European Health Data Space legislation
The European Health Data Space (EHDS) regulation was proposed by the European Commission in May 2022, and finalized in March 2024.
Throughout the legislative process, EHA has worked with other stakeholders, including the BioMed Alliance, to ensure the legislation is fit for purpose.
The legislation
Main aims
- Giving citizens access and control over their data.
- Supporting free movement by ensuring that health data follow people.
- Creating strict rules for the use of non-identifiable health data for research, innovation, and policy-making.
This should subsequently result in:
- Better diagnosis and treatment for patients across the European Union
- Informed policy and regulatory approaches
- Data-driven research and innovation
This is illustrated in the infographic below.
The EHDS makes a distinction between ‘primary use’ and ‘secondary use’ of health data.
Primary use of health data
Primary use is defined as the processing of health data solely for the provision of healthcare.
Within this scope, the regulation stipulates several rights for individuals with regard to their electronic health data. These are:
- The right to access their data
- The ability to share their data with health providers in any member state—i.e. data portability
- The right to obtain information on health provider access
- The right to restrict access to all/part of their health data
- The right to request rectification (although accuracy might have to be validated)
In addition, member states can give individuals a right to opt out and prevent their health data from being accessed. However, this right to opt out can be suspended if vital interests are at stake.
Secondary use of health data
Secondary use is defined as the processing of health data for purposes other than the provision of healthcare.
The following purposes fall within this scope:
- Policymaking, regulatory activities, statistics, and public interest activities—reserved for public sector bodies and EU institutions, bodies, and agencies
- Education and teaching
- Scientific research (strictly with the aim of benefiting end-users)
- Improvement of delivery of care and treatment optimization
The EHDS also prohibits certain uses of data, including:
- Developing products/services that can cause harm to individuals, society, or public health
- Advertising or marketing activities
- Taking decisions detrimental to individuals
Access to health data
Access to health data for the aforementioned lawful purposes requires a data permit, subject to strict criteria.
For instance:
- The requested data must be necessary, adequate, and proportionate
- The applicant must have a qualification linked to the intended purposes of data use and have appropriate expertise
- The applicant must put safeguards in place to prevent misuse of the data
When a permit is granted, the researcher or company will receive access to the sought anonymized or pseudonymized health data. In order to receive data in pseudonymized format, an additional justification is necessary.
Patients’ say over their health data
In addition, the EHDS defines the following rights for natural persons, when it comes to the processing of their health data for secondary use.
Patients can:
- Opt out at any time (reversible)
- Get insights into who has access to their data and for which purpose
- Access information on the outcomes derived from the project in which their health data was used
Member states' discretion
The legislation leaves room for member states to:
- Circumvent the patient opt-out, but only under strict conditions
- Implement stricter safeguards for sensitive categories of data (e.g. genetic, genomic data), which could include an opt-in
Implementation
The regulation establishes a Stakeholder Forum, in order to:
- Enable the exchange of information
- Promote cooperation with stakeholders on the implementation of the legislation
Depending on the provision, the implementation will take two, four, or even six years.
Find out more
For more information regarding the EHDS, you can contact Tamara Almeida at t.almeida@ehaweb.org.
Back