European Health Data Space Regulation

Article 1 Subject matter and scope

This regulation sets up common rules, standards, infrastructure and governance for primary and secondary use of electronic health data, specifying and extending GDPR rights for personal electronic health data, mandating requirements for EHR systems and interoperable wellness applications, and establishing cross-border infrastructure and Union and national governance mechanisms. It does not affect contractual or administrative access arrangements between entities, national laws granting public bodies or public-interest entities access to health data, or processing by competent authorities for crime prevention, investigation or prosecution outside Union law.

Article 2 Definitions

The section incorporates definitions from GDPR, the cross-border healthcare directive, the Data Act, product safety regulation, medical device regulations, eID regulation and public procurement law, and defines key terms including personal electronic health data (health and genetic data in electronic form), non-personal electronic health data (anonymised or never-personal data), primary use (healthcare provision and related services), and secondary use (processing for other specified purposes). It defines interoperability as the ability to interact and exchange information between organisations and systems without altering data, EHR systems as software for storing and managing health data for patient care and personal access, EHR as a collection of electronic health data for one person, and two mandatory software components: the interoperability component that exchanges priority health data in European format and the logging component that records access to priority categories. The section also defines serious incident as EHR system malfunctions causing or potentially causing death, serious harm, serious rights violations or critical infrastructure disruption; health data holders as organisations controlling health data with rights to process it for healthcare, care, research or public health purposes; health data users as entities granted lawful secondary use access through data permits or health data access bodies; dataset catalogue as a systematic collection of dataset descriptions with a public-oriented component accessible electronically through an online portal; data quality as the suitability of electronic health data elements for their intended primary or secondary use; and wellness application as software or combined hardware-software intended for processing electronic health data to provide information about or deliver care for non-healthcare purposes.

Article 3 Right of natural persons to access their personal electronic health data

Grants individuals the right to free access their personal health data in priority categories through electronic services immediately after registration, in a readable and accessible format. Allows free downloading of health records in a standardized exchange format, though member states may delay access temporarily for patient safety or ethical reasons pending communication from a health professional.

Article 4 Electronic health data access services for natural persons and their representatives

Requires member states to establish free electronic services enabling individuals to access their health data and exercise related rights. Services must include proxy functions allowing individuals to authorize others to access their data, must be interoperable across member states, and must be accessible to persons with disabilities and low digital literacy.

Article 5 Right of natural persons to insert information in their own EHR

Allows individuals or their legal representatives to add information to their electronic health record through designated services, with such additions clearly marked as user-entered. Individuals cannot directly modify information entered by health professionals.

Article 6 Right of natural persons to rectification

Requires electronic health data access services to allow individuals to request corrections to their health data online in accordance with data protection rules. The controller may verify accuracy with a relevant health professional. Member states may also enable individuals to exercise other data rights through these services.

Article 7 Right to data portability for natural persons

Patients may request their healthcare providers to share all or some of their electronic health data with other providers at no cost and without obstruction. Cross-border data transfers must use the specified exchange format and infrastructure. Patients can also request transmission of data to social security or reimbursement bodies, and may share downloaded health records with new providers in the prescribed format.

Article 8 Right to restrict access

Patients can limit which health professionals and providers can view parts of their electronic health data. Patients must be informed that restrictions may affect healthcare quality. Members states set rules for restriction mechanisms, and healthcare providers cannot see which data patients have restricted.

Article 9 Right to obtain information on accessing data

Patients have the right to learn about any access to their electronic health data through automatic notifications. This information must include who accessed the data, when, and which records were viewed, must be free and provided without delay, and must remain available for at least three years. Member states may limit this right in exceptional circumstances to protect health professionals or patients.

Article 10 Right of natural persons to opt out in primary use

Member states may allow patients to opt out from health professionals accessing their electronic health records through the access services, with the ability to reverse this choice. Where such opt-out exists, member states may permit access without patient consent only to protect vital interests of the patient or others.

Article 11 Access by health professionals to personal electronic health data

Health professionals processing digital data must be able to access relevant and necessary records of their patients through dedicated services, regardless of member state boundaries. They must access at least the priority categories, with member states defining which health professionals can access what data. Access to restricted records is not disclosed to providers, but emergency access to restricted data is permitted to protect vital interests and must be logged.

Article 12 Health professional access services

Member states must provide health professionals at no cost with access to priority health data categories through dedicated services, including for cross-border care, using recognised electronic identification. The data must be presented in a user-friendly format in electronic health records.

