Bridging the Digital Divide: Evidence-Informed Health Policy Recommendations to Accelerate Electronic Health Record Implementation in Southern Italian Regions

Infrastructural barriers and policy implications

The most immediately evident barrier to EHR implementation in Southern regions is inadequate digital infrastructure. According to the 2023 SVIMEZ report, approximately 35% of healthcare facilities in Southern Italy operate with insufficient broadband connectivity to support cloud‑based EHR architectures.⁸ This deficit is particularly acute in rural and economically disadvantaged areas, where bandwidth availability remains fragmented and inconsistent. Technological obsolescence compounds this barrier. Many Southern healthcare facilities rely on legacy computing systems that are incompatible with contemporary EHR platform requirements. Capital expenditure for hardware modernisation has historically been constrained by the limited fiscal capacity of regions under health system recovery programmes (piani di rientro), creating a mechanism by which historical financial disadvantage is translated into persistent technological disadvantage.

Policy Implication: Infrastructure deficits require sustained, protected investment rather than one‑off capital infusions. Temporary funding cycles incentivise the adoption of unsustainable solutions and fail to address systemic underinvestment in digital infrastructure. Regional health authorities should establish multiyear investment commitments aligned with PNRR accountability mechanisms, ensuring that capital expenditure for broadband expansion, hardware modernisation, and system maintenance is decoupled from short‑term budgetary fluctuations.

Governance fragmentation and policy implications

Fragmentation of regional health governance represents a second critical barrier. Unlike Northern regions (such as Emilia‑Romagna, Tuscany, and Lombardy), which maintain dedicated, well‑resourced digital health units with clear mandates and autonomous decision‑making authority, many Southern regions address digital transformation through ad hoc, uncoordinated mechanisms dispersed across multiple administrative units.⁹ This governance fragmentation is compounded by the systematic absence of senior leadership positions dedicated to digital health strategy. The role of Chief Information Officer (CIO) in healthcare—a standard institutional function in Northern European and North American health systems—remains rare in Southern Italian regions. Where such positions do exist, they frequently lack adequate authority over procurement, technology selection, and implementation timelines. This structural deficit is exacerbated by high turnover among health system administrators and discontinuity in regional health policy following electoral cycles. The absence of institutional continuity undermines long‑term digital health strategies and perpetuates organisational learning deficits.

Policy Implication: Institutional reform must establish durable, depoliticised structures for digital health governance, insulated from short‑term electoral pressures and equipped with genuine decision‑making authority. Specifically, each Southern Italian region should establish a formally constituted Regional Digital Health Unit reporting directly to the regional health commissioner, with protected multiyear budgets and autonomous authority over EHR strategy, procurement processes, and implementation timelines. Such units should be staffed with qualified digital health professionals (CIO or equivalent) and include health informaticists, change management specialists, and project managers with demonstrable experience in complex health IT implementation.

Educational and workforce capacity gaps and policy implications

Deficits in health professionals’ digital literacy represent a third barrier that intersects with organisational and infrastructural constraints. Evidence from healthcare settings indicates that substantial proportions of health professionals in Southern regions report inadequate training in health information systems.¹⁰ This skills deficit generates multiple downstream consequences: resistance to system adoption; reduced efficiency gains in clinical workflows; increased risk of user errors and patient safety incidents; and failure to realise the clinical and organisational benefits that justify capital investment. Systematic analysis of Continuing Medical Education (ECM) curricula in Southern regions reveals that health informatics modules are rarely mandatory or integrated into coordinated learning pathways. This contrasts sharply with Northern regions and international comparators, where health IT literacy is treated as a core professional competency.

Policy Implication: Education must be institutionalised as a mandatory, credentialed component of professional practice rather than optional supplementation. Regional health authorities should integrate mandatory health informatics education into ECM programmes with the following specifications: Minimum 10 ECM credits per three‑year cycle dedicated to digital health competencies for all healthcare professionals (physicians, nurses, allied health workers, administrative staff ). Curriculum content covering: (a) fundamentals of health information systems; (b) EHR functionality and clinical workflow integration; (c) health data security and privacy; (d) interoperability standards (SNOMED CT, HL7 FHIR); and (e) quality improvement using health IT. Mixed delivery modalities combining in‑person training, e‑learning modules, and hands‑on system simulations, to accommodate the geographic distribution of healthcare facilities. Pre‑ and post‑training assessments of knowledge acquisition and confidence in system use. The establishment of a regional/national cadre of certified health informatics educators is essential to ensure training quality and consistency across Southern regions.

