This article was originally published by Research Money on May 27, 2026. See the original article here.
—
For years, the primary question about Canadian health data has been: where should it live?
This is because too much of Canada’s digital infrastructure depended on systems, servers and services outside the country. In response, governments, health authorities and other organizations focused on data residency have taken steps to ensure that sensitive data, including health data, is stored on servers located in Canada.
That matters. Canadians have good reason to expect that their most sensitive personal information should not cross borders or sit outside Canadian legal and institutional safeguards, especially without their consent.
But with progress on this front, data residency is quickly becoming yesterday’s problem. The questions now are who controls health data, who can access it, under what legal conditions and, vitally, who benefits from the economic value it creates?
Modern health systems need cloud capacity, interoperability, cybersecurity expertise, analytics platforms and AI-ready infrastructure. Companies such as Amazon Web Services, Microsoft, Google, Oracle, Epic and others are providing solutions to these challenges.
The issue is that these are overwhelmingly foreign-controlled companies. Even when data is stored in Canada, the infrastructure, software layers, administrative systems, technical standards and contractual relationships are often still shaped by firms headquartered elsewhere.
For many years, Canada’s deep reliance on U.S.-controlled digital infrastructure felt like a safe background condition. The Canada-U.S. relationship was stable enough that this dependence was treated mainly as a procurement solution, not a sovereignty issue. That assumption now deserves a second look.
The federal government already recognizes the distinction. Its work on public cloud and digital sovereignty separates data residency from data sovereignty and security. In simple terms, having data stored in Canada answers the “where” question. It does not fully answer the “who controls it” and “who benefits” questions.
A fragmented system, a shared responsibility
Canada is not starting from zero. For example, the Pan-Canadian Health Data Strategy set out the need for stronger governance, interoperability, standards, data literacy and public trust. Canada Health Infoway has advanced a shared pan-Canadian interoperability roadmap.
The Canadian Institute for Health Information has developed work on health data stewardship. And the federal government has introduced the Connected Care for Canadians Act, now before Parliament as Bill S-5, which aims to improve interoperability and prohibit data blocking by health information technology vendors.
That bill is especially timely. Canada is actively debating how health data should move more easily and securely across the health system. But if health data is going to become more interoperable and support AI-enabled care and research, then the infrastructure underneath it matters even more.
The provincial picture makes this more complicated. Canada does not have one health-data system. It has many.
Ontario has relatively mature data assets and provincial digital-health standards, including Ontario Health’s Digital Health Information Exchange framework and the long-standing role of the Institute for Clinical Evaluative Sciences in linking and analyzing health administrative data. Quebec is moving through major legal and institutional reforms, including its Act respecting health and social services information, Santé Québec and the Dossier santé numérique.
Alberta may be the strongest clinical centralization case, with Connect Care described by Alberta Health Services as its provincial electronic health record. British Columbia, by contrast, remains more decentralized across health authorities and systems, even as it develops cloud-enabled data tools and analytics infrastructure.
These differences matter. But the sovereignty question cuts across all of them. A centralized system can still depend on foreign-controlled platforms. A decentralized system can still become cloud-enabled. Provincial variation does not remove the underlying issue: Canada is modernizing health data through infrastructure that may not be fully under Canadian control.
Lessons from abroad
Other countries are already confronting this more directly.
France is the clearest example. Its national Health Data Hub was originally hosted on Microsoft Azure, a decision that generated years of controversy over whether sensitive health data could be considered sovereign if the underlying cloud provider was subject to U.S. legal and operational control.
In April 2026, France selected Scaleway, a French cloud provider owned by Iliad, to replace Microsoft Azure as the host of the Health Data Hub. The move was framed as part of a broader European push for cloud sovereignty and reduced dependence on U.S. technology firms.
France did not reject cloud computing. It rejected complacency about the terms on which cloud computing is used for sensitive public data.
Other examples point in the same direction. The European Commission has pursued cloud contracts with European providers under sovereignty-oriented conditions. The Dutch parliament has called for reduced dependence on U.S. cloud and software providers.
Germany has seen sovereign-cloud initiatives in the health sector. Denmark and other European jurisdictions are also rethinking dependence on foreign digital platforms.
These examples vary in scale, but they show that several countries are beginning to treat digital infrastructure as a question of sovereignty, security and industrial capacity, not just IT procurement.
Canada should do the same.
Where Canada should go from here
The next stage of Canada’s health-data agenda should add a sovereignty and economic-development layer to the work already underway. That means three practical steps.
First, Canada should make health data procurement sovereignty-aware. Procurement should not only ask if data will be stored in Canada. It should also ask whether Canadian institutions can audit the system and whether the contract builds domestic capacity or deepens dependence.
Second, Canada should increase Canadian-controlled data stewardship and administration capacity. Canadian public institutions, trusted intermediaries and companies should be able to manage sensitive health-data environments in ways that are secure, ethical, auditable and aligned with the public interest.
Third, Canada should treat health data as critical infrastructure and an economic-development opportunity. Health data is not just an input into better care. It is also an input into AI, life sciences, diagnostics, public-health planning, research and innovation. If Canada can build a reputation for responsible, secure and AI-ready health-data governance, it could support domestic companies and create an international advantage around trusted data stewardship.
That economic-development angle matters. Canada should not be content to pay foreign firms to administer the infrastructure around one of its most valuable public data assets; it should use this moment to build domestic capacity, strengthen public control and ensure that more of the value created from health data benefits Canadians.
Done well, Canada could build companies and institutions that help other countries manage sensitive data responsibly – burnishing Canada’s international brand as a stable, trusted and ethically minded partner.
The goal is not digital nationalism for its own sake. Nor is it to pretend Canada can or should build everything alone. The goal is strategic maturity.
Canada has already begun the work of making health data more connected, useful and accessible. The next challenge is to ensure that this modernization also strengthens sovereignty, safety and public value.
Canada has taken critical steps to address the data residency challenge. But getting the next questions right – who controls the data and who benefits from it – will determine what kind of digital nation Canada becomes.
