Confidential Computing in Healthcare: Secure Processing of Sensitive Data

Healthcare organisations face the challenge of advancing digitalisation while meeting strict legal protection requirements and creating secure environments and data spaces for information processing.

‍

Health data is increasingly processed outside local hospital IT or insurance databases: clinical applications connect to cloud services, AI systems analyse sensitive patient or insurance data, and research projects combine information from multiple institutions. This increases both the number of parties an organisation has to trust and the number of environments it needs to control.
‍

Confidential Computing provides this control in external infrastructures by extending encryption to data while it is being processed. This allows organisations to use external computing resources without automatically giving the infrastructure operator access to medical plaintext data. This development in cryptographic protection enables new cloud and AI scenarios, creating opportunities for greater efficiency and new insights in patient care, research and health policy.
‍

‍

Why is conventional encryption not enough for health data?
‍

Conventional encryption protects data at rest and in transit. While an application – such as an AI model – processes the data, however, it is “in use” and typically available in plaintext in memory. Infrastructure operators and their administrators can access this exposed data through elevated system privileges. The same applies to external attackers who compromise the system. Confidential Computing addresses this security gap.
‍

‍

What is Confidential Computing?
‍

Confidential Computing protects data in use by processing it inside hardware-based, encrypted Trusted Execution Environments (TEEs). Software-based access from outside the protected environment is effectively blocked. The integrity of the execution environment can be technically verified through Remote Attestation, which provides cryptographic evidence of its state. Data and keys can then be released selectively.
‍

For a more detailed explanation, see our introductory article on Confidential Computing.
‍

‍

What are the main use cases for Confidential Computing in healthcare?
‍

Typical scenarios include AI-based processing of medical data, cross-organisational collaboration and secure cloud migrations. Confidential Computing is therefore worth considering whenever health data is processed in external or shared infrastructure and the infrastructure operator must be prevented from accessing it.
‍

The following sections take a closer look at the key use cases.
‍

‍

Confidential AI for medical data and models
‍

The potential of AI in healthcare is substantial, but so are the associated data-security risks. In healthcare AI, both the input data and the model itself may require protection. Confidential AI makes it possible to run models confidentially inside a TEE while keeping the data protected during processing. Inference takes place inside the isolated environment. This approach is primarily suited to proprietary models operated by the organisation itself and to open-weight and open-source models.
‍

Large proprietary models that are available only via an external API are different: their model weights and runtime environment remain under the control of the provider. When such models are used, a GenAI firewall is an appropriate option. Before data is sent to the external service, the firewall filters and pseudonymises sensitive prompt data inside a TEE. This keeps the pseudonymisation process protected throughout. The output is then enriched again with the previously replaced information inside the TEE.
‍

Learn more about Confidential AI
‍

‍

Cross-organisational collaboration in secure data spaces
‍

Research projects and medical collaborations as well as health policy analyses often depend on external data from multiple sources. At the same time, the organisations providing that data must ensure its confidentiality throughout the process.
‍

Data spaces allow multiple organisations to use health data under a shared set of rules. Confidential Computing adds a protected processing layer to the governance and access controls that define such environments.
‍

In practice, data from several hospitals and research institutions – or from insurers and public health authorities – can be pooled and analysed inside a TEE, and only the result of the analysis is released. None of the participating organisations or infrastructure providers can see the raw data in plaintext, preserving confidentiality throughout the process.
‍

‍

Sovereign cloud use and controlled migration
‍

Many healthcare organisations are modernising their IT environments step by step, moving more workloads to the cloud or adopting cloud-based services. For highly sensitive data, however, contractual assurances from a provider may not always be sufficient.
‍

Where the possibility of operator access has previously prevented a migration, Confidential Computing can make cloud adoption viable by protecting data inside TEEs against privileged access. This requires the organisation to retain control over its own encryption keys. It therefore becomes possible to benefit from high-performance cloud infrastructure and ecosystems while implementing effective technical controls that strengthen digital sovereignty.
‍

Another relevant use case is moving applications to the cloud without adapting their architecture or code. These “lift-and-shift” migrations can suffer from performance issues or outages when the existing on-premises environment differs too much from the target cloud infrastructure. A dedicated TEE, by contrast, can be configured with characteristics that closely match the original environment, allowing the migration to be tested with lower risk.
‍

‍

The same technical controls that enable these use cases also support requirements found across different regulations in healthcare.
‍

‍

How does Confidential Computing support regulatory requirements?
‍

Confidential Computing supports security objectives found across a range of data protection and cybersecurity frameworks by encrypting data in use, restricting privileged access, using attested workloads and controlling the release of cryptographic keys.
‍

The most relevant frameworks include:
‍

GDPR and EHDS: Data protection and controlled data use
‍

Under Article 9 of the GDPR, health data is classified as a special category of personal data. The GDPR requires risk-appropriate technical and organisational measures as well as evidence that personal data is processed in accordance with the regulation. Confidential Computing extends existing encryption to data in use and can therefore restrict access from the infrastructure and administration layers. Attestation also provides evidence about the integrity of the environment in which information is processed.
‍

For secondary use, the European Health Data Space requires health data to be accessed and processed in secure processing environments. These environments must restrict access to authorised persons, minimise the risk of unauthorised reading, copying, modification or removal of data, and maintain identifiable logs of access and activity. Encrypted and attested TEEs that release keys and data only to verified workloads can support these controls and enable confidential data spaces.
‍

‍

gematik HCC, BSI C5 and BSI TR-03161: Technical guidance for manufacturers, providers and operators
‍

The gematik is Germany’s National Digital Health Agency and responsible for the country’s telematics infrastructure (“Telematikinfrastruktur”). gematik’s HCC (Healthcare Confidential Computing) specification draft states that, from a data-protection perspective, Confidential Computing is a mandatory prerequisite for outsourced processing of personal medical plaintext data in the Telematikinfrastruktur. The draft specifies Confidential Virtual Machines, Remote Attestation and a cryptographic trust domain (HCC Trust Domain) to which only verified workloads are admitted.
‍

For HCC providers, the draft includes a BSI C5 Type 2 report among its requirements. The current version of C5 explicitly addresses Confidential Computing, including the different trust levels of remote attestation. BSI TR-03161 complements this framework with security requirements for healthcare applications. Part 3 covers backend systems and includes requirements relating to authorisation, security logging, key management and the protection of sensitive data. Together, the three frameworks address secure data processing, cloud security and application security.
‍

‍

NIS2 and the German BSIG: Strengthening cyber resilience
‍

NIS2 and the German BSIG address information security at organisational level. Healthcare entities within scope are required to manage risks systematically, handle security incidents and strengthen the resilience of their systems and supply chains. Within this framework, Confidential Computing can serve as a security measure for sensitive cloud workloads.
‍

‍

AI Act, MDR, IVDR and MDCG guidance: AI and other digital medical devices
‍

The EU AI Act may also apply to AI-based healthcare applications. If software – whether AI-based or not – qualifies as a medical device or in vitro diagnostic medical device because of its intended purpose, the MDR or IVDR also applies.
‍

MDCG 2019-16 Rev.1, Guidance on Cybersecurity for medical devices, further details the cybersecurity requirements under the MDR and IVDR. It identifies the confidentiality, integrity and availability of data, functions and services as core security objectives and describes security capabilities as potential risk-control measures. Runtime protection, Remote Attestation and controlled key release can form part of these controls.
‍

‍

HIPAA: A risk-based approach for the US market
‍

For providers operating in the US, the HIPAA Security Rule is also relevant. It requires a risk-based selection of administrative, physical and technical safeguards for electronic protected health information (ePHI). Confidential Computing is not explicitly required, but may be considered where privileged infrastructure access or external cloud administration is identified as a relevant risk.
‍

‍

Confidential Computing as an enabler of secure digitalisation
‍

Confidential Computing complements established safeguards by extending encryption to data while it is being processed. This allows organisations to define narrow trust boundaries around external infrastructure and specialised applications such as AI models.
‍

The technology does not provide complete independence from cloud providers or hardware and software vendors. It does, however, allow organisations to retain control over their own data even when it is processed in external infrastructure – a capability that healthcare increasingly depends on as digitalisation advances. Preventing architecture-related data leakage when using AI models will also become increasingly important.
‍

Plus, the requirements set out in gematik’s HCC specification draft are a strong indication of the strategic importance Confidential Computing is gaining for secure and sovereign health data processing in Europe.

‍

‍