### member states shall inform the commission and the other member states of any foreign direct investments that are undergoing screening within the framework of their screening mechanisms , within 5 working days from the start of the screening . as part of the information , and when applicable , the screening member states shall endeavour to indicate whether it considers that the foreign direct investment undergoing screening is likely to fall within the scope of regulation no 139 / 2004 . ### member states shall inform the commission of any foreign direct investments that are undergoing screening within the framework of their screening mechanisms which it considers likely to affect public order or security in another member state or in the union , within 20 working days from the start of the screening . as part of the information , and when applicable , the screening member states shall endeavour to indicate whether it considers that the foreign direct investment undergoing screening is likely to fall within the scope of regulation no 139 / 2004 .


### the opinion of the commission shall be communicated to the other member states . ### the opinion of the commission shall be communicated to the other member states with the permission of the member state where the foreign direct investment is planned or has been completed in strict compliance with applicable rules of notification of ec decisions .


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , health professionals , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use in full respect of the rules on confidentiality.


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , legislators , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to make the absolute most of the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use provided that the effort is made by means of effective and safe processes , such as aggregation and randomisation , with due respect for professional duties , including but not limited to confidentiality duties.


### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other. ### (39) the categories of electronic health data that , with the patient’s exclusive consent , can be processed for secondary use , should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data that are related to health or have a direct , known impact on health. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured.


### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other. ### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (consumption of different substances , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it and the request is duly justified. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , common standards for data anonymisation will be further developed and the use of anonymised electronic health data without any personal data will be facilitated wherever possible , excluding possibilities for re-use of data that cannot be anonymised or pseudonymised. requests for pseudonymised data shall be duly justified. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### deleted


### article 48 ### deleted


### article 49 ### deleted


### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. ### deleted


### 14. the approval for individual authorised participant to join healthdata@eu or to disconnect a participant from the infrastructure shall be issued by the joint controllership group , based on the results of the compliance checks. ### 14. subject to a positive outcome of this compliance check , the commission shall , by means of implementing acts , take decisions to connect individual authorised participants to join the respective infrastructure or to disconnect them. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 68.


### 14. the approval for individual authorised participant to join healthdata@eu or to disconnect a participant from the infrastructure shall be issued by the joint controllership group , based on the results of the compliance checks. ### 14. the approval for individual authorised participants to join myhealth@eu for different services , or to disconnect a participant shall be issued by the ehds board , based on the results of the compliance checks performed by the commission.


### 3. the composition , organisation , functioning and cooperation of the sub-groups shall be set out in the rules of procedure put forward by the commission. ### 3. the composition , organisation , functioning and cooperation of the sub-groups shall be set out in the rules of procedure put forward by the commission after consultations with the member states.


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### 4. stakeholders and relevant third parties , including patients’ and health professionals’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity.


### it shall apply from 12 months after its entry into force. ### it shall apply from 24 months after its entry into force.


### from 1 year after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (a) , (b) and (c) , and to ehr systems intended by the manufacturer to process such categories of data.; ### from 3 years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (a) , (b) and (c) , and to ehr systems intended by the manufacturer to process such categories of data.;


### from 3 years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (d) , (e) and (f) , and to ehr systems intended by the manufacturer to process such categories of data; ### from 5 years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (d) , (e) and (f) , and to ehr systems intended by the manufacturer to process such categories of data;


### chapter iii shall apply to ehr systems put into service in the union pursuant to article 15(2) from 3 years after date of entry into application. ### chapter iii shall apply to ehr systems put into service in the union pursuant to article 15(2) from 5 years after date of entry into application.


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. health data access bodies shall establish protocols to facilitate access for all natural persons to the specific information concerning the use of their data , especially in the case of pseudonymised or anonymised data where the lack of information could affect the fundamental rights of the natural person.


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. health data access bodies shall be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46.


### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in compliance with the requirements set out in article 32 of regulation (eu) 2016/679 , and in good faith with the health data access bodies , where relevant.


### 2. where the data in question are not held by the data access body or a public sector body , the fees may also include compensation for part of the costs for collecting the electronic health data specifically under this regulation in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the data holder’s costs shall be paid to the data holder. ### 2. where the data in question are not held by the health data access body , the fees may also include compensation for collecting the electronic health data in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the health data holder’s costs shall be paid to the health data holder and shall also reflect market value of the data in question.


### 2. where the data in question are not held by the data access body or a public sector body , the fees may also include compensation for part of the costs for collecting the electronic health data specifically under this regulation in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the data holder’s costs shall be paid to the data holder. ### 2. where the data in question are not held by the health data access body or a public sector body , the fees may also include compensation for part of the costs for collecting the electronic health data specifically under this regulation in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the health data holder’s costs shall be paid to the data holder and shall correspond to the fees’ market value.


