The European Parliament adopted by 516 votes to 95, with 20 abstentions, amendments to the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space.

The matter was referred back to the committee responsible for interinstitutional negotiations.

The aim of the proposed regulation is to establish the European Health Data Space (EHDS) in order to improve access to and control by natural persons over their personal electronic health data in the context of healthcare ( primary use of electronic health data), as well as to better achieve as well as for other purposes that would benefit the society such as research, innovation, policy-making, patient safety, personalised medicine, official statistics or regulatory activities (secondary use of electronic health data).

Access to and transmission of personal electronic health data for primary use

Natural persons should have the right to access, immediately, free of charge and in an easily readable, consolidated and accessible format, their personal electronic health data processed in the context of the primary use of electronic health data. They should have the right to request a health data holder in the health or social security sector, or in the reimbursement services, to transmit some or all of their electronic health data to a health data recipient of their choice in the health or social security sector, or in the reimbursement services, immediately and free of charge.

Access to EHR for primary use should be strictly limited to healthcare providers . Where they process data in an electronic format, health professionals should have access, based on the data minimisation and purpose limitation principles, to the electronic health data of natural persons under their treatment and exclusively for the purpose of that treatment, including relevant administration, irrespective of the Member State of affiliation and the Member State of treatment.

Where access to electronic health data has been restricted by the natural person, the healthcare provider or health professionals should not be informed of the restricted content of the electronic health data without prior explicit consent the natural person.

Priority categories of personal electronic health data for primary use

The right of access should cover: patient records; electronic prescriptions; laboratory results; medical test results and other complementary and diagnostic results; discharge reports; patient discharge reports; medical directives of the natural persons and information about consent for substances of human origin and organ donations.

Personal electronic health data of priority data categories should be delivered across the continuum of care. Member States may provide that individuals have a right to object to the recording of their personal health data in an EMR system.

Right to an effective judicial remedy against a health data access body

Natural and legal persons should have the right to lodge a complaint, individually or, where relevant, collectively, with the health data access body, where their rights are affected. Each natural or legal person should have the right to an effective judicial remedy against a legally binding decision of a health data access body concerning them. Proceedings against a health data access body should be brought before the courts of the Member States where the health data access body is established.

Conformity assessment of EHR systems

In order to certify the conformity of an EHR system with this Regulation, prior to placing an EHR system on the market, the manufacturer, its authorised representative, or any economic operator should apply for a conformity assessment procedure . Only after an EU wide approval has been issued, may the CE marking be affixed, together with an identification number.

Minimum categories of electronic data for secondary use

Natural persons should have the right to opt-out of the processing of their electronic health data for secondary use. Member States should provide for an accessible and easily understandable opt-out mechanism , whereby natural persons should be offered the possibility to explicitly express their wish not to have all or part of their personal electronic health data processed for some or all secondary use purposes. The amended regulation requires explicit consent to be obtained from a patient for the secondary use of certain sensitive data (e.g. genetic and genomic information).

Intellectual property rights and trade secrets for secondary use

Electronic health data entailing protected intellectual property and trade secrets from health data holders should be made available for secondary use. In this case, a specific procedure should apply.

In this case, health data access bodies should take measures necessary to preserve the confidentiality of such data and to ensure such rights are not infringed.

Prohibited secondary use of electronic health data

Members call for rules to prohibit the processing of such data for the following purposes:

- taking decisions which are detrimental to an individual or a group of individuals and which are likely to have legal, economic or social effects;

- taking decisions in relation to a natural person or groups of natural persons in relation to job offers or offering less favourable terms in the provision of goods or services, including to exclude them from the benefit of an insurance or credit contract or to modify their contributions and insurance premiums or conditions of loans;

- advertising or marketing activities;

- automated individual decision-making, including profiling.

Health data access body

Member States should designate one or more health data access bodies responsible for granting access to electronic health data for secondary use. They should also ensure that designated separate structures are set up within health data access bodies for the authorisation of the data permit.

Each health data access body should act with full independence in performing its tasks and exercising its powers in accordance with this Regulation. These bodies should decide on data access applications, including deciding on whether the data should be made accessible in anonymised or pseudonymised form , based on its own thorough assessment of any reasons provided by the health data applicant.

The data access body should only issue an authorisation for data processing if all the conditions set out in this Regulation are met.

Natural and legal persons should have the right to: (i) lodge a complaint, individually or, where relevant, collectively, with the health data access body; (ii) have the data processed by the health data access body reviewed.