Article 13 Registration of personal electronic health data

Healthcare providers must register patient health data in electronic format covering at least the priority categories in electronic health record systems, and keep them current. Cross-border registrations must use the patient's identification from their home member state. The Commission will set data quality requirements by March 2027, and registrations must identify who entered the data and when.

Article 14 Priority categories of personal electronic health data for primary use

The priority data categories are: patient summaries, prescriptions, dispensations, medical imaging with reports, test results with reports, and discharge reports. Member states may add more categories, and the Commission may set cross-border specifications and update characteristics through implementing acts based on technical developments and usage across member states.

Article 15 European electronic health record exchange format

By March 2027, the Commission will establish technical specifications for a common, machine-readable format for exchanging priority health data categories between software, devices and providers, including harmonised datasets, coding systems, and interoperability standards. The Commission will provide regular updates and may extend the format to other data categories. Member states must issue priority data in this format, and receiving providers must accept and read it.

Article 16 Identification management

Individuals accessing electronic health data services may identify themselves using any electronic identification means recognized under the eIDAS regulation, with Member States able to add complementary verification procedures for cross-border cases. The Commission shall establish technical requirements for an interoperable cross-border identification and authentication system that enables transferable personal electronic health data across borders, which both the Commission and Member States shall implement at their respective levels.

Article 17 Requirements for technical implementation

The Commission shall set out the technical requirements for implementing the rights established in this Section through implementing acts.

Article 18 Compensation for making personal electronic health data available

Healthcare providers who receive data shall not be entitled to financial compensation for sharing it, and data subjects shall not be charged fees or costs, either directly or indirectly, for accessing or sharing their personal electronic health data.

Article 19 Digital health authorities

Each Member State must designate one or more digital health authorities to implement and enforce this Chapter at national level with notification to the Commission by 26 March 2027, with one authority coordinating where multiple are designated. These authorities must implement rights and obligations through technical solutions, provide implementation information, ensure compliance with the regulation, develop technical solutions and common specifications for electronic health record exchange, perform market surveillance, handle risks and incidents, facilitate accessibility for persons with disabilities, and cooperate with relevant entities and supervisory authorities on interoperability, portability and security. Member States must ensure digital health authorities have necessary human, technical, financial resources, premises and infrastructure, avoid conflicts of interest, act independently in the public interest, and actively cooperate and consult with stakeholders including patients' representatives, healthcare providers, health professionals and their associations, consumer organisations and industry associations.

Article 20 Reporting by digital health authorities

Designated digital health authorities must submit a biennial activity report describing their efforts to implement this Regulation and detailing matters such as user access to health records, exercise of citizen rights, healthcare provider connections to MyHealth@EU, cross-border data sharing volumes, and non-compliance cases. If multiple authorities exist in one Member State, one shall coordinate the submission.

Article 21 Right to lodge a complaint with a digital health authority

Natural and legal persons may lodge complaints with the competent digital health authority if their rights or interests are negatively affected, and the authority shall transmit complaints involving personal data rights to data protection supervisory authorities, cooperate across borders on related complaints, and facilitate accessible complaint submission procedures.

Article 22 Relationship with supervisory authorities under Regulation (EU) 2016/679

Data protection supervisory authorities responsible for the GDPR shall also monitor and enforce compliance with the personal data rights in this Regulation, empowered to impose administrative fines, and shall cooperate with digital health authorities in their respective enforcement roles.

Article 23 MyHealth@EU

The Commission will create MyHealth@EU, a central interoperability platform enabling Member States to exchange personal electronic health data through single national contact points that each Member State must establish by 26 March 2027 to connect with all other Member States' contact points and healthcare providers, with the Member State explaining task distribution if the contact point comprises multiple organisations. Pharmacies, including online ones, in each Member State must be able to fill prescriptions from other Member States through MyHealth@EU and report dispensation back to the originating Member State's contact point. National contact points act as joint controllers of exchanged health data whilst the Commission acts as processor, sets rules for cybersecurity, interoperability and service management, and verifies connection conditions through compliance checks.

Article 24 Supplementary cross-border digital health services and infrastructures

Member States may offer additional services through MyHealth@EU such as telemedicine, mobile health, health data translations, health certificate verification and vaccination services. The Commission and Member States may facilitate health data exchange with other infrastructures like patient management systems, subject to Commission approval based on compliance checks. Third countries' contact points and international organisations' systems can participate in MyHealth@EU if they meet equivalent technical, security and legal requirements and comply with EU data transfer rules.

Article 25 Harmonised software components of EHR systems

EHR systems must incorporate a European interoperability component and a European logging component. General purpose software used in healthcare environments is excluded from these requirements.

