### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final].


### 2. the protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### 2. additional protective measures for the categories of data mentioned in paragraph shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final].


### 2. the protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### 2. additional protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final].


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states , and high-level representatives of the european data protection board and the european data protection supervisor. other national authorities , including market surveillance authorities referred to in article 28 , shall be invited to the meetings as permanent observers. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an ad hoc observer role where the issues discussed are of relevance for them.


### 3. the composition , organisation , functioning and cooperation of the sub-groups shall be set out in the rules of procedure put forward by the commission. ### 3. the composition , organisation , functioning and cooperation of the sub-groups shall be set out in the rules of procedure put forward by the commission. the commission shall make publicly available the membership and observers of the ehds board and its outputs , including rules of procedure , guidance , minutes , and meeting agendas.


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### 4. stakeholders and relevant third parties , including patients’ , consumers’ and healthcare professionals’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. all invited stakeholders shall provide a declaration of all direct and indirect economic , financial or personal interests ahead of the meeting to the ehds board.


### (iii) other aspects of the primary use of electronic health data. ### (iii) other aspects of the primary use of electronic health data , with the exception of aspects concerning the protection of natural persons when processing their personal data.


### to share information concerning risks posed by ehr systems and serious incidents as well as their handling; ### to share information concerning risks posed by ehr systems and serious incidents as well as their handling , without prejudice to the obligation to inform competent supervisory authorities pursuant to regulation (eu) 2016/679;


### to facilitate the exchange of views on the primary use of electronic health data with the relevant stakeholders , including representatives of patients , health professionals , researchers , regulators and policy makers in the health sector. ### to facilitate the exchange of views on the primary use of electronic health data with the relevant stakeholders , including representatives of patients , consumers , health professionals , regulators and policy makers in the health sector.


### (vi) other aspects of the secondary use of electronic health data. ### (vi) other aspects of the secondary use of electronic health data , with the exception of aspects concerning the protection of natural persons when processing their personal data.


### to facilitate cooperation between health data access bodies through capacity-building , establishing the structure for annual activity reporting , peer-review of annual activity reports and exchange of information; ### to facilitate cooperation and exchange of best practices between health data access bodies through capacity-building , establishing the structure for annual activity reporting , peer-review of annual activity reports and exchange of information pursuant to the obligations laid down in article 37(1) , point (q);


### 3. stakeholders and relevant third parties , including patients’ representatives , may be invited to attend meetings of the groups and to participate in their work. ### 3. stakeholders and relevant third parties , including patients’ , consumers’ and healthcare professionals’ representatives and data protection experts , may be invited to attend meetings of the groups and to participate in their work.


### 2. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation. ### 2. the power to adopt delegated acts referred to in articles 7(3) , 9(2) , 25(3) , 26(4a) 32(4) , 39(3) , 41(7) , 42(6) 45(7) , 46(8) , 52(7) , 52(13) , 53(3) , 55(2) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation.


### 3. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force. ### 3. the power to adopt delegated acts referred to in articles 7(3) , 9(2) , 25(3) , 26(4a) , 32(4) , 39(3) , 41(7) , 42(6) , 45(7) , 46(8) , 52(7) , 52(13) , 53(3) , 55(2) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force.


### 6. a delegated act adopted pursuant to articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall enter into force only if no objection has been expressed either by the european parliament or by the council within a period of 3 months of notification of that act to the european parliament and to the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by 3 months at the initiative of the european parliament or of the council. ### 6. a delegated act adopted pursuant to articles 7(3) , 9(2) , 25(3) , 26(4a) , 32(4) , 39(3) , 41(7) , 42(6) , 45(7) , 46(8) , 52(7) , 52(13) , 53(3) , 55(2) , 56(4) shall enter into force only if no objection has been expressed either by the european parliament or by the council within a period of 3 months of notification of that act to the european parliament and to the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by 3 months at the initiative of the european parliament or of the council.


### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them. ### member states shall lay down the rules on penalties applicable to infringements of this regulation , for all public and private stakeholders , in particular for the non-respect of data access and usage provisions with intent or by negligence , and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them. penalties shall cover infringements not addressed by regulation (eu) 2017/745 , regulation (eu) 2017/746 , regulation (eu) no 536/2014 and regulation (eu) 2016/679.


### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them. ### member states shall lay down the rules on penalties applicable to infringements of this regulation , for all public and private stakeholders in particular for the non-respect of data access and usage provisions with intent or by negligence , and shall take all measures necessary to ensure that they are properly and effectively implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them.


### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the self-certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies. ### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii and iv , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the self-certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies , as well as the need to designate a public testing facility of a member state as a union testing facility , pursuant to article 21 of regulation (eu) 2019/1020. the evaluation shall also assess the added value , associated risks and feasibility of adding wellness applications and other digital health applications in the scope of primary and secondary use of the ehds.


### 2.3. an ehr system that includes a functionality for entering structured personal electronic health data shall enable the entry of data structured in a structured way that supports the data sharing in a structured , commonly used and machine-readable format , enabling system to system communication. ### 2.3. an ehr system that includes a functionality for entering structured personal electronic health data shall enable the entry of data structured in a structured way that supports the data sharing in a structured , commonly used , open and machine-readable format , enabling system to system communication.


### 2.4. an ehr system shall not include features that prohibit , restrict or place undue burden on authorised access , personal electronic health data sharing , or use of personal electronic health data for permitted purposes. ### 2.4. an ehr system shall not include features that prohibit , restrict or place undue burden on authorised access , personal electronic health data sharing , or use of personal electronic health data for permitted purposes , in particular on the basis of commercial considerations and beyond security and legal safeguards requirements.


