Earlier this month, the European Commission published a proposal for a Regulation for the European Health Data Space (EHDS) aimed at regulating and facilitating electronic health data access and sharing across the European Union (the Proposal). The two main objectives of the EHDS are to (i) enable individuals to easily access and control their electronic health data; and (ii) allow researchers, innovators and policy makers to use electronic health data in a lawful, legitimate, trusted and secure way that preserves privacy and the fundamental rights of patients.


The digital transformation of the healthcare sector and the use of health data for healthcare delivery, policy making and research purposes have been key elements of the European Commission’s agenda. In particular, in 2020, the creation of a EHDS became one of the central building blocks of the European Health Union as well as one of the objectives of the European Data Strategy.

According to the European Commission’s communication, the EU health sector is rich in data but lacks digital transformation mechanisms and the means to properly exploit the use of health data, which is estimated to be worth approximately 25-30 billion euros annually.

As part of the preparation of the Proposal, the European Commission launched a public consultation, which was conducted from May to July 2021. Nearly all of the 382 respondents were supportive of accelerating health research, giving patients control over their own data, and facilitating access to health data for delivery of healthcare across borders.

The Proposal aims to establish rules for the processing of electronic health data both in primary use for providing health care services to individuals and in secondary use for research, innovation, policymaking, statistics and protecting against cross-border threats to health.

Primary use

The Proposal aims to give patients a number of rights over their own data, including the rights of access, rectification and data portability, as well as the right to restrict access to their personal electronic health data in the context of healthcare. Access for patients’ to their own data should be free of charge, through the use of a personal electronic health data access service. In parallel, according to the Proposal, health care professionals must have a corresponding right of access to the data of their patients, including where the patient resides in an EU Member State that is different from the EU Member State where the treatment takes place.

The latter is clearly aimed at facilitating cross-border healthcare, which is also an objective of other EU legislation and potential future proposals by the European Commission.

Secondary use

The Proposal lays down the rules and mechanisms governing the secondary use of electronic health data. It requires providers of electronic health data to ensure that certain categories of electronic health data (e.g., health records, social data, administrative data, genetic and genomic data, public registries, clinical studies, research questionnaires, and biomedical data) are made available to competent bodies, to be designated by Member States. Access to electronic health data for secondary use should be provided based on a permit that is issued on the basis of a data access application, which must contain a number of elements. These include a description of the requested data, the reasons for seeking access, the intended uses of the data, the safeguards put in place protecting the security and confidentiality of the data, the duration of the use and retention of the data, as well as whether the data should be made available in a pseudonymised, anonymised or aggregated format.

The Proposal also permits data to be released in a pseudonymised format where the purposes of further processing require this. In such case, it is prohibited to attempt to reverse the pseudonymisation and/or seek to reidentify the individuals concerned by the data.

Access to electronic health data may be granted only for the purposes that are listed in the Proposal. These include:

  • public interest in the area of public and occupational health (e.g., protection against serious cross-border health threats, public health surveillance, ensuring high levels of quality and safety of healthcare and of medicinal products or medical devices);
  • to support EU and national authorities in the performance of their missions;
  • to produce health or care statistics;
  • development and innovation in the areas of public health, social security and high levels of quality and safety of healthcare, medicinal products and medical devices;
  • scientific research and education/teaching in the health or care sectors;
  • training, testing and evaluating of algorithms, including in medical devices, AI systems and digital health applications; and
  • providing personalised healthcare.

The above purposes reflect both the language in the GDPR (e.g., Article 9.2) and various policy objectives (e.g., effective regulation and administration, more efficient healthcare, innovation and research, AI and digital health development).

In contrast, the purposes for which access may be prohibited include:

  • taking decisions that are detrimental to individuals;
  • excluding individuals from insurance coverage or increasing insurance premiums;
  • advertising or marketing activities aimed at healthcare professionals, health organisations or individuals; and
  • developing products or services that may harm individuals and societies at large (e.g., illicit drugs, alcohol, tobacco products, goods or services which are designed or modified in such a way that they contravene public order or morality).

Moreover, the Proposal also includes provisions to implement “data altruism” in the health sector, whereby patients can donate data for research purposes. This is somewhat similar to the mechanism foreseen in the EU Data Governance Act, which is expected to be adopted relatively soon.

Next steps  

The Proposal will now be discussed by the Council and the European Parliament. However, the public consultation on the Proposal is open for feedback until 12 July 2022. The responses will be summarised by the European Commission and presented to the Council and the European Parliament as supportive material for the legislative debate.