### (1) where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### (1) where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies or data users , where relevant.


### 2. the data holder shall communicate to the health data access body a general description of the dataset it holds in accordance with article 55. ### 2. the data holder shall communicate to the application processing body a general description of the dataset it holds in accordance with article 55.


### (2) the data holder shall communicate to the health data access body a general description of the dataset it holds in accordance with article 55. ### (2) the data holder shall communicate to the application processing body a general description of the dataset it holds in accordance with article 55.


### 3. where a data quality and utility label accompanies the dataset pursuant to article 56 , the data holder shall provide sufficient documentation to the health data access body for that body to confirm the accuracy of the label. ### 3. where a data quality and utility label accompanies the dataset pursuant to article 56 , the data holder shall provide sufficient documentation to the application processing body for that body to confirm the accuracy of the label.


### (3) where a data quality and utility label accompanies the dataset pursuant to article 56 , the data holder shall provide sufficient documentation to the health data access body for that body to confirm the accuracy of the label. ### (3) where a data quality and utility label accompanies the dataset pursuant to article 56 , the data holder shall provide sufficient documentation to the application processing body for that body to confirm the accuracy of the label.


### 4. the data holder shall put the electronic health data at the disposal of the health data access body within 2 months from receiving the request from the health data access body. in exceptional cases , that period may be extended by the health data access body for an additional period of 2 months. ### 4. where the data holder has a processing environment that meets the conditions of the secure processing environment in accordance with article 50 , the data holder shall make the electronic health data available to the data user through that processing environment , using the pseudonymisation body as an intermediary; where the data holder does not have such a processing environment , the data holder shall put the electronic health data at the disposal of the health data access body , using the pseudonymisation body as an intermediary. the electronic health data shall be made available by the data holder within two months of receipt of the application from the application processing body. in exceptional cases , the two-month period may be extended by a further two months by the application processing body.


### 4. the data holder shall put the electronic health data at the disposal of the health data access body within 2 months from receiving the request from the health data access body. in exceptional cases , that period may be extended by the health data access body for an additional period of 2 months. ### 4. the data holder shall put the electronic health data referred to in paragraph 1 at the disposal of the health data access body within 3 months from receiving the request from the health data access body , taking into account the different technical features between the categories referred to in article 33(1) and how those can affect the timeframe for the delivery of the data. in exceptional cases , that period may be extended by the health data access body for an additional period of 3 months.


### (4) the data holder shall put the electronic health data at the disposal of the health data access body within 2 months from receiving the request from the health data access body. in exceptional cases , that period may be extended by the health data access body for an additional period of 2 months. ### (4) where the data holder has a processing environment that meets the conditions of the secure processing environment in accordance with article 50 , the data holder shall put the electronic health data at the disposal of the data user through that processing environment using the pseudonymisation body as an intermediary; where the data holder does not have such a processing environment , the data holder shall put the electronic health data at the disposal of the health data access body using the pseudonymisation body as an intermediary. the electronic health data shall be made available by the data holder within 2 months of receipt of the application from the application processing body. in exceptional cases , the 2-month period may be extended by the application processing body for an additional period of 2 months.


### 7. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the duties of the data holders in this article , to reflect the evolution of activities performed by data holders. ### deleted


### (7) the commission is empowered to adopt delegated acts in accordance with article 67 to amend the duties of the data holders in this article , to reflect the evolution of activities performed by data holders. ### deleted


### 1. health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] ### 1. application processing bodies , health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final]


### (1) health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] ### (1) application processing bodies , health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final]


### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget. ### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the fees shall be calculated according to objective criteria , in particular the completeness and representativeness of the data , the number of patients concerned , the scarcity of the data and the cost of any processes used to make the data accessible , such as anonymisation. the support received by the data holder from donations , public national or union grants , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget.


### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget. ### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to objective parameters relating to budget , size , and research importance.


### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget. ### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , academic and educational institutions , non-commercial entities and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget.


### 5. where data holders and data users do not agree on the level of the fees within 1 month of the data permit being granted , the health data access body may set the fees in proportion to the cost of making available electronic health data for secondary use. where the data holder or the data user disagree with the fee set out by the health data access body , they shall have access to dispute settlement bodies set out in accordance with article 10 of the regulation […] [data act com/2022/68 final]. ### 5. where data holders and data users do not agree on the level of the fees within 1 month of the data permit being granted , the health data access body may set the fees in proportion to the cost of making available electronic health data for secondary use. where the data users are non-commercial entities , their size and financial resources shall be taken into account when the fees are set. where the data holder or the data user disagree with the fee set out by the health data access body , they shall have access to dispute settlement bodies set out in accordance with article 10 of the regulation […] [data act com/2022/68 final].


