The European Health Data Space (EHDS) is revolutionizing healthcare in the EU. Discover how this groundbreaking initiative is shaping the future of health data management and improving patient outcomes.
Sign up for updates and receive the latest case studies on EHDS to your email.
Thanks — you're on the list. Watch your inbox for the next update.
Something went wrong. Please try again, or email timo@healthdataspace.eu.
Questions? Ideas for Collaboration? Contact timo@healthdataspace.eu
The EHDS is an EU regulation that gives people control over their electronic health data and creates one common, secure way to reuse that data for research, innovation and policy. It is the first sector-specific common European data space and builds on the GDPR rather than replacing it.
Free, immediate access to your own electronic health data — and the right to add to it, restrict who sees it and see who has accessed it.
Patient summaries, ePrescriptions, lab results, images and discharge reports can be shared with a doctor in any Member State via MyHealth@EU.
Researchers apply to a Health Data Access Body, receive a data permit and analyse data inside a Secure Processing Environment. Only anonymous results come out.
EHR systems must meet common interoperability and security requirements and use the European Electronic Health Record Exchange Format (EEHRxF).
Regulation (EU) 2025/327 enters into force, 20 days after publication in the Official Journal. The transition period begins.
The Regulation starts to apply. Governance such as the EHDS Board is set up and the Commission's key implementing acts are due.
Patient summaries and ePrescriptions/eDispensations exchanged in all Member States. Secondary-use rules apply to most data categories, e.g. EHR data.
Medical images, lab results and discharge reports join cross-border exchange. Secondary use extends to remaining categories such as genomic data.
Third countries and international organisations may become authorised participants in HealthData@EU.
Health data used to deliver care — to you, wherever you are in the EU.
Health data reused for research, innovation, policy-making and the public good.
Free, immediate access to your priority health data, cross-border care via MyHealth@EU, control over who sees what — and the right to opt out of secondary use.
Register priority data electronically in interoperable formats, share it with patients and other providers, and act as data holders for secondary use.
Mandatory essential requirements on interoperability and logging, conformity self-assessment, CE marking and registration in an EU database.
Apply once through the HDAB one-stop-shop for data across Member States, and analyse it in secure environments rather than by bilateral deals.
Access EU-wide datasets for research and innovation — and, as data holders, make your own datasets available, with IP and trade-secret protections.
Apps that claim interoperability with EHR systems must meet the Article 47 requirements and carry a label. Others are not subject to it.
The EU regulation (2025/327) and ecosystem for the primary and secondary use of electronic health data.
Processing health data to provide care to the person the data belongs to, including prescribing and dispensing.
Processing health data for research, innovation, policy-making, statistics, education and regulatory purposes.
National body that assesses data access applications, issues data permits and provides secure processing environments.
A controlled system where approved users analyse data without downloading or extracting raw personal data.
The authorisation from an HDAB setting out which data may be used, for what purpose and under which conditions.
An organisation entitled or obliged to process personal electronic health data — e.g. hospitals, universities, companies.
Any eligible natural or legal person granted access to health data for secondary use.
The common format for exchanging priority categories of health data, expected to rely heavily on FHIR profiles.
The cross-border network that lets health data follow patients between Member States.
The cross-border network connecting HDABs and the EU Dataset Catalogue.
A standard description of a dataset's completeness, accuracy and relevance, filled in by the data holder.
An individual's right to object to their data being used for secondary purposes, subject to limited public-interest exceptions.
EU Joint Action preparing guidelines and technical specifications for secondary use under the EHDS.
No answer for that yet.
Send it to us via the question form — we'll reply by email or cover it in an upcoming newsletter.
The EHDS is an EU regulatory framework for health data sharing, aimed at enabling individuals to control their electronic health data while facilitating its use for healthcare delivery (primary use) and for research, innovation, and policy-making (secondary use).
