Europe is building the cross-border medical record. Medical tourism isn't in it.

The CDC has documented what happens when a patient's care ends at the airport. The EU has legislated the infrastructure that would prevent it — and left a door open for third countries. The industry chasing millions of international patients has not walked through it.

Two things happened this year that belong in the same sentence, and so far have not been put there.

In June, CDC researchers published a review in Emerging Infectious Diseases of adverse outcomes among US residents who travelled for elective cosmetic procedures between 2014 and 2024. Among 21 reports covering roughly 145 patients, post-surgical infections appeared in 20 consultations, twelve involving suspected or confirmed nontuberculous mycobacteria. Four consultations involved patient deaths. The authors noted that patients were frequently scattered across multiple states, which made the clusters difficult to detect and investigate.

Separately, the European Union's Health Data Space regulation entered into force in March 2025 and begins to apply in March 2027. Under it, every member state must be able to exchange patient summaries and ePrescriptions across borders by March 2029. Medical images, laboratory results and hospital discharge reports follow by 2031. The infrastructure carrying them, MyHealth@EU, is explicitly open to applications from third countries and international organisations.

Set those side by side. One is a record of what happens when a patient's medical information does not travel home with them. The other is a functioning legal mandate to make exactly that information move across borders.

The countries competing hardest for international patients are in neither. India has set a target of 10 million medical value travellers a year. Thailand, Turkey, Mexico, the UAE and Malaysia are pursuing the same patients. None of this growth is currently attached to any mechanism for getting a discharge report from the treating hospital to the doctor who will manage the complication.

That is the medical tourism safety gap, and it is an infrastructure problem before it is an ethics problem.

The returning patient is an information problem

Picture a patient home from surgery abroad who develops fever, swelling and drainage at the incision.

The clinical problem is visible. The second problem is not. The doctor now treating her needs to know what procedure was performed and when, which prophylactic antibiotics were given, whether cultures were taken, what implant or device was used, whether there were complications during admission, and what she has already been prescribed. CDC's guidance for clinicians assessing ill returning travellers is direct on this point: details of healthcare received abroad and of antimicrobial use materially affect diagnosis and management, particularly given the international movement of highly resistant organisms.

What that clinician typically has instead is the patient's recollection, photographs on a phone, and a folder of documents possibly in another language, possibly missing the operative report, possibly using drug names and device identifiers that do not resolve to anything in her local formulary.

In cross-border care, the medical record is not paperwork. It is a clinical input, and its absence is a clinical risk.

Nobody tells the hospital abroad

The dispersion the CDC researchers describe creates a second failure that gets almost no attention.

Suppose four patients acquire infections after procedures at the same overseas facility, and return to four different cities. Each is treated locally. Each looks like an isolated post-operative infection. If a state health department eventually assembles the pattern and CDC is consulted, the outbreak may be identified. That is roughly how the cases in this review surfaced.

Now ask what happens next in the other direction. Who informs the hospital that performed the operations? Which regulator in the destination country is notified? What obligation exists to act on it?

In most cases the answer is that there is no route back. A facility can generate complications in patients who disperse across a continent and never learn of it, because every signal it produces is detected somewhere it has no relationship with. Detection runs one way. Accountability does not run at all.

An industry that wants to move millions of patients a year cannot leave that loop open indefinitely.

Europe is five years from solving a version of this. The rest of the world is not trying.

What makes the EU timeline worth studying is not that it is fast. It is not. Discharge reports are not a mandatory cross-border category until 2031, and the practical question of whether an exchanged patient summary is clinically complete remains unresolved. Europe is spending a decade and a regulation on a problem that is narrower than the one medical tourism has, since it operates inside a single regulatory bloc with shared data law.

But the direction is instructive, and the third-country provision is the part the medical travel sector should be reading. A destination country serious about long-term international patient volume has an obvious move available: adopt the European electronic health record exchange format for its international patient discharges, and pursue connection to the infrastructure being built around it. That converts a marketing claim about quality into an interoperability commitment that another country's health system can verify.

No hospital needs to wait for 2031 to do the underlying work.

What accountability looks like before the infrastructure arrives

Four things can be specified in a treatment agreement today.

A structured discharge package, issued in English and in the patient's language where they differ, containing the final diagnosis, the operative report, pathology, relevant imaging, medications administered and prescribed, implant and device identifiers with lot numbers, complications, and the follow-up plan. The standard is simple: a physician who has never met this patient should be able to reconstruct what happened without calling anyone.

A named accountable clinician, with a working contact route, who remains reachable after the patient has flown home and is obliged to respond to a treating physician abroad. Not an international patient desk that closes at six.

Explicit terms for complications, covering who pays for what, for how long, and under which circumstances. A patient who pays $12,000 overseas rather than $40,000 at home has not saved $28,000 if an unplanned readmission at home costs $30,000 and no one accepts it. The lowest procedure price is not the lowest episode cost, and transparent pricing that stops at the operation is not transparent.

A travel-readiness assessment treated as a clinical decision rather than a booking one. Discharge from a hospital is not clearance for a twelve-hour flight, and CDC notes that surgery and air travel independently raise clotting risk.

None of this is technically hard. It is unassigned, which is a different problem.

A metric the industry could actually report

Medical travel operators publish patients served, hospitals in network, countries covered, and money saved. Every one of those is counted at the point of sale.

A more useful set would be counted at the other end. What share of patients left with a complete structured discharge package? What share had a documented, named follow-up clinician at home before they travelled? What share required unplanned medical care after returning? In how many cases did a physician-to-physician handoff actually occur? And how many episodes of care were formally closed rather than simply abandoned when the patient's flight landed?

Call it continuity completed. Unlike volume, it measures something the patient cares about and the operator cannot fake, because the receiving clinician either got the records or did not.

The measure of international healthcare

None of this argues against crossing borders for treatment. Patients find expertise abroad that does not exist near them and prices that make otherwise impossible care possible, and the CDC's own review included procedures performed domestically, which should dispose of the idea that geography is the variable. It is not. Fragmentation is. Distance simply makes fragmentation worse, because it separates a patient from their clinicians, their records, their regulator and their insurer simultaneously.

Before treatment thousands of miles from home, patients are told to ask whether the surgeon is qualified, the hospital accredited, the price complete. They should be able to ask one more, and get an answer in writing.

If something goes wrong after I get home, who is still responsible for me?

Europe has decided that question deserves an infrastructure. The industry selling cross-border care to millions of people has not yet decided it deserves an answer.

Chida Khatua is the founder of Healing Tourist (healingtourist.com), a medical second-opinion and treatment-facilitation platform built around independent specialist review before travel and continuity of records after it.