Quality management and information security standardisation—Policy implications

Deficits in quality management and cybersecurity frameworks constitute a fourth, often overlooked barrier that intersects with all preceding categories. The ISO 9001:2015 quality management standard provides organisations with systematic methodologies for process documentation, risk identification and mitigation, continuous improvement cycles, and stakeholder satisfaction measurement. In the EHR context, ISO 9001 implementation ensures that clinical workflows are systematically mapped, user requirements are formally captured, system failures are documented and remediated, and performance metrics inform iterative improvement.¹¹ Complementing quality management, the ISO/IEC 27001:2022 information security management standard establishes frameworks for asset inventory and classification, access control and authentication mechanisms, incident response protocols, and security awareness and training.¹² For healthcare organisations—where patient data constitute both a critical clinical resource and highly sensitive personal information—ISO/IEC 27001 compliance is essential for GDPR conformity, cybersecurity resilience, and patient trust. At present, the majority of Southern Italian regional health authorities do not mandate ISO 9001 or ISO/IEC 27001 certification within procurement specifications for EHR systems. This omission exposes organisations to substantial risks: acquisition of systems lacking documented quality assurance processes; inadequate security controls against evolving cyber threats; vulnerability to regulatory sanctions; and compromised interoperability due to non‑standard implementations. Moreover, the absence of standardised quality and security requirements across regional procurement processes may perpetuate vendor lock‑in and limit competition, ultimately increasing costs and reducing system flexibility.

Policy Implication: Quality and security standards must be elevated from optional “nice‑to‑have” attributes to mandatory procurement criteria, with certification requirements specified within contractual terms. Specifically, regional health authorities should mandate compliance with international quality and security standards in all EHR procurement processes:Vendor EHR systems must demonstrate conformity to SNOMED CT clinical terminology standards, HL7 FHIR API standards, and international electronic health record data‑exchange protocols. Conformity should be validated through independent certification or vendor attestation, with contractual penalties for non‑compliance. All EHR systems must be certified to ISO 9001:2015. Evidence of certification must be provided during competitive procurement evaluation, and recertification requirements should be contractually mandated throughout the system lifecycle (with at least annual audit cycles). All EHR systems must be certified to ISO/IEC 27001:2022. Certification audit reports must be submitted during procurement evaluation and at regular intervals (minimum biennial audits) throughout the contract term. Regional health authorities should specify mandatory security requirements (e.g. encryption standards, access controls, incident‑response timelines) within procurement specifications, again with contractual penalties for non‑compliance. In competitive tender evaluations, award criteria should allocate significant weighting (minimum 25–30%) to quality and security compliance, ensuring that these factors compete on an equal footing with cost considerations rather than being treated as secondary criteria.

Pillar 1: Institutional Reform—Dedicated Digital Health Governance

Action: Each Southern Italian region should establish a formally constituted Regional Digital Health Unit with the following attributes:

Autonomous governance structure: Reporting directly to the regional health commissioner or a designated senior health authority, thereby minimising bureaucratic obstruction and ensuring decision‑making agility.

Multiyear protected budget: Allocation of dedicated resources for 5–10‑year horizons, shielded from short‑term budgetary fluctuations or political pressures. Qualified personnel: Recruitment of senior digital health professionals (CIO or equivalent), health informaticists, change management specialists, and project managers with demonstrable experience in complex health IT implementation.

Clear mandate: Formal authority over regional EHR strategy, procurement processes, implementation timelines, and performance evaluation.

Accountability mechanisms: Regular reporting to regional health authorities and the national PNRR monitoring framework, supported by transparent performance metrics.Expected Outcome: Establishment of institutional capacity for strategic digital health planning, vendor selection based on technical merit rather than political patronage, and coherent implementation timelines aligned with PNRR deadlines. Implementation Timeline: Regional Digital Health Units should be established by Q2 2026 in order to meet PNRR deadlines.

Pillar 2: Professional Development—Mandatory Health Informatics Training

Action: Integrate mandatory health informatics education into regional Continuing Medical Education (ECM) programmes with the following specifications:

Credit allocation: Minimum 10 ECM credits per three‑year cycle dedicated to digital health competencies for all healthcare professionals (physicians, nurses, allied health professionals, administrative staff ).

Curriculum content: Core modules addressing (a) fundamentals of health information systems; (b) EHR functionality and clinical workflow integration; (c) health data security and privacy; (d) interoperability standards (SNOMED CT, HL7 FHIR); and (e) quality improvement using health IT.

Delivery modality: Mixed approach combining in‑person training, e‑learning modules, and hands‑on system simulations, accommodating the geographic dispersion of healthcare facilities.

Evaluation mechanism: Pre‑ and post‑training assessments of knowledge acquisition and confidence in system use.

Trainer qualification: Establishment of a regional/national cadre of certified health informatics educators.

Expected Outcome: Systematic improvement in workforce digital literacy; reduced resistance to implementation; improved system utilisation and clinical workflow efficiency; and generation of user‑centred feedback to support continuous system improvement. Implementation Timeline: Integration into ECM curricula should begin by Q3 2026, with full incorporation into regional programmes by Q1 2027.