### 2. where the data in question are not held by the data access body or a public sector body , the fees may also include compensation for part of the costs for collecting the electronic health data specifically under this regulation in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the data holder’s costs shall be paid to the data holder. ### 2. where the data in question are not held by the health data access body the fees may also include compensation for collecting the electronic health data in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the health data holder’s costs shall be paid to the health data holder and shall also reflect market value of the data in question.


### 8. the commission may , by means of implementing act , set out the architecture of an it tool aimed to support and make transparent to other health data access bodies the activities referred to in this article , especially penalties and exclusions. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 8. the commission may , by means of implementing act , set out the architecture of an it tool aimed to support and make transparent to other health data access bodies the activities referred to in this article , especially penalties and exclusions. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2).


### 10. the commission may issues guidelines on penalties to be applied by the health data access bodies. ### 10. the commission , without undue delay , shall issue guidelines on penalties to be applied by the health data access bodies.


### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### deleted


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### deleted


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant , and if individuals have the option to opt-out with respect to the secondary use of their personal health data. if that is the case , the health data access body shall issue a data permit.


### strengthens the rights of natural persons in relation to the availability and control of their electronic health data; ### strengthens the rights of natural persons in relation to the availability and control of their electronic health data , both in the primary as in the secondary use thereof;


### manufacturers and suppliers of ehr systems and wellness applications placed on the market and put into service in the union and the users of such products; ### manufacturers and suppliers of ehr systems placed on the market and put into service in the union and the users of such products;


### controllers and processors established in a third country that has been connected to or are interoperable with myhealth@eu , pursuant to article 12(5); ### deleted


### ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess , maintain or restore the state of health of the natural person to whom that data relates , including the prescription , dispensation and provision of medicinal products and medical devices , as well as for relevant social security , administrative or reimbursement services; ### 'primary use of electronic health data' means the processing of personal electronic health data for the provision of health services to assess , maintain or restore the state of health of the natural person to whom that data relates , including the prescription , dispensation and provision of medicinal products and medical devices , improvement of personalised care , as well as for relevant social security , administrative or reimbursement services;


### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for the purpose of the secondary use; ### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , exclusively where the patient has given prior consent for such use , but also electronic health data collected for the purpose of the secondary use;


### ‘registration of electronic health data’ means the recording of health data in an electronic format , through manual entry of data , through the collection of data by a device , or through the conversion of non-electronic health data into an electronic format , to be processed in an ehr system or a wellness application; ### ‘registration of electronic health data’ means the recording of health data in an electronic format , through manual entry of data , through the collection of data by a device , or through the conversion of non-electronic health data into an electronic format , to be processed in an ehr system;


### ‘telemedicine’ means the provision of healthcare services , including remote care and online pharmacies , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location; ### ‘telemedicine’ means the provision of healthcare services , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location;


### ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for other purposes than healthcare , such as well-being and pursuing healthy life-styles; ### deleted


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , to register , facilitate , restrict access or exchange certain data that the person processes for secondary use or that could be processed for such purposes in accordance with applicable union law or national legislation implementing union law;


### (aa) ‘data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation; ### (aa) ‘data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation; this permit applies only to data for the publication of which the patient has given prior consent;


### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health. ### deleted


### establish one or more electronic health data access services at national , regional or local level enabling the exercise of rights referred to in paragraphs 1 and 2; ### establish one or more electronic health data access services at national , regional or local level enabling the exercise of rights referred to in paragraphs 1 and 2 , incorporating health professionals’ experience and knowledge within the framework of the exercise of the rights set out in paragraph 7.


### establish one or more electronic health data access services at national , regional or local level enabling the exercise of rights referred to in paragraphs 1 and 2; ### establish one or more electronic health data access services at national , regional or local level enabling the exercise of rights referred to in paragraphs 1 and 2; these bodies shall incorporate health professionals’ experience when dealing with the exercise of the rights set out in paragraph 7.


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf in accordance with the provisions of member states' legislation.


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf or to enable guardians to act on behalf of their dependent children in a legitimate manner in accordance with the member state’s national standards.


