EUROPEAN COMMISSION Strasbourg, 3.5.2022 SWD(2022) 131 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Health Data Space {COM(2022) 197 final} - {SEC(2022) 196 final} - {SWD(2022) 130 final} - {SWD(2022) 132 final}



Table of contents 1Introduction 1.1Technological context 1.2Socio-economic context 1.3Legal context 2Problem definition 2.1Lessons learnt from the evaluation of Article 14 of the Cross Border Health Care Directive (CBHC) Directive 2.2What are the problems? 2.3What are the problem drivers? 2.4How will the problem evolve? 3Why should the EU act? 3.1Legal basis 3.2Subsidiarity and Proportionality 4Objectives: What is to be achieved? 4.1General objective 4.2Specific objectives 4.3Objectives tree/intervention logic 5What are the available policy options? 5.1What is the baseline from which options are assessed?

5.2Description of the policy options 6What are the impacts of the policy options? 6.1Economic impact 6.2Single Market, competitiveness, innovation, SMEs and international aspects 6.3Impacts on fundamental rights 6.4Social and environmental impact 7How do the options compare? 8Preferred option 9How will actual impacts be monitored and evaluated? End-notes

Glossary Term or acronym Meaning or definition AI Artificial intelligence AIA Artificial Intelligence Act App Application CBHC Cross-Border Healthcare Directive (2011/24/EU) CEF Connecting Europe Facility DCC Digital COVID-19 Certificate DGA Data Governance Act DA Data Act eIDAS Electronic identification, authentication and trust services eHDSI, MyHealth@EU Cross-border digital infrastructure for the exchange of health data, also known as the eHealth Digital Service Infrastructure (previously referred to as “eHDSI”) DARWIN Data Analysis and Real-World Interrogation Network eHealth Network Voluntary network established on the basis of Article 14 of Directive 2011/24/EU with EU Member States representatives collaborating on eHealth EEHRxF European Electronic Health Record exchange format EHR Electronic Health Record eID Electronic Identification and Authentication epSOS Smart Open Services for European Patients ECDC European Centre for Disease Prevention and Control EMA European Medicines Agency ERDF European Regional Development Fund EU European Union FTE Fulltime equivalent GDP Gross Domestic Product GDPR General Data Protection Regulation GP General Practitioner ICT Information and Communication Technology MD Medical Device MDR Medical Device Regulation mHealth Mobile communication device used in health and well-being services covering various technological solutions, which support self-management and measure vital signs such as heart rate, blood glucose level, blood pressure, body temperature and brain activity. MWP Multiannual Work Plan NCPeHs National Contact Points for eHealth OECD Organisation for Economic Co-operation and Development R&D Research & Development RRF Recovery and Resilience Facility RWE Real World Evidence RWD Real World Data Telehealth Provision of healthcare services and medical information using innovative technologies, especially ICT, in situations where the health professional and patient (or two health professionals) are not in the same location. WHO World Health Organization

11 Introduction This impact assessment accompanies the legislative proposal on a European Health Data Space (EHDS). EHDS is one of the priorities of the current College in the area of health I and will be an integral part of building a European Health Union II . It will ensure coherence with a number of other EU legislative frameworks, including the General Data Protection Regulation, the Data Governance Act, the AI Act, cybersecurity regulatory framework, the eIDAS regulation, the pharmaceutical regulatory framework and the medical device regulation III . The COVID-19 pandemic has highlighted the imperative of having timely access to health data for research, innovation, regulatory, policy-making and statistical purposes, and the European Council has recognised the urgency to make progress towards and to give priority to the EHDS IV . Such timely access would have helped, through efficient public health surveillance and monitoring, a more effective management of the pandemic, and ultimately contributing to save lives. In 2020, the Commission adapted urgently its Clinical Patient Management System V (CPMS) to allow Member States share the data of COVID patients when moving between healthcare providers and Member States during the peak of the pandemic, but this was only an emergency solution, showing the need for a structural approach at Member States and cross-country level. The call for structural approach was further strengthened through Council Conclusions by the ministers of health during the German Presidency VI . In February 2019, the European Parliament adopted a resolution on the implementation of Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare (hereinafter “CBHC Directive”) VII , where it stressed the need for action in the area of digital health data, personal records, ePrescriptions and telemedicine, while ensuring data protection.

The 2020 European Strategy for Data VIII announced the Commission’s plans for European data spaces, including the EHDS. The initiative on an EHDS builds upon and complements the proposal for a Data Governance Act IX and the proposal for a Data Act X , by providing specific measures for health. It also builds on the provisions of the GDPR for the area of health. The EHDS is a Commission priority XI , as reiterated in the State of the Union of 2020 XII and 2021 XIII , and is included in the 2021 Commission Work Programme (CWP) XIV . Digital health has been on the agenda of the European Commission for a long time XV , building on the CBHC Directive XVI and eHealth Action Plan 2012-2020 XVII . Prior to the COVID-19 health crisis, in the Communication on enabling digital transformation of health and care in the Digital Single Market (2018) XVIII , the Commission announced its intention to act in three areas: citizens' secure access to and sharing of health data across borders; better data to advance research, disease prevention and personalised health and care; and digital tools for citizen empowerment and person-centred care. Through MyHealth@EU XIX , in 2019, Member States started to provide patients the ability to share their data with healthcare providers (in the language of the healthcare professional) of their choice when traveling abroad. Also, progress was made on the interoperability of electronic health records (EHRs) XX . The COVID-19 crisis strongly anchored the work of the eHealth Network as the main pillar for the development of contact tracing and warning apps XXI and EU Digital COVID Certificates XXII . At international level, the challenges and opportunities related to the growing digitalisation of data in the health area and to health data sharing have also been discussed. The Council of Europe issued in March 2019 a Recommendation on the protection of health-related data XXIII , providing guidelines on the processing of health-related data in line with the Convention for the Protection of Human Rights and Fundamental Freedoms. The Organisation for Economic Co-operation and Development (OECD) underlined in 2016 XXIV the important and growing opportunities of health data re-use and World Health Organization (WHO) adopted a Global Strategy on digital health 2020-2025 XXV . Moreover, WHO and OECD are looking into the state of play of digital health ecosystems of countries. The WHO has developed State of Digital Health report, which provides the snapshot throughout the world. The report presents data collected from the 22 countries across 6 regions that participate in the Global Digital Health Index (GDHI), analyses regional trends, and sets benchmarks to consider when charting future growth. XXVI . OECD regularly develops reports on the implementation, dissemination and continued relevance of the OECD Recommendation on Health Data Governance XXVII . Several third countries adopted specific legislation on data and interoperability XXVIII . Cooperation with WHO, OECD, G7 continues, as well as bilateral cooperation with different third countries, such as the US. 1.11.1 Technological context Data concerning health is defined by the GDPR as personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. The scope of health data covered by the EHDS includes not only processing of electronic personal data concerning health and social care, but also non-personal data, for example, as anonymised or aggregated data related to health and social care XXIX which may fall outside the scope of the GDPR. It is important to distinguish between primary and secondary uses of health data to understand the challenges of the EHDS. In this context, primary and secondary uses should be understood as follows, unless indicated otherwise: a)Primary use, or use, of heath data is defined as the use of health data to support or provide direct individual healthcare delivery to the data subject, including for ensuring continuity of care XXX . Such data comprises data stored in electronic health records (including patient summaries, ePrescriptions, images, laboratory results, discharge reports), as well as other types of data (e.g. genetic data, data generated by medical devices or wellness applications). The eHealth Network, the existing voluntary cooperation network established under article 14 of the CBHC Directive, has worked over the past years on the cross-border exchange of health data for primary uses. Key information domains that have been or are being standardised (coded, made interoperability for data exchange etc.) include patient summaries, ePrescriptions/eDispensations, laboratory reports, medical images and reports and hospital discharge reports. While these documents are not the only documents constituting an electronic health record (EHR) XXXI , they are key datasets identified as a baseline for a European Electronic Health Record Exchange Format (EEHRxF) XXXII . b)Secondary use (or reuse) of health data is defined as the use of individual-level, personal or non-personal health data or aggregated datasets, particularly data generated during healthcare provision with the purpose of supporting research, innovation, policy making, regulatory activities and other uses, such as healthcare delivery to a patient, based on the data concerning other patients (e.g. personalised medicine). The scope of health data for reuse purposes is much wider than in the context of primary use. Such data could include electronic health records, other clinical documents, sickness claims, reimbursement data, diseases registries, but also relevant social data etc. Besides electronic health records and other digital health products and services, reusers may utilise sources such as disease-specific or subdomain-specific data registries (e.g. focused on brain research or communicable diseases, among many others) and networks of registries (such as EUROCAT or ENCR), health-related administrative data (e.g. reimbursement and claims data), as well as other specific datasets containing genetic and genomic data. The current landscape of health data reuse initiatives is characterised by disease-specific or subdomain-specific initiatives and infrastructures XXXIII . Digital health refers to the use of digital technologies by people and healthcare systems for health. It covers a wide range of services and products, including medical devices XXXIV , such as those used for remote care delivery, health data and information management, patient management (including therapeutic decision-making) and telemonitoring and diagnosis XXXV . The rollout of digital technologies XXXVI is rapidly changing the way in which health and care services are provided, and the scope of health data processing, which has traditionally been limited to electronic health records systems and other IT systems managed by healthcare systems, is becoming more decentralised and more granular, as online and portable electronic devices become more popular. These technologies increasingly rely on health data generation, access, processing and transmission by patients themselves and their reach extends beyond traditional health systems. This decentralisation has also widened the data domains that are relevant for providing health care XXXVII , including, for example, data generated from digital health products such as wearables or mobile health applications XXXVIII (which can also be medical devices), as well as wellness mobile applications XXXIX and patient recorded outcomes. An overview of user perspectives is available in Figure 1 of Annex 4 on graphical representation of different aspects in the impact assessment. As defined by the GDPR XL , personal health data is highly sensitive for the repercussions its processing potentially has on the health and wellbeing of individuals, and its processing is therefore characterised by specific standards and protocols for interoperability and cybersecurity. The categories of relevant health data are widening and becoming more diverse and decentralised and are collected in different formats and repositories XLI . While GDPR foresee the right to access and portability of data, its practical implementation is hampered by different structures of data, different coding and different standards for sharing data between data sources. Technologically, the decentralisation has brought new challenges for interoperability beyond the interoperability between electronic health records, particularly regarding the interoperability among digital devices and digital health applications. Due to a lack of interoperability, in many cases, healthcare professionals cannot access the complete medical history of the patient and cannot make optimal medical decisions for the treatment and diagnosis of their patients, which adds considerable costs for both health systems and patients. Researchers and innovators cannot have access to sufficiently large amounts of health data that is necessary for breakthroughs in the medical field. Likewise, policy-makers and regulators lack the relevant health data in order to take efficient decisions and ensure the right surveillance of health issues. The picture below describes the challenges in terms of interoperability. According to eHealth Network’s Refined eHealth European Interoperability Framework XLII , for interoperability to be implemented, one should ensure legal interoperability (same rules), organisational (similar policy and care processes), semantic (similar way of codong the information that feeds into the system) and technical interoperability (for applications and IT infrastructure) XLIII . For more details on the interoperability challenges, including the interoperability framework and the state of play in Member States, see Annex 10. 