Beyond Consent-Centred Protection in Digital Healthcare: Italy, Secondary Use of Health Data, and Governance-Based Safeguards for AI-Mediated Care

Abstract The digitalisation of healthcare is transforming not only clinical practice but also the legal architecture through which health rights are protected, coordinated, and operationalised. Using Italy as a doctrinal case study within the European Union (EU) framework shaped by the General Data Protection Regulation, the European Health Data Space, and artificial intelligence (AI) regulation, this article argues that digital healthcare is moving beyond consent-centred protection toward governance-based safeguards. The Italian trajectory is especially revealing because regionalised healthcare governance intersects with centralised digital coordination through the Fascicolo Sanitario Elettronico, the Ecosystem of Health Data, and EU rules on the secondary use of health data. The article contends that this shift does not displace consent as a legal or constitutional value, but requires stronger substitute and complementary safeguards when consent can no longer operate as an effective practical control mechanism. These include clear legal bases, differentiated access regimes, data minimisation, secure processing environments, meaningful patient information, democratic accountability, human oversight, anti-discrimination duties, and clearer allocations of responsibility among clinicians, institutions, and technology providers. AI-mediated care is treated as a downstream test case for whether governance-based legality remains compatible with autonomy, dignity, and responsibility in clinical care.