The European Health Data Space (EHDS) is on its way – an overview

Nearly three years after the first draft, Regulation (EU) 2025/327 on the European Health Data Space (“EHDS Regulation”) was published in the Official Journal of the EU on 5 March 2025. The Regulation came into force on 25 March 2025 (twenty days post-publication). Various implementing acts are scheduled for adoption within two years of its entry into force. The Regulation will primarily take effect from 26 March 2027, although certain provisions will not apply until a later date, as detailed in Article 105 of the EHDS Regulation.

The EHDS Regulation consists of three main pillars. This overview outlines the upcoming changes and identifies who will be affected by them.

I. Natural persons are granted new rights relating to personal electronic health data – Primary use of personal electronic health data 

The first pillar addresses the primary use of personal electronic health data. 

While healthcare providers have already been obliged to document health data until now, they will have to record certain health data in EHR systems, i.e. in systems for electronic health records in the future (Article 13 of the EHDS Regulation).

All personal electronic health data classified under newly introduced priority categories is affected (see Article 14 of the EHDS Regulation).

This will apply from 26 March 2029 for patient summaries, electronic prescriptions and electronic dispensation. For other priority categories such as medical imaging and related findings, results from medical examinations and discharge reports), the requirements will take effect from 26 March 2031 (Art. 14 EHDS Regulation, Art.105 EHDS Regulation).

Natural persons will have the ability to exercise the following rights in relation to this personal electronic health data via one or more access services for electronic health data (e.g. a portal or an app). Member States are responsible for ensuring these services are established:

• Right of access to personal electronic health data which is in a priority category and is processed for healthcare purposes; this also includes the option to download in a European exchange format still to be developed (Article 3(1) and (2) of the EHDS Regulation)
• Establishing access restrictions for health professionals and healthcare providers (Article 8 of the EHDS Regulation)
• Right to information about data access (Article 9 of the EHDS Regulation)
• Right to rectification of personal electronic health data (Article 6 of the EHDS Regulation) and right to enter information (Article 5 of the EHDS Regulation)
• Right to (crossborder) data portability (Article 7 of the EHDS Regulation)
• Right to opt out from the primary use of data through access services (Article 10 of the EHDS Regulation).
• Appointment of digital representatives who can also obtain data access (see Article 4(2) of the EHDS Regulation)

Health professionals will have (cross-border) access to the data of the individuals they treat through their own access services (Articles 11 and 12 of the EHDS Regulation). This access will be based on the Myhealth@EU infrastructure, which has so far been available for voluntary use (Article 23 of the EHDS Regulation).

II. Improved and simplified access to data sets – Secondary use of personal electronic health data

The second pillar addresses the secondary use of personal electronic health data.

1. What is secondary use, and who has to provide what data?

Secondary use refers to the use of personal electronic health data for purposes other than direct patient care, such as research.

Health data holders are required to provide certain minimum categories of data for this purpose. These must include electronic health data from EHRs, clinical studies and certain medical registers (Article 51 of the EHDS Regulation). In the future, publicly available dataset catalogues and, in particular, an EU dataset catalogue will provide an overview of existing health data for secondary use as well as its quality and usability (Article 79 of the EHDS Regulation).

2. Who can apply for what types of secondary use?

Access to personal electronic health data for secondary use may be granted to natural or legal persons for the purposes specified in the Regulation (Article 67(1) of the EHDS Regulation).

For this purpose, an application for data permits must be submitted to national contact points for the secondary use of electronic health data. A data permit and the associated data access are granted if the strict legal requirements for data protection are met and the requested purposes correspond to the purposes defined in the EHDS Regulation (see Article 68 of the EHDS Regulation).

Permitted purposes include the public interest in the area of public health, policy-making and regulatory activities, educational and teaching activities and certain scientific research in the health or care sector, including development and innovation activities for products or services and the training, testing and evaluation of algorithms (e.g. in medical devices, in vitro diagnostics, AI systems and digital health applications; for details see Article 53 of the EHDS Regulation).

In addition, a health data request can be made if the request is only for an answer in an anonymised statistical format (Article 69 of the EHDS Regulation).

III. Requirements for EHR systems

The third pillar encompasses new regulations for EHR systems, which also include a few restrictions on wellness applications.

The term “EHR system” is broadly defined and refers to any system where software or a combination of hardware and software enables the storage, intermediation, export, import, conversion, editing or viewing of personal electronic health data from priority categories (Article 14 of the EHDS Regulation) and which is intended by the manufacturer for use by healthcare providers in patient care or by patients to access their electronic health data (Article 2(2)(k) of the EHDS Regulation).

In the future, EHR systems must incorporate two harmonised software components: the European interoperability software component for EHR systems and a European logging software component for EHR systems that tracks data access (see Article 25(1) of the EHDS Regulation). There will be no third-party assessment of product compliance for EHR systems. However, in accordance with Article 30(1) of the EHDS Regulation, manufacturers must, among other things, ensure the following for their EHR systems:

• Draw up technical documentation and keep it up to date based on the results of testing the software in a digital testing environment (still to be developed) (Articles 37 and 40 of the EHDS Regulation).
• Draw up an EU declaration of conformity (if declarations of conformity are required for a product under several legal acts, a single EU declaration of conformity covering all legal acts is issued; Article of the 39 EHDS Regulation).
• Affix the CE marking of conformity (Article 41 of the EHDS Regulation).
• Compliance with registration obligations (Article 49 of the EHDS Regulation); an EU database for registration of EHR systems and wellness applications will be established by the European Commission.

Further obligations are established for “quasi-manufacturers”, importers and distributors of EHR systems, as well as for wellness applications.

About the practice groups: Health Care & Life Sciences and Data, Tech & Telecoms