Operationalising ethics in secondary health-data use: an operator-focused framework for normative governance with audit and performance metrics

Normative governance: an underdefined field

The maturity of ethics practices varies considerably. Some areas, such as privacy or data quality, are guided by extensive privacy standards (GDPR, HIPAA, ISO 27701) and by well-established data-quality frameworks (FAIR principles, Kahn et al. dimensions).^3,4 Others, such as consent models, access governance, or stakeholder engagement, remain heterogeneous, under-institutionalized, and difficult to evaluate. Although central to trust and accountability in data infrastructures, these practices are rarely treated as a coherent field with shared structures, expectations, or evaluative tools.

The missing piece: a framework for mapping and evaluation

What is still lacking is a structured approach to describe, organize, and assess these ethics practices. Unlike technical domains such as data architecture or cost allocation, which are supported by specialized toolkits and professional norms, normative governance remains fragmented. No widely accepted model captures the full range of ethics practices, their connection to ethical values, or the means by which their implementation can be evaluated.

This paper proposes a framework that addresses this gap in two ways: first, by categorizing ethics practices across key governance domains (e.g. consent, data protection, access control); second, by linking each domain to relevant audit questions and evaluation criteria. The framework is not a prescriptive checklist but an orientation tool, intended to support operators in adapting, combining, or omitting elements based on their institutional context.

Positioning within the landscape of existing ethics guidance

Numerous bioethics contributions, international statements and best-practice guidelines have laid out the ethical principles for secondary data use. A systematic review of principles and norms in this area by Kalkman et al. synthesized four stable value clusters: (i) societal benefit & public value, (ii) respect for persons, (iii) fairness & data justice, and (iv) public trust & engagement.⁵ These value clusters are echoed in reviews of patient and public attitudes^6,7 and in principle-oriented guidance such as the WMA Declaration of Taipei,⁸ the OECD Recommendation on Health Data Governance⁹ and the CIOMS International Ethical Guidelines.¹⁰

Practice-oriented documents go a step further. The ISBER Best Practices¹¹ or the WHO policy and implementation guide on health-data reuse¹² provide detailed operational recommendations on biospecimen handling, data security, access procedures and quality control. Similarly, frameworks such as the UK Biobank Ethics & Governance Framework,^13,14 the All of Us Data-Access Framework¹⁵ and the GA4GH Framework for Responsible Sharing of Genomic and Health-Related Data¹⁶ set concrete standards for consent, privacy or tiered access. However, each addresses only selected ethics-practice domains and rarely embeds evaluation metrics.

As a result, even the more detailed best-practice documents offer valuable guidance but do not yet provide an integrative, evaluable framework for ethics practices as a field in its own right.

Conceptual orientation

The goal was to construct an operator-focused framework that couples widely accepted ethical values to actionable practices and a lean but meaningful evaluation tier.

Knowledge inputs and scope

Six knowledge streams informed the design:

Practice selection

Source documents were scanned for recurring but distinct ethics practices such as consent, data protection or stakeholder engagement. Candidate practices were retained if they met two filters:

Each governance domain was then structured into four PDCA (Plan–Do–Check–Act)-aligned activities to reflect the dual goal of implementation and evaluation⁴²:

The list of ethics practices across the PDCA structure is deliberately illustrative, not comprehensive. An all-inclusive catalogue would be unmanageable, ignore context-specific tailoring and age rapidly. The framework therefore provides anchor practices in each domain—enough to guide gap analysis and stakeholder dialogue, while leaving space for operators to add, refine or merge practices as required.

Evaluation layer

For every ethics practice, the framework specifies:

Plausibility check

To verify the completeness and real-world applicability of the resulting list of ethics practices, the following plausibility checks were conducted. In a practice-guideline triangulation the list was cross-matched with five benchmark guidelines for secondary health-data use, namely.^8–12 In a real-world implementation scan the practices were mapped to governance artefacts from five well-documented platforms (UK Biobank, All of Us, PCORnet, German MII, GA4GH) and to 51 European patient registries reviewed by van den Akker et al.²⁵

Overview of the three-layer framework

The framework translates four aspirational norms into illustrative ethics practices across seven governance domains ( Table 1) and couples each practice to evaluation items ( Table 2). Practices are organised along the Plan–Do–Check–Act (PDCA) logic, labelled Norm-Setting, Operational, Assurance and, where applicable, Improvement.

Seven domains proved sufficient when tested against the contents of multiple international guidance documents and governance artefacts from five major data platforms and 33 registries. No further domain emerged, indicating a breadth that is “complete enough to start a gap analysis” yet concise.

