Real-world healthcare data is at the centre of a new agreement between AstraZeneca and Oracle, announced on 20 October 2026, and the companies’ emphasis on privacy and governance is as notable as the technology. The non-binding collaboration aims to use AI and deidentified data from routine care to help find patients for clinical trials and support safety monitoring, starting with a hypertension programme in Abu Dhabi with M42. AstraZeneca says it will not receive patient-identifiable information. This industry report examines the governance claims, what they do and do not guarantee, and what the two releases leave out.
Real-world healthcare data: key takeaways
- The agreement is non-binding and discloses no financial terms or timeline.
- The data are described as deidentified, and AstraZeneca says it will receive no patient-identifiable information.
- Each project is reviewed separately and proceeds only after legal, privacy, regulatory, ethical and institutional safeguards are in place.
- The work is said to operate under the governance of the health systems delivering care.
- The first programme is hypertension in Abu Dhabi with M42, per AstraZeneca’s version of the release.
What real-world healthcare data means here
General background: real-world healthcare data is information collected during routine care, such as diagnoses, test results, prescriptions and clinical notes, as opposed to data gathered in a controlled trial. Regulators and drug developers increasingly examine whether it can support evidence about medicines, as the FDA overview of real-world evidence describes. The releases use the term for the data the collaboration would draw on, and say it would feed a continuous learning model in which insights from research and routine care inform study design, safety monitoring and patient care.
The governance commitments in the AstraZeneca-Oracle plan
AstraZeneca’s version of the announcement says the work uses deidentified real-world data within stated governance, privacy and security arrangements, that AstraZeneca will not receive patient-identifiable information, and that each project is reviewed individually. Oracle’s Seema Verma says the collaboration will operate under the governance of the health systems delivering care. Together these point to a structure in which hospitals or health systems control access and AstraZeneca sees only results or deidentified outputs, although the releases do not describe the mechanics.
What deidentified real-world healthcare data does and does not guarantee
This is our analysis. Deidentified data has had direct identifiers such as names removed, which lowers privacy risk, but the strength of protection depends on the method used and on who can combine it with other data. The releases do not say which standard or technique is applied, who audits it, or how re-identification is prevented. Readers should therefore treat the privacy statement as a commitment of intent and look for the governance documents when they are published.
The Abu Dhabi programme and real-world healthcare data
The first programme aims to help clinical teams identify patients with uncontrolled hypertension, implement guideline-directed care and improve clinical-trial recruitment, according to AstraZeneca’s version. M42 is described as a healthcare company. Oracle’s version does not mention the project, and its dateline lists Austin and Abu Dhabi. No patient numbers, data sources or start date have been given, and we cannot say which health records would be used.
Why the data question matters to industry
For pharmaceutical companies, access to real-world healthcare data can inform how trials are designed and where patients are found, and for health systems it raises questions about control and benefit sharing. The releases mention reusable technical components and agreed outcome measures, which suggests the companies want a repeatable model, not a one-off pilot. We have no information on commercial arrangements, ownership of insights or whether results will be published.
Real-world healthcare data: regional scope and regulation
AstraZeneca’s version names the United States, the Middle East and Europe as key regions and says projects will work with local governments and follow applicable regulations. Data-protection rules differ between these regions, so the same model may need different safeguards in each. The releases do not identify the regulators involved or the legal basis for using the data, and we make no claim about either.
Questions readers should ask about real-world healthcare data
This list is our suggestion and not a company disclosure. Which hospitals or health systems supply the records, and who sits on the body that approves each project? What method removes identifiers, and has an independent party tested it? Can a patient opt out, and how would they know their records were included? Are the findings published whatever the outcome? Who owns the models and insights built from the data? The releases promise project-by-project review but answer none of these, so each is a fair test of how the governance works in practice once the first programme begins.
The health-system view
General background: hospitals and health ministries that hold patient records carry the legal duty to protect them, so their willingness to take part depends on clear rules about access, purpose and benefit. The companies say the work will run under the governance of the health systems delivering care, and that an extension to other disease areas and geographies would be assessed later. Whether other health systems adopt the model is not stated, and we do not know the terms agreed with M42.
Real-world healthcare data: what is not disclosed
- Financial terms or investment amounts.
- The deidentification method and who audits it.
- The scale of data, number of hospitals and patients.
- Whether results and methods will be published.
Risks and caveats on real-world healthcare data claims
- Governance statements are the companies’ own and have not been independently verified.
- A non-binding agreement may not lead to the projects described.
- Our analysis of deidentification is general and not specific to this programme.
- This is news reporting, not legal, medical or investment advice.
In our assessment, the real-world healthcare data model in this agreement will be judged less by the technology than by whether the governance papers, audit arrangements and outcome measures become public, and whether health systems retain control over their records. See also AstraZeneca Pays $40 Million Upfront in AI Pact With insitro. More in our healthcare IT coverage.
What to watch next on real-world healthcare data
- Publication of governance and outcome-measure documents.
- Start of the Abu Dhabi programme.
- Additional health systems or regions joining.
Frequently asked questions
What data will be used?
Deidentified real-world healthcare data from routine care, according to AstraZeneca’s version of the release. Company background is on AstraZeneca website.
Will AstraZeneca see patient identities?
AstraZeneca says it will not receive patient-identifiable information.
Is the agreement binding?
No. It is described as non-binding.
How we reported this: we relied on the companies’ releases of 20 October 2026 and the regulator’s public page. Our analysis is labelled. Last updated: 20 October 2026. This article is news reporting and not legal, medical or investment advice.
