, a committee has signed off. Yet from the patient's perspective, the reality is often opaque. They rarely know where their data is, who is using it, or whether the original purpose still applies.
The problem is not that regulation failed. It is that regulation alone was never going to be sufficient. Modern privacy frameworks evolved strongly as a legal governance mechanism, but only weakly as an operational one. That gap is what this article addresses.
This is not a new problem for governance disciplines generally. Cybersecurity already solved it, and identity management is in the process of solving it. Privacy is simply the last of the three to catch up.
Over the past two decades, cybersecurity moved away from perimeter controls and implicit trust, toward continuously verifying every request and making trust decisions that can be observed and checked in real time. Zero Trust reflects this: trust is never implicit or permanent, it is granted narrowly, checked continuously, and always visible.
Privacy governance still operates largely on implicit institutional trust. Once an organization establishes itself as a lawful controller, the ecosystem inherits the assumption that its processing stays proportionate and within bounds. Regulators may audit periodically and contracts may define obligations, but the subject whose data is being processed rarely participates in the operational governance of these flows. Organizations control processing operationally, while individuals largely authorize it retrospectively, through consent notices and terms of service. Privacy still runs on promises, not the kind of live enforcement other governance disciplines have built.
A useful comparison is Identity Governance and Administration, where access rules aren't just documented and forgotten. Permissions are monitored in real time, violations are flagged automatically, and access can be revoked on the spot. Privacy rarely works this way. Once data crosses an organizational boundary, the governance context around it weakens as it propagates through copies, transformations, and derived datasets. Privacy becomes a matter of institutional process rather than continuous runtime governance.
In the Netherlands, the Mitz initiative is one of the first meaningful steps toward operationalizing subject-expressed consent in a live healthcare system. Through DigiD, the national digital identity infrastructure, Mitz lets individuals set their own consent preferences, which providers then actively evaluate at the point of processing. This is the beginning of a runtime consent layer, one where the patient participates operationally rather than just through paperwork.
The limitation is that this layer is country-specific. A patient's consent is expressed and evaluated within one national system and does not yet travel with the data across borders, and today, data rarely crosses a border at all unless the patient carries it there themselves. That gap, portable, standards-based consent that moves with the data, is precisely what the European Health Data Space is designed to close (more on this below). Mitz proves the transition is feasible. The question is how to generalize it.
AI disrupts the simple model that privacy was built around, where data moves from one organization to another for a defined purpose. Personal data can now shape model training, influence outputs, and participate in inferences that become difficult to trace back to their origin. This raises a real question: once data has helped shape a model, can governance still follow it, or does the trail effectively end at training time?
This is not an argument against AI in healthcare. AI-assisted care is one of the most significant opportunities to address capacity constraints and improve outcomes across European health systems. It is an argument that governance infrastructure must maintain observability and accountability across these new processing patterns, rather than assuming traditional data-transfer models are still sufficient.
So far, this has been the diagnosis. Here is where the argument turns to the answer.
Modern privacy systems assume governance can remain external to the data itself: policies in documents, consent in databases, contracts between institutions. That model struggles under the weight of distributed healthcare ecosystems and AI-driven processing. The next generation of privacy needs a different assumption. It is tempting to say governance should travel with the data, but that framing is slightly misleading. Governance does not need to ride inside the payload. What needs to be continuous is the relationship between the person, the parties they've authorized, and the purposes they've agreed to. If that relationship is expressed once, anchored to the person, and verifiable at runtime, governance follows the data wherever it goes.
This is not an argument against institutional trust, or against GDPR. GDPR established the legal foundations required for accountable processing. The challenge is that legal governance alone is no longer sufficient for increasingly dynamic, distributed ecosystems. What's needed is an operational layer that continuously represents and evaluates the permissions, obligations, and provenance tied to a person's data as it moves, anchored to the person rather than re-derived by each institution holding a copy. For those of us building healthcare data availability infrastructure, this reframes the task: the interoperability layer isn't only where data is made available, it's the natural place to make governance observable as that data moves.
It's tempting to imagine a privacy envelope wrapping every piece of data as it moves, carrying governance metadata alongside it. That's intuitive but operationally unwieldy. A cleaner model separates two concerns that look similar but have opposite trust topologies: identity and consent.
Identity needs an external root. A self-asserted claim to be a particular person is worthless to a hospital unless something it already trusts binds that claim to a real individual. That's exactly what state-issued identity provides, and Europe is already building it: under eIDAS 2.0, every EU member state must issue citizens a digital identity credential, held in a European Digital Identity Wallet, by 2027 [2].
Consent is the mirror image. Verifying who someone requires an outside authority to vouch for the claim. Verifying that someone consents does not: the person is the only authority the claim needs. Consent can therefore be self-attested by the subject, provided it's bound to that externally anchored identity. This keeps the institutional anchor where it's irreducible, identity, and removes it where it isn't, consent.
That distinction points to an inversion of how consent usually works. Today, the burden sits with the data custodian, who must establish consent before disclosing, even though the custodian rarely holds the live relationship with the patient and cannot anticipate every future purpose. This produces either meaningless generic consent ("share my data if needed") or an unwieldy upfront matrix, which is the path Mitz takes, asking patients to answer dozens of abstract questions about hypothetical future uses.