The EHDS Regulation enter into force in March 2025, with different provisions applying gradually over the following years. Key implementation dates include March 2029 for both primary and secondary use of health data.
No, the EHDS will not replace existing frameworks. It creates a supplementary framework that will exist alongside national systems. Data users may choose between the EHDS process or a national process, but cannot mix aspects of both systems.
The data available for secondary use under the EHDS is the same for all eligible data users, including pharmaceutical companies. The scope is defined in Article 51 of the EHDS Regulation and includes a broad range of electronic health data, such as EHRs, claims data, registries, genomic data, and other datasets relevant to health research and innovation.
A data holder is defined as a natural or legal person who has the right or obligation, in accordance with applicable Union or national law and in its capacity as a controller or joint controller, to process personal electronic health data. Examples include hospitals, research institutions, pharmaceutical companies with health data, and universities doing health research.
Data users can include researchers, statisticians, health policy makers, pharmaceutical companies, and other entities that request access to health data for secondary use purposes. Any eligible natural or legal person can submit a data access request, regardless of whether they are also a data holder.
Wellness apps fall under the scope of EHDS if they claim interoperability with EHR systems, as specified in Article 47. If a wellness app does not claim such interoperability, it is not subject to the requirements of this article.
Data from patients outside the EU are not automatically eligible for secondary use under the EHDS framework. EHDS applies primarily to electronic health data generated within the EU. However, if non-EU patient data is included in an EU-hosted dataset, its eligibility would depend on the legal basis for processing and applicable data transfer agreements.
The EHDS promotes interoperability through the European Electronic Health Record Exchange Format (EEHRxF). FHIR profiles are expected to play a key role, particularly for primary use under MyHealth@EU. The specific technical specifications will be defined in implementing acts, with input from standardization bodies like HL7 Europe and CEN/TC 251.
Systems using older interoperability standards (like HL7 v2 or EDIFACT) or terminology standards (like READ codes) will need to adapt to the EHDS requirements. The EHDS establishes a framework for interoperability and security that all systems must comply with, although it does not prescribe specific technological solutions.
Yes, in-house EHR systems developed and used internally by healthcare providers are subject to EHDS requirements, though they have a later compliance deadline (March 2031) compared to commercial systems (March 2029).
Testing environments for EHR systems will be provided as open-source solutions, but there will be no central EU-wide testing platform. Member States will be responsible for setting up their own testing environments based on common specifications.
The EEHRxF is not fully defined yet, so alignment with openEHR cannot be definitively determined. The Xt-EHR consortium is working on the groundwork for the definition of the format, which will later be defined in the implementing act under Article 15 of the EHDS Regulation.
Secondary use of health data under EHDS involves accessing and processing health data for purposes such as research, innovation, policy-making, and education. Data access is managed through Health Data Access Bodies (HDABs), which issue data permits specifying the conditions of use.
Yes, there is no obligation to use solely the EHDS framework to request access to electronic health data for secondary use. The EHDS exists alongside other mechanisms for accessing data for research and innovation purposes and does not replace traditional data sharing mechanisms or existing agreements.
Secondary use in EHDS does not require standardization at the source. The data will remain in the format provided by data holders. However, metadata and interoperability requirements will be defined to facilitate discoverability and analysis. Some harmonization efforts are taking place in the primary use of data for specific categories.
Yes, it is possible to bring in external data (such as environmental data) for combination within the Secure Processing Environment (SPE). However, this must be clearly specified in the data access application submitted to the HDAB and approved in the permit granted.
Data analysis for secondary use under EHDS will be possible through Secure Processing Environments (SPEs), allowing researchers to work with data from different datasets. While data sets will not be fully harmonized at the source, metadata and interoperability requirements will facilitate discovery and analysis.
HDABs are responsible for:
HDABs will assess applications based on criteria specified in the EHDS Regulation and detailed in implementing acts. The Joint Action TEHDAS2 is currently developing guidelines for HDABs on application assessment procedures. These will include evaluation of purpose, legal basis, data minimization, and ethical considerations.
