### where a member state considers that a foreign direct investment planned or completed in another member state is likely to affect its security or public order , it may provide comments to the member state where the foreign direct investment is planned or has been completed . the comments shall be forwarded to the commission in parallel . ### where a member state considers that a foreign direct investment planned or completed in another member state is likely to affect its security or public order , it may provide comments to the member state where the foreign direct investment is planned or has been completed . the comments may be forwarded to the commission in parallel . however , the member state where the foreign investment is planned has the exclusive competence to make a decision .


### the opinion of the commission shall be communicated to the other member states . ### the comments of the commission may be communicated to the other member states .


### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data should also be made available for secondary use. however , much of the existing health-related data is not made available for purposes other than that for which they were collected. this limits the ability of researchers , innovators , policy-makers , regulators and doctors to use those data for different purposes , including research , innovation , policy-making , regulatory purposes , patient safety or personalised medicine. in order to fully unleash the benefits of the secondary use of electronic health data , all data holders should contribute to this effort in making different categories of electronic health data they are holding available for secondary use. ### (38) in the context of the ehds , the electronic health data already exists and is being collected by healthcare providers , professional associations , public institutions , regulators , researchers , insurers etc. in the course of their activities. some categories of data are collected primarily for the provisions of healthcare (e.g. electronic health records , genetic data , claims data , etc.) , others are collected also for other purposes such as research , statistics , patient safety , regulatory activities or policy making (e.g. disease registries , policy making registries , registries concerning the side effects of medicinal products or medical devices , etc.). for instance , european databases that facilitate data (re)use are available in some areas , such as cancer (european cancer information system) or rare diseases (european platform on rare disease registration , ern registries , etc.). these data might also be made available for secondary use that would benefit the public interest.


### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.) , as well as data with an impact on health (for example consumption of different substances , homelessness , health insurance , minimum income , professional status , behaviour , including environmental factors (for example , pollution , radiation , use of certain chemical substances). they can also include person-generated data , such as data from medical devices , wellness applications or other wearables and digital health applications. the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other. ### (39) the categories of electronic health data that can be processed for secondary use should be broad and flexible enough to accommodate the evolving needs of data users , while remaining limited to data related to health or known to influence health. it can also include relevant data from the health system (electronic health records , claims data , disease registries , genomic data etc.). the data user who benefits from access to datasets provided under this regulation could enrich the data with various corrections , annotations and other improvements , for instance by supplementing missing or incomplete data , thus improving the accuracy , completeness or quality of data in the dataset. to support the improvement of the original database and further use of the enriched dataset , the dataset with such improvements and a description of the changes should be made available free of charge to the original data holder. the data holder should make available the new dataset , unless it provides a justified notification against it to the health data access body , for instance in cases of low quality of the enrichment. secondary use of non-personal electronic data should also be ensured. in particular , pathogen genomic data hold significant value for human health , as proven during the covid-19 pandemic. timely access to and sharing of such data has proven to be essential for the rapid development of detection tools , medical countermeasures and responses to public health threats. the greatest benefit from pathogen genomics effort will be achieved when public health and research processes share datasets and work mutually to inform and improve each other.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society and lead to better , more affordable and accessible health products and services for all natural persons. for this purpose , pharmaceutical and medical devices companies must be fully transparent about the uses of ehds data and their contribution to product development. in addition , to maximise public return , data access requests should include commitments on the availability and affordability of end products such as medicines. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited.


### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data for research , innovation , policy making , educational activities , patient safety , regulatory activities or personalised medicine , in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research (including private research) , development and innovation , producing goods and services for the health or care sectors , such as innovation activities or training of ai algorithms that could protect the health or care of natural persons. in some cases , the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited. ### (41) the secondary use of health data under ehds should enable the public , private , not for profit entities , as well as individual researchers to have access to health data in line with the purposes set out in this regulation. access to data for secondary use should contribute to the general interest of the society and lead to better , more affordable and accessible health products and services for all natural persons. for this purpose pharmaceutical and medical devices companies must be fully transparent about the uses of ehds data and its contribution to product development. in addition , to maximise public return , data access requests should include commitments on the availability and affordability of end products such as medicines. activities for which access in the context of this regulation is lawful may include using the electronic health data for tasks carried out by public bodies , such as exercise of public duty , including public health surveillance , planning and reporting duties , health policy making , ensuring patient safety , quality of care , and the sustainability of health care systems. public bodies and union institutions , bodies , offices and agencies may require to have regular access to electronic health data for an extended period of time , including in order to fulfil their mandate , which is provided by this regulation. public sector bodies may carry out such research activities by using third parties , including sub-contractors , as long as the public sector body remain at all time the supervisor of these activities. the provision of the data should also support activities related to scientific research of public interest. there is a need for public bodies to go beyond the emergency scope of chapter v of regulation […] [data act com/2022/68 final]. however , the public sector bodies may request the support of health data access bodies for processing or linking data. this regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law , but does not extend the mandate of such public sector bodies. any attempt to use the data for any measures detrimental to the natural person , to increase insurance premiums , to advertise products or treatments , or develop harmful products should be prohibited.


### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities. ### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional , with due regard for the stated preference of the data subject to not be contacted. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s) , with due regard for the stated preference of the data subject to not be contacted. moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### deleted


### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments. ### (54) given the sensitivity of electronic health data , data users should only have restricted access to such data , in accordance with the data minimisation principle. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments.


### (71) in order to assess whether this regulation reaches its objectives effectively and efficiently , is coherent and still relevant and provides added value at union level the commission should carry out an evaluation of this regulation. the commission should carry out a partial evaluation of this regulation 5 years after its entry into force , on the self-certification of ehr systems , and an overall evaluation 7 years after the entry into force of this regulation. the commission should submit reports on its main findings following each evaluation to the european parliament and to the council , the european economic and social committee and the committee of the regions. ### (71) in order to assess whether this regulation reaches its objectives effectively and efficiently , is coherent and still relevant and provides added value at union level the commission should carry out an evaluation of this regulation. the commission should carry out a partial evaluation of this regulation 5 years after its entry into force , on the certification of ehr systems , and an overall evaluation 7 years after the entry into force of this regulation. the commission should submit reports on its main findings following each evaluation to the european parliament and to the council , the european economic and social committee and the committee of the regions.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### when carrying out the tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe.


### article 49 ### deleted


### minimise the risk of the unauthorised reading , copying , modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technological means; ### minimise the risk of the unauthorised reading , copying , modification or removal of electronic health data hosted in the secure processing environment through state-of-the-art technological and organisational means;


### requirements , technical specifications , the it architecture of healthdata@eu , conditions and compliance checks for authorised participants to join and remain connected to healthdata@eu and conditions for temporary or definitive exclusion from healthdata@eu; ### requirements , technical specifications , the it architecture of healthdata@eu , which shall guarantee a high level of data security , confidentiality and protection of electronic data;


### the minimum criteria that need to be met by the authorised participants in the infrastructure; ### deleted


### the responsibilities of the joint controllers and processor(s) participating in the cross-border infrastructures; ### deleted


### the responsibilities of the joint controllers and processor(s) for the secure environment managed by the commission; ### deleted


### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). the european union agency for cyber security (enisa) shall be consulted and closely involved in the process.


### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final].


### 2. the protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### 2. the protective measures for the categories of data mentioned in paragraph 1 shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final].


### in the context of international access and transfer of personal electronic health data , member states may maintain or introduce further conditions , including limitations , in accordance with and under the conditions of article 9(4) of the regulation (eu) 2016/679. ### controllers and processors located in the eu who process personal electronic health data within the scope of this regulation shall process that data within the territory of the eu.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states , as well as representatives of health stakeholders , including patient organisations. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor shall be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### 4. health stakeholders , including patients’ representatives , and relevant third parties , shall attend meetings of the ehds board and participate in its work.


### 6. the commission shall chair the meetings of the ehds board. ### deleted


### 3. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force. ### 3. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force.


### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the self-certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies. ### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies.


### electronic health data category ### main characteristics of electronic health data included under the category


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. health data access bodies shall be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit.


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. at the request of a natural person or a group representing natural persons , health data access bodies shall be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 concerning the use of their health data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46.


### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body shall notify the data holder in order for them to inform the natural person and his or her treating health professional about that finding.


### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies , as well as the risks and consequences linked with individual and collective digital health data rights arising from this regulation.


### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### 4. member states shall regularly inform the public at large about the role , risks and benefits of the secondary use of health data and the role of health data access bodies.


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to modify the content of the annual activity report. ### deleted


### 1. when processing personal electronic health data , data altruism organisations shall comply with the rules set out in chapter iv of regulation […] [data governance act com/2020/767 final]. where data altruism organisations process personal electronic health data using a secure processing environment , such environments shall also comply with the requirements set out in article 50 of this regulation. ### 1. when processing personal electronic health data , data altruism organisations shall comply with the rules set out in chapter iv of regulation […] [data governance act com/2020/767 final]. when processing electronic health data , data altruism organisations shall make use of a secure processing environment , and also comply with the requirements set out in article 50 of this regulation.


### 1. health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] ### 1. health data access bodies may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final]


### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### 4. notwithstanding the right for member states to impose penalties in accordance with article 69 , health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years.


### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years , and fines shall be imposed in accordance with article 83 of the regulation (eu) 2016/679


### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49. ### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years.


### 1. the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted. ### 1. the health data access body shall ensure that access is only provided to requested electronic health data that are adequate , relevant and limited to what is necessary in relation to the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.


### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. the health data access bodies shall indicate the entity in charge of the anonymization and the anonymization standard applied. special safeguards shall be applied in the case of rare diseases. data users shall not attempt to re-identify the data subject of the anonymised data.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. for that purpose , health data access points shall verify in advance the compliance of the pseudonymisation of the data for processing by the data user with article 6 and , where relevant , article 9 of regulation (eu) 2016/679. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### a detailed explanation of the intended use of the electronic health data , including for which of the purposes referred to in article 34(1) access is sought; ### a detailed explanation of the intended use and benefit related to that use of the electronic health data , including:


### an indication whether electronic health data should be made available in an anonymised format; ### an indication whether electronic health data need to be made available in a pseudonymised format and the reason why the envisaged purpose for processing cannot be pursued using anonymised data;


### a description of the safeguards planned to prevent any other use of the electronic health data; ### a description of the safeguards planned to prevent any other misuse of the electronic health data , including the re-identification of natural persons in the dataset;


### 4. where the applicant intends to access the personal electronic health data in a pseudonymised format , the following additional information shall be provided together with the data access application: ### 4. where the applicant requests to access the personal electronic health data in a pseudonymised format , the following additional information shall be provided together with the data access application:


### a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679; ### a description of how the processing would comply with article 6(1) and , where applicable , article 9 of regulation (eu) 2016/679;


### for the implementation of the tasks referred to in article 37(1) , points (b) and (c) , the public sector bodies and the union institutions , bodies , offices and agencies shall provide the same information as requested under article 45(2) , except for point (g) , where they shall submit information concerning the period for which the data can be accessed , the frequency of that access or the frequency of the data updates. ### for the implementation of the tasks referred to in article 37(1) , points (b) and (c) , the public sector bodies and the union institutions , bodies , offices and agencies shall provide the same information as requested under article 45(2).


### where the public sector bodies and the union institutions , bodies , offices and agencies intend to access the electronic health data in pseudonymised format , a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679 or article 5(1) of regulation (eu) 2018/1725 , as applicable , shall also be provided. ### where the public sector bodies and the union institutions , bodies , offices and agencies intend to access the electronic health data in pseudonymised format , a description of how the processing would comply with article 6(1) and article 9 of regulation (eu) 2016/679 , or article 5(1) and article 10 of regulation (eu) 2018/1725 , as applicable , shall also be provided.


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. they shall also assess if the entity applying for the permit has a proven track record of genuine activity in the field of medical research or education. if that is the case , the health data access body shall issue a data permit.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay.