Ethics practices

Each domain includes four action-oriented, conceptually distinct practices (one per PDCA step). The domains and examples are as follows:

The practices are illustrative, not exhaustive. They are intended to provide a shared vocabulary and structure, while enabling tailoring or merging in line with platform scope, objectives and resources.

Special context for Privacy & Data Protection and Data Quality

For Privacy & Data Protection and Data Quality these examples are deliberately concise, because detailed operational playbooks already exist e.g. GDPR and ISO 27701 for privacy safeguards; the Kahn data-quality dimensions together with FAIR and further guides for profiling and validation.

In the other five domains, Informed Consent & Information, Use & Access Governance, Incidental-Finding Management, Patient & Stakeholder Engagement, and Project-Level Transparency, no universally adopted standards are available. The framework therefore offers additional illustrative examples to help operators translate abstract norms into actionable and auditable tasks.

Division of labour between operators and data users

Not all practices must be executed by the operator’s internal staff. In domains such as incidental findings or project-level transparency, tasks may be i) handled centrally by the operator, ii) delegated to researchers, or iii) executed via a hybrid model, where researchers must follow operator-defined standards and report back.

The framework includes practices that the operator can mandate, monitor or audit, even when operational execution is partly decentralised. Whether platforms opt for centralised, decentralised or hybrid models will depend on legal, scientific and logistical context. In all cases, operators should retain oversight to ensure that the aspirational norms are met.

Evaluation items

Table 2 links each ethics practice to three evaluation items:

Currently, most platforms satisfy only the audit item: they can point to a policy or SOP, but descriptive and especially outcome metrics are still uncommon. Consent materials are seldom comprehension-tested, IF workflows rarely audited, and stakeholder engagement rarely evaluated for satisfaction or perceived impact. The proposed structure aims to shift normative governance culture from “existence” to “performance.”

Plausibility results

The list of ethics practices was cross-matched with five benchmark guidelines (ISBER 2023, WHO 2022, OECD 2022, CIOMS 2016, WMA 2016). All seven governance domains appeared at least once across the set, no additional domain emerged. Coverage, however, was uneven: domains such as Informed Consent & Information and Privacy & Data Protection were present (and often detailed) in every guideline, whereas Stakeholder Engagement and Incidental-Finding Management were mentioned in only two or three, typically at a high level.

A real-world scan linked the seven domains to governance artefacts from UK Biobank, All of Us, PCORnet, GA4GH, and the German MII. Each domain had at least one concrete implementation artefact (policy, template, SOP), demonstrating that every practice on the list is in active use somewhere in the field.

The registry review by van den Akker et al. (2024) analysed 51 European patient registries. Again, every domain surfaced at least once, yet implementation was highly variable. For example, only 1 of 20 consent/information forms (5%) described a procedure for incidental findings, and fewer than one-third of registries detailed how data were anonymised or pseudonymised. These findings confirm the framework’s completeness while illustrating the heterogeneity it is meant to address.

From value to verifiability

Current guidance for biobanks and data platforms, such as the WMA Declaration of Taipei,⁸ typically stops at high-level imperatives such as “ensure consent” or “justify data access,” without indicating which concrete ethics practices are required or how performance should be judged. Checklists such as the ISBER Best Practices go further,¹¹ but they rarely span all seven domains identified here and seldom distinguish between the mere existence of a document and the effectiveness of its implementation. By pairing each practice with audit items and performance metrics, the present framework fills this gap. Its breadth is intentional but lean: complete enough to initiate internal gap analysis, yet not so prescriptive that initiatives are paralyzed by dozens of indicators.

The framework moves governance from a trust-based logic of presumed compliance to an audit-informed logic that demands not only written policies but also evidence of their real-world performance.

Contextual adaptability and scalable use

A key feature of the framework is its modularity. It allows differentiated use across stakeholder groups, from self-assessment by operators to oversight by funders or advocacy by civil society actors. Equally important, it is scalable: the domains and practices are structured in a way that applies to small-scale registries as well as national or multi-jurisdictional platforms. Its illustrative nature enables context-sensitive specification. Operators are not expected to implement every practice identically, but to transparently justify how they adapt the framework to their operational, legal, and social environment.

Such justification may take two forms: a positive specification (e.g. “we implement X by doing Y”) or an explicit non-adoption with rationale (e.g. “this domain is not relevant because our data are fully anonymised” or “this metric is currently infeasible but under development”). This practice of context-based declaration makes the framework practical and normatively accountable at once.

From policies to performance

As the plausibility check showed, most large data platforms (e.g. UK Biobank, All of Us, PCORnet,) and many patient registries already satisfy the audit layer by publishing policies or SOPs that cover at least some of the seven ethics-practice domains. Publicly disclosed descriptive or outcome metrics, however, remain rare.

