Smart Care Governance in Hong Kong: Building Assurance Around AI, Data, Robotics and Connected Technologies

A residential care home may now use electronic health information, sensor-based monitoring, digital medication systems, mobile care records and gerontechnology within the same service. Another organisation may be trialling artificial intelligence while already operating rehabilitation technology, remote monitoring and connected devices. Each system may have been introduced for a legitimate reason. The governance challenge begins when they start to interact.

Hong Kong has deliberately built infrastructure for this transition. The Innovation and Technology Fund for Application in Elderly and Rehabilitation Care continues to support technology adoption across eligible elderly and rehabilitation services, while eHealth+ is developing Hong Kong’s electronic health infrastructure beyond record sharing towards broader data sharing, service support and care-journey management. These developments sit within the wider transformation explored through the Hong Kong Ageing, Long-Term Care & Community Support Knowledge Hub.

The next challenge is therefore not simply digital adoption. It is smart care governance.

A provider can purchase a safe device and still create an unsafe system if information flows are poorly controlled, alerts are not acted upon, staff misunderstand automated outputs or several suppliers hold overlapping data. Equally, cautious governance should not become a barrier that prevents useful technology from improving independence, workforce capacity or continuity.

The stronger model is proportionate assurance: understanding what the technology does, what decisions it influences, who remains accountable and how risks are detected before they become part of routine care.

Smart care governance is broader than technology governance

Technology governance can sound like a specialist function concerned with cyber security, procurement and IT policies.

Smart care governance is broader because digital systems increasingly shape care itself.

A sensor may influence when a worker enters somebody’s room. An AI tool may influence what information a manager reviews first. An electronic medication system may determine which prescription information staff see. A rehabilitation robot may shape the amount and form of exercise a person receives.

These are operational care decisions mediated by technology.

Governance therefore needs to connect technology with:

• individual outcomes and preferences;
• clinical and care responsibilities;
• workforce competence;
• information governance and privacy;
• service continuity and cyber resilience;
• supplier accountability; and
• organisational learning when technology behaves unexpectedly.

The distinction matters because technology risk can no longer be safely delegated to an IT function alone.

Hong Kong’s smart care environment is becoming increasingly interconnected

The direction of Hong Kong policy is towards greater digital connectivity.

eHealth has operated as a territory-wide electronic health record sharing platform since 2016. The subsequent eHealth+ five-year plan is designed to expand that infrastructure across four strategic directions: a more comprehensive health record, a more connected care journey, a stronger digital front door and a broader health data repository.

This creates significant potential for older people and persons with disabilities whose support crosses hospitals, outpatient services, residential care, rehabilitation and community provision.

Better information can reduce repeated history-taking, improve medication visibility and support more coordinated decisions.

But connected systems also increase dependency.

If staff rely on digital information, the quality, timeliness and availability of that information become part of service safety. If information is missing or inaccurate, the problem may travel further because more people depend upon it.

This is why interoperability and system integration require governance as well as technical capability.

Data remains the foundation of most smart care systems

Artificial intelligence, remote monitoring, digital dashboards and many connected devices depend on data.

That makes data quality one of the least glamorous but most important elements of smart care governance.

A predictive system built on incomplete information may create false reassurance. A dashboard combining differently defined indicators across several homes may produce misleading comparisons. AI-generated summaries can become increasingly confident even when the underlying record is ambiguous.

Organisations therefore need to understand where important data originates, who can amend it and how errors are corrected.

Data governance should not be reduced to completeness rates.

Information can be complete and still be poor quality if it is outdated, copied forward uncritically or recorded in ways that obscure what actually happened.

This connects directly with data quality, metrics and performance dashboards. Smart care becomes reliable only when the information beneath it is reliable enough for the decisions being made.

Consent and access remain central as systems become more connected

Hong Kong’s eHealth architecture is built around defined access and sharing controls.

Participation, sharing consent, role-based access, the principle that a patient is under the care of the healthcare provider and a need-to-know approach all create boundaries around who can see health information.

Access is also logged and subject to audit.

These principles provide a useful wider lesson for smart care systems.

Connected technology should not create an assumption that more data sharing is automatically better.

The stronger question is what information a person or system genuinely needs for a legitimate care purpose.

A remote-monitoring supplier may require technical data but not a person’s complete health record. A rehabilitation application may need movement information without requiring unrelated social-care history.

Purpose limitation therefore remains important even when systems can technically exchange much more information.