### 4. following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe. ### 4. following the issuance of the data permit , the health data access body shall , without undue delay , request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 12 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public in lay summaries on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### manufacturers and suppliers of ehr systems and wellness applications placed on the market and put into service in the union and the users of such products; ### manufacturers and suppliers of ehr systems placed on the market and put into service in the union and the users of such products;


### controllers and processors established in the union processing electronic health data of union citizens and third-country nationals legally residing in the territories of member states; ### controllers and processors established in the union processing electronic health data of persons in the eu;


### 4. this regulation shall be without prejudice to other union legal acts regarding access to , sharing of or secondary use of electronic health data , or requirements related to the processing of data in relation to electronic health data , in particular regulations (eu) 2016/679 , (eu) 2018/1725 , […] [data governance act com/2020/767 final] and […] [data act com/2022/68 final]. ### 4. this regulation shall be without prejudice to other union legal acts regarding access to , sharing of or secondary use of electronic health data , or requirements related to the processing of data in relation to electronic health data , in particular regulations (eu) 2016/679 , (eu) 2018/1725 , (eu) 2022/868 , directive 2002/58/ec , and […] [data act com/2022/68 final].


### 1. for the purposes of this regulation , following definitions shall apply: ### 1. for the purposes of this regulation , the following definitions shall apply:


### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , as well as data referring to determinants of health , or data processed in relation to the provision of healthcare services , processed in an electronic form; ### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 processed in an electronic form;


### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; ### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; where such data are part of a mixed dataset where personal and non-personal data are inextricably linked , the entire dataset shall be considered as personal electronic health data;


### ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess , maintain or restore the state of health of the natural person to whom that data relates , including the prescription , dispensation and provision of medicinal products and medical devices , as well as for relevant social security , administrative or reimbursement services; ### ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess , maintain or restore the state of health of the natural person to whom that data relates , including the prescription , dispensation and provision of medicinal products and medical devices , as well as for relevant social security and administrative services;


### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for the purpose of the secondary use; ### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. secondary use of personal electronic health data shall have article 6(1)(e) of regulation (eu) 2016/679 as its legal basis.


### ‘registration of electronic health data’ means the recording of health data in an electronic format , through manual entry of data , through the collection of data by a device , or through the conversion of non-electronic health data into an electronic format , to be processed in an ehr system or a wellness application; ### ‘registration of electronic health data’ means the recording of health data in an electronic format , through manual entry of data , through the collection of data by a device , or through the conversion of non-electronic health data into an electronic format , to be processed in an ehr system;


### ‘data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data; ### ‘health data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data;


### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for healthcare purposes; ### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for the purpose of the provision of healthcare services;


### ‘ehr system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records; ### ‘ehr system’ (electronic health record system) means any product (hardware or software) primarily intended by the manufacturer to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records;


### ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for other purposes than healthcare , such as well-being and pursuing healthy life-styles; ### deleted


### ‘serious incident’ means any malfunction or deterioration in the characteristics or performance of an ehr system made available on the market that directly or indirectly leads , might have led or might lead to any of the following: ### ‘serious incident’ means any malfunction or deterioration in the characteristics or performance of an ehr system made available on the market that directly or indirectly led , leads , was or is likely to lead to any of the following:


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘health data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has either:


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘health data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data;


### ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use; ### ‘health data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use pursuant to a health data permit or a health data request in accordance with this regulation;


### (aa) ‘data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation; ### (aa) ‘health data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation;


### (ab) ‘dataset’ means a structured collection of electronic health data; ### (ab) ‘health dataset’ means a structured collection of electronic health data;


### (ac) ‘dataset catalogue’ means a collection of datasets descriptions , which is arranged in a systematic manner and consists of a user-oriented public part , where information concerning individual dataset parameters is accessible by electronic means through an online portal; ### (ac) ‘health dataset catalogue’ means a collection of datasets descriptions , which is arranged in a systematic manner and consists of a user-oriented public part , where information concerning individual dataset parameters is accessible by electronic means through an online portal;


### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health. ### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of the rights under paragraphs 1 and 2 whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health.


### establish one or more electronic health data access services at national , regional or local level enabling the exercise of rights referred to in paragraphs 1 and 2; ### establish one or more public electronic health data access services at national , regional or local level enabling the exercise of rights referred to in paragraphs 1 and 2;


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf or to enable legal guardians as recognized by national law to act on behalf of their dependent children.


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more public proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf.


