Synthetic health data: how it is made, where it is used, and what it does not guarantee

Synthetic data is data produced by an algorithm rather than collected from people. In healthcare, it usually means artificial patient records, images or physiological signals that reproduce the statistical patterns of real ones (the usual age range for a disease, the way blood pressure tends to rise with weight) without describing any person who exists. A Tech Anatomy solo episode in April 2025 compared it to a film set: the hospital room looks real, but nothing in it is.

The appeal comes from the difficulties of real health data. Records are personal, scattered across institutions and protected by long approval processes. Even when accessible, they are often incomplete or unbalanced, with too few children, too few cases of a rare disease or too few examples of a rare side effect to train a reliable model. Synthetic data promises a version of the dataset that can circulate more freely and be topped up where it is thin.

Four ways of generating it

The episode described four families of methods, ranging from simple to elaborate.

The simplest draws random values from known distributions: if most patients with a condition are between 50 and 60, generate ages in that range. This reproduces each variable on its own but can miss the relationships between them.

A second approach uses rules and simulation. Synthea, an open-source generator developed at MITRE and described in the Journal of the American Medical Informatics Association in 2018, simulates the lives of fictional patients from published population and health statistics, modelling common reasons for primary care visits and major chronic conditions. Its records are not derived from any real patient file, which is also why they are less faithful to the quirks of a particular hospital.

The third and fourth families learn directly from real data. Generative adversarial networks, introduced by Ian Goodfellow and colleagues in 2014, pit two neural networks against each other: one generates samples, the other tries to tell them from real ones, and both improve until the generated samples are hard to distinguish. Variational autoencoders and related networks learn a compressed representation of the real data and sample new records from it, an approach the episode linked to time series such as heart or breathing signals. In practice, teams often combine methods.

Where it is already used

Data sharing is the most institutional use. In the United Kingdom, the Clinical Practice Research Datalink, part of the medicines regulator MHRA, offers high-fidelity synthetic datasets built from real primary care records, including one on COVID-19 and one on cardiovascular disease, designed for developers of medical technologies. Access still goes through a request form.

Enriching rare cases is a second use, especially in imaging. In a study published in Neurocomputing in 2018, Maayan Frid-Adar and colleagues used generative adversarial networks to create synthetic CT images of liver lesions from a set of 182 real lesions. Adding them to the training data raised the classifier's sensitivity from 78.6% to 85.7% and its specificity from 88.4% to 92.4%, according to the conference version of the work.

Clinical trials are a third. The episode mentioned "synthetic twins" used so that fewer participants need to receive placebo. The most advanced regulatory example is more specific than that phrase suggests. In September 2022, the European Medicines Agency qualified PROCOVA, a method developed by the company Unlearn, which uses a model trained on historical data to predict each participant's outcome on placebo and then uses that prediction as a covariate in the analysis. The EMA opinion says the approach can increase statistical power or reduce sample size in phase 2 and 3 trials with continuous outcomes. Participants are still randomised and a real control arm remains; the prediction makes the comparison more precise rather than replacing it.

How much privacy it protects

The episode presented privacy as the main benefit, on the reasoning that records not linked to any real person cannot expose one. That reasoning holds best for data generated from rules and public statistics, like Synthea's. It is debated for data generated by models trained on real records, because a model can reproduce, or let an attacker infer, details of the people it learned from.

In 2022, Theresa Stadler, Bristena Oprisanu and Carmela Troncoso, of EPFL and UCL, tested several generative models at the USENIX Security Symposium and concluded that synthetic data did not offer a better trade-off between privacy and usefulness than traditional anonymisation. Depending on the settings, it either failed to prevent inference attacks or lost much of its analytical value, and the outcome was hard to predict in advance. Other researchers, such as the statistician Gillian Raab in a 2024 paper, argue that disclosure risk can be measured record by record and reduced, which would make synthetic data one privacy technique among others rather than a guarantee. Whether a given synthetic dataset counts as personal data under the GDPR therefore depends on how it was produced and tested, not on the label.

Two readings

One reading sees synthetic data as a practical bridge: a way to let developers, students and regulators work with realistic records while the slower work of governed access to real data continues. The CPRD datasets and the EMA qualification fit this view.

A second reading stresses that synthetic data inherits the limits of its source. A generator trained on a dataset with too few rare cases has little to learn about them, and a generator that adds them is extrapolating. Results obtained on synthetic data then need confirming on real patients, which brings back the access problem it was meant to avoid.

What the episode and this article leave open

Neither covers how to validate a synthetic dataset, a field with no settled standard: fidelity to the source, usefulness for a specific task and disclosure risk are measured separately and can pull against each other. Nor do they address the digital twins mentioned at the end of the episode, which model one individual over time rather than a population.

What to watch

Two signals would clarify where synthetic health data stands: guidance from European data protection authorities on when synthetic records fall outside the GDPR, and the share of regulatory submissions that rely on synthetic or model-predicted data beyond the PROCOVA case. Until then, the useful question for any synthetic dataset is how it was generated and how its privacy was tested.

Listen to the episode

Synthetic Data Massively Simplified

Listen · 10 min