### 2.4. an ehr system shall not include features that prohibit , restrict or place undue burden on authorised access , personal electronic health data sharing , or use of personal electronic health data for permitted purposes. ### 2.4. an ehr system shall not include features that prohibit , restrict or place undue burden on authorised access , personal electronic health data sharing , or use of personal electronic health data for permitted purposes , in particular on the basis of commercial considerations and beyond security and legal safeguards requirements. .


### electronic health data category ### main characteristics of electronic health data included under the category


### the applicable rights of natural persons in relation to secondary use of electronic health data; ### the applicable rights of natural persons in relation to secondary use of electronic health data , including the rights pursuant to regulation (eu) 2016/679;


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. health data access bodies shall provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46.


### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body shall inform the natural person and his or her treating health professional about that finding , while respecting the principles of medical confidentiality and professional secrecy. in accordance with article 23(1) , point (i) , of regulation (eu) 2016/679 , member states may by law restrict the scope of the obligation to inform the natural person whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their information for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have an impact on them.


### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### 4. member states shall regularly inform the public at large about the role of the health data access bodies and the benefits and risk of sharing health data for research and decision-making.


### 2. the report shall be transmitted to the commission. ### 2. the report shall be transmitted to the commission , which shall make it publicly available on its website.


### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### 1. where a data holder is obliged to make electronic health data available to a health data access body under article 33 , it shall cooperate in good faith with the health data access bodies , where relevant.


### 1. health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] ### 1. health data access bodies may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] , as well as the technical and operational costs to prepare the data sets , including anonymization and pseudonymization , and to make them available.


### 3. the electronic health data referred to in article 33(1) , point (o) , shall be made available to a new user free of charge or against a fee matching the compensation for the costs of the human and technical resources used to enrich the electronic health data. that fee shall be paid to the entity that enriched the electronic health data. ### 3. the electronic health data referred to in article 33(1) , point (o) , shall be made available to a new user against a fee matching the compensation for the costs of the human and technical resources used to enrich the electronic health data. that fee shall be paid to the entity that enriched the electronic health data.


### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget. ### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update that dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by aligning those fees proportionately with their size or budget.


### 6. the commission may , by means of implementing acts , lay down principles and rules for the fee policies and fee structures. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 6. the commission shall , by means of delegated acts , lay down principles and rules for the fee policies and fee structures. those delegated acts shall be adopted in accordance with the procedure referred to in article 67.


### penalties by health data access bodies ### enforcement by health data access bodies


### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to fine up to 10% of the data user's annual turnover for the previous financial year or revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. where an eu institution , body or agency is the data user , the power to impose such penalties shall rest with the european data protection supervisor , after notification from the health data access body.


### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49. ### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from submitting data access applications pursuant to chapter iv for a period of up to 5 years , while still being obliged to make data accessible pursuant to chapter iv , where applicable.


### 7. any penalties and measures imposed pursuant to paragraph 4 shall be made available to other health data access bodies. ### 7. any penalties and measures imposed pursuant to paragraph 4 shall be made available to other health data access bodies and publicly available on the commission’s website.


### 9. any natural or legal person affected by a decision of a health data access body shall have the right to an effective judicial remedy against such decision. ### deleted


### 10. the commission may issues guidelines on penalties to be applied by the health data access bodies. ### 10. the commission shall issue guidelines on penalties to be applied by the health data access bodies , in line with the principles set out in article 69.


### 1. the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted. ### 1. the health data access body shall ensure that access is only provided to requested electronic health data necessary and relevant and as long as needed for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.


### 2. the health data access bodies shall provide the electronic health data in an anonymised format , where the purpose of processing by the data user can be achieved with such data , taking into account the information provided by the data user. ### 2. the health data access bodies shall provide the electronic health data in an anonymised format:


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format where the data subject has given their explicit consent. the information necessary to reverse the pseudonymisation shall be available only to data holder. data users shall not re-identify the electronic health data provided to them in anonymised or pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring anonymisation or pseudonymisation shall be subject to appropriate penalties.


### 1. any natural or legal person may submit a data access application for the purposes referred to in article 34. ### 1. any entity active in the area of health care , public health , or scientific or medical research may submit a data access application for the purposes referred to in article 34.


### a detailed explanation of the intended use of the electronic health data , including for which of the purposes referred to in article 34(1) access is sought; ### a detailed explanation of the intended use of the electronic health data , including for which of the purposes referred to in article 9(2) of regulation (eu) 2016/679 , in combination with article 34(1) , access is necessary;


### a description of the tools and computing resources needed for a secure environment. ### a description of the free and open-source tools and computing resources needed for a secure environment.


### a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679; ### a description of how the processing would comply with regulation (eu) 2016/679;


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall assess if the application fulfils all of the following criteria:


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body may issue a data permit.


### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met. ### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 , applications where the necessity of processing for the intended purpose has not been sufficiently demonstrated , applications that do not sufficiently provide safeguards on re-identification , and applications where requirements in this chapter are not met.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay..


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay.


### 4. following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe. ### 4. following the issuance of the data permit , the health data access body shall immediately request the electronic health data from the data holder and inform them whether the data shall be made accessible in anonymised or pseudonymised form. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless the health data access body specifies that it will provide the data within a longer specified timeframe due to circumstances beyond its control.


### 7. data users shall have the right to access and process the electronic health data in accordance with the data permit delivered to them on the basis of this regulation. ### 7. data users shall have the right to access and process the electronic health data in accordance with the data permit delivered to them on the basis of this regulation , after they have demonstrated that the security measures pursuant to in article 52 , points (e) and (f) , are effectively implemented.