### the proxy services shall provide authorisations free of charge , electronically or on paper. they shall enable guardians or other representatives to be authorised , either automatically or upon request , to access electronic health data of the natural persons whose affairs they administer. member states may provide that authorisations do not apply whenever necessary for reasons related to the protection of the natural person , and in particular based on patient safety and ethics. the proxy services shall be interoperable among member states. ### the proxy services shall provide authorisations free of charge , electronically or on paper. they shall enable legal guardians as recognised by national law to be authorised , either automatically or upon request , to access electronic health data of the natural persons whose affairs they administer. member states may provide that authorisations do not apply whenever necessary for reasons related to the protection of the natural person , and in particular based on patient safety and ethics. the proxy services shall be interoperable among member states.


### 6. natural persons may insert their electronic health data in their own ehr or in that of natural persons whose health information they can access , through electronic health data access services or applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative. ### 6. natural persons may insert , access and export their electronic health data in and from their own ehr or in that of natural persons whose health information they can access , through electronic health data access services and applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative.


### natural persons shall have the right to give access to or request a data holder from the health or social security sector to transmit their electronic health data to a data recipient of their choice from the health or social security sector , immediately , free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. ### natural persons shall have the right to give access to or request a controller or a data holder , including from the health or social security sector , to transmit all or part of their electronic health data to a data recipient of their choice from the health or social security sector , immediately , free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. where requested by the data subject , the controller , data holders , data recipients and their processors shall comply with the request and shall transmit the data in the format provided for in article 5.


### natural persons shall have the right that , where priority categories of personal electronic health data referred to in article 5 are transmitted or made available by the natural person according to the european electronic health record exchange format referred to in article 6 , such data shall be read and accepted by other healthcare providers. ### natural persons shall have the right that , where priority categories of personal electronic health data referred to in article 5 are transmitted or made available by the natural person according to the european electronic health record exchange format referred to in article 6 , other healthcare providers shall be able to read and accept such data.


### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms. ### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms , which may also include the possibility to exercise geographical and temporal restrictions and restrictions related to a specific category of health professionals.


### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms. ### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. the european commission shall establish the rules and specific safeguards regarding such restriction mechanisms through a delegated act


### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge through electronic health data access services. ### 10. natural persons shall receive an automatic notification on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. in order to demonstrate compliance with this provision , all relevant entities shall also maintain a record of those healthcare providers and health professionals who had access to data. the information shall be provided immediately and free of charge through electronic health data access services in a commonly accepted , interoperable , and machine-readable format. the information shall at least include the names of the health care providers controlling the data processing , the health data that was accessed , and the time of access.


### 11. the supervisory authority or authorities responsible for monitoring the application of regulation (eu) 2016/679 shall also be responsible for monitoring the application of this article , in accordance with the relevant provisions in chapters vi , vii and viii of regulation (eu) 2016/679. they shall be competent to impose administrative fines up to the amount referred to in article 83(5) of that regulation. those supervisory authorities and the digital health authorities referred to in article 10 of this regulation shall , where relevant , cooperate in the enforcement of this regulation , within the remit of their respective competences. ### 11. the supervisory authority or authorities responsible for monitoring the application of regulation (eu) 2016/679 shall also be responsible for monitoring the application of this article , in accordance with the relevant provisions of regulation (eu) 2016/679. they shall be competent to impose administrative fines in accordance with article 83 of that regulation. those supervisory authorities and the digital health authorities referred to in article 10 of this regulation shall , where relevant , cooperate in the enforcement of this regulation , within the remit of their respective competences.


### 12. the commission shall , by means of implementing acts , determine the requirements concerning the technical implementation of the rights set out in this article. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 12. the commission shall , by means of implementing acts , determine the requirements concerning the technical implementation of the rights set out in this article , including technical and organisational measures to ensure the process of authentication of the authorised person referred to in point (b) of paragraph 5. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2).


### 1. where they process data in an electronic format , health professionals shall: ### 1. where they process data in an electronic format , health professionals shall , upon explicit consent from the natural persons under their treatment:


### have access to the electronic health data of natural persons under their treatment , irrespective of the member state of affiliation and the member state of treatment; ### have access on a need-to-know basis to the electronic health data of natural persons under their treatment , irrespective of the member state of affiliation and the member state of treatment;


### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states may establish rules providing for the categories of personal electronic health data required by different health professions. such rules shall not be based on the source of electronic health data. ### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states shall establish rules providing for the categories of personal electronic health data required by different health professions or different healthcare tasks. such rules shall not be based on the source of electronic health data.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services , where the processing of health data is necessary. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge.


### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards. ### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior explicit consent by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards.


### access to and exchange of electronic health data for primary use may be enabled for other categories of personal electronic health data available in the ehr of natural persons. ### deleted


### 2. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list of priority categories of electronic health data in paragraph 1. such delegated acts may also amend annex i by adding , modifying or removing the main characteristics of the priority categories of electronic health data and indicating , where relevant , deferred application date. the categories of electronic health data added through such delegated acts shall satisfy the following criteria: ### deleted


### 1. the commission shall , by means of implementing acts , lay down the technical specifications for the priority categories of personal electronic health data referred to in article 5 , setting out the european electronic health record exchange format. the format shall include the following elements: ### 1. the commission shall , by means of implementing acts , lay down the technical specifications for the priority categories of personal electronic health data referred to in article 5 , setting out the european electronic health record exchange format. the exchange format must be chosen in accordance with the feasibility of technical and organisational measures pursuant to article 32 of regulation (eu) 2016/679. the format shall include the following elements:


### datasets containing electronic health data and defining structures , such as data fields and data groups for the content representation of clinical content and other parts of the electronic health data; ### harmonised datasets containing electronic health data and defining structures , such as minimum data fields and data groups for the content representation of clinical content and other parts of the electronic health data , that can be enlarged to include disease-specific data;


### the commission shall , by means of implementing acts , determine the requirements for the registration of electronic health data by healthcare providers and natural persons , as relevant. those implementing acts shall establish the following: ### the commission shall , by means of implementing acts , determine the requirements for the quality of data for the registration of electronic health data by healthcare providers and natural persons , as relevant.


### categories of healthcare providers that are to register health data electronically; ### deleted


### categories of health data that are to be registered systematically in electronic format by healthcare providers referred to in point (a); ### deleted


### data quality requirements pertaining to the electronic registration of health data. ### deleted


### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### those implementing acts shall be adopted in accordance with the examination procedure referred to in article 68(2).


### article 8 ### deleted


### where a member state accepts the provision of telemedicine services , it shall , under the same conditions , accept the provision of the services of the same type by healthcare providers located in other member states. ### deleted


### 2. the commission shall , by means of implementing acts , determine the requirements for the interoperable , cross-border identification and authentication mechanism for natural persons and health professionals , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final]. the mechanism shall facilitate the transferability of electronic health data in a cross-border context. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 2. the commission shall , by means of implementing acts , determine the requirements for the interoperable , cross-border identification and authentication mechanism for natural persons and health professionals , in accordance with regulation (eu) no 910/2014. the mechanism shall facilitate the transferability of electronic health data in a cross-border context. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2).


### cooperate with other relevant entities and bodies at national or union level , to ensure interoperability , data portability and security of electronic health data , as well as with stakeholders representatives , including patients’ representatives , healthcare providers , health professionals , industry associations; ### cooperate with other relevant entities and bodies at national or union level , to ensure interoperability , data portability and security of electronic health data , as well as with stakeholders representatives , including patients’ representatives , healthcare providers , health professionals or their representatives , industry associations;


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by entrusting the digital health authorities with additional tasks necessary to carry out the missions conferred on them by this regulation and to modify the content of the annual report. ### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by entrusting the digital health authorities with additional tasks necessary to carry out the missions conferred on them by this regulation.


### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall avoid any conflicts of interest. ### 5. essential health stakeholders’ representatives , including patient organisations , shall be present in the governance and decision-making structures of the digital health authority. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall avoid any conflicts of interest. the commission shall be empowered to adopt delegated acts setting out what is likely to constitute a conflict of interests together with the procedure to be followed in such cases.


### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall avoid any conflicts of interest. ### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall be free of any conflicts of interest.


