Bridging the Digital Divide: Evidence-Informed Health Policy Recommendations to Accelerate Electronic Health Record Implementation in Southern Italian Regions

The most immediately evident barrier to FSE implementation in Southern regions is inadequate digital infrastructure. The SVIMEZ 2023 Report documents a persistent digital gap between Northern and Southern Italy across multiple dimensions, including broadband connectivity and ICT infrastructure in public services.¹² Data from the Osservatorio Sanità Digitale (2025) confirm that 55% of healthcare facilities nationally identify insufficient economic resources as the most significant barrier to digital innovation, with workforce competency gaps (40%) and digital culture deficits (34%) as further critical obstacles.¹³ These barriers are disproportionately concentrated in Southern and insular regions.

Technological obsolescence compounds this barrier. Many Southern healthcare facilities rely on legacy computing systems incompatible with contemporary FSE platform requirements. Capital expenditure for hardware modernisation has historically been constrained by the limited fiscal capacity of regions under health system recovery programmes (piani di rientro), creating a mechanism by which historical financial disadvantage translates into persistent technological disadvantage. The Corte dei Conti has documented that PNRR spending on anti-seismic interventions for healthcare facilities in the Mezzogiorno reaches barely 6% of allocated funding, illustrating the broader pattern of delayed infrastructure investment in the South.³

Policy Implication: Infrastructure deficits require sustained, protected investment rather than one-off capital infusions. Regional health authorities should establish multiyear investment commitments aligned with PNRR accountability mechanisms, ensuring that capital expenditure for connectivity, hardware modernisation, and system maintenance is decoupled from short-term budgetary fluctuations.

Fragmentation of regional health governance represents a second critical barrier. Northern regions such as Emilia-Romagna and Veneto—which achieve near-universal FSE utilisation among general practitioners—maintain dedicated, well-resourced digital health units with clear mandates and autonomous decision-making authority. In contrast, many Southern regions address digital transformation through ad hoc, uncoordinated mechanisms dispersed across multiple administrative units.^7,14

This governance fragmentation is compounded by the absence of senior leadership positions dedicated to digital health strategy. The role of Chief Information Officer (CIO) in healthcare—a standard institutional function in Northern European and North American health systems—remains rare in Southern Italian regions. Where such positions exist, they frequently lack adequate authority over procurement, technology selection, and implementation timelines. This structural deficit is exacerbated by high turnover among health system administrators and discontinuity in regional health policy following electoral cycles.

The 8th GIMBE Report on the SSN (2025) confirms a persistent “structural fracture” between North and South in cumulative LEA (Livelli Essenziali di Assistenza) compliance: in the period 2010–2019, no region of the Mezzogiorno ranked among the top ten; in 2022, only thirteen regions were compliant, with a widening gap.¹⁵ This systemic governance imbalance directly undermines the capacity for coherent digital health planning.

Policy Implication: Institutional reform must establish durable, depoliticised structures for digital health governance. Each Southern Italian region should establish a formally constituted Regional Digital Health Unit reporting directly to the regional health commissioner, with protected multiyear budgets and autonomous authority over FSE strategy, procurement processes, and implementation timelines.

Educational and workforce capacity gaps and policy implications

Deficits in health professionals’ digital competencies represent a third barrier. Data from the Osservatorio Sanità Digitale (2025) show that 36% of medical specialists and 52% of general practitioners report having used telemedicine services (televisit); telemonitoring has been used by 30% of specialists and 46% of GPs.¹³ A recent systematic review of digital health competencies among healthcare professionals confirmed that insufficient training is a major barrier to EHR adoption across European health systems.¹⁶ The Fondazione GIMBE further notes that 95% of GPs have accessed the FSE at least once, but the depth and quality of engagement varies dramatically by region, with nine regions reaching 100% utilisation while Southern regions show lower consistency.⁴

This skills deficit generates multiple downstream consequences: resistance to system adoption; reduced efficiency gains in clinical workflows; increased risk of user errors; and failure to realise the clinical and organisational benefits that justify capital investment. The Osservatorio Sanità Digitale (2025) specifically identifies the informal use of generalist AI tools (such as ChatGPT) by 46% of GPs and 26% of specialists for clinical information—rather than dedicated clinical platforms—as evidence of a critical gap between technological awareness and structured digital competency.¹³

In regions such as Emilia-Romagna, targeted training programmes (“Competenze digitali per la salute”) have demonstrated the effectiveness of structured digital literacy initiatives for healthcare workers.¹⁷

Policy Implication: Education must be institutionalised as a mandatory component of professional practice. Regional health authorities should integrate mandatory health informatics modules into ECM programmes, drawing on successful Northern models such as the Emilia-Romagna digital competency programme.

