F1000Research F1000Research 2046-1402 F1000 Research Limited London, UK 10.12688/f1000research.176771.1 Policy Brief Articles Bridging the Digital Divide: Evidence-Informed Health Policy Recommendations to Accelerate Electronic Health Record Implementation in Southern Italian Regions

[version 1; peer review: awaiting peer review]

 Fumai Giuseppe Conceptualization Investigation Methodology Resources Supervision Validation Visualization Writing – Original Draft Preparation Writing – Review & Editing https://orcid.org/0009-0007-5931-4417 a 1 Menolascina Francesco Methodology Validation Writing – Review & Editing https://orcid.org/0009-0005-3881-4653 2 Morelli Claudio Validation Writing – Review & Editing https://orcid.org/0009-0004-8622-874X 3 Scienze Biomediche, Universita degli Studi di Foggia Dipartimenti di Area Medica, Foggia, Apulia, 71100, Italy Universita degli Studi di Bari Aldo Moro, Bari, Apulia, Italy Bari, Istituto Tumori Bari, Puglia, Italy giuseppe_fumai.637401@unifg.it

No competing interests were disclosed.

 25 3 2026 2026 15 434 4 3 2026 Copyright: © 2026 Fumai G et al. 2026 This is an open access article distributed under the terms of the Creative Commons Attribution Licence, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Background

Implementation of Electronic Health Records (EHRs) is a strategic priority within Italy’s National Recovery and Resilience Plan (PNRR), which allocates approximately €15 billion to healthcare digitalisation. Southern Italian regions currently exhibit EHR adoption rates below 50%, compared with 70–80% in Northern regions. This digital divide reflects interconnected barriers spanning infrastructure, governance, workforce capacity, and the standardisation of quality management. Understanding these barriers and their policy implications is essential to achieve equitable healthcare digitalisation and to meet EU digital health targets by 2026.

 Policy and Implications

Four primary barriers were identified: (1) infrastructural deficits—approximately 35% of Southern healthcare facilities lack adequate broadband capacity to support cloud-based EHR systems; (2) governance fragmentation—characterised by the absence of dedicated digital health units and senior information technology leadership; (3) workforce capability gaps—substantial proportions of health professionals report inadequate training in health information systems, with health informatics modules rarely mandated within continuing professional education (ECM) curricula in Southern regions; and (4) insufficient integration of quality management (ISO 9001) and information security standards (ISO/IEC 27001) within procurement specifications.

These barriers are manifestations of deeper institutional asymmetries. The absence of mandatory quality and security standards in EHR procurement exposes healthcare organisations to substantial cybersecurity risks, perpetuates vendor lock‑in, and inflates costs.

 Recommendations

A four‑pillar policy strategy is proposed: (1) establish dedicated Regional Digital Health Units with autonomous governance and protected multiyear budgets; (2) mandate a minimum of 10 continuing education credits per triennium in health informatics for all healthcare professionals; (3) require SNOMED CT/HL7 FHIR interoperability and ISO 9001 and ISO/IEC 27001 certification as mandatory procurement criteria; and (4) establish formal twinning arrangements between digitally mature Northern regions and less digitally developed Southern regions to accelerate knowledge transfer and capacity building.

 Conclusions

Bridging the North–South digital divide requires coordinated policy reform addressing governance, professional development, technical standardisation, and inter‑regional collaboration. This evidence‑informed strategy is operationally feasible within existing PNRR timelines and will strengthen the quality governance of health information systems across Southern Italian healthcare.

 Electronic Health Records; Digital health; Health policy; Italy; Healthcare digitalisation; Interoperability; ISO 9001; Implementation science The author(s) declared that no grants were involved in supporting this work. Introduction