### strengthens the rights of natural persons in relation to the availability and control of their electronic health data; ### specifies the rights of natural persons in relation to the availability and control of their electronic health data;


### manufacturers and suppliers of ehr systems and wellness applications placed on the market and put into service in the union and the users of such products; ### manufacturers and suppliers of ehr systems and of medical devices placed on the market and put into service in the union and the users of such products;


### 4. this regulation shall be without prejudice to other union legal acts regarding access to , sharing of or secondary use of electronic health data , or requirements related to the processing of data in relation to electronic health data , in particular regulations (eu) 2016/679 , (eu) 2018/1725 , […] [data governance act com/2020/767 final] and […] [data act com/2022/68 final]. ### 4. this regulation shall be without prejudice to other union legal acts regarding access to , sharing of or secondary use of electronic health data , or requirements related to the processing of data in relation to electronic health data , in particular regulations (eu) 2016/679 , (eu) 2018/1725 , (eu) 2022/868 and […] [data act com/2022/68 final].


### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , as well as data referring to determinants of health , or data processed in relation to the provision of healthcare services , processed in an electronic form; ### ‘personal electronic health data’ means data concerning physical or mental health , and genetic data as defined in regulation (eu) 2016/679 , as well as data referring to determinants of health , that are processed in an electronic form;


### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; ### ‘non-personal electronic health data’ means data concerning health and aggregated genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679;


### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; ### ‘non-personal electronic health data’ means data concerning health and anonymised genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679;


### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for the purpose of the secondary use; ### ‘secondary use of electronic health data’ means the further processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for other purposes;


### ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals , involving the exchange of information and knowledge without changing the content of the data between these organisations , software applications or devices , through the processes they support; ### ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals using commonly accepted open standards and open data formats , involving the exchange of information and knowledge without changing the content of the data between these organisations , software applications or devices , through the processes they support;


### ‘european electronic health record exchange format’ means a structured , commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications , devices and healthcare providers; ### ‘european electronic health record exchange format’ means a structured , commonly used , open standard and machine-readable format that allows transmission of personal electronic health data between different software applications , devices and healthcare providers;


### ‘data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data; ### deleted


### ‘telemedicine’ means the provision of healthcare services , including remote care and online pharmacies , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location; ### deleted


### the death of a natural person or serious damage to a natural person’s health; ### the death of a natural person or serious damage to a natural person’s health or rights;


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘data holder’ means a controller in the meaning of regulation (eu) 2016/679 in the health or care or social security sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies which are a controller in the meaning of regulation (eu) 2018/1725 , which has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , to process personal health data , or in the case of non-personal health data , through control of the technical design of a product and related services , the lawful ability to make available , including to register , provide , restrict access or exchange certain data;


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### deleted


### ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use; ### ‘data user’ means a natural or legal person , including public authorities and eu institutions , bodies or agencies , who has lawful access to personal or non-personal electronic health data for secondary use , pursuant to a data permit in accordance with this regulation;


### ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use; ### ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data;


### (aa) ‘data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation; ### (aa) ‘data permit’ means an administrative decision issued to a data user by a health data access body to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this regulation;


### 1. natural persons shall have the right to access their personal electronic health data processed in the context of primary use of electronic health data , immediately , free of charge and in an easily readable , consolidated and accessible form. ### 1. natural persons shall have the right to access their personal electronic health data processed in the context of primary use of electronic health data , and any available information as to their origin , immediately , free of charge and in an easily readable , consolidated and accessible form , in accordance with article 14 of regulation (eu) 2016/679.


### 2. natural persons shall have the right to receive an electronic copy , in the european electronic health record exchange format referred to in article 6 , of at least their electronic health data in the priority categories referred to in article 5. ### 2. natural persons shall have the right to receive an electronic copy , in the european electronic health record exchange format referred to in article 6 , of their electronic health data , or a printed copy thereof , in accordance with paragraph 3 of article 15 of regulation (eu) 2016/679.


### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health. ### 3. in accordance with paragraph 1 , point (i) of article 23 of regulation (eu) 2016/679 , member states may by law restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on this person.


### 4. where the personal health data have not been registered electronically prior to the application of this regulation , member states may require that such data is made available in electronic format pursuant to this article. this shall not affect the obligation to make personal electronic health data registered after the application of this regulation available in electronic format pursuant to this article. ### 4. where the personal health data have not been registered electronically , member states may require that such data is made available in electronic format pursuant to this article , where the data subject consents to such electronic processing.


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf and on their request.


### 6. natural persons may insert their electronic health data in their own ehr or in that of natural persons whose health information they can access , through electronic health data access services or applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative. ### 6. natural persons may , in accordance with the rules of the respective healthcare provider , insert their electronic health data in their own ehr or in that of natural persons whose health information they can access because they are proxies pursuant to paragraph 5 , through electronic health data access services or applications linked to these services. that information shall be marked as inserted by the natural person or by his or her representative , shall not be available for secondary use , and shall only be considered as a clinical fact and made available for secondary use if validated by a registered healthcare professional of relevant specialisation responsible for the natural person’s treatment.


### 7. member states shall ensure that , when exercising the right to rectification under article 16 of regulation (eu) 2016/679 , natural persons can easily request rectification online through the electronic health data access services referred to in paragraph 5 , point (a) , of this article. ### 7. member states shall ensure that , when exercising the right to rectification under article 16 of regulation (eu) 2016/679 , natural persons can easily request rectification online through the electronic health data access services referred to in paragraph 5 , point (a) , of this article. in accordance with article 16 of regulation (eu) 2016/679 , natural persons shall not have the possibility to directly change data inserted by healthcare professionals. such rectifications of clinical facts shall be validated by a registered healthcare professional of relevant specialisation responsible for the natural person’s treatment. the original data holder shall be responsible for the rectification.


### natural persons shall have the right to give access to or request a data holder from the health or social security sector to transmit their electronic health data to a data recipient of their choice from the health or social security sector , immediately , free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. ### in accordance with paragraph 2 of article 20 of regulation (eu) 2016/679 , natural persons shall have the right to give access to or request a data holder from the health or social security sector to transmit all of or part of their electronic health data to a data recipient of their choice from the health or social security sector , immediately , free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. that data recipient shall be properly identified , including demonstrating that it belongs to the health or social security sectors.


