# Mapping the biotech and medtech data landscape
A cardiologist prescribes a new anticoagulant. Six months later, a safety analyst wants to know: are patients on this drug bleeding more than expected? To answer, she needs at least four different datasets, none of which were built to talk to each other. The electronic health record shows the prescription. The claims database shows the hospital visit. The adverse-event registry shows the reported bleed. The genomics panel might explain why one patient reacted badly. Each dataset holds part of the truth, and each has blind spots the others cannot fix.
That is the core skill of this lesson: knowing which dataset answers which question, and where each one lies to you.
EHRs are the clinical record generated during care: diagnoses, prescriptions, lab orders, physician notes, vital signs. In the US, the dominant vendors are Epic and Oracle Health (formerly Cerner). In Europe, the landscape is more fragmented across national systems.
Answers well: What happened to this patient clinically? What was measured, prescribed, diagnosed?
Cannot answer: What happened outside this health system. If a patient sees a competing hospital, that visit is invisible. EHR data is also messy: free-text notes, inconsistent coding, and diagnoses entered for billing rather than clinical accuracy.
Diagnoses are typically coded in ICD-10 (International Classification of Diseases, 10th revision, the WHO standard diagnosis code set). Procedures often use CPT (Current Procedural Terminology) in the US.
Claims are the billing records exchanged between providers and payers (insurers, or in Europe, national health systems). Every reimbursed drug, test, and procedure leaves a claim.
Answers well: Did the patient fill the prescription? What was the full care journey across providers? Claims follow the money, so they capture activity across institutions.
Cannot answer: Clinical outcomes and lab values. A claim tells you a test was billed, not the result. It also lags: claims are adjudicated weeks to months after the event.
In the US, the Centers for Medicare and Medicaid Services (CMS) publishes large claims datasets. A useful free entry point is the CMS Research Data portal.
DNA sequencing, gene expression, and variant data. Formats include FASTQ (raw reads), BAM (aligned reads), and VCF (Variant Call Format, listing where a genome differs from a reference).
Answers well: Why did a patient respond or not respond? Which mutation drives a tumor? Genomics underpins precision oncology, for example matching a lung cancer patient with an EGFR mutation to a targeted therapy.
Cannot answer: What the patient actually experienced clinically. A variant is a probability, not an outcome. Genomics files are also enormous (a single whole genome is roughly 100 to 200 gigabytes uncompressed) and require heavy governance because they are inherently identifiable.
Post-market safety reporting. The US FDA (Food and Drug Administration) runs FAERS (FDA Adverse Event Reporting System). The EU equivalent is EudraVigilance, run by the EMA (European Medicines Agency). For devices, the FDA runs MAUDE (Manufacturer and User Facility Device Experience).
Answers well: What safety signals are being reported for a drug or device across the whole market?
Cannot answer: True incidence rates. These are spontaneous reporting systems, meaning reports are voluntary and incomplete. You cannot compute a real rate because you know the numerator (reports) but not the denominator (total patients exposed). Underreporting is severe, and reporting spikes after media attention. Never treat a raw FAERS count as a rate.
FAERS is public and browsable through the openFDA API.
Laboratory Information Management Systems track samples, assays, and results in both clinical and research labs. In diagnostics companies and pharma R&D, LIMS data is the backbone of experimental reproducibility.
Answers well: What was the actual measured result, with quality controls attached? Was the assay validated?
Cannot answer: Anything about the patient beyond the sample. LIMS is sample-centric, not patient-centric.
Manufacturing Execution Systems and their data live under GMP (Good Manufacturing Practice, the regulated quality standard for producing drugs and devices). They log batch records, environmental conditions, equipment calibration, and deviations.
Answers well: Was this batch made correctly? Is the process in control? Critical for biologics, where the process largely defines the product.
Cannot answer: Anything clinical. But a manufacturing deviation can trigger a recall that shows up months later in adverse-event data, so these worlds do connect.
The hard part is joining these sources. There is rarely a shared patient key. Linkage relies on tokenized identifiers (privacy-preserving hashes of name, date of birth, and other fields) or on standardized data models.
The most important standard to know is OMOP CDM (Observational Medical Outcomes Partnership Common Data Model), maintained by the OHDSI community. It reshapes EHR and claims data into a common structure so the same analysis runs across hospitals and countries. In genomics and clinical exchange, FHIR (Fast Healthcare Interoperability Resources) is the dominant APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → standard.
Data qualityData qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → here is not abstract. A missing lab value can invalidate a regulatory submission. The OHDSI community groups quality checks into three dimensions you should memorize:
Suppose you extract 50,000 diabetes patients from an EHR and want to use HbA1c (a blood sugar control marker) as an outcome. You find 32,000 patients have at least one HbA1c value recorded.
Completeness = 32,000 / 50,000 = 64%
That 36% gap is not random. Patients with recorded values are usually sicker or more engaged, a bias called informed presence. If you analyze only the 64%, your results may not generalize. The metric flags the problem; judgment fixes it.
Here is the same check expressed in SQLSQLSales Qualified Lead: a prospect the sales team has validated as ready for direct outreach and a proposal, having passed clear qualification criteria.View full definition → against an OMOP-style table:
SELECT
COUNT(DISTINCT person_id) FILTER (
WHERE measurement_concept_id = 3004410 -- HbA1c
)::float
/ COUNT(DISTINCT person_id) AS hba1c_completeness
FROM measurement;Knowledge check
1. A safety analyst needs to know whether patients who left one hospital system actually filled their prescription and received follow-up care at other providers. Which dataset is best suited to answer this question?
2. Why does the lesson emphasize knowing 'where each dataset lies to you' rather than simply which dataset to use?
3. An EHR diagnosis field shows a condition that doesn't match the physician's free-text notes. What is the most likely conceptual explanation the lesson suggests?
4. Select ALL correct answers about the limitations of Electronic Health Records (EHRs) as described in the lesson.
Select all the correct answers.
5. Select ALL correct answers that correctly match a data question to the dataset that answers it well.
Select all the correct answers.
Every dataset above is regulated, and the rules differ by geography.
United States: HIPAA (Health Insurance Portability and Accountability Act) governs protected health information. Data can be used more freely once it is de-identified, which HIPAA defines through two methods: Safe Harbor (removing 18 specified identifiers) or Expert Determination (a statistician certifies low re-identification risk).
Europe: GDPR (General Data Protection Regulation) treats health and genetic data as a special category requiring a strong legal basis. The new European Health Data Space (EHDS), adopted in 2024 and rolling out through the late 2020s, creates a framework for reusing health data for research across member states. Expect this to reshape European access over the coming years.
For medtech specifically, devices in the EU fall under the MDR (Medical Device Regulation), which mandates ongoing post-market data collection.
Genomics deserves special caution: DNA cannot be truly de-identified, because the sequence itself is an identifier. Governance there leans on access controls and consent, not anonymization.
The professional instinct is to ask, before any analysis: which dataset was designed to capture this, and what is it structurally blind to?