Scenario: a connected-care platform becomes more powerful than expected

A residential care organisation introduces a platform combining care records, fall-risk information, medication alerts and selected sensor data. The intention is to give staff a more coherent view of residents’ needs.

Over time, the supplier adds predictive functions. The system begins ranking residents according to the likelihood of deterioration based on several data sources.

Managers appreciate the feature because it helps them prioritise review. Staff gradually begin checking the high-risk list at the start of each shift.

During an internal review, however, leaders realise that nobody has formally examined how the ranking works, how often it is validated or whether some groups are consistently assigned lower risk despite significant needs.

The organisation does not remove the tool immediately. Instead, it changes how it is governed.

The ranking becomes one source of information rather than the primary determinant of review. Staff remain responsible for clinical and care judgement. The provider seeks greater transparency from the supplier, monitors discrepancies between algorithmic risk and actual events and ensures that workers can escalate concerns even where the system does not identify elevated risk.

The technology remains useful, but its authority is deliberately limited.

This is a fundamental principle of smart care governance: the more strongly a system influences human decisions, the stronger the assurance required around how it reaches those conclusions.

Hong Kong already has a developing AI governance framework

Hong Kong’s approach to AI governance provides important foundations for care organisations.

The Office of the Privacy Commissioner for Personal Data has published an Artificial Intelligence: Model Personal Data Protection Framework for organisations procuring, implementing and using AI systems involving personal data.

The framework emphasises principles including accountability, human oversight, transparency and interpretability, privacy, fairness, beneficial use, reliability, robustness and security.

These principles are highly relevant to care.

They move AI governance beyond the narrow question of whether personal data has been collected lawfully.

An AI system in care may comply with privacy requirements and still be unsafe if workers cannot understand its limitations or if management relies on inaccurate predictions.

Likewise, a technically accurate model may still create unfair outcomes if some people are under-represented in the data used to develop or validate it.

AI assurance should follow the consequence of the decision

Not every use of AI requires identical governance.

An AI tool used to draft an internal meeting summary does not create the same risk as one that influences a medication decision, predicts safeguarding risk or prioritises residents for intervention.

The level of scrutiny should therefore increase with consequence.

A practical governance model can distinguish between:

• administrative assistance with limited impact on individuals;
• workflow recommendations that influence staff priorities;
• analysis of personal or health information;
• systems contributing to care or clinical decisions; and
• automation capable of materially affecting safety, rights or access to support.

This prevents two opposite mistakes.

The first is governing every use of AI so heavily that useful low-risk applications become unnecessarily difficult. The second is treating all AI as merely another software function and failing to recognise when it begins influencing important human decisions.

Human oversight needs to be real rather than ceremonial

Many technology policies state that a human remains “in the loop”.

That is only meaningful if the person can genuinely challenge or override the system.

A worker who is theoretically allowed to disagree with an AI recommendation but is routinely questioned whenever they do so may gradually defer to the technology.

Likewise, a manager presented with a highly polished risk score may give it more authority than a qualitative concern raised by frontline staff.

Human oversight therefore requires more than final sign-off.

Workers need enough understanding to recognise when an output may be unreliable, enough organisational authority to challenge it and clear escalation routes when they believe technology is producing unsafe or misleading results.

This connects smart care governance with decision-making and escalation. Automated systems may inform decisions, but accountability for material care decisions cannot disappear into the technology.

Scenario: an AI summary conflicts with frontline observation

A community rehabilitation service introduces an AI-supported system that summarises care records and highlights people whose recent information suggests declining mobility.

One person is repeatedly classified as stable because recorded mobility scores have changed very little.

A support worker who knows her well reports a different picture. She is leaving home less often, taking longer to stand and increasingly asking neighbours to complete errands.

The organisation initially finds no obvious error in the AI output because the structured mobility indicators remain stable.

Further review shows that important changes were recorded in narrative notes but were not captured strongly within the structured fields driving the analysis.

The service responds in two ways.

First, the person receives a fuller review based on staff observation and her own account rather than the algorithmic classification. Second, the provider examines whether its records capture functional change in a form suitable for future analysis.

The scenario illustrates why smart care governance cannot treat algorithmic disagreement as staff error. Sometimes the technology identifies something humans have missed. Sometimes frontline knowledge exposes what the data model cannot see.

Strong assurance keeps both forms of intelligence visible.

Robotics adds physical risk to digital risk

Robotics creates an additional layer of governance because software can now cause physical action.