### by way of derogation from article 9 of regulation […] [data act com/2022/68 final] , the data recipient shall not be required to compensate the data holder for making electronic heath data available. ### the data recipient shall compensate the data holder for the reasonable and non-discriminatory costs of making electronic health data available. a data holder , a data recipient or a third party shall not directly or indirectly charge data subjects a fee , compensation or costs for sharing data or accessing it.


### 9. notwithstanding article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms. ### 9. without prejudice to article 6(1) , point (d) , of regulation (eu) 2016/679 , natural persons shall have the right to restrict access of certain health professionals to all or part of their electronic health data. member states shall establish the rules and specific safeguards regarding such restriction mechanisms , which may also include the possibility of restrictions related to a specific category of health professionals. natural persons shall be informed of the patient safety risks associated with limiting access to health data.


### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. the information shall be provided immediately and free of charge through electronic health data access services. ### 10. natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare , including access to restricted data pursuant to paragraph 9. the information shall be provided immediately and free of charge through electronic health data access services , whenever such access has taken place. for this purpose , providers of electronic health records shall keep a record of who has accessed which data in the previous 24 months. member states may provide for restrictions to this right in exceptional circumstances , where there are factual indications that disclosure would endanger the vital interests or rights of the health professional.


### 11. the supervisory authority or authorities responsible for monitoring the application of regulation (eu) 2016/679 shall also be responsible for monitoring the application of this article , in accordance with the relevant provisions in chapters vi , vii and viii of regulation (eu) 2016/679. they shall be competent to impose administrative fines up to the amount referred to in article 83(5) of that regulation. those supervisory authorities and the digital health authorities referred to in article 10 of this regulation shall , where relevant , cooperate in the enforcement of this regulation , within the remit of their respective competences. ### 11. the supervisory authority or authorities responsible for monitoring the application of regulation (eu) 2016/679 shall also be responsible for monitoring the application of this article , in accordance with the relevant provisions in chapters vi , vii and viii of regulation (eu) 2016/679.


### have access to the electronic health data of natural persons under their treatment , irrespective of the member state of affiliation and the member state of treatment; ### have access to the electronic health data of natural persons , where , and to the extent that , this is necessary for the purposes spelled out in point (h) of paragraph 2 of article 9 of regulation (eu) 2016/679 , irrespective of the member state of affiliation and the member state of treatment , with the exceptions provided for in paragraphs 9 and 9a of article 3;


### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states may establish rules providing for the categories of personal electronic health data required by different health professions. such rules shall not be based on the source of electronic health data. ### 2. in line with the data minimisation principle provided for in regulation (eu) 2016/679 , member states shall establish rules providing for the categories of personal electronic health data required by different categories of health professions. such rules shall not be based on the source of electronic health data.


### 3. member states shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services , free of charge. ### 3. member states and , where appropriate , local or regional authorities shall ensure that access to at least the priority categories of electronic health data referred to in article 5 is made available to health professionals through health professional access services , where , and to the extent to , this is necessary for the purposes spelled out in point (h) of paragraph 2 of regulation (eu) 2016/679 , and with the exceptions provided for in paragraphs 9 and 9a of article 3. health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services regarding the electronic health data of natural persons under their treatment , irrespective of the member state of affiliation and treatment , free of charge.


### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards. ### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the existence , the nature and the content of the electronic health data without prior explicit consent by the natural person. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards.


### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior authorisation by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards. ### 4. where access to electronic health data has been restricted by the natural person , the healthcare provider or health professionals shall not be informed of the content of the electronic health data without prior explicit consent by the natural person , including where the provider or professional is informed of the existence and nature of the restricted electronic health data. in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person , the healthcare provider or health professional may get access to the restricted electronic health data. following such access , the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. member states’ law may add additional safeguards.


### access to and exchange of electronic health data for primary use may be enabled for other categories of personal electronic health data available in the ehr of natural persons. ### member states may by law enable access to and exchange of electronic health data for primary use for other categories of personal electronic health data available in the ehr of natural persons.


### 2. the commission is empowered to adopt delegated acts in accordance with article 67 to amend the list of priority categories of electronic health data in paragraph 1. such delegated acts may also amend annex i by adding , modifying or removing the main characteristics of the priority categories of electronic health data and indicating , where relevant , deferred application date. the categories of electronic health data added through such delegated acts shall satisfy the following criteria: ### deleted


### 1. the commission shall , by means of implementing acts , lay down the technical specifications for the priority categories of personal electronic health data referred to in article 5 , setting out the european electronic health record exchange format. the format shall include the following elements: ### 1. the commission shall , by means of implementing acts , lay down the open technical specifications for the priority categories of personal electronic health data referred to in article 5 , setting out the european electronic health record exchange format pursuant to the fair principle (findability , accessibility , interoperability , re-use). the format shall include the following elements:


### 1. the commission shall , by means of implementing acts , lay down the technical specifications for the priority categories of personal electronic health data referred to in article 5 , setting out the european electronic health record exchange format. the format shall include the following elements: ### 1. the commission shall , by means of implementing acts , lay down the open technical specifications for the priority categories of personal electronic health data referred to in article 5 , setting out the european electronic health record exchange format. the format shall include the following elements:


### 1. member states shall ensure that , where data is processed in electronic format , health professionals systematically register the relevant health data falling under at least the priority categories referred to in article 5 concerning the health services provided by them to natural persons , in the electronic format in an ehr system. ### 1. member states shall ensure that , where data is processed in electronic format , health professionals register the relevant health data falling under at least the priority categories referred to in article 5 concerning the health services provided by them to natural persons , in the electronic format in an ehr system.