### the proxy services shall provide authorisations free of charge , electronically or on paper. they shall enable guardians or other representatives to be authorised , either automatically or upon request , to access electronic health data of the natural persons whose affairs they administer. member states may provide that authorisations do not apply whenever necessary for reasons related to the protection of the natural person , and in particular based on patient safety and ethics. the proxy services shall be interoperable among member states. ### the proxy services shall provide authorisations free of charge , electronically or on paper. they shall enable guardians or other representatives to be authorised , either automatically or upon request , to access electronic health data of the natural persons whose affairs they administer. member states may provide that authorisations do not apply whenever necessary for reasons related to the protection of the natural person , and in particular based on patient safety and ethics. the proxy services shall be interoperable among member states unless the proposed rectification concerns a data record made by a health service provider , in which case the provider concerned will have to approve the rectification or lodge their opposition before the health data processing service.


### 7. member states shall ensure that , when exercising the right to rectification under article 16 of regulation (eu) 2016/679 , natural persons can easily request rectification online through the electronic health data access services referred to in paragraph 5 , point (a) , of this article. ### 7. member states shall ensure that , when exercising the right to rectification under article 16 of regulation (eu) 2016/679 , natural persons can easily request rectification online through the electronic health data access services referred to in paragraph 5 , point (a) , of this article , unless the proposed rectification concerns a data record made by a health service provider , in which case the provider in question will have to approve the rectification or lodge its opposition before the health data processing service.


### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms. ### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of healthcare providers , health professionals , data holders and data users to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms.


### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge through electronic health data access services. ### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare by means of an automatic notification procedure. the information shall be provided immediately and free of charge through electronic health data access services. the information shall include the names of the health care providers controlling the data processing , the health data that was accessed , and the time of access.


### ensure that the personal electronic health data of the natural persons they treat are updated with information related to the health services provided. ### ensure that the personal electronic health data of the natural persons they treat and the data connected with the health services offered to them are updated with information related to the health services provided.


### ensure that the personal electronic health data of the natural persons they treat are updated with information related to the health services provided. ### ensure that the personal electronic health data of the natural persons they treat are updated with information related to the health services provided and , otherwise , update data on the health services that they offer.


### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states may establish rules providing for the categories of personal electronic health data required by different health professions. such rules shall not be based on the source of electronic health data. ### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states shall establish rules providing for the categories of personal electronic health data required by different health professions. such rules shall not be based on the source of electronic health data.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. where appropriate , professional associations shall be authorised to cooperate in accordance with the provisions of national legislation.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made only available for the purpose of the healthcare treatment , to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals who lawfully carry out their work through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. to that end , they may cooperate , where appropriate , with professional associations as provided for under national rules.


### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards. ### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data.


### where data is processed in electronic format , member states shall implement access to and exchange of personal electronic health data for primary use fully or partially falling under the following categories: ### where data is registered in electronic format , member states shall implement access to and exchange of personal electronic health data for primary use fully or partially falling under the following categories:


### access to and exchange of electronic health data for primary use may be enabled for other categories of personal electronic health data available in the ehr of natural persons. ### member states may enable access to and exchange of electronic health data for primary use for other categories of personal electronic health data available in the ehr of natural persons ,


### 2. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list of priority categories of electronic health data in paragraph 1. such delegated acts may also amend annex i by adding , modifying or removing the main characteristics of the priority categories of electronic health data and indicating , where relevant , deferred application date. the categories of electronic health data added through such delegated acts shall satisfy the following criteria: ### 2. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list of priority categories of electronic health data in paragraph 1. such delegated acts may also amend annex i by adding , modifying or removing the minimum characteristics of the priority categories of electronic health data and indicating , where relevant , deferred application date. the categories of electronic health data added through such delegated acts shall satisfy the following criteria:


### 2. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list of priority categories of electronic health data in paragraph 1. such delegated acts may also amend annex i by adding , modifying or removing the main characteristics of the priority categories of electronic health data and indicating , where relevant , deferred application date. the categories of electronic health data added through such delegated acts shall satisfy the following criteria: ### 2. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list of priority categories of electronic health data in paragraph 1. such delegated acts may also amend annex i by adding , modifying or removing the minimum main characteristics of the priority categories of electronic health data and indicating , where relevant , deferred application date. the categories of electronic health data added through such delegated acts shall satisfy the following criteria:


### 3. member states shall ensure that the priority categories of personal electronic health data referred to in article 5 are issued in the format referred to in paragraph 1 and such data shall be read and accepted by the data recipient. ### 3. member states shall ensure that the priority categories of personal electronic health data referred to in article 5 are issued in the format referred to in paragraph 1 and such data shall be read and accepted by the data recipient. likewise , access to personal health data in the language of the patient or the health professional shall be assured to the extent necessary to provide those health services effectively.