Right to receive compensation

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation should have the right to receive compensation. Where a natural person considers that their rights under this Regulation have been infringed, they should have the right to mandate a not-for-profit body, organisation or association to lodge a complaint on their behalf.

The Committee on the Environment, Public Health and Food Safety and the Committee on Civil Liberties, Justice and Home Affairs jointly adopted the report by Tomislav SOKOL (EPP, HR) and Annalisa TARDINO (ID, IT) on the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space.

The aim of the proposed regulation is to establish the European Health Data Space (EHDS) in order to:

- improve access to and control by natural persons over their personal electronic health data in the context of healthcare ( primary use of electronic health data);

- better achieve as well as for other purposes that would benefit the society such as research, innovation, policy-making, patient safety, personalised medicine, official statistics or regulatory activities ( secondary use of electronic health data).

The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:

Rights of natural persons in relation to the primary use of their personal electronic health data

Access to EHR for primary use should be strictly limited to healthcare providers . Where they process data in an electronic format, health professionals should have access, based on the data minimisation and purpose limitation principles, to the electronic health data of natural persons under their treatment and exclusively for the purpose of that treatment, including relevant administration, irrespective of the Member State of affiliation and the Member State of treatment.

Where access to electronic health data has been restricted by the natural person, the healthcare provider or health professionals should not be informed of the restricted content of the electronic health data without prior explicit consent the natural person.

Priority categories of personal electronic health data for primary use

The right of access should cover: patient records; electronic prescriptions; laboratory results; medical test results and other complementary and diagnostic results; discharge reports; patient discharge reports; medical directives of the natural persons and information about consent for substances of human origin and organ donations.

The patient summary should be harmonised across Member States and include a minimum data set that can be expanded to include disease-specific data. Prescription, dispensation and administration of current and past medications across the continuum of care, including, hospital and ambulatory/day hospitals.

The Commission should, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data. The Commission should ensure that those implementing acts contain the latest versions of healthcare coding systems and nomenclatures and that they are updated regularly in order to keep up with the revisions of the healthcare coding systems and nomenclatures.

Registration of personal electronic health data

When health data are registered or updated, electronic health records should identify the health professional, time and health care provider that carried out the registration or the update. Member States may provide for other aspects of data registration to be recorded.

Right to an effective judicial remedy against a health data access body

Without prejudice to any other administrative or non-judicial remedy, each natural or legal person should have the right to an effective judicial remedy against a legally binding decision of a health data access body concerning them. Proceedings against a health data access body should be brought before the courts of the Member States where the health data access body is established.

Conformity assessment of EHR systems

In order to certify the conformity of an EHR system with this Regulation, prior to placing an EHR system on the market, the manufacturer, its authorised representative, or any economic operator should apply for a conformity assessment procedure . Only after an Union wide approval has been issued, may the CE marking be affixed, together with an identification number.

Minimum categories of electronic data for secondary use

Natural persons should have the right to opt-out of the processing of their electronic health data for secondary use. Member States should provide for an accessible and easily understandable opt-out mechanism , whereby natural persons should be offered the possibility to explicitly express their wish not to have all or part of their personal electronic health data processed for some or all secondary use purposes.

Intellectual property rights and trade secrets for secondary use

Electronic health data entailing protected intellectual property and trade secrets from health data holders should be made available for secondary use. In this case, a specific procedure should apply.

Prohibited secondary use of electronic health data

Members call for rules to prohibit the processing of such data for the following purposes:

- taking decisions which are detrimental to an individual or a group of individuals and which are likely to have legal, economic or social effects;

- taking decisions in relation to a natural person or groups of natural persons in relation to job offers or offering less favourable terms in the provision of goods or services, including to exclude them from the benefit of an insurance or credit contract or to modify their contributions and insurance premiums or conditions of loans;

- advertising or marketing activities;

- automated individual decision-making, including profiling.

Health data access body

Member States should need to designate one or more health data access bodies responsible for granting access to electronic health data for secondary use.

Member States should ensure that designated separate structures are set up within health data access bodies for the authorisation of the data permit, on the one hand, and for the reception and preparation of the data set, including anonymisation, pseudonymisation of the electronic health data.

Each health data access body should act with full independence in performing its tasks and exercising its powers in accordance with this Regulation. These bodies should decide on data access applications, including deciding on whether the data should be made accessible in anonymised or pseudonymised form , based on its own thorough assessment of any reasons provided by the health data applicant.

The data access body should only issue an authorisation for data processing if all the conditions set out in this Regulation are met.

