Source: EURLEX
Language: en
Format: md

**EUROPEAN UNION**

**THE EUROPEAN PARLIAMENT** **THE COUNCIL**

**Brussels, 8 January 2025**
**(OR. en)**

**2022/0140(COD)** **PE-CONS 76/24**

**SAN 195**

**PHARM 48**

**COMPET 369**

**MI 360**

**DATAPROTECT 159**

**CODEC 905**

**LEGISLATIVE ACTS AND OTHER INSTRUMENTS**

Subject: REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE
COUNCIL on the European Health Data Space and amending Directive
2011/24/EU and Regulation (EU) 2024/2847

PE-CONS 76/24

# LIFE.5 EN

**REGULATION (EU) 2024/…**

**OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL**

**of …**

**on the European Health Data Space and amending Directive 2011/24/EU**

**and Regulation (EU) 2024/2847**

**(Text with EEA relevance)**

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 16

and 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee **[1]**,

Having regard to the opinion of the Committee of the Regions **[2]**,

Acting in accordance with the ordinary legislative procedure **[3]**,

**1** OJ C 486, 21.12.2022, p. 123.
**2** OJ C 157, 3.5.2023, p. 64.
**3** Position of the European Parliament of 24 April 2024 (not yet published in the Official
Journal) and decision of the Council of …

PE-CONS 76/24 1

# LIFE.5 EN

Whereas:

(1) The aim of this Regulation is to establish the European Health Data Space (EHDS) in order

to improve natural persons’ access to and control over their personal electronic health data

in the context of healthcare, as well as to better achieve other purposes involving the use of

electronic health data in the healthcare and care sectors that would benefit society, such as

research, innovation, policy-making, health threats preparedness and response, including

preventing and addressing future pandemics, patient safety, personalised medicine, official

statistics or regulatory activities. In addition, this Regulation’s goal is to improve the

functioning of the internal market by laying down a uniform legal and technical framework

in particular for the development, marketing and use of electronic health record systems

(‘EHR systems’) in conformity with Union values. The EHDS will be a key element in the

creation of a strong and resilient European Health Union.

PE-CONS 76/24 2

# LIFE.5 EN

(2) The COVID-19 pandemic highlighted the imperative of having timely access to quality

electronic health data for health threats preparedness and response, as well as for

prevention, diagnosis and treatment and for secondary use of such electronic health data.

Such timely access could potentially contribute, through efficient public health surveillance

and monitoring, to more effective management of future pandemics, to a reduction of costs

and to improving the response to health threats, and ultimately could help to save more

lives. In 2020, the Commission urgently adapted its Clinical Patient Management System,

established by Commission Implementing Decision (EU) 2019/1269 **[4]**, to allow Member

States to share electronic health data of COVID-19 patients moving between healthcare

providers and Member States during the peak of that pandemic. However, that adaptation

was only an emergency solution, showing the need for a structural and consistent approach

at Member State and Union level, both in order to improve the availability of electronic

health data for healthcare and to facilitate access to electronic health data in order to steer

effective policy responses and contribute to high standards of human health.

**4** Commission Implementing Decision (EU) 2019/1269 of 26 July 2019 amending
Implementing Decision 2014/287/EU setting out criteria for establishing and evaluating
European Reference Networks and their Members and for facilitating the exchange of
information and expertise on establishing and evaluating such Networks
(OJ L 200, 29.7.2019, p. 35).

PE-CONS 76/24 3

# LIFE.5 EN

(3) The COVID-19 crisis strongly cemented the work of the eHealth Network, a voluntary

network of authorities responsible for digital health, as the main pillar for the development

of contact-tracing and contact-warning applications for mobile devices and the technical

aspects of the EU Digital COVID Certificates. It also highlighted the need for sharing

electronic health data that are findable, accessible, interoperable and reusable

(the ‘FAIR principles’), and ensuring that electronic health data are as open as possible,

while respecting the data minimisation principle as set out in Regulation (EU) 2016/679 of

the European Parliament and of the Council **[5]** . Synergies between the EHDS, the European

Open Science Cloud and the European Research Infrastructures should be ensured, and

lessons should be learned from data-sharing solutions developed under the European

COVID-19 Data Platform.

**5** Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) (OJ L 119, 4.5.2016, p. 1).

PE-CONS 76/24 4

# LIFE.5 EN

(4) Given the sensitivity of personal electronic health data, this Regulation seeks to provide

sufficient safeguards at both Union and national level to ensure a high degree of data

protection, security, confidentiality and ethical use. Such safeguards are necessary to

promote trust in safe handling of electronic health data of natural persons for primary use

and secondary use as defined in this Regulation.

(5) The processing of personal electronic health data is subject to the provisions of Regulation

(EU) 2016/679 and, for Union institutions, bodies, offices and agencies, of Regulation

(EU) 2018/1725 of the European Parliament and of the Council **[6]** . References to the

provisions of Regulation (EU) 2016/679 should be understood also as references to the

corresponding provisions of Regulation (EU) 2018/1725 for Union institutions, bodies,

offices and agencies, where relevant.

**6** Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October
2018 on the protection of natural persons with regard to the processing of personal data by
the Union institutions, bodies, offices and agencies and on the free movement of such data,
and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC
(OJ L 295, 21.11.2018, p. 39).

PE-CONS 76/24 5

# LIFE.5 EN

(6) More and more individuals living in the Union cross national borders to work, study, visit

relatives, or for other reasons. To facilitate the exchange of health data, and in line with the

need to empower citizens, they should be able to access their health data in an electronic

format that can be recognised and accepted across the Union. Such personal electronic

health data could include personal data related to the physical or mental health of a natural

person, including related to the provision of healthcare services, and which reveal

information about their health status, personal data relating to the inherited or acquired

genetic characteristics of a natural person which give unique information about the

physiology or the health of that natural person and which result, in particular, from an

analysis of a biological sample from the natural person in question, as well as data

determinants of health, such as behaviour, environmental and physical influences, medical

care, and social or educational factors. Electronic health data also include data that have

been initially collected for research, statistical, health threat assessment, policy making or

regulatory purposes and it should be possible to make them available in accordance with

the rules laid down in this Regulation. Electronic health data consist of all categories of

those data, irrespective of whether such data are provided by the data subject or other

natural or legal persons, such as health professionals, or are processed in relation to a

natural person’s health or well-being and should also include inferred and derived data,

such as diagnostics, tests and medical examinations, as well as data observed and recorded

by automated means.

PE-CONS 76/24 6

# LIFE.5 EN

(7) In health systems, personal electronic health data are usually gathered in electronic health

records, which typically contain a natural person’s medical history, diagnoses and

treatment, medications, allergies and vaccinations, as well as radiology images, laboratory

results and other medical data, spread between different actors in the health system, such as

general practitioners, hospitals, pharmacies or care services. In order to allow electronic

health data to be accessed, shared and modified by natural persons or health professionals,

some Member States have taken the necessary legal and technical measures and set up

centralised infrastructures connecting EHR systems used by healthcare providers and

natural persons. In addition, some Member States provide support to public and private

healthcare providers to set up personal electronic health data spaces to enable

interoperability between different healthcare providers. Several Member States also

support or provide electronic health data access services for patients and health

professionals, for instance through patient or health professional portals. Those Member

States have also taken measures to ensure that EHR systems or wellness applications are

able to transmit electronic health data to the central EHR system, for instance by providing

a system of certification. However, not all Member States have put in place such systems,

and those Member States that have implemented them have done so in a fragmented

manner. In order to facilitate the free movement of personal electronic health data across

the Union and avoid negative consequences for patients when receiving healthcare in a

cross-border context, Union action is needed to improve natural persons’ access to their

own personal electronic health data and to empower them to share those data. In this

respect, appropriate action at Union and national level should be taken as a means of

reducing fragmentation, heterogeneity and division, and to create a system that is user

friendly and intuitive in all Member States. Any digital transformation in the healthcare

sector should aim to be inclusive and also benefit natural persons with limited ability to

access and use digital services, including people with disabilities.

PE-CONS 76/24 7

# LIFE.5 EN

(8) Regulation (EU) 2016/679 sets out specific provisions concerning the rights of natural

persons in relation to the processing of their personal data. The EHDS builds upon those

rights and complements some of them as applied to personal electronic health data. Those

rights apply regardless of the Member State in which the personal electronic health data are

processed, type of healthcare provider, sources of those data or Member State of affiliation

of the natural person. The rights and rules related to the primary use of personal electronic

health data under this Regulation concern all categories of those data, irrespective of how

they have been collected or who has provided them, the legal ground for the processing

under Regulation (EU) 2016/679 or the status of the controller as a public or private

organisation. The additional rights of access and portability of personal electronic health

data provided for in this Regulation should be without prejudice to the rights of access and

portability as established under Regulation (EU) 2016/679. Natural persons continue to

have those rights under the conditions set out in that Regulation.