Quality management and information security standardisation—Policy implications

Deficits in quality management and cybersecurity frameworks constitute a fourth barrier. The ISO 9001:2015 quality management standard provides organisations with systematic methodologies for process documentation, risk identification, continuous improvement, and stakeholder satisfaction measurement.¹⁸ In the FSE context, ISO 9001 implementation ensures that clinical workflows are systematically mapped, user requirements are formally captured, and system failures are documented and remediated.

The ISO/IEC 27001:2022 information security management standard establishes frameworks for asset classification, access control, incident response, and security awareness.¹⁹ The Osservatorio Sanità Digitale confirms that cybersecurity remains a top strategic priority for Italian healthcare facilities, with investments continuing to increase in response to the growing frequency and sophistication of cyberattacks against the health sector.¹³

At present, the majority of Southern Italian regional health authorities do not mandate ISO 9001 or ISO/IEC 27001 certification within procurement specifications for FSE systems. This omission exposes organisations to risks including: acquisition of systems lacking documented quality assurance; inadequate security controls against cyber threats; vulnerability to GDPR sanctions; and compromised interoperability due to non-standard implementations.

Policy Implication: Quality and security standards must be elevated from optional attributes to mandatory procurement criteria. Award criteria in competitive tenders should allocate significant weighting (minimum 25-30%) to quality and security compliance.

The extremely low citizen consent rates in Southern regions—as low as 1% in Abruzzo, Calabria, and Campania compared to 92% in Emilia-Romagna⁴—cannot be fully explained by supply-side factors alone. Analysis of the demand-side barriers reveals three interconnected dimensions that contribute to citizen disengagement from the FSE.

First, digital literacy deficits are particularly acute in Southern Italy. The SVIMEZ Report documents lower rates of internet access and digital skills in the Mezzogiorno compared to Northern regions.¹² The Osservatorio Sanità Digitale (2025) notes that 41% of Italian citizens have used the FSE, but this national average masks profound territorial inequalities: in the Mezzogiorno, utilisation remains below 11%.^4,13 As the GIMBE President Nino Cartabellotta has emphasised, uploading data is insufficient without putting citizens in a position to actually use them, which requires serious investment in digital literacy.⁴

Second, trust in data security and institutional handling of personal health information varies substantially across the national territory. Citizens in Southern regions exhibit greater diffidence toward digital systems, reflecting broader patterns of lower institutional trust documented in socio-political research. The FSE 2.0 decree of 30 December 2024 introduced important privacy safeguards—including data obscuring capabilities and the right to control which health professionals access specific documents²⁰—but these provisions require effective communication to citizens who may be unaware of them.

Third, the design of the consent model itself plays a critical role. International evidence from Germany, where an opt-in model similarly resulted in low EHR adoption, and from Estonia and Denmark, where opt-out models achieved near-universal coverage, demonstrates that the choice of consent architecture is a structurally determinative factor in citizen engagement.²¹ Italy’s current consent model, while respecting individual autonomy, may require supplementary measures—such as assisted digital onboarding at the point of care and proactive outreach campaigns in community settings—to overcome passive non-participation.

Policy Implication: Citizen engagement must be treated as a distinct policy priority. Southern regions should implement structured digital health literacy programmes at community level, deploy assisted FSE activation services within primary care facilities, and launch transparent communication campaigns addressing data security concerns. Additionally, the impact of the current opt-in consent model on adoption should be systematically evaluated, with consideration of alternative consent architectures that balance individual rights with public health benefits.

Action: Each Southern Italian region should establish a formally constituted Regional Digital Health Unit with the following attributes:

KPIs: (a) Number of Southern regions with formally established Digital Health Units by end of 2026; (b) presence of a senior CIO-level appointment in each unit; (c) percentage of annual digital health budget executed against plan; (d) quarterly reporting compliance rate to the PNRR monitoring framework.

Expected Outcome: Institutional capacity for strategic digital health planning, vendor selection based on technical merit, and coherent implementation timelines.

Implementation Timeline: Establishment by end of 2026, aligned with PNRR deadlines.

Action: Integrate mandatory health informatics education into regional ECM programmes:

KPIs: (a) Percentage of healthcare professionals completing mandatory health informatics ECM credits (≥80% by 2028); (b) pre−/post-training knowledge improvement scores; (c) FSE active utilisation rate among trained professionals; (d) number of certified health informatics trainers per region.

Expected Outcome: Systematic improvement in workforce digital literacy; reduced resistance to implementation; improved system utilisation and clinical workflow efficiency.

Implementation Timeline: Integration into ECM curricula beginning 2026, with full incorporation by early 2027.

