### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural and consumersectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.


### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950 or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950 or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.


### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible , bearing in mind technical feasibility and existing best practices. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.


### (56) in case of cross-border registries or databases , such as the registries of european reference networks for rare diseases , which receive data from different healthcare providers in several member states , the health data access body where the coordinator of the registry is located should be responsible for providing access to data. ### (56) in case of cross-border registries or databases , such as the registries of european reference networks for rare diseases , which receive data from different healthcare providers in several member states , an application processing body from the member state in which the coordinator of the registry is located should be responsible for providing access to data.


### (57) the authorisation process to gain access to personal health data in different member states can be repetitive and cumbersome for data users. whenever possible , synergies should be established to reduce the burden and barriers for data users. one way to achieve this aim is to adhere to the “single application” principle whereby , with one application , the data user obtain authorisation from multiple health data access bodies in different member states. ### (57) the authorisation process to gain access to personal health data in different member states can be repetitive and cumbersome for data users. whenever possible , synergies should be established to reduce the burden and barriers for data users. one way to achieve this aim is to adhere to the “single application” principle whereby , with one application , the data user obtain authorisation from multiple application processing bodies in different member states.


### (58) the health data access bodies should provide information about the available datasets and their characteristics so that data users can be informed of elementary facts about the dataset and assess their possible relevance to them. for this reason , each dataset should include , at least , information concerning the source , nature of data and conditions for making data available. therefore , an eu datasets catalogue should be established to facilitate the discoverability of datasets available in the ehds; to help data holders to publish their datasets; to provide all stakeholders , including the general public , also taking into account people with disabilities , with information about datasets placed on the ehds (such as quality and utility labels , dataset information sheets); to provide the data users with up-to-date data quality and utility information about datasets. ### (58) application processing bodies should provide information about the available datasets and their characteristics so that data users can be informed of elementary facts about the dataset and assess their possible relevance to them. for this reason , each dataset should include , at least , information concerning the source , nature of data and conditions for making data available. therefore , an eu datasets catalogue should be established to facilitate the discoverability of datasets available in the ehds; to help data holders to publish their datasets; to provide all stakeholders , including the general public , also taking into account people with disabilities , with information about datasets placed on the ehds (such as quality and utility labels , dataset information sheets); to provide the data users with up-to-date data quality and utility information about datasets.


### (61) cooperation and work is ongoing between different professional organisations , the commission and other institutions to set up minimum data fields and other characteristics of different datasets (registries for instance). this work is more advanced in areas such as cancer , rare diseases , and statistics and shall be taken into account when defining new standards. however , many datasets are not harmonised , raising comparability issues and making cross-border research difficult. therefore , more detailed rules should be set out in implementing acts to ensure a harmonised provision , coding and registration of electronic health data. member states should work towards delivering sustainable economic and social benefits of european electronic health systems and services and interoperable applications , with a view to achieving a high level of trust and security , enhancing continuity of healthcare and ensuring access to safe and high-quality healthcare. ### (61) cooperation and work is ongoing between different professional organisations , the commission and other institutions to set up minimum data fields and other characteristics of different datasets (registries for instance). this work is more advanced in areas such as cancer , rare diseases , and statistics and shall be taken into account when defining new standards. however , many datasets are not harmonised , raising comparability issues and making cross-border research difficult. for example , the terminology used in disease classification (essential for providing a diagnosis) varies across member states , where adoption of the latest update to the international classification of diseases could improve interoperability of such patient data. therefore , more detailed rules should be set out in implementing acts to ensure a harmonised provision , coding and registration of electronic health data. member states should work towards delivering sustainable economic and social benefits of european electronic health systems and services and interoperable applications , with a view to achieving a high level of trust and security , enhancing continuity of healthcare and ensuring access to safe and high-quality healthcare.


### (62) the commission should support member states in building capacity and effectiveness in the area of digital health systems for primary and secondary use of electronic health data. member states should be supported to strengthen their capacity. activities at union level , such as benchmarking and exchange of best practices are relevant measures in this respect. ### (62) the commission should support member states in building capacity , interoperability and effectiveness in the area of digital health systems for primary and secondary use of electronic health data. member states should be supported to strengthen their capacity and improve the interoperability of their digital health systems within and between member states. activities at union level , such as benchmarking and exchange of best practices are relevant measures in this respect.


### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. ### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. eu funds must be distributed adequately and sufficiently among the member states , ensuring its well-endowment and taking into account different levels of health system digitalisation and the costs involved in making national data infrastructures interoperable and compatible with the requirements of the ehds.


### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. ### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. the union funds should be distributed among member states on the basis of the levels of digitalisation of their health systems and the financial effort they have to make to implement the provisions of this regulation.


### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. therefore , appropriate anonymisation under this regulation is only possible if it cannot be reversed in the future. in particular , in order to protect data subjects , no individual datasets may be issued in connection with secondary use under this regulation.


### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. in case of mixed datasets , where personal and non-personal data are inextricably linked , and where a distinction between categories of personal and non-personal data is difficult to apply and results in the possibility to infer personal data from non-personal data , protections of regulation (eu) 2016/679 and of this regulation concerning personal electronic health data should be applicable.


### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### (64) certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal , as already specifically foreseen in the data governance act. even in situations of the use of state of the art anonymization techniques , there remains a residual risk that the capacity to re-identify could be or become available , beyond the means reasonably likely to be used. such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the union) , where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. it can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects , the number of people affected or and for instance in cases of data included in electronic health records , disease registries , biobanks , person generated data etc. where the identification characteristics are broader and where , in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation , can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. the realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this regulation at risk. this underlines the need for a harmonized interpretation of anonymisation and pseudonymisation across member states. furthermore , aggregation techniques are less tested for non-personal data containing for example trade secrets , as in the reporting on clinical trials , and enforcement of breaches of trade secrets outside the union is more difficult in the absence of a sufficient international protection standard. therefore , for these types of health data , there remains a risk for re-identification after the anonymisation or aggregation , which could not be reasonably mitigated initially. this falls within the criteria indicated in article 5(13) of regulation […] [data governance act com/2020/767 final]. these types of health data would thus fall within the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final] for transfer to third countries. the protective measures , proportional to the risk of re-identification , would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final].


### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. ### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the board should consist of representatives from digital health authorities , european data protection board , european data protection supervisor , european medicines agency , european centre for disease prevention and control , healthcare professionals , patient organizations , social security institutions and the health industry. all board members have the same rights and responsibilities. furthermore , experts of the european parliament should be invited to attend the meetings of the ehds board. the ehds board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. the ehds board should operate transparently with open publication of meeting dates and minutes of the discussion as well as an annual report. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act].


### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. ### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the board should consists of representatives from digital health authorities , european data protection board , european data protection supervisor , european medicines agency , european centre for disease prevention and control , healthcare professionals , patient organizations , research community and health industry. all board members have the same rights and responsibilities. furthermore , experts of the european parliament should be invited to attend the meetings of the ehds board. the ehds board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. the ehds board should operate transparently with open publication of meeting dates and minutes of the discussion as well as an annual report. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act].


### (1) any natural or legal person may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer. ### (1) any natural or legal person may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request which is transmitted to it by the application processing body in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer.


### (1) any natural or legal person may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer. ### (1) any natural or legal person may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request , which is transmitted to it by the application processing body , in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer.


### 3. where an applicant has requested a result in an anonymised form , including statistical format , based on a data request , the health data access body shall assess , within 2 months and , where possible , provide the result to the data user within 2 months. ### 3. where an applicant has requested a result in an anonymised form , including statistical format , based on a data request , the health data access body shall assess , within 3 months and , where possible , provide the result to the health data user within 3 months.


### article 48 ### deleted


### making data available for public sector bodies and union institutions , bodies , offices and agencies without a data permit ### making data available for union agencies without a data permit


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. where electronic health data involving protected intellectual property and trade secrets are made available , it shall be ensured that all necessary measures are taken to protect the confidentiality of intellectual property rights and trade secrets. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation [...] [data governance act com/2020/767 final]. by way of derogation from that regulation [...] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article for any of the purposes under article 34(1) , points (a) or (b). when carrying out those tasks under article 37 (1) , points (b) and (c) , and upon request from the union agencies , in duly justified cases the health data access body shall make the electronic health data available within 1 month of the data access application. however , data shall be shared as soon as it is available in the context of a public health emergency of international concern (pheic) or when a public health emergency has been declared at union level.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. for the purpose of the evaluation of the benefits and risks of medicinal products and of the identification and assessment of threats to human health posed by infectious diseases , the ema and ecdc shall be granted rapid and unrestricted access to the health data within the ehds. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe.