A transport robot may move through shared spaces. A rehabilitation system may guide a person’s movement. A robotic transfer device may interact directly with the body. An intelligent patrol robot may combine navigation, sensors and communication functions.

These technologies require conventional safety controls alongside digital assurance.

The organisation needs to understand what happens when sensors fail, connectivity is interrupted, equipment behaves unexpectedly or the physical environment differs from the conditions in which the product was tested.

Near misses are especially valuable.

If staff repeatedly intervene to prevent collisions or stop a device because a resident becomes distressed, those events should not be dismissed because no injury occurred.

They are evidence that the interaction between technology, people and environment needs adjustment.

Connected devices can create invisible supplier dependencies

Many smart care technologies are not self-contained.

The physical device may depend on cloud services, remote technical support, software subscriptions, mobile applications or supplier-managed analytics.

This creates dependency on organisations outside the care provider.

A supplier failure can therefore become a care continuity problem.

Procurement should examine more than functionality and price. Providers need to understand:

• where data is stored and processed;
• which subcontractors or cloud services are involved;
• how security updates are managed;
• what technical support is available;
• what happens if the supplier ceases trading;
• whether data can be extracted in a usable form; and
• how the service continues during system failure.

This is where digital procurement and contract management become part of care assurance.

A strong contract does not eliminate risk, but it makes responsibility clearer before a failure occurs.

Cyber resilience is now operational resilience

The increasing digitalisation of care means cyber security can no longer be viewed primarily as a confidentiality issue.

A cyber incident may prevent staff accessing care plans, disrupt medication information, disable connected devices or remove access to scheduling and communication systems.

Hong Kong’s Protection of Critical Infrastructures (Computer Systems) Ordinance came into operation on 1 January 2026, establishing statutory obligations for designated operators of critical infrastructure.

Not every care provider will fall within that regime, and organisations should not assume that the Ordinance directly applies merely because they provide care.

Its broader significance is nevertheless clear: computer-system security is increasingly being treated as an operational continuity issue where disruption can affect essential services and public safety.

Care organisations need the same mindset even where they are outside the statutory critical-infrastructure framework.

Cyber security and digital resilience should form part of business continuity planning, not sit separately within technical policy.

Scenario: a connected service loses digital access

A residential care organisation experiences a serious system outage affecting digital care plans, medication information and several connected monitoring devices.

The technology supplier is investigating the cause, but restoration time is uncertain.

The provider has paper contingency records, although some information has not been updated recently because staff have become accustomed to uninterrupted digital access.

During the first hours, managers discover that the organisation is more digitally dependent than its business continuity plan assumed.

Staff can continue essential support, but locating current information takes longer and several non-essential digital functions are suspended.

After recovery, the organisation does not treat the event simply as an IT incident.

It reviews which services were affected, where care decisions were delayed, whether residents experienced disruption and which contingency records proved inadequate. It also identifies which digital functions have become critical to safe delivery and therefore require stronger resilience testing.

The lesson is important for smart care governance.

As technology becomes more reliable, organisations naturally rely on it more heavily. That success can itself create vulnerability unless contingency arrangements evolve at the same pace.

Staff use of generative AI creates a different governance challenge

Not all AI enters care organisations through formal procurement.

Workers may independently use public generative AI tools to draft emails, summarise information or prepare documents.

This creates the possibility of sensitive personal information being entered into systems that the organisation has never assessed.

The Privacy Commissioner for Personal Data has addressed this risk through guidance encouraging organisations to establish policies for employee use of generative AI.

Care organisations need equivalent clarity.

Staff should know which tools are approved, what information must never be entered, when AI-generated material requires checking and which activities are inappropriate for generative systems.

A blanket prohibition may prove difficult to sustain as AI becomes embedded in ordinary office software. Uncontrolled use is equally problematic.

The stronger approach is governed adoption.

Information governance has to follow data across the ecosystem

Smart care services increasingly involve several organisations processing information around one individual.

The provider may hold the core care record. A technology supplier may process sensor data. A healthcare provider may contribute health information. A family-facing application may provide selected updates.

Responsibility does not disappear simply because information crosses organisational boundaries.

Providers need to understand what information leaves their systems, why it leaves and what happens afterwards.

This makes digital records, data and information governance central to smart care strategy.

The organisation should be able to explain its technology environment in terms that people using services can understand. If staff cannot explain what a system collects or why it is being used, meaningful transparency becomes difficult.