Natural and legal persons should have the right to: (i) lodge a complaint , individually or, where relevant, collectively, with the health data access body; (ii) have the data processed by the health data access body reviewed.

Right to receive compensation

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation should have the right to receive compensation. Where a natural person considers that their rights under this Regulation have been infringed, they should have the right to mandate a not-for-profit body, organisation or association to lodge a complaint on their behalf.

PURPOSE: to establish a European Health Data Space for people and science.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: the COVID-19 pandemic has clearly shown the importance of electronic health data for policy-making in response to health emergencies. It has also highlighted the imperative of ensuring timely access to personal electronic health data for health threats preparedness and response, as well as for treatment, but also for research, innovation, patient safety, regulatory purposes, statistical purposes or personalised medicine.

However, the complexity of rules, structures and processes across Member States makes it difficult to access and share health data , especially cross-border. At present, individuals have difficulties in exercising their rights with regard to their electronic health data, in particular with regard to accessing and sharing their data nationally and across borders, despite the provisions of the General Data Protection Regulation (GDPR).

The European Health Data Space (EHDS) is the first proposal for a common domain-specific European data space . It will address health-specific challenges to electronic health data access and sharing and will be an integral part of building a European Health Union. EHDS will create a common space where natural persons can easily control their electronic health data. It will also make it possible for researchers, innovators and policy makers to use this electronic health data in a trusted and secure way that preserves privacy.

CONTENT: the proposed regulation has the following objectives:

- to establish the European Health Data Space (EHDS) in order to improve access to and control by natural persons over their personal electronic health data in the context of healthcare (primary use of electronic health data), as well as for other purposes that would benefit the society such as research, innovation, policy-making, patient safety, personalised medicine, official statistics or regulatory activities (secondary use of electronic health data);

- to improve the functioning of the internal market by establishing a uniform legal framework , in particular for the development, marketing and use of electronic health record systems (EHR systems) in line with EU values.

Primary use of electronic health data

Under the proposal, natural persons should have the right to access their personal electronic health data processed in the context of primary use of electronic health data, immediately, free of charge and in an easily readable, consolidated and accessible form . They should easily share such data with other health professionals within and between Member States in order to improve the delivery of health care.

Member States should ensure that patient records, electronic prescriptions, medical imaging images and reports, laboratory results and hospital discharge reports are issued and accepted in a common European electronic health record exchange format. Categories of electronic health data could be added by means of delegated acts.

When processing data in electronic format, health professionals would have access to the electronic health data of their natural person patients, regardless of the Member State of affiliation and the Member State of treatment.

To safeguard citizens' rights, all Member States should designate digital health authorities . The Commission would set up a central platform for digital health ( MyHealth@EU ) to provide services to support and facilitate the exchange of electronic health data between Member States' national contact points for digital health.

Interoperability and security

The proposal provides for the implementation of a mandatory self-certification scheme for EMR systems, under which EMR systems must comply with essential interoperability and security requirements. Manufacturers of electronic health record systems will have to certify compliance with these standards. This will ensure that different electronic health record systems are compatible and allow for easy transmission of electronic health data between them.

Improving the use of health data for research, innovation and policymaking

The EHDS creates a strong legal framework for the use of health data for research, innovation, public health, policy-making and regulatory purposes . Under strict conditions, researchers, innovators, public institutions or industry will have access to large amounts of high-quality health data, crucial to develop life-saving treatments, vaccines or medical devices and ensuring better access to healthcare and more resilient health systems.

To access this data, researchers, companies or institutions would have to apply for authorisation from the body responsible for access to health data, which will have to be set up in each Member State. Access would only be allowed if the requested data are used for specific purposes, in closed and secure environments and without revealing the identity of individuals. Any attempt to use the data for any measures detrimental to the natural person, to increase insurance premiums, to advertise products or treatments, or develop harmful products should be prohibited.

Member States should designate one or more health data access points responsible for granting access to electronic health data for secondary use. The Health Data Access Bodies would be connected to the new EU decentralised infrastructure for secondary use of data (HealthData@EU), which will be set up to support cross-border projects.

BUDGETARY IMPLICATIONS: the fulfilment of the obligations by the Commission and associated support actions under this legal proposal will require EUR 220 million between 2023 and 2027 and will be funded directly from the EU4Health programme (EUR 170 million) and supported further from the Digital Europe Programme (EUR 50 million). In both cases, the expenditure linked to this proposal will be covered within the programmed amounts of these programmes.