The digital transformation of healthcare systems constitutes one of the defining challenges of contemporary health policy. Within the European Union, the digitalisation of health services is framed as a fundamental enabler of healthcare quality, efficiency, and patient safety. In Italy, the implementation of Electronic Health Records (EHRs), termed Fascicolo Sanitario Elettronico (FSE), has been designated as a strategic priority within the National Recovery and Resilience Plan (PNRR), with investments exceeding €15 billion allocated to healthcare system digitalisation. 1 Despite this substantial financial commitment, implementation outcomes show a striking geographical pattern: Northern and Central Italian regions demonstrate EHR adoption rates of 70–80%, whereas Southern regions remain substantially below 50%. 2 This digital divide is not merely a technological gap; it reflects and potentially reinforces existing health inequities. International evidence indicates that effective EHR implementation delivers substantial clinical benefits, including reductions in adverse events (with reductions of up to 50% documented in comparable European contexts), improved continuity of care, and enhanced clinical decision support. 3, 4 In Italy, where an ageing population and the rising prevalence of chronic diseases create substantial and growing healthcare demands, the underutilisation of EHR infrastructure in economically disadvantaged regions raises significant concerns regarding equitable access to healthcare innovation. The persistence of this geographical disparity, despite EU‑wide commitments to digital health integration and regulatory frameworks designed to promote interoperability, suggests that technological diffusion is mediated by complex institutional, infrastructural, and human factors that extend beyond simple resource constraints. 5 Furthermore, the binding deadline imposed by PNRR implementation targets (2026) creates temporal pressure for evidence‑informed policy interventions. This policy brief presents a narrative, evidence‑informed analysis aimed at: (1) systematically identifying the primary barriers to EHR implementation in Southern Italian regions; (2) analysing the interconnections among infrastructural, organisational, educational, and standardisation‑related obstacles; and (3) proposing actionable, evidence‑based policy recommendations that address these multidimensional challenges at regional and national levels. Methodology: This analysis employed a narrative policy research approach, combining a systematic literature review with institutional document analysis. 6 This methodology was selected because the research question—identifying barriers to complex policy implementation and generating feasible recommendations—does not require experimental design but instead calls for the synthesis of existing evidence and institutional knowledge to inform policy dialogue.Literature searches were conducted across three major biomedical databases (PubMed/MEDLINE, Scopus, CINAHL) for peer‑reviewed publications (2018–2024) examining EHR/digital health implementation, barriers, or policy frameworks in European or OECD health systems. Italian health policy reports from authoritative institutional sources (Ministry of Health, AGENAS, SVIMEZ), EU regulatory guidance documents, and empirical studies on EHR adoption and implementation science were systematically reviewed. Grey literature from the Ministry of Health (Ministero della Salute), AGENAS monitoring datasets, SVIMEZ reports on economic and social development in Southern Italy, and European Commission regulatory frameworks was retrieved. Extracted information included: identified barriers to EHR implementation; reported adoption rates and implementation timelines; policy interventions and institutional responses; and quantitative indicators (infrastructure metrics, workforce training rates). Barriers were thematically organised into four categories derived from implementation science literature 7 : infrastructural, organisational/governance, educational/workforce, and standardisation‑related factors. Where specific quantitative data for Southern Italian regions were unavailable, evidence from comparable Southern European health systems (Spain, Greece, Portugal) was incorporated to contextualise the analysis.

 Policy outcomes and implications Infrastructural barriers and policy implications

The most immediately evident barrier to EHR implementation in Southern regions is inadequate digital infrastructure. According to the 2023 SVIMEZ report, approximately 35% of healthcare facilities in Southern Italy operate with insufficient broadband connectivity to support cloud‑based EHR architectures. 8 This deficit is particularly acute in rural and economically disadvantaged areas, where bandwidth availability remains fragmented and inconsistent. Technological obsolescence compounds this barrier. Many Southern healthcare facilities rely on legacy computing systems that are incompatible with contemporary EHR platform requirements. Capital expenditure for hardware modernisation has historically been constrained by the limited fiscal capacity of regions under health system recovery programmes (piani di rientro), creating a mechanism by which historical financial disadvantage is translated into persistent technological disadvantage.

Policy Implication: Infrastructure deficits require sustained, protected investment rather than one‑off capital infusions. Temporary funding cycles incentivise the adoption of unsustainable solutions and fail to address systemic underinvestment in digital infrastructure. Regional health authorities should establish multiyear investment commitments aligned with PNRR accountability mechanisms, ensuring that capital expenditure for broadband expansion, hardware modernisation, and system maintenance is decoupled from short‑term budgetary fluctuations.

