A health data holder is an organization or other entity that controls or maintains health data and has governance duties over it. In practice, that means knowing what datasets exist, who is responsible for them, how they are classified, and under what conditions they can be accessed, shared, or reused. The term is important in health-sector compliance because data governance starts with ownership, inventory, and clear accountability.
In cyber security, a health data holder is a high-value target because it concentrates sensitive records and decision-making power. Defenders use this role to define access controls, logging, encryption, retention, and incident-response responsibilities. Attackers benefit when holders have incomplete inventories, poor metadata, or weak internal coordination, because those gaps can hide shadow datasets, slow containment, and make unauthorized exfiltration or misuse easier. A strong holder function improves both security and lawful reuse.