Service-user choice should influence technology intensity

Smart care can become more intrusive as capability increases.

A service can monitor movement, sleep, room entry, location, physiological information and patterns of daily activity.

The existence of these capabilities does not mean they should all be activated.

A person may prefer greater independence even if this creates some additional uncertainty. Another may value monitoring because it allows them to live more independently.

Technology therefore interacts with positive risk-taking.

The question is not simply whether monitoring can reduce risk, but whether the level of monitoring is proportionate to the person’s needs and preferences.

Organisations examining these decisions can use the Positive Risk-Taking Planner to structure thinking around independence, safeguards and proportionate control. It does not replace Hong Kong law or provider policy, but it can help leaders avoid treating maximum monitoring as automatically synonymous with maximum safety.

Smart care governance needs an organisation-wide view

One of the greatest risks in digital transformation is fragmentation.

A rehabilitation team buys one platform. A residential service adopts another. Human resources introduces an AI-enabled workforce system. Facilities management installs sensors. Another department purchases robots.

Each decision may be reasonable individually.

Collectively, the organisation may no longer know how many systems process personal information, how many suppliers require access or where technologies overlap.

Smart care governance therefore needs an organisational technology inventory that is meaningful to operational leaders, not merely an asset register maintained by IT.

Leaders should know which systems are critical to care, which involve personal data, which use AI, which can take physical action and which depend on external suppliers.

The Governance Maturity Assessment can help organisations examine whether accountability, assurance and leadership oversight are sufficiently developed to manage this level of complexity.

Governance information should connect technology with care outcomes

Organisations can easily generate technology metrics.

System uptime, device utilisation, alert volume and user logins are useful operational measures.

They are not enough.

Governance needs to know whether technology is improving care.

A mature evidence set might combine:

• service-user outcomes and experience;
• staff experience and workload;
• incidents and technology-related near misses;
• false or missed alerts;
• system reliability and downtime;
• data quality and access issues;
• supplier performance; and
• evidence of whether expected benefits were actually realised.

The Quality Dashboard Builder offers a practical way to structure this broader evidence and avoid treating technology utilisation itself as proof of quality.

Scenario: three good technologies create one bad workflow

A multi-service organisation uses separate systems for digital care planning, incident management and remote monitoring.

Each performs its own function reasonably well.

A resident experiences a recurring pattern of night-time falls. Monitoring alerts are reviewed by frontline staff, incidents are entered into the incident system and changes to the person’s support are recorded in the care-planning platform.

Because the systems do not communicate, nobody sees immediately that alerts have increased before each fall.

After the third incident, a quality review manually combines information from all three systems and identifies the pattern.

The organisation initially considers purchasing another analytics product.

Instead, leaders first redesign the information flow. Responsibility is assigned for reviewing recurring monitoring alerts alongside incident data, and an escalation trigger is introduced when defined patterns emerge.

Only then does the provider consider whether additional integration would improve the process further.

The scenario demonstrates an important principle: smart care does not mean accumulating technologies. Sometimes better governance of existing information produces more value than buying another system.

Incident learning must include technological contribution

Traditional incident investigation often focuses on human action.

Who was present? Was procedure followed? Was training adequate?

Smart care environments require another question: what role did technology play?

A system may have failed completely, but more subtle contributions are common.

An alert may have been poorly prioritised. A user interface may have made important information difficult to find. Staff may have assumed that a sensor would detect something outside its designed capability. An AI-generated summary may have influenced judgement.

Technology should therefore be incorporated into root cause analysis and thematic learning.

This prevents organisations repeatedly retraining staff where the deeper problem is the way a system has been designed or implemented.

Digital audit should test real use, not policy compliance alone

Smart care governance requires assurance that technology is being used as intended.

A policy may specify role-based access while staff share generic accounts in practice. An AI policy may prohibit personal data entry into public tools while employees use them informally. Sensor consent may have been obtained originally but never revisited after circumstances changed.

Audit therefore needs to examine practice.

Digital audit and assurance should test access logs, real workflows, staff understanding, data quality, supplier performance and whether technology remains appropriate for the people using it.

The purpose is not simply compliance detection.

It is to identify drift between the designed system and the lived system.

Technology can become restrictive without appearing restrictive

Connected systems can influence freedom subtly.

A person may technically be free to move around, but repeated sensor alerts can lead workers to discourage that movement. A location system may gradually become a condition of community access. Predictive risk tools may encourage increasingly cautious decisions.

No physical restraint has been introduced, yet the person’s life may become more restricted.

Smart care governance therefore needs to examine behavioural consequences as well as technical functions.

This is particularly important where staff perceive technology-generated risk assessments as authoritative.

Digital systems should support proportionate decisions rather than create an environment in which the easiest response to uncertainty is more surveillance or less autonomy.

Procurement should include an exit strategy

Care organisations understandably concentrate on implementation when purchasing technology.

Smart governance also considers how the organisation will leave the product.

A supplier may increase prices, discontinue functionality or be acquired. The provider may decide that another platform is better. A technology may simply fail to deliver expected value.

Exit planning should address data portability, replacement timescales, retention responsibilities, device removal and continuity during transition.

This matters especially where technology has become embedded in everyday care.

An organisation that cannot leave a system without significant disruption may have created supplier dependence rather than digital resilience.

People using services should influence smart care governance

Technology governance can become highly technical and therefore distant from the people most affected by it.

That is a mistake.

Residents, people using rehabilitation services, disabled people, families and carers can identify issues that technical teams may miss.

They know whether technology feels reassuring or intrusive. They notice whether staff spend more time on screens. They experience the consequences of false alarms and fragmented information.

Meaningful feedback should therefore influence technology review.

That may include formal consultation, co-design, service-user groups, complaints, individual care reviews and observation of how people actually interact with technology.

This links smart care governance with service-user feedback and co-production rather than treating digital strategy as an exclusively professional function.

Future smart care assurance will need to govern systems rather than products

The next stage of digital care is likely to involve increasing convergence.

AI may analyse information produced by sensors. Workforce platforms may incorporate predictive scheduling. Robots may use machine learning to navigate and interact. eHealth infrastructure may support increasingly connected care journeys.

Individual product approval will therefore become less sufficient.

The organisation will need to understand the ecosystem.

A change in one system may influence another. Data created for one purpose may become input into a new analytic process. An apparently minor software update may alter an automated recommendation.

This means change control will become increasingly important.

Smart care governance cannot assume that a system remains the same product that was originally assessed.

The strongest assurance is proportionate, not obstructive

There is a risk that expanding governance creates bureaucracy around every innovation.

That would undermine the purpose of digital transformation.

Low-risk technologies should be capable of moving through proportionate review. Higher-risk systems should receive deeper scrutiny because they process sensitive information, influence important decisions or act physically around people.

A useful governance model therefore asks four questions:

• What can this technology do?
• What happens if it is wrong or unavailable?
• Who remains accountable for the resulting decision?
• What evidence will show whether it is actually improving care?

These questions are simple enough for operational leaders to use but strong enough to expose much of the hidden risk within connected care environments.

International learning: digital maturity requires institutional maturity

Hong Kong’s smart care environment is being shaped by a distinctive combination of government-supported gerontechnology, territory-wide electronic health infrastructure, residential-care reform, active privacy governance and a growing innovation sector.

Other jurisdictions will have different legal, funding and institutional arrangements.

The transferable lesson lies less in any individual programme than in the need to develop assurance alongside innovation.

Technology funding without governance can produce fragmented adoption. Regulation without implementation capability can slow useful change. The stronger model connects investment, workforce competence, privacy, security, quality evidence and service-user experience.

Other care systems can adapt that principle without replicating Hong Kong’s exact structures.

Conclusion

Hong Kong is entering a stage in which smart care governance will matter as much as smart care technology. AI, electronic health information, sensors, robotics and connected devices are increasingly capable of shaping how staff prioritise work, how risks are identified and how people experience care.

The strategic opportunity is substantial. Better systems can reduce duplication, improve continuity, support earlier intervention and give workers information that was previously difficult to assemble. But every additional connection also creates dependencies around data quality, cyber resilience, supplier performance and human oversight.

The strongest response is not to slow innovation unnecessarily. It is to make accountability move at the same speed.

Providers need to know which technologies influence important decisions, what information they depend upon, who can challenge automated outputs and what happens when systems become unavailable. Governance should also remain grounded in the person: whether technology improves independence, dignity, safety and human connection rather than merely increasing the amount of data available.

Hong Kong’s smart care future will therefore depend on more than technical sophistication. It will depend on whether organisations can connect innovation with transparent responsibility, proportionate risk control, workforce competence and continuous learning. The most mature services will not simply operate more technology. They will understand the combined care system that technology has created and be able to demonstrate why that system remains safe, accountable and centred on the people it exists to support.