### article 49 ### deleted


### 4. within 3 months the data holder shall inform the relevant health data access body by electronic means of all data access applications filed and all the data permits issued and the data requests fulfilled under this article in order to enable the health data access body to fulfil its obligations under article 37(1) and article 39. ### 4. the single data holder , referred to in paragraph 1 , shall in due time inform the relevant health data access body by electronic means of all data access applications filed and all the data permits issued and the data requests fulfilled under this article in order to enable the health data access body to fulfil its obligations under article 37(1) and article 39.


### 1. the health data access bodies shall provide access to electronic health data only through a secure processing environment , with technical and organisational measures and security and interoperability requirements. in particular , they shall take the following security measures: ### 1. the health data access bodies shall provide access to electronic health data only through a secure processing environment , with technical and organisational measures and security and interoperability requirements and protection of intellectual property and trade secrets. in particular , they shall take the following security measures:


### keep identifiable logs of access to the secure processing environment for the period of time necessary to verify and audit all processing operations in that environment; ### keep identifiable logs of access that include data access holders to the secure processing environment for the period of time necessary to verify and audit all processing operations in that environment;


### ensure compliance and monitor the security measures referred to in this article to mitigate potential security threats. ### ensure compliance and monitor the security measures referred to in this article to minimise potential security threats.


### (2) the health data access bodies shall ensure that electronic health data can be uploaded by data holders and can be accessed by the data user in a secure processing environment. the data users shall only be able to download non-personal electronic health data from the secure processing environment. ### (2) the health data access bodies shall ensure that electronic health data can be uploaded by data holders and can be accessed by the data user in a secure processing environment. the data users shall only be able to download non-personal electronic health data from the secure processing environment. initially personal data may only be downloaded by data users if anonymised in accordance with this regulation; this is usually the case only for aggregated data from at least 100 individual datasets.


### (1) the health data access bodies and the data users , including union institutions , bodies , offices and agencies , shall be deemed joint controllers of electronic health data processed in accordance with data permit. ### (1) the health data access bodies and the data users , including union institutions , bodies , offices and agencies , shall be deemed joint controllers of electronic health data processed in accordance with data permit. in the event that the data holder provides access to the electronic health data to the data user without going through the health data access bodies , the data holder and data user shall be joint controllers of the electronic health data processed in accordance with the data permit.


### 1. each member state shall designate a national contact point for secondary use of electronic health data , responsible for making electronic health data available for secondary use in a cross-border context and shall communicate their names and contact details to the commission. the national contact point may be the coordinator health data access body pursuant to article 36. the commission and the member states shall make this information publicly available. ### 1. each member state shall designate a national contact point for secondary use of electronic health data. the national contact point shall work as an organisational and technical gateway , enabling and being responsible for making electronic health data available for secondary use in a cross-border context. when constructing a national contact point , it shall be in close consultation with the holders and users of data for the specific member state. every member state shall inform the commission of the name and contact details of their respective national contact point by the date of application of this regulation. the national contact point may be the coordinator health data access body pursuant to article 36. the commission and the member states shall make this information publicly available.


### (3) union institutions , bodies , offices and agencies involved in research , health policy or analysis , shall be authorised participants of healthdata@eu. ### (3) union institutions , bodies , offices and agencies in the health sector involved in research , health policy or analysis , shall be authorised participants of healthdata@eu.


### (4) health-related research infrastructures or similar structures whose functioning is based on union law and which support the use of electronic health data for research , policy making , statistical , patient safety or regulatory purposes shall be authorised participants of healthdata@eu. ### (4) health-related research infrastructures or similar structures which support the use of electronic health data in the health sector for research , policy making , statistical , patient safety or regulatory purposes shall be authorised participants of healthdata@eu.


### (7) the commission is empowered to adopt delegated acts in accordance with article 67 in order to amend this article to add or remove categories of authorised participants in healthdata@eu , taking into account the opinion of the joint controllership group pursuant to article 66 of this regulation. ### (7) the commission is empowered to adopt delegated acts in accordance with article 67 in order to amend this article to add or remove categories of authorised health sector participants in healthdata@eu , taking into account the opinion of the joint controllership group pursuant to article 66 of this regulation.