The fix is to invert who holds the burden. The live relationship belongs to the requestor, the provider the patient has actually come to for care, not the custodian sitting on old records. So the requestor presents evidence of consent as part of the request. The patient issues that evidence, the provider holds it, the custodian verifies it. In practice, this happens at registration: using a digital identity wallet, the patient signs a consent credential specifying what they consent to, with whom, for what purpose, and for how long, tied to a real and present need rather than a hypothetical one. The wallet handles the cryptography, the patient makes the human decision. The standards for this exact flow, building on OpenID for Verifiable Credentials, are still being finalized.
Purpose is the hardest part to standardize, since it can be arbitrarily rich. The resolution is two layers: a coarse, standardized purpose code that any verifier can check, and the richer agreement underneath that stays between the patient and provider. When the provider approaches a custodian for records, it presents the credential, revealing only what's needed: that the patient issued it, to this provider, for this period, for this coarse purpose. The custodian isn't a rubber stamp, it checks that the credential is authentic, unrevoked, and within the authorized purpose, releasing what fits and withholding the rest.
Revocation is what makes this a living relationship rather than a one-time event. Each credential carries a pointer to a status list, a publicly checkable record of whether it's still valid, built on the W3C Bitstring Status List standard [3]. When a patient revokes consent in their wallet, that status updates, and any processor checking it afterward sees the change automatically. No need to track down every system holding a copy.
None of this implies perfect enforcement. Organizations acting in bad faith can still attempt misuse, just as malicious insiders exist in cybersecurity today. The goal isn't perfection, it's reducing invisible trust assumptions through observability, traceability, and accountability, the same shift cybersecurity already made. This is an extension of what a data availability platform already does: making the right data available in the right place is the first problem, carrying its governance across processors, anchored to the person, in a standardized way, is the next.
The European Health Data Space (EU regulation 2025/327) [4] establishes a mandatory framework for cross-border health data exchange across EU member states, with implementation through 2031. It doesn't just expand data sharing, it creates governance requirements around secondary use, access conditions, and individual rights across distributed ecosystems.
EHDS creates the demand for exactly the consent credential layer described here, and eIDAS 2.0 creates the identity infrastructure to build it on. Together, they lay the technical and legal groundwork for a genuinely portable governance model: consent anchored to state-issued identity, expressed through a standardized credential, verifiable by any authorized processor across Europe.
Notably, EHDS secondary use currently operates on opt-out rather than active consent, reflecting the practical limits of today's governance models. That's a reasonable near-term choice, but it relies on the same institutional trust assumption this article argues we need to move beyond. Opt-out only works as long as trust holds. If people lose confidence in how their data is used downstream, the rational response is to opt out, and at scale, that would starve the longitudinal data intelligent care depends on. A more mature governance architecture, where people can see and steer their own data relationships, is what makes the trust behind opt-out sustainable in the first place.
There's a deeper shift underneath the technical argument. Modern digital systems model institutions as primary and individuals as subordinate: hospitals create patient identifiers, platforms create accounts. But institutions are transient compared to the person. Providers change, vendors change, governments change, systems get replaced. The person remains.
This matters most in longitudinal contexts, lifelong care records, population health, AI-assisted preventative medicine, where personal data can outlive the systems and organizations that first touched it. The natural person, not the institution, may need to become the anchor point for privacy governance, not because institutions stop mattering, but because the continuity of governance ultimately belongs to the person whose life the data describes.
Cybersecurity moved from static policy to runtime enforcement. Identity governance moved from manual administration to continuous operational control. Privacy is approaching the same threshold. The likely path isn't pure decentralization, governments will keep issuing foundational identities because societies need trusted anchors, but the emerging model, state-issued identity combined with subject-controlled consent credentials verified at runtime, is a real advance on what exists today.
At Founda, we see this as the next layer of data availability. The first task is getting the right information to the right point of care. The next is making sure the governance of that information travels with the person it belongs to: observable, accountable, and anchored to the individual whose life the data describes. Not privacy as a promise made once and filed away, but governance carried in the infrastructure itself.
There's a deeper shift underneath the technical argument. Modern digital systems model institutions as primary and individuals as subordinate: hospitals create patient identifiers, platforms create accounts. But institutions are transient compared to the person. Providers change, vendors change, governments change, systems get replaced. The person remains.
This matters most in longitudinal contexts, lifelong care records, population health, AI-assisted preventative medicine, where personal data can outlive the systems and organizations that first touched it. The natural person, not the institution, may need to become the anchor point for privacy governance, not because institutions stop mattering, but because the continuity of governance ultimately belongs to the person whose life the data describes.
Cybersecurity moved from static policy to runtime enforcement. Identity governance moved from manual administration to continuous operational control. Privacy is approaching the same threshold. The likely path isn't pure decentralization, governments will keep issuing foundational identities because societies need trusted anchors, but the emerging model, state-issued identity combined with subject-controlled consent credentials verified at runtime, is a real advance on what exists today.
At Founda, we see this as the next layer of data availability. The first task is getting the right information to the right point of care. The next is making sure the governance of that information travels with the person it belongs to: observable, accountable, and anchored to the individual whose life the data describes. Not privacy as a promise made once and filed away, but governance carried in the infrastructure itself.