### 5. where data holders and data users do not agree on the level of the fees within 1 month of the data permit being granted , the health data access body may set the fees in proportion to the cost of making available electronic health data for secondary use. where the data holder or the data user disagree with the fee set out by the health data access body , they shall have access to dispute settlement bodies set out in accordance with article 10 of the regulation […] [data act com/2022/68 final]. ### 5. where data holders and data users do not agree on the level of the fees within 1 month of the data permit being granted , the application processing body may set the fees in proportion to the cost of making available electronic health data for secondary use. where the data holder or the data user disagree with the fee set out by the application processing body , they shall have access to dispute settlement bodies set out in accordance with article 10 of the regulation […] [data act com/2022/68 final].


### (5) where data holders and data users do not agree on the level of the fees within 1 month of the data permit being granted , the health data access body may set the fees in proportion to the cost of making available electronic health data for secondary use. where the data holder or the data user disagree with the fee set out by the health data access body , they shall have access to dispute settlement bodies set out in accordance with article 10 of the regulation […] [data act com/2022/68 final]. ### (5) where data holders and data users do not agree on the level of the fees within 1 month of the data permit being granted , the application processing body may set the fees in proportion to the cost of making available electronic health data for secondary use. where the data holder or the data user disagree with the fee set out by the application processing body , they shall have access to dispute settlement bodies set out in accordance with article 10 of the regulation […] [data act com/2022/68 final].


### 2. when requesting from data users and data holders the information that is necessary to verify compliance with this chapter , the health data access bodies shall be proportionate to the performance of the compliance verification task. ### 2. when requesting from data users and data holders as well as other bodies involved in accessing health data the information that is necessary to verify compliance with this chapter , the health data access bodies shall be proportionate to the performance of the compliance verification task.


### (2) when requesting from data users and data holders the information that is necessary to verify compliance with this chapter , the health data access bodies shall be proportionate to the performance of the compliance verification task. ### (2) when requesting from data users and data holders as well as other bodies involved in the access to health data the information that is necessary to verify compliance with this chapter , the health data access bodies shall be proportionate to the performance of the compliance verification task.


### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### 4. health data access bodies shall have the power to declare the data permit issued pursuant to article 46 invalid and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to declare the data permit invalid and to exclude the data user from any access to electronic health data for a period of up to 5 years.


### (4) health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### (4) health data access bodies shall have the power to declare the data permit issued pursuant to article 46 void and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to declare the data permit void and to exclude the data user from any access to electronic health data for a period of up to 5 years.


### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49. ### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49.


### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49. ### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body in accordance with the tasks of the ehds board , set out in article 65 of this regulation. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49.


### 10. the commission may issues guidelines on penalties to be applied by the health data access bodies. ### 10. the commission shall issue guidelines on penalties to be applied by the health data access bodies.


### 1. the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted. ### 1. the health data access body or the data holder shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.


### (1) the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted. ### (1) the health data access body or the data holder shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.


### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. the health data access bodies shall specify which entity has been tasked with anonymisation and which anonymisation standard has been applied. specific provisions shall be put in place for data on rare diseases.


### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### 2. the health data access bodies or data holders shall provide the electronic health data in an anonymised format , where appropriate using the pseudonymisation body as an intermediary , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user.


### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### 2. the health data access bodies shall always provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user.


### (2) the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### (2) the health data access bodies or data holders shall provide the electronic health data in an anonymised format , where appropriate using the pseudonymisation body as an intermediary , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. for that purpose , health data access points shall verify in advance the compliance of the pseudonymisation of the data for processing by the data user with article 6 or article 9 of regulation (eu) 2016/679. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , or for the purpose of the evaluation of the benefits and risks of medicinal products or of the identification and assessment of threats to human health posed by infectious diseases , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information required to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information required to reverse the pseudonymisation shall be available only to the health data access body , which will eliminate it after pseudonymisation completion. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies or the data holder shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the pseudonymisation body or the data holder. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the pseudonymisation body’s or the data holder’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. only in the exceptional cases where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user or for the purpose of the evaluation of the benefits and risks of medicinal products and of the identification and assessment of threats to human health posed by infectious diseases , , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### (3) where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### (3) where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies or the data holder shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the pseudonymisation body or the data holder. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the pseudonymisation body’s or the data holder’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### a description of the safeguards planned to protect the rights and interests of the data holder and of the natural persons concerned; ### a description of the necessary technical and organizational measures pursuant to article 32 of regulation (eu) 2016/679;


