Operationalising ethics in secondary health-data use: an operator-focused framework for normative governance with audit and performance metrics

Background Operators of health data hubs and registries enable secondary use by implementing consent processes, privacy safeguards, access governance, data quality management, transparency, and stakeholder engagement. Ethical guidance is extensive, yet it rarely specifies operator-level practices or indicators that show whether governance performs well in routine use. This paper proposes an operator-focused framework that makes ethics implementable and assessable. Methods The framework synthesises international guidance, systematic reviews and other empirical work on governance gaps, and publicly available governance materials from major data infrastructures. Ethics practices were selected for conceptual distinctness and operator-level controllability, grouped into seven governance domains, and aligned with a PDCA (Plan–Do–Check–Act) cycle. For each practice, the framework provides illustrative audit items, descriptive metrics, and outcome indicators intended as adaptable references rather than prescriptive standards. Results Seven domains are covered: Informed Consent & Information, Privacy & Data Protection, Data Quality, Use & Access Governance, Incidental Findings, Stakeholder Engagement, and Project-Level Transparency. Each domain contains four PDCA-aligned practices with linked evaluation items. Discussion The framework shifts practical bioethics for secondary use from policy existence to demonstrable performance. It can support operator self-audit and proportionate oversight by funders, ethics committees, and stakeholder bodies, while remaining modular across legal and infrastructural contexts. It also provides a starting point for developing minimal, transparent reporting expectations to support trust-building governance.