### the commission shall , by means of implementing acts , determine the requirements for the registration of electronic health data by healthcare providers and natural persons , as relevant. those implementing acts shall establish the following: ### the commission shall , by means of delegated acts , determine the requirements for the registration of electronic health data by healthcare professionals and natural persons , as relevant. those delegated acts shall establish the following:


### categories of healthcare providers that are to register health data electronically; ### categories of healthcare professionals that are to register health data electronically;


### categories of health data that are to be registered systematically in electronic format by healthcare providers referred to in point (a); ### categories of health data that are to be registered systematically in electronic format by healthcare professionals referred to in point (a);


### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### those delegated acts shall be adopted in accordance with the advisory procedure referred to in article 67.


### where a member state accepts the provision of telemedicine services , it shall , under the same conditions , accept the provision of the services of the same type by healthcare providers located in other member states. ### deleted


### 1. where a natural person uses telemedicine services or personal health data access services referred to in article 3(5) , point (a) , that natural person shall have the right to identify electronically using any electronic identification means which is recognised pursuant to article 6 of regulation (eu) no 910/2014. ### 1. where a natural person uses personal health data access services referred to in article 3(5) , point (a) , that natural person shall have the right to identify electronically using any electronic identification means which is recognised pursuant to article 6 of regulation (eu) no 910/2014.


### 2. the commission shall , by means of implementing acts , determine the requirements for the interoperable , cross-border identification and authentication mechanism for natural persons and health professionals , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final]. the mechanism shall facilitate the transferability of electronic health data in a cross-border context. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 2. the commission shall , by means of delegated acts , determine the requirements for the interoperable , cross-border identification and authentication mechanism for natural persons and health professionals , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final]. the mechanism shall facilitate the secure transferability of electronic health data in a cross-border context. those delegated acts shall be adopted in accordance with article 67.


### 2. the commission shall , by means of implementing acts , determine the requirements for the interoperable , cross-border identification and authentication mechanism for natural persons and health professionals , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final]. the mechanism shall facilitate the transferability of electronic health data in a cross-border context. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 2. the commission shall , by means of delegated acts , determine the requirements for the interoperable , cross-border identification and authentication mechanism for natural persons and health professionals , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final]. the mechanism shall facilitate the secure transferability of electronic health data in a cross-border context.


### 3. the commission shall implement services required by the interoperable , cross-border identification and authentication mechanism referred to in paragraph 2 of this article at union level , as part of the cross-border digital health infrastructure referred to in article 12(3). ### 3. the commission and member states shall implement services required by the interoperable , cross-border identification and authentication mechanism referred to in paragraph 2 of this article at union level , as part of the cross-border digital health infrastructure referred to in article 12(3).


### 3. the commission shall implement services required by the interoperable , cross-border identification and authentication mechanism referred to in paragraph 2 of this article at union level , as part of the cross-border digital health infrastructure referred to in article 12(3). ### 3. the commission and the member states shall implement services required by the interoperable , cross-border identification and authentication mechanism referred to in paragraph 2 of this article at union level , as part of the cross-border digital health infrastructure referred to in article 12(3).


### 4. the digital health authorities and the commission shall implement the cross-border identification and authentication mechanism at union and member states’ level , respectively. ### 4. the member states and the commission shall implement the cross-border identification and authentication mechanism at union and member states’ level , respectively , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final].


### 4. the digital health authorities and the commission shall implement the cross-border identification and authentication mechanism at union and member states’ level , respectively. ### 4. the member states and the commission shall develop a the cross-border identification and authentication mechanism at union and member states’ level , respectively , in accordance with regulation (eu) no 910/2014 as amended by [com(2021) 281 final].


### 2. each digital health authority shall be entrusted with the following tasks: ### 2. each digital health authority shall be entrusted with the following tasks and powers:


### ensure the implementation , at national level , of the european electronic health record exchange format , in cooperation with national authorities and stakeholders; ### ensure the implementation , at national level , of the european electronic health record exchange format , in cooperation with national authorities and stakeholders , including representatives of patients , consumers and healthcare professionals;


### contribute , at union level , to the development of the european electronic health record exchange format and to the elaboration of common specifications addressing interoperability , security , safety or fundamental right concerns in accordance with article 23 and of the specifications of the eu database for ehr systems and wellness applications referred to in article 32; ### contribute , at union level , to the development of the european electronic health record exchange format and to the elaboration of common specifications addressing quality , interoperability , security , safety , ease of use , accessibility , non-discrimination or fundamental right concerns in accordance with article 23 and of the specifications of the eu database for ehr systems;


### offer , in compliance with national legislation , telemedicine services and ensure that such services are easy to use , accessible to different groups of natural persons and health professionals , including natural persons with disabilities , do not discriminate and offer the possibility of choosing between in person and digital services; ### deleted


### cooperate with other relevant entities and bodies at national or union level , to ensure interoperability , data portability and security of electronic health data , as well as with stakeholders representatives , including patients’ representatives , healthcare providers , health professionals , industry associations; ### cooperate with other relevant entities and bodies at local , regional , national or union level , to ensure interoperability , data portability and security of electronic health data , as well as with stakeholders representatives , including patients’ and consumers’ representatives , healthcare providers , health professionals , industry associations;


### cooperate with supervisory authorities in accordance with regulation (eu) 910/2014 , regulation (eu) 2016/679 and directive (eu) 2016/1148 of the european parliament and of the council56with other relevant authorities , including those competent for cybersecurity , electronic identification , the european artificial intelligence board , the medical device coordination group , the european data innovation board and the competent authorities under regulation […] [data act com/2022/68 final]; ### cooperate in the enforcement of this regulation , within the remit of their respective competences , with supervisory authorities in accordance with regulation (eu) 910/2014 , regulation (eu) 2016/679 and directive (eu) 2016/1148 of the european parliament and of the council56with other relevant authorities , including those competent for cybersecurity , electronic identification , the european artificial intelligence board , the medical device coordination group , the european data innovation board and the competent authorities under regulation […] [data act com/2022/68 final];