### 3. data users seeking access to electronic health data from more than one member state shall submit a single application to one of the concerned health data access bodies of their choice which shall be responsible for sharing the request with other health data access bodies and authorised participants in healthdata@eu referred to in article 52 , which have been identified in the data access application. for requests to access electronic health data from more than one member states , the health data access body shall notify the other relevant health data access bodies of the receipt of an application relevant to them within 15 days from the date of receipt of the data access application. ### 3. data users seeking access to electronic health data from more than one member state shall submit a single application to one of the concerned application processing bodies of their choice which shall be responsible for sharing the request with other application processing bodies and authorised participants in healthdata@eu referred to in article 52 , which have been identified in the data access application. for requests to access electronic health data from more than one member states , the application processing body shall notify the other relevant application processing bodies of the receipt of an application relevant to them within 15 days from the date of receipt of the data access application.


### 3. data users seeking access to electronic health data from more than one member state shall submit a single application to one of the concerned health data access bodies of their choice which shall be responsible for sharing the request with other health data access bodies and authorised participants in healthdata@eu referred to in article 52 , which have been identified in the data access application. for requests to access electronic health data from more than one member states , the health data access body shall notify the other relevant health data access bodies of the receipt of an application relevant to them within 15 days from the date of receipt of the data access application. ### 3. data users seeking access to electronic health data from more than one member state shall submit a single application to one of the concerned health data access bodies of their choice which shall be responsible for sharing the request with other health data access bodies and authorised participants in healthdata@eu referred to in article 52 , which have been identified in the data access application. for requests to access electronic health data from more than one member states , the health data access body shall notify the other relevant health data access bodies of the receipt of an application relevant to them within 30 days from the date of receipt of the data access application.


### (3) data users seeking access to electronic health data from more than one member state shall submit a single application to one of the concerned health data access bodies of their choice which shall be responsible for sharing the request with other health data access bodies and authorised participants in healthdata@eu referred to in article 52 , which have been identified in the data access application. for requests to access electronic health data from more than one member states , the health data access body shall notify the other relevant health data access bodies of the receipt of an application relevant to them within 15 days from the date of receipt of the data access application. ### (3) data users seeking access to electronic health data from more than one member state shall submit a single application to one of the concerned application processing bodies of their choice which shall be responsible for sharing the request with other application processing bodies and authorised participants in healthdata@eu referred to in article 52 , which have been identified in the data access application. for requests to access electronic health data from more than one member states , the application processing body shall notify the other relevant application processing bodies of the receipt of an application relevant to them within 15 days from the date of receipt of the data access application.


### a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679; ### a description of the legal basis on which the processing is to be carried out within the meaning of article 6(1) of regulation (eu) 2016/679;


### a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679; ### a description of how the processing would comply with article 6(1) or article 9 of regulation (eu) 2016/679;


### where the public sector bodies and the union institutions , bodies , offices and agencies intend to access the electronic health data in pseudonymised format , a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679 or article 5(1) of regulation (eu) 2018/1725 , as applicable , shall also be provided. ### where the public sector bodies and the union institutions , bodies , offices and agencies intend to access the electronic health data in pseudonymised format , a description of the legal basis on which the processing is to be carried out within the meaning of article 6(1) of regulation (eu) 2016/679 shall also be provided.


### 6. the commission may , by means of implementing acts , set out the templates for the data access application referred to in this article , the data permit referred to in article 46 and the data request referred to in article 47. those implementing acts shall be adopted in accordance with the procedure referred to in article 68(2). ### 6. the commission may , by means of implementing acts , set out the templates for the data access application referred to in this article , the data permit referred to in article 46 and the data request referred to in article 47. these templates shall be developed with the aim to limit unnecessary bureaucratic burden for applicants to the greatest possible extent. those implementing acts shall be adopted in accordance with the procedure referred to in article 68(2).


### 6. the commission may , by means of implementing acts , set out the templates for the data access application referred to in this article , the data permit referred to in article 46 and the data request referred to in article 47. those implementing acts shall be adopted in accordance with the procedure referred to in article 68(2). ### 6. the commission shall , by means of implementing acts , set out the templates for the data access application referred to in this article , the data permit referred to in article 46 and the data request referred to in article 47. those implementing acts shall be adopted in accordance with the procedure referred to in article 68(2) and shall be limited to what is strictly necessary to avoid any unnecessary administrative burden.


