How will Costa Rica regulate data exchange between public, private and mixed health providers without creating a central database of patient records?
A national framework for connecting separate systems
Costa Rica’s new regulation establishes the Modelo Nacional de Interoperabilidad en Salud, a framework for public, private and mixed health providers to exchange relevant patient information securely and in a standardised way. The stated aims include continuity of care and reducing unjustified duplication of records, tests, procedures and administrative steps. Participation is voluntary, and the decree does not mean that providers become connected immediately. The Ministry of Health must publish the model’s initial technical specifications and a progressive implementation plan within five months. That plan will set the stages, participating provider categories, deadlines and conditions for joining.
Federated architecture leaves implementation with providers
The model uses a federated architecture: each provider remains responsible for its own technology infrastructure and for safeguarding the data under its control, while participating systems can exchange information without placing clinical files in a central repository. Shared components may support identification, authentication, information discovery and auditing, provided they do not persistently store clinical information. The Ministry of Health will oversee the model and coordinate digital architecture, technical interoperability and cybersecurity matters with Micitt, but the decree does not require either ministry to develop, finance, contract, host or maintain each provider’s infrastructure. Providers joining the model must fund and organise their own adjustments.
Interoperability does not create a free-standing right to use data
The regulation states that connecting systems is not, by itself, permission to access, use, share or otherwise process health information. Providers must rely on informed consent or another valid legal basis, with limited exceptions under legislation and emergencies where strictly necessary information is needed to protect a patient’s life or health. Access in such an emergency must be recorded for later review. Providers must also maintain data quality and traceability, control access, prepare for incidents and oversee their technology suppliers. Contracts with vendors that host, process, store or transmit health data must specify purposes, confidentiality, security, incident responsibilities and, where relevant, subcontracting, data location, audits and migration when the service ends.
IN NUMBERS
The decree took effect when it appeared on 16 October and repeals the 2016 regulation on health-data standards. Its practical effect will depend on the implementation plan and technical specifications still to be issued. Existing interoperability processes must be adjusted to the new model within the period set by that plan, while the voluntary route does not remove legal duties to provide or notify information.
Reported from elfinancierocr.com, 2026-10-19. The Tender Wire is published by Otnox.