The horizontal legal framework for intellectual property (IP) rights and trade secrets continues to apply under the EHDS. HDABs will ensure compliance with these existing rules when handling data access requests. A dedicated workshop on this topic will be organized by the TEHDAS2 Joint Action to further discuss how IP and trade secret protections will be managed.
The implementation of stakeholder cooperation, including the role of patient representatives, will be decided at the national level. Each Member State will determine how patient representatives and other stakeholders contribute, whether through consultative mechanisms, advisory boards, or direct involvement in governance processes.
A Secure Processing Environment is a controlled system where data users can access and analyze health data securely, without being able to download or extract raw data. SPEs ensure data protection, security, and compliance with EHDS rules.
No, data holders do not need to implement their own SPE. The provision of SPEs is the responsibility of the Health Data Access Bodies (HDABs), which ensure that data is accessed in a controlled, secure, and privacy-compliant manner.
Pharmaceutical companies do not need to have their own Secure Processing Environment. The provision of SPEs is the responsibility of the HDABs, which ensure that data is accessed in a controlled, secure, and privacy-compliant manner.
Under the EHDS framework, data holders do not maintain exclusive control over data processing. All secondary use access applications must go through the HDAB, and data must be processed in an SPE managed or supervised by the HDAB.
Yes, researchers and data users must bring their analytic tools, AI/machine learning models, and processing algorithms into the SPE to analyze the data. The computation happens within the SPE, ensuring that no raw data leaves the environment.
The technical specifications for SPEs will be defined in upcoming implementing acts. The Joint Action TEHDAS2 is currently working on these specifications, with further details expected to be published in the coming years.
The EHDS does not foresee direct agreements between data holders and data users. Instead, access to data will be regulated through data permits issued by HDABs, which will specify the conditions of use. The framework for these data permits will be detailed in an implementing act.
The exact timing of fee payment will be defined in a future implementing act. However, it is reasonable to expect that payment will be required at the time of submitting the application rather than after the decision.
The EHDS foresees a one-stop-shop for the application process, meaning data users will be able to submit a single access application. However, there is no single permit for cross-border data access—each HDAB will still assess each application and issue its own permit. Mutual recognition mechanisms may be possible on a case-by-case basis.
An implementing act will define the Common Application Form for requesting data access under EHDS. A first draft was developed in the HealthData@EU Pilot and further refined by TEHDAS2. The form will standardize the information required for data access requests across all Member States.
The EHDS does not replace or override existing ethical review requirements at the national level. Researchers requesting health data for secondary use must still comply with the ethical review and approval procedures of each relevant Member State. Future implementing acts may provide further harmonization or mutual recognition mechanisms.
The quality of data in the EHDS will be described through a data quality and utility label. This label will provide transparency on key aspects such as completeness, accuracy, and relevance of datasets. Additionally, datasets must follow metadata requirements to be described in an implementing act.
The data holder is responsible for filling in and completing the data quality and utility label for their datasets. The Health Data Access Body (HDAB) supervises the process to ensure compliance and consistency. The CSA Quantum project under Horizon Europe is currently working on developing the specifications and guidelines for the label.
Not all datasets require a quality label, but those funded by public money do. For complex datasets with mixed data types under Article 51, each dataset should be assessed according to the applicable quality and utility label criteria.
The specific de-identification standards for EHDS are still being defined. Work is ongoing in the TEHDAS2 Joint Action to develop recommendations for these processes. HDABs will be responsible for ensuring that data is properly de-identified before granting access.
Secondary use in EHDS does not require standardization at the source. The data will remain in the format provided by data holders. However, metadata and interoperability requirements will facilitate discovery and analysis. The EHDS also promotes alignment with FAIR principles (Findability, Accessibility, Interoperability, and Reusability).