Article 26 Placing on the market and putting into service

Electronic health record systems may only be introduced to the market or deployed if they satisfy this Regulation's requirements. Systems created within Union health institutions or offered as services to Union entities are considered deployed. Member States cannot forbid compliant systems based on regulatory aspects of their harmonised software components.

Article 27 Relation to Union law governing medical devices, in vitro diagnostic medical devices and AI systems

Makers of medical devices, diagnostic devices, and high-risk AI systems claiming compatibility with EHR systems' standardised components must demonstrate compliance with interoperability and logging requirements specified in this Regulation and are subject to its conformity procedures.

Article 28 Claims

Marketing and informational materials for EHR systems must not mislead professional users about the systems' functions, interoperability, security, or intended purpose, and must clearly disclose any significant limitations.

Article 29 Procurement, reimbursement and financing

Member States may establish their own rules for procuring, financing or reimbursing EHR systems in healthcare delivery, provided these comply with Union law and do not undermine the functioning of the harmonised software components.

Article 30 Obligations of manufacturers of EHR systems

Manufacturers must ensure their EHR systems and harmonised software components meet essential requirements and common specifications, maintain technical documentation, prepare conformity information sheets and instructions, make EU declarations of conformity, affix CE marking, provide accessible contact details and register as required, take corrective action or recall non-conforming systems, notify authorities and users of non-conformity, supply documentation to market surveillance authorities, establish complaint channels and registers, and ensure design, development and deployment continue to comply with requirements. Manufacturers must retain technical documentation and EU declarations for 10 years after placing systems on the market and provide source code or programming logic to authorities upon reasoned request if necessary to verify compliance. EU-based manufacturers' authorised representatives must have required documentation readily available, and manufacturers must cooperate with market surveillance authorities on risk mitigation measures.

Article 31 Authorised representatives

Manufacturers based outside the Union must appoint an authorised representative in the Union prior to market entry. The representative must maintain documentation, respond to authorities, inform the manufacturer of compliance issues and consumer complaints, and may be held jointly liable for non-compliance.

Article 32 Obligations of importers

Importers must only place EHR systems on the market that comply with essential requirements and common specifications, verified through checking manufacturer technical documentation, EU declaration of conformity, CE marking, conformity information sheet, and use instructions in accessible formats; provide their contact details as single point of contact without obscuring manufacturer information; ensure systems are not altered in ways that compromise conformity; and not place non-conforming systems on the market or must recall or withdraw them, notifying manufacturers, users and market surveillance authorities without undue delay if a system is non-conforming or poses health or safety risks. Importers must retain the EU declaration of conformity and make technical documentation available to market surveillance authorities, provide information and documentation to demonstrate conformity, cooperate with authorities and manufacturers on compliance, establish publicly accessible complaint channels for users, maintain complaint and recall registers, investigate incidents, and keep manufacturers and distributors informed of investigation results.

Article 33 Obligations of distributors

Distributors must confirm before marketing an EHR system that manufacturers have prepared conformity documentation, the system bears required markings, and information is provided in accessible formats. Distributors must prevent alterations compromising conformity, must not market non-conforming systems, and must inform relevant authorities and supply chain partners of non-conformity or safety concerns.

Article 34 Cases in which obligations of manufacturers of an EHR system apply to other entities or individuals

Importers, distributors or users are treated as manufacturers when they market an EHR system under their own brand, substantially modify an existing system in ways affecting conformity, or change the system's intended purpose in a manner that impacts compliance.

Article 35 Identification of economic operators

Economic operators must identify their suppliers and customers in the EHR system supply chain to market surveillance authorities upon request, maintaining this information for ten years from when the last system covered by a conformity declaration was placed on the market.

Article 36 Common specifications

When common specifications on interoperability and security of EHR systems involve medical devices, in vitro diagnostic devices or high-risk AI systems under other laws, the Commission may consult the Medical Device Coordination Group, the European Artificial Intelligence Board or the European Data Protection Board beforehand. When common specifications for those other device and system types affect EHR systems, the Commission must consult the EHDS Board and the European Data Protection Board.

Article 37 Technical documentation

Manufacturers must prepare and maintain technical documentation before marketing showing compliance with essential requirements, including minimum elements from applicable annexes and testing results. Documentation must be in local official language or easily understood language, with translations provided upon authority request within 30 days or less for urgent safety risks.

Article 38 Information sheet accompanying the EHR system

EHR systems must be accompanied by clear information including manufacturer identity and contact details, system name and version, intended purpose, data categories processed, and supported standards and formats. Alternatively, manufacturers may register this information in a designated EU database instead of providing a physical information sheet.

