### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing common security standards in order to promote the security and interoperability of the various secure environments. ### (54) given the sensitivity of electronic health data , data users should not have an unrestricted access to such data. all secondary use access to the requested electronic health data should be done through a secure processing environment. in order to ensure strong technical and security safeguards for the electronic health data , the health data access body or , where relevant , single data holder should provide access to such data in a secure processing environment , complying with the high technical and security standards set out pursuant to this regulation. some member states took measures to locate such secure environments in europe. the processing of personal data in such a secure environment should comply with regulation (eu) 2016/679 , including , where the secure environment is managed by a third party , the requirements of article 28 and , where applicable , chapter v. such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. the health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. thus , it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. the commission should assist the member state in developing high common security standards in order to promote the security and interoperability of the various secure environments as well as the regular updating of these security measures to keep pace with it developments and to counter attacks on databases.


### (57) the authorisation process to gain access to personal health data in different member states can be repetitive and cumbersome for data users. whenever possible , synergies should be established to reduce the burden and barriers for data users. one way to achieve this aim is to adhere to the “single application” principle whereby , with one application , the data user obtain authorisation from multiple health data access bodies in different member states. ### (57) the authorisation process to gain access to personal health data in different member states can be repetitive and cumbersome for data users. whenever possible , synergies should be established to reduce the burden and barriers for data users. one way to achieve this aim is to adhere to the “single application” principle whereby , with one application , the data user obtains authorisation from multiple health data access bodies in different member states.


### (61) cooperation and work is ongoing between different professional organisations , the commission and other institutions to set up minimum data fields and other characteristics of different datasets (registries for instance). this work is more advanced in areas such as cancer , rare diseases , and statistics and shall be taken into account when defining new standards. however , many datasets are not harmonised , raising comparability issues and making cross-border research difficult. therefore , more detailed rules should be set out in implementing acts to ensure a harmonised provision , coding and registration of electronic health data. member states should work towards delivering sustainable economic and social benefits of european electronic health systems and services and interoperable applications , with a view to achieving a high level of trust and security , enhancing continuity of healthcare and ensuring access to safe and high-quality healthcare. ### (61) cooperation and work is ongoing between different professional organisations , the commission and other institutions to set up minimum data fields and other characteristics of different datasets (registries for instance). this work is more advanced in areas such as cancer , rare diseases , cardiovascular and metabolic diseases , risk factors assessment and statistics and shall be taken into account when defining new standards and disease-specific harmonised templates for structured data elements.. however , many datasets are not harmonised , raising comparability issues and making cross-border research difficult. therefore , more detailed rules should be set out in implementing acts to ensure a harmonised provision , coding and registration of electronic health data. member states should work towards delivering sustainable economic and social benefits of european electronic health systems and services and interoperable applications , with a view to achieving a high level of trust and security , enhancing continuity of healthcare and ensuring access to safe and high-quality healthcare. existing health data infrastructures and registries put in place by institutions and stakeholders can contribute to defining and implementing data standards , to ensuring interoperability and must be leveraged to allow continuity and build on existing expertise.


### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , security and data quality , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds. ### (63) the use of funds should also contribute to attaining the objectives of the ehds. public procurers , national competent authorities in the member states , including digital health authorities and health data access bodies , as well as the commission should make references to applicable technical specifications , standards and profiles on interoperability , access to and security and quality of data , as well as other requirements developed under this regulation when defining the conditions for public procurement , calls for proposals and allocation of union funds , including structural and cohesion funds.


### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. ### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. given the tasks of the ehds board , its members should be only representatives of national or union authorities. an advisory group with representatives of external stakeholders (such as industry , patients organisations , etc.) could be established , without voting rights in the ehds board.


### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act]. ### (65) in order to promote the consistent application of this regulation , a european health data space board (ehds board) should be set up. the commission should participate in its activities and chair it. it should contribute to the consistent application of this regulation throughout the union , including by helping member state to coordinate the use of electronic health data for healthcare , certification , but also concerning the secondary use of electronic health data. given that , at national level , digital health authorities dealing with the primary use of electronic health data may be different to the health data access bodies dealing with the secondary use of electronic health data , the functions are different and there is a need for distinct cooperation in each of these areas , the ehds board should be able to set up subgroups dealing with these two functions , as well as other subgroups , as needed , which can be granted limited or permanent access to data provided that they respect the security of that data. for an efficient working method , the digital health authorities and health data access bodies should create networks and links at national level with different other bodies and authorities , but also at union level. such bodies could comprise data protection authorities , cybersecurity , eid and standardisation bodies , as well as bodies and expert groups under regulations […] , […] , […] and […] [data governance act , data act , ai act and cybersecurity act].


### (70) member states should take all necessary measures to ensure that the provisions of this regulation are implemented , including by laying down effective , proportionate and dissuasive penalties for their infringement. for certain specific infringements , member states should take into account the margins and criteria set out in this regulation. ### (70) member states should take all necessary measures to ensure that the provisions of this regulation are implemented , including by laying down effective , proportionate and dissuasive penalties and fines for their infringement. for certain specific infringements , member states should take into account the margins and criteria set out in this regulation.