PE-CONS 76/24 8

# LIFE.5 EN

(9) While the rights conferred by Regulation (EU) 2016/679 should continue to apply, the

right of access to data by a natural person, established in Regulation (EU) 2016/679,

should be further complemented in the healthcare sector. Under that Regulation, controllers

do not have to provide access immediately. The right of access to health data is still

commonly implemented in many places through the provision of the requested health data

in paper format or as scanned documents, which is time-consuming for the controller, such

as a hospital or other healthcare provider that provides access. That situation slows down

access to health data by natural persons, and can have a negative impact on them if they

need such access immediately due to urgent circumstances pertaining to their health

condition. It is therefore necessary to provide for a more efficient way for natural persons

to access their own personal electronic health data. They should have the right to have

free-of-charge and immediate access, while respecting the need for technological

practicability, to specific priority categories of personal electronic health data, such as the

patient summary, through an electronic health data access service. That right should apply

regardless of the Member State in which the personal electronic health data are processed,

the type of healthcare provider, the sources of those data or the Member State of affiliation

of the natural person. The scope of that complementary right established under this

Regulation and the conditions for exercising it differ in certain ways from the right of

access to personal data under Regulation (EU) 2016/679, which covers all personal data

held by a controller and is exercised against an individual controller, which has up to one

month to reply to a request. The right to access personal electronic health data under this

Regulation should be limited to the categories of data falling within its scope, be exercised

via an electronic health data access service and entail an immediate answer. The rights

under Regulation (EU) 2016/679 should continue to apply, allowing natural persons to

benefit from their rights under both legal frameworks, in particular the right to obtain a

paper copy of the electronic health data.

PE-CONS 76/24 9

# LIFE.5 EN

(10) It should be considered that immediate access of natural persons to certain categories of

their personal electronic health data could be harmful for the safety of those natural

persons or unethical. For example, it could be unethical to inform a patient through an

electronic channel about a diagnosis of an incurable disease that is likely to be terminal

instead of first providing that information in a consultation with the patient. Therefore, it

should be possible to delay the provision of the access to personal electronic health data in

such situations for a limited amount of time, for instance until the moment when the health

professional can explain the situation to the patient. Member States should be able to

establish such an exception where it constitutes a necessary and proportionate measure in a

democratic society, in line with restrictions as provided for in Article 23 of Regulation

(EU) 2016/679.

(11) This Regulation does not affect Member States’ competences concerning the initial

registration of personal electronic health data, such as making the registration of genetic

data subject to the natural person’s consent or other safeguards. Member States may

require that data be made available in an electronic format prior to the application of this

Regulation. This should not affect the obligation to make personal electronic health data,

registered after the date of application of this Regulation, available in an electronic format.

PE-CONS 76/24 10

# LIFE.5 EN

(12) In order to complement the information available to them, natural persons should be able to

add electronic health data to their EHRs or to store additional information in their separate

personal health record which could be accessed by health professionals. However,

information inserted by natural persons might not be as reliable as electronic health data

entered and verified by health professionals and does not have the same clinical or legal

value as information provided by health professionals. Therefore, data added by natural

persons in their EHR should be clearly distinguishable from data provided by health

professionals. That possibility for natural persons to add and complement personal

electronic health data should not entitle them to change personal electronic health data

which have been provided by health professionals.

(13) Enabling natural persons to more easily and quickly access their personal electronic health

data will enable them to notice possible errors such as incorrect information or incorrectly

attributed patient records. In such cases, natural persons should be able to request online

the rectification of the incorrect personal electronic health data, immediately and free of

charge, through an electronic health data access service. Such rectification requests should

then be treated by the relevant controllers in line with Regulation (EU) 2016/679, if

necessary involving health professionals with a relevant specialisation and responsible for

the natural persons’ treatment.

PE-CONS 76/24 11

# LIFE.5 EN

(14) Under Regulation (EU) 2016/679, the right to data portability is limited to data processed

based on consent or contract and provided by the data subject to a controller. Additionally,

under that Regulation, natural persons have the right to have the personal data transmitted

directly from one controller to another only where technically feasible. Regulation

(EU) 2016/679, however, does not impose an obligation to make that direct transmission

technically feasible. The right to data portability should be complemented under this

Regulation, thereby empowering natural persons to provide access to, at least, priority

categories of their personal electronic health data to the health professionals of their

choice, to exchange such health data with such health professionals and to download such

health data. In addition, natural persons should have the right to request a healthcare

provider to transmit a part of their electronic health data to a clearly identified recipient in

the social security or reimbursement services sector. Such a transfer should be one-way

only.

PE-CONS 76/24 12

# LIFE.5 EN

(15) The framework laid down by this Regulation should build on the right to data portability

established in Regulation (EU) 2016/679 by ensuring that natural persons as data subjects

can transmit their personal electronic health data, including inferred data, in the European

electronic health record exchange format, irrespective of the legal basis for processing the

electronic health data. Health professionals should refrain from hindering the application of

the rights of natural persons, for example by refusing to take into account personal

electronic health data originating from another Member State and which are provided

through the interoperable and reliable European electronic health record exchange format.

(16) Access to electronic health records by healthcare providers or other individuals should be

transparent to the natural persons concerned. Electronic health data access services should

provide detailed information on access to data, such as when and which entity or natural

person accessed data and which data were accessed. Natural persons should also be able to

enable or disable automatic notifications regarding access to personal electronic health data

relating to them through the health professional access services.

PE-CONS 76/24 13

# LIFE.5 EN

(17) Natural persons might not want to allow access to some parts of their personal electronic

health data while enabling access to other parts. This could especially be relevant in cases

of sensitive health issues such as those related to mental or sexual health, sensitive

procedures such as abortions, or data on specific medication which could reveal other

sensitive issues. Such selective sharing of personal electronic health data should therefore

be supported and implemented through restrictions set by the natural person concerned in

the same way within the territory of a given Member State and for cross-border data

sharing. Those restrictions should allow for sufficient granularity to restrict parts of

datasets, such as elements of the patient summaries. Before setting the restrictions, natural

persons should be informed of the risks for patient safety associated with limiting access to

health data. Given that the unavailability of the restricted personal electronic health data

may impact the provision or quality of health services provided to the natural person,

natural persons making use of such access restrictions should assume responsibility for the

fact that the healthcare provider cannot take the data into account when providing health

services. The restrictions on access to personal electronic health data could have life

threatening consequences and, therefore, access to those data should nevertheless be

possible where necessary to protect vital interests in emergency situations. More specific

legal provisions on the mechanisms of restrictions placed by natural persons on parts of

their personal electronic health data could be provided for by Member States in their

national law, in particular as regards medical liability in cases where restrictions have been

placed by the natural person concerned.

PE-CONS 76/24 14

# LIFE.5 EN

(18) In addition, due to the different sensitivities in the Member States on the degree of

patients’ control over their health data, Member States should be able to provide for an

absolute right to opt out from access to their personal electronic health data by anyone

other than the original controller, without any possibility to override that opt-out in

emergency situations. In such a case, Member States should establish the rules and specific

safeguards regarding such opt-out mechanisms. Those rules and specific safeguards could

also relate to specific categories of personal electronic health data, for example genetic

data. The right to opt out means that personal electronic health data relating to the natural

person who exercises that right would not be made available through the services set up

under the EHDS other than to the healthcare provider that provided the treatment. Member

States should be able to require the registration and storage of personal electronic health

data in an EHR system used by the healthcare provider who provided the health services

and accessible only to that healthcare provider. If a natural person has exercised the right to

opt out, healthcare providers will still document the treatment provided in accordance with

applicable rules, and will be able to access the data registered by them. Natural persons

who exercise the right to opt out should be able to reverse their decision. In such cases,

personal electronic health data generated during the period of the opt-out might not be

available via the access services and MyHealth@EU.

PE-CONS 76/24 15

# LIFE.5 EN

(19) Timely and full access by health professionals to the medical records of patients is

fundamental for ensuring continuity of care, avoiding duplications and errors, and reducing

costs. However, due to a lack of interoperability, in many cases health professionals cannot

access the complete medical records of their patients and cannot make optimal medical

decisions for their diagnosis and treatment, which adds considerable costs both for health

systems and for natural persons and can lead to worse health outcomes for natural persons.