### 3. member states shall ensure that the priority categories of personal electronic health data referred to in article 5 are issued in the format referred to in paragraph 1 and such data shall be read and accepted by the data recipient. ### 3. member states shall ensure that the priority categories of personal electronic health data referred to in article 5 are issued in the format referred to in paragraph 1 and such data shall be read and accepted by the data recipient including measures intended to ensure that priority categories of personal health data are translated into the language of the patient or health professional to the extent necessary for those health services to be provided.


### 1. member states shall ensure that , where data is processed in electronic format , health professionals systematically register the relevant health data falling under at least the priority categories referred to in article 5 concerning the health services provided by them to natural persons , in the electronic format in an ehr system. ### 1. member states shall ensure that , where data is processed in electronic format , health professionals register the relevant health data falling under at least the priority categories referred to in article 5 concerning the health services provided by them to natural persons , in the electronic format in an ehr system.


### article 8 ### deleted


### contribute , at union level , to the development of the european electronic health record exchange format and to the elaboration of common specifications addressing interoperability , security , safety or fundamental right concerns in accordance with article 23 and of the specifications of the eu database for ehr systems and wellness applications referred to in article 32; ### contribute , at union level , to the development of the european electronic health record exchange format and to the elaboration of common specifications addressing interoperability , security , safety or fundamental right concerns in accordance with article 23 and of the specifications of the eu database for ehr systems referred to in article 32;


### cooperate with other relevant entities and bodies at national or union level , to ensure interoperability , data portability and security of electronic health data , as well as with stakeholders representatives , including patients’ representatives , healthcare providers , health professionals , industry associations; ### cooperate with other relevant entities and bodies at national or union level , to ensure interoperability , data portability and security of electronic health data , as well as with stakeholders representatives , including patients’ representatives , healthcare providers , health professionals , through the professional associations that represent them , industry associations;


### (vii) number of certified ehr systems and labelled wellness applications enrolled in the eu database; ### (vii) number of certified ehr systems enrolled in the eu database;


### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall avoid any conflicts of interest. ### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ and healthcare professionals’ representatives. members of the digital health authority shall avoid any conflicts of interest.


### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall avoid any conflicts of interest. ### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives and health representatives. members of the digital health authority shall avoid any conflicts of interest.


### 2. the digital health authority with which the complaint has been lodged shall inform the complainant of the progress of the proceedings and of the decision taken. ### 2. the digital health authority with which the complaint has been lodged shall inform the complainant of the progress of the proceedings and of the decision taken. the digital health authority shall send a copy of the complaint to the relevant data protection supervisory authority.


### 6. member states shall ensure that pharmacies operating on their territories , including online pharmacies , are enabled to dispense electronic prescriptions issued by other member states , under the conditions laid down in article 11 of directive 2011/24/eu. the pharmacies shall access and accept electronic prescriptions transmitted to them from other member states through myhealth@eu. following dispensation of medicinal products based on an electronic prescription from another member state , pharmacies shall report the dispensation to the member state that issued the prescription , through myhealth@eu. ### 6. member states shall ensure that pharmacies operating on their territories are enabled to dispense electronic prescriptions issued by other member states , under the conditions laid down in article 11 of directive 2011/24/eu. the pharmacies shall access and accept electronic prescriptions transmitted to them from other member states through myhealth@eu. following dispensation of medicinal products based on an electronic prescription from another member state , pharmacies shall report the dispensation to the member state that issued the prescription , through myhealth@eu in accordance with national provisions on the matter.


### 6. member states shall ensure that pharmacies operating on their territories , including online pharmacies , are enabled to dispense electronic prescriptions issued by other member states , under the conditions laid down in article 11 of directive 2011/24/eu. the pharmacies shall access and accept electronic prescriptions transmitted to them from other member states through myhealth@eu. following dispensation of medicinal products based on an electronic prescription from another member state , pharmacies shall report the dispensation to the member state that issued the prescription , through myhealth@eu. ### 6. member states shall ensure that pharmacies operating on their territories are enabled to dispense electronic prescriptions issued by other member states , under the conditions laid down in article 11 of directive 2011/24/eu. the pharmacy offices shall access and accept electronic prescriptions transmitted to them from other member states through myhealth@eu , provided that the conditions laid down in their national legislation within the meaning of article 85(c) of directive 2001/83/ec and article 11 of directive 2011/24/eu. following dispensation of medicinal products based on an electronic prescription from another member state , pharmacy offices shall communicate the dispensation to the member state that issued the prescription , through myhealth@eu.


### 7. the national contact points for digital health shall act as joint controllers of the electronic health data communicated through ‘myhealth@eu’ for the processing operations in which they are involved. the commission shall act as processor. ### 7. the national contact points for digital health shall act as joint controllers of the electronic health data communicated through ‘myhealth@eu’ for the processing operations in which they are involved. the commission shall act as processor , with the limitation to the central platform myhealth@eu to provide services supporting and facilitating the electronic exchange of health data between national digital health contact points.


### 9. the approval for individual authorised participants to join myhealth@eu for different services , or to disconnect a participant shall be issued by the joint controllership group , based on the results of the compliance checks. ### 9. the approval for individual authorised participants to join myhealth@eu for different services , or to disconnect a participant , shall be issued by the ehds board , based on the results of the capacity checks carried out by the commission.


### 9. the approval for individual authorised participants to join myhealth@eu for different services , or to disconnect a participant shall be issued by the joint controllership group , based on the results of the compliance checks. ### 9. the approval for individual authorised participants to join myhealth@eu for different services , or to disconnect a participant shall be issued by the ehds board , based on the results of the compliance checks performed by the commission .


### 1. member states may provide through myhealth@eu supplementary services that facilitate telemedicine , mobile health , access by natural persons to their translated health data , exchange or verification of health-related certificates , including vaccination card services supporting public health and public health monitoring or digital health systems , services and interoperable applications , with a view to achieving a high level of trust and security , enhancing continuity of care and ensuring access to safe and high-quality healthcare. the commission shall , by means of implementing acts , set out the technical aspects of such provision. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 1. member states may provide through myhealth@eu supplementary services that facilitate telemedicine , mobile health and access by natural persons to their translated health data.


### member states and the commission shall seek to ensure interoperability of myhealth@eu with technological systems established at international level for the exchange of electronic health data. the commission may adopt an implementing act establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of myhealth@eu for the purposes of the electronic health data exchange. before adopting such an implementing act , a compliance check of the national contact point of the third country or of the system established at an international level shall be performed under the control of the commission. ### deleted


### the implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the procedure referred to in article 68. the connection of the national contact point of the third country or of the system established at an international level to the central platform for digital health , as well as the decision to be disconnected shall be subject to a decision of the joint controllership group for myhealth@eu referred to in article 66. ### deleted


### iii ehr systems and wellness applications ### iii ehr systems


### 1. ehr systems may be placed on the market or put into service only if they comply with the provisions laid down in this chapter. ### 1. ehr systems may be placed on the market or put into service only if they comply with the provisions laid down in this chapter and following the transitional periods laid down in article 72.


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by allowing manufacturers to enter the information referred to in paragraph 2 into the eu database of ehr systems and wellness applications referred to in article 32 , as an alternative to supplying the information sheet referred to in paragraph 1 with the ehr system. ### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by allowing manufacturers to enter the information referred to in paragraph 2 into the eu database of ehr systems referred to in article 32 , as an alternative to supplying the information sheet referred to in paragraph 1 with the ehr system.


### article 31 ### deleted


### registration of ehr systems and wellness applications ### registration of ehr systems


### 1. the commission shall establish and maintain a publicly available database with information on ehr systems for which an eu declaration of conformity has been issued pursuant to article 26 and wellness applications for which a label has been issued pursuant to article 31. ### 1. the commission shall establish and maintain a publicly available database with information on ehr systems for which an eu declaration of conformity has been issued pursuant to article 26;


### 2. before placing on the market or putting into service an ehr system referred to in article 14 or a wellness application referred to in article 31 , the manufacturer of such ehr system or wellness application or , where applicable , its authorised representative shall register the required data into the eu database referred to in paragraph 1. ### 2. before placing on the market or putting into service an ehr system referred to in article 14 , the manufacturer of such ehr system or , where applicable , its authorised representative shall register the required data into the eu database referred to in paragraph 1.


### 4. the commission is empowered to adopt delegated acts in accordance with article 67 to determine the list of required data to be registered by the manufacturers of ehr systems and wellness applications pursuant to paragraph 2. ### 4. the commission is empowered to adopt delegated acts in accordance with article 67 to determine the list of required data to be registered by the manufacturers of ehr systems pursuant to paragraph 2.


### 1. data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this chapter: ### 1. data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this chapter , in such a manner so as not to conflict with the holder’s legal and ethical obligations:


### 1. data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this chapter: ### 1. data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this chapter , provided that their availability does not conflict with the holder’s other legal or ethical obligations:


### ehrs; ### deleted


### ehrs; ### electronic health data from ehrs ;


### ehrs; ### non-personal ehrs;


### data impacting on health , including social , environmental behavioural determinants of health; ### deleted


### relevant pathogen genomic data , impacting on human health; ### relevant pathogen data , impacting on human health;


### health-related administrative data , including claims and reimbursement data; ### deleted


### health-related administrative data , including claims and reimbursement data; ### administrative data underlying the provision of health care services;


### human genetic , genomic and proteomic data; ### deleted


### person generated electronic health data , including medical devices , wellness applications or other digital health applications; ### person-generated electronic health data , including medical devices;


### person generated electronic health data , including medical devices , wellness applications or other digital health applications; ### person generated electronic health data , including medical devices;


### electronic data related to insurance status , professional status , education , lifestyle , wellness and behaviour data relevant to health; ### deleted


### 2. the requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in article 2 of the annex to commission recommendation 2003/361/ec59. ### 2. the requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in article 2 of the annex to commission recommendation 2003/361/ec59nor to the category of small enterprises in the context of health professional practices.


### 2. the requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in article 2 of the annex to commission recommendation 2003/361/ec59. ### 2. the requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in article 2 of the annex to commission recommendation 2003/361/ec. the requirement in the first subparagraph shall not apply to data holders who fall within the category of small enterprises in the context of health professional practices.


### 3. the electronic health data referred to in paragraph 1 shall cover data processed for the provision of health or care or for public health , research , innovation , policy making , official statistics , patient safety or regulatory purposes , collected by entities and bodies in the health or care sectors , including public and private providers of health or care , entities or bodies performing research in relation to these sectors , and union institutions , bodies , offices and agencies. ### 3. the electronic health data referred to in paragraph 1 shall cover data processed for the provision of health or care or for public health , research , innovation , policy making , official statistics , patient safety or regulatory purposes , collected by entities and bodies in the health or care sectors , including public and private providers of health or care , entities or bodies performing research in relation to these sectors , and union institutions , bodies , offices and agencies , which are processed for secondary use or that may be processed for such purposes in accordance with applicable union law or with national legislation implementing union law.


### 4. electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. where such data is made available for secondary use , all measures necessary to preserve the confidentiality of ip rights and trade secrets shall be taken. ### 4. electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. where such data is made available for secondary use , all measures necessary to preserve the confidentiality of ip rights and trade secrets shall be taken. data holders may refuse to make data available if the confidentiality of the data is not adequately ensured.


### 4. electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. where such data is made available for secondary use , all measures necessary to preserve the confidentiality of ip rights and trade secrets shall be taken. ### 4. electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. all measures necessary to preserve the confidentiality of ip rights and trade secrets shall be taken and data holders may refuse to make the data available if sufficient safeguards for those measures are not provided.


### 7. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list in paragraph 1 to adapt it to the evolution of available electronic health data. ### 7. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list in paragraph 1 to adapt it to the evolution of available electronic health data after consultations with all stakeholders , including industry and ensuring public scrutiny for the changes.


### to support public sector bodies or union institutions , agencies and bodies including regulatory authorities , in the health or care sector to carry out their tasks defined in their mandates; ### to support public sector bodies in the health or care sector;


### to support public sector bodies or union institutions , agencies and bodies including regulatory authorities , in the health or care sector to carry out their tasks defined in their mandates; ### to support public sector bodies or union institutions , agencies and bodies , including regulatory authorities and professional associations , in the health or care sector to carry out their tasks defined in their mandates;


### scientific research related to health or care sectors; ### scientific research related to health or care sectors for the purpose of improving medical diagnostics or health services or the development of new products and services;


### development and innovation activities for products or services contributing to public health or social security , or ensuring high levels of quality and safety of health care , of medicinal products or of medical devices; ### deleted


### development and innovation activities for products or services contributing to public health or social security , or ensuring high levels of quality and safety of health care , of medicinal products or of medical devices; ### development and innovation activities for products or services contributing to public health or ensuring high levels of quality and safety of health care , of medicinal products or of medical devices;


### training , testing and evaluating of algorithms , including in medical devices , ai systems and digital health applications , contributing to the public health or social security , or ensuring high levels of quality and safety of health care , of medicinal products or of medical devices; ### deleted


### training , testing and evaluating of algorithms , including in medical devices , ai systems and digital health applications , contributing to the public health or social security , or ensuring high levels of quality and safety of health care , of medicinal products or of medical devices; ### training , testing and evaluating of algorithms , including in medical devices and ai systems , contributing to the public health or social security , or ensuring high levels of quality and safety of health care , of medicinal products or of medical devices;


### providing personalised healthcare consisting in assessing , maintaining or restoring the state of health of natural persons , based on the health data of other natural persons. ### deleted


### developing products or services that may harm individuals and societies at large , including , but not limited to illicit drugs , alcoholic beverages , tobacco products , or goods or services which are designed or modified in such a way that they contravene public order or morality. ### developing products or services that may harm individuals and societies at large , including , but not limited to illicit drugs , alcoholic beverages , tobacco products or those that may cause addiction , or goods or services which are designed or modified in such a way that they contravene public order or morality.


### (7) in health systems , personal electronic health data is usually gathered in electronic health records , which typically contain a natural person’s medical history , diagnoses and treatment , medications , allergies , immunisations , as well as radiology images and laboratory results , spread between different entities from the health system (general practitioners , hospitals , pharmacies , care services). in order to enable that electronic health data to be accessed , shared and changed by the natural persons or health professionals , some member states have taken the necessary legal and technical measures and set up centralised infrastructures connecting ehr systems used by healthcare providers and natural persons. alternatively , some member states support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. several member states have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). they have also taken measures to ensure that ehr systems or wellness applications are able to transmit electronic health data with the central ehr system (some member states do this by ensuring , for instance , a system of certification). however , not all member states have put in place such systems , and the member states that have implemented them have done so in a fragmented manner. in order to facilitate the free movement of personal health data across the union and avoid negative consequences for patients when receiving healthcare in cross-border context , union action is needed in order to ensure individuals have improved acess to their own personal electronic health data and are empowered to share it. ### (7) in health systems , personal electronic health data is usually gathered in electronic health records , which typically contain a natural person’s medical history , diagnoses and treatment , medications , allergies , immunisations , as well as radiology images and laboratory results , spread between different entities from the health system (general practitioners , hospitals , pharmacies , care services). in order to enable that electronic health data to be accessed , shared and changed by the natural persons or health professionals , some member states have taken the necessary legal and technical measures and set up centralised infrastructures connecting ehr systems used by healthcare providers and natural persons. alternatively , some member states support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. several member states have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). they have also taken measures to ensure that ehr systems or wellness applications are able to transmit electronic health data with the central ehr system (some member states do this by ensuring , for instance , a system of certification). however , not all member states have put in place such systems , and the member states that have implemented them have done so in a fragmented manner. in order to facilitate the free movement of personal health data across the union and avoid negative consequences for patients when receiving healthcare in cross-border context , union action is needed in order to ensure individuals have improved access to their own personal electronic health data and are empowered to share it. however , existing electronic health records and the technological infrastructures that support them shall be retained , where possible , and member states shall further their interoperability and compliance with the provisions of this regulation.


### (11) natural persons should be further empowered to exchange and to provide access to personal electronic health data to the health professionals of their choice , going beyond the right to data portability as established in article 20 of regulation (eu) 2016/679. this is necessary to tackle objective difficulties and obstacles in the current state of play. under regulation (eu) 2016/679 , portability is limited only to data processed based on consent or contract , which excludes data processed under other legal bases , such as when the processing is based on law , for example when their processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. it only concerns data provided by the data subject to a controller , excluding many inferred or indirect data , such as diagnoses , or tests. finally , under regulation (eu) 2016/679 , the natural person has the right to have the personal data transmitted directly from one controller to another only where technically feasible. that regulation , however , does not impose an obligation to make this direct transmission technically feasible. all these elements limit the data portability and may limit its benefits for provision of high-quality , safe and efficient healthcare services to the natural person. ### (11) natural persons should be further empowered to exchange and to provide access to personal electronic health data to the health professionals of their choice , going beyond the right to data portability as established in article 20 of regulation (eu) 2016/679. this is necessary to tackle objective difficulties and obstacles in the current state of play. under regulation (eu) 2016/679 , portability is limited only to data processed based on consent or contract , which excludes data processed under other legal bases , such as when the processing is based on law , for example when their processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. it only concerns data provided by the data subject to a controller , excluding many inferred or indirect data , such as diagnoses , or tests. finally , under regulation (eu) 2016/679 , the natural person has the right to have the personal data transmitted directly from one controller to another only where technically feasible. that regulation , however , does not impose an obligation to make this direct transmission technically feasible. all these elements limit the data portability and may limit its benefits for provision of high-quality , safe and efficient healthcare services to the natural person. portability should give consumers more choice in the selection of healthcare provider , resulting in reduced healthcare costs , faster diagnosis and treatment time and overall better health outcomes.