Article 39 EU declaration of conformity

Manufacturers must declare that EHR systems meet essential requirements, combining declarations where systems are subject to multiple EU legal acts. Declarations must contain required identification information, be translated to relevant official languages, and if digital must remain accessible online for at least ten years from market placement.

Article 40 European digital testing environment

The Commission shall establish an open-source European digital testing environment and issue common specifications for it. Member States must operate their own testing environments compliant with these specifications. Manufacturers are required to use these environments to assess harmonised software components of EHR systems before placing them on the market, with positive assessment results creating a presumption of conformity.

Article 41 CE marking of conformity

EHR systems must be affixed with a visible, legible and permanent CE marking on accompanying documents and packaging before being placed on the market, following the general principles established in the referenced product liability regulation.

Article 42 National requirements and reporting to the Commission

Member States may establish their own requirements for EHR systems regarding aspects other than harmonised software components, provided these do not adversely affect the harmonised elements, and must notify the Commission of such requirements.

Article 43 Market surveillance authorities

Member States must designate market surveillance authorities with adequate powers and resources to enforce EHR system requirements. These authorities shall report yearly to the Commission, cooperate with each other and the Commission, and have powers to restrict non-cooperating manufacturers or prohibit non-compliant systems from the market. For medical devices and high-risk AI systems, existing sector-specific authorities assume this role.

Article 44 Handling of risks posed by EHR systems and of serious incidents

Market surveillance authorities must evaluate EHR systems suspected of posing risks to health, safety, personal rights or data protection, requiring manufacturers and economic operators to cooperate and take corrective action or remove systems from the market; findings of non-compliance extending beyond one Member State must be reported to the Commission and other Member States, with immediate alerts to data protection supervisory authorities where personal data is concerned. Manufacturers must report serious incidents to market surveillance authorities where they occurred and where EHR systems are placed on market, within three days of establishing or reasonably believing in a causal link, describing corrective actions. Market surveillance authorities must promptly inform each other and the digital health authority of incidents, risks and corrective actions, and may demand immediate corrective action where patient safety or information security is threatened.

Article 45 Handling of non-compliance

Market surveillance authorities must require manufacturers to correct non-compliance with essential requirements, common specifications, or documentation and registration obligations by a set deadline. If corrective action fails, authorities may prohibit, restrict or recall non-compliant EHR systems, and must inform the Commission and other Member States; measures become justified if not objected to within three months. Persistent non-compliance triggers removal from market.

Article 46 Union safeguard procedure

When national measures are contested or the Commission believes they breach Union law, the Commission shall consult with relevant authorities and operators, then adopt an implementing decision on whether the measure is justified. If justified, all Member States must remove the non-compliant system from their market; if unjustified, the Member State must revoke the measure.

Article 47 Labelling of wellness applications

Wellness application makers claiming EHR compatibility must provide a label indicating which data categories comply with essential requirements, citing the applicable common specifications, and stating the label's validity period, which must not exceed three years. Distributors shall display the label to buyers in electronic form at the sales point.

Article 48 Interoperability of wellness applications with EHR systems

Manufacturers of wellness applications may claim compatibility with EHR systems if they meet relevant standards and must inform users of the compatibility and its implications. Data sharing or transmission from wellness applications to EHR systems requires explicit consent and is limited to specified purposes; manufacturers must allow users to choose which data categories are shared and under what conditions.

Article 49 EU database for registration of EHR systems and wellness applications

The Commission establishes and maintains a public database registering EHR systems with conformity declarations and wellness applications with issued labels. Manufacturers must register required data before placing their systems or applications on the market or putting them into service, and must forward related data to the database if the products are also regulated as medical devices or high-risk AI systems.

Article 50 Applicability to health data holders

Individual natural persons and microenterprises are exempt from secondary use obligations in this chapter, but Member States may apply these obligations to them under national law. Member States may designate health data intermediary entities to fulfill certain obligations on behalf of health data holders and must notify the Commission of such national provisions.

Article 51 Minimum categories of electronic health data for secondary use

Health data holders must make available numerous categories of data for secondary use, including records from electronic health systems, genetic and molecular data, data from medical devices and wellness applications, healthcare resource and expenditure data, registry data from clinical trials and biobanks, and other specified categories. Member States may require additional categories, introduce stricter protections for sensitive data types, or allow data holders to improve data quality through processing.