Electronic health data made available in an interoperable format and which can be

transmitted between healthcare providers can also reduce the administrative burden on

health professionals of manually entering or copying health data between electronic

systems. Therefore, health professionals should be provided with appropriate electronic

means, such as electronic devices and health professional portals or other health

professional access services, to use personal electronic health data for the exercise of their

duties. As it is difficult to exhaustively determine in advance which data from the existing

data in priority categories are medically relevant in a specific episode of care, health

professionals should have a wide access to data. When accessing data relating to their

patients, health professionals should comply with the applicable law, codes of conduct,

deontological guidelines or other provisions governing ethical conduct with respect to

sharing or accessing information, particularly in life-threatening or extreme situations. In

accordance with Regulation (EU) 2016/679, in order to limit their access to what is

relevant in a specific episode of care, healthcare providers should follow the data

minimisation principle when accessing personal electronic health data, limiting the data

accessed to data that are strictly necessary and justified for a given service.

PE-CONS 76/24 16

# LIFE.5 EN

Providing health professional access services is a task assigned in the public interest by this

Regulation and the performance of such task requires the processing of personal data as

referred to in Article 6(1), point (e), of Regulation (EU) 2016/679. This Regulation

provides for conditions and safeguards for the processing of electronic health data by the

health professional access service in accordance with Article 9(2), point (h), of Regulation

(EU) 2016/679, for instance detailed provisions regarding logging of access to personal

electronic health data and that aim to provide transparency towards data subjects.

However, this Regulation should be without prejudice to national law concerning the

processing of health data for the delivery of healthcare, including national law establishing

categories of health professionals that can process different categories of electronic health

data.

PE-CONS 76/24 17

# LIFE.5 EN

(20) In order to facilitate the exercise of the complementary access and portability rights

established under this Regulation, Member States should establish one or more electronic

health data access services. Those services could be provided at national, regional or local

level, or by healthcare providers, in the form of an online patient portal, an application for

mobile devices or by other means. They should be designed in an accessible way, in

particular for persons with disabilities. Providing such a service to enable natural persons

to have easy access to their personal electronic health data is a substantial public interest.

The processing of personal electronic health data through those services is necessary for

the performance of that task assigned by this Regulation in the sense of Article 6(1),

point (e), and Article 9(2), point (g), of Regulation (EU) 2016/679. This Regulation lays

down the necessary conditions and safeguards for the processing of electronic health data

in electronic health data access services, such as electronic identification of natural persons

accessing such services.

PE-CONS 76/24 18

# LIFE.5 EN

(21) Natural persons should be able to provide an authorisation to other natural persons of their

choice, such as their relatives or other close natural persons, enabling such persons of their

choice to access or control the access to the personal electronic health data of the natural

persons who provide the authorisation or to use digital health services on their behalf. Such

authorisations could also be convenient for other usage by natural persons provided with

such an authorisation. Proxy services for enabling and implementing such authorisations

should be established by Member States, and be linked to personal electronic health data

access services, such as patient portals or patient-facing applications for mobile devices.

Those proxy services should also enable guardians to act on behalf of their dependents,

including minors; in such situations, authorisations could be automatic. In addition to those

proxy services, Member States should also establish easily accessible support services to

be provided by adequately trained staff dedicated to assisting natural persons when

exercising their rights. In order to take into account cases in which the display of some

personal electronic health data of dependent persons to their guardians could be contrary to

the interests or the will of their dependents, including minors, Member States should be

able to provide in national law for limitations and safeguards as well as for mechanisms for

their technical implementation. Personal electronic health data access services, such as

patient portals or patient-facing applications for mobile devices, should make use of such

authorisations and thus enable authorised natural persons to access personal electronic

health data falling within the scope of the authorisation. In order to provide a horizontal

solution with increased user-friendliness, digital proxy solutions should be aligned with

Regulation (EU) No 910/2014 of the European Parliament and of the Council **[7]** and the

technical specifications of the European Digital Identity Wallet. That alignment would

contribute to reducing both the administrative and financial burden for Member States by

lowering the risk of developing parallel systems that are not interoperable across the

Union.

**7** Regulation (EU) No 910/2014 of the European Parliament and of the Council of
23 July 2014 on electronic identification and trust services for electronic transactions in the
internal market and repealing Directive 1999/93/EC (OJ L 257, 28.8.2014, p. 73).

PE-CONS 76/24 19

# LIFE.5 EN

(22) In some Member States, healthcare is provided by primary care management teams, which

are groups of health professionals focused on primary care, such as general practitioners,

that carry out their primary care activities based on a healthcare plan that they draw up.

Other types of healthcare teams also exist in several Member States for other care

purposes. In the context of primary use in the EHDS, access should be provided to the

health professionals belonging to such teams.

PE-CONS 76/24 20

# LIFE.5 EN

(23) The supervisory authorities established pursuant to Regulation (EU) 2016/679 are

competent for monitoring and enforcing the application of that Regulation, in particular for

the monitoring of the processing of personal electronic health data and for handling any

complaints lodged by the natural persons concerned. This Regulation establishes additional

rights for natural persons regarding primary use, which go beyond and complement access

and portability rights enshrined in Regulation (EU) 2016/679. Since those additional rights

should also be enforced by the supervisory authorities established pursuant to Regulation

(EU) 2016/679, Member States should ensure that those supervisory authorities are

provided with the financial and human resources, premises and infrastructure necessary for

the effective performance of those additional tasks. The supervisory authority or authorities

responsible for the monitoring and enforcement of the processing of personal electronic

health data for primary use in compliance with this Regulation should be competent to

impose administrative fines. The legal system of Denmark does not allow for

administrative fines as set out in this Regulation. The rules on administrative fines may be

applied in such a manner that in Denmark the fines are imposed by the competent national

courts as a criminal penalty, provided that such an application of the rules has an

equivalent effect to administrative fines imposed by supervisory authorities. In any event,

the fines imposed should be effective, proportionate and dissuasive.

PE-CONS 76/24 21

# LIFE.5 EN

(24) Member States ought to strive to adhere to ethical principles, such as the European ethical

principles for digital health adopted by the eHealth Network on 26 January 2022 and the

principle of health professional-patient confidentiality, in the application of this

Regulation. Recognising the importance of ethical principles, the European ethical

principles for digital health provide guidance to practitioners, researchers, innovators,

policy-makers and regulators.

PE-CONS 76/24 22

# LIFE.5 EN

(25) The relevance of different categories of electronic health data for different healthcare

scenarios varies. Different categories have also achieved different levels of maturity as

regards standardisation, and therefore the implementation of mechanisms for their

exchange may be more or less complex depending on the category. Therefore, the

improvement of interoperability and data sharing should be gradual and prioritisation of

certain categories of electronic health data is needed. Categories of electronic health data

such as patient summaries, electronic prescriptions and dispensations, medical imaging

studies and related imaging reports, medical test results such as laboratory results and

related reports, and discharge reports have been selected by the eHealth Network as most

relevant for the majority of healthcare situations and should be considered as priority

categories for Member States to implement access to them and their transmission. Where

such priority categories of data represent groups of electronic health data, this Regulation

should apply to both the groups as a whole and to the individual data entries included in

those groups. For example, given that vaccination status is part of a patient summary, the

rights and requirements linked to the patient summary should also apply to such

vaccination status even if it is processed separately from the patient summary as a whole.

When further needs for the exchange of additional categories of electronic health data are

identified for healthcare purposes, access to and exchange of those additional categories

should be possible under this Regulation. The additional categories should be first

implemented at Member State level and the exchange on a voluntary basis of such

categories of data in cross-border situations between the cooperating Member States should

be provided for in this Regulation. Particular attention should be given to data exchange in

border regions of neighbouring Member States where the provision of cross-border health

services is more frequent and needs even quicker procedures than across the Union in

general.

PE-CONS 76/24 23

# LIFE.5 EN

(26) The level of availability of personal health and genetic data in an electronic format varies

between Member States. The EHDS should make it easier for natural persons to have those

data available in electronic format and to control better the access to and sharing of their

personal electronic health data. This would also contribute to the achievement of the target

of 100 % of Union citizens having access to their electronic health records by 2030, as

referred to in Decision (EU) 2022/2481 of the European Parliament and of the Council **[8]** . In

order to make electronic health data accessible and transmissible, such data should be

accessed and transmitted in an interoperable common European electronic health record

exchange format, at least for certain categories of electronic health data such as patient

summaries, electronic prescriptions and dispensations, medical imaging studies and related

imaging reports, medical test results and discharge reports, subject to transition periods.

