What Is The European Health Data Space?

The European Health Data Space Regulation (EHDS) was adopted by European Parliament and Council on February 11, 2025, and published in the Official Journal of the European Union in March 2025, marking its entry into force. It is the first ‘data space’ to take shape as part of the broader European data strategy.

In addition to offering individuals the right to access their electronic health records immediately and free of charge, it also establishes a new regulatory regime intended to promote the use of health data for cross-border clinical care (primary uses) as well as research, innovation, and policymaking (secondary uses).

Up to now, the sharing of digital health data in Europe has been characterized by heterogeneous national regulations, and a patchwork of digital and paper-based processes, consent requirements, and institution-specific data access agreements. Seeking to streamline these processes, the EHDS will affect nearly 450 million individuals across 27 EU member states.

What Does It Do?

There are two main components to the EHDS:

Primary Use (Clinical Care): This is being realized through interoperability requirements for electronic medical records (broadly defined) as set out in the MyHealth@EU framework. This is required to be fully implemented in all member states by March 2029. It offers individuals the right to access their electronic health records immediately and free of charge in any EU member states. It also allows for cross-border EMR access for medical care, and for cross-border prescriptions.

Secondary Use (Research, Innovation, Policymaking): This component establishes a new regulatory regime intended to promote the use of health data (broadly defined, and includes 15 categories) for research, innovation, and policymaking. To accomplish these aims, the EHDS introduces a number of new terms, actors, and relationships that will govern health-related data. For example, the European Health Data Space Board will facilitate cooperation and exchange of information among member states and the European Commission. The Digital Health Authority will be responsible for the implementation and enforcement of the EHDS at the national level. Health Data Access Bodies (HDABs) will review data access requests, charge fees, and make health data available within a secure processing environment. Data Holders are those responsible for collecting, curating, and holding any of the 15 categories of health data. Data Users are any natural or legal persons granted a permit to access health data.

How Will It Work?

Under the EHDS, ALL data holders (Big Tech, hospitals, clinics, pharma, etc.) as defined in the regulation would be required to disclose their data holdings to health data access bodies (HDABs) in each member state. In some cases, national institutes already exist and will assume the role of HDAB. In other cases they will be created from scratch.

HDABs will publish national data catalogues, assess requests for data from data users (for purposes outlined in the regulation), send the requests to the data holders, and is also responsible for setting and collecting fees for data preparation. It is also responsible for publishing a national data catalogue. The data are then made available in a secure processing environment (details of which are to be determined in future implementing acts). If a data user wants to access data from multiple organizations, they can submit a single application to one HDAB of their choice, and that HDAB will coordinate and forward the request to the other HDABs. The Regulation foresees the option for data users to also continue to go through existing institutional processes, rather than the HDABs, if they choose.

When Will It Be Implemented?

The EHDS has an unusually long implementation timeline. While the Regulation entered into force in March 2025, the Commission will continue to develop 20+ delegated and implementing acts into 2027, with secondary use provisions applying four years from entry into force in March 2029. In contrast, the timeline from Council adoption to full applicability in all member states for the GDPR was only two years. EHDS delegating and implementing acts will address data standards, access fees, and standards for secure processing, for example. There are also a number of active pilots for primary and secondary use which you can find here.

Of note is that non-EU third countries (such as the UK or Canada) could eventually join the EHDS starting March 2034, provided they meet the criteria laid out in the regulation (including reciprocity of data flows).

Main Takeaways

The EHDS is an ambitious regulatory regime that sets out the conditions for health data access and use within the EU. Because of the scale and scope of the initiative, variations in degrees of digital maturity among member states, and the sensitivity of health as a domain, the EHDS warrants close attention as it continues to unfold.

Stay tuned for more updates and publications as they become available.