### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders in the context of secondary use of electronic health data can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies should be provided by the level of confidentiality protection in accordance with trips and directive (eu) 2016/943. often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies shall be provided with the level of confidentiality protection mandated by the trips agreement and the trade secrets directive (2016/943). however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector. ### (40) the data holders can be public , non for profit or private health or care providers , public , non for profit and private organisations , associations or other entities , public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. in order to avoid a disproportionate burden on small entities , micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of ehds. the public or private entities often receive public funding , from national or union funds to collect and process electronic health data for research , statistics (official or not) or other similar purposes , including in area where the collection of such data is fragmented of difficult , such as rare diseases , cancer etc. such data , collected and processed by data holders with the support of union or national public funding , should be made available by data holders to health data access bodies , in order to maximise the impact of the public investment and support research , innovation , patient safety or policy making benefitting the society. in some member states , private entities , including private healthcare providers and professional associations , play a pivotal role in the health sector. the health data held by such providers should also be made available for secondary use. at the same time , data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection which shall be treated accordingly. however , public authorities and regulators should have access to such data , for instance in the event of pandemics , to verify defective devices and protect human health. in times of severe public health concerns (for example , pip breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. the covid-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. such data should be made available for public and regulatory activities , supporting public bodies to carry out their legal mandate , while complying with , where relevant and possible , the protection enjoyed by commercial data. specific rules in relation to the secondary use of health data should be provided. data altruism activities may be carried out by different entities , in the context of regulation […] [data governance act com/2020/767 final] and taking into account the specificities of the health sector.


### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data. ### (42) the establishment of one or more health data access bodies , supporting access to electronic health data in member states , is an essential component for promoting the secondary use of health-related data. member states should therefore establish one or more health data access body , for instance to reflect their constitutional , organisational and administrative structure. however , one of these health data access bodies should be designated as a coordinator in case there are more than one data access body. where a member state establishes several bodies , it should lay down rules at national level to ensure the coordinated participation of those bodies in the ehds board. that member state should in particular designate one health data access body to function as a single contact point for the effective participation of those bodies , and ensure swift and smooth cooperation with other health data access bodies , the ehds board and the commission. health data access bodies may vary in terms of organisation and size (spanning from a dedicated full-fledged organization to a unit or department in an existing organization) but should have the same functions , responsibilities and capabilities. health data access bodies should not be influenced in their decisions on access to electronic data for secondary use. however , their independence should not mean that the health data access body cannot be subject to control or monitoring mechanisms regarding its financial expenditure or to judicial review. each health data access body should be provided with the financial , technical and human resources , premises and infrastructure necessary for the effective performance of its tasks , including those related to cooperation with other health data access bodies throughout the union. given the central role of the health data access bodies in the context of secondary use of electronic health data , and especially the decision-making on granting or refusing a health data permit and preparing the data to make it available to health data users , their members and staff should have the necessary qualifications , experience and skills , in particular in the area of ethics , cybersecurity , protection of intellectual property and trade secrets , healthcare , scientific research , artificial intelligence and other relevant areas , as well as the protection of personal data and specifically data concerning health. in addition , the decision-making process regarding the granting or refusal of the health data permit should involve ethical considerations. each health data access body should have a separate , public annual budget , which may be part of the overall state or national budget. in order to enable better access to health data and complementing article 7(3) of regulation […] of the european parliament and of the council [data governance act com/2020/767 final] , member states should entrust health data access bodies with powers to take decisions on access to and secondary use of health data. this could consist in allocating new tasks to the competent bodies designated by member states under article 7(1) of regulation […] [data governance act com/2020/767 final] or in designating existing or new sectoral bodies responsible for such tasks in relation to access to health data.


### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets. ### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested state-of-the-art techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. in this regard , health data access bodies should cooperate across borders and converge on common definitions and techniques. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets.


### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets. ### (43) the health data access bodies should monitor the application of chapter iv of this regulation and contribute to its consistent application throughout the union. for that purpose , the health data access bodies should cooperate with each other and with the commission , without the need for any agreement between member states on the provision of mutual assistance or on such cooperation. the health data access bodies should also cooperate with stakeholders , including patient organisations. since the secondary use of health data involves the processing of personal data concerning health , the relevant provisions of regulation (eu) 2016/679 apply and the supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725 should be tasked with enforcing these rules. moreover , given that health data are sensitive data and in a duty of loyal cooperation , the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use , including penalties. in addition to the tasks necessary to ensure effective secondary use of health data , the health data access body should strive to expand the availability of additional health datasets , support the development of ai in health and promote the development of common standards. they should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed , including techniques for pseudonymisation , anonymisation , generalisation , suppression and randomisation of personal data. in this regard , health data access bodies should cooperate cross-border and converge on common definitions and techniques. health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. this includes rules for anonymization of microdata sets.


### (44) considering the administrative burden for health data access bodies to inform the natural persons whose data are used in data projects within a secure processing environment , the exceptions provided for in article 14(5) of regulation (eu) 2016/679 should apply. therefore , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the data subject or his health professional. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities. ### (44) health data access bodies should comply with the obligations laid down in article 14 paragraphs (1) , (2) , (3) and (4) of regulation (eu) 2016/679 and inform the natural persons whose data are used in data projects within a secure processing environment. the exceptions provided for in article 14(5) of regulation (eu) 2016/679 may apply. where such exceptions are applied , health data access bodies should provide general information concerning the conditions for the secondary use of their health data containing the information items listed in article 14(1) and , where necessary to ensure fair and transparent processing , article 14(2) of regulation (eu) 2016/679 , e.g. information on the purpose and the data categories processed , allowing natural persons to understand whether their data are being made available for secondary use pursuant to data permits. exceptions from this rule should be made when the results of the research could assist in the treatment of the natural person concerned. in this case , the data user should inform the health data access body , which should inform the health professional of the data subject concerned. natural persons should be able to access the results of different research projects on the website of the health data access body , ideally in an easily searchable manner. the list of the data permits should also be made public. in order to promote transparency in their operation , each health data access body should publish an annual activity report providing an overview of its activities.


### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available when possible and if the data user asks it. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request , including in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request. ### (49) given the sensitivity of electronic health data , it is necessary to reduce risks on the privacy of natural persons by applying the data minimisation principle as set out in article 5 (1) , point (c) of regulation (eu) 2016/679. therefore , the use of anonymised electronic health data which is devoid of any personal data should be made available. if the data user needs to use personal electronic health data , it should clearly indicate in its request the justification for the use of this type of data for the planned data processing activity. the personal electronic health data should only be made available in pseudonymised format and the encryption key can only be held by the health data access body. data users should not attempt to re-identify natural persons from the dataset provided under this regulation , subject to administrative or possible criminal penalties , where the national laws foresee this. however , this should not prevent , in cases where the results of a project carried out based on a data permit has a health benefit or impact to a concerned natural person (for instance , discovering treatments or risk factors to develop a certain disease) , the data users would inform the health data access body , which in turn would inform the relevant health professional of the concerned natural person(s). moreover , the applicant can request the health data access bodies to provide the answer to a data request in statistical form. in this case , the data users would not process health data and the health data access body would remain sole controller for the data necessary to provide the answer to the data request.


### (50) in order to ensure that all health data access bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide health data access bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different health data access bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , purposes for which the data would be used , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. the health data access bodies and , where relevant data holders , should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the health data access body to provide directly the result. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data application , as well as data request. ### (50) in order to ensure that all health data access bodies issue permits in a similar way , it is necessary to establish a standard common process for the issuance of data permits , with similar requests in different member states. the applicant should provide health data access bodies with several information elements that would help the body evaluate the request and decide if the applicant may receive a data permit for secondary use of data , also ensuring coherence between different health data access bodies. such information include: the legal basis under regulation (eu) 2016/679 to request access to data (exercise of a task in the public interest assigned by law or legitimate interest) , applicant´s identity , purposes for which the data would be used and detailed plan and explanation of the intended use and expected benefits related to the use , description of the needed data and possible data sources , a description of the tools needed to process the data , as well as characteristics of the secure environment that are needed. the applicant should also provide a declaration of having sufficient experience to manage the intended uses of the data requested , consistent with ethical practice and applicable laws and regulations as well as a declaration that the intended uses of the data request do not pose a risk of stigmatisation or dignity harm to both individuals and the groups implicated in the dataset requested. where data is requested in pseudonymised format , the data applicant should explain why this is necessary and why anonymous data would not suffice. an ethical assessment may be requested based on national law. the health data access bodies and , where relevant data holders , should assist data users in the selection of the suitable datasets or data sources for the intended purpose of secondary use. where the applicant needs anonymised statistical data , it should submit a data request application , requiring the health data access body to provide directly the result. in order to ensure a harmonised approach between health data access bodies , the commission should support the harmonisation of data application , as well as data request.


### (53) for requests to access electronic health data from a single data holder in a single member state and in order to alieviate the administrative burden for heath data access bodies of managing such request , the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. the data holder should report to the health data access bodies about any data permits or data requests they provide. ### deleted


### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments. ### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments.


### (55) for the processing of electronic health data in the scope of a granted permit , the health data access bodies and the data users should be joint controllers in the sense of article 26 of regulation (eu) 2016/679 , meaning that the obligations of joint controllers under that regulation will apply. to support health data access bodies and data users , the commission should , by means of an implementing act , provide a template for the joint controller arrangements health data access bodies and data users will have to enter into. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social etc. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51. ### (55) for the processing of electronic health data in the scope of a granted permit , the health data holders , the health data access bodies and the health data users should should each , in their turn , be deemed a controller for a specific part of the process and according to their respective roles in it , meaning that the health data holder should be considered a controller for the processing of personal electronic health data while carrying out its obligation under article 41 (1) and (1a) , health data access body should be considered a controller for the processing of personal electronic health data while carrying out its task referred to in article 37(1) (d) of this regulation and health data user , including union institutions , bodies , offices and agencies , should be deemed a controller for the processing of personal electronic health data in the secure processing environment pursuant to a data permit. in this case , the health data access body should be deemed a processor. in order to achieve an inclusive and sustainable framework for multi-country secondary use of electronic health data , a cross-border infrastructure should be established. healthdata@eu should accelerate the secondary use of electronic health data while increasing legal certainty , respecting the privacy of natural persons and being interoperable. due to the sensitivity of health data , principles such as “privacy by design” and “bring questions to data instead of moving data” should be respected whenever possible. authorised participants in healthdata@eu could be health data access bodies , research infrastructures established as an european research infrastructure consortium (‘eric’) under council regulation (ec) no 723/200950or similar structures established under another union legislation , as well as other types of entities , including infrastructures under the european strategy forum on research infrastructures (esfri) , infrastructures federated under the european open science cloud (eosc). other authorised participants should obtain the approval of the joint controllership group for joining healthdata@eu. on the other hand , healthdata@eu should enable the secondary use of different categories of electronic health data , including linking of the health data with data from other data spaces such as environment , agriculture , social , etc.. the commission could provide a number of services within healthdata@eu , including supporting the exchange of information amongst health data access bodies and authorised participants for the handling of cross-border access requests , maintaining catalogues of electronic health data available through the infrastructure , network discoverability and metadata queries , connectivity and compliance services. the commission may also set up a secure environment , allowing data from different national infrastructures to be transmitted and analysed , at the request of the controllers. the commission digital strategy promote the linking of the various common european data spaces. for the health sector , interoperability with the sectors such as the environmental , social , agricultural sectors may be relevant for additional insights on health determinants. for the sake of it efficiency , rationalisation and interoperability of data exchanges , existing systems for data sharing should be reused as much as possible , like those being built for the exchange of evidences under the once only technical system of regulation (eu) 2018/1724 of the european parliament and of the council51.


### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. ### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities. the ehds board should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. an advisory forum should be set up to advise the ehds board it in the fulfilment of its tasks by providing stakeholder input in matters pertaining to this regulation. the advisory forum should be composed of representatives of patients , health professionals , industry , scientific researchers and academia , have a balanced composition and represent the views of different relevant stakeholders. commercial and non-commercial interests should be balanced. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act].


### (71) in order to assess whether this regulation reaches its objectives effectively and efficiently , is coherent and still relevant and provides added value at union level the commission should carry out an evaluation of this regulation. the commission should carry out a partial evaluation of this regulation 5 years after its entry into force , on the self-certification of ehr systems , and an overall evaluation 7 years after the entry into force of this regulation. the commission should submit reports on its main findings following each evaluation to the european parliament and to the council , the european economic and social committee and the committee of the regions. ### (71) in order to assess whether this regulation reaches its objectives effectively and efficiently , is coherent and still relevant and provides added value at union level the commission should carry out an evaluation of this regulation. the commission should carry out a partial evaluation of this regulation 5 years after its entry into force , and an overall evaluation 7 years after the entry into force of this regulation. the commission should submit reports on its main findings following each evaluation to the european parliament and to the council , the european economic and social committee and the committee of the regions.


### 1. any natural or legal person may submit a data request for the purposes referred to in article 34. a health data access body shall only provide an answer to a data request in an anonymised statistical format and the data user shall have no access to the electronic health data used to provide this answer. ### 1. any natural or legal person may submit a data request for the purposes referred to in article 34 with the aim of obtaining an answer only in anonymised statistical format.


### 2. a data request shall include the elements mentioned in paragraphs 2 (a) and (b) of article 45 and if needed may also include: ### 2. a data request shall include the elements mentioned in paragraphs 2 (-a) , (a) and (b) of article 45 and if needed may also include:


### 3. where an applicant has requested a result in an anonymised form , including statistical format , based on a data request , the health data access body shall assess , within 2 months and , where possible , provide the result to the data user within 2 months. ### 3. the health data access body shall assess the health data request within 2 months and , where possible , provide the result to the data user within 2 months.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , member states may allow national and european public institutions , agencies bodies and offices , under specific conditions , to access data without requiring a data permit under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe.


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , a data permit shall not be required by the european medicines agency (ema) , european centre for disease prevention and control (ecdc) and health emergency preparedness and response authority (hera) to access the electronic health data under this chapter. the health data access body shall inform ema , ecdc , or hera about the availability of data within 2 months of the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe.


### article 49 ### deleted


### 3. the health data access bodies shall ensure regular audits of the secure processing environments. ### 3. the health data access bodies shall ensure regular third party audits of the secure processing environments.


### 4. the commission shall , by means of implementing acts , provide for the technical , information security and interoperability requirements for the secure processing environments. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 4. the commission shall , by means of implementing acts , provide for the technical , information security , confidentiality , data protection and interoperability requirements for the secure processing environments , in consultation with enisa. those implementing acts shall be adopted in accordance with the examination procedure referred to in article 68(2a).


### joint controllers ### controllership


### 1. the health data access bodies and the data users , including union institutions , bodies , offices and agencies , shall be deemed joint controllers of electronic health data processed in accordance with data permit. ### 1. data user , including union institutions , bodies , offices and agencies , shall be deemed controller for the processing of personal of electronic health data in the secure processing environment pursuant to a data permit. in this case , the health data access body shall be deemed a processor.


### 2. the commission shall , by means of implementing acts , establish a template for the joint controllers’ arrangement. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2). ### 2. the commission shall , by means of implementing acts , establish a template for a contract or other legal act for the purpose of paragraph 1 in line with article 28(3) of regulation (eu) 2016/679. those implementing acts shall be adopted in accordance with the examination procedure set out in article 68(2a).


### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. ### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation , where they have set up a body equivalent to the health data access bodies as referred to in article 36 and where they ensure that chapter v of regulation (eu) 2016/679 will be complied with after the connection to the healthdata@eu and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation as well as with chapter v of regulation (eu) 2016/679 and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available.


### requirements , technical specifications , the it architecture of healthdata@eu , conditions and compliance checks for authorised participants to join and remain connected to healthdata@eu and conditions for temporary or definitive exclusion from healthdata@eu; ### requirements , technical specifications , the it architecture of healthdata@eu , conditions and compliance checks for authorised participants to join and remain connected to healthdata@eu and conditions for temporary or definitive exclusion from healthdata@eu , with stricter criteria and an accelerated procedure for third countries and international organisations;


### access to cross-border sources of electronic health data for secondary use ### access to cross-border registries and databases for secondary use


### 54 mutual recognition ### 54 cross-border access and mutual recognition of data permits


### 1. when handling an access application for cross-border access to electronic health data for secondary use , health data access bodies and relevant authorised participants shall remain responsible for taking decisions to grant or refuse access to electronic health data within their remit in accordance with the requirements for access laid down in this chapter. ### 1. when handling an access application for cross-border access to electronic health data for secondary use , health data access bodies and relevant authorised participants shall remain responsible for taking decisions to grant or refuse access to electronic health data within their remit in accordance with the requirements for access laid down in this chapter. after a decision is made regarding the granting or refusal of the health data permit , the health data access body shall inform the other health data bodies concerned by the same application about the decision. these decisions may be taken into consideration by the other health data access bodies when deciding on the granting or refusal of the data permit.


### dataset description ### dataset description and dataset catalogue


### 1. datasets made available through health data access bodies may have a union data quality and utility label provided by the data holders. ### 1. datasets made available through health data access bodies may have a union data quality and utility label provided by the health data access bodies.


### 2. any judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a digital health authority , health data access body or data users to transfer or give access to non-personal electronic health data within the scope of this regulation held in the union shall be recognised or enforceable in any manner only if based on an international agreement , such as a mutual legal assistance treaty , in force between the requesting third country and the union or any such agreement between the requesting third country and a member state. ### 2. any judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a digital health authority , health data access body or data users to transfer or give access to non-personal electronic health data within the scope of this regulation held in the union may only be recognised or enforceable in any manner if based on an international agreement , such as a mutual legal assistance treaty , in force between the requesting third country and the union or any such agreement between the requesting third country and a member state.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states , as well as representatives of stakeholders , including health professionals , patients and consumers' organisations. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### deleted


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### 4. stakeholders and relevant third parties , including health professionals , patients and consumers' representatives , shall attend meetings of the ehds board and to participate in its work.


### 6. the commission shall chair the meetings of the ehds board. ### 6. a representative of the commission and a representative of the european parliament shall co-chair the meetings of the ehds board.


### to share information concerning risks posed by ehr systems and serious incidents as well as their handling; ### to share information between members of the ehds board concerning risks posed by ehr systems and serious incidents as well as how they were handled. the edpb shall be responsible for identifying all possible data protection risks posed by ehr systems and provide guidance for their handling;


### to share information concerning risks and data protection incidents related to secondary use of electronic health data , as well as their handling; ### to share information between members of the ehds board concerning risks and data protection incidents related to secondary use of electronic health data , as well as how they were handled. the edpb shall be responsible for identifying all possible data protection risks and provide guidance for their handling;


### 2. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation. ### 2. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation.


### 3. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force. ### 3. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force.


### 6. a delegated act adopted pursuant to articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall enter into force only if no objection has been expressed either by the european parliament or by the council within a period of 3 months of notification of that act to the european parliament and to the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by 3 months at the initiative of the european parliament or of the council. ### 6. a delegated act adopted pursuant to articles 5(2) , 10(3) , 25(3) , 32(4) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall enter into force only if no objection has been expressed either by the european parliament or by the council within a period of 3 months of notification of that act to the european parliament and to the council or if , before the expiry of that period , the european parliament and the council have both informed the commission that they will not object. that period shall be extended by 3 months at the initiative of the european parliament or of the council.


### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them. ### 1. member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. specific attention shall be given to penalties for serious breaches of this regulation , as referred to in article 41a(3) and article 44(3). member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them.


### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the self-certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies. ### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , including the need to extend interoperability possibilities between ehr systems and electronic health data access services other than those established by the member states , the possibility to expand the access to myhealth@eu infrastructure to third countries and international organisations , the implementation and use by natural persons of the opt-out mechanism in secondary use as referred to in article -33a , the use and implementation of the right referred to in article 3(9) , the implementation of articles 33 and 34 as well as the application of fees as referred to in article 42 , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment.


### it shall apply from 12 months after its entry into force. ### it shall apply from 24 months after its entry into force.


### 3.8. an ehr system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data. ### 3.8. an ehr system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data as well as the specific purposes of data processing.