Article 52 Intellectual property rights and trade secrets

Data protected by intellectual property, trade secrets, or regulatory exclusivity must still be made available for secondary use but with safeguards; holders must identify protected content to the access body. Access bodies must implement legal, organizational and technical measures to protect such rights, may impose conditions when granting access, and may refuse access only if serious infringement risks cannot be adequately mitigated.

Article 53 Purposes for which electronic health data can be processed for secondary use

Grants permission for health data access bodies to allow processing of electronic health data for secondary purposes including public health protection, policy-making, statistics, education, scientific research, and care delivery improvement. Public sector bodies are restricted to accessing data for public health, policy-making, and statistical purposes, while other entities may access data for research, education and care optimisation.

Article 54 Prohibited secondary use

Prohibits using electronic health data to make harmful decisions affecting individuals or groups, discriminate against people based on health information, conduct advertising activities, develop harmful products, or conduct unethical activities. These restrictions apply to all health data users processing data via data permits or approved health data requests.

Article 55 Health data access bodies

Each Member State must designate one or more public sector health data access bodies to manage access to health data under the Regulation, potentially designating a coordinator if multiple bodies exist. Member States must equip these bodies with adequate human, financial, technical and premises resources, and must ensure they avoid conflicts of interest through organisational safeguards and engage actively with stakeholders while acting independently in the public interest.

Article 56 Union health data access service

Authorizes the Commission to perform the tasks of health data access bodies when data originates from Union institutions, bodies, offices and agencies, with full responsibility for allocating necessary resources and performing oversight functions under the regulation.

Article 57 Tasks of health data access bodies

Health data access bodies must decide on applications to access electronic health data for secondary use, issue data permits, and approve health data requests; manage access through secure processing environments; monitor and supervise users and holders' compliance; process and pseudonymise or anonymise data; protect confidential information; cooperate with holders on data quality; maintain systems recording applications, permits, and decisions; publish catalogues, applications, decisions, and non-compliance measures; and facilitate cross-border access through HealthData@EU. Health data access bodies must cooperate with data protection supervisory authorities, the EHDS Board, stakeholders including patient organisations and researchers, and other national competent bodies. They may provide assistance to public sector bodies accessing electronic health data and support them in processing and combining data for joint analysis under specified regulations.

Article 58 Obligations of health data access bodies towards natural persons

Requires health data access bodies to publicly disclose the legal basis, technical safeguards, individual rights, access arrangements, contact information, and outcomes related to secondary data use. Bodies must facilitate opt-out procedures, inform data holders about significant health findings, and inform the public about their role and benefits.

Article 59 Reporting by health data access bodies

Health data access bodies must release a public biennial activity report containing standardized information on data access applications, user compliance, audit results, data protection requests, stakeholder engagement, revenues, processing timelines, data quality labels, and resulting research publications and digital products. The coordinating body submits the report to the Commission and EHDS Board within six months of the reporting period's end.

Article 60 Duties of health data holders

Health data holders must provide electronic health data to the health data access body within three months upon approval of a data permit or health data request, and maintain accurate dataset descriptions in the national catalogue on an annual basis. Non-personal health data must be accessible through trusted open databases with transparent governance, and holders must provide documentation to verify any quality and utility labels.

Article 61 Duties of health data users

Health data users may process electronic health data only in accordance with approved permits or requests and must not re-identify individuals or grant third-party access beyond those named in the permit. They must publish results of secondary use in anonymous form within eighteen months, acknowledge data sources, inform the access body of significant health findings, and cooperate with oversight activities.

Article 62 Fees

Health data access bodies and trusted data holders may charge proportionate fees not restricting competition, covering assessment and processing costs including consolidation, pseudonymisation and provision. Member States may set reduced fees for public sector bodies, Union institutions with public health mandates, university researchers or microenterprises. Fees must be transparent and non-discriminatory; where parties disagree within one month of permit issuance, the access body may set fees proportionate to costs.

Article 63 Enforcement by health data access bodies

Health data access bodies have the right to request information to verify compliance and must notify users or holders within four weeks of finding non-compliance; if data protection law may be breached, they must immediately inform supervisory authorities. For user non-compliance, bodies may revoke data permits and exclude users from EHDS access for up to five years. For holder non-compliance such as manifestly obstructing access or breaching Article 60(2) deadlines, bodies may impose daily periodic penalty payments or exclude holders from submitting applications for up to five years, though excluded holders remain obliged to make data accessible.