 Governance fragmentation and policy implications

Fragmentation of regional health governance represents a second critical barrier. Unlike Northern regions (such as Emilia‑Romagna, Tuscany, and Lombardy), which maintain dedicated, well‑resourced digital health units with clear mandates and autonomous decision‑making authority, many Southern regions address digital transformation through ad hoc, uncoordinated mechanisms dispersed across multiple administrative units. 9 This governance fragmentation is compounded by the systematic absence of senior leadership positions dedicated to digital health strategy. The role of Chief Information Officer (CIO) in healthcare—a standard institutional function in Northern European and North American health systems—remains rare in Southern Italian regions. Where such positions do exist, they frequently lack adequate authority over procurement, technology selection, and implementation timelines. This structural deficit is exacerbated by high turnover among health system administrators and discontinuity in regional health policy following electoral cycles. The absence of institutional continuity undermines long‑term digital health strategies and perpetuates organisational learning deficits.

Policy Implication: Institutional reform must establish durable, depoliticised structures for digital health governance, insulated from short‑term electoral pressures and equipped with genuine decision‑making authority. Specifically, each Southern Italian region should establish a formally constituted Regional Digital Health Unit reporting directly to the regional health commissioner, with protected multiyear budgets and autonomous authority over EHR strategy, procurement processes, and implementation timelines. Such units should be staffed with qualified digital health professionals (CIO or equivalent) and include health informaticists, change management specialists, and project managers with demonstrable experience in complex health IT implementation.

Educational and workforce capacity gaps and policy implications

Deficits in health professionals’ digital literacy represent a third barrier that intersects with organisational and infrastructural constraints. Evidence from healthcare settings indicates that substantial proportions of health professionals in Southern regions report inadequate training in health information systems. 10 This skills deficit generates multiple downstream consequences: resistance to system adoption; reduced efficiency gains in clinical workflows; increased risk of user errors and patient safety incidents; and failure to realise the clinical and organisational benefits that justify capital investment. Systematic analysis of Continuing Medical Education (ECM) curricula in Southern regions reveals that health informatics modules are rarely mandatory or integrated into coordinated learning pathways. This contrasts sharply with Northern regions and international comparators, where health IT literacy is treated as a core professional competency.

Policy Implication: Education must be institutionalised as a mandatory, credentialed component of professional practice rather than optional supplementation. Regional health authorities should integrate mandatory health informatics education into ECM programmes with the following specifications: Minimum 10 ECM credits per three‑year cycle dedicated to digital health competencies for all healthcare professionals (physicians, nurses, allied health workers, administrative staff ). Curriculum content covering: (a) fundamentals of health information systems; (b) EHR functionality and clinical workflow integration; (c) health data security and privacy; (d) interoperability standards (SNOMED CT, HL7 FHIR); and (e) quality improvement using health IT. Mixed delivery modalities combining in‑person training, e‑learning modules, and hands‑on system simulations, to accommodate the geographic distribution of healthcare facilities. Pre‑ and post‑training assessments of knowledge acquisition and confidence in system use. The establishment of a regional/national cadre of certified health informatics educators is essential to ensure training quality and consistency across Southern regions.

Quality management and information security standardisation—Policy implications

Deficits in quality management and cybersecurity frameworks constitute a fourth, often overlooked barrier that intersects with all preceding categories. The ISO 9001:2015 quality management standard provides organisations with systematic methodologies for process documentation, risk identification and mitigation, continuous improvement cycles, and stakeholder satisfaction measurement. In the EHR context, ISO 9001 implementation ensures that clinical workflows are systematically mapped, user requirements are formally captured, system failures are documented and remediated, and performance metrics inform iterative improvement. 11 Complementing quality management, the ISO/IEC 27001:2022 information security management standard establishes frameworks for asset inventory and classification, access control and authentication mechanisms, incident response protocols, and security awareness and training. 12 For healthcare organisations—where patient data constitute both a critical clinical resource and highly sensitive personal information—ISO/IEC 27001 compliance is essential for GDPR conformity, cybersecurity resilience, and patient trust. At present, the majority of Southern Italian regional health authorities do not mandate ISO 9001 or ISO/IEC 27001 certification within procurement specifications for EHR systems. This omission exposes organisations to substantial risks: acquisition of systems lacking documented quality assurance processes; inadequate security controls against evolving cyber threats; vulnerability to regulatory sanctions; and compromised interoperability due to non‑standard implementations. Moreover, the absence of standardised quality and security requirements across regional procurement processes may perpetuate vendor lock‑in and limit competition, ultimately increasing costs and reducing system flexibility.