Where personal electronic health data are made available to a healthcare provider or a

pharmacy by a natural person, or are transmitted by another controller in the European

electronic health record exchange format, that format should be accepted, and the recipient

should be able to read the data and use them for the provision of healthcare or for

dispensation of a medicinal product, thus supporting the provision of the healthcare

services or the dispensation of the electronic prescription. The European electronic health

record exchange format ought to be designed in a way that facilitates translation of

electronic health data communicated using that format into the official languages of the

Union, to the extent possible. Commission Recommendation (EU) 2019/243 **[9]** provides the

foundations for such a common European electronic health record exchange format. The

interoperability of the EHDS should contribute to having European health datasets of a

high quality. The use of a European electronic health record exchange format should

become more widespread at Union and national level. The European electronic health

record exchange format could allow for different profiles for its use at the level of EHR

systems and at the level of the national contact points for digital health in MyHealth@EU

for cross-border data exchange.

**8** Decision (EU) 2022/2481 of the European Parliament and of the Council of 14 December
2022 establishing the Digital Decade Policy Programme 2030 (OJ L 323, 19.12.2022, p. 4).
**9** Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic
Health Record exchange format (OJ L 39, 11.2.2019, p. 18).

PE-CONS 76/24 24

# LIFE.5 EN

(27) While EHR systems are widespread, the level of digitalisation of health data varies in

Member States depending on data categories and on the coverage of healthcare providers

that register health data in electronic format. In order to support the application of data

subjects’ rights of access to and exchange of electronic health data, Union action is needed

to avoid further fragmentation. In order to contribute to a high quality and continuity of

healthcare, certain categories of health data should be registered in electronic format

systematically and in accordance with specific data quality requirements. The European

electronic health record exchange format should form the basis for specifications related to

the registration and exchange of electronic health data.

(28) Telemedicine is becoming an increasingly important tool that can provide patients with

access to care and tackle inequities. It has the potential to reduce health inequalities and

reinforce the free movement of Union citizens across borders. Digital and other

technological tools can facilitate the provision of care in remote regions. When digital

services accompany the physical provision of a healthcare service, the digital service

should be included in the overall care provision. Under Article 168 of the Treaty on the

Functioning of the European Union (TFEU), Member States are responsible for their

health policy, in particular for the organisation and delivery of health services and medical

care, including the regulation of activities such as online pharmacies, telemedicine and

other services that they provide and provide reimbursement for, in line with their national

legislation. Different healthcare policies should not, however, constitute barriers to the free

movement of electronic health data in the context of cross-border healthcare, for example

telemedicine and online pharmacy services.

PE-CONS 76/24 25

# LIFE.5 EN

(29) Regulation (EU) No 910/2014 lays down the conditions under which Member States

perform identification of natural persons in cross-border situations using identification

means issued by another Member State, establishing rules for the mutual recognition of

such electronic identification means. The EHDS requires secure access to electronic health

data, including in cross-border situations. Electronic health data access services and

telemedicine services should enable natural persons to exercise their rights regardless of

their Member State of affiliation, and should therefore support the identification of natural

persons using any electronic identification means recognised pursuant to Regulation

(EU) No 910/2014. Given the possibility of challenges regarding identity matching in

cross-border situations, it might be necessary for Member States of treatment to provide

complementary access mechanisms such as tokens or codes to natural persons who arrive

from other Member States and receive healthcare. The Commission should be empowered

to adopt implementing acts to determine the requirements for the interoperable and cross

border identification and authentication of natural persons and health professionals,

including any complementary mechanisms that are necessary to ensure that natural persons

can exercise their rights related to personal electronic health data in cross-border situations.

PE-CONS 76/24 26

# LIFE.5 EN

(30) Member States should designate relevant digital health authorities for the planning and

implementation of standards for access to and transmission of electronic health data and

the enforcement of the rights of natural persons and health professionals, as separate

organisations or as part of already existing authorities. The digital health authority staff

should not have any financial or other interests in industries or economic activities which

could affect their impartiality. Digital health authorities already exist in most of the

Member States and they deal with EHRs, interoperability, security or standardisation.

When carrying out their tasks, digital health authorities should cooperate in particular with

the supervisory authorities established pursuant to Regulation (EU) 2016/679 and

supervisory bodies established pursuant to Regulation (EU) No 910/2014. Digital health

authorities can also cooperate with the European Artificial Intelligence Board established

by Regulation (EU) 2024/1689 of the European Parliament and of the Council **[10]**, the

Medical Device Coordination Group established by Regulation (EU) 2017/745 of the

European Parliament and of the Council **[11]**, the European Data Innovation Board

established pursuant to Regulation (EU) 2022/868 of the European Parliament and of the

Council **[12]** and the competent authorities under Regulation (EU) 2023/2854 of the European

Parliament and of the Council **[13]** .

**10** Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024
laying down harmonised rules on artificial intelligence and amending Regulations (EC)
No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and
(EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828
(Artificial Intelligence Act) (OJ L, 2024/1689, 12.7.2024,
ELI: http://data.europa.eu/eli/reg/2024/1689/oj).
**11** Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017
on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and
Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and
93/42/EEC (OJ L 117, 5.5.2017, p. 1).
**12** Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022
on European data governance and amending Regulation (EU) 2018/1724
(Data Governance Act) (OJ L 152, 3.6.2022, p. 1).
**13** Regulation (EU) 2023/2854 of the European Parliament and of the Council of
13 December 2023 on harmonised rules on fair access to and use of data and amending
Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (OJ L, 2023/2854,
22.12.2023, ELI: http://data.europa.eu/eli/reg/2023/2854/oj).

PE-CONS 76/24 27

# LIFE.5 EN

Member States should facilitate the participation of national actors in the cooperation at

Union level, the conveying of expertise and the provision of advice on the design of

solutions necessary to achieve the goals of the EHDS.

(31) Without prejudice to any other administrative or non-judicial remedy, any natural or legal

person should have the right to an effective judicial remedy against a legally binding

decision of a digital health authority concerning them or where a digital health authority

does not handle a complaint or does not inform the natural or legal person within three

months about the progress or outcome of the complaint. Proceedings against a digital

health authority should be brought before the courts of the Member States where the digital

health authority is established.

PE-CONS 76/24 28

# LIFE.5 EN

(32) Digital health authorities should have sufficient technical skills, possibly by bringing

together experts from different organisations. The activities of digital health authorities

should be well-planned and monitored in order to ensure their efficiency. Digital health

authorities should take the necessary measures to protect the rights of natural persons by

setting up national, regional, and local technical solutions such as national EHR

intermediation solutions and patient portals. When taking such necessary protective

measures, digital health authorities should apply common standards and specifications in

such solutions, promote the application of the standards and specifications in procurement

procedures and use other innovative means including reimbursement of solutions that are

compliant with interoperability and security requirements of the EHDS. Member States

should ensure that appropriate training initiatives are taken. In particular, health

professionals should be informed and trained with regard to their rights and obligations

under this Regulation. To carry out their tasks, the digital health authorities should

cooperate at Union and national level with other entities, including with insurance bodies,

healthcare providers, health professionals, manufacturers of EHR systems and of wellness

applications, as well as other stakeholders from the health or information technology

sector, entities handling reimbursement schemes, health technology assessment bodies,

medicinal products regulatory authorities and agencies, medical devices authorities,

procurers and cybersecurity or e-ID authorities.

PE-CONS 76/24 29

# LIFE.5 EN

(33) Access to and transmission of electronic health data is relevant in cross-border healthcare

situations, as it can support continuity of healthcare when natural persons travel to other

Member States or change their place of residence. Continuity of care and rapid access to

personal electronic health data is even more important for residents in border regions who

cross the border frequently to get healthcare. In many border regions, some specialised

healthcare services might be available closer across the border than in the same Member

State. Infrastructure is needed for the transmission of personal electronic health data across

borders, in situations where a natural person is using services of a healthcare provider

established in another Member State. The gradual expansion of such infrastructure and its

funding should be considered. A voluntary infrastructure for that purpose, MyHealth@EU,

was established as part of the actions to achieve the objectives set up in Directive

2011/24/EU of the European Parliament and of the Council **[14]** . Through MyHealth@EU,

Member States started to provide natural persons with the possibility of sharing their

personal electronic health data with healthcare providers when travelling abroad. Building

on that experience, the participation of Member States in MyHealth@EU as established by

this Regulation should be mandatory. Technical specifications for MyHealth@EU should

enable the exchange of priority categories of electronic health data as well as additional

categories supported by the European electronic health record exchange format. Those

specifications should be defined by means of implementing acts and should be based on

the cross-border specifications of the European electronic health record exchange format,

complemented by further specifications on cybersecurity, technical and semantic

interoperability, operations and service management. Member States should be required to

join MyHealth@EU, comply with its technical specifications and connect healthcare

providers, including pharmacies, to it, as this is necessary for enabling natural persons to

exercise their rights under this Regulation to access and make use of their personal

electronic health data regardless of the Member State where the natural persons are

located.