### draw up , in collaboration where relevant with market surveillance authorities , an annual activity report , which shall contain a comprehensive overview of its activities. the report shall be transmitted to the commission. the annual activity report shall follow a structure that is agreed at union level within ehds board , to support benchmarking pursuant to article 59. the report shall contain at least information concerning: ### draw up , in collaboration where relevant with market surveillance authorities , an annual activity report , which shall contain a comprehensive overview of its activities. the report shall be transmitted to the commission and shall be published. the annual activity report shall follow a structure that is agreed at union level within ehds board , to support benchmarking pursuant to article 59. the report shall contain at least information concerning:


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by entrusting the digital health authorities with additional tasks necessary to carry out the missions conferred on them by this regulation and to modify the content of the annual report. ### deleted


### 4. each member state shall ensure that each digital health authority is provided with the human , technical and financial resources , premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers. ### 4. each member state shall ensure that each digital health authority is provided with the human , technical and financial resources , premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers. each member state shall by law provide for the details of the enforcement powers pursuant to point (p) of paragraph 2.


### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients’ representatives. members of the digital health authority shall avoid any conflicts of interest. ### 5. in the performance of its tasks , the digital health authority shall actively cooperate with stakeholders’ representatives , including patients , consumers and healthcare professionals’ representatives. members of the digital health authority shall have no direct or indirect economic , financial or personal interest that might be considered prejudicial to their independence and , in particular , that they are not in a situation that may , directly or indirectly , affect the impartiality of their professional conduct.


### 1. without prejudice to any other administrative or judicial remedy , natural and legal persons shall have the right to lodge a complaint , individually or , where relevant , collectively , with the digital health authority. where the complaint concerns the rights of natural persons pursuant to article 3 of this regulation , the digital health authority shall inform the supervisory authorities under regulation (eu) 2016/679. ### 1. without prejudice to any other administrative or judicial remedy , natural and legal persons shall have the right to lodge a complaint , individually or collectively , with the digital health authority. where the complaint concerns the rights of natural persons pursuant to article 3 of this regulation , the digital health authority shall send a copy of the complaint to and consult with the supervisory authorities under regulation (eu) 2016/679. those supervisory authorities shall be competent to treat the complaint in a separate proceeding , pursuant to their tasks and powers under that regulation.


### 1. the commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the member states. ### 1. the commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the member states. the central platform shall be licenced under an open-source licence and published in the open source code repository of the eu institutions.


### 4. the commission shall , by means of implementing acts , adopt the necessary measures for the technical development of myhealth@eu , detailed rules concerning the security , confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to myhealth@eu and conditions for temporary or definitive exclusion from myhealth@eu. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 4. the commission shall , by means of implementing acts , adopt the necessary measures for the technical development of myhealth@eu , detailed rules concerning the security , confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to myhealth@eu and conditions for temporary or definitive exclusion from myhealth@eu. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). the european union agency for cyber security shall be consulted and closely involved in all steps of the procedure. any measures adopted shall meet the highest technical standards in terms of security , confidentiality and protection of electronic health data.


### member states and the commission shall seek to ensure interoperability of myhealth@eu with technological systems established at international level for the exchange of electronic health data. the commission may adopt an implementing act establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of myhealth@eu for the purposes of the electronic health data exchange. before adopting such an implementing act , a compliance check of the national contact point of the third country or of the system established at an international level shall be performed under the control of the commission. ### member states and the commission shall seek to ensure interoperability of myhealth@eu with technological systems established at international level for the exchange of electronic health data. the commission may adopt an implementing act establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of myhealth@eu for the purposes of the electronic health data exchange. before adopting such an implementing act , a compliance check of the national contact point of the third country or of the system established at an international level , as well as a compliance check with the requirements of chapter v of regulation (eu) 2016/679 , shall be performed under the control of the commission.


### iii ehr systems and wellness applications ### iii ehr systems


### 3. manufacturers of medical devices as defined in article 2(1) of regulation (eu) 2017/745 that claim interoperability of those medical devices with ehr systems shall prove compliance with the essential requirements on interoperability laid down in section 2 of annex ii of this regulation. article 23 of this chapter shall be applicable to those medical devices. ### 3. manufacturers of medical devices as defined in article 2(1) of regulation (eu) 2017/745 that claim interoperability of those medical devices with ehr systems shall prove compliance with the essential requirements on quality and interoperability laid down in section 2 of annex ii of this regulation. article 23 of this chapter shall be applicable to those medical devices.


### 4. providers of high-risk ai systems as defined in article 6 of regulation […] [ai act com/2021/206 final] , which does not fall within the scope of regulation (eu) 2017/745 , that claim interoperability of those ai systems with ehr systems will need to prove compliance with the essential requirements on interoperability laid down in section 2 of annex ii of this regulation. article 23 of this chapter shall be applicable to those high-risk ai systems. ### 4. notwithstanding the obligations laid down in regulation [ai act com/2021/206 final] , providers of high-risk ai systems as defined in article 6 of regulation […] [ai act com/2021/206 final] , which do not fall within the scope of regulation (eu) 2017/745 , that claim interoperability of those ai systems with ehr systems will need to prove compliance with the essential requirements on quality and interoperability laid down in section 2 of annex ii of this regulation. article 23 of this chapter shall be applicable to those high-risk ai systems. .


### 1. ehr systems may be placed on the market or put into service only if they comply with the provisions laid down in this chapter. ### 1. ehr systems may be placed on the market or put into service only if they comply with the provisions laid down in this chapter and in annex ii of this regulation.