In the EHDS, personal data is always provided via Secure Processing Environments (SPEs). This ensures data protection, security, and compliance with EHDS rules. Direct downloads or external transfers of personal health data are not allowed.
The Health Data Access Bodies (HDABs) are responsible for ensuring that only non-personal data can be extracted from the SPEs. They implement controls and review processes to prevent re-identification risks.
Data subjects have the right to opt out of having their data used for secondary purposes, except in cases where Member States establish exceptions for public interest purposes (e.g., public health research, rare diseases). The legal basis for the opt-out right is provided within the EHDS Regulation itself.
In their application, health data users must describe the safeguards to prevent re-identification. The Health Data Access Body will also control re-identification risk issues. Technical and organizational measures will be implemented to minimize these risks.
The HDAB is responsible for ensuring that anonymization or pseudonymization is properly implemented before providing access to the data. However, this does not prevent the data holder from performing these processes. The specific responsibilities will be defined in implementing acts.
Key dates:
The Commission mobilizes EU funding instruments, such as the Digital Europe Programme and EU4Health, to support national efforts. The Commission also assists through webinars, workshops, knowledge-sharing platforms, and pilot projects to help build capacity and adopt best practices.
Yes, EU funding instruments such as the Digital Europe Programme and EU4Health will support EHDS implementation. Horizon Europe may also fund related research projects, including those addressing synthetic data, federated analysis, and interoperability solutions.
Strategies and incentives for supporting healthcare providers will be defined at the national level, with Member States responsible for helping organizations meet EHDS requirements. The EU will provide technical assistance and funding opportunities to facilitate implementation.
Yes, the Commission supports the development of federated analysis and data-visiting solutions as part of the EHDS framework. EU funding programs, such as Horizon Europe and Digital Europe, may further support tool development in this area.
The EU Dataset Catalogue, including dataset descriptions, will be available in all official EU languages, ensuring accessibility across Member States. Similarly, the Common Application Form for requesting data access will also be available in all EU languages. This will help facilitate cross-border data use and improve understanding of datasets.
Data holders that are in scope of the EHDS Regulation are those established within the EU. For multinational groups, the obligations apply to their EU entities and the data they control. Data held by entities outside the EU is not directly subject to EHDS requirements.
Yes, merging data across different HDABs is possible under the EHDS framework. Data will not be physically transferred or merged outside SPEs. There are two options:
For EU-wide registries not tied to a single Member State:
Each HDAB remains responsible for handling data access applications for its own country's data. The data application is forwarded to each relevant HDAB separately. For processing across multiple Member States, either federated analysis or a potential EU SPE could be used.
Member States are responsible for informing citizens about EHDS and their rights, with support from the European Commission. Awareness campaigns, digital health literacy initiatives, and user-friendly tools will be key to ensuring accessibility for all, including those with lower digital literacy.
The EHDS Board will play a key role in coordinating implementation and advising on standards. A stakeholder group will be established to provide input on EHDS implementation, including the development of implementing acts and guidelines. This ensures that perspectives from patients, healthcare professionals, industry, and research are considered.
The implementation of stakeholder cooperation, including the role of patient representatives, will be decided at the national level. Each Member State will determine how patient representatives contribute, whether through consultative mechanisms, advisory boards, or direct involvement in governance processes.
The timing for establishing the eHealth stakeholder group is still being determined. Updates will be provided as they become available.
The European Commission is responsible for adopting implementing acts, with input from expert groups, standardization bodies (e.g., HL7 Europe, CEN/TC 251), the EHDS Board, and EU-funded projects. Stakeholder consultation will also be part of the process.
Tell us what you'd like to know about the EHDS. We'll reply to you by email — and if it's useful to others, we may cover it in an upcoming newsletter.
Prefer email? Write to timo@healthdataspace.eu
Sign up for updates and receive the latest case studies on EHDS to your email.
Thanks — you're on the list.
Something went wrong. Please try again, or email timo@healthdataspace.eu.