### 1. without prejudice to any other administrative or judicial remedy , natural and legal persons shall have the right to lodge a complaint , individually or , where relevant , collectively , with the digital health authority. where the complaint concerns the rights of natural persons pursuant to article 3 of this regulation , the digital health authority shall inform the supervisory authorities under regulation (eu) 2016/679. ### 1. without prejudice to any other administrative or judicial remedy , natural and legal persons shall have the right to lodge a complaint , individually or , where relevant , collectively , with the digital health authority. where the complaint concerns the rights of natural persons pursuant to article 3 of this regulation , the digital health authority shall send a copy of the complaint to the supervisory authorities under regulation (eu) 2016/679.


### 1. the commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the member states. ### 1. the commission shall establish a central platform to support and facilitate the exchange of electronic health data between national contact points for digital health of the member states.


### 3. each national contact point for digital health shall enable the exchange of the personal electronic health data referred to in article 5 with all other national contact points. the exchange shall be based on the european electronic health record exchange format. ### 3. each national contact point for digital health shall enable the exchange of the personal electronic health data referred to in article 5 with all other national contact points. the exchange shall be based on the european electronic health record exchange format in accordance with directive 2011/24/eu.


### 4. the commission shall , by means of implementing acts , adopt the necessary measures for the technical development of myhealth@eu , detailed rules concerning the security , confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to myhealth@eu and conditions for temporary or definitive exclusion from myhealth@eu. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 4. the commission shall , by means of implementing acts , adopt the necessary measures for the technical development of myhealth@eu , detailed rules concerning the security , confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to myhealth@eu and conditions for temporary or definitive exclusion from myhealth@eu. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). the implementing act shall include the target implementation dates , including for improved cross border health data interoperability , in consultation with the ehds board. the european union agency for cyber security shall be consulted and closely involved in all steps of the procedure. any measures adopted shall meet the highest technical standards in terms of security , confidentiality and protection of electronic health data.


### 4. the commission shall , by means of implementing acts , adopt the necessary measures for the technical development of myhealth@eu , detailed rules concerning the security , confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to myhealth@eu and conditions for temporary or definitive exclusion from myhealth@eu. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 4. the commission shall , by means of implementing acts , adopt the necessary measures for the technical development of myhealth@eu , detailed rules concerning the security , confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to myhealth@eu and conditions for temporary or definitive exclusion from myhealth@eu. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). the european union agency for cyber security shall be consulted and closely involved in all steps of the procedure. any measures adopted shall meet the highest technical standards in terms of security , confidentiality and protection of electronic health data.


### 8. the commission shall , by means of implementing acts , allocate responsibilities among controllers and as regards the processor referred to in paragraph 7 of this article , in accordance with chapter iv of regulation (eu) 2016/679. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### deleted


### member states and the commission shall seek to ensure interoperability of myhealth@eu with technological systems established at international level for the exchange of electronic health data. the commission may adopt an implementing act establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of myhealth@eu for the purposes of the electronic health data exchange. before adopting such an implementing act , a compliance check of the national contact point of the third country or of the system established at an international level shall be performed under the control of the commission. ### member states and the commission shall seek to ensure interoperability of myhealth@eu with technological systems established at international level for the exchange of electronic health data. the commission may adopt an implementing act establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of myhealth@eu for the purposes of the electronic health data exchange. before adopting such an implementing act , a compliance check of the national contact point of the third country or of the system established at an international level shall be performed under the control of the commission , including on whether the health data transfer stemming from such exchange complies with the rules in chapter v of regulation (eu) 2016/679.


### iii ehr systems and wellness applications ### iii ehr systems


### 1. ehr systems may be placed on the market or put into service only if they comply with the provisions laid down in this chapter. ### 1. ehr systems may be placed on the market or put into service only after a notified body confirms that the ehr system complies with the provisions laid down in this chapter.


### the commission shall , by means of implementing acts , adopt common specifications in respect of the essential requirements set out in annex ii , including a time limit for implementing those common specifications. where relevant , the common specifications shall take into account the specificities of medical devices and high risk ai systems referred to in paragraphs 3 and 4 of article 14. ### the commission shall , by means of implementing acts , adopt common specifications in respect of the essential requirements set out in annex ii , including a uniform template document and a time limit for implementing those common specifications. where relevant , the common specifications shall take into account the specificities of medical devices and high risk ai systems referred to in paragraphs 3 and 4 of article 14.