### draw up the technical documentation of their ehr systems in accordance with article 24; ### draw up and keep up to date the technical documentation of their ehr systems in accordance with article 24;


### ensure that their ehr systems are accompanied , free of charge for the user , by the information sheet provided for in article 25 and clear and complete instructions for use; ### ensure that their ehr systems are accompanied , free of charge for the user , by the information sheet provided for in article 25 and by clear and complete instructions for use , including in accessible formats for vulnerable populations , including migrants , the elderly and persons with disabilities;


### take without undue delay any necessary corrective action in respect of their ehr systems which are not in conformity with the essential requirements laid down in annex ii , or recall or withdraw such systems; ### take immediately any necessary corrective action in respect of their ehr systems when manufacturers consider or have reasons to believe that such systems are not in conformity with the essential requirements laid down in annex ii , or recall or withdraw such systems;


### inform the distributors of their ehr systems and , where applicable , the authorised representative and importers of any corrective action , recall or withdrawal; ### immediately inform the distributors of their ehr systems and , where applicable , the authorised representative and importers of any corrective action , recall or withdrawal;


### inform the market surveillance authorities of the member states in which they made their ehr systems available or put them into service of the non-conformity and of any corrective action taken; ### immediately inform the market surveillance authorities of the member states in which they made their ehr systems available or put them into service of the non-conformity and of any corrective action taken;


### upon request of a market surveillance authority , provide it with all the information and documentation necessary to demonstrate the conformity of their ehr system with the essential requirements laid down in annex ii. ### at least 6 months before placing on the market or putting into service their ehr systems , provide market surveillance authorities in the member states concerned with all the information and documentation necessary to demonstrate the conformity of their ehr system with the essential requirements laid down in annex ii.


### 3. manufacturers of ehr systems shall keep the technical documentation and the eu declaration of conformity for 10 years after the last ehr system covered by the eu declaration of conformity has been placed on the market. ### 3. manufacturers of ehr systems shall keep the technical documentation and the eu declaration of conformity for at least 10 years after the last ehr system covered by the eu declaration of conformity has been placed on the market.


### 2. an authorised representative shall perform the tasks specified in the mandate received from the manufacturer. the mandate shall allow the authorised representative to do at least the following: ### 2. an authorised representative shall perform the tasks specified in the mandate agreed with the manufacturer. the mandate shall allow the authorised representative to do at least the following:


### further to a reasoned request from a market surveillance authority , provide that authority with all the information and documentation necessary to demonstrate the conformity of an ehr system with the essential requirements laid down in annex ii; ### at least 6 months before an ehr system is placed on the market or putting into service provide market surveillance authorities of the member states concerned a copy of the mandate with all the information and documentation necessary to demonstrate the conformity of an ehr system with the essential requirements laid down in annex ii in an official language of the authority;


### the manufacturer has drawn up the technical documentation and the eu declaration of conformity; ### the manufacturer has drawn up the technical documentation and the eu declaration of conformity and ensure that it is made available to market surveillance authorities at least 6 months before an ehr system is placed on the market or put into service;


### the ehr system is accompanied by the information sheet referred to in article 25 and appropriate instructions for use. ### the ehr system is accompanied by the information sheet referred to in article 25 and clear and complete instructions for use in accessible formats , including for persons with disabilities.


### 3. importers shall indicate their name , registered trade name or registered trade mark and the address at which they can be contacted in a document accompanying the ehr system. ### 3. importers shall indicate their name , registered trade name or registered trade mark and the postal and electronic address and a telephone number at which they can be contacted in a document accompanying the ehr system. they shall ensure that any additional label does not obscure any information on the label provided by the manufacturer.


### 5. where an importer considers or has reason to believe that an ehr system is not in conformity with the essential requirements in annex ii , it shall not make that system available on the market until that system has been brought into conformity. the importer shall inform without undue delay the manufacturer of such ehr system and the market surveillance authorities of the member state in which it made the ehr system available , to that effect. ### 5. where an importer considers or has reason to believe that an ehr system is not in conformity with the essential requirements in annex ii , it shall not make that system available on the market until that system has been brought into conformity. the importer shall immediately inform the manufacturer of such ehr system and the market surveillance authorities of the member state in which it made the ehr system available , to that effect. where an importer considers or has reason to believe that an ehr system presents a risk to the health or safety of natural persons or to other aspects of public interest protection , it shall immediately inform the market surveillance authority of the member state in which the importer is established , as well as the manufacturer and where applicable , the authorised representative.


### 7. importers shall , further to a reasoned request from a market surveillance authority , provide it with all the information and documentation necessary to demonstrate the conformity of an ehr system in the official language of the member state where the market surveillance authority is located. they shall cooperate with that authority , at its request , on any action taken to bring their ehr systems in conformity with the essential requirements laid down in annex ii. ### 7. importers shall , at least 6 months before placing on the market or putting into service an ehr system , provide market surveillance authorities of member states concerned with all the information and documentation necessary to demonstrate the conformity of an ehr system in the official language of the member state where the market surveillance authority is located. they shall cooperate with that authority , at its request , and with the manufacturer and , where applicable , with the manufacturer’s authorised representative on any action taken to bring their ehr systems in conformity with the essential requirements laid down in annex ii , or to ensure that their ehr systems are withdrawn or recalled.


### the ehr system is accompanied by the information sheet referred to in article 25 and appropriate instructions for use; ### the ehr system is accompanied by the information sheet referred to in article 25 and by clear and complete instructions for use in accessible formats , including for persons with disabilities;


### 3. where a distributor considers or has reason to believe that an ehr system is not in conformity with the essential requirements laid down in annex ii , it shall not make the ehr system available on the market until it has been brought into conformity. furthermore , the distributor shall inform without undue delay the manufacturer or the importer , as well as the market surveillance authorities of the member states where the ehr system has been made available on the market , to that effect. ### 3. where a distributor considers or has reason to believe that an ehr system is not in conformity with the essential requirements laid down in annex ii , it shall not make the ehr system available on the market until it has been brought into conformity. furthermore , the distributor shall immediately inform the manufacturer or the importer , as well as the market surveillance authorities of the member states where the ehr system has been made available on the market , to that effect. where a distributor considers or has reason to believe that an ehr system presents a risk to the health or safety of natural persons or to other aspects of public interest protection , it shall immediately inform the market surveillance authority of the member state in which the distributor is established , as well as the manufacturer , the importer and where applicable , the authorised representative.