### electronic health data category ### main characteristics of electronic health data included under the category


### 1. health data access bodies shall make publicly available and easily searchable the conditions under which electronic health data is made available for secondary use , with information concerning: ### 1. health data access bodies shall make publicly available and easily searchable and accessible the conditions under which electronic health data is made available for secondary use , with information concerning:


### the applicable rights of natural persons in relation to secondary use of electronic health data; ### the applicable rights of natural persons in relation to secondary use of electronic health data , in particular the right to opt-out pursuant to article 33 , including detailed information on how to exercise them;


### the applicable rights of natural persons in relation to secondary use of electronic health data; ### the applicable rights of natural persons in relation to secondary use of electronic health data including the right to opt out for certain type of data as defined in article 33a (new);


### the arrangements for natural persons to exercise their rights in accordance with chapter iii of regulation (eu) 2016/679; ### the modalities for natural persons to exercise their rights in accordance with chapter iii of regulation (eu) 2016/679;


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. health data access bodies shall comply with the obligations laid down in article 14(1) to (4) of regulation (eu) 2016/679. natural persons shall have the possibility to choose whether to receive notifications when their data are being used for secondary purpose , as well as the periodicity of such notifications.where , with regards to obligations laid down in article 14(1) to (4) of regulation (eu) 2016/679 a health data access body decides to make use of the exception laid down in article 14(5) , point (b) , of the same regulation , it shall make sure to make the information as referred to in article 14(1) to (4) of regulation (eu) 2016/679 publicly available on its website in an aggregated form , allowing natural persons to understand whether their data are being made available for secondary use pursuant to data permits.


### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### 3. where a health data access body is informed by a health data user of a clinically significant finding that may influence the health status of a natural person , as referred to in article 41a(5) of this regulation , the health data access body shall inform , where applicable , the treating health professional of the natural person concerned about that finding. where relevant , the treating health professional shall take due regard to the expressed wish of the natural person not to be informed.


### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies , as well as the risks and consequences linked with individual and collective digital health data rights arising from this regulation.


### information relating to the data access applications for electronic health data access submitted , such as the types of applicants , number of data permits granted or refused , purposes of access and categories of electronic health data accessed , and a summary of the results of the electronic health data uses , where applicable; ### information relating to the data access applications and data requests submitted , such as the types of applicants , number of data permits granted or refused , purposes of access and categories of electronic health data accessed , and a summary of the results of the electronic health data uses , where applicable;


### information on the fulfilment of regulatory and contractual commitments by data users and data holders , as well as penalties imposed; ### information on the fulfilment of regulatory and contractual commitments by data users and data holders , as well as the number and amount of penalties imposed by health data access bodies or supervisory authorities under regulation (eu) 2016/679 and regulation (eu) 2018/1725;


### information on audits carried out on data users to ensure compliance of the processing with this regulation , ### information on audits carried out on data users to ensure compliance of the processing in the secure processing environment as referred to in article 50 of this regulation ,


### information on audits on compliance of secure processing environments with the defined standards , specifications and requirements; ### information on third party audits on compliance of secure processing environments with the defined standards , specifications and requirements , as referred to in article 50(3) of this regulation;


### satisfaction from applicants requesting access to data; ### deleted


### 2. the report shall be transmitted to the commission. ### 2. the report shall be transmitted to the commission , the council and the european parliament and made publicly available.


### 1. when processing personal electronic health data , data altruism organisations shall comply with the rules set out in chapter iv of regulation […] [data governance act com/2020/767 final]. where data altruism organisations process personal electronic health data using a secure processing environment , such environments shall also comply with the requirements set out in article 50 of this regulation. ### 1. in addition to rules regarding data altruism estabished by regulation (eu) 2022/868 , where recognised data altruism organisations under chapter iv of that regulation process personal electronic health data using a secure processing environment , such environments shall also comply with the requirements set out in article 50 of this regulation.


### 2. health data access bodies shall support the competent authorities designated in accordance with article 23 of regulation […] [data governance act com/2020/767 final] in the monitoring of entities carrying out data altruism activities. ### 2. health data access bodies shall support the competent authorities designated in accordance with article 23 of regulation (eu) 2022/868 in the monitoring of entities carrying out data altruism activities , where electronic health data are concerned.


### 1. where a data holder is obliged to make electronic health data available under article 33 or under other union law or national legislation implementing union law , it shall cooperate in good faith with the health data access bodies , where relevant. ### 1. (1) health data holders shall make relevant electronic health data under article 33 available upon request to the health data access body pursuant to a data permit issued or data request granted by such a body. health data holders shall cooperate in good faith with the health data access bodies , where relevant.


