Approach

Why Fortify

Secondary use of health data can speed up research, innovation and better care—one of the core ambitions of the EHDS. But for many organisations, health data is also tied to innovation assets: proprietary datasets, know how, trade secrets, and commercially confidential information. Without clear operational safeguards, health data holders may hesitate to share high value data, slowing down the EHDS and limiting Europe’s capacity to innovate. Common challenges include:

LOSS OF CONTROL

Once data is shared, it can be difficult to monitor downstream use and prevent misuse.

UNCLEAR PROCEDURES

EHDS foresees safeguards, but practical protocols need to be made usable day-to-day.

NEED FOR CONSISTENCY

Fragmented approaches across Member States can increase delays, costs and uncertainty.

Our roadmap

FORTIFY will develop and validate a practical set of tools that help EHDS actors share and reuse health data responsibly while safeguarding innovation. Central to the project is the FORTIFY Framework, which integrates legal, governance and technical measures that are rigorously validated through a range of use cases and stakeholder reviews.

  • Legal guidance and operational recommendations for handling IP-sensitive health data across the EHDS secondary-use process.

  • Model contracts and template clauses for common data access scenarios, clarifying roles, responsibilities and protections.

  • Governance tools —such as checklists, decision criteria and procedures— to facilitate consistent and robust assessments of data access requests.
  • Technical toolkit supporting IP-risk management, including traceability and watermarking solutions, and guidance for using synthetic, anonymised or transformed data where appropriate.
  • Training and policy recommendations to support uptake by Health Data Access Bodies (HDABs), health data holders and other stakeholders.

Community-driven solutions

FORTIFY is an Innovative Health Initiative (IHI) funded public–private partnership, uniting 33 partners from academia, industry, healthcare, policy and patient organisations. Coordinated by Karolinska Institutet and led by Johnson & Johnson, our consortium is designed to serve the needs of:

  • Health Data Holders (HDH) such as hospitals, clinics, research institutions, biobanks, industry or public health agencies.

  • Health Data Access Bodies (HDAB) including national data protection authorities, specialised health data access offices, or designated government agencies

  • Health Data Users (HDU) like academic researchers, pharmaceutical companies, public health researchers or biotech companies.

  • and, crucially, patients and citizens whose trust and expectations are central to the project.

A Multi-stakeholder Forum brings together the diverse perspectives and requirements of these stakeholder groups. This forum plays a vital role in guiding and validating FORTIFY solutions, making sure they are fit for purpose and respond to real-world needs.

Use cases

FORTIFY will validate its legal and technical solutions in a set of real-world use cases chosen to reflect the breadth of EHDS secondary use and the diversity of IP-related risks. These include scenarios where data is pooled, federated, processed in secure environments, and used for advanced analytics and AI.

Clinical trials and studies

Enabling responsible reuse while managing timing, confidentiality and downstream publication risks

Medical imaging and AI

Testing safeguards for high-dimensional data and model development (including risks of memorisation and leakage)

Biobanks and multi omics

Supporting secure reuse of linked molecular and clinical data in biomarker discovery

Federated studies

Validating IP-aware governance and controls where analysis is executed locally and only results are shared

Device-generated data

Addressing proprietary signal-processing and derived feature risks in medtech contexts

Secure processing environments

Exploring how IP safeguards can complement privacy and security controls, including post access traceability

Clinical trials and studies

Enabling responsible reuse while managing timing, confidentiality and downstream publication risks

Medical imaging and AI

Testing safeguards for high-dimensional data and model development (including risks of memorisation and leakage)

Biobanks and multi omics

Supporting secure reuse of linked molecular and clinical data in biomarker discovery

Federated studies

Validating IP-aware governance and controls where analysis is executed locally and only results are shared

Device-generated data

Addressing proprietary signal-processing and derived feature risks in medtech contexts

Secure processing environments

Exploring how IP safeguards can complement privacy and security controls, including post access traceability

Value

For Health Data Holders (HDH)

Clearer rules, ready-to-use templates and technical safeguards to share high-value data without risking competitive assets.

For Health Data Users (HDU)

Improved access to high-quality data with greater legal certainty and more predictable conditions.

For Health Data Access Bodies (HDAB)

Consistent procedures and decision support to assess requests efficiently and proportionately, including IP-sensitive scenarios.

For patients and citizens

Stronger confidence that health data is reused responsibly, securely and in the public interest—supporting faster research and better treatments.

Consortium

FORTIFY is delivered by a 33-partner consortium spanning research, healthcare, industry, policy and patient organisations. This mix ensures solutions are technically feasible, legally robust, and workable for the EHDS actors who will implement them.

Leadership

Karolinska Institutet
Coordinator

Johnson & Johnson
Project lead

  • Clarivate
  • Pfizer
  • Resmed

FAQ

FORTIFY is an IHI-funded public–private partnership developing and validating a framework that enables secondary use of health data in the EHDS while safeguarding intellectual property, trade secrets and commercially confidential information.

No. FORTIFY is designed to complement existing privacy and security approaches in the EHDS (such as secure processing environments). It focuses on the additional—and often overlooked—risk of innovation-related harm (e.g., exposure of trade secrets) and develops practical safeguards that can be used alongside privacy controls.

As the project progresses, FORTIFY will publish guidance, templates, training materials and evidence from use case testing. The main integrated output—the FORTIFY Framework—will be validated through real-world pilots and shared alongside practical recommendations for EHDS stakeholders.

FORTIFY engages stakeholders through events, consultations and a Multi-stakeholder Forum. If you represent a health data holder, health data access body, research organisation, patient group or innovator, you can contact the consortium to express interest in updates or collaboration opportunities.
Contact us at info@fortify-ehds.eu