**14** Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on
the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

PE-CONS 76/24 30

# LIFE.5 EN

(34) MyHealth@EU provides a common infrastructure for the Member States to ensure

connectivity and interoperability in an efficient and secure way to support cross-border

healthcare, without affecting Member States’ responsibilities before and after the

transmission of personal electronic health data through it. Member States are responsible

for the organisation of their national contact points for digital health and for the processing

of personal data for the purposes of the delivery of healthcare, before and after the

transmission of those data through MyHealth@EU. The Commission should monitor

through compliance checks the compliance of national contact points for digital health with

the necessary requirements regarding the technical development of MyHealth@EU as well

as with detailed rules concerning the security, confidentiality and protection of personal

electronic health data. In the event of serious non-compliance by a national contact point

for digital health, the Commission should be able to suspend the services affected by the

non-compliance provided by that national contact point for digital health. The Commission

should act as a processor on behalf of the Member States within MyHealth@EU and

should provide central services for it. To ensure compliance with data protection rules and

to provide a risk management framework for the transmission of personal electronic health

data, the specific responsibilities of the Member States, as joint controllers, and the

Commission’s obligations as processor on their behalf should be specified by means of

implementing acts. Each Member State is solely responsible for data and services in that

Member State. This Regulation provides the legal basis for the processing of personal

electronic health data in MyHealth@EU as a task carried out in the public interest assigned

by Union law referred to in Article 6(1), point (e), of Regulation (EU) 2016/679. That

processing is necessary for the provision of healthcare in cross-border situations, as

mentioned in Article 9(2), point (h), of that Regulation.

PE-CONS 76/24 31

# LIFE.5 EN

(35) In addition to services in MyHealth@EU for the exchange of personal electronic health

data based on the European electronic health record exchange format, other services or

supplementary infrastructures could be needed, for example in cases of public health

emergencies or where the architecture of MyHealth@EU is not suitable for the

implementation of some use cases. Examples of such use cases include support for

vaccination card functionalities, including the exchange of information on vaccination

plans, or verification of vaccination certificates or other health-related certificates. Such

additional use cases would also be important for introducing additional functionality for

handling public health crises, such as support for contact tracing for the purposes of

containing infectious diseases. MyHealth@EU should support exchanges of personal

electronic health data with national contact points for digital health of relevant third

countries and systems established at international level by international organisations in

order to contribute to the continuity of healthcare. This is particularly relevant for

individuals travelling to and from neighbouring third countries, candidate countries, and

the associated overseas countries and territories. The connection of such national contact

points for digital health of third countries to MyHealth@EU and the interoperability with

digital systems established at international level by international organisations should be

subject to a check ensuring the compliance of those contact points and digital systems with

the technical specifications, data protection rules and other requirements of

MyHealth@EU. In addition, given that the connection to MyHealth@EU will entail

transfers of personal electronic health data to third countries, such as sharing a patient

summary when the patient seeks care in that third country, relevant transfer instruments

under Chapter V of Regulation (EU) 2016/679 should be put in place. The Commission

should be empowered to adopt implementing acts to facilitate the connection of such

national contact points for digital health of third countries and systems established at

international level by international organisations to MyHealth@EU. When preparing those

implementing acts, the Commission should take into account Member States’ national

security interests.

PE-CONS 76/24 32

# LIFE.5 EN

(36) In order to enable the seamless exchange of electronic health data and ensure respect for

the rights of natural persons and health professionals, EHR systems marketed in the

internal market should be able to store and transmit, in a secure way, high quality

electronic health data. It is a key objective of the EHDS to ensure the secure and free

movement of electronic health data across the Union. To that end, a mandatory conformity

self-assessment scheme for EHR systems processing one or more priority categories of

electronic health data should be established to overcome market fragmentation while

ensuring a proportionate approach. Through the self-assessment, EHR systems will prove

compliance with the requirements on interoperability, security and logging for

communication of personal electronic health data established by the two mandatory EHR

software components harmonised by this Regulation, namely the European interoperability

software component for EHR systems and the European logging software component for

EHR systems (the ‘harmonised software components of EHR systems’). The harmonised

software components of EHR systems mainly concern data transformation, although they

may imply the need for indirect requirements for data registration and data presentation in

EHR systems. Technical specifications for the harmonised software components of EHR

systems should be defined by means of implementing acts and should be based on the use

of the European electronic health record exchange format. The harmonised software

components of EHR systems should be designed to be reusable and to integrate seamlessly

with other components within a larger software system.

PE-CONS 76/24 33

# LIFE.5 EN

The security requirements of the harmonised software components of EHR systems should

cover elements specific to EHR systems, as more general security properties should be

supported by other mechanisms such as those under Regulation (EU) 2024/2847 of the

European Parliament and of the Council **[15]** . To support that process, European digital

testing environments should be set up to provide automated means to test whether the

functioning of the harmonised software components of an EHR system is compliant with

the requirements laid down in this Regulation. To that end, implementing powers should

be conferred on the Commission to determine the common specifications for those

environments. The Commission should develop the necessary software for the testing

environments and make it available as open source. Member States should be responsible

for the operation of the digital testing environments, as they are closer to manufacturers

and better placed to support them. Manufacturers should use those digital testing

environments to test their products before placing them on the market while continuing to

bear full responsibility for the compliance of their products. The results of the test should

become part of the product’s technical documentation. Where the EHR system or any part

of it complies with European standards or common specifications, the list of the relevant

European standards and common specifications should also be indicated in the technical

documentation. To support the comparability of EHR systems, the Commission should

prepare a uniform template for the technical documentation accompanying such systems.

**15** Regulation (EU) 2024/2847 of the European Parliament and of the Council of
23 October 2024 on horizontal cybersecurity requirements for products with digital elements
and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive
(EU) 2020/1828 (Cyber Resilience Act) (OJ L, 2024/2847, 20.11.2024,
ELI: http://data.europa.eu/eli/reg/2024/2847/oj).

PE-CONS 76/24 34

# LIFE.5 EN

(37) EHR systems should be accompanied by an information sheet that includes information for

its professional users and by clear and complete instructions for use, including in

accessible formats for persons with disabilities. If an EHR system is not accompanied by

such information, the manufacturer of the EHR system concerned, its authorised

representative and all other relevant economic operators should be required to add to the

EHR system that information sheet and those instructions for use.

(38) While EHR systems specifically intended by the manufacturer to be used for processing

one or more specific categories of electronic health data should be subject to mandatory

self-certification, software for general purposes should not be considered to be an EHR

system, even when used in a healthcare setting, and should therefore not be required to

comply with this Regulation. That covers cases such as text-processing software used for

writing reports that would then become part of written electronic health records, general

purpose middleware, or database management software that is used as part of data storage

solutions.

PE-CONS 76/24 35

# LIFE.5 EN

(39) This Regulation imposes a mandatory conformity self-assessment scheme for the

harmonised software components of EHR systems to ensure that EHR systems placed on

the Union market are able to exchange data in the European electronic health record

exchange format and that they have the required logging capabilities. That mandatory

conformity self-assessment, which would be in the form of an EU declaration of

conformity by the manufacturer, should ensure that those requirements are fulfilled in a

proportionate way, while avoiding an undue burden on Member States and manufacturers.

(40) Manufacturers should affix in the accompanying documents of the EHR system, and where

applicable on its packaging, a CE marking of conformity indicating that the EHR system is

in conformity with this Regulation and, in respect of aspects not covered by this

Regulation, with other applicable Union law which also requires the affixing of such

marking. Member States should build upon existing mechanisms to ensure the correct

application of the provisions on the CE marking of conformity under relevant Union law

and should take appropriate action in the event of improper use of that marking.

PE-CONS 76/24 36

# LIFE.5 EN

(41) Member States should remain competent to define requirements relating to any other

software components of EHR systems and the terms and conditions for connection of

healthcare providers to their respective national infrastructures, which could be subject to

third-party assessment at national level. In order to facilitate the smooth functioning of the

internal market for EHR systems, digital health products and associated services, it is

necessary to ensure as much as possible transparency as regards national law establishing

requirements for EHR systems and provisions on their conformity assessment in relation to

aspects other than the harmonised software components of EHR systems. Therefore,

Member States should inform the Commission of those national requirements so it has the

necessary information to ensure that they do not adversely affect the harmonised software

components of EHR systems.