### (8) the member states and the commission shall set up healthdata@eu to support and facilitate the cross-border access to electronic health data for secondary use , connecting the national contact points for secondary use of electronic health data of all member states and authorised participants in that infrastructure. ### (8) the member states and the commission shall set up healthdata@eu to support and facilitate the cross-border access to electronic health data for secondary use in the health sector , connecting the national contact points for secondary use of electronic health data of all member states and authorised participants in that infrastructure.


### (1) in the case of cross-border registries and databases , the health data access body in which the data holder is registered shall be competent to decide on data access applications to provide access to electronic health data. where the registry has joint controllers , the health data access body that shall provide access to electronic health data shall be the body in the member state where one of the joint controllers is established. ### (1) in the case of cross-border registries and databases , the application processing body in which the data holder is registered shall be competent to decide on data access applications and to arrange access to electronic health data through the health data access body. where the registry has joint controllers , the health data access body that shall provide access to electronic health data shall be the body in the member state where one of the joint controllers is established.


### (2) where registries or databases from a number of member states organise themselves into a single network of registries or databases at union level , the associated registries may designate one of their members as a coordinator to ensure the provision of data from the registries’ network for secondary use. the health data access body of the member state in which the coordinator of the network is located shall be competent to decide on the data access applications to provide access to electronic health data for the network of registries or databases. ### (2) where registries or databases from a number of member states organise themselves into a single network of registries or databases at union level , the associated registries may designate one of their members as a coordinator to ensure the provision of data from the registries’ network for secondary use. the application processing body of the member state in which the coordinator of the network is located shall be competent to decide on the data access applications to arrange access to electronic health data for the network of registries or databases.


### (1) when handling an access application for cross-border access to electronic health data for secondary use , health data access bodies and relevant authorised participants shall remain responsible for taking decisions to grant or refuse access to electronic health data within their remit in accordance with the requirements for access laid down in this chapter. ### (1) when handling an access application for cross-border access to electronic health data for secondary use , application processing bodies and relevant authorised participants shall remain responsible for taking decisions to grant or refuse access to electronic health data within their remit in accordance with the requirements for access laid down in this chapter.


### (2) a data permit issued by one concerned health data access body may benefit from mutual recognition by the other concerned health data access bodies. ### (2) a data permit issued by one application processing body may benefit from mutual recognition by the other concerned application processing bodies.


### (1) the health data access bodies shall inform the data users about the available datasets and their characteristics through a metadata catalogue. each dataset shall include information concerning the source , the scope , the main characteristics , nature of electronic health data and conditions for making electronic health data available. ### (1) the application processing bodies shall inform the data users about the available datasets and their characteristics through a metadata catalogue. each dataset shall include information concerning the source , the scope , the main characteristics , nature of electronic health data and conditions for making electronic health data available.


### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data. ### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building and to guarantee the correct implementation of the european health data space system , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data.


### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data. ### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data. additionally , with reference to article 33(1) , point (i) , guidance shall be made available to support compliance , particularly for non-profit organisations , researchers and medical societies , who act as data holders in relation to registries.


### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building , the commission shall draw up benchmarking guidelines for the primary and secondary use of electronic health data. ### the commission shall support sharing of best practices and expertise , aimed to build the capacity of member states to strengthen digital health systems for primary and secondary use of electronic health data. to support capacity building , the commission shall , in close cooperation with the member states , draw up benchmarking guidelines for the primary and secondary use of electronic health data.


### third country transfer of non-personal electronic data ### third country transfer of anonymous data


### (1) non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### (1) non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (b) and (f) through to (i)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. this shall be without prejudice to article 50(2) , third sentence.


### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future.


### (1) non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### (1) anonymous electronic data made available by health data access bodies , that are based on a natural person’s electronic health data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future.


### (1) non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### (1) non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (b) and (f) through to (i)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. this shall be without prejudice to article 50(2) third sentence.


