WHAT IS THE AIM OF THE REGULATION?
Regulation (EU) 2025/327 establishes the European Health Data Space (EHDS) to enhance individuals’ access to and control over their personal electronic health data to improve healthcare delivery and support research and innovation. The EHDS is a cornerstone of the European health union and the first common EU data space dedicated to a specific sector as part of the European strategy for data.
KEY POINTS
Purpose and scope
The EHDS regulation lays down rules that will:
- empower individuals to access, control and share their electronic health data across borders for healthcare purposes (primary use of data);
- enable the secure reuse of electronic health data for research, innovation, policymaking and regulatory activities (secondary use of data);
- foster a single market for electronic health record (EHR) systems, supporting both primary and secondary use.
Primary use of electronic health data
Individuals’ rights
Under the EHDS regulation, individuals, or their representatives, will have additional rights in relation to specific categories of their personal electronic health data, including the right to:
- access their electronic health data immediately and free of charge through health access services;
- download a copy of their health data in the commonly used and machine-readable European electronic health record exchange format and share it with healthcare providers across the EU;
- insert information into their EHRs and request corrections;
- view records of who accessed their data, when and for what purpose;
- manage proxy authorities;
- restrict access to all or parts of their health data; and
- opt out of giving access to their personal electronic health data, under certain conditions.
These additional rights apply to the following categories of personal electronic health data, collectively called the ‘priority categories’. These rights will start to apply in two phases.
First phase:
- patient summaries (an extensive set of key clinical data including diagnoses and health conditions, allergies, medication, vaccination, plan of care, etc.);
- electronic prescriptions;
- electronic dispensations (information that a prescription has been used).
Added in the second phase:
- medical imaging studies and related imaging reports;
- medical test results, including laboratory and other diagnostic results and related reports;
- discharge reports.
Individuals will be able to exercise these additional rights on the first three categories by 26 March 2029 (first phase) and by 26 March 2031 on the last three categories (second phase).
These rights apply to these data categories when such data are processed electronically. These rights also cover historical data – they are not limited to documents generated after these rights start to apply.
Access by healthcare professionals
Healthcare professionals may access the priority categories of personal electronic health data for patients under their treatment, including across borders via MyHealth@EU, to support safe, high-quality and continuous care.
Each EU Member State will need to define access rights based on professional roles, along with tasks to be carried out. Only professionals with recognised electronic identification may access data, which must be presented in a user-friendly format.
Individuals may restrict access to parts of their data. In such cases, professionals will not be aware of the existence or content of the restricted information. In emergencies, access may be granted if needed to protect the individual’s vital interests, with all such access recorded and visible to the individual.
MyHealth@EU, the EU’s central interoperability platform, enables the secure cross-border exchange of electronic health data for healthcare purposes (primary use), giving individuals and professionals access to necessary data when a person receives treatment in another Member State.
Rules for placing electronic health record systems and wellness applications on the market
EHR systems may only be placed on the EU market if they comply with the essential requirements, follow common specifications and pass a conformity self-assessment.
Manufacturers are responsible for ensuring ongoing compliance, maintaining technical documentation and, where required under EU law, affixing CE markings before placing the system on the market.
Wellness applications claiming interoperability with EHR systems, and therefore compliance with relevant requirements, must be labelled accordingly and meet minimum interoperability standards.
National market surveillance authorities monitor compliance with these requirements.
Secondary use of electronic health data
Where an entity qualifies as a health data holder, it will have to make the data categories listed in Article 51 available according to the conditions in Chapter IV of the EHDS.
Health data can be reused, under strict conditions.
- A data permit issued by a health data access body (HDAB)1 is required. This follows the submission of an application and its assessment by the HDAB under strict criteria, including whether access is requested for data falling within the ‘minimum’ categories, i.e. those categories of electronic health data allowed to be used for secondary use and for specific purposes.
- Only pseudonymised or anonymised data can be accessed in a secure processing environment – no personal data can be downloaded from these environments.
- Researchers, companies or public institutions may only access pseudonymised data if anonymised data is insufficient for their purposes.
- Results of data use must be made publicly available when appropriate, especially if publicly funded or for transparency.
- Certain uses, such as for advertising, reidentification or discrimination, are strictly prohibited.
Member State responsibilities and EU coordination
To ensure consistent application of the regulation and smooth cross-border cooperation in primary use, each Member State must designate one or more digital health authorities. These authorities are responsible for:
- monitoring the implementation and enforcement of the regulation;
- ensuring the interoperability and security of data systems;
- supervising EHR systems and wellness applications made available in their territory;
- coordinating digital health matters at both the national and EU levels.
In addition, Member States must appoint national contact points for digital health. These act as gateways for cross-border data exchange. All national contact points must be connected to the central interoperability platform for digital health in the cross-border infrastructure MyHealth@EU.
With regard to secondary use, each Member State must designate at least one HDAB, responsible for handling data access applications and requests, issuing data permits, supervising compliance and ensuring transparency in data reuse.
HealthData@EU supports the secondary use of health data across Member States by connecting national contact points and authorised users to promote research and innovation across the EU.
The European Health Data Space Board is established to facilitate cooperation among Member States and the European Commission and to carry out tasks related to both primary and secondary use.
Member States are also required to ensure compliance through appropriate penalties and enforcement measures. The Commission reports annually on implementation progress, technical readiness and cooperation measures.
FROM WHEN DOES THE REGULATION APPLY?
The regulation applies from 26 March 2027, with phased implementation of key rules between 2029 and 2035.
Key implementation milestones
- 26 March 2025 – the regulation enters into force.
- 26 March 2027 – deadline for the Commission to adopt implementing acts for the application of the regulation.
- From 26 March 2029 – cross-border exchange of patient summaries and electronic prescriptions and dispensations become mandatory in all Member States via MyHealth@EU (primary use). Rules on secondary use will also start to apply for most data categories (e.g. data from electronic health records).
- From 26 March 2031 – cross-border exchange expands to include laboratory results, medical imaging and hospital discharge reports (primary use). Rules on secondary use will also start to apply for the remaining data categories (e.g. genomic data).
- From 26 March 2035 – non-EU countries and international organisations may apply to join HealthData@EU, under specific conditions (secondary use).
The regulation amends Directive 2011/24/EU (see summary) and Regulation (EU) 2024/2847 (see summary).
BACKGROUND
The EHDS is a key pillar of the European health union; it builds further on the General Data Protection Regulation (see summary) and aligns with the Data Governance Act (see summary), the Data Act (see summary) and the NIS 2 Directive (see summary).
For further information, see:
KEY TERMS
- Health data access body (HDAB). A national authority that authorises and oversees the secondary use of electronic health data under the EHDS.
MAIN DOCUMENT
Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (OJ L, 2025/327, 5.3.2025).
RELATED DOCUMENTS
Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) (OJ L, 2024/2847, 20.11.2024).
Successive amendments to Regulation (EU) 2024/2847 have been incorporated into the original text. This consolidated version is of documentary value only.
Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (OJ L, 2023/2854, 22.12.2023).
Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (OJ L 152, 3.6.2022, pp. 1–44).
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, pp. 80–152).
See consolidated version.
Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, pp. 18–27).
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1–88).
See consolidated version.
Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, pp. 45–65).
See consolidated version.
