The Italian Ministry of Health decree of 7 September 2023, published in the Official Gazette (Serie Generale) no. 249 of 24 October 2023, sets out the contents, architecture and access methods of the Electronic Health Record 2.0 (Fascicolo Sanitario Elettronico, FSE 2.0). The structure changes from the earlier model: between the system that produces a clinical document and the record, two software components now sit, the national Gateway built by Sogei and the regional Healthcare Data Ecosystem (Ecosistema Dati Sanitari, EDS).

Context

The FSE was established by Prime Ministerial Decree 178/2015, which created the National Interoperability Infrastructure (Infrastruttura Nazionale per l’Interoperabilità, INI) as a routing node between regional records. In that model each Region kept its own document repositories and INI acted as a federated index for cross-regional interoperability, following the Integrating the Healthcare Enterprise (IHE) Cross-Enterprise Document Sharing (XDS.b) and Cross-Community Access (XCA) profiles.

The 2015 model had two limits. On content, the record held almost only signed documents — reports, discharge letters — with no structured data that was easy to reprocess. On feeding, the requirement of patient consent both to feed and to consult left records almost empty. The Relaunch Decree (Decree-Law 34/2020, converted by Law 77/2020) introduced the FSE 2.0: it made feeding mandatory regardless of consent and set 19 May 2020 as the date from which documents are collected automatically.

Architecture

The 7 September 2023 decree keeps apart two functions that the 2015 model overlapped: publishing the document and collecting the data.

The Gateway is the national component, developed and run by Sogei, through which every publication operation passes. The technical documentation on developers.italia.it assigns it three tasks:

  • validation, syntactic and semantic, of the clinical document before publication, against XSD schemas and Schematron rules;
  • conversion of the incoming data into HL7 Fast Healthcare Interoperability Resources (FHIR) format for transmission to the EDS;
  • metadata preparation for the document to be transmitted to INI, which remains operational for indexing and cross-regional interoperability.

The EDS is the regional layer. The documentation describes it as the component that “collects, manages and makes the data available through REST services”. Unlike the document repository, the EDS holds structured data in FHIR format acquired directly from the producing systems, separate from the signed document published in the record.

FSE 2.0 content thus follows a dual track:

  • documents are produced as HL7 Clinical Document Architecture release 2 (CDA R2) and embedded in a digitally signed PDF, stored in the regional or facility repository;
  • data in FHIR format flows into the EDS, where it remains available as resources queryable over REST.

Interoperability between regional nodes and the national node follows the Interoperability Model (Modello di Interoperabilità, ModI) defined by AgID and the IHE profiles of the Italian affinity domain. The document “Technical specifications for interoperability between regional FSE systems — Affinity Domain Italia”, in version 2.5 of 12 December 2023, lists the applicable profiles: XDS.b for intra-domain document sharing, XCA for cross-domain queries, Audit Trail and Node Authentication (ATNA) for access tracing.

The critical point

With mandatory validation at the Gateway, the conformance check moves upstream of every publication: it used to be distributed across the nodes and effectively optional. In the 2015 INI model a regional repository could publish malformed CDA documents without a central node systematically rejecting them: the index merely recorded the metadata. With the Gateway, a document that does not pass syntactic and semantic validation is not published.

The cost of compliance thus falls onto the producing systems. Hospital electronic health record vendors and general practitioners’ management software must ensure that every CDA R2 they produce conforms to the published schemas and Schematron rules, and at the same time that the data can be expressed in FHIR to feed the EDS. The operational sequence described in regional documents is clear-cut: validation of the document at the Gateway, the healthcare operator’s digital signature, transmission of the signed document to the repository, preparation of the metadata towards INI. An error at the first step blocks every subsequent one.

In practice the quality of the FSE 2.0 depends not on the central infrastructure but on the ability of peripheral systems to produce conformant artefacts. It is a software-compliance bottleneck spread across many heterogeneous actors, with contract renewal cycles staggered over several years.

Implications

The consent model has been redrawn. The decree separates feeding, mandatory by law for care purposes, from consultation, which remains tied to the patient’s consent. The patient keeps the right to obscure individual documents and to consult the access log.

Retroactive feeding required a dedicated objection mechanism. The interministerial decree of 11 April 2024 governed the objection to the automatic uploading of historical data: for documents produced before 19 May 2020, patients could object through an online service open from 22 April to 30 June 2024. Without an objection, the available historical data was uploaded automatically into the records of active patients.

The Data Protection Authority (Garante per la protezione dei dati personali) kept an active role. In its opinion of 21 December 2023 it ruled on the information-notice template prepared by the Ministry. During 2024 it opened proceedings against 18 Regions and 2 autonomous provinces that had altered the national information-notice template, finding that some patient rights and some security measures were not guaranteed uniformly across the country. The Authority’s measures on the FSE 2.0 continued into September 2024.

Limits

As of September 2024 the state of rollout is uneven. Some Regions adopted the FSE 2.0 in “bundle light” mode, using the Gateway and Regional Archival Unit components made available by Sogei on central infrastructure under a subsidiarity arrangement; others work with their own infrastructure. The technical integration specifications and feeding rules kept changing through 2024, a sign that the interface between periphery and centre has not yet settled.

Structured FHIR data coexists with the signed CDA R2 document: the decree does not replace the document model, it adds a data track alongside it. How much of the record will actually be queryable as structured data — and not merely consultable as a signed PDF — depends on how ready the producing systems are to express clinical content in FHIR, and at this date the work is still under way. The European framework on the health data space, under discussion at EU level, will bring primary- and secondary-use obligations that bear on this design and will require subsequent national transposition.

Cover image: Facade of the historic Italian Ministry of Health building on Lungotevere Ripa in Rome’s Trastevere district — photo by User:Mattes, CC BY-SA (cc-by-sa-1.0+, multilicenza 1.0/2.0/2.5/3.0/4.0) — https://commons.wikimedia.org/wiki/File:Italian_Ministry_of_Health,_Rome_(Travestere).jpg