### international access and transfer of non-personal electronic health data ### international access and transfer of anonymous electronic health data


### (1) the digital health authorities , health data access bodies , the authorised participants in the cross-border infrastructures provided for in articles 12 and 52 and data users shall take all reasonable technical , legal and organisational measures , including contractual arrangements , in order to prevent international transfer or governmental access to non-personal electronic health data held in the union where such transfer or access would create a conflict with union law or the national law of the relevant member state , without prejudice to paragraph 2 or 3 of this article. ### (1) the digital health authorities , health data access bodies , the authorised participants in the cross-border infrastructures provided for in articles 12 and 52 and data users shall take all reasonable technical , legal and organisational measures , including contractual arrangements , in order to prevent international transfer or governmental access to anonymous electronic health data held in the union where such transfer or access would create a conflict with union law or the national law of the relevant member state , without prejudice to paragraph 2 or 3 of this article.


### (2) any judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a digital health authority , health data access body or data users to transfer or give access to non-personal electronic health data within the scope of this regulation held in the union shall be recognised or enforceable in any manner only if based on an international agreement , such as a mutual legal assistance treaty , in force between the requesting third country and the union or any such agreement between the requesting third country and a member state. ### (2) any judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a digital health authority , health data access body or data users to transfer or give access to anonymous electronic health data within the scope of this regulation held in the union shall be recognised or enforceable in any manner only if based on an international agreement , such as a mutual legal assistance treaty , in force between the requesting third country and the union or any such agreement between the requesting third country and a member state.


### (3) in the absence of an international agreement as referred to in paragraph 2 of this article , where a digital health authority , a health data access body , data users is the addressee of a decision or judgment of a third-country court or tribunal or a decision of a third-country administrative authority to transfer or give access to non-personal data within the scope of this regulation held in the union and compliance with such a decision would risk putting the addressee in conflict with union law or with the national law of the relevant member state , transfer to or access to such data by that third-country authority shall take place only where: ### (3) in the absence of an international agreement as referred to in paragraph 2 of this article , where a digital health authority , a health data access body , data users is the addressee of a decision or judgment of a third-country court or tribunal or a decision of a third-country administrative authority to transfer or give access to anonymous data within the scope of this regulation held in the union and compliance with such a decision would risk putting the addressee in conflict with union law or with the national law of the relevant member state , transfer to or access to such data by that third-country authority shall take place only where:


### (5) the digital health authorities , health data access bodies , data users shall inform the data holder about the existence of a request of a third-country administrative authority to access its data before complying with that request , except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity. ### (5) the digital health authorities , bodies involved in accessing health data , data users shall inform the data holder about the existence of a request of a third-country administrative authority to access its data before complying with that request , except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.


### in the context of international access and transfer of personal electronic health data , member states may maintain or introduce further conditions , including limitations , in accordance with and under the conditions of article 9(4) of the regulation (eu) 2016/679. ### deleted


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of:


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board shall , where relevant , invite experts and other relevant stakeholders to attend its meetings and to cooperate on aspects of its work. such stakeholders may include actors of the public and private sector , patients , health professionals , and researchers. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### to issue written contributions and to exchange best practices on matters related to the coordination of the implementation at member state level of this regulation and of the delegated and implementing acts adopted pursuant to it , in particular as regards: ### to issue written contributions and to exchange best practices on matters related to the coordination of the implementation at member state level of this regulation and of the delegated and implementing acts adopted pursuant to it , taking into account the regional and local level , in particular as regards:


### (iii) incentives policy for promoting data quality and interoperability improvement; ### (iii) incentives policy for promoting data quality and interoperability improvement , including facilitating the development of harmonised guidance for anonymisation and pseudonymisation of health data;


### the establishment and application of penalties; ### the establishment , calculation and application of penalties;


### to facilitate the exchange of views on the secondary use of electronic health data with the relevant stakeholders , including representatives of patients , health professionals , researchers , regulators and policy makers in the health sector. ### to facilitate the exchange of views on the secondary use of electronic health data with the relevant stakeholders , including representatives of patients , health professionals , researchers , industry representatives , regulators and policy makers in the health sector.


### 3. stakeholders and relevant third parties , including patients’ representatives , may be invited to attend meetings of the groups and to participate in their work. ### 3. stakeholders and relevant third parties , including patients’ and healthcare professionals’ representatives , may be invited to attend meetings of the groups and to participate in their work.


### (2) the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation. ### (2) the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation.


