On 20 October 2026, at the IGF Poland 2026 Digital Summit in Bydgoszcz (Senate Hall), Healthcare Poland Foundation led the session “Digital Shield for Health” („Cyfrowa tarcza zdrowia”). The question we put to the panel: how do the protection and governance of patient data build the sovereignty and security of the state? Below we set out the systemic conclusions the Foundation draws from the discussion — and how they connect with Poland joining Digital Commons EDIC.
The panel
- Robert Kroplewski, attorney-at-law (moderator) — Poliversum Foundation, SAIL, Healthcare Poland Foundation
- Michał P. Dybowski — President of the Management Board, Healthcare Poland Foundation
- Prof. Przemysław Biecek — Director of the Centre for Trustworthy AI, Warsaw University of Technology and University of Warsaw
- Prof. Piotr Senkus — University for Peace (UN Mandate), Healthcare Poland Foundation
- Piotr Welenc — Director of the Quality and Audit Department, Healthcare Poland Foundation
- Ewelina Bogiel — Head of Legal & Compliance, Healthcare Poland Foundation
Starting point: patient data are critical infrastructure
Patient data are not merely an administrative resource. Continuity of care, citizens’ trust and the resilience of the health system in a crisis depend on their integrity, availability and accountable processing. Digital sovereignty begins where the state retains control over the data that describe its citizens’ health — and where artificial intelligence serves the patient instead of treating them only as an object of processing.
What the discussion revealed
Questions from the audience showed that we still need a calm, concrete conversation about the European Health Data Space (EHDS). It is not clear to everyone what EHDS is, what it is for, and how projects such as HeliX respond to it.
The most important misunderstanding: sharing medical data is sometimes equated with data “circulating freely on the internet”. In fact, secondary use under EHDS is to be based on defined purposes, permits and secure processing environments. Enabling analysis of data does not mean handing anyone patient records to download and use at will.
In HeliX (Horizon Europe), in which Healthcare Poland participates, we answer this with a simple principle: the data stay, the AI travels. Federated learning brings computation to data that remain in healthcare facilities. Model updates are exchanged; source data remain under the control of the institutions that hold them. Federation does not remove the need for safeguards — access control and protection against information leaking through the model updates themselves are still required — but it genuinely limits copying and exposure of data.
Context: Poland joins Digital Commons EDIC
Four days before the panel, on 16 October 2026, the Assembly of Members of Digital Commons EDIC endorsed Poland’s application. From 1 January 2027 Poland will be a full member of the European consortium that jointly develops and maintains open technologies for the public sector, represented by the Ministry of Digital Affairs. We described what this may mean for hospitals in a separate article. The panel showed why the two topics belong together: trust in the use of health data is built on architecture that can be verified.
Systemic conclusions
1. Transparency of data flows as a standard
For every system that uses health data we should be able to state simply: where the data stay, who may run computations on them, what leaves the facility, and who is accountable. This should become the standard of communication with patients, physicians and regulators — not an exception.
2. Federated architecture as the default for secondary use
Where the goal is research, innovation or AI training, the default question should be whether the computation can be brought to the data rather than the data to the computation. The “data stay, AI travels” principle limits risk — provided it is accompanied by assessment of the specific architecture, information flows and safeguards.
3. Openness as a condition of trust and resilience
Code that can be reviewed, shared standards and transparent rules make it possible to verify how a system treats patient data. Digital commons — some technologies built once, jointly and openly — reduce vendor lock-in and the cost of interoperability, and give smaller hospitals access to security they could not afford alone. We believe healthcare should be one of the areas of Poland’s participation in Digital Commons EDIC.
4. Openness does not exempt from regulation
An open solution must meet the same requirements as any other: integration with the national P1 platform, the National Cybersecurity System Act and NIS2, the GDPR, EHDS requirements for electronic health record systems, the Medical Devices Regulation where software qualifies as a medical device, and the AI Act. Compliance must be designed in from the start, not added at the end.
5. A commons needs a licence and governance
Without an open licence (for example the EUPL), transparent governance and a clear model for maintenance and accountability, an “open” system remains one organisation’s product, not a common good. These elements must be settled before a solution is proposed as part of a shared portfolio.
6. Proportionate tools: sandboxes, quality standards, audit
Building the digital shield requires instruments proportionate to risk: regulatory sandboxes for AI in healthcare, quality and audit standards, and clear legal accountability — always with respect for the patient as a subject, not an object of processing.
7. Hospitals at the centre
Shared solutions only make sense if they answer real needs of healthcare providers. Together with the Polish Hospital Federation we want member hospitals to define the requirements, take part in pilots and benefit first from European cooperation.
What we propose
- A working note to the Ministry of Digital Affairs and the Ministry of Health on healthcare as a domain of Poland’s participation in Digital Commons EDIC, prepared together with the Polish Hospital Federation, with a proposal for a working meeting.
- Plain-language educational materials on EHDS and the secondary use of health data, for hospital managers, physicians and patients.
- Sharing HeliX experience on federated AI as a practical example of “data stay, AI travels”.
We thank the panellists and Robert Kroplewski for moderating and steering the discussion despite technical difficulties, and the IGF Poland Secretariat at the Ministry of Digital Affairs for including our session in the programme.
The conclusions are the Foundation’s summary of the discussion and do not attribute specific views to individual panellists. This article expresses the position of Healthcare Poland Foundation and is not a statement of the Ministry of Digital Affairs, the Ministry of Health or Digital Commons EDIC. As of 21 October 2026.
Healthcare Poland Foundation | Polish Hospital Federation
