European Health Data Space Regulation Published in the Official Journal

The regulation has two main objectives. For "primary use", it gives individuals better access to and control over their electronic health data, including across borders. For "secondary use", it sets up a framework for the reuse of health data for research, innovation, policy-making and regulatory activities. It also creates a single market for electronic health record (EHR) systems.

What it means for patients and providers

According to the European Commission, patients will be able to access their health data electronically and share it with health professionals in other Member States, and will have the right to restrict health professionals' access to all or part of their data. Member States may offer an opt-out from cross-border exchange. Secondary use will only be possible for purposes set out in the regulation and on the basis of a permit from a health data access body; using the data for decisions detrimental to individuals or for marketing is prohibited, and people will be able to opt out of secondary use.

A phased timetable

Entry into force starts a long transition. The regulation generally applies from 26 March 2027, the date by which the Commission must adopt key implementing acts. The main staging points are:

• 26 March 2029: exchange of the first priority categories, patient summaries and ePrescriptions and eDispensations, and most secondary use rules apply.
• 26 March 2031: exchange of medical images, laboratory results and hospital discharge reports; the EHR systems chapter applies to systems put into service.
• 26 March 2035: third countries and international organisations may apply to join the secondary use infrastructure, HealthData@EU.

Who is affected

Hospitals, clinics and other healthcare providers, manufacturers of EHR systems, research institutions, pharmaceutical and medical technology companies and public health bodies will all be affected. EHR system manufacturers face conformity requirements for interoperability and logging components, while data holders will need to prepare to make datasets available to health data access bodies. The rules sit alongside the GDPR, which continues to apply to processing of health data.

Sources

• EUR-Lex: Regulation (EU) 2025/327 on the European Health Data Space
• European Commission: European Health Data Space Regulation (EHDS)