### 4. distributors shall , further to a reasoned request from a market surveillance authority , provide it with all the information and documentation necessary to demonstrate the conformity of an ehr system. they shall cooperate with that authority , at its request , on any action taken to bring their ehr systems in conformity with the essential requirements laid down in annex ii. ### 4. distributors shall , further to a reasoned request from a market surveillance authority , provide it with all the information and documentation necessary to demonstrate the conformity of an ehr system. they shall cooperate with that authority , at its request , and with the manufacturer , the importer and , where applicable , with the manufacturer’s authorised representative on any action taken to bring their ehr systems in conformity with the essential requirements laid down in annex ii or to ensure that their ehr systems are withdrawn or recalled.


### cases in which obligations of manufacturers of an ehr system apply to importers and distributors ### cases in which obligations of manufacturers of an ehr system apply to other economic operators


### an importer or distributor shall be considered a manufacturer for the purposes of this regulation and shall be subject to the obligations laid down in article 17 , where they made an ehr system available on the market under their own name or trademark or modify an ehr system already placed on the market in such a way that conformity with the applicable requirements may be affected. ### an economic operator other than the manufacturer shall be considered a manufacturer for the purposes of this regulation and shall be subject to the obligations laid down in article 17 , where they made an ehr system available on the market under their own name or trademark or modify an ehr system already placed on the market in such a way that conformity with the applicable requirements may be affected.


### 5. where common specifications covering interoperability and security requirements of ehr systems affect medical devices or high-risk ai systems falling under other acts , such as regulations (eu) 2017/745 or […] [ai act com/2021/206 final] , the adoption of those common specifications may be preceded by a consultation with the medical devices coordination group (mdcg) referred to in article 103 of regulation (eu) 2017/745 or the european artificial intelligence board referred to in article 56 of regulation […] [ai act com/2021/206 final] , as applicable. ### 5. where common specifications covering interoperability and security requirements of ehr systems affect medical devices or high-risk ai systems falling under other acts , such as regulations (eu) 2017/745 or […] [ai act com/2021/206 final] , the adoption of those common specifications shall be preceded by a consultation with the medical devices coordination group (mdcg) referred to in article 103 of regulation (eu) 2017/745 or the european artificial intelligence board referred to in article 56 of regulation […] [ai act com/2021/206 final] , as applicable , as well as the european data protection board referred to in article 68 of regulation (eu) 2016/679.


### 6. where common specifications covering interoperability and security requirements of medical devices or high-risk ai systems falling under other acts such as regulation (eu) 2017/745 or regulation […] [ai act com/2021/206 final] , impact ehr systems , the adoption of those common specifications shall be preceded by a consultation with the ehds board , especially its subgroup for chapters ii and iii of this regulation. ### 6. where common specifications covering interoperability and security requirements of medical devices or high-risk ai systems falling under other acts such as regulation (eu) 2017/745 or regulation […] [ai act com/2021/206 final] , impact ehr systems , the adoption of those common specifications shall be preceded by a consultation with the ehds board , especially its subgroup for chapters ii and iii of this regulation and , where applicable , the european data protection board referred to in article 68 of regulation (eu) 2016/679.


### 1. the technical documentation shall be drawn up before the ehr system is placed on the market or put into service and shall be kept up-to-date. ### 1. manufacturers shall draw up technical documentation before the ehr system is placed on the market or put into service and shall be kept up-to-date. the technical documentation shall be submitted to the market surveillance authorities of the member states concerned at least 6 months before an ehr system is placed on the market or put into service.


### 2. the technical documentation shall be drawn up in such a way as to demonstrate that the ehr system complies with the essential requirements laid down in annex ii and provide market surveillance authorities with all the necessary information to assess the conformity of the ehr system with those requirements. it shall contain , at a minimum , the elements set out in annex iii. ### 2. the technical documentation shall be drawn up in such a way as to demonstrate that the ehr system complies with the essential requirements laid down in annex ii and provide market surveillance authorities with all the necessary information to assess the conformity of the ehr system with those requirements. it shall contain , at a minimum , the elements set out in annex iii. in case the system or any part of it complies with european standards or common specifications , the list of the relevant european standards and common specifications shall also be indicated.


### the identity , registered trade name or registered trademark , and the contact details of the manufacturer and , where applicable , of its authorised representative; ### the identity , registered trade name or registered trademark , and the contact details of the manufacturer including the postal and electronic address and the telephone number and , where applicable , of its authorised representative;


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by allowing manufacturers to enter the information referred to in paragraph 2 into the eu database of ehr systems and wellness applications referred to in article 32 , as an alternative to supplying the information sheet referred to in paragraph 1 with the ehr system. ### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to supplement this regulation by allowing manufacturers to enter the information referred to in paragraph 2 into the eu database of ehr systems , as an alternative to supplying the information sheet referred to in paragraph 1 with the ehr system.


### 1. the eu declaration of conformity shall state that the manufacturer of the ehr system has demonstrated that the essential requirements laid down in annex ii have been fulfilled. ### 1. the eu declaration of conformity shall state that the manufacturer of the ehr system has demonstrated that the essential requirements laid down in annex ii have been fulfilled. the manufacturer shall continuously update the eu declaration of conformity.


### 4. by drawing up the eu declaration of conformity , the manufacturer shall assume responsibility for the conformity of the ehr system. ### 4. by drawing up the eu declaration of conformity , the manufacturer shall assume responsibility for compliance with the requirements of this regulation and all union acts applicable to ehr systems.