Action: Mandate compliance with international quality and security standards in all regional FSE procurement processes:

KPIs: (a) Percentage of new FSE-related procurement tenders including mandatory ISO 9001 and ISO/IEC 27001 certification requirements; (b) number of awarded contracts with full SNOMED CT/HL7 FHIR compliance; (c) cybersecurity incident rate in FSE systems per region (year-on-year reduction target); (d) audit compliance rate for existing contracts.

Expected Outcome: Elevated technical and organisational quality; reduced cybersecurity risk; improved interoperability; reduced vendor lock-in.

Implementation Timeline: Immediate implementation for new tenders; existing contracts amended by end of 2026.

Action: Establish formal twinning arrangements between digitally mature and developing regions:

KPIs: (a) Number of formally established twinning agreements; (b) number of personnel exchanges completed per year; (c) documented knowledge transfer outcomes (e.g., procurement specifications adopted, training programmes replicated); (d) FSE adoption rate improvement in twinned Southern regions versus non-twinned regions.

Expected Outcome: Accelerated transfer of implementation knowledge; reduced costly implementation errors; identification of scalable best practices.

Implementation Timeline: Twinning partnerships formally established by mid-2026, with exchanges commencing thereafter.

The policy recommendations proposed here are informed by international evidence from countries that have achieved successful nationwide EHR implementation. Three cases are particularly instructive.

Estonia launched its national e-Health Information System (EHIS) in 2008, achieving near-universal coverage within a decade. By 2017, approximately 99% of medical prescriptions were issued electronically, and over 10,000 healthcare professionals used the system daily.²² The key success factors identified in the Estonian experience—clear governance through a dedicated e-Health Foundation, legal clarity through mandatory participation for all healthcare institutions, standardisation of medical data using HL7 CDA, and agreement on access rights²²—directly correspond to the governance and standardisation pillars proposed in this policy brief. Estonia’s experience demonstrates that even a small country with limited resources can achieve comprehensive EHR implementation when institutional structures are coherent and standards are enforced.

Denmark represents a second instructive case. The Danish health data network achieved near-complete primary care physician participation by 2010, supported by strong coordination between national and regional health authorities, a unique patient identifier system (CPR-number), and the establishment of MedCom as a national e-Health competence centre responsible for interoperability standards.^23,24 Denmark’s consolidation of hospital EHR systems to just two national platforms illustrates how reducing system fragmentation—the inverse of Italy’s current situation—facilitates data sharing and quality governance.

Critically, both Estonia and Denmark adopted opt-out consent models for their EHR systems, in contrast to the opt-in approach used in Italy and Germany. A recent comparative analysis of the German EHR implementation demonstrates that the choice of an opt-in procedure was a structurally determinative factor in the low adoption rates observed, while Estonia and Denmark’s opt-out approach resulted in near-universal population coverage.²¹ This international evidence is directly relevant to the extremely low citizen consent rates observed in Southern Italian regions (1% in Abruzzo, Calabria, and Campania) and supports the recommendation for a systematic evaluation of Italy’s consent architecture.

The European Commission’s eHealth adoption study confirms that countries with the highest adoption levels—Denmark, Estonia, Finland, Spain, Sweden, and the United Kingdom—share common characteristics: national health service-type systems, strong central coordination, and mandated interoperability standards.²⁵ Italy’s NHS-type structure (SSN) provides a favourable institutional foundation, but the devolved governance model creates implementation challenges that the proposed Regional Digital Health Units are specifically designed to address.

The digital health divide between Northern and Southern Italy represents not merely a technological or resource gap, but a manifestation of deeper institutional, governance, and human‑capacity asymmetries. Addressing this divide requires coordinated intervention across four interdependent policy domains: institutional governance, professional development, technical standardisation, and inter‑regional collaboration.The four‑pillar strategy proposed here offers a comprehensive yet operationally feasible policy framework for Southern Italian regions to accelerate EHR implementation while simultaneously strengthening the quality and security governance of their health information systems. The inclusion of ISO 9001 and ISO/IEC 27001 certification requirements within procurement specifications represents a particularly important innovation, enabling regions to address quality and cybersecurity imperatives while simultaneously promoting technical standardisation and vendor market discipline.Implementation of this strategy, combined with rigorous PNRR accountability mechanisms and sustained political commitment, is necessary—although not by itself sufficient—to achieve health equity in digital healthcare access and to meet European Union digital health integration targets by 2026. The proposed implementation timeline for the four pillars (establishment of Regional Digital Health Units by Q2 2026; commencement of ECM curriculum integration by Q3 2026; immediate implementation of procurement reform) is aligned with binding PNRR deadlines and demonstrates operational feasibility.