### (16) timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. however , due to a lack of interoperability , in many cases , health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment , which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. electronic health data made available in interoperable format , which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. therefore , health professionals should be provided with appropriate electronic means , such as health professional portals , to use personal electronic health data for the exercise of their duties. moreover , the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access , including by limiting access to all or part of the personal electronic health data in their records. health professionals should refrain from hindering the implementation of the rights of natural persons , such as refusing to take into account electronic health data originating from another member state and provided in the interoperable and reliable european electronic health record exchange format. ### (16) timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. however , due to a lack of interoperability , in many cases , health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment , which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. such costs and health outcomes should be regularly assessed and quantified in order to measure the results of improved interoperability. electronic health data made available in interoperable format , which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. cost reduction should be periodically reviewed and compared between member states in order to identify best practices and deliver results in the whole internal market without potential fragmentation. therefore , health professionals should be provided with appropriate electronic means , such as health professional portals , to use personal electronic health data for the exercise of their duties. moreover , the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access , including by limiting access to all or part of the personal electronic health data in their records. health professionals should refrain from hindering the implementation of the rights of natural persons , such as refusing to take into account electronic health data originating from another member state and provided in the interoperable and reliable european electronic health record exchange format.


### (16) timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. however , due to a lack of interoperability , in many cases , health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment , which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. electronic health data made available in interoperable format , which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. therefore , health professionals should be provided with appropriate electronic means , such as health professional portals , to use personal electronic health data for the exercise of their duties. moreover , the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access , including by limiting access to all or part of the personal electronic health data in their records. health professionals should refrain from hindering the implementation of the rights of natural persons , such as refusing to take into account electronic health data originating from another member state and provided in the interoperable and reliable european electronic health record exchange format. ### (16) timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. however , due to a lack of interoperability , in many cases , health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment , which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. electronic health data made available in interoperable format , which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. therefore , health professionals should be provided with appropriate electronic means , such as health professional portals , with access managed by the professional regulatory body , to use personal electronic health data for the exercise of their duties. moreover , the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access , including by limiting access to all or part of the personal electronic health data in their records. health professionals should refrain from hindering the implementation of the rights of natural persons , such as refusing to take into account electronic health data originating from another member state and provided in the interoperable and reliable european electronic health record exchange format. none of the provisions of this regulation shall be construed as limiting health professionals’ obligation to behave in line with the relevant codes of conduct , ethical guidelines or other provisions governing ethical conduct with regard to the exchanging of , or access to , information , particularly in extreme or life-threatening situations.


### (19) the level of availability of personal health and genetic data in an electronic format varies between member states. the ehds should make it easier for natural persons to have those data available in electronic format. this would also contribute to the achievement of the target of 100% of union citizens having access to their electronic health records by 2030 , as referred to in the policy programme “path to the digital decade”. in order to make electronic health data accesible and transmissible , such data should be accessed and transmitted in an interoperable common european electronic health record exchange format , at least for certain categories of electronic health data , such as patient summaries , electronic prescriptions and dispensations , medical images and image reports , laboratory results and discharge reports , subject to transition periods. where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person , or is transmitted by another data controller in the european electronic health record exchange format , the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product , thus supporting the provision of the health care services or the dispensation of the electronic prescription. commission recommendation (eu) 2019/24345provides the foundations for such a common european electronic health record exchange format. the use of european electronic health record exchange format should become more generalised at eu and national level. while the ehealth network under article 14 of directive 2011/24/eu of the european parliament and of the council46recommended member states to use the european electronic health record exchange format in procurements , in order to improve interoperability , uptake was limited in practice , resulting in fragmented landscape and uneven access to and portability of electronic health data. ### (19) the level of availability of personal health and genetic data in an electronic format varies between member states. the ehds should make it easier for natural persons to have those data available in electronic format. this would also contribute to the achievement of the target of 100% of union citizens having access to their electronic health records by 2030 , as referred to in the policy programme “path to the digital decade”. the ehds should also contribute to other requirements , mainly to apply the once-only principle , where possible. in order to make electronic health data accesible and transmissible , such data should be accessed and transmitted in an interoperable common european electronic health record exchange format , at least for certain categories of electronic health data , such as patient summaries , electronic prescriptions and dispensations , medical images and image reports , laboratory results and discharge reports , subject to transition periods. where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person , or is transmitted by another data controller in the european electronic health record exchange format , the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product , thus supporting the provision of the health care services or the dispensation of the electronic prescription. commission recommendation (eu) 2019/24345provides the foundations for such a common european electronic health record exchange format. the use of european electronic health record exchange format should become more generalised at eu and national level. while the ehealth network under article 14 of directive 2011/24/eu of the european parliament and of the council46recommended member states to use the european electronic health record exchange format in procurements , in order to improve interoperability , uptake was limited in practice , resulting in fragmented landscape and uneven access to and portability of electronic health data.