### (71) in order to assess whether this regulation reaches its objectives effectively and efficiently , is coherent and still relevant and provides added value at union level the commission should carry out an evaluation of this regulation. the commission should carry out a partial evaluation of this regulation 5 years after its entry into force , on the self-certification of ehr systems , and an overall evaluation 7 years after the entry into force of this regulation. the commission should submit reports on its main findings following each evaluation to the european parliament and to the council , the european economic and social committee and the committee of the regions. ### (71) in order to assess whether this regulation reaches its objectives effectively and efficiently , is coherent and still relevant and provides added value at union level the commission should carry out an evaluation of this regulation. the commission should carry out a partial evaluation of this regulation 3 years after its entry into force , and an overall evaluation 5 years after the entry into force of this regulation. the commission should submit reports on its main findings following each evaluation to the european parliament and to the council , the european economic and social committee and the committee of the regions.


### making data available for public sector bodies and union institutions , bodies , offices and agencies without a data permit ### making data available for national public health authorities and european union public health agencies without a data permit


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### deleted


### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform public sector bodies and the union institutions , offices , agencies and bodies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe. ### by derogation from article 46 of this regulation , a data permit shall not be required to access the electronic health data under this article. when carrying out those tasks under article 37 (1) , points (b) and (c) , the health data access body shall inform national public health authorities and the european union health agencies , about the availability of data within 2 months of the data access application , in accordance with article 9 of regulation […] [data governance act com/2020/767 final]. by way of derogation from that regulation […] [data governance act com/2020/767 final ] , the health data access body may extend the period by 2 additional months where necessary , taking into account the complexity of the request. the health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders , unless it specifies that it will provide the data within a longer specified timeframe.


### article 49 ### deleted


### 1. the health data access bodies shall provide access to electronic health data only through a secure processing environment , with technical and organisational measures and security and interoperability requirements. in particular , they shall take the following security measures: ### 1. subject to the issuance of a data permit , the health data access bodies shall provide access to electronic health data only through a secure processing environment , with technical and organisational measures and security and interoperability requirements. in particular , they shall take the following security measures:


### 2. the health data access bodies shall ensure that electronic health data can be uploaded by data holders and can be accessed by the data user in a secure processing environment. the data users shall only be able to download non-personal electronic health data from the secure processing environment. ### 2. the health data access bodies shall ensure that electronic health data from data holders in the format determined by the data permit can be uploaded by data holders and can be accessed by the data user in a secure processing environment. the data users shall only be able to download non-personal electronic health data from the secure processing environment.


### 3. the health data access bodies shall ensure regular audits of the secure processing environments. ### 3. the health data access bodies shall ensure regular audits of the secure processing environments and take immediate corrective action of any shortcomings , risks or vulnerabilities identified in the secure processing environments


### joint controllers ### controllership


### 1. the health data access bodies and the data users , including union institutions , bodies , offices and agencies , shall be deemed joint controllers of electronic health data processed in accordance with data permit. ### 1. the data holder shall be deemed controller for the disclosure of the requested personal electronic health data to the health data access body pursuant to article 33(1). the health data access body shall be deemed controller for the processing of the personal electronic health data when fulfilling its tasks pursuant to article 37(1) , point (d). the data user shall be deemed controller for the processing of personal electronic health data in pseudonymised form in the secure processing environment pursuant to the data permit. the health data access body shall act as a processor for the health data user's processing pursuant to a data permit in the secure processing environment.


### 1. the health data access bodies and the data users , including union institutions , bodies , offices and agencies , shall be deemed joint controllers of electronic health data processed in accordance with data permit. ### 1. in addition to data holders , the health data access bodies shall be deemed a controller for the processing of personal electronic health data in accordance with article 37(1)(d). the data users shall be deemed controller for the processing of personal electronic health data in pseudonymised form in the secure processing environment pursuant to the data permit. the health data access body shall act as a processor for the health data user´s processing pursuant to a data permit in the secure processing environment.


### 2. the commission shall , by means of implementing acts , establish a template for the joint controllers’ arrangement. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2). ### 2. the commission shall , by means of implementing acts , establish a template for the joint controllers’ arrangement that meets the requirements laid down in article 28(3) of regulation (eu) 2016/679. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2).


### 2. the commission shall , by means of implementing acts , establish a template for the joint controllers’ arrangement. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2). ### 2. the commission shall , by means of implementing acts , establish a template for the controllers’ arrangement. those implementing acts shall be adopted in accordance with the advisory procedure set out in article 68(2).


### 3. union institutions , bodies , offices and agencies involved in research , health policy or analysis , shall be authorised participants of healthdata@eu. ### 3. union institutions , bodies , offices and agencies involved in health research , health policy or analysis , shall be authorised participants of healthdata@eu.


### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. ### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and whereby the transfer of electronic health data is compliant with the provisions laid down in chapter v of regulation (eu) 2016/679 and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and chapter v of regulation 2016/679 and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available.


### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. ### 5. third countries or international organisations may become authorised participants where they comply with the rules of chapter iv of this regulation , the transfer stemming from such connection complies with the rules in chapter v of regulation (eu) 2016/679 and provide access to data users located in the union , on equivalent terms and conditions , to the electronic health data available to their health data access bodies. the commission may adopt implementing acts establishing that a national contact point of a third country or a system established at an international level is compliant with requirements of healthdata@eu for the purposes of secondary use of health data , is compliant with the chapter iv of this regulation and chapter v of regulation (eu) 2016/679 and provides access to data users located in the union to the electronic health data it has access to on equivalent terms and conditions. the compliance with these legal , organisational , technical and security requirements , including with the standards for secure processing environments pursuant to article 50 shall be checked under the control of the commission. these implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68 (2). the commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available.


### 8. the member states and the commission shall set up healthdata@eu to support and facilitate the cross-border access to electronic health data for secondary use , connecting the national contact points for secondary use of electronic health data of all member states and authorised participants in that infrastructure. ### 8. the member states and the commission shall set up healthdata@eu to support and facilitate the cross-border access to electronic health data for secondary use , connecting the national contact points for secondary use of electronic health data of all member states and authorised participants in that infrastructure. healthdata@eu shall be a non-proprietary software product developed in an open and transparent process.


### the commission may , by means of implementing acts , set out: ### the commission shall , by means of implementing acts , set out:


### requirements , technical specifications , the it architecture of healthdata@eu , conditions and compliance checks for authorised participants to join and remain connected to healthdata@eu and conditions for temporary or definitive exclusion from healthdata@eu; ### requirements , technical specifications , the it architecture of healthdata@eu , conditions and compliance checks for authorised participants to join and remain connected to healthdata@eu and conditions for temporary or definitive exclusion from healthdata@eu which shall ensure state-of-the-art data security , confidentiality , and protection of electronic health data in the cross border infrastructure;


### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). the commission shall consult with and involve the european union agency for cyber security (enisa) in the aforementioned process.


### 2. a data permit issued by one concerned health data access body may benefit from mutual recognition by the other concerned health data access bodies. ### 2. the same data permit issued by one concerned health data access body shall benefit from mutual recognition by the other concerned health data access bodies.


### 1. the commission shall establish an eu datasets catalogue connecting the national catalogues of datasets established by the health data access bodies and other authorised participants in healthdata@eu. ### 1. the commission shall establish an eu datasets catalogue connecting the national catalogues of datasets established by the health data access bodies and other authorised participants in healthdata@eu taking into consideration the health interoperability resources already developed across the union.


### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 [(a) , (e) , (f) , (i) , (j) , (k) , (m)] shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final] , provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used , in view of the limited number of natural persons involved in that data , the fact that they are geographically scattered or the technological developments expected in the near future. ### 1. non-personal electronic data made available by health data access bodies , that are based on a natural person’s electronic data falling within one of the categories of article 33 shall be deemed highly sensitive within the meaning of article 5(13) of regulation […] [data governance act com/2020/767 final].


### 2. the protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### 2. the protective measures for the categories of data mentioned in paragraph 1 shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final].


### 2. the protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final]. ### 2. the protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization and pseudonymisation techniques and shall be detailed in the delegated act under the empowerment set out in article 5(13) of regulation […] [data governance act com/2020/767 final].


### in the context of international access and transfer of personal electronic health data , member states may maintain or introduce further conditions , including limitations , in accordance with and under the conditions of article 9(4) of the regulation (eu) 2016/679. ### persons responsible and processors located in the eu who process personal electronic health data in the scope of this regulation shall store the respective data within the territory of the eu. in the context of international access and transfer of personal electronic health data , shall be granted in accordance with chapter v of the regulation (eu) 2016/679.


### in the context of international access and transfer of personal electronic health data , member states may maintain or introduce further conditions , including limitations , in accordance with and under the conditions of article 9(4) of the regulation (eu) 2016/679. ### international access and transfer of personal electronic health data shall be granted in accordance with chapter v of regulation (eu) 2016/679. member states may maintain or introduce further conditions , including limitations , in accordance with and under the conditions of article 9(4) of the regulation (eu) 2016/679.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor shall be invited to the meetings , where the issues discussed are of relevance for them. the board shall also consult on a regular basis european level patient organisations and european level healthcare professional organisations and may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states and of the european data protection board and the european data protection supervisor. other national authorities , including market surveillance authorities referred to in article 28 , may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor may be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role. ### 1. a european health data space board (ehds board) is hereby established to facilitate cooperation and the exchange of information among member states. the ehds board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the member states , as well at least one patient organisation and one healthcare professional organization. other national authorities , including market surveillance authorities referred to in article 28 , european data protection board and european data protection supervisor shall be invited to the meetings , where the issues discussed are of relevance for them. the board may also invite experts and observers to attend its meetings , and may cooperate with other external experts as appropriate. other union institutions , bodies , offices and agencies , research infrastructures and other similar structures shall have an observer role.


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### 4. relevant stakeholders , including patients' and healthcare professional's organisations and academia , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity.


### 4. stakeholders and relevant third parties , including patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity. ### 4. stakeholders and relevant third parties , including healthcare professionals , researchers and patients’ representatives , shall be invited to attend meetings of the ehds board and to participate in its work , depending on the topics discussed and their degree of sensitivity.


