Confidentiality of Medical Data in the Proposed Romanian National Cardiac Rehabilitation Registry: Ethical, Technical, and Legal Considerations

Romania is deficient in a centralized infrastructure to monitor outcomes in cardiac rehabilitation (CR), and this contributes to high cardiovascular mortality, which nevertheless remains high despite clinical guidelines and EU strategic actions. This paper articulates the process that led to the establishment of the National Cardiac Rehabilitation Registry (NCRR), which is a digital infrastructure compliant with the GDPR and NIS2 framework, intended to close a significant policy and clinical void in Romania's cardiovascular care system. Applying a multi-tiered methodology to consider the NCRR feasibility (a legal-ethical analysis, benchmarking of registries in EU member states, and cybersecurity threat modelling), the NCRR seeks to provide a secure, interoperable, and ethically governed platform for the longitudinal collection of CR data. The registry, which allows real-time data exchange via HL7 FHIR and complies with EHDS interoperability standards, will enable Romania to participate in cross-border research and EU health initiatives. Politically, the NCRR provides a favorable condition for the synchronization of national policies with the EU digital health strategy, bolsters cybersecurity resilience, and enhances accountability of institutions through transparent performance dashboards and independent ethical oversight. From a clinical perspective, it aids in outcome monitoring and quality standardization for health professionals and access to evidence-based CR programs for patients. As such, the registry serves as a scalable model for national disease-specific data governance, an important tool for Romania's transition to digital, secure, and patient-centered cardiovascular care.