PE-CONS 76/24 37

# LIFE.5 EN

(42) Certain software components of EHR systems could be considered medical devices under

Regulation (EU) 2017/745 or in vitro diagnostic medical devices under Regulation

(EU) 2017/746 of the European Parliament and of the Council **[16]** . Software or modules of

software which fall within the definition of a medical device, in vitro diagnostic medical

devices or an artificial intelligence (AI) system considered to be high-risk

(the ‘high-risk AI system’) should be certified in accordance with Regulations

(EU) 2017/745, (EU) 2017/746 and (EU) 2024/1689, as applicable. While such products

are required to fulfil the requirements under the respective Regulation governing those

products, Member States should take appropriate measures to ensure that the respective

conformity assessment is carried out as a joint or coordinated procedure in order to limit

the administrative burden on manufacturers and other economic operators. The essential

requirements on interoperability of this Regulation should only apply to the extent that the

manufacturer of a medical device, an in vitro diagnostic medical device, or a high-risk AI

system, which is providing electronic health data to be processed as part of the EHR

system, claims interoperability with such EHR system. In such case, the provisions on

common specifications for EHR systems should be applicable to those medical devices, in

vitro diagnostic medical devices and high-risk AI systems.

**16** Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017
on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission
Decision 2010/227/EU (OJ L 117, 5.5.2017, p. 176).

PE-CONS 76/24 38

# LIFE.5 EN

(43) To further support interoperability and security, Member States should be able to maintain

or define specific rules for the procurement, reimbursement or financing of EHR systems

at national level in the context of the organisation, delivery or financing of health services.

Such specific rules should not impede the free movement of EHR systems in the Union.

Some Member States have introduced mandatory certification of EHR systems or

mandatory interoperability testing for their connection to national digital health services.

Such requirements are commonly reflected in procurement procedures organised by

healthcare providers and national or regional authorities. The mandatory certification of

EHR systems at Union level should establish a baseline that can be used in procurement

procedures at national level.

(44) In order to guarantee the effective exercise by patients of their rights under this Regulation,

healthcare providers developing and using an EHR system ‘in-house’ to carry out internal

activities without placing it on the market in return for payment or remuneration should

also comply with this Regulation. In that context, such healthcare providers should comply

with all requirements applicable to manufacturers as regards such EHR systems that are

              developed ‘in house’ and that such healthcare providers put into service. However, given

that the healthcare providers may need additional time to prepare for compliance with this

Regulation, those requirements should only apply to such systems after an extended

transitional period.

PE-CONS 76/24 39

# LIFE.5 EN

(45) It is necessary to provide for a clear and proportionate distribution of obligations

corresponding to the role of each economic operator in the supply and distribution process

of EHR systems. Economic operators should be responsible for compliance in relation to

their respective roles in such process and should ensure that they make available on the

market only EHR systems which comply with relevant requirements.

(46) Compliance with essential requirements on interoperability and security should be

demonstrated by the manufacturers of EHR systems through the implementation of

common specifications. To that end, implementing powers should be conferred on the

Commission to determine such common specifications regarding datasets, coding systems,

technical specifications, standards, specifications and profiles for data exchange, as well as

requirements and principles related to patient safety and the security, confidentiality,

integrity and protection of personal data, and specifications and requirements related to

identification management and the use of electronic identification. Digital health

authorities should contribute to the development of such common specifications. Where

applicable, those common specifications should be based on existing harmonised standards

for the harmonised software components of EHR systems and be compatible with sectoral

law. Where common specifications have a particular importance in relation to personal

data protection requirements concerning EHR systems, they should be subject to

consultation with the European Data Protection Board (EDPB) and the European Data

Protection Supervisor (EDPS) before their adoption, pursuant to Article 42(2) of

Regulation (EU) 2018/1725.

PE-CONS 76/24 40

# LIFE.5 EN

(47) In order to ensure there is appropriate and effective enforcement of the requirements and

obligations laid down in this Regulation, the system of market surveillance and compliance

of products established by Regulation (EU) 2019/1020 of the European Parliament and of

the Council **[17]** should apply. Depending on the organisation defined at national level, such

market surveillance activities could be carried out by the digital health authorities ensuring

the proper implementation of Chapter II of this Regulation or a separate market

surveillance authority responsible for EHR systems. While designating digital health

authorities as market surveillance authorities could have significant practical advantages

for the implementation of health and care, any conflicts of interest should be avoided, for

instance by separating different tasks.

(48) The staff of market surveillance authorities should have no direct or indirect economic,

financial or personal conflicts of interest that might be considered prejudicial to their

independence and, in particular, they should not be in a situation that could, directly or

indirectly, affect the impartiality of their professional conduct. Member States should

determine and publish the selection procedure for market surveillance authorities. They

should ensure that the procedure is transparent and does not allow conflicts of interest.

**17** Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019
on market surveillance and compliance of products and amending Directive 2004/42/EC and
Regulations (EC) No 765/2008 and (EU) No 305/2011 (OJ L 169, 25.6.2019, p. 1).

PE-CONS 76/24 41

# LIFE.5 EN

(49) Users of wellness applications, including applications for mobile devices, should be

informed about the capacity of such applications to be connected and to supply data to

EHR systems or to national electronic health solutions in cases where data produced by

wellness applications are useful for healthcare purposes. The capability of those

applications to export data in an interoperable format is also relevant for data portability

purposes. Where applicable, users should also be informed about the compliance of such

wellness applications with interoperability and security requirements. However, given the

large number of wellness applications and the limited relevance for healthcare purposes of

the data produced by many of them, a certification scheme for these applications would not

be proportionate. A mandatory labelling scheme for wellness applications for which

interoperability with EHR systems is claimed should therefore be established as an

appropriate mechanism for providing transparency for the users of wellness applications

regarding compliance with requirements under this Regulation, thereby supporting users in

their choice of appropriate wellness applications with high standards of interoperability and

security. The Commission should set out by means of implementing acts the details

regarding the format and content of such label.

PE-CONS 76/24 42

# LIFE.5 EN

(50) Member States should remain free to regulate other aspects of the use of wellness

applications, provided that the corresponding rules are in compliance with Union law.

(51) The distribution of information on certified EHR systems and labelled wellness

applications is necessary to enable procurers and users of such products to find

interoperable solutions for their specific needs. A database of interoperable EHR systems

and wellness applications, which do not fall within the scope of Regulations

(EU) 2017/745 and (EU) 2024/1689, should therefore be established at Union level, similar

to the European database on medical devices (Eudamed) established by Regulation

(EU) 2017/745. The objectives of the EU database for registration of EHR systems and

wellness applications should be to enhance overall transparency, to avoid multiple

reporting requirements and to streamline and facilitate the flow of information. For medical

devices and AI systems, the registration should be maintained under the existing databases

established respectively under Regulations (EU) 2017/745 and (EU) 2024/1689, but the

compliance with interoperability requirements should be indicated by manufacturers when

they claim such compliance, in order to provide information to procurers.

PE-CONS 76/24 43

# LIFE.5 EN

(52) Without hindering or replacing contractual arrangements or other mechanisms in place,

this Regulation is aimed at establishing a common mechanism to access electronic health

data for secondary use across the Union. Under that mechanism, health data holders should

make the data they hold available on the basis of a data permit or a health data request. For

the purpose of processing electronic health data for secondary use, one of the legal bases

referred to in Article 6(1), points (a), (c), (e) or (f), of Regulation (EU) 2016/679 in

conjunction with Article 9(2) thereof is required. Accordingly, this Regulation provides for

a legal basis for the secondary use of personal electronic health data, including the

safeguards required under Article 9(2), points (g) to (j), of Regulation (EU) 2016/679 to

allow the processing of special categories of data, in terms of lawful purposes, trusted

governance for providing access to health data through the involvement of health data

access bodies, and processing in a secure processing environment, as well as arrangements

for data processing, set out in the data permit. Consequently, Member States should no

longer be able to maintain or introduce under Article 9(4) of Regulation (EU) 2016/679

further conditions, including limitations and specific provisions requesting the consent of

natural persons, with regard to the processing for secondary use of personal electronic

health data under this Regulation, with the exception of the introduction of stricter

measures and additional safeguards at national level aimed at safeguarding the sensitivity

and value of certain data as laid down in this Regulation. Health data applicants should

also demonstrate a legal basis referred to in Article 6 of Regulation (EU) 2016/679 that

allows them to request access to electronic health data pursuant to this Regulation and

should fulfil the conditions set out in Chapter IV thereof.

PE-CONS 76/24 44

# LIFE.5 EN

In addition, the health data access body should assess the information provided by the

health data applicant, based on which it should be able to issue a data permit for the

processing of personal electronic health data pursuant to this Regulation that should fulfil

the requirements and conditions set out in Chapter IV of this Regulation. For processing of

electronic health data held by the health data holders, this Regulation creates the legal

obligation within the meaning of Article 6(1), point (c), of Regulation (EU) 2016/679, in

accordance with Article 9(2), points (i) and (j), of that Regulation, for the health data

holder to make available the personal electronic health data to health data access bodies,

while the legal basis for the purpose of the initial processing, for example the delivery of

healthcare, is unaffected. This Regulation also assigns tasks in the public interest within

the meaning of Article 6(1), point (e), of Regulation (EU) 2016/679 to the health data

access bodies, and meets the requirements of Article 9(2), points (g) to (j), as applicable, of

that Regulation. If the health data user relies upon a legal basis set out in Article 6(1),

point (e) or (f), of Regulation (EU) 2016/679, this Regulation should provide for the

safeguards required under Article 9(2) of Regulation (EU) 2016/679.