### 5. the ehds board shall cooperate with other relevant bodies , entities and experts , such as the european data innovation board referred to in article 26 of regulation […] [data governance act com/2020/767 final] , competent bodies set up under article 7 of regulation […] [data act com/2022/68 final] , supervisory bodies set up under article 17 of regulation […] [eid regulation] , european data protection board referred to in article 68 of regulation (eu) 2016/679 and cybersecurity bodies. ### 5. the ehds board shall cooperate with other relevant bodies , entities and experts , such as the european data innovation board referred to in article 26 of regulation […] [data governance act com/2020/767 final] , competent bodies set up under article 7 of regulation […] [data act com/2022/68 final] , supervisory bodies set up under article 17 of regulation […] [eid regulation] , european data protection board referred to in article 68 of regulation (eu) 2016/679 and cybersecurity bodies , in particular the european agency for cybersecurity (enisa).


### (iii) other aspects of the primary use of electronic health data. ### (iii) other aspects of the primary use of electronic health data , with the exception of all matters related to personal data protection.


### (vi) other aspects of the secondary use of electronic health data. ### (vi) other aspects of the secondary use of electronic health data , with the exception of all matters related to personal data protection.


### to facilitate the exchange of views on the secondary use of electronic health data with the relevant stakeholders , including representatives of patients , health professionals , researchers , regulators and policy makers in the health sector. ### to facilitate the exchange of views on the secondary use of electronic health data with the relevant stakeholders , including representatives of patients , health professionals , researchers , regulators and policy makers in the health sector to support the design of aligned implementation strategies , guidance and standards and to assess the needs for further improvement.


### 2. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation. ### 2. the power to adopt delegated acts referred to in articles 5(2) , 7(3) , 25(3) , 32(4) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) shall be conferred on the commission for an indeterminate period of time from the date of entry into force of this regulation.


### 3. the power to adopt delegated acts referred to in articles 5(2) , 10(3) , 25(3) , 32(4) , 33(7) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force. ### 3. the power to adopt delegated acts referred to in articles 5(2) , 7(3) , 25(3) , 32(4) , 37(4) , 39(3) , 41(7) , 45(7) , 46(8) , 52(7) , 56(4) may be revoked at any time by the european parliament or by the council. a decision to revoke shall put an end to the delegation of the power specified in that decision. it shall take effect the day following the publication of the decision in the official journal of the european union or at a later date specified therein. it shall not affect the validity of any delegated acts already in force.


### 4. before adopting a delegated act , the commission shall consult experts designated by each member state in accordance with the principles laid down in the inter-institutional agreement of 13 april 2016 on better law-making. ### 4. before adopting a delegated act , the commission shall consult experts designated by each member state in accordance with the principles laid down in the inter-institutional agreement of 13 april 2016 on better law-making. in accordance with article 42 of regulation (eu) 2018/1725 , the commission shall consult the european data protection board and european data protection supervisor where the delegated acts concern data protection.


### 4. before adopting a delegated act , the commission shall consult experts designated by each member state in accordance with the principles laid down in the inter-institutional agreement of 13 april 2016 on better law-making. ### 4. before adopting a delegated act , the commission shall consult experts designated by each member state and targeted stakeholders , including health professionals and patients’ organisations , in accordance with the principles laid down in the inter-institutional agreement of 13 april 2016 on better law-making.


### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them. ### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them.


### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate and dissuasive. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them. ### member states shall lay down the rules on penalties applicable to infringements of this regulation and shall take all measures necessary to ensure that they are implemented. the penalties shall be effective , proportionate , dissuasive and encouraging corrective action to the infringements. member states shall notify the commission of those rules and measures by date of application of this regulation and shall notify the commission without delay of any subsequent amendment affecting them.


### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the self-certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies. ### 1. after 3 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment.


### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapter iii , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment. the evaluation shall include an assessment of the self-certification of ehr systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies. ### 1. after 5 years from the entry into force of this regulation , the commission shall carry out a targeted evaluation of this regulation especially with regards to chapters iii and iv , and submit a report on its main findings to the european parliament and to the council , the european economic and social committee and the committee of the regions , accompanied , where appropriate , by a proposal for its amendment.


### from 3 years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (d) , (e) and (f) , and to ehr systems intended by the manufacturer to process such categories of data; ### from 2 years after date of entry into application to categories of personal electronic health data referred to in article 5(1) , points (d) , (e) and (f) , and to ehr systems intended by the manufacturer to process such categories of data;


### chapter iii shall apply to ehr systems put into service in the union pursuant to article 15(2) from 3 years after date of entry into application. ### chapter iii shall apply to ehr systems put into service in the union pursuant to article 15(2) from 2 years after date of entry into application.


### main characteristics of electronic health data categories ### main characteristics of electronic health data categories electronic health data that includes important clinical facts related to an identified person and that is essential for the provision of safe and efficient healthcare to that person. the following information is part of a patient summary: 1. personal details 2. contact information 3. allergies 4. medical alerts 5.vaccination/prophylaxis information , possibly in the form of a vaccination card 6. current , resolved , closed or inactive problems 7. medical devices and implants 8. medical procedures 9. functional status 10. current and relevant past medicines 11. social history observations related to health on which the healthcare provider/ health professional bases their care or which are useful for the continuity of care or the management of the patient by another healthcare professional 12. pregnancy history 13. observation results pertaining to the health condition on which the /healthcare provider/ health professional bases his care or which are useful for the continuity of care or the management of the patient by another healthcare professional. 14. plan of care 15. information on a rare disease such as details about the impact or characteristics of the disease


### 2.5. an ehr system shall not include features that prohibit , restrict or place undue burden on authorised exporting of personal electronic health data for the reasons of replacing the ehr system by another product. ### 2.5. an ehr system shall not include features that prohibit , restrict or place undue burden on authorised exporting of personal electronic health data for the reasons of replacing the ehr system by another product. authorised exporting of personal electronic health data shall be free of charge , without undue delay , or in in any event within one month from the request and in a structured , commonly used and machine-readable format , in line with the interoperability and security requirements to be developed according to articles 23 and 50.