1.21.2 Socio-economic context Digital health products and the use and reuse of health data can enable models of care better suited to people and patients’ needs and preferences, by preventing the onset of disease or earlier treatment. The increased use of digital health solutions during the COVID-19 pandemic allowed healthcare systems to expand their support of patients from various socioeconomic backgrounds who would otherwise not seek or be able to access care during this crisis. The use and reuse of health data influences the quality and efficiency of health services received by individuals in many ways. The availability of health data to healthcare professionals is key for ensuring continuity of care and avoiding duplications and errors, and to policy-makers for proper decision-making, for example, regarding the assessment of new health technologies for pricing and reimbursement. The availability of health data to patients is also fundamental for transparency and better disease management. The use and reuse of health data can inform better clinical decisions, contribute to automation in health and accelerate R&D processes, helping close the current productivity gap both in the provision of healthcare and in the research and development of medical breakthroughs. In order to ensure that the patients can control their health data, for the primary use of health data, one can distinguish three main product markets that can be impacted by the European Health Data Space initiative, as they entail use of data (especially access and portability): electronic health records, medical devices and wellness apps. Telemedicine is also another market (although it often contains a combination of medical devices, electronic health records and communication tools). The market of healthcare providers is also impacted by the proposal, as they need to ensure that data can be shared/made accessible and that the electronic health records, medical devices and other systems are interoperable. The health services sector, representing approximately 10% of the EU’s GDP XLIV and including both public and private providers, is a fundamental ecosystem both for the wellbeing of Europeans and the economy of the EU. Europe’s healthcare systems are under pressure XLV as health costs increase at a faster rate than GDP due to, among others, structural issues such as ageing population and high development costs of new medicines and treatments XLVI . The COVID-19 pandemic exacerbated this issue. The sharing and reusing of health data, particularly combined with automation and digitalisation, would contribute to increased efficiencies. When all relevant health information is available at the point of care, tests no longer need to be duplicated, the administrative burden on healthcare professionals will be lowered when entering or copying health data between systems and medical errors can be reduced. Studies have estimates that up to 20% of spending in health could be wasteful and that, therefore, this waste could be reduced without hampering the performance of healthcare systems XLVII . Digitalisation and interoperability can contribute to reducing this waste by allowing the data to be shared between healthcare providers thus leading to better, more targeted diagnosis, avoiding duplications and additional unnecessary costs. Overall, studies have shown that the increased use of health data and increased interoperability could generate potential savings valued at EUR 4.6 billion per year for health services and 4.3 billion per year for patients XLVIII . The most recent estimates by the OECD suggest that the combined economic benefits of putting data and digital technology to work in the health sector could amount to 8% of the total health expenditure of all OECD countries XLIX . While the investments in digital health contribute to the competitivennes of Member States’ economies and their future growth, allowing the cost savings and increased efficiency of health systems, detailed estimations are not yet systematically available. With regards to electronic health records (EHRs), the introduction of electronic health records for medical coding and billing has eased the process as data entering into computerized systems is more convenient than paper-based methods. The size of the global market in 2020 was estimated at USD 26.9 billion and is expected to grow to US 35 billion by 2028 L . While the market is competitive, some big players, such as Cerner Corporation, Allscripts Healthcare LLC, EPIC Corporation are among the major brands in the market, but smaller players are also active. Many providers tend to provide proprietary solutions, which lead to lock-in effects, although governmental initiatives (e.g. 21 Century Cures Act of the US government) can lead to increased interoperability and data unblocking. For instance, in August 2020, Cerner Corp. collaborated with Amazon to integrate its EHR solutions with the latter’s wearables, such as Amazon Halo. This would provide greater interoperability to its customers and strengthen its service portfolio LI . During the COVID-19 crisis, Electronic Health Records (EHR) vendors and organizations have started to help curbing the pandemic by making telehealth a mainstream alternative, enhancing data access through EHRs, and collaborating to develop Covid-19 dashboards in detail. In terms of regional distribution, North America is expected to dominate the global EHR market owing to rising support for the adoption of health information technology by providers and payers, big giants in the market focusing on improving patients’ clinical outcomes, coupled with increasing government initiatives and programmes for population health management. Asia Pacific seems the fastest growing region in this field, especially thanks to governmental initiatives in China. Europe (including Russia) is estimated to have a share of around 27% of the global market LII , which would mean by extrapolation around EUR 3.85 billion. However, this seems to be a conservative estimate, as shown by the estimates of Member States. Based on information received from experts in Member States, the cost of setting up nationally electronic health record systems ranges between few hundred million euros EUR 1.4 billion for mid-sized and large EU countries, depending on the service coverage. Based on Member States declarations, studies LIII and extrapolations, the value of the EHR market can go up to EUR 16 billion, out of which EUR 3-9 billion need to be set up or further developed. Under the Recovery and Resilience Facility, Member States applied for around EUR 12 billion funding for digital health (out of a total of EUR 720 billion) including for investments in electronic health records. In terms of number of EHR products, Finland has registered around 400 electronic health record systems, including 80 connected to the national system (Kanta) and other digital health products processing electronic health data in its current database of certified products. By extrapolation (considering all EU Member States and that some products can overlap between different countries), one could expect around 4,000-5,000 EHR systems on the EU market, as some producers will provide services in several countries. During the pandemic, faced with the unprecedented need for remote access to care in the context of the imposed social distancing restrictions, the use of digital health, including telemedicine has increased significantly (e.g. reflected in the use of teleconsultations LIV ), thus guaranteeing continuity of care for a large part of the population LV . According to Eurostat, 2% of the population report unmet needs for medical examination and care due to the healthcare service being too expensive or too far to travel. Digital health products and services, including telehealth, are increasingly becoming an intrinsic part of the delivery of care, allowing to reduce some of the inequalities in relation to access and affordability of healthcare. The integration of these digital products and services can positively contribute to improving the cost-effectiveness of healthcare systems, e.g. telemedicine is reported to be cost-effective in 73.3% of the cases covered by the literature LVI . A 2018 market study on telemedicine LVII considered that its market potential was strong and expected to grow in the EU at a compound annual growth rate of 14% in the coming years. Telemedicine is also expected to improve the efficiency of the healthcare systems, including by supporting triage. In fact, OECD estimated that 12% to 56% of emergency department visits are inappropriate LVIII . The COVID crisis has boosted strongly the telemedicine market. In the long run, it is expected that the global market is projected to grow from USD 41.63 in 2019, USD 79.79 billion in 2020 to USD 396.76 billion by 2027 LIX , with North America in the lead, followed by Europe. At the same time, further roll-out of telemedicine requires more mature and interoperable electronic health records and medical devices. The global digital health market, which comprises various software and hardware solutions (which includes medical devices, but not necessarily) used in the processing of health data, has seen a steady increase in terms of size, and was expected to almost double in size, from EUR 16 billion in 2015 to EUR 31 billion in 2020 LX . For example, industry association COCIR estimates that the size of the European market for medical imaging IT technologies is worth EUR 500 million. The European digital health sector is a very important supplier of products and services for healthcare, but before the pandemic it clearly lagged behind the US both in terms of revenue and number of users per capita LXI . A consultancy considered that by using mHealth solutions to their potential, healthcare systems in the EU can save 99 billion EUR in total annual healthcare spend in 2017 after the cost of extra workforce to support mHealth LXII . According to Eurostat LXIII , in 2019, pharmaceutical goods and other medical non-durable goods made up approximately 14% of total health expenditure in the EU LXIV , or almost EUR 195 billion, while therapeutic appliances and other medical durable goods made up 4%, or around EUR 60 billion. According to the yearly analysis of an industry association LXV , the medical devices industry employs 760,000 workers, consists of 33,000 companies (of which 95% are SMEs), and represents almost 8% of healthcare expenditure. The European medical devices market, with a size of EUR 140 billion and growing steadily since 2017, is the second largest market after the US and represents 28% of the world market for medical devices. This sector contributed to the EU’s economy with a EUR 8.7 billion trade surplus in 2020. Digital products that are medical devices are another sector impacted by EHDS in several ways: re-use of data is essential to develop some devices, especially those entailing AI. At the same time, these devices produce data that ideally should be ported to electronic health records if the two are interoperable and be consulted by the patient and the healthcare provider. An industry association listed around 500 000 products in the area of medical devices (including all types of devices, from digital to masks and PPE), but the exact numbers of devices that process patients’ data are difficult to identify. Devices processing patients’ data could include: personal (connected) health devices (including imaging and other diagnostic/monitoring devices in clinical settings, digital and robotic surgery equipment, telehealth and remote care/monitoring systems, glucose meters and insulin pens, pulse oximeters, blood pressure cuffs, thermometers, medical grade weight scales, etc.), cardiac implanted electronic devices, health apps ranging from personal monitoring/coaching to advanced clinical decision support software etc. The central database Eudamed LXVI is being set up and only a limited number of medical devices have been included (59 with software and around 1000 using electricity). A search in medical devices database of Italy revealed around 160 medical devices that process information such as images which, by extrapolation to the whole EU (taing into account the overlap on different markets and increased number of products), can lead to around 5,000-20,000 medical devices processing patients’ data.