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , and only after any data sharing agreement(s) on mutually agreed terms required by this regulation , such as set out in article 46a , are signed , the health data access body shall issue a data permit. however , any assessments by health data access bodies of an application concerning any data under article 33(4) shall require the health data access bodies to consult the data holder(s).


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. application processing bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the application processing body shall issue a data permit.


### (1) health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### (1) application processing bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the application processing body shall issue a data permit.


### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met. ### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met , including in the event a data holder permissibly refuses to give access to its data under article 33(1).


### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met. ### 2. application processing bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met.


### (2) health data access bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met. ### (2) application processing bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. if the health data access body finds that the data access application is incomplete , it shall notify the data user and indicate the documents to be filed subsequently. if the data user does not fullfill this request within 4 weeks , a permit will not be granted. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. an application processing body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the application processing body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where an application processing body fails to provide a decision within the time limit , the data permit shall be issued.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall not be issued.


### (3) a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### (3) an application processing body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the application processing body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where an application processing body fails to provide a decision within the time limit , the data permit shall be issued.


### 4. following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe. ### 4. following the issuance of the data permit , the application processing body shall call on the data holder to transmit the electronic health data to the health data access body , or to make it available to the data user , via the pseudonymisation body without delay. the health data access body or the data holder shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe.


### 4. following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe. ### 4. following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , except where the health data access body can duly justify the need for an extension. in this case , a longer specified timeframe shall be decided.


### (4) following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe. ### (4) following the issuance of the data permit , the application processing body shall call on the data holder to transmit the electronic health data to the health data access body , or to make it available to the data user , via the pseudonymisation body without delay. the health data access body or the data holder shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe.


### 5. when the health data access body refuses to issue a data permit , it shall provide a justification for the refusal to the applicant. ### 5. when the application processing body refuses to issue a data permit , it shall provide a justification for the refusal to the applicant.


### (5) when the health data access body refuses to issue a data permit , it shall provide a justification for the refusal to the applicant. ### (5) when the application processing body refuses to issue a data permit , it shall provide a justification for the refusal to the applicant.


### 7. data users shall have the right to access and process the electronic health data in accordance with the data permit delivered to them on the basis of this regulation. ### 7. data users shall have the right to access and process the electronic health data in accordance with the data permit delivered to them on the basis of this regulation. pursuant to article 9)(1) , point (j) , of regulation (eu)2016/679 , where the permit allows data users to process personal electronic health data , data users shall have a right to process such data , subject to the safeguards and limitations set out in this regulation and the permit.


### 9. a data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 5 years. this duration may be extended once , at the request of the data user , based on arguments and documents to justify this extension provided , 1 month before the expiry of the data permit , for a period which cannot exceed 5 years. by way of derogation from article 42 , the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 5 years. in order to reduce such costs and fees , the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. the data within the secure processing environment shall be deleted within 6 months following the expiry of the data permit. upon request of the data user , the formula on the creation of the requested dataset shall be stored by the health data access body. ### 9. a data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 10 years. this duration may be extended once , at the request of the data user , based on arguments and documents to justify this extension provided , 1 month before the expiry of the data permit , for a period which cannot exceed 2 years. by way of derogation from article 42 , the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 5 years. in order to reduce such costs and fees , the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. the data within the secure processing environment shall be deleted within 6 months following the expiry of the data permit. upon request of the data user , the formula on the creation of the requested dataset shall be stored by the health data access body.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output (in accordance with the definition of results/outputs under article 2) of the secondary use of electronic health data , including information relevant for the provision of healthcare and in compliance with minimum requirements of what needs to be published , but such that this will not prejudice the ip rights in the secondary use results/outputs , particularly if the secondary use is for development or innovation as referred to in article 34(f) , no later than 18 months after the completion of the electronic health data processing with a possible extension to 24 months if requested by data users due to sensitivity of health data in relation to ip rights. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output (in accordance with the definition of results /outputs under article 2) of the secondary use of electronic health data on a voluntary basis , including information relevant for the provision of healthcare and in compliance with minimum requirements of what needs to be published , but such that this will not prejudice the ip rights in the secondary use results/outputs , particularly if the secondary use is for development or innovation as referred to in article 34(f) , no later than 18 months after the completion of the electronic health data processing with a possible extension to 24 months. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. data users shall not be obliged to make public results or output in a way that compromises intellectual property rights contained therein. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the application processing bodies from which a data permit was obtained and support them to make the information public on the application processing bodies’ websites or on a central website. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. data users shall not be obliged to make public results or output in a way which compromises intellectual property rights contained therein. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### (11) data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### (11) data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the application processing bodies from which a data permit was obtained and support them to make the information public on the application processing bodies’ websites or on a central website. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### 12. data users shall inform the health data access body of any clinically significant findings that may influence the health status of the natural persons whose data are included in the dataset. ### 12. data users shall inform the application processing body of any clinically significant findings that may influence the health status of the natural persons whose data are included in the dataset.


