Council of the European Union approves the European Health Data Space: a shift towards the digital regulation of health data across the EU

Building on our previous insight, the European Union has taken a groundbreaking step in digital healthcare with the formal adoption of the European Health Data Space Regulation (“EHDS”). Approved by the European Council, this ambitious framework aims to revolutionise health data management across Member States, ensuring data handling, empowering patients, and fostering innovation through data interoperability and, in particular, encouraging secondary use of health data.

At the core of the EHDS is patient empowerment. Individuals are granted enhanced rights over their health data, including free access to their personal electronic health records in a consolidated, user-friendly format through electronic health data access services. This access will be immediate after data registration in an electronic health record (“EHR”) system, while respecting the need for technological practicability. 

Patients will also be able to download their data in a standardised European format, request corrections, exercise opt-out in primary use of data and share it with healthcare providers of their choice. They will also have the right to restrict access to sensitive parts of their records, although they will be informed of potential impacts on their healthcare. Additionally, Member States can allow individuals to add personal information to their EHRs, though they cannot alter data entered by health professionals.

To address data sharing across borders, the EHDS introduces a European electronic health record exchange format, ensuring interoperability between systems. Key measures include:

• Establishment of MyHealth@EU, a central interoperability platform for digital health to provide services to support and facilitate the exchange of personal electronic health data between the national contact points for digital health of the Member States. 
• EHR systems marketed in the EU must comply with standards for security, interoperability, and data logging.
• Introduction of two mandatory software components for EHR systems: the European interoperability software component and the European logging software component.

These efforts aim to eliminate fragmentation in health data systems and provide a cohesive framework for cross-border data sharing.

EHDS is also pivotal in establishing a comprehensive framework for the secondary use of health data, which will support research, innovation, and policy-making. In particular, health data holders are required to make specific categories of data available for purposes such as public health monitoring, medical research, and healthcare innovation. Data categories include, by way of example:

• Information from EHRs, genetic data, and administrative health records;
• Human genetic, epigenomic and genomic data; 
• Data on pathogens that impact human health; 
• Data from medical devices, wellness applications, registries, and biobanks, etc.

To ensure secure access, health data access bodies will oversee requests by health data users, ensuring data is used only for legitimate purposes and processed in secure environments that prevent re-identification, while establishing prohibited secondary use purposes pursuant to Article 54. MyHealthData@EU will also streamline the secondary use of data, as it will connect the national contact points for secondary use and authorised participants of the platform. While individuals can opt out of secondary use, exceptions may be made for public interest purposes, such as addressing health crises or conducting essential research.

Lastly, as to the governance and oversight mechanism, each Member State will establish one or more digital health authorities to oversee implementation and ensure compliance with the regulation. These authorities will work in tandem with the newly established European Health Data Space Board (“EHDS Board”), which will facilitate coordination among Member States and the European Commission. 

The EHDS will now be formally signed by the Council and the European Parliament and is set to enter into force 20 days after its publication in the EU’s Official Journal. While the general application of the EHDS is anticipated to commence 24 months after its entry into force, specific provisions are expected to be implemented in staggered phases:

• Primary use of health data:

The exchange of the first group of priority data categories, including patient summaries, electronic prescriptions, medical images, medical test results, and discharge reports, is expected to begin approximately two years after the EHDS enters into force.

The exchange of the second group of data categories, such as genomics and other -omics data, as well as data from wellness applications, is anticipated to start several years later.

• EHR systems:

Requirements for EHR systems, particularly concerning interoperability and logging, will be enforced in stages.

Manufacturers will be required to ensure that their EHR products comply with these requirements within specific timelines corresponding to the phased implementation of data categories.

• Secondary use of health data:

The framework for the secondary use of health data, which includes making data available for research, innovation, policy-making, and regulatory activities, is expected to be operational a few years after the EHDS enters into force.

Besides, these deadlines remain indicative and are subject to confirmation by the European Commission through a series of delegated acts. This phased approach allows Member States and stakeholders to adapt gradually to the new rules, facilitating a seamless transition and ensuring the effective implementation of the EHDS framework.

Authored by Giulia Mariuz, Giacomo Bertelli, and Alessandro Bacchilega.