PE-CONS 76/24 45

# LIFE.5 EN

(53) Electronic health data used for secondary use can bring great societal benefits. The uptake

of real-world data and real-world evidence, including patient-reported outcomes, for

evidence-based regulatory and policy purposes as well as for research, health technology

assessment and clinical objectives should be encouraged. Real-world data and real-world

evidence have the potential to complement health data currently made available. To

achieve that goal, it is important that datasets made available for secondary use pursuant to

this Regulation be as complete as possible. This Regulation provides the necessary

safeguards to mitigate certain risks involved in the achievement of those benefits. The

secondary use of electronic health data is based on pseudonymised or anonymised data, in

order to preclude the identification of the data subjects.

PE-CONS 76/24 46

# LIFE.5 EN

(54) To balance the need of health data users to have exhaustive and representative datasets

with the need for autonomy of natural persons over personal electronic health data of theirs

that are considered particularly sensitive, natural persons should be able to make the

decision as to whether their personal electronic health data can be processed for secondary

use under this Regulation, in the form of a right to opt out from having those data being

made available for secondary use. An easily understandable and accessible user-friendly

mechanism to exercise that right to opt out should be provided for. Moreover, it is

imperative to provide natural persons with sufficient and complete information regarding

their right to opt out, including on the benefits and drawbacks entailed by exercising that

right. Natural persons should not be required to give any reasons for opting out and should

have the possibility of reconsidering their choice at any time. However, for certain

purposes with a strong link to the public interest, such as activities for protection against

serious cross-border threats to health or scientific research for important reasons of public

interest, it is appropriate to provide for a possibility for Member States to establish, taking

into account their national context, mechanisms to provide access to personal electronic

health data of natural persons who have exercised their right to opt out, to ensure that

complete datasets can be made available in those situations. Such mechanisms should

comply with the requirements established for secondary use under this Regulation.

Scientific research for important reasons of public interest could for example include

research addressing unmet medical needs, including for rare diseases, or emerging health

threats. The rules on such overrides should respect the essence of the fundamental rights

and freedoms and be a necessary and proportionate measure in a democratic society to

fulfil the public interest in relation to legitimate scientific and societal objectives.

PE-CONS 76/24 47

# LIFE.5 EN

Such overrides should only be available to health data users that are public sector bodies,

or relevant Union institutions, bodies, offices or agencies, entrusted with the performance

of tasks in the area of public health, or to another entity entrusted with the performance of

public tasks in the area of public health or acting on behalf of or commissioned by a public

authority, and only where the data cannot be obtained by alternative means in a timely and

effective manner. Those health data users should justify that the use of the override is

necessary for an individual health data access application or health data request. When

such an override is applied, the safeguards under Chapter IV should continue to be applied

by health data users, in particular the prohibition of re-identification or attempting to re

identify the natural persons concerned.

(55) In the context of the EHDS, electronic health data already exist and are being collected by,

among others, healthcare providers, professional associations, public institutions,

regulators, researchers and insurers in the course of their activities. Those data should also

be made available for secondary use, that is to say for processing of data for purposes other

than those for which they were collected or produced, however, many of such data are not

made available for processing for such purposes. This limits the ability of researchers,

innovators, policy-makers, regulators and doctors to use those data for different purposes,

including research, innovation, policy-making, regulatory purposes, patient safety or

personalised medicine. In order to fully exploit the benefits of secondary use, all health

data holders should contribute to this effort in making different categories of electronic

health data they are holding available for secondary use provided that such effort is always

made through effective and secured processes, with due respect for professional duties,

such as confidentiality duties.

PE-CONS 76/24 48

# LIFE.5 EN

(56) The categories of electronic health data that can be processed for secondary use should be

broad and flexible enough to accommodate the evolving needs of health data users, while

remaining limited to data related to health or known to influence health. They can also

include relevant data from the health system, for example electronic health records, claims

data, dispensation data, data from disease registries or genomic data, as well as data with

an impact on health, for example data on consumption of different substances, socio

economic status or behaviour, and data on environmental factors such as pollution,

radiation or the use of certain chemical substances. The categories of electronic health data

for secondary use include some categories of data that were initially collected for other

purposes such as research, statistics, patient safety, regulatory activities or policy making,

for example, policy-making registries or registries concerning the side effects of medicinal

products or medical devices. European databases that facilitate use or reuse of data are

available in some areas, such as cancer (the European Cancer Information System) or rare

diseases (for example, the European Platform on Rare Disease Registration and European

reference networks (ERN) registries). The categories of electronic health data that can be

processed for secondary use should also include automatically generated data from medical

devices and person-generated data, such as data from wellness applications. Data on

clinical trials and clinical investigations should also be included in the categories of

electronic health data for secondary use when the clinical trial or clinical investigation has

ended, without affecting any voluntary data sharing by the sponsors of ongoing trials and

investigations. Electronic health data for secondary use should be made available

preferably in a structured electronic format that facilitates their processing by computer

systems. Examples of structured electronic formats include records in a relational database,

XML documents or CSV files and free text, audios, videos and images provided as

computer-readable files.

PE-CONS 76/24 49

# LIFE.5 EN

(57) Health data users who benefit from access to datasets provided for under this Regulation

could enrich the data in those datasets with various corrections, annotations and other

improvements, for instance by supplementing missing or incomplete data, thus improving

the accuracy, completeness or quality of the data in the datasets. Health data users should

be encouraged to report critical errors in datasets to health data access bodies. To support

the improvement of the initial database and further use of the enriched dataset, Member

States should be able to establish rules for the processing and the use of electronic health

data containing improvements related to the processing of those data. The improved dataset

should be made available free of charge to the original health data holder together with a

description of the improvements. The health data holder should make the new dataset

available, unless it provides a justified notification to the health data access body for not

doing so, for instance in cases in which the enrichment by the health data user is of low

quality. It should be ensured that non-personal electronic health data are available for

secondary use. In particular, pathogen genomic data hold significant value for human

health, as shown during the COVID-19 pandemic during which timely access to and

sharing of such data proved to be essential for the rapid development of detection tools,

medical countermeasures and responses to public health threats. The greatest benefit from

pathogen genomics efforts will be achieved when public health and research processes

share datasets and cooperate to inform and improve each other.

PE-CONS 76/24 50

# LIFE.5 EN

(58) In order to increase the effectiveness of the secondary use of personal electronic health

data, and to fully benefit from the possibilities offered by this Regulation, the availability

in the EHDS of electronic health data described in Chapter IV should be such that the data

are as accessible, high-quality, ready and suitable for the purpose of creating scientific,

innovative and societal value and quality as possible. Work on the implementation of the

EHDS and further dataset improvements should be conducted in a manner that prioritises

the datasets that are the most suitable for creating such value and quality.

PE-CONS 76/24 51

# LIFE.5 EN

(59) Public or private entities often receive public funding from national or Union funds to

collect and process electronic health data for research, official or unofficial statistics, or

other similar purposes, including in areas where the collection of such data is fragmented

or difficult, such as in relation to rare diseases or cancer. Such data, collected and

processed by health data holders with the support of Union or national public funding,

should be made available to health data access bodies, in order to maximise the impact of

the public investment and support research, innovation, patient safety or policy making,

benefiting society. In some Member States, private entities, including private healthcare

providers and professional associations, play a pivotal role in the health sector. The health

data held by such providers should also be made available for secondary use. The health

data holders in the context of secondary use should therefore be entities that are healthcare

providers or care providers or carry out research with regard to the healthcare or care

sectors, or develop products or services intended for the healthcare or care sectors. Such

entities can be public, not for profit or private. In line with this definition, nursing homes,

day-care centres, entities providing services for people with disabilities, entities carrying

out business and technological activities related to care such as orthopaedics and

companies providing care services should be considered health data holders. Legal persons

developing wellness applications should also be considered health data holders. Union

institutions, bodies, offices or agencies that process those categories of health and

healthcare data as well as mortality registries should also be considered health data holders.

