Data governance framework for the implementation of automated healthcare-associated infection surveillance using large language models: Privacy-by-design with open-source de-identification pipeline

Abstract Background Healthcare-associated infection (HAI) surveillance remains heavily dependent on manual review of electronic medical records (EMRs), limiting scalability, reproducibility, and between-hospital comparability. Large language models (LLMs) may support extraction of clinically relevant information from unstructured text, but implementation is constrained by data protection, governance, and workflow integration challenges. Within an ECDC-funded feasibility project on healthcare-associated bloodstream infection (HA-BSI) surveillance in Italian hospitals, we developed an implementation framework to address these barriers. Methods The framework combines a Data Protection Impact Assessment used as a design instrument, categorization of data into raw, derived, and aggregated tiers, an on-site assisted de-identification workflow, and a tiered LLM deployment model. LLMs are used for structured clinical information extraction only, while final case classification is performed through a transparent, deterministic, rule-based algorithm based on ECDC definitions. Results The project produced an operational workflow in which identifiable clinical records remain under hospital control and only locally reviewed de-identified outputs are transferred for downstream research processing. It also led to development of an open-source human-in-the-loop redaction prototype. Key implementation barriers included variable EMR maturity, document export constraints, and lengthy ethics, institutional, and data protection approval cycles. Final LLM benchmarking and surveillance-performance evaluation remain ongoing. Conclusions Trustworthy LLM-assisted surveillance may depend on governance and implementation architecture as much as on model capability. The proposed framework provides a feasibility model requiring further validation across hospitals, languages, record systems, and LLM versions. This study describes a privacy-by-design workflow for using large language models to extract clinical information from Italian hospital records while preserving local data control, enabling deterministic ECDC case-definition matching for healthcare-associated bloodstream infection surveillance through on-site de-identification and human oversight.