Other m-health products that may produce relevant health data are wellness applications (which do not fit within the definition of medical device LXVII ). The size of the market is much bigger than for medical devices. A 2019 study published by the Dutch National Institute for Public Health and the Environment analysed the market of mobile health applications in the Netherlands and found that 21% of sampled applications were a medical device (i.e. a mobile health application according to the definition above), while the rest 79% were not (i.e. a wellness mobile application) LXVIII . With regards to the state of the market, over 71,000 health and fitness apps were launched globally in 2020 (24,000 in the Apple App Store and 47,000 in the Google Play Store) LXIX . According to the IQVIA Institute LXX the volume of health-related mobile applications would have surpassed 350,000 globally in 2021. According to industry analysts LXXI , sales in health and fitness apps in Europe accounted for 30% of global spending in the category, up from a 27% share in 2019. Therefore, there could be approximately 100,000 mobile wellness applications in the European market. The COVID-19 crisis boosted the use of such apps, with Europe as a global lead. European spending in health and fitness category mobile applicationss jumped by 70% year-over-year in 2020 to an estimated USD 544 million as consumers looked to keep fit and stay mindful during the COVID-19 pandemic and regional lockdowns. Downloads of Health & Fitness category apps saw a significant surge in Europe during 2020, rising by approximately 46% year-over-year in 2020 to 829 million LXXII . For the secondary use of health data, the main sectors impacted are research and innovation (including on pharma, medical devices, AI), policy making and regulatory aspects, as well as the data market. The yearly economic value of health data reuse, which can very notably benefit the development and placing in the market of new pharmaceutical products LXXIII , medical devices and other digital health products (e.g. those based on artificial intelligence), is estimated at around EUR 25-30 billion at present, expected to increase to around 50 billion in 10 years LXXIV . According to a recent retrospective analysis LXXV on the use of real-world evidence (RWE) to support marketing authorisation applications to the EMA for new pharmaceutical products and extensions of indications, 40% of initial marketing authorisation applications and 18% of applications for extension of indication for products currently on the market contained RWE (obtained from the re-use of data from electronic health records, registries etc). Another recent analysis LXXVI on the use of RWE during the pre-authorisation phase concluded that dearly all European Public Assessment Reports submitted in 2018-2019 relied on RWE for the discovery (98.2%) and life-cycle management (100.0%) LXXVII . However, the collection and management of RWE remains costly, particularly when it requires processing of personal health data originating from several national jurisdictions and when such data is being collected by obtaining the explicit consent of each data subject. Reducing the costs of accessing the data (fee to data access body as opposed to contacting data subjects and getting the consent) can stimulate new research, innovation and can facilitate the decision making of health authorities and regulators. For more details concerning the differences in costs, see Annex 5 on methodological approach. According to the current evaluation of data markets for the countries that developed mapping and quality evaluation of different data sources, Finland has listed in its data catalogue around 450 data sources/datasets and France, 12. Therefore, extrapolating and considering that not all the countries will have from the beginning the same level of maturity and mapping and evaluation of data sources/datasets, one could have at the level of EU, at the end of 10 years between 3500-5000 data sources mapped and benefiting from a quality label (with some countries having more, others less). Overall, Member States and stakeholders are supportive to the objectives of the EHDS initiative, as gathered in the public consultation and other stakeholder consultations. The most important objectives that respondents said a European framework on the access and exchange of personal health data should aim included: supporting and accelerating research in health (89%); promoting citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format (88%); and facilitating the delivery of healthcare for citizens across borders (83%) (see Annex 2). 1.31.3 Legal context 1.3.11.3.1 Horizontal framework As shown in Annex 6, the EHDS builds upon legislation such as GDPR, Data Governance Act, Data Act and the Cross-border Healthcare Directive, while ensuring compliance with regulatory frameworks in the areas of sybersecurity, pharma and cross-border health threats. Considering that a substantive amount of data to be accessed in EHDS are personal health data relating to individuals in the EU, the instrument must be designed in full compliance with the General Data Protection Regulation (GDPR) LXXVIII , but also with EU Data Protection Regulation LXXIX (EUDPR). The instrument should also take account of the EU’s international trade commitments. The use of data for health and the re-use of health-related data build on the possibilities for processing health data based on EU law, offered by the article 9 of GDPR LXXX for processing special categories of data, including health or genetic data, whereby processing is necessary for: ·healthcare provision (the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services and subject to professional secrecy (Article 9(2)(h)); ·for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices (Article 9(2)(i)); ·scientific or historical research, statistical purposes or archiving in the public interest (Article 9(2)(j)). With regards to processing of data for healthcare (primary use of health data), EHDS is intended to reinforce the control of patients over their health data by establishing clear rules on how the rights of data subjects under chapter III of the GDPR (right to access, portability, information, rectification, erasure, restriction of processing, right to object, with a focus on right to access and port the data) can be implemented in practice. EHDS would task the national digital health authorities with establishing a national framework supporting the implementation of these rights. Such a framework could entail establishing of national patient portal, as well as implementation of requirements that could stengthen the interoperability and allow the data to “flow” between healthcare providers (by certification, using such standards in procurements etc.). In the context of EHDS, the notion of “control” on the part of the individuals concerning the rights remains the same as in Chapter III and IV of GDPR. More specifically, the EHDS aims at further strengthening the right to access and portability of the data subjects to their health data so that they can provide it to the healthcare professionals of their choice rapidly and in an easy, transparent common format. The need to reinforce the right to access in the field of the healthcare services derives from objective difficulties and obstacles, since, for instance, the data may not be available immediately or in an electronic format (for more details, see Annex 12 on the evaluation of the Cross-Border Healthcare Directive). Moreover, this right is difficult to implement in practice in an electronic format if no patient portal exists and if data is stored in electronic health records of healthcare providers which are not readily accessible to patients. A study LXXXI has shown that, while 26 EU/EEA countries generally provide their citizens with access to EHR data by law, 12 countries indicate that their citizens are not entitled to choose which healthcare professional or other party can access their EHR. Most countries specify conditions for alteration and archiving of electronic health data, but only around one third allow patients to correct data entered intheir EHR by themselves. Furthermore, one of the major purposes of the EHDS is to facilitate the transfer of health data, upon request of the data subjects, between the healthcare or social providers of their choice. Article 20 GDPR provides the right to portability for data subjects. However, its fragmented implementation across Member States has shown some serious limitations concerning healthcare, as Article 20 GDPR excludes: a) health data that has not been provided by the data subject or observed (e.g. medical reports etc.), b) data that had been processed based on another legal basis other than consent or contract (which in practice excludessome categories of public entities the majority of which processes personal data on the legal basis of public interest). Consequently, on a practical level, patients may not exercise the right to portability of their health data when for example consulting a new doctor (patients need to ask for the data, bring it often in paper format, and the data may be incomplete) since it could be outside the scope of Article 20 of the GDPR. Moreover, the portability right cannot be implemented technically if there is no interoperability between different healthcare providers and with an electronic health record. If the standards and specifications used for different solutions are proprietary and cannot “talk” to each other, if data are kept in silos then even if the various healthcare providers are willing to fulfil the data subject’s demand in relation to their personal health data it will be challenging to do so in practice. Therefore, the EHDS proposal will also support the technical aspects that are necessary to operationalise some of the GDPR rights, as for instance, the electronic right of access and portability cannot be ensured without the necessary technical elements standards and specifications necessary to ensure interoperability between different data sources, authentication of individuals or setting up the national infrastructure for electronic health records. Whilst consent (Article 6(1)(a) and 9(2)(a) of GDRPR) is one of the main legal bases for health data processing under GDPR, the GDPR also allows the processing of health data under other valid legal basis- ie provision of health or social care, public health, scientific purpose based on Union or national law. Thus, data can be processed as per Articles 9(2)(h), (i) (j) LXXXII of the GDPR, which do not require explicit consent, provided that suitable and specific measures are put in place to safeguard the rights and freedoms of data subjects. Some Member States already use these possibilities under their national law (see Table 1. in section 2.2.).