PE-CONS 76/24 52

# LIFE.5 EN

In order to avoid a disproportionate burden for natural persons and microenterprises, they

should be, as a general rule, exempted from the obligations on health data holders. Member

States should, however, be able to extend the obligations of health data holders to natural

persons and microenterprises in their national law. To reduce the administrative burden,

and in light of the effectiveness and efficiency principles, Member States should be able to

require in their national law that health data intermediation entities carry out the duties of

certain categories of health data holders. Such health data intermediation entities should be

legal persons able to process, make available, register, provide, restrict access to, and

exchange electronic health data for secondary use provided by health data holders. Such

health data intermediation entities perform tasks that differ from those of data

intermediation services under Regulation (EU) 2022/868.

PE-CONS 76/24 53

# LIFE.5 EN

(60) Electronic health data protected by intellectual property rights or trade secrets, including

data on clinical trials, investigations and studies, can be very useful for secondary use and

can foster innovation within the Union for the benefit of Union patients. In order to

incentivise continuous Union leadership in this domain, it is important to encourage the

sharing of clinical trials and clinical investigations data through the EHDS for secondary

use. Clinical trials and clinical investigations data should be made available to the extent

possible, while taking all necessary measures to protect intellectual property rights and

trade secrets. This Regulation should not be used to reduce or circumvent such protection

and should be consistent with the relevant transparency provisions laid down in Union law,

including for clinical trials and clinical investigations data. Health data access bodies

should assess how to preserve such protection while enabling access to such data for health

data users to the extent possible. If a health data access body is unable to provide access to

such data, it should inform the health data user and explain why it is not possible to

provide such access. Legal, organisational and technical measures to protect intellectual

property rights or trade secrets could include common electronic health data access

contractual arrangements, specific obligations within the data permit in relation to such

rights, pre-processing the data to generate derived data that protect a trade secret but

nonetheless have a utility for the health data user or configuration of the secure processing

environment so that such data are not accessible to the health data user.

PE-CONS 76/24 54

# LIFE.5 EN

(61) The secondary use of health data under the EHDS should enable public, private and

not-for-profit entities, as well as individual researchers, to have access to health data for

research, innovation, policy making, educational activities, patient safety, regulatory

activities or personalised medicine, in line with the purposes as set out in this Regulation.

Access to data for secondary use should contribute to the general interest of society. In

particular, the secondary use of health data for research and development purposes should

contribute to benefiting society in the form of new medicines, medical devices, and

healthcare products and services at affordable and fair prices for Union citizens, as well as

to enhancing access to and the availability of such products and services in all Member

States. Activities for which access in the context of this Regulation is lawful could include

using the electronic health data for tasks carried out by public sector bodies, such as the

exercise of public duty, including public health surveillance, planning and reporting duties,

health policy making, and ensuring patient safety, quality of care and the sustainability of

healthcare systems. Public sector bodies and Union institutions, bodies, offices and

agencies might need to have regular access to electronic health data for an extended period

of time, including in order to fulfil their mandate, as is provided for in this Regulation.

Public sector bodies could carry out such research activities by using third parties,

including sub-contractors, as long as the public sector body remains at all time the

supervisor of those activities. The provision of the data should also support activities

related to scientific research. The notion of scientific research purposes should be

interpreted in a broad manner, including technological development and demonstration,

fundamental research, applied research and privately funded research.

PE-CONS 76/24 55

# LIFE.5 EN

Activities related to scientific research include innovation activities such as training of AI

algorithms that could be used in healthcare or the care of natural persons, as well as the

evaluation and further development of existing algorithms and products for such purposes.

It is necessary that the EHDS also contribute to fundamental research, and, although its

benefits to end-users and patients might be less direct, such fundamental research is crucial

for societal benefits in the longer term. In some cases, the information of some natural

persons, such as genomic information of natural persons with a certain disease, could

contribute to the diagnosis or treatment of other natural persons. There is a need for public

sector bodies to go beyond the scope of ‘exceptional need’ of Chapter V of Regulation

(EU) 2023/2854. However, health data access bodies should be allowed to provide support

to public sector bodies when processing or linking data. This Regulation provides for a

channel for public sector bodies to obtain access to information that they require for

fulfilling the tasks assigned to them by law, but does not extend the mandate of such public

sector bodies.

PE-CONS 76/24 56

# LIFE.5 EN

(62) Any attempt to use electronic health data for measures detrimental to natural persons, such

as to increase insurance premiums, to engage in activities potentially detrimental to natural

persons related to employment, pensions or banking, including mortgaging of properties, to

advertise products or treatments, to automate individual decision-making, to re-identify

natural persons or to develop harmful products should be prohibited. That prohibition

should also apply to activities contrary to ethical provisions under national law, with the

exception of ethical provisions relating to consent to the processing of personal data and

ethical provisions relating to the right to opt out, since this Regulation takes precedence

over national law in accordance with the general principle of the primacy of Union law. It

should also be prohibited to provide access to, or otherwise make available, electronic

health data to third parties not mentioned in the data permit. The identity of authorised

persons, in particular the identity of the principal investigator, who will have the right

pursuant to this Regulation to access electronic health data in the secure processing

environment should be indicated in the data permit. The principal investigators are the

main persons responsible for requesting access to the electronic health data and for

processing the requested data within the secure processing environment on behalf of the

health data user.

PE-CONS 76/24 57

# LIFE.5 EN

(63) This Regulation does not create an empowerment for the secondary use of health data for

the purpose of law enforcement. The prevention, investigation, detection or prosecution of

criminal offences or the execution of criminal penalties by the competent authorities

should not be among the secondary use purposes covered under this Regulation. Therefore,

courts and other entities of the justice system should not be considered health data users for

the secondary use of health data under this Regulation. In addition, courts and other entities

of the justice system should not be covered under the definition of health data holders and

should not therefore be addressees of obligations on health data holders under this

Regulation. Moreover, the powers of the competent authorities for the prevention,

investigation, detection and prosecution of criminal offences established by law to obtain

electronic health data are unaffected by this Regulation. Likewise, electronic health data

held by courts for the purpose of judicial proceedings are outside the scope of this

Regulation.

PE-CONS 76/24 58

# LIFE.5 EN

(64) The establishment of one or more health data access bodies, supporting access to electronic

health data in Member States, is essential to promoting the secondary use of health-related

data. Member States should therefore establish one or more health data access bodies to

reflect, inter alia, their constitutional, organisational and administrative structure. However,

one of those health data access bodies should be designated as a coordinator in the event

there is more than one health data access body. Where a Member State establishes several

health data access bodies, it should lay down rules at national level to ensure the

coordinated participation of those bodies in the European Health Data Space Board

(the ‘EHDS Board’). That Member State should, in particular, designate one health data

access body to function as a single contact point for the effective participation of those

bodies, and ensure swift and smooth cooperation with other health data access bodies, the

EHDS Board and the Commission. Health data access bodies could vary in terms of

organisation and size, spanning from a dedicated fully fledged organisation to a unit or

department in an existing organisation. Health data access bodies should not be influenced

in their decisions on access to electronic data for secondary use and should avoid any

conflicts of interest. Therefore, members of the governance and decision-making bodies of

each health data access body and its staff should refrain from any action that is

incompatible with their duties and should not engage in any incompatible occupation.

PE-CONS 76/24 59

# LIFE.5 EN

However, the independence of the health data access bodies should not mean that they

cannot be subject to control or monitoring mechanisms regarding their financial

expenditure or to judicial review. Each health data access body should be provided with the

financial, technical and human resources, premises and infrastructure necessary for the

effective performance of its tasks, including those related to cooperation with other health

data access bodies throughout the Union. The members of the governance and

decision-making bodies of health data access bodies and their staff should have the

necessary qualifications, experience and skills. Each health data access body should have a

separate public annual budget, which could be part of the overall state or national budget.

In order to enable better access to health data and complementing Article 7(2) of

Regulation (EU) 2022/868, Member States should entrust health data access bodies with

powers to take decisions on access to and secondary use of health data. This could consist

in allocating new tasks to the competent bodies designated by Member States under

Article 7(1) of Regulation (EU) 2022/868 or in designating existing or new sectoral bodies

responsible for such tasks in relation to access to health data.

PE-CONS 76/24 60

# LIFE.5 EN

(65) Health data access bodies should monitor the application of Chapter IV of this Regulation

and contribute to its consistent application throughout the Union. For that purpose, health

data access bodies should cooperate with each other and with the Commission. Health data

access bodies should also cooperate with stakeholders, including patient organisations.

Health data access bodies should support health data holders that are small enterprises in

accordance with Commission Recommendation 2003/361/EC **[18]**, in particular medical

practitioners and pharmacies. Since the secondary use of health data involves the

processing of personal data concerning health, the relevant provisions of Regulations

(EU) 2016/679 and (EU) 2018/1725 apply and the supervisory authorities under those

Regulations should remain the only authorities competent for enforcing those provisions.

Health data access bodies should inform the