Article 64 General conditions for the imposition of administrative fines by health data access bodies

Health data access bodies must impose administrative fines that are effective, proportionate and dissuasive, considering factors such as breach gravity, intent, cooperation and prior penalties. Breaches of duties in Articles 60 and 61 incur fines up to EUR 10 million or 2% of worldwide annual turnover whichever is higher; multiple infringements for the same permit or request are capped at the most serious breach's amount. Higher-tier breaches including unauthorized processing under Article 54, extracting personal data from secure environments, re-identifying data subjects, or non-compliance with enforcement measures incur fines up to EUR 20 million or 4% of worldwide annual turnover whichever is higher.

Article 65 Relationship with supervisory authorities under Regulation (EU) 2016/679

Data protection supervisory authorities under the GDPR have competence to enforce and impose fines regarding the right to opt out from processing personal electronic health data, and must cooperate with health data access bodies in enforcing this regulation within their respective areas of responsibility.

Article 66 Data minimisation and purpose limitation

Health data access bodies must provide only adequate, relevant and necessary electronic health data in line with stated purposes and issued permits, preferring anonymised data where the applicant's goals can be met, but allowing pseudonymised data when the applicant demonstrates anonymisation would prevent achieving the intended purpose.

Article 67 Health data access applications

A health data access application must include the applicant's identity and professional functions, intended purposes, detailed explanation of data use and expected benefits, description of requested data including scope and format, whether data should be pseudonymised or anonymised with justification, planned safeguards against misuse and re-identification, duration needed in the secure processing environment, tools and computing resources required, and any ethical assessment or exception justification. For data held across multiple Member States, a single application is submitted through the applicant's home Member State's access body, the relevant data holder's Member State, or the Commission's HealthData@EU services, and is automatically forwarded to relevant participants; applications for pseudonymised data must describe compliance with EU data protection law, particularly GDPR Article 6(1). Public sector bodies and EU institutions provide the same information except regarding data access frequency rather than a specific period.

Article 68 Data permit

Health data access bodies assess whether purposes match Article 53(1), data are necessary and proportionate, processing complies with GDPR Article 6(1), the applicant is qualified with appropriate expertise, technical and organisational safeguards are sufficient, ethical assessments comply with national law, and all Chapter requirements are met, while considering risks to national defence, security, public order and governmental database confidentiality; the body grants a permit if requirements are fulfilled and risks sufficiently mitigated, or may offer an anonymised statistical response alternative if risks are mitigated and the applicant agrees. A data permit specifies data categories and format, processing purpose, authorised persons, duration, technical tools, fees and specific conditions; it lasts as long as necessary for the requested purposes, not exceeding 10 years, and may be extended once for up to another 10 years if the user provides justification one month before expiry. Data must be deleted within six months of permit expiry; higher fees may apply for storage beyond the initial period.

Article 69 Health data request

Applicants may request anonymised statistical responses only, providing details of their identity, purposes, requested data, statistical content, safeguards against misuse, and legal basis, and access bodies must assess completeness and risks within three months and provide responses within a further three months where possible.

Article 70 Templates to support access to electronic health data for secondary use

The Commission shall establish by 26 March 2027 implementing acts creating templates for health data access applications, data permits and health data requests to standardise submission and evaluation procedures.

Article 71 Right to opt out from the processing of personal electronic health data for secondary use

Individuals may opt out at any time without reason from secondary use of their personal electronic health data and may reverse the opt-out; Member States must provide an accessible mechanism for this right. After opt-out, data cannot be provided for new permits or requests approved after opt-out takes effect, though existing permits and requests approved before opt-out remain valid. Any national mechanism permitting access to opted-out data must be necessary and proportionate for legitimate scientific or societal objectives in a democratic society with specific safeguards for individual safety and rights, and must comply with Chapter prohibitions including those on re-identifying individuals; Member States must notify the Commission promptly of such provisions and amendments.

Article 72 Simplified procedure for access to electronic health data from a trusted health data holder

Article 73 Secure processing environment

Health data access bodies must provide access to electronic health data through a secure processing environment with technical, organisational, security and interoperability measures including: limiting access to authorised individuals, minimising risks of unauthorised reading or modification, restricting data input and modification to identifiable staff, ensuring users can only access data covered by their permit, maintaining access logs for at least one year, and monitoring security. The bodies must enable health data holders to upload data in specified formats and ensure users download only non-personal data; they must conduct regular audits by third parties and correct identified shortcomings. Data altruism organisations processing personal data must meet the same security requirements.

Article 74 Controllership

The health data holder is responsible for providing data to the access body, while the access body is responsible for processing it; however, the access body acts as a processor under the data user's control when operating secure processing environments. Trusted data holders similarly bear responsibility for their processing but act as processors when providing data through secure environments.