### from 1 year after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (a) , (b) and (c) , and to ehr systems intended by the manufacturer to process such categories of data.; ### from two years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (a) , (b) and (c) , and to ehr systems intended by the manufacturer to process such categories of data.;


### from 3 years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (d) , (e) and (f) , and to ehr systems intended by the manufacturer to process such categories of data; ### from four years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (d) , (e) and (f) , and to ehr systems intended by the manufacturer to process such categories of data;


### obligations of health data access bodies towards natural persons ### obligations of bodies involved in accessing health data towards natural persons


### 1. health data access bodies shall make publicly available and easily searchable the conditions under which electronic health data is made available for secondary use , with information concerning: ### 1. application processing bodies shall make publicly available and easily searchable the conditions under which electronic health data is made available for secondary use , with information concerning:


### (1) health data access bodies shall make publicly available and easily searchable the conditions under which electronic health data is made available for secondary use , with information concerning: ### (1) application processing bodies shall make publicly available and easily searchable the conditions under which electronic health data is made available for secondary use; with information concerning:


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. bodies involved in accessing health data shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit. application processing bodies shall provide general public information on all the data permits issued pursuant to article 46.


### (2) health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### (2) bodies involved in accessing health data shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit. application processing bodies shall provide general public information on all the data permits issued pursuant to article 46.


### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body shall inform the natural person , if that person has given their prior consent for this , along with his or her treating health professional , that this finding exists , and shall give that natural person the opportunity to authorise or prohibit the exchange of information on that finding and on future findings.


### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### 3. where an application processing body is informed by a data user of a finding that may impact on the health of a natural person , it may , together with the pseudonymisation body and the data holder , inform the natural person and his or her treating health professional about that finding.


### (3) where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### (3) where an application processing body is informed by a data user of a finding that may impact on the health of a natural person , it may , together with the pseudonymisation body and the data holder , inform the natural person and his or her treating health professional about that finding.


### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### 4. member states shall regularly inform the public at large about the role and benefits of bodies involved in accessing health data.


### (4) member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### (4) member states shall regularly inform the public at large about the role and benefits of bodies involved in accessing health data.


### reporting by health data access bodies ### reporting by bodies involved in accessing health data


### 1. each health data access body shall publish an annual activity report which shall contain at least the following: ### 1. each body involved in accessing health data shall publish an annual activity report which shall contain at least the following in relation to its respective tasks:


### 1. each health data access body shall publish an annual activity report which shall contain at least the following: ### 1. each health data access body shall publish an annual activity report that shall include summary data only which shall contain at least the following:


### (1) each health data access body shall publish an annual activity report which shall contain at least the following: ### (1) each body involved in access to health data shall publish an annual activity report which shall contain at least the following in relation to its respective tasks:


### a list of data permits involving access to electronic health data processed by the health data access body based on data altruism and a summary description of the general interests purposes pursued , where applicable , including the outcomes of the data permits granted; ### deleted


### 2. the report shall be transmitted to the commission. ### 2. the reports shall be transmitted to the commission.


### (2) the report shall be transmitted to the commission. ### (2) the reports shall be transmitted to the commission.


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to modify the content of the annual activity report. ### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to modify the content of annual activity reports.


### (3) the commission is empowered to adopt delegated acts in accordance with article 67 to modify the content of the annual activity report. ### (3) the commission is empowered to adopt delegated acts in accordance with article 67 to modify the content of the annual activity reports.


### 1. when processing personal electronic health data , data altruism organisations shall comply with the rules set out in chapter iv of regulation […] [data governance act com/2020/767 final]. where data altruism organisations process personal electronic health data using a secure processing environment , such environments shall also comply with the requirements set out in article 50 of this regulation. ### 1. this regulation shall be without prejudice to the processing of datasets based on consent , including in particular altruistic consent pursuant to [data governance act com/2020/767 final].


### (1) when processing personal electronic health data , data altruism organisations shall comply with the rules set out in chapter iv of regulation […] [data governance act com/2020/767 final]. where data altruism organisations process personal electronic health data using a secure processing environment , such environments shall also comply with the requirements set out in article 50 of this regulation. ### (1) this regulation is without prejudice to the processing of datasets based on consent , including in particular altruistic consent pursuant to [data governance act com(2020) 767 final].


### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### 1. where a health data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate , in compliance with the requirements set out in article 32 of regulation (eu) 2016/679 , and in good faith with the health data access bodies , where relevant.


### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall , where relevant , cooperate in good faith with the health data access bodies and other relevant actors involved.


### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies or data users , where relevant.