### (12) data users shall inform the health data access body of any clinically significant findings that may influence the health status of the natural persons whose data are included in the dataset. ### (12) data users shall inform the application processing body of any clinically significant findings that may influence the health status of the natural persons whose data are included in the dataset.


### 14. the liability of health data access bodies as joint controller is limited to the scope of the issued data permit until the completion of the processing activity. ### 14. the liability of health data access bodies or of the data holder as joint controller , depending on who makes the data available to the data user , is limited to the scope of the issued data permit until the completion of the processing activity.


### (14) the liability of health data access bodies as joint controller is limited to the scope of the issued data permit until the completion of the processing activity. ### (14) the liability of health data access bodies or of the data holder as joint controller , depending on who makes the data available to the data user , is limited to the scope of the issued data permit until the completion of the processing activity.


### lays down rules for the placing on the market , making available on the market or putting into service of electronic health records systems (‘ehr systems’) in the union; ### lays down rules for the placing on the market , making available on the market or putting into service of electronic health records systems (‘ehr systems’) in the union for all electronic health applications that use data and produce wearables , health apps , telemedicine platforms , etc. , with those data;


### manufacturers and suppliers of ehr systems and wellness applications placed on the market and put into service in the union and the users of such products; ### manufacturers and suppliers of ehr systems , medical devices , wellness applications and other digital health applications that are able to process electronic data related to insurance status , professional status , education , lifestyle , wellness and behaviour data relevant to health and that are placed on the market and put into service in the union and the users of such products;


### controllers and processors established in the union processing electronic health data of union citizens and third-country nationals legally residing in the territories of member states; ### data holders and data users established in the union processing electronic health data of union citizens and third-country nationals legally residing in the territories of member states;


### data users to whom electronic health data are made available by data holders in the union. ### data users to whom electronic health data are made available by data holders in the union or third countries or international institutions.


### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , as well as data referring to determinants of health , or data processed in relation to the provision of healthcare services , processed in an electronic form; ### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 that are processed in an electronic form;


### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , as well as data referring to determinants of health , or data processed in relation to the provision of healthcare services , processed in an electronic form; ### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , processed in an electronic form;


### ‘electronic health data’ means personal or non-personal electronic health data; ### ‘electronic health data’ means personal or non-personal electronic health data processed by providers in the context of healthcare. such data may include actionable health data , which is collected and processed by providers in the context of healthcare which provides clinical measurements/values that are usable by patients , healthcare professionals and researchers.


### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for the purpose of the secondary use; ### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation.


### ‘european electronic health record exchange format’ means a structured , commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications , devices and healthcare providers; ### ‘european electronic health record exchange format’ means a structured , commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications , devices and healthcare providers; that format shall be easy to read , consolidated and accessible when sent to a natural person in accordance with article 3 of this regulation;


### ‘telemedicine’ means the provision of healthcare services , including remote care and online pharmacies , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location; ### ‘telemedicine’ means the provision of healthcare services , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location;


### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for healthcare purposes; ### ‘ehr’ (electronic health record) means a collection of dataset related to a natural person and collected in the health system , processed for healthcare purposes;


### ‘ehr system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records; ### ‘ehr system’ (electronic health record system) means any appliance or software whose primary purpose is to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records;


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘health data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has either:


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , to make available , including to register , provide , restrict access or exchange certain data;


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , with the exception of personal data processors as defined in article 28 of regulation (eu) 2016/679 , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data;


### ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use; ### ‘health data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use;


### (aa) ‘data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation; ### (aa) ‘data permit’ means an administrative decision issued to a data user by an application processing body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation;


### 1. natural persons shall have the right to access their personal electronic health data processed in the context of primary use of electronic health data , immediately , free of charge and in an easily readable , consolidated and accessible form. ### 1. natural persons shall have the right to access their personal electronic health data processed in the context of primary use of electronic health data , without undue delay , free of charge and in an easily readable , consolidated and accessible form.