### 3.1. an ehr system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data , and that it prevents unauthorised access to such data. ### 3.1. an ehr system shall be designed and developed in such a way that it ensures highly safe and secure processing of electronic health data , and that it prevents unauthorised access to such data.


### electronic health data category ### main characteristics of electronic health data included under the category


### the applicable rights of natural persons in relation to secondary use of electronic health data; ### the applicable rights of natural persons in relation to secondary use of electronic health data , including the right to opt-out referred to in article 33(5a) and the right to opt-in for the categories of data referred to in article 33(5b);


### the applicable rights of natural persons in relation to secondary use of electronic health data; ### the applicable rights of natural persons in relation to secondary use of electronic health data , including the rights laid down in chapter iii of regulation (eu) 2016/679;


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### deleted


### 2. health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46. ### 2. at the request of a natural person or a group representing natural persons , health data access bodies shall not be obliged to provide the specific information under article 14 of regulation (eu) 2016/679 to each natural person concerning the use of their data for projects subject to a data permit and shall provide general public information on all the data permits issued pursuant to article 46.


### 3. where a health data access body is informed by a data user of a finding that may impact on the health of a natural person , the health data access body may inform the natural person and his or her treating health professional about that finding. ### 3. data users shall inform the health data access bodies of conclusive findings that arise from the secondary use of natural persons’ health data. health data access bodies shall provide an accessible and easily understandable mechanism for natural persons to express their explicit will to be informed by a data user of a finding that may impact on the health of that natural person. electronic health records shall notify the health professionals with the appropriate competence to communicate to the natural person about that finding to better evaluate the finding and its consequences.


### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies. ### 4. member states shall regularly inform the public at large about the role and benefits of health data access bodies , as well as the risks and consequences linked with individual and collective digital health data rights arising from this regulation.


### 3. the commission is empowered to adopt delegated acts in accordance with article 67 to modify the content of the annual activity report. ### deleted


### 4. the data holder shall put the electronic health data at the disposal of the health data access body within 2 months from receiving the request from the health data access body. in exceptional cases , that period may be extended by the health data access body for an additional period of 2 months. ### 4. the data holder shall put the electronic health data at the disposal of the health data access body within 3 months from receiving the request from the health data access body. in exceptional cases , that period may be extended by the health data access body for an additional period of 2 months.


### 1. health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final] ### 1. health data access bodies may charge fees for making electronic health data available for secondary use. any fees shall include and be derived from the costs related to set up , data enrichment , maintainance or updating of the dataset and conducting the procedure for requests , including for assessing a data application or a data request , granting , refusing or amending a data permit pursuant to articles 45 and 46 or providing an answer to a data request pursuant to article 47 , in accordance with article 6 of regulation […] [data governance act com/2020/767 final]. no fees should be charged to public health authorities , at local , regional or national level or to address public health research , including but not limited to , epidemiological surveillance or monitoring of health projects and programmes.


### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update tat dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget. ### 4. any fees charged to data users pursuant to this article by the health data access bodies or data holders shall be transparent and proportionate to the cost of collecting , set up , data enrichment , maintainance or updating of the dataset and making electronic health data available for secondary use , objectively justified and shall not restrict competition. the support received by the data holder from donations , public national or union funds , to set up , develop or update that dataset shall be excluded from this calculation. the specific interests and needs of smes , public bodies , union institutions , bodies , offices and agencies involved in research , health policy or analysis , educational institutions and healthcare providers shall be taken into account when setting the fees , by reducing those fees proportionately to their size or budget.


### 6. the commission may , by means of implementing acts , lay down principles and rules for the fee policies and fee structures. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2). ### 6. the commission shall , by means of implementing acts , lay down principles and rules for the fee policies and fee structures. those implementing acts shall be adopted in accordance with the advisory procedure referred to in article 68(2).


### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years. ### 4. health data access bodies shall have the power to revoke the data permit issued pursuant to article 46 and stop the affected electronic health data processing operation carried out by the data user in order to ensure the cessation of the non-compliance referred to in paragraph 3 , immediately or within a reasonable time limit , and shall take appropriate and proportionate measures aimed at ensuring compliant processing by the data users. in this regard , the health data access bodies shall be able , where appropriate , to revoke the data permit and to exclude the data user from any access to electronic health data for a period of up to 5 years , and fines shall be imposed in accordance with article 83 of the regulation (eu) 2016/679.


### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years. where a data holder has been excluded from the participation in the ehds pursuant to this article , following manifest intention of obstructing the secondary use of electronic health data , it shall not have the right to provide access to health data in accordance with article 49. ### 5. where data holders withhold the electronic health data from health data access bodies with the manifest intention of obstructing the use of electronic health data , or do not respect the deadlines set out in article 41 , the health data access body shall have the power to fine the data holder with fines for each day of delay , which shall be transparent and proportionate. the amount of the fines shall be established by the health data access body. in case of repeated breaches by the data holder of the obligation of loyal cooperation with the health data access body , that body can exclude the data holder from participation in the ehds for a period of up to 5 years.


### 10. the commission may issues guidelines on penalties to be applied by the health data access bodies. ### 10. the commission shall issues guidelines on penalties to be applied by the health data access bodies.


### 1. the health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted. ### 1. the health data access body shall ensure that access is only provided to requested electronic health data that is necessary and relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring anonymisation and pseudonymisation shall be subject to appropriate penalties.


### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data access body. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties. ### 3. where the purpose of the data user’s processing cannot be achieved with anonymised data , taking into account the information provided by the data user , the health data access bodies shall provide access to electronic health data in pseudonymised format. the information necessary to reverse the pseudonymisation shall be available only to the health data holder. data users shall not re-identify the electronic health data provided to them in pseudonymised format. the data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.


### a detailed explanation of the intended use of the electronic health data , including for which of the purposes referred to in article 34(1) access is sought; ### a detailed explanation of the intended use of the electronic health data including:


### an indication whether electronic health data should be made available in an anonymised format; ### an indication whether electronic health data need to be made available in a pseudonymised format and the reason why the envisaged purpose for processing cannot be pursued using anonymised data;


### where applicable , an explanation of the reasons for seeking access to electronic health data in a pseudonymised format; ### deleted


### a description of the safeguards planned to prevent any other use of the electronic health data; ### a description of the safeguards planned to prevent any other use or any misuse of the electronic health data , including the re-identification of natural persons in the dataset;


### an estimation of the period during which the electronic health data is needed for processing; ### a justified estimation of the period during which the electronic health data is needed for processing;


### 4. where the applicant intends to access the personal electronic health data in a pseudonymised format , the following additional information shall be provided together with the data access application: ### 4. where the applicant intends to access the personal electronic health data in a pseudonymised format or non-personal data , the following additional information shall be provided together with the data access application:


### a description of how the processing would comply with article 6(1) of regulation (eu) 2016/679; ### a description of how the processing would comply with applicable union and national law on data protection and privacy , notably regulation (eu) 2016/679 and , where relevant , regulation (eu) 2018/1725;


### information on the assessment of ethical aspects of the processing , where applicable and in line with national law. ### information on the assessment of ethical aspects of the processing.


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall grant access to electronic health data only if the application fulfils all of the following criteria:


### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary for the purpose listed in the application and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit. ### 1. health data access bodies shall assess if the application fulfils one of the purposes listed in article 34(1) of this regulation , if the requested data is necessary , adequate , and proportionate for the purpose listed in the application , if it received a favourable opinion from an authorised ethics committee , where applicable , or after conducting a data protection impact assessment , and if the requirements in this chapter are fulfilled by the applicant. if that is the case , the health data access body shall issue a data permit.


### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 or where requirements in this chapter are not met. ### 2. health data access bodies shall refuse all applications including one or more purposes listed in article 35 , all applications that do not fulfill the criteria referred to in paragraph 1 or where requirements in this chapter are not met. the data authorisation shall not be granted for personal electronic health data where the data subject has not given consent pursuant to article 33(5).


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 6 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay.


### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay. where a health data access body fails to provide a decision within the time limit , the data permit shall be issued. ### 3. a health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. by way of derogation from that regulation […] [data governance act com/2020/767 final] , the health data access body may extend the period for responding to a data access application by 2 additional months where necessary , taking into account the complexity of the request. in such cases , the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application , together with the reasons for the delay.


### 7. data users shall have the right to access and process the electronic health data in accordance with the data permit delivered to them on the basis of this regulation. ### 7. data users shall have the right to access and process the electronic health data in accordance with the data permit delivered to them on the basis of this regulation only after they have demonstrated the effective implementation of their security measures referred to in article 45(2) , points (e) and (f).


### 9. a data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 5 years. this duration may be extended once , at the request of the data user , based on arguments and documents to justify this extension provided , 1 month before the expiry of the data permit , for a period which cannot exceed 5 years. by way of derogation from article 42 , the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 5 years. in order to reduce such costs and fees , the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. the data within the secure processing environment shall be deleted within 6 months following the expiry of the data permit. upon request of the data user , the formula on the creation of the requested dataset shall be stored by the health data access body. ### 9. a data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 5 years. this duration may be extended once , at the request of the data user , based on arguments and documents to justify this extension provided , 1 month before the expiry of the data permit , for a period which cannot exceed 5 years. by way of derogation from article 42 , the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 5 years. in order to reduce such costs and fees , the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. the data within the secure processing environment shall be deleted immediately after the expiry of the data permit. upon request of the data user , the formula on the creation of the requested dataset shall be stored by the health data access body.