Pillar 3: Quality and Security Standardisation—Procurement Reform

Action: Mandate compliance with international quality and security standards in all regional EHR procurement processes:

Interoperability requirements: Vendor EHR systems must demonstrate conformity to SNOMED CT clinical terminology standards, HL7 FHIR API standards, and international electronic health record data‑exchange protocols. Conformity should be validated through independent certification or formal vendor attestation, with explicit contractual penalties for non‑compliance.

Quality management certification: All EHR systems must be certified to ISO 9001:2015. Evidence of certification must be provided during competitive procurement evaluation, and recertification requirements must be contractually mandated throughout the system lifecycle (with at least annual audit cycles). Information security certification: All EHR systems must be certified to ISO/IEC 27001:2022. Certification audit reports must be submitted during procurement evaluation and at regular intervals (minimum biennial audits) throughout the contract term. Regional health authorities should also specify mandatory security requirements (e.g. encryption, access control, incident‑response timelines) within procurement specifications, with contractual penalties for non‑compliance.

Procurement weighting: In competitive tender evaluations, quality and security compliance should receive substantial weighting (minimum 25–30%), ensuring that these dimensions are considered on an equal footing with cost.

Expected Outcome: Systematic elevation of technical and organisational quality across regional EHR implementations; reduced cybersecurity risk and enhanced data protection; improved interoperability and reduced vendor lock‑in; and stronger market incentives for vendors to maintain rigorous quality and security standards. Implementation Timeline: Procurement specification reforms should be implemented immediately for all new EHR tenders. Existing contracts should be amended to incorporate ISO certification requirements by Q4 2026.

Pillar 4: Inter-Regional Knowledge Networks—Twinning and Capacity Transfer

Action: Establish formal twinning arrangements between digitally mature Northern regions and developing Southern regions:

Partnership structure: Formal agreements between pairs of regions (e.g. Emilia‑Romagna with Campania; Tuscany with Sicily; Veneto with Calabria) specifying objectives for technical assistance, knowledge sharing, and capacity building.

Personnel exchange: Structured rotations of 3–6 months, enabling Southern health IT professionals and administrators to work within Northern digital health units and to learn implementation practices and technical approaches in situ. Mentorship model: Identification of senior Northern health IT leaders as formal mentors to Southern counterparts, with regular structured mentorship interactions (monthly or quarterly).

Peer learning networks: Establishment of working groups focused on specific implementation challenges (e.g. vendor selection, cybersecurity, clinical user engagement), with representation from participating regions.

Funding mechanism: Allocation of PNRR resources to support personnel exchanges and peer‑learning activities, ensuring that financial barriers do not impede participation. Expected Outcome: Accelerated transfer of implementation knowledge and lessons learned; reduced probability of costly implementation errors; strengthened professional networks among Italian health IT leaders; and identification of scalable best practices and adaptations of successful Northern models to Southern contexts. Implementation Timeline: Twinning partnerships should be formally established by Q2 2026, with initial personnel exchanges commencing by Q3 2026.

Key stakeholders and implementation roles

Effective implementation requires coordinated action across multiple stakeholders:

Regional Health Authorities must establish Regional Digital Health Units with adequate budgets and staffing, mandate ISO standardisation in procurement specifications, and integrate health informatics into ECM curricula.

National Ministry of Health must provide regulatory guidance on standardisation requirements, allocate PNRR resources to support inter‑regional twinning and capacity building, and establish national accountability mechanisms for monitoring regional EHR implementation progress.

Northern Italian Regions (digitally mature) must commit to formal mentorship and knowledge‑transfer arrangements with Southern regions, facilitating personnel exchanges and peer‑learning networks.

Healthcare Facilities and Organisations must comply with mandatory workforce training requirements, adopt EHR systems that meet ISO certification standards, and participate in implementation evaluation and feedback mechanisms.

Anticipated barriers to implementation and mitigation strategies

Political resistance stemming from administrative transitions may impede the establishment of depoliticised Regional Digital Health Units.

Mitigation: PNRR regulations should specify that Regional Units are protected entities insulated from electoral cycles, with dedicated funding streams that cannot be reallocated. Fiscal constraints in economically disadvantaged Southern regions may limit multiyear protected budgeting for infrastructure and workforce development.

Mitigation: The national government should allocate PNRR resources specifically to support infrastructure investments in Southern regions and provide additional support for regions unable to meet matching‑fund requirements. Workforce resistance to mandatory health informatics training may arise if training is perceived as burdensome or disconnected from clinical practice.

Mitigation: Curriculum development must be practitioner‑centred and context‑specific, with active involvement of clinical leaders in design; training delivery should emphasise workflow integration and demonstrable clinical benefits.Future research should prospectively evaluate the implementation effectiveness of these recommendations and assess their impact on clinical outcomes, healthcare efficiency, and patient experience across Southern Italian regions. Longitudinal assessment of EHR adoption rates, quality metrics, cybersecurity incident rates, and workforce satisfaction should inform iterative refinement of the policy strategy.