Policy Implication: Quality and security standards must be elevated from optional “nice‑to‑have” attributes to mandatory procurement criteria, with certification requirements specified within contractual terms. Specifically, regional health authorities should mandate compliance with international quality and security standards in all EHR procurement processes:Vendor EHR systems must demonstrate conformity to SNOMED CT clinical terminology standards, HL7 FHIR API standards, and international electronic health record data‑exchange protocols. Conformity should be validated through independent certification or vendor attestation, with contractual penalties for non‑compliance. All EHR systems must be certified to ISO 9001:2015. Evidence of certification must be provided during competitive procurement evaluation, and recertification requirements should be contractually mandated throughout the system lifecycle (with at least annual audit cycles). All EHR systems must be certified to ISO/IEC 27001:2022. Certification audit reports must be submitted during procurement evaluation and at regular intervals (minimum biennial audits) throughout the contract term. Regional health authorities should specify mandatory security requirements (e.g. encryption standards, access controls, incident‑response timelines) within procurement specifications, again with contractual penalties for non‑compliance. In competitive tender evaluations, award criteria should allocate significant weighting (minimum 25–30%) to quality and security compliance, ensuring that these factors compete on an equal footing with cost considerations rather than being treated as secondary criteria.

 Actionable recommendations

The recommendations presented here constitute a four‑pillar policy strategy designed to address the multidimensional barriers identified above. These pillars are conceptually distinct yet operationally interdependent; implementation of any single pillar in isolation will be insufficient to resolve the underlying systemic constraints.

Pillar 1: Institutional Reform—Dedicated Digital Health Governance

Action: Each Southern Italian region should establish a formally constituted Regional Digital Health Unit with the following attributes:

Autonomous governance structure: Reporting directly to the regional health commissioner or a designated senior health authority, thereby minimising bureaucratic obstruction and ensuring decision‑making agility.

Multiyear protected budget: Allocation of dedicated resources for 5–10‑year horizons, shielded from short‑term budgetary fluctuations or political pressures. Qualified personnel: Recruitment of senior digital health professionals (CIO or equivalent), health informaticists, change management specialists, and project managers with demonstrable experience in complex health IT implementation.

Clear mandate: Formal authority over regional EHR strategy, procurement processes, implementation timelines, and performance evaluation.

Accountability mechanisms: Regular reporting to regional health authorities and the national PNRR monitoring framework, supported by transparent performance metrics. Expected Outcome: Establishment of institutional capacity for strategic digital health planning, vendor selection based on technical merit rather than political patronage, and coherent implementation timelines aligned with PNRR deadlines. Implementation Timeline: Regional Digital Health Units should be established by Q2 2026 in order to meet PNRR deadlines.

 Pillar 2: Professional Development—Mandatory Health Informatics Training

Action: Integrate mandatory health informatics education into regional Continuing Medical Education (ECM) programmes with the following specifications:

Credit allocation: Minimum 10 ECM credits per three‑year cycle dedicated to digital health competencies for all healthcare professionals (physicians, nurses, allied health professionals, administrative staff ).

Curriculum content: Core modules addressing (a) fundamentals of health information systems; (b) EHR functionality and clinical workflow integration; (c) health data security and privacy; (d) interoperability standards (SNOMED CT, HL7 FHIR); and (e) quality improvement using health IT.

Delivery modality: Mixed approach combining in‑person training, e‑learning modules, and hands‑on system simulations, accommodating the geographic dispersion of healthcare facilities.

Evaluation mechanism: Pre‑ and post‑training assessments of knowledge acquisition and confidence in system use.

Trainer qualification: Establishment of a regional/national cadre of certified health informatics educators.

Expected Outcome: Systematic improvement in workforce digital literacy; reduced resistance to implementation; improved system utilisation and clinical workflow efficiency; and generation of user‑centred feedback to support continuous system improvement. Implementation Timeline: Integration into ECM curricula should begin by Q3 2026, with full incorporation into regional programmes by Q1 2027.