### 9. a data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 5 years. this duration may be extended once , at the request of the data user , based on arguments and documents to justify this extension provided , 1 month before the expiry of the data permit , for a period which cannot exceed 5 years. by way of derogation from article 42 , the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 5 years. in order to reduce such costs and fees , the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. the data within the secure processing environment shall be deleted within 6 months following the expiry of the data permit. upon request of the data user , the formula on the creation of the requested dataset shall be stored by the health data access body. ### 9. a data permit shall be issued for the duration necessary to fulfil the requested purposes which shall not exceed 10 years. this duration may be extended once for no more than 2 years at the request of the data user based on arguments and documents to justify this extension provided 1 month before the expiry of the data permit. by way of derogation from article 42 , the health data access body may charge increasing fees to reflect the costs and risks of storing electronic health data for a longer period of time exceeding the initial 10 years. in order to reduce such costs and fees , the health data access body may also propose to the data user to store the dataset in storage system with reduced capabilities. the data within the secure processing environment shall be deleted within 6 months following the expiry of the data permit. upon request of the data user , the formula on the creation of the requested dataset shall be stored by the health data access body.


### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds. ### 11. data users shall make public the results or output of the secondary use of electronic health data , including information relevant for the provision of healthcare , no later than 12 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in article 47. those results or output shall only contain anonymised data. the data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public in lay summaries on health data access bodies’ websites. whenever the data users have used electronic health data in accordance with this chapter , they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the ehds.


### 12. data users shall inform the health data access body of any clinically significant findings that may influence the health status of the natural persons whose data are included in the dataset. ### 12. data users shall inform the health data access body of any clinically significant findings that may influence the health status of the natural persons whose data are included in the dataset and where natural persons have explicitly given their consent.


### 2. this regulation: ### 2. this regulation:


### strengthens the rights of natural persons in relation to the availability and control of their electronic health data; ### strengthens the rights of natural persons in relation to the availability , control and security of their electronic health data;


### strengthens the rights of natural persons in relation to the availability and control of their electronic health data; ### outlines the rights of natural persons in relation to the availability and control of their electronic health data;


### lays down rules for the placing on the market , making available on the market or putting into service of electronic health records systems (‘ehr systems’) in the union; ### lays down rules for the placing on the market , making available on the market or putting into service of electronic health records systems (‘ehr systems’) in the union , with the appropriate security measures;


### lays down rules for the placing on the market , making available on the market or putting into service of electronic health records systems (‘ehr systems’) in the union; ### lays down rules for the placing on the market , making available on the market or putting into service of electronic health records systems (‘ehr systems’) in the union , with the obligation to comply with the gdpr;


### establishes a mandatory cross-border infrastructure enabling the primary use of electronic health data across the union; ### establishes a mandatory cross-border infrastructure enabling the primary use of electronic health data across the union that complies with the gdpr;


### establishes a mandatory cross-border infrastructure for the secondary use of electronic health data. ### establishes a mandatory cross-border infrastructure for the secondary use of electronic health data that complies with the gdpr.


### manufacturers and suppliers of ehr systems and wellness applications placed on the market and put into service in the union and the users of such products; ### manufacturers and suppliers of ehr systems placed on the market and put into service in the union and the users of such products;


### 4. this regulation shall be without prejudice to other union legal acts regarding access to , sharing of or secondary use of electronic health data , or requirements related to the processing of data in relation to electronic health data , in particular regulations (eu) 2016/679 , (eu) 2018/1725 , […] [data governance act com/2020/767 final] and […] [data act com/2022/68 final]. ### 4. this regulation shall be without prejudice to other union legal acts regarding access to , sharing of or secondary use of electronic health data , or requirements related to the processing of data in relation to electronic health data , in particular regulations (eu) 2016/679 , (eu) 2018/1725 , […] [data governance act com/2020/767 final] and […] [data act com/2022/68 final] and directive 2002/58/ec.


### 6. this regulation shall not affect the rights and obligations laid down in union or national law concerning data processing for the purposes of reporting , complying with information requests or demonstrating or verifying compliance with legal obligations. ### 6. this regulation shall not affect the rights and obligations laid down in union or national law concerning data processing for the purposes of reporting , complying with information requests or demonstrating or verifying compliance with legal obligations and shall be without prejudice to the rights and obligations arising from the gdpr.


### the definitions in regulation (eu) 2016/679; ### the definitions , including those of ‘personal data’ , ‘processing’ , ‘pseudonymisation’ , ‘controller’ , ‘processor’ , ‘third party’ , ‘consent’ , ‘genetic data’ , ‘data concerning health’ , ‘supervisory authority’ , ‘international organisation’ in regulation (eu) 2016/679;


### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , as well as data referring to determinants of health , or data processed in relation to the provision of healthcare services , processed in an electronic form; ### ‘personal electronic health data’ means data concerning health and genetic data as defined in regulation (eu) 2016/679 , processed in an electronic form;


### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; ### ‘non-personal electronic health data’ means data relevant for health research in electronic format that have been irreversibly anonymised and data that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679;


### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; ### ‘non-personal electronic health data’ means data concerning mental and physical health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679;


### ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679; ### ‘non-personal electronic health data’ means data concerning health in electronic format that falls outside the definition of personal data provided in article 4(1) of regulation (eu) 2016/679;


### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for the purpose of the secondary use; ### ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in chapter iv of this regulation. the data used may include personal electronic health data initially collected in the context of primary use , but also electronic health data collected for the purpose of the secondary use. secondary use of personal electronic health data shall have article 9(2) of regulation (eu) 2016/679 as its legal basis;


### ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals , involving the exchange of information and knowledge without changing the content of the data between these organisations , software applications or devices , through the processes they support; ### ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals , involving the exchange of information and knowledge without changing the content or quality of the data between these organisations , software applications or devices , through the processes they support , enabling data portability across data holders and health care providers for data recipients and data users;


### ‘european electronic health record exchange format’ means a structured , commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications , devices and healthcare providers; ### ‘european electronic health record exchange format’ means a structured , commonly used and machine-readable format that allows transmission of personal electronic health data between different organisations , software applications , devices and healthcare providers;


### ‘health professional access service’ means a service , supported by an ehr system , that enables health professionals to access data of natural persons under their treatment; ### ‘health professional access service’ means a service , supported by an ehr system , that enables health professionals to access data of natural persons under their care and with authorised permission to do so;


### ‘telemedicine’ means the provision of healthcare services , including remote care and online pharmacies , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location; ### ‘telemedicine’ means the provision of healthcare services , including remote care , through the use of information and communication technologies , in situations where the health professional and the patient (or several health professionals) are not in the same location;


### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for healthcare purposes; ### ‘ehr’ (electronic health record) means any collection of the past or present electronic mental and physical health data related to a natural person and collected in the health system , processed for the purpose of the provision of healthcare services or research purposes;


### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for healthcare purposes; ### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for the purpose of the provision of healthcare services;


### ‘ehr’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system , processed for healthcare purposes; ### ‘ehr’ (electronic health record) means a collection of electronic mental and physical health data related to a natural person and collected in the health system , processed for healthcare or research purposes;


### ‘ehr system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records; ### ‘ehr system’ (electronic health record system) means any appliance or other article whose primary purpose intended by the manufacturer to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records or that can be reasonably expected by the manufacturer to be used for these purposes;


### ‘ehr system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records; ### ‘ehr system’ (electronic health record system) means any appliance or software intended by the healthcare provider to be used for storing , intermediating , importing , exporting , converting , editing or viewing electronic health records;


### ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for other purposes than healthcare , such as well-being and pursuing healthy life-styles; ### deleted


### ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for other purposes than healthcare , such as well-being and pursuing healthy life-styles; ### ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for a healthy lifestyle , well-being purposes or that can be reasonably expected by the manufacturer for these purposes;


### ‘data holder’ means any natural or legal person , which is an entity or a body in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies who has the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , or in the case of non-personal data , through control of the technical design of a product and related services , the ability to make available , including to register , provide , restrict access or exchange certain data; ### ‘data holder’ means a controller as set out in regulation (eu) 2016/679 in the health or care sector , or performing research in relation to these sectors , as well as union institutions , bodies , offices and agencies which are a controller as set out in regulation (eu) 2018/1725 which have the right or obligation , in accordance with this regulation , applicable union law or national legislation implementing union law , to process personal electronic health data or in the case of non-personal health data , through control of the technical design of the product and related services and as allowed by contract with natural or legal person owning , renting or leasing the product or related service , the ability to make the relevant and appropriate data pursuant to the relevant requirements laid down in this regulation available , including to register , provide , restrict access or exchange certain data;


### (ac) ‘dataset catalogue’ means a collection of datasets descriptions , which is arranged in a systematic manner and consists of a user-oriented public part , where information concerning individual dataset parameters is accessible by electronic means through an online portal; ### (ac) ‘dataset catalogue’ means a collection of datasets descriptions , which is arranged in a systematic manner;


### 1. natural persons shall have the right to access their personal electronic health data processed in the context of primary use of electronic health data , immediately , free of charge and in an easily readable , consolidated and accessible form. ### 1. natural persons shall have the right to access their personal electronic health data processed in the context of primary use of electronic health data , without delay , free of charge and in an easily readable , consolidated and accessible form.


### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health. ### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of these rights whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health.


### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on his or her health. ### 3. in accordance with article 23 of regulation (eu) 2016/679 , member states may restrict the scope of this right whenever necessary for the protection of the natural person based on patient safety and ethics by imposing their access to their personal electronic health data be made only through a health professional who will properly communicate and explain to the natural person information that can have a significant impact on his or her health.


### 4. where the personal health data have not been registered electronically prior to the application of this regulation , member states may require that such data is made available in electronic format pursuant to this article. this shall not affect the obligation to make personal electronic health data registered after the application of this regulation available in electronic format pursuant to this article. ### deleted


### 4. where the personal health data have not been registered electronically prior to the application of this regulation , member states may require that such data is made available in electronic format pursuant to this article. this shall not affect the obligation to make personal electronic health data registered after the application of this regulation available in electronic format pursuant to this article. ### 4. where the personal health data have not been registered electronically prior to the application of this regulation , member states shall require that such data is made available in electronic format. this shall not affect the obligation to make personal electronic health data registered after the application of this regulation available in electronic format pursuant to this article.


### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf. ### establish one or more proxy services enabling a natural person to authorise other natural persons of their choice to access their electronic health data on their behalf or to enable legal guardians to act on behalf of their dependents in accordance with the national law of the member state.