When inclusion isn’t safety: legal status, trust, and the ethics of disease surveillance

On the margins of the Seventy-ninth World Health Assembly (WHA79) this June, Spain hosted a high-level side event on refugee and migrant health, co-sponsored by Brazil, Colombia, Egypt, and Nepal, and supported by WHO. The message was clear: national health systems need to become more inclusive, and countries need to move from commitments to practice. Spain’s Secretary of State for Health, Javier Padilla, said it plainly: “Ensuring equity for migrants and refugees means recognizing their right to health.” Spain has backed that statement with policy - removing administrative barriers so that, in principle, anyone residing in the country can access care regardless of status.

That is the right instinct, and it deserves to spread. But the harder question is what “inclusive” has to mean in practice.

What “inclusive” leaves out

Universal health coverage promises care for all without financial hardship (see WHO’s global monitoring report), but access still depends on citizenship or legal status. WHO’s own monitoring shows the gap: none of the health systems it surveyed gave irregular migrants the same care as citizens, and fewer than four in ten even collect health data by migration status. This is the pattern that inclusive systems are meant to break.

Researchers call this pattern “bordering” because it ties health access to nationality rather than need (see Görentaş et al). The WHA79 side event was, in effect, a call to undo that pattern - to build systems where legal status no longer determines who gets seen. This article supports that shift but argues that inclusion on its own is not the same as safety. A national health system can add migrants and refugees to its rolls and still put them at risk. The real question is what “safe” would require.

One way to answer that is to change the frame entirely. A human security approach centers on people rather than the state (see UNDP’s development report). Citizenship-based systems ask whether someone belongs; human security asks whether someone is safe - from threats to health, work, and community, as the UNDP’s original framework described. By this standard, the health needs of people on the move depend on their risks, not their legal status (see Cassidy & Davidson, 2024).

Applied at scale, that standard covers a lot of people. According to the UN, more than 300 million people are now living outside their country of birth, and millions more are internally displaced within their own countries. Yet most destination-country health systems, even ones actively working toward the model Spain described at WHA79, were not built with these numbers in mind. These systems often focus more on stopping disease than on providing regular care, so for undocumented migrants, even visiting a clinic can carry risk, since they may avoid care out of fear of being reported (see Severoni et al, 2025 and Cassidy & Davidson, 2024).

When people avoid care, the effects reach beyond themselves. Someone who stays sick while living, working, and moving through a community lets the risk spread unmanaged. Left unmanaged, that risk becomes everyone's problem, not just the person avoiding care (see Salman et al, 2025). Meeting people's actual risks, rather than sorting them by status, means the data systems built around them have to serve care rather than control - which is where the design of those systems starts to matter.

The traceability problem

This is where the challenge sharpens for countries trying to follow WHA79’s lead. In practice, inclusion often means adding people to national data systems built for citizens with stable legal status: registration, records, reporting. The goal is fairness, and data is the tool used to reach it. That tool carries its own risk. For displaced and migrant groups, the risk lies in traceability (see Taylor, 2016). When health data is linked to security enforcement, an inclusive health system can end up pushing people further away from care rather than drawing them in (see Taylor & Broeders, 2015).

Legal status is the hidden variable that shapes this whole experience. For people with secure papers, sharing health data is a reasonably fair exchange: data goes in, and access to healthcare, jobs, or travel comes out. They may still worry about privacy, but their legal status gives them some predictability. Without that protection, the risk is not shared equally (see Taylor 2017). Whether health data can reach immigration authorities, and what's done with it if it does, is still unresolved. Just knowing that's possible changes how, whether, and when people seek care, no matter how inclusive the system looks on paper.

Trust is what connects legal status to whether surveillance works at all. When health data can reach enforcement, an inclusive system can become one that people quietly avoid. If people delay treatment, skip testing, or stop using services because they feel at risk, the data collected no longer reflects the real disease burden. Surveillance only works if people take part, and trust is what makes that participation possible.

Even when trust breaks down, the data already collected does not disappear. These systems tend to run long past their original purpose. Funding cycles reward ongoing collection. Donor and government reporting rules expect continuity. And nobody built in an end date to begin with.

Biometric databases built for refugee registration have followed the same path: set up to solve a short-term problem, they often outlast it, which raises questions about who can access the data later (see Devine et al, 2020).

There's a second question buried in this one: not just how long data is kept, but how much should have been collected in the first place. The core ethical question in disease surveillance is whether the level of intrusion matches the actual public health need, both now and as that need changes over time. The type of data matters here, and it is often overlooked. Aggregated case reports, stripped of personal details, carry much less risk when managed properly. Identifiable data - names, ID numbers, biometric details, movement histories - sits in a different category. It can be traced back to a person and used beyond its original purpose. Proportionality means collecting only what the public health need requires, built into the system’s design from the start rather than added on afterward (see Taylor & Broeders, 2015).

How much is collected is one question. Whether people have a real choice in providing it is another. Among displaced and migrant populations, consent is rarely a simple signature. When healthcare access depends on joining a data system, most people cannot meaningfully refuse. Consent that looks voluntary on paper is often not a real choice in practice.

Privacy here isn't a private matter. It's whether an entire community feels safe enough to walk into a clinic without wondering what happens to their information afterward. That trust does not break one person at a time - when it goes, it goes for everyone, because the system only works if the community believes it can be trusted.

Public health cannot separate the ethics of traceability from how well surveillance works. Without trust, surveillance gets worse on both counts: less ethical, and less accurate.

What real safety would require

That is the question WHA79 raised, and it is worth carrying through to the end. WHA79 was right to put refugee and migrant health at the center of the conversation, and countries like Spain are right to lead with removing administrative barriers to care. Adding migrants and displaced people to national systems is the right step, but it is not the whole step. Ignore the risks of traceability, and inclusion stays incomplete. What makes a system both trustworthy and accessible is the safeguards built around it: limiting data collection, keeping clinical and program data separate from enforcement, setting clear retention limits, and planning for system exits from the start.

None of this is free of friction: the same data that helps a clinic plan care is often what a ministry of interior wants for exactly the opposite purpose. Building the safeguards means resolving that tension by design, not assuming it away. As displacement grows longer and more widespread, that difference will matter more, not less.

Whether Spain's own approach meets that standard - whether its health data stays walled off from immigration enforcement - is a fair question, and one worth asking of any country cited as a model.

Image: WHA79 side event to advance refugee and migrant health through stronger national systems. © World Health Organization/WHO, 2026

Authors are Sharon Low, Tiah Ling and Piya Hanvoravongchai, who are all members of the Thematic Working Group on Health Systems in Fragile and Conflict-Affected Settings (TWG FCAS).