 Pillar 3: Quality and Security Standardisation—Procurement Reform

Action: Mandate compliance with international quality and security standards in all regional EHR procurement processes:

Interoperability requirements: Vendor EHR systems must demonstrate conformity to SNOMED CT clinical terminology standards, HL7 FHIR API standards, and international electronic health record data‑exchange protocols. Conformity should be validated through independent certification or formal vendor attestation, with explicit contractual penalties for non‑compliance.

Quality management certification: All EHR systems must be certified to ISO 9001:2015. Evidence of certification must be provided during competitive procurement evaluation, and recertification requirements must be contractually mandated throughout the system lifecycle (with at least annual audit cycles). Information security certification: All EHR systems must be certified to ISO/IEC 27001:2022. Certification audit reports must be submitted during procurement evaluation and at regular intervals (minimum biennial audits) throughout the contract term. Regional health authorities should also specify mandatory security requirements (e.g. encryption, access control, incident‑response timelines) within procurement specifications, with contractual penalties for non‑compliance.

Procurement weighting: In competitive tender evaluations, quality and security compliance should receive substantial weighting (minimum 25–30%), ensuring that these dimensions are considered on an equal footing with cost.

Expected Outcome: Systematic elevation of technical and organisational quality across regional EHR implementations; reduced cybersecurity risk and enhanced data protection; improved interoperability and reduced vendor lock‑in; and stronger market incentives for vendors to maintain rigorous quality and security standards. Implementation Timeline: Procurement specification reforms should be implemented immediately for all new EHR tenders. Existing contracts should be amended to incorporate ISO certification requirements by Q4 2026.

 Pillar 4: Inter-Regional Knowledge Networks—Twinning and Capacity Transfer

Action: Establish formal twinning arrangements between digitally mature Northern regions and developing Southern regions:

Partnership structure: Formal agreements between pairs of regions (e.g. Emilia‑Romagna with Campania; Tuscany with Sicily; Veneto with Calabria) specifying objectives for technical assistance, knowledge sharing, and capacity building.

Personnel exchange: Structured rotations of 3–6 months, enabling Southern health IT professionals and administrators to work within Northern digital health units and to learn implementation practices and technical approaches in situ. Mentorship model: Identification of senior Northern health IT leaders as formal mentors to Southern counterparts, with regular structured mentorship interactions (monthly or quarterly).

Peer learning networks: Establishment of working groups focused on specific implementation challenges (e.g. vendor selection, cybersecurity, clinical user engagement), with representation from participating regions.

Funding mechanism: Allocation of PNRR resources to support personnel exchanges and peer‑learning activities, ensuring that financial barriers do not impede participation. Expected Outcome: Accelerated transfer of implementation knowledge and lessons learned; reduced probability of costly implementation errors; strengthened professional networks among Italian health IT leaders; and identification of scalable best practices and adaptations of successful Northern models to Southern contexts. Implementation Timeline: Twinning partnerships should be formally established by Q2 2026, with initial personnel exchanges commencing by Q3 2026.

 Conclusions/Discussion

The digital health divide between Northern and Southern Italy represents not merely a technological or resource gap, but a manifestation of deeper institutional, governance, and human‑capacity asymmetries. Addressing this divide requires coordinated intervention across four interdependent policy domains: institutional governance, professional development, technical standardisation, and inter‑regional collaboration.The four‑pillar strategy proposed here offers a comprehensive yet operationally feasible policy framework for Southern Italian regions to accelerate EHR implementation while simultaneously strengthening the quality and security governance of their health information systems. The inclusion of ISO 9001 and ISO/IEC 27001 certification requirements within procurement specifications represents a particularly important innovation, enabling regions to address quality and cybersecurity imperatives while simultaneously promoting technical standardisation and vendor market discipline.Implementation of this strategy, combined with rigorous PNRR accountability mechanisms and sustained political commitment, is necessary—although not by itself sufficient—to achieve health equity in digital healthcare access and to meet European Union digital health integration targets by 2026. The proposed implementation timeline for the four pillars (establishment of Regional Digital Health Units by Q2 2026; commencement of ECM curriculum integration by Q3 2026; immediate implementation of procurement reform) is aligned with binding PNRR deadlines and demonstrates operational feasibility.

Key stakeholders and implementation roles

Effective implementation requires coordinated action across multiple stakeholders:

Regional Health Authorities must establish Regional Digital Health Units with adequate budgets and staffing, mandate ISO standardisation in procurement specifications, and integrate health informatics into ECM curricula.