### 4. the data holder shall put the electronic health data at the disposal of the health data access body within 2 months from receiving the request from the health data access body. in exceptional cases , that period may be extended by the health data access body for an additional period of 2 months. ### deleted


### 1. health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] ### 1. health data access bodies and single data holders may charge fees to health data users for making electronic health data available for secondary use.


### 2. where the data in question are not held by the data access body or a public sector body , the fees may also include compensation for part of the costs for collecting the electronic health data specifically under this regulation in addition to the fees that may be charged pursuant to paragraph 1. the part of the fees linked to the data holder’s costs shall be paid to the data holder. ### 2. in the case of health data holders , where the data in question are not held by the data access body or a public sector body , the fees may be derived from the costs for gathering and preparing the electronic health data for secondary use specifically under this regulation.


### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget. ### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent , non-discriminatory , proportionate to the cost of making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes and start-ups , public bodies , union institutions , bodies , offices and agencies involved in scientific research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget.


### 1. health data access bodies shall monitor and supervise compliance by data users and data holders with the requirements laid down in this chapter. ### deleted


### 2. when requesting from data users and data holders the information that is necessary to verify compliance with this chapter , the health data access bodies shall be proportionate to the performance of the compliance verification task. ### 2. when carrying out its monitoring and supervisory tasks to verify compliance with this chapter , as referred to in article 37(1) , point (ra) , the health data access bodies shall request information from data holders and users that is necessary for the performance of the task.


### 3. where health data access bodies find that a data user or data holder does not comply with the requirements of this chapter , they shall immediately notify the data user or data holder of those findings and shall give it the opportunity to state its views within 2 months. ### 3. where health data access bodies find that a data user or data holder does not comply with the requirements of this chapter , they shall immediately notify the data user or data holder of those findings and shall give it the opportunity to state its views within 4 weeks.


### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 immediately and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. the health data access bodies shall be able , where appropriate , to exclude the data user from any access to electronic health data within the ehds for a period of up to 5 years.


### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49. ### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years.


### 6. the health data access body shall communicate the measures imposed pursuant to paragraph 4 and the reasons on which they are based to the data user or holder concerned , without delay , and shall lay down a reasonable period for the data user or holder to comply with those measures. ### 6. the health data access body shall communicate the measures imposed pursuant to paragraphs 4 and 5 and the reasons on which they are based to the data user or holder concerned , without delay , and shall lay down a reasonable period for the data user or holder to comply with those measures.


### 7. any penalties and measures imposed pursuant to paragraph 4 shall be made available to other health data access bodies. ### 7. any penalties and measures imposed pursuant to paragraph 4 shall be notified to other health data access bodies.


### 10. the commission may issues guidelines on penalties to be applied by the health data access bodies. ### 10. the commission shall issues guidelines on penalties to be applied by the health data access bodies.


### 1. the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted. ### 1. the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user from natural persons who have explicitly given access to their right data under article 33(5) and in line with the data permit granted.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the data user has demonstrated that the purpose of processing cannot be achieved with anonymised data , in line with article 46(1c) , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be considered a particularly serious breach of this regulation and shall be subject to effective , proportionate and dissuasive penalties.


### 1. any natural or legal person may submit a data access application for the purposes referred to in article 34. ### 1. any natural or legal person with a demonstrable link to the health or care sector and specifically activities relevant for the purposes listed in article 34(1) of this regulation may submit a data access application for the purposes referred to in article 34.


### a detailed explanation of the intended use of the electronic health data , including for which of the purposes referred to in article 34(1) access is sought; ### a detailed plan and explanation of the intended use of the electronic health data , including for which of the purposes referred to in article 34(1) access is sought;


### a description of the requested electronic health data , their format and data sources , where possible , including geographical coverage where data is requested from several member states; ### a description of the requested electronic health data , their timeframe , format and data sources , where possible , including geographical coverage where data is requested from several member states;


### an indication whether electronic health data should be made available in an anonymised format; ### an indication whether electronic health data need to be made available in a pseudonymised format;


### a description of the safeguards planned to prevent any other use of the electronic health data; ### a description of the safeguards planned to prevent any other use or misuse of the electronic health data , including attempts to re-identify natural persons whose data are part of the dataset;