The framework draws attention to this blind spot. Tracking consent comprehension, veto-based access rejections, or IF follow-up adds workload, but these data are essential for demonstrating respect, fairness, and public value in practice. Future work should therefore develop lightweight tooling for routine metric collection and explore how external stakeholders (ethics committees, funders, patient groups) can access and interpret such data without over-burdening operators.

Although systematic evaluation remains the exception, published case studies show that it is feasible. Zenker et al. report on broad consent uptake across 27 university hospitals participating in the German Medical Informatics Initiative (MII), providing implementation-level insights into consent processes at scale.⁴³ While substantial variation in consent rates across sites was observed, the authors emphasize that interpretation remains difficult due to inconsistent definitions and documentation standards. Fischer-Rosinsky et al. complement these findings with detailed uptake data from four emergency departments⁴⁴: among 1,138 approached patients, only 28% ultimately consented, while over 40% declined or could not complete the process, often due to contextual or situational factors. These studies illustrate that capturing consent dynamics is feasible, but depends on clear procedural standards and routine monitoring. Bossert et al. used participatory feedback and cognitive interviews to iteratively revise a broad consent form.⁴⁵ While no quantitative comprehension testing was reported, patient feedback led to substantial revisions across three document versions.

These case examples for the domain “Consent&Information” show that descriptive and outcome metrics can be embedded into routine operations or implemented by independent third parties. Beyond consent, recent audits illustrate how further ethics practices can be assessed in practice. A pan-European survey of 41 health-data hubs showed that 83% apply some form of data-quality control and 65% report anonymisation procedures, but only about half publish Data-Access or Data-Processing Agreements, and fewer still enforce minimum quality thresholds before ingesting data.¹ The cross-sectional audit of 51 European patient registries showed that although 31 (61%) claimed to have a use-and-access policy, only 17 made the full document publicly available and just four explicitly prohibited re-identification.²⁵

Relation to adjacent ethics domains

While this framework centers on operator-level governance of health data infrastructures, it intersects with adjacent ethics discourses that warrant distinction. One such discourse concerns Learning Health Care Systems (LHCS). These systems depend on many of the same infrastructures and may presuppose several of the ethics practices addressed here. However, LHCS ethics typically focus on downstream questions at the point of care or project level, such as minimal-risk research without explicit consent, point-of-care randomisation, or obligations to implement findings.^46,47 In contrast, the present framework addresses upstream responsibilities: the governance of data access, protection, and provisioning that enables such learning activities in the first place.

A parallel situation arises with AI ethics. Much AI development, especially in medical contexts, relies on access to large, well-governed datasets managed by health data platforms. Yet AI ethics debates often focus on downstream issues such as algorithmic explainability, fairness, or accountability.^48,49 These are important but distinct from the operator-level responsibilities that determine whether and how data become available for AI development at all.

While this framework does not seek to resolve domain-specific concerns in LHCS or AI ethics, it may help clarify what responsible infrastructure entails in practice, especially where operator decisions shape the scope, quality, and legitimacy of downstream research and innovation.

Strengths, limitations, and future directions

A strength of the framework lies in its integrative structure: it brings together ethical concepts, normative considerations, and insights from existing governance materials across multiple health data platforms. Rather than proposing a fixed model, it offers adaptable components that can be aligned with different institutional contexts and levels of maturity.

At the same time, several limitations apply. First, the proposed metrics are illustrative: they have not been broadly discussed or endorsed across the data governance community, and no shared standards exist regarding their use, relevance, or thresholds. Routine data collection for many domains, such as consent comprehension, veto-based access rejections, or incidental finding follow-up, remains rare. Implementation will therefore require context-sensitive prioritization and negotiation of feasibility.

Second, while the framework is grounded in a broad range of conceptual and documentary sources, it does not result from a systematic or exhaustive scan of all existing platforms and policies. Rather, it reflects a structured synthesis of operator-level responsibilities, developed through iterative comparison with international ethics guidance and governance practices. While the seven domains are intended to offer a comprehensive account of ethically relevant tasks at the infrastructure level, future work may test their completeness and applicability across additional settings.

Building on these limitations, two lines of inquiry suggest themselves. First, adaptation studies at platform level could explore how the framework is interpreted and specified in different legal, infrastructural, and ethical environments, and what rationales are offered for adaptation, postponement, or omission. Second, indicator research should refine and test proposed metrics, distinguishing between norm-referenced targets and descriptive monitors. Consensus-building methods may help establish minimal reporting standards, including metadata on evidentiary strength and resource requirements.