1. What is it?

The European Health Data Space (EHDS) is a hugely impactful piece of EU legislation, aiming to create a single digital health data infrastructure across the EU and beyond. It will affect almost all citizens and healthcare organisations within the EU.

Currently, there is significant fragmentation between each EU Member States’ rules and infrastructure for accessing electronic health data, which hinders, patients, healthcare professionals, researchers, innovators and governments from fully utilizing this data for the public benefit. The EHDS regulation is designed to overcome these barriers by creating a unified legal framework, and infrastructure, to enable open access to, and use of, almost all electronic health data.

The EHDS sets out two infrastructures: one for patients to share their health records, so they can receive care across providers and borders (primary use); and another to enable the re-use of health data for research, innovation, policy, regulation etc (secondary use).

This blog will focus on the latter re-use of health data for secondary use.

The regulation is part of the EU’s aim to create a single market for data and establish several common European Data Spaces in areas such as health, mobility, and agriculture. Health is the first of these European Data Spaces.

2. What data will be affected?

The health data affected by the EHDS is comprehensive and defined flexibly to accommodate the evolving nature of health data. As such, it includes ‘health data’ in the simple English sense of the word (i.e. data that relates to someone’s physical or mental health, such as electronic health records and genetic data), but also includes data that may influence health (such as sociodemographic data), or that is produced from healthcare services (such as wellness app data, data on homelessness, consumption of substances, clinical trials, registries, etc.).

3. Who will be affected?

The EHDS will affect every person or entity who interacts with health data. The impact depends on your role within the EHDS, as a ‘health data holder’, ‘health data user’ and/or ‘Health Data Access Body

• Health data holder: in essence, any person or organisation that controls the use of health data. The health data holder is responsible for registering information about its health data in a publicly available catalogue and making it available for reuse, either upon request or by uploading to public databases.
• Health data user: someone that applies to access and use health data for specific purposes. This includes research, innovation, education, training, policymaking, health service management, and official statistics.
• Health Data Access Bodies (HDAB): broker entities established by every Member State. They will adjudicate access requests to health data, process the data, host the data access, monitor compliance of stakeholders to the EHDS regulation and report on the performance of the EHDS network. A European equivalent will be established to accommodate data requests for the Union’s own data and as a fallback for hosting the data access of multi-country data requests.

4. How will it work?

The EHDS establishes a secure infrastructure for the reuse of electronic health data. This entails that all stakeholders holding electronic health data must comply with EHDS, aside from individuals and enterprises who employ fewer than 10 people and have an annual turnover lower than 2 million euros (although this exemption may be removed by individual Member States). Here’s how it will work for health data holders:

A. Data discovery:

Register your health data assets in a national dataset catalogue, providing metadata (information about the data) which will enable them to be found and reused. Ambitiously, holders of non-personal health data (i.e. data which doesn’t contain personal data or annonmysed data) should upload that data to ‘trusted open public databases’, the provenance of which is unclear.

B. Data access:

Upon reasonable request from a third party for the health data, which are made to the HDABs, the HDABs have 3 months to process it and instruct you, as a health data holder, to hand over the data. After which you have 3 months to do so.

• What is a ‘reasonable request’?

  Reasonable requests (Article 53) include data for a broad range of uses: scientific research in health and health technology (including medicinal products); for the purposes of public interest, including public policymaking, regulation and statistics; and education. It shall not be used for harmful purposes, or for advertising. In line with the GDPR regulation, a request should only apply for the minimum data relevant to answer the research question.

• Can you refuse a request?

  No, but there are complaint procedures to the HDABs should you feel it an unlawful request.

  Also, if the data is protected by intellectual property rights, trade secrets or data protection then the health data holders can suggest to the HDAB the legal, organisational and technical measures to share such data in a manner that maintains those protections or to refuse access if they cannot. However, determination of which safeguards to apply is in the unknown hands of local HDABs, who are expected to follow forthcoming guidelines set at the European level. Fees can be charged by the HDABs for their services and by the health data holders for compiling and preparing electronic health data to be made available. These fees must be proportionate to the cost of carrying out these tasks.

C. Data preparation

HDABs will provide this data in a secure processing environment within two months after receiving it, once they have completed their unenviable task of preparing, processing, combining and (pseudo) anonymising it. The exact features of the environment need to be clarified but include the option to use third party software such as statistical programmes, and the ability to introduce external data.

Citizens have the reversable right to opt-out from their data being reused. If a citizen opts-out, that data may not be shared from that point in time with health data users even in anonymous form (subject to some very specific exemptions) and so the HDAB/health data holder needs to remove such citizens from the dataset. Member States can also enforce additional safeguards and opt-out or opt-in requirements for specific data types, such as genomic data, wellness app data, and biobanks/databases. There are open questions on how this could work from a practical perspective.

D. Use of Data

The health data user analyses the data within this environment based on the purpose defined in the application phase and cannot download any personal identifiable data.

E. Finalisation

In the last phase, the health data user must publish the results within 18 months (the level of detail here being unclear). The results should be provided in an anonymous format and the health data user must inform the HDAB of the results and must mention in the output that the results have been obtained by using data in the framework of the EHDS.

The above steps are depicted in figure 1.