For secondary use of health data, EHDS would build upon these possibilities offered by GDPR for a specific EU law with particular safeguards. It will develop a European framework, inspired from the actions taken by several Member States that adopted similar national legislation for the secondary use of health data. EHDS, similarly to these national laws, would specify the purposes for which data can be used, as well as limitations LXXXIII in full compliance with the provisions and requirements of the GDPR. Similarly to national framework built upon GDPR, EHDS would ensure that data is processed in a legal, ethical and secure way by setting up a data access body/data permit authority LXXXIV deciding on every request to access to data, alone or in cooperation with other entities LXXXV . EHDS would provide access to a large array of health data (electronic health records, claims, genetic data etc.), but the technical implementation of the cooperation between the data access bodies and the data holders would be left to the national level. The request for data access should provide information about the purpose of processing, ethical evaluation, data protection aspects etc LXXXVI which would allow the data access body to analyse and determine whether the request complies with the relevant data protection principles. In line with data minimisation principles under GDPR, data, by default, may be provided in an anonymised/aggregated way or in a pseudonymised way. In order to ensure security of the data, this can be processed in a virtual secure processing environment where the researcher has the necessary IT tools for data processing, but only the aggregated results can be downloaded. EHDS may foresee that data users can process data based on Union law and applicable data protection principles, provided that they comply with the security standards and data is processed in a secure environment. The proposed system will promote the processing of personal health data while maintaining strong legal and technical security safeguards to the rights of the data subjects as required by GDPR. During the discussions with several Member States which have already set up such data access bodies, it appeared that they have encountered a high demand for such service and are currently facing long delays to satisfy all the requests. The EHDS would build upon the horizontal framework on data access and reuse, including the proposal for a Data Governance Act (DGA) LXXXVII adopted on 25 November 2020 (political agreement in November 2021) and the proposal for a Data Act LXXXVIII , to complement it and provide more specific rules for the health sector. These specific rules would cover standards and specifications for providers of data intermediation services in the health sector, minimum technical requirements for the portability of health data, criteria for security of data for bodies dealing with data altruism). When providing a framework for data reuse in health, EHDS will build upon the DGA. As a horizontal framework, the DGA cannot address the specificities of sensitive data, such as health or genetic data. The DGA alone does not provide an adequate solution to the current uncoordinated patchwork of national laws arising from the fragmented implementation of the GDPR in the health domain. DGA does not provide a legal base for re-use of sensitive catagories of data, such as health data, whose processing is in principle prohibited, save exceptions listed in article 9(2) of GDPR (including an EU law providing the adequate safeguards). Furthermore, DGA does not impose any obligation to create “data access bodies” which could be empowered to grant access to health data. However, the technical framework set up under DGA (e.g. secure environments) could be used by the data access bodies under EHDS. As concerns data sharing intermediaries and data altruism organisations, the DGA provides for rules which apply regardless of the concerned sectors. However, specific rules are needed for example on security in order to take into account the specificities of personal health data, already outlined in section 1.1. In addition, the DGA regulates data sharing intermediaries mainly from a competition point of view (neutrality of marketplaces for data) and does not lay down rules mitigating specific risks of primary and secondary use of health data, including on technical formats for interoperability. For these reasons, with the EHDS, it should be possible to consolidate the requirements and technical framework needed to achieve a functioning system in the field of primary and secondary use of health data complementing the DGA rules with more detailed or more practical rules considering the specific nature of health data. With regards to Data Act proposal, EHDS would build on provisions related to portability and access of data linked to devices (medical devices and wellness apps). The Data Act may set a general portability rule for data from such devices, irrespective whether health related or not. For health data, EHDS would extend to electronic health records and medical devices feeding data to EHRs. It would build upon the Data Act and establish the standards and specifications for portability and interoperability, thus making the portability and access technically and practically possible. With regard to the use of data from entreprises (especially commercial data) by public sector bodies in exceptional circumstances, EHDS would build upon Data Act, by providing a secure framework for processing health data through data access bodies. At the same time, unlike the DA, EHDS would ensure that data held by both public and private healthcare providers can be made available through EHDS. The aim of establishing the EHDS is also to aid all the parties involved in Artificial Intelligence (AI) in healthcare to carry out their tasks and fulfil their legal obligations under the proposal for a regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act (AIA)) LXXXIX . The AI Act provides the framework and rules that providers of some type of AI algorithms need to comply with. EHDS can support the providers with the provision of quality health data necessary for these algorithms to perform as intended and be compliant with AIA. Health data play a key role in the training, validation, testing and post-market monitoring of AI in healthcare. The training and use of AI algorithms in health needs to take place in a way that is ethical; discrimination and other adverse effects need to be avoided. The aim of establishing the EHDS is to also aid providers and users of AI as well as notified bodies and market surveillance authorities to carry out their tasks and effectively and efficiently fulfil their legal obligations under the AIA. The possibility to access diverse and a large amount of organized data within the EHDS infrastructure that provide transparency and information concerning the characteristics of these data would lead to the speedy development, upscale and uptake of trustworthy AI in healthcare. For instance, health data within the EHDS could share common standards and/or follow common rules and guidelines on issues like annotation, labelling, prevention of bias and avoidance of errors. Additionally, information might be provided on the characteristics of data within the EHDS infrastructure that would enable the developer of AI systems to use appropriate data to train, test and validate algorithms that reflect the geographical, behavioural or functional setting within which the AI system is intended to be used. In this regard, Health Data Access Bodies and/or national bodies might be involved to develop and oversee common rules. The Directive on Security of Network and Information Systems (the NIS Directive, 2016/1148/EU) set the first EU-wide rules on cybersecurity. The objective of the Directive is to achieve a high common level of security of network and information systems within the EU and covers operators working in the healthcare sector. By promoting the use of compulsory common security standards and of the integration of electronic identification (eID) for healthcare professionals and patients, the EHDS initiative reinforce and complement the principles and security measures set out in the aforementioned cybersecurity regulatory framework. It is designed to enhance the security and trust in the technical framework designed to facilitate the exchange of health data both for primary and secondary use. The initiative would build on the new framework for eID, including the Digital eID Wallet. This would allow the online identification of patients. A pilot project has been launched in 2021 and aims to support the access of patients to their data, including in the context of MyHealth@EU. The NIS Directive is being revised (NIS2 proposal XC ) and is currently undergoing negotiations with the co-legislators. It aims to raise the EU common level of ambition of the cybersecurity regulatory framework, through a wider scope, clearer rules and stronger supervision tools. The Commission proposal addresses these issues across three pillars: (1) Member State capabilities; (2) risk management; (3) cooperation and information exchange. Operators in the healthcare system remain under the scope. A proposal for a Cyber Resilience Act is also planned for adoption by the Commission in 2022, with the aim to set out horizontal cybersecurity requirements for digital products and ancillary services. The envisaged set of essential cybersecurity requirements to be laid down by the Cyber Resilience Act will be applied to all sectors and categories of digital products whose producers and vendors shall comply with, before placing the products on the market or, as applicable, when putting them into service and also through the entire product lifecycle. These requirements will be of general nature and technology neutral. Although the horizontal initiatives affect some common issues that may be encountered in the health data sector, they often lack dedicated provisions addressing the specificities and peculiarities of the health data sector. The common provisions like those encountered in, for instance, the proposal for a Data Act, may in practice negatively impact on different sectors if no sectoral exclusions are allowed (e.g. an obligation for compensation in case of B2B data sharing could hamper the interoperability of medical devices and healthcare providers). If these proposals have provisions on health data, such as the GDPR, they do not always provide the necessary elements to translate these provisions into the expected operational practices or may only respond to some of the sectoral needs. For instance, access to health data is not immediate; the portability article excludes inferred data, such as tests or diagnoses, of data from some public healthcare providers; moreover, the portability right may be limited by the lack of interoperability between healthcare providers or cross-border. 1.3.21.3.2 Sectoral legislation The current relevant applicable EU legal framework for the cross-border exchange of health data is laid down in the CBHC Directive. The EU supports and facilitates voluntary cooperation and the exchange of information among Member States working within a voluntary network connecting national authorities responsible for eHealth in the Member States (the ‘eHealth Network’), as well as other tasks related to patients access to data, telemedicine, interoperability of prescriptions. The EHDS proposal will repeal the relevant provisions of the CBHC Directive and replace the current article 14 (limited to governance) with completely new set of binding rules on data use and re-use. An evaluation of the key provisions related to digital health in the CBHC Directive (Article 14 and the articles related to patients’ access to their data, telemedicine, interoperability of prescriptions), as well as the national implementation of the European Electronic Health Record Exchange Format and the role of eHealth Network in this respect has been carried. The current voluntary system to support patients’ access and sharing of health data, to deal with fragmentation and low interoperability of digital health at national and cross-border level has limited effectiveness XCI . The eHealth Network, with its voluntary structure and a decision making based on guidelines, has had a limited impact on supporting individual’s access to and control over their health data (including through the uptake and interoperability of digital health across the EU). The eHealth Network was very ineffective in supporting the re-use of health data for research and policy-making (also because its members often do not have tasks in this area at national level). On the other hand, during the COVID-19 crisis, the eHealth Network set up in a very short time two EU-wide interoperable infrastructures (the European Federation Gateway Services and the gateway for the EU Digital COVID Certificates), also supported in one case by a strong and harmonising legal basis (a regulation for EU Digital COVID Certificates XCII ). The medical device regulatory framework is composed of the medical devices Regulation (2017/745/EU) and the in vitro diagnostic medical devices Regulation (2017/746/EU). These regulations include provisions related to the assessment and marketing authorisation of medical devices in the Union. While the CE marking of medical devices comprise some elements related to security and interoperability of the device and its platform, it does not entail elements related to the interoperability of medical devices with electronic health records, which is a fundamental aspect for data portability. EHDS aims to tackle this, including by specific mandatory standards and specifications and a certification process for those devices that process data which is core for electronic health records. Pharmaceutical regulatory framework The EU legal framework for human medicines sets standards to ensure a high level of public health protection and the quality, safety and efficacy of authorised medicines. Additionally, EU legislation provides for common rules for the conduct of clinical trials in the EU XCIII . Various rules have also been adopted to address the particularities of certain types of medicinal products and promote research in specific areas XCIV . The EHDS initiative complements the aims and scopes of the aforementioned Regulations and Directives by providing access to a wide range of health data that could be useful for regulatory purposes and enhance and streamline the collection of the necessary health data required to assess and supervise the introduction and surveillance of pharmaceutical products and devices in the Union. The set-up of the EHDS would be an integral part of building a European Health Union, a process launched by the adoption of a first set of proposals to reinforce preparedness and response during health crisis XCV , which pave the way for the participation of the European Medicines Agency (EMA) and the European Centre for Disease Prevention and Control (ECDC) in the future EHDS infrastructure, along with research institutes, public health bodies, and Health Data Access Bodies in the Member States. The EHDS infrastructure for secondary use of health data could also support the activities of European Health Emergency preparedness and Response Authority (HERA) XCVI and “Europe’s Beating Cancer Plan” XCVII and Horizon Europe EU Mission on Cancer. XCVIII . The EHDS proposal will ensure coherence with other sectoral regulatory frameworks. It will address the peculiarities and specific legal and securities issues related to the processing of health data both for primary and secondary use.

22 Problem definition Figure 6 shows the link between the problems identified, their drivers and consequences. The evaluation of the existing framework under the CBHC Directive was used as a starting point for the identification of the problems and drivers. 2.12.1 Lessons learnt from the evaluation of Article 14 of the Cross Border Health Care Directive (CBHC) Directive The evalution of the Cross Border Healthcare Directive’s provisions related to eHealth concluded that due to the voluntary nature of the eHealth Network actions its effectiveness and efficiency has been rather limited. Progress is slow on the use of health data for primary purpose in the context of cross-border healthcare with the MyHealth@EU platform being implemented only in 9 Member States and currently supporting two services only (ePrescriptions and Patient Summaries). The low and slow uptake is partly related to the fact that the Directive, whilst establishing the right of patients to receive a written record of the treatment carried out, does not require this medical record to be provided in electronic form. Patients’ access to their health data remains burdensome, citizens’ control over their own personal health data and the use of data for medical diagnosis and treatment is limited. While the eHealth Network recommended Member States to use the standards and specifications from Electronic Health Record Exchange Format in procurements, in order to build interoperability, their real uptake was limited, resulting in fragmented landscape and uneven access to and portability of health data. Most Member States are expected to implement the MyHealth@EU platform by 2025. Only when more Member States will implement the MyHealth@EU platform and the developed tools, their use, development, and maintenance will become more efficient across the EU. However, advancements in eHealth in recent years call for a more coordinated action at EU level. Nevertheless, following the outbreak of the COVID-19 pandemic in Europe, the eHealth Network proved to be very effective and efficient in times of public health crisis and political convergence following the COVID-19 pandemic outbreak. On secondary use of health data, the eHealth Network activities were very limited and not very effective. The few non-binding documents on big data were not followed up by further specific actions and their implementation in practice remains very limited. At national level, other actors emerged on secondary use of health data than the ones represented in the eHealth Network. Some Member States set up different bodies to deal with the subject and participated in the Joint Action TEHDaS. However, neither the Joint Action TEHDaS, nor the numerous funds provided by the Commission under e.g. Horizon Europe to support the secondary use of health data have sufficiently been realized in coherence with eHN activities. It can therefore be concluded that the current structure of the eHealth Network does not appear to be appropriate anymore, as it only allows for soft cooperation on primary use of data and interoperability, which did not solve in a systematic manner the problems of access and portability of data at national and cross-border level. Moreover, the eHealth Network is not able to address in particular the needs related to the secondary use of health data in an effective and efficient manner. The legal base for the use of health data for primary and secondary use is not sufficiently strong. The COVID-19 pandemic has highlighted and emphasised the importance of access to and availability of public health and healthcare data beyond the Member States borders. However, progress on these issues seems to be hindered by the absence of binding or compulsory standards across the EU and consequently limited interoperability. Addressing this issue would not just benefit the patients, but also contribute to the achievement of the Digital Single Market and lowering the barriers to the free movement of digital healthcare products and services. 2.22.2 What are the problems? As explained above, due to the voluntary measures, the current regulatory framework has shown a limited effectiveness in supporting patients’ control over their health data at national and cross-border level and very low effectiveness on secondary uses of health data. However, the COVID-19 crisis has revealed the need and the high potential for interoperability and harmonisation, building upon existing technical expertise at national level. The figure on Overview of problems in Annex 4 shows the key problems that were identified. Individuals have difficulties to exercise their right to control their health data, including accessing and porting their data nationally and cross-borders, because of fragmented tools and infrastructures and limited interoperability between them. This hampers their access to health services and cause healthcare system ineffectiveness (reduced continuity of care) and inefficiencies (waste and administrative burden). It can result in medical errors, unnecessary repeated tests XCIX and substantial inefficiencies and costs for patients, healthcare professionals and healthcare systems C . The problem exists both at the EU, but also at the Member States level, despite the legal provisions of GDPR in this respect. The way the GDPR has been implemented is rather fragmented and made difficult the access and sharing of health data, as shown by the table below. As described in the section 1.3, data may not be available immediately and in electronic format and the portability right does not cover all the needs of the health sector (e.g. portability of images, laboratory results, which are not provided by the data subject, data processed on other legal basis than consent or contract or data from some public entities). The Annex 8 concerning the way the GDPR has been implemented in health sector shows the high legal fragmentation, which makes difficult to harmonise the framework both cross-border and between different healthcare providers at national level. At the same time, without the technical elements aimed to ensure interoperability, these rights are not effectively implemented. A recent study on interoperability of EHRs CI shows that access to health information for citizens has been facilitated nationwide in seventeen EU/EEA countries, while six countries have ongoing pilot projects, three countries do not offer access to health data for patients, four countries offer mobile access, and two countries still use paper print-outs. In addition, citizens of 12 countries are not entitled to choose which healthcare professional or other party can access their EHR (often, general practitioners act as 'data gatekeepers', allowing additional parties to access a patient's EHR, while in other countries, this is not possible technically). The study also shows that 18 Member States allow the exchange of health data across borders and that almost half of the Member States have devolved powers in digital health to decentralised governments, often further exacerbating the current fragmentation and patchwork of incompatible health data exchange formats and networks. Three Member States do not have rules in place for the identification and authentication of healthcare professionals. Patient Summaries and ePresription exists in two-thirds of the Member States. When it comes to connecting healthcare providers to the national EHRs, general practitioners are largely connected in 20 Member States, pharmacies are connected in 19 Member States and labs are connected in 20 Member States. Several Member States score weak on the connection of different healthcare providers to the national EHR system. With regards to cross-border data sharing, as part of the evaluation of the CBHC Directive, the volume of patient mobility was studied. The aggregated reported data on the number of requests for reimbursement shows that patient mobility under the Directive remains generally very low. When looking at the total expenditure on cross border healthcare, in those countries that were able to provide information about the amount reimbursed for healthcare subject and/or not subject to prior authorisation in 2019, the total healthcare spending amounted to EUR 882 billion. The share of the amount reimbursed under the Directive on the total government expenditure on healthcare amounted to 0.01% (EUR 92.1 million/EUR 882 billion). Cross-border healthcare in general remains very limited, and most of the healthcare spending occurs domestically. However, it should be noted that the demand for certain cross-border health services for which interoperability is highly relevant is growing rapidly. For example, the assessment of the cross-border prescriptions use case has provided indicative evidence of an estimated increase of approximately 300% for foreign prescriptions presented to pharmacists in the EU between 2012 and 2021 (from 1.46 foreign prescriptions per pharmacy per month in 2012 to 5.87 in 2021). When travelling or moving to another EU country, few citizens can currently share their health data with foreign healthcare providers in a language understandable to the health professional, which can lead to wrong diagnosis or treatments and impact on free movement. The overall number of cross-border transactions so far remains low compared to potential demand: over 200 million Europeans have a European Health Insurance Card and 4% of employees are nationals of another Member State CII which could benefit from cross-border provision of healthcare. Patient summaries and e-prescription services exist in two-thirds of all Member States and are most frequently accessed via online portal, but only in few countries can have them be sent or received across borders and 11 countries are still using paper printouts for prescriptions CIII . Through MyHealth@EU CIV , 10 out of 27 Member States allow their patients to share their patient summaries and ePrescriptions with healthcare providers in other Member States, in the language of the country of destination. Since 2019 over 21,000 ePrescriptions have been dispensed and over 300 patient summaries have been accessed in other countries and other languages than the country of the origin of the patient. The number of ePrescriptions dispensed remains far from the target number of up to 8 million prescriptions issued in another Member State than the Member State where the patient tries to have them dispensed CV . In an online stakeholder survey, a broad majority of consulted respondents (>80%) agree that lack of practical data portability driven by strong rules on interoperability drives healthcare costs up through repeated testing and examination, slows down time to diagnosis and treatment and increases the risk of errors CVI . Access and sharing of data are important for stakeholders, particularly the right to access one's health data in electronic format, including those stored by healthcare providers (88%), right to transmit one's health data in electronic format to another professional/entity of one's choice (84%), the right to request healthcare providers to transmit one's health data in one's electronic health record (83%), and the right to request public healthcare providers to share electronically one's health data with other healthcare providers/entities of one's choice (82%). 80% of EU citizens consider that a European framework on the access and exchange of personal health data should aim at facilitating the delivery of healthcare for citizens at national level and 84% abroad. 85% of EU citizens that participated in the public consultation believe that a European framework on the access and exchange of personal health data should aim at promoting citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format. More details concerning the opinion of different stakeholder group can be found in Annex 2. Due to different standards and limited interoperability, manufacturers of digital health services and products face barriers and additional costs when entering the markets of other Member States, hampering their competitiveness. The digitalisation of health systems is limited and often the health IT solutions, whether they are health apps, medical device software, EHR systems or other health software, are not interoperable amongst each other, causing lock-in situations and inefficiencies in the provision of health and in the reuse of health data. The Commission has adopted the Recommendation on European Electronic Health Record Exchange Format (EEHRxF) CVII and the eHealth Network recommended CVIII all the national and EU procurers to require EEHRxF standards and specifications to ensure national and cross-country interoperability. However, the implementation of these recommendations remains uneven is: four Member States do not have a fully functioning EHR system, six show an overall low level of use across all EHR data types, whilst only four have a very high level of use CIX . The voluntary recommendations on the EEHRxF have had little effect in promoting interoperability amongst health software solutions CX . Annex 10 provide an overview of the interoperability challenges and the opinions concerning the EEHRxF Recommendation.

The ePrescriptions, another information domain in the Recommendation also shows a mixed picture: in only half of EU Member States, the pharmacy sector in Europe is almost completely connected to national EHR systems and service-related data is being exchanged between pharmacies and EHRs. Five countries do not have an ePrescription system in place. At the same time, the limited use of ePrescriptions come with costs, as ePrescribing reduces medication errors. According to the Estonian Health Information Fund, 80,000 patients (6% of the total) could benefit from error reduction thanks to ePrescribing, while errors in prescription were down by 15% in Sweden CXI . ePrescribing systems can also provide useful data on patients’ adherence to prescribed medications CXII . When it comes to coding and structuring data, in most countries, the amount of clearly structured electronic health data is low and most of them do not maintain any programmes to train healthcare staff or to audit data quality CXIII . Moreover, only half of EU countries implement measures and perform mapping activities to international standards (including those in the EEHRxF Recommendation) to enable interoperability with digital health systems in other countries CXIV . Nine out of 27 Member States and Norway indicate to not refer to EU-level guidelines and documents on the patient summary and ePrescription/eDispensation in national policy documents and 19 do not refer to these resources in legislation documents. Although almost two thirds of EU countries have enacted compulsory technological standards, only half of national digital health authorities promote the use of the EU tools and building blocks of the MyHealth@EU CXV . While the cooperation at EU level has focused mostly on interoperability of EHRs, some countries have started to implement legislative frameworks on assessment, reimbursement schemes, labelling and certification for the adoption of digital health, such as DiGA framework in Germany CXVI , the mHealth pyramid in Belgium CXVII , ANS eHealth label and HAS mHealth in France, or MAST CIMT in Denmark CXVIII (a more comprehensive overview is available in Annex 7). Some of these systems, such as DiGA take medical devices, analyse them from the perspective of interoperability with electronic health records and impact on health and propose them for prescription or reimbursement by healthcare providers. A similar system is being implemented by Belgium CXIX . France is also working on a law for a similar system. The United States also analyses the interoperability of medical devices with the hospital environment, but also with the electronic health records CXX . This analys is often done by digital health bodies (not notified bodies). However, this approach remains limited, and many Member States requested a mutual recognition of such products. The first technical specification on a quality label for health and wellness apps was published by ISO, CEN and IEC in 2021 CXXI . Although the volume of applications approved for prescription is currently very low, e.g. with only 24 mobile health applications approved for a population with statutory health insurance of over 70 million CXXII , as long as these approaches continue to be implemented without a common framework, there is an increasing risk of fragmentation within the EU. This adversely affects companies wishing to operate across the European digital single market, as their cross-border operations are hindered by differing digital structures, differing data formats and incompatible infrastructures. This is in line with the views of industry representatives who indicate that the European market is fragmented, with significant barriers for operation in more than one country CXXIII CXXIV . Individuals cannot benefit from innovative treatments and policy-makers cannot react effectively to health crises, due to barriers impeding researchers, innovators, policy-makers and regulators to access health data. The evaluation of the digital aspects of the CBHC Directive shows a very low effectiveness of the eHealth Network in dealing with secondary use of health data, while new entities (such as Health Data Access Bodies) have started to emerge in several Member States. Divergent rules and frameworks, prevent data holders from facilitating reuse of health data CXXV . The over-reliance on consent (which can be difficult CXXVI and costly to obtain) and a lack of specific Member State law has increased the costs for research. The wide variety of GDPR legal bases applied by different data holders in different Member States has made cross-country studies very difficult, as data re-users must comply with different requirements in each jurisdiction CXXVII CXXVIII . As indicated by experts consulted on pharmaceutical regulatory frameworks, currently, studies which inform regulatory decisions are often performed in a small set of databases clustered in a few EU Member States, limiting geographical and demographic representability. To overcome this fragmentation and the reliance on consent, some Member States started to adopt national law for processing health data for public interest, scientific research and policy making. For instance, 13 Member States have started to put forward more centralised national systems to provide access to data, but there is no link between them at EU level, the system remains fragmented and there ae differeencies between their tasks, even though they share many commonalities. Some Member States support access to data held by the original controller, others act as a Health Data Access Body. The best-known Health Data Access Bodies are Findata, French Data Hub, German Forschungsdatenzentren, Danish and Norwegian Health Data Access Bodies CXXIX (details about the state of play are available in Annex 9). During the public consultation, several barriers were identified by both the Member States and stakeholders, which include the divergencies in national legal frameworks and practices, which have repercussions on standards adopted and interoperability, as well the different national healthcare systems across Member States. Some Member States mentioned that one of the main issues was the sensitivity of the data which may make it difficult to transfer across countries on an individual level. This is aggravated by different data anonymization procedures across institutes and countries, as well as varying interpretations of GDPR. Other Memebr States stated that the different legal grounds for data sharing across Member States may require the researchers to travel across borders if the data must stay within a country. Furthermore, it was noted that data is currently not organized in one data centre base as various data sources are not linked in a structured way. Some decentralised countries underlined that most data collections for secondary use happen at the local level. Therefore, considerable collaboration between the public and private spheres would be needed. Several Member States underlined the need to ensure adequate financial resources. Moreover, interoperability issues could arise as some countries do not have plans to even introduce patient summaries. Some Member States also admit having difficulties with the legislation allowing for data sharing within the country, which would only be exacerbated at international level. Exists at national level 13 BG, DK, DE, IE, GR, FR, CY, MT, NL, PT, SI, SK, FI, [UK] Public sector entity 13 BG, DK, DE, IE, GR, FR, CY, MT, NL, PT, SI, SK, FI Hosts data 8 FR, BG, DK, DE, GR, NL, FI, SK, [UK] Provides access to data stored with the original data controller 2 RO, FI, [UK] Type of data to which access is provided Primary care electronic health records 5 DE, MT, NL, PT, SI Hospital electronic health records 7 DK, DE, FR, MT, NL, PT, SI Social or long-term care 4 DK, DE, NL, SI Health insurance claims data 5 DK, DE, GR FR, NL Prescribing and dispensation records 7 DK, DE, GR, FR, NL, PT, SI Disease registries 7 BG, DK, GR, MT, NL, PT, SI Bio banks 1 DK Genomic data bases 1 DK Linked health, social and environmental data 6 BG, DK, DE, MT, NL, SI Other 3 IE, CY, FI Available for research for health system monitoring, manage-ment and evaluation by a public sector entity (Function 2) 12 BG, DK, DE, IE, GR, FR, CY, MT, NL, PT, SI, FI, [UK] Available for research for medi- cines and device monitoring and evaluation (including pharmaco-vigilance) by public sector organisations (including regulators) (Function 2) 10 BG, DK, DE, IE, FR, CY, MT, NL, SI, FI, [UK] Available for scientific research by not-for-profit and academic organisations (Function 3) 12 BG, DK, DE, IE, GR, FR, CY, MT, NL, PT, SI, FI, [UK] Available for scientific research by commercial scientific organisations (including pharmaceutical and medical technology industry) (Function 3) 10 BG, DK, DE, FR, CY, MT, NL, PT, SI, FI, [UK] Possible under the same conditions as for public entities 5 BG, FR, MT, NL, FI Possible under different conditions 3 DK, DE, SI Available for scientific research by any commercial organisation (Function 3) 4 BG, DE, SI, FI Available for data requests from researchers in other EU MSM 5 DK, DE, FR, NL, FI, [UK] Charges access fees No 5 GR, FR, CY, MT, PT Yes 6 BG, DK, DE, NL, SI, FI Same fee for all 4 BG, DK, NL, FI Differentiated fees 2 DE, SI According to a report by Deloitte CXXXI , productivity of research and development in the biopharmaceutical sector has steadily decreased over the last decade, while the cost of bringing of a new product to market has significantly increased CXXXII . If this trend persists, the industry will see less and less incentives to invest in the risky and costly search for health innovations, limiting their future ability to provide innovative health products to tackle current and emerging health needs. Similarly, the health data reuse ecosystem is characterised by fragmented infrastructures CXXXIII , structured around health-specific subdomains and limited interoperability. The lack of re-use of health data also poses problems for the work of regulators, which rely on Real World Evidence to check for the effectiveness of medicines. This can also stifle innovation and the development of new medicine, which in turn affects patients. Data quality issues play an important role as the data collected must fulfil certain uniform standards to be fit for purpose. The various degrees of data quality and availability across Member States and health subdomains also impacts on the ability to develop and evaluate AI algorithms, as health data that is comparable and representative of the EU’s population becomes difficult to obtain. 2.32.3 What are the problem drivers? There are fragmented and limited tools for timely access to health data in electronic format and their digital transmission causing cumbersome problems for individuals to access and control their own health data, including in the cross-border setting. Not all the Member States have set up EHR systems and not all of them are interoperable between healthcare providers or with different data sources (e.g. mHealth, telehealth) CXXXIV CXXXV . In a third of EU countries, digital health policy is not integrated into general healthcare policy CXXXVI . Divergent regulations at Member State level CXXXVII do not enable sustainable data-sharing amongst stakeholders and exercising portability of health data, both nationally and in the cross-border context. While the 'right to access one's health data in electronic format, including those stored by healthcare providers (public or private)' was deemed by 88% of the respondents in the public consulation as the most important right, evidence CXXXVIII shows that, while legislation in almost all (93%) Member States enables the electronic storage of health data, support for the access to and sharing of health related data is missing from legislation in almost one third of Member States. In 43% of Member States, legislation and national rules do not allow citizens to choose whom to provide access with to their health data. In 57% of Member States, less than half of Patient Summaries are consulted by a health professional in another medical institution. Imaging reports are predominantly exchanged non-electronically CXXXIX . At cross-border level, half of the EU population has a European Health Insurance Card and could potentially benefit from healthcare abroad, only 7 Member States (less than 10% of EU population) are able to share or consult patient summaries from another Member State through MyHealth@EU, and medical images are not exchanged yet. Preliminary results in the context of the evaluation of the CBHC Directive indicate that almost 8 million cross-border prescriptions are presented for dispensation per year in EU, with a non-dispensation rate CXL of 46% CXLI , which could generate up to EUR 240 million in unnecessary costs yearly CXLII .Verification and language issues and missing information are the key problem drivers for non-dispensation. These could be solved by the full rollout of cross-border services in MyHealth@EU CXLIII . Limited legal and technical interoperability, including in relation to cybersecurity and data protection aspects, across Member States are barriers for providers of digital health services and products when entering the markets of other Member States. As shown above and in Annex 10, there is low and fragmented implementation of common standards and specifications at national and especially EU level. Many healthcare providers implement un-interoperable/locked in IT systems, which would require significant investment to be upgraded and contribute to perpetuate the lack of interoperability. Over the past 10 years, European cooperation has focused on data domains and interoperability of EHRs. However, with the deployment of other digital health technologies (such as wearable and mobile), Member States have started to develop separate national schemes to support uptake according to national needs, but without a common EU framework for assessing interoperability and cybersecurity, which are fundamental for the secure flow of health data in the single market. This is caused, at least partly, by the fact that by a lack of specific mandate of the EU and the eHealth Network in this area CXLIV . EIT Health analysed several use cases in digital health and concluded that a consolidated European assessment framework for digital health solutions could easy the route to market for small companies CXLV . The Data Act proposal will provide a general obligation to make data accesible and portable for the user of product or related services. But it is limited to tangible item and may not cover purely software or service-based health systems, such as electronic health records. Moreover, it will not impose specific standards and specifications that EHDS would come forward for the health sector. Fragmented and divergent legal and administrative rules, frameworks, processes, standards and infrastructures for health data reuse restrict the access of researchers and innovators to health data, limiting the availability for individuals of innovative health products and services based on health data use and reuse, and reduce the access of policy-makers and regulators to health data for their tasks and to react to health crises, hampering optimal decision-making and particularly effective crisis management. 89% of respondents to the public consultation from all stakeholder groups completely agree that the European framework on access and exchange of personal health data should support and accelerate health research. Annex 10 shows the current fragmentation, at Member State level, of the legal basis available to researchers for the reuse of health data initially collected for healthcare purposes. Almost half of the Member States do not have any specific legislation for such reuse and rely on the provisions of the GDPR. Other Member States provide a legal basis based on public interest outside the traditional requirement of consent and rely on an independent public body for this (i.e. a Health Data Access Body CXLVI ). Not all the Member States have a Data Access Body, but where such a body exists, the demand is very high (the Finnish Health Data Access Body, Findata, has an average queueing time for data permits of around 7-9 months CXLVII , while the Danish counterpart has an average processing time of over 100 working days). There is also a need for cross-country cooperation between existing data access bodies. Data quality issues, such as lack of accurate metadata, divergent data collection procedures or unstructured data, pose a key challenge for extensive data-sharing, use and reuse in health. Most health data is unstructured CXLVIII , often fragmented, which becomes a barrier for the use and reuse of health data due to low technical and semantic interoperability CXLIX CL CLI . These challenges have become even more apparent during the COVID-19 pandemic, as researchers, innovators and policy-makers have struggled to gain access to comparable health datasets in a timely manner CLII . 2.42.4 How will the problem evolve? Several problems will persist if no EU action is taken. The cross-border exchange of health data will remain limited, the expansion of MyHealth@EU will progress at a slow pace on a voluntary basis only and the barriers to a single digital health market will equally persist. With a slower uptake of digital health, patients will continue to experience disruption to continuity of care and healthcare providers will continue to struggle with accessing medical information timely in the provision of care, causing inefficiencies and ineffective healthcare and avoidable medical errors. Health software providers and researchers too will struggle to provide services that serve the interests of people and healthcare providers. Health software solutions will not sufficiently take into account the needs and preferences of end users, which will impede uptake from and value for the latter. Given the lack of adequate incentives for interoperability and health data exchanges, the digital health market will continue to cope with vendor lock-in situations, as there will be no common interoperability requirements facilitating provider changes and market entry. Such a situation will favour incumbents and prevent a level playing field. If the single digital health market is insufficiently supported, the uptake of digital health innovations will be slower and more expensive. Producers of digital health services will not market their products in other Member States or will incur additional costs stemming from the adaptation to the national standards. Policy makers will have insufficient access to evidence to support their regulatory activities. Citizens will continue to have limited digital access to and control over their health data in digital format, which will limit their empowerment and may weaken their trust in health technology. The limited reuse of health data for research, innovation, policy-making and regulatory purposes would hamper the introduction of more efficient and effective healthcare and public health policy. With insufficient action taken, there will be untapped potential of digital health services and products for people and healthcare systems. Potential benefits for patients, through greater availability of health innovations, would not materialise. For example, telemonitoring can facilitate access to healthcare in medical deserts CLIII , and AI-based medical decision support systems can facilitate diagnosis and treatment, but both require extensive research and development based on health data and proper interoperability with healthcare IT systems. Lack of trust of the public in health technology tools would frustrate the potential benefits for health. In the case of a new pandemic, Europe will continue to struggle to provide data for policy making, regulatory purposes and support scientific research, statistics and innovation for the general interest. 33 Why should the EU act? 3.13.1 Legal basis The possible legal bases for the proposed initiative are Articles 16 (personal data protection) and 114 (internal market) of the Treaty on the Functioning of the European Union (TFEU). The initiative will build on the possibilities offered by articles 9(2)(h), 9(2)(i) and 9(2)(j) of GDPR to use the data for healthcare and re-use it for public interest and for scientific research. Therefore, the initiative has two purposes: to further strengthen the rights of individuals in relation to control of their personal health data, building upon the rights already provided by the GDPR; to promote the exchange of health data for healthcare provision, to facilitating access to health and relevant social data for further processing for research, innovation, policy-making and regulatory decision. Health data are particularly sensitive data and their treatment is already strictly regulated by GDPR, which stipulated that national or EU law making use of e.g. Articles 9(2)(i) and 9(2)(j) must lay down suitable and specific safeguards The GDPR provides important safeguards in relation to rights of individuals over their health data (even though some additional requirements are needed for health sector CLIV ). However, as outlined in section 1, in practice, in the field of health data, limited harmonisation of requirements and technical standards implemented at national and EU level do not allow to implement these provisions in practice for every individual. Therefore, there is a need to introduce additional legally binding provisions and safeguards, as well as design specific requirements and standards in order to fully implement the rights provided in the GDPR in the field of the processing of health data and take advantage of the value of health data for the public interest. Hence, to the extent that Article 16 TFEU prescribes the purposes of both the protection of personal data and the free movement of such data, it is deduced that Article 16 TFEU is a relevant legal basis for the proposed initiative.

Digitalisation and data are transforming the way of healthcare is provided, in many cases offering an alternative to traditional physical interactions, which has a particularly beneficial impact for remote and rural areas. However, the growing diversity of national laws, regulations and administrative actions lead to obstacles to the free movement of data, which has a substantial impact on the free movement of digital technologies in healthcare that contact such data (including AI systems), the free movement of persons, as well as creating distortions to competition. Some Member States, for example, have already developed often different national or regional rules for the standards related to development and recognition of new digital health services and products, but others have not. This will likely lead to a further fragmentation of the internal market, as providers of these digital health products and services will need to adapt to these different rules when marketing and competing on digital health products and services. The obstacles to free movement and distortions of competition have a detrimental impact on the functioning of the internal market. EU action on the basis of Article 114 of the TFEU can be taken for the purposes of the approximation of the provisions laid down by law, regulations or administrative actions in the Member States when it has as its object the establishment and functioning of the internal market. The measures assessed in this impact assessment for creation of an EHDS aim to improve the conditions for the establishment and functioning of the internal market for digital health and data and actually contribute to eliminating the obstacles to the free movement of healthcare goods and services.While a smoother flow of health data could eventually contribute to the protection of human health (through better, more efficient and targeted healthcare, more powered research and better tailored public health policies), the main drivers of this initiative are the free movement and protection of (non-)personal data and the internal market, which will reflect the selection of legal basis for the legal proposal. The EHDS is a tool aimed to improve access to quality health data for both primary and secondary use. It will be the task of data users to implement uses that could improve the health outcome of data subjects. Thus, Article 168 was not selected as a potential legal basis since the effect of such a tool on health outcomes is a secondary effect of the main aims of the initiative. Moreover, Article 168 of the TFEU provides for a more limited scope for Union intervention, which would not allow to tackle the problems that have been identified in the problem definition, such as supporting control of patients over their health data by improving interoperability, allowing the digital health products and services to circulate freely within the EU and re-using health data. 3.23.2 Subsidiarity and Proportionality Even though the GDPR provides some extensive rights concerning individuals’ access to and transmission of their health data, their practical implementation is limited by low interoperability, which has been addressed so far mainly through soft law instruments. Such difference in national standards and specifications can also prevent producers of digital health services and products to enter new markets, where they need to adapt to new standards. Evidence from the public consultation shows, there is support for being able to transmit data from mHealth into the EHR systems (77%) and for the introduction of a certification scheme to assess interoperability of digital health products and services (52%). As the evaluation of Article 14 of the CBHC Directive shows, the approaches taken so far, consisting of low intensity/soft instruments, such as guidelines and recommendations aimed to support interoperability, have not produced the desired results. Moreover, national approaches in addressing the problems have only limited scope and do not fully address the EU-wide issue. A true internal market of digital health products and services is promoted when people can take their health data with them and when health data can be accessed cross-border, while respecting data protection rules and a high level of security. The COVID-19 pandemic and EU Digital COVID Certificates shows that a strong legal basis and a common EU approach to use of health data for specific purposes, as well as EU efforts to ensure legal, semantic and technical interoperability, can significantly support the free movement of people and can transform the EU into a global standard setter. Therefore, EU-wide action in the content and form indicated is required to promote cross-border flow of health data and such action does not exceed what is necessary to achieve the Treaty objectives. The extensive use of facultative specification clauses under the GDPR at national level CLV created fragmentation and difficulties for accessing data, both at national level and between Member States, impacting on the possibility of researchers, policy makers and regulators to carry out their tasks or to do research or innovation, with negative effects on the European economy. Moreover, Member States’ health datasets often lack the diversity or size required to detect weak health pattern or to being suitable for machine learning. Accessing EU-wide health datasets is a necessity, for actors in this domain can develop more accurate and inclusive AI-based devices solutions and AI algorithms. The current situation of fragmentation, differences and barriers to access and use health data, shows that action by Member States alone is not sufficient and may hamper the rapid development and deployment of digital health products and services and of AI. Moreover, GDPR foresees the possibility of an EU law as the legal basis for processing health data for research, innovation, policy making, regulatory purposes and statistics. As analysed in section 6, concerted actions by all Member States will reduce the economic and administrative burden to access health data, supporting single market. The detailed analysis on the proposal’s financial impacts indicates that action at EU level complies with both the principle of subsidiarity and proportionality. Furthermore, the analysis on the impacts of different policy options, including economic, social and environmental, international impacts as well as impacts on fundamental rights, single market, competitiveness and SMEs show in both qualitative and quantitative terms that the Union objectives in question can be better achieved at Union level. Additionally, the detailed analysis of the different possible options in pursuing the Union objectives indicate the content and form of Union action that does not exceed what is necessary to achieve the objectives of the Treaties. 44 Objectives: What is to be achieved? 4.14.1 General objective The general objective of the intervention is to establish a genuine single market for digital health and to ensure that individuals have access to and control over their own health data, can benefit from a wealth of innovative health products and services based on health data use and reuse, and that researchers, innovators, policy-makers and regulators can make the most of the available health data for their work, while preserving trust and security. 4.24.2 Specific objectives 4.2.14.2.1 Empower citizens through increased control of their personal health data and support their free movement by ensuring that health data follows them (SO1) The EHDS would aim at empowering citizens through increased digital control of their personal health data and support their free movement by ensuring that health data follows them. The Public Consultation findings show that there is wide support for EHDS to promote citizens’ control over their own health data, with 85% of EU citizens, 83% of public authorities and 94% of industry supporting this objective. With measures strengthening the control of individuals over their own health data, the EHDS would allow health data to be used when and where individuals need it, regardless of the data source (e.g. EHR systems, medical devices, or wellness applications) or type of data controller (public or private), promoting continuity of care and patient safety. This empowerment of individuals will also help build confidence of society in the use and reuse of health data. The availability of the necessary health data when receiving health services, combined with a faster digitalisation in healthcare, would contribute to mitigate some of the inefficiencies in the health sector. 4.2.24.2.2 Unleash the data economy by fostering a genuine single market for digital health services and products (SO2) The EHDS would aim at unleashing the data economy by fostering a genuine single market for digital health services and products. It will tackle issues related to interoperability, security and other related aspects in the exchange, use and reuse of health data for the provision of healthcare, research and innovation, policy-making and regulatory activities. The Public Consultation findings show that there is wide support for the EU to establish interoperability standards for secondary use of health data, with 88% support from public authorities and 91% support from industry. By addressing interoperability discrepancies within the single market, the EHDS would reduce obstacles to the free movement of goods and services, as well as distortions of competi