National Ministry of Health must provide regulatory guidance on standardisation requirements, allocate PNRR resources to support inter‑regional twinning and capacity building, and establish national accountability mechanisms for monitoring regional EHR implementation progress.

Northern Italian Regions (digitally mature) must commit to formal mentorship and knowledge‑transfer arrangements with Southern regions, facilitating personnel exchanges and peer‑learning networks.

Healthcare Facilities and Organisations must comply with mandatory workforce training requirements, adopt EHR systems that meet ISO certification standards, and participate in implementation evaluation and feedback mechanisms.

 Anticipated barriers to implementation and mitigation strategies

Political resistance stemming from administrative transitions may impede the establishment of depoliticised Regional Digital Health Units.

Mitigation: PNRR regulations should specify that Regional Units are protected entities insulated from electoral cycles, with dedicated funding streams that cannot be reallocated. Fiscal constraints in economically disadvantaged Southern regions may limit multiyear protected budgeting for infrastructure and workforce development.

Mitigation: The national government should allocate PNRR resources specifically to support infrastructure investments in Southern regions and provide additional support for regions unable to meet matching‑fund requirements. Workforce resistance to mandatory health informatics training may arise if training is perceived as burdensome or disconnected from clinical practice.

Mitigation: Curriculum development must be practitioner‑centred and context‑specific, with active involvement of clinical leaders in design; training delivery should emphasise workflow integration and demonstrable clinical benefits.Future research should prospectively evaluate the implementation effectiveness of these recommendations and assess their impact on clinical outcomes, healthcare efficiency, and patient experience across Southern Italian regions. Longitudinal assessment of EHR adoption rates, quality metrics, cybersecurity incident rates, and workforce satisfaction should inform iterative refinement of the policy strategy.

 Data availability

No primary data were generated in this analysis. All data cited are from published peer-reviewed literature or publicly available policy reports from the Italian Ministry of Health, AGENAS, and SVIMEZ. Access information for specific datasets is provided within reference citations and institutional websites.

 References Ministero della Salute: Piano Nazionale di Ripresa e Resilienza - Missione 6: Salute. Rome: Governo Italiano;2021. Agenzia Nazionale per i Servizi Sanitari Regionali (AGENAS): Monitoraggio della Sanità Digitale nelle Regioni Italiane: Rapporto 2023. Rome: AGENAS;2023. Reference Source Campanella P Lovato E Marone C : The impact of electronic health records on healthcare quality: a systematic review and meta-analysis. Eur. J. Pub. Health. 2016;26(1):60–64. 10.1093/eurpub/ckv122 Kruse CS Stein A Thomas H : The use of electronic health records to support population health: a systematic review of the literature. J. Med. Syst. 2018;42(11):214. 30269237 10.1007/s10916-018-1075-6 PMC6182727 Ricciardi W Pita Barros P Bourek A : How to govern the digital transformation of health services. Eur. J. Pub. Health. 2019;29:7–12. 31738442 10.1093/eurpub/ckz165 PMC6859522 Bosch S Albiges-Soria L : Narrative policy research: approaches, methods, tools and applications for health systems research. Health Policy Plan. 2021;35(3):i4–i6. 33165579 10.1093/heapol/czaa105 PMC7649665 Damschroder LJ Aron DC Keith RE : Fostering implementation of health services research findings into practice: a consolidated framework for advancing implementation science. Implement. Sci. 2009;4:50. 19664226 10.1186/1748-5908-4-50 PMC2736161 Svimez: Rapporto SVIMEZ 2023 sull'economia del Mezzogiorno. Naples: Il Mulino;2023;9788815391896. Tarricone R Cucciniello M Armeni P : Digital health governance in Italy: the path towards integrated care. Health Policy. 2022;126(9):891–897. 10.1016/j.healthpol.2022.06.003 Mazzoleni MC Baiardini I Canonica GW : Digital health and eHealth literacy: the role of healthcare professionals. Eur Ann Allergy Clin Immunol. 2020;52(3):100–104. International Organization for Standardization: ISO 9001:2015 Quality management systems — Requirements. Geneva: ISO;2015. International Organization for Standardization: ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Geneva: ISO;2022.