### 2. natural persons shall have the right to receive an electronic copy , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5. ### 2. natural persons shall have the right to receive an electronic copy or a hard copy of their electronic health data upon request to a health professional , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5;


### 2. natural persons shall have the right to receive an electronic copy , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5. ### 2. natural persons shall have the right to receive an electronic copy , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5. member states shall provide manufacturers with uniform templates to ensure conformity with the referred articles.


### 2. natural persons shall have the right to receive an electronic copy , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5. ### 2. natural persons shall have the right to receive an electronic or paper copy , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5.


### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health. ### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of the right provided for in paragraph 1 whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health.


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more proxy services enabling a natural person to legitimately authorise , under the national rules of the member state , a legitimate legal representative of the patient to access their electronic health data on their behalf.


### 6. natural persons may insert their electronic health data in their own ehr or in that of natural persons whose health information they can access , through electronic health data access services or applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative. ### 6. natural persons may insert , access and download their electronic health data in and from their own ehr or in that of natural persons whose health information they can access , through electronic health data access services and applications linked to these services. that information shall be marked as inserted , accessed or downloaded by the natural person or by the legitimate legal representative of the patient.


### 6. natural persons may insert their electronic health data in their own ehr or in that of natural persons whose health information they can access , through electronic health data access services or applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative. ### 6. natural persons may insert , access and export their electronic health data in their own ehr or in that of natural persons whose health information they can access , through electronic health data access services or applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative.


### natural persons shall have the right to give access to or request a data holder from the health or social security sector to transmit their electronic health data to a data recipient of their choice from the health or social security sector , immediately , free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. ### natural persons shall have the right to give access to or request a data holder from the health or social security sector to transmit their electronic health data to a data recipient of their choice from the health or social security sector , immediately , free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. the data recipients shall be easily identifiable to the natural persons transmitting their electronic health data and demonstrate their affiliation to the health or social security sector.


### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms. ### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms , including the terms of medical liability. it shall be clearly indicated in the ehr when access to information has been restricted by a natural person or by his or her representative.


### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge through electronic health data access services. ### 10. natural persons shall have the right to receive an automatic notification with information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare , and on the substance of the accessed data. the information shall be provided immediately and free of charge through electronic health data access services.


### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge through electronic health data access services. ### 10. natural persons shall have the right to obtain information on any access to their electronic health data , including information about the identity of the person who accessed their electronic health data , which health data was accessed and the time of access. the information shall be provided immediately and free of charge through electronic health data access services.


### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge through electronic health data access services. ### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge in a readable , consolidated and accessible format through electronic health data access services.


### 11. the supervisory authority or authorities responsible for monitoring the application of regulation (eu) 2016/679 shall also be responsible for monitoring the application of this article , in accordance with the relevant provisions in chapters vi , vii and viii of regulation (eu) 2016/679. they shall be competent to impose administrative fines up to the amount referred to in article 83(5) of that regulation. those supervisory authorities and the digital health authorities referred to in article 10 of this regulation shall , where relevant , cooperate in the enforcement of this regulation , within the remit of their respective competences. ### 11. the supervisory authority or authorities responsible for monitoring the application of regulation (eu) 2016/679 shall also be responsible for monitoring the application of this article , in accordance with the relevant provisions in chapters vi , vii and viii of regulation (eu) 2016/679. they shall be competent to impose administrative fines up to the amount referred to in article 83(5) of that regulation. those supervisory authorities and the digital health authorities referred to in article 10 of this regulation shall , where relevant , cooperate in the enforcement of this regulation , within the remit of their respective competences.


### have access to the electronic health data of natural persons under their treatment , irrespective of the member state of affiliation and the member state of treatment; ### have access to the electronic health data of natural persons under their treatment , on a need-to-know basis , irrespective of the member state of affiliation and the member state of treatment;


### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states may establish rules providing for the categories of personal electronic health data required by different health professions. such rules shall not be based on the source of electronic health data. ### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states shall establish rules providing for the categories of personal electronic health data required by different health professions in accordance with the principles of purpose limitation and data minimisation. such rules shall not be based on the source of electronic health data.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. health professionals should be given appropriate trainings and regular digital literacy courses as means to reduce fragmentation and promote harmonisation.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states and , where appropriate , local or regional authorities shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals , including for cross-border care , through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge.


### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards. ### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person. it shall be clearly indicated in the ehr when access to information has been restricted by a natural person or by his or her representative. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards.