Estonia's health data is among the most digitised in Europe, and that is exactly why a dispute over who may open it matters for artificial intelligence policy. This is not an AI law. No verified Estonian AI-regulation event drove this story. But national AI projects and EU-wide secondary-use schemes depend on public trust that health records stay confidential, and that trust is being tested now.
What happened
ERR News reported on 13 October 2026 that Estonia plans to require court approval before investigators can access people's health data without consent. According to that report, two competing bills would make the change. One, from the Ministry of Justice and Digital Affairs, sets conditions for official access. The other, from Social Affairs Minister Karmen Joller, would merge the prescription, treatment-billing and national health information (TEHIK) databases. An attorney quoted in the report argues that the second bill would broaden access, so the two conflict. I could not review the bill texts themselves, so the details below rest on ERR's reporting.
The trigger is visible in ERR's Estonian-language coverage. The Estonian Medical Association sent Joller a public letter objecting that police and other state agencies can reach patient data. It asked that access without consent through state information systems be suspended, and that access in clearly defined exceptions require a court's permission. Its president, Neeme Tõnisson, said patient confidentiality must hold even after data enters an information system. Joller replied that a law amendment, prepared with the Justice and Digital Affairs ministry, was already on its way to the government. She said the Police and Border Guard Board had sometimes requested data without enough justification and has since changed its practice, and that TEHIK broke no rule because it acted within current law.
The strongest case for broad access
The case for consolidation and easy access deserves a fair hearing. Investigators of serious crime, missing-person cases or threats to life can have a legitimate need for medical information, and delay can cost lives. A merged prescription, billing and health-information database can also cut duplication, improve data quality and give researchers and clinicians one coherent record. Estonia built its reputation as a digital state on that kind of integration. Requiring a judge for every request adds friction, and a badly drafted rule could slow legitimate care and research.
Why a judicial gate is the proportionate answer
The argument for court approval is not anti-state. It is about sequencing. Health data is among the most sensitive categories a person has, and the doctors' complaint is that confidentiality ends at the database boundary. A neutral decision-maker who weighs necessity and proportionality before each non-consensual access is the standard liberal democracies already apply to wiretaps and searches. It protects investigators too, because evidence gathered through a reviewed process is harder to challenge.
The concern about merging databases is a design problem, not a ban on integration. A single combined register is a single point of failure and a single target. If the merger widens who can query it, as the attorney quoted by ERR argues, it would enlarge the pool of people and agencies able to read records. Estonia has seen what weak control of health data looks like: after the Asper Biogene genetic-lab leak, Chancellor of Justice Ülle Madise told ERR in December 2023 that the state should review who collects and holds sensitive personal data and why, and questioned whether consent on test order forms was adequate.
The AI and secondary-use connection
This is where the dispute meets AI policy. The EU's European Health Data Space Regulation, Regulation (EU) 2025/327 of 11 February 2025, was published in the Official Journal on 5 March 2025. It applies mainly from 26 March 2027, with its secondary-use chapter applying from 26 March 2029. That chapter creates a framework for reusing electronic health data for purposes beyond the care for which it was collected, which is the route through which health data can reach research and AI development. Member states must have their governance in place by then.
The Artificial Intelligence Act, Regulation (EU) 2024/1689 of 13 June 2024, separately sets obligations for AI systems, including high-risk ones in health settings. Estonia's national implementing act for it appears to still be in preparation. I found no verified recent Estonian AI-regulation event, so I make no claim about its content.
The practical point is simple. AI developers and researchers will ask Estonia for access to the same records that police now seek. If a citizen sees one agency read their file without a judge, they will not accept another agency's promise that reuse is safe. Public legitimacy is the input that data-driven health innovation cannot do without. Weak safeguards for investigators therefore threaten secondary use as well.
What a good outcome looks like
- One access standard. The two bills should be reconciled so that a single statute defines who may access health data without consent, under which conditions and with what judicial authorisation.
- Integration with limits. Merging TEHIK, prescription and billing data can go ahead only if query rights are not widened and every access is logged and reviewable by the patient.
- Separate tracks for reuse. Secondary use for research and AI should run through the EHDS-style governance, with pseudonymisation and purpose limitation, and not through the police-access provisions.
- Narrow emergency exceptions. Urgent situations can be covered by after-the-fact judicial review, so that the court requirement does not become a hazard to life.
The pro-innovation position is not to maximise access. It is to build a system in which citizens can rely on a rule they understand. Estonia is well placed to do so, because it already has a minister and a medical profession publicly agreeing that a law change is needed. Disagreement between two ministries' drafts is a normal stage of lawmaking. What matters is that parliament resolves it in favour of a clear, narrow, court-supervised gate before 2029, when European secondary-use rules begin to bite.