Article 75 HealthData@EU

Each Member State must designate a national contact point for secondary use and a cross-border health data access gateway, and inform the Commission by 26 March 2027; the Union health data access service acts as contact point for Union institutions. All contact points and the Union service must connect to HealthData@EU, a cross-border infrastructure for secondary use, and national contact points and authorised participants must acquire technical capability to connect to and operate within it. The Commission shall develop, deploy and operate HealthData@EU's central platform to exchange information between access bodies, and by 26 March 2027 must establish implementing acts setting technical specifications for state-of-the-art security, conditions for joining and remaining connected including grounds for exclusion, minimum criteria for participants, controller and processor responsibilities, and interoperability with other EU data spaces.

Article 76 Access to cross-border registries or databases of electronic health data for secondary use

For cross-border registries or databases, the competent health data access body is determined by the location of a joint controller or the network coordinator, and this body decides on applications for data access permits. Where registries from multiple Member States form a network at EU level, the health data access body in the coordinator's Member State handles all access applications.

Article 77 Dataset description and dataset catalogue

Health data access bodies must maintain a public, standardised, machine-readable catalogue with metadata about available datasets, including their source, scope, characteristics and access conditions, in at least one Union language. By 26 March 2027, the Commission will establish minimum elements that dataset holders must provide.

Article 78 Data quality and utility label

Datasets funded with public money must display a quality label covering documentation, technical quality, management processes, coverage, access timeframes, and data modifications. Health data access bodies may revoke labels found to be inaccurate, and the Commission will set visual and technical specifications for labels by 26 March 2027.

Article 79 EU dataset catalogue

The Commission shall establish a publicly available EU dataset catalogue that connects national catalogues from health data access bodies and catalogues of authorised HealthData@EU participants.

Article 80 Minimum specifications for datasets of high impact

The Commission may adopt implementing acts to set minimum specifications for high-impact datasets used in secondary use, taking into account existing Union infrastructure, standards and guidelines.

Article 81 Right to lodge a complaint with a health data access body

Natural and legal persons may lodge individual or collective complaints with health data access bodies if their rights or interests are negatively affected. Health data access bodies must provide accessible complaint tools and inform complainants of progress; complaints regarding personal data rights are forwarded to data protection authorities.

Article 82 Capacity building

The Commission shall promote exchange of best practices to strengthen digital health systems in Member States for both primary and secondary use. The Commission will establish self-assessment indicators in cooperation with Member States, considering different stakeholder categories.

Article 83 Training programmes and information for health professionals

Member States must establish, implement or offer access to training and information enabling health professionals to understand their responsibilities in managing electronic health data for patient care and cross-border access. These programmes and materials shall be available and affordable to all professionals regardless of how individual countries organize their healthcare.

Article 84 Digital health literacy and digital health access

Member States shall encourage patients' understanding of digital health technology and relevant capabilities. Awareness campaigns must inform about personal health data use, patient rights, and benefits or risks involved, tailored to particular population groups and updated as needed. States shall support infrastructure enabling individuals to manage their health data effectively.

Article 85 Additional requirements for public procurement and Union funding

Public bodies and institutions procuring goods or services must reference applicable technical standards and specifications in their tender documents and funding conditions related to this Regulation. Union funding criteria shall account for requirements established in the Regulation's chapters on governance, primary use and secondary use.

Article 86 Storage of personal electronic health data for primary use

Member States must ensure rigorous protection and safeguards when processing personal health data for direct care. National law may require that health data held by care providers or national contact points for cross-border access be stored within the Union, provided this complies with Union law and international agreements.

Article 87 Storage of personal electronic health data by health data access bodies and secure processing environments

Bodies managing health data for secondary use must keep and process personal health data within the Union through secure facilities or HealthData@EU when performing de-identification and other permitted processing. This requirement applies to any organization acting on their behalf, though exceptions exist for third countries with an adequacy decision under Union data protection law.

Article 88 Third-country transfer of non-personal electronic data

Non-personal health data transferred to third countries through authorized permits or requests may be classified as highly sensitive under relevant data regulation where re-identification is possible, particularly given the small populations involved or foreseeable technological advances. Protective measures for such data shall be specified by delegated act.

Article 89 International governmental access to non-personal electronic health data

Article 90 Additional conditions for transfer of personal electronic health data to a third country or an international organisation

International transfer of personal health data must follow the rules in the General Data Protection Regulation. Member States may establish additional restrictions on foreign access and transfer of personal health data, beyond the Regulation's requirements and GDPR standards.

Article 91 Health data access applications and health data requests from third countries

Requests from foreign health data applicants are eligible for consideration if their country has been recognized through a formal Commission decision as either having secondary use capability or as offering reciprocal access not stricter than this Regulation. The Commission shall publicly list qualifying countries, monitor changes, and withdraw decisions if countries no longer meet eligibility criteria.

Article 92 European Health Data Space Board

Establishes the EHDS Board composed of two representatives per Member State, one for primary use and one for secondary use, with equal voting rights. Members must act independently and in the public interest. The Board may establish subgroups on specific topics with digital health authorities and health data access bodies represented, adopts rules of procedure and code of conduct, decides by consensus or two-thirds majority, and is assisted by a Commission secretariat.

Article 93 Stakeholder forum

Creates a stakeholder forum with balanced representation from patients, health professionals, industry, consumers, researchers and academia to promote cooperation on implementation matters. Members are appointed through transparent selection, must declare interests annually, and the forum publishes yearly activity reports.

Article 94 Tasks of the EHDS Board

The Board assists Member States in coordinating digital health authority practices for primary use, exchanges best practices on implementation, facilitates cooperation and capacity building, shares information on EHR system risks and incidents, and exchanges views with the stakeholder forum and health sector regulators. For secondary use, the Board coordinates health data access body practices, issues guidance on compliance with secondary use rules, creates guidelines for health data users, facilitates cooperation and capacity building, shares information on secondary use risks and incidents, and exchanges views with stakeholders.

Article 95 Steering groups for MyHealth@EU and HealthData@EU

Two steering groups, one for each cross-border infrastructure, are composed of Member State representatives and take operational decisions on development and operation by consensus or two-thirds majority vote. They may invite authorized participants as observers and stakeholders from patients, health professionals and industry to attend meetings.

Article 96 Roles and responsibilities of the Commission regarding the functioning of the EHDS

The Commission develops and operates supporting infrastructures including cross-border identification mechanisms, MyHealth@EU and HealthData@EU central services, secure processing environments, dataset catalogues and secretariat functions. These services must meet quality standards for availability, security and interoperability, with biennial public reports on their performance.

Article 97 Exercise of the delegation

Grants the Commission power to adopt delegated acts for an indefinite period starting 25 March 2025, subject to revocation by the European Parliament or Council. Delegated acts enter into force only if neither institution objects within three months of notification, with the possibility to extend this period.

Article 98 Committee procedure

The Commission receives assistance from a committee operating under the rules of Regulation (EU) No 182/2011, including provisions allowing the use of the examination procedure for certain measures.

Article 99 Penalties

Member States must establish enforcement rules with effective, proportionate and dissuasive consequences for breaches not covered by administrative fines, and notify the Commission by 26 March 2027. When setting penalties, authorities should consider factors such as the infringement's nature and duration, harm mitigation efforts, prior violations, financial gain or loss, and the offender's Union turnover.

Article 100 Right to receive compensation

Any person suffering material or non-material harm from a breach of this Regulation may seek redress under applicable Union and Member State law.

Article 101 Representation of a natural person

A natural person whose rights under this Regulation have been violated may authorise a not-for-profit organisation or association with statutory public interest objectives in data protection matters to file complaints or exercise specified rights on their behalf.

Article 102 Evaluation, review and progress report

The Commission shall conduct a targeted evaluation by 26 March 2033 covering interoperability possibilities, data categories and purposes, opt-out mechanisms for secondary use, costs and benefits of secondary use provisions, and other specified aspects, and an overall evaluation by 26 March 2035 assessing systems providing access to electronic health data. Member States shall supply necessary information for these reports. The Commission shall submit annual progress reports to the Council from 25 March 2025 until full implementation, assessing Member State readiness and feasibility of implementation timeframes.

Article 103 Amendment to Directive 2011/24/EU

Article 14 of Directive 2011/24/EU ceases to apply from 26 March 2031.

Article 104 Amendment to Regulation (EU) 2024/2847

Regulation (EU) 2024/2847 is modified to require manufacturers including cybersecurity risk assessments in technical documentation where applicable, to consolidate technical documentation for products subject to multiple Union acts, and to ensure EHR system manufacturers demonstrate conformity using the procedures specified in this Regulation's certification framework.

Article 105 Entry into force and application

The Regulation enters into force on the twentieth day after publication in the Official Journal and applies from 26 March 2027. Articles 3 to 15 and Articles 23(2) to (6), 25, 26, 27, 47, 48 and 49 apply to priority categories from 26 March 2029 or 26 March 2031 depending on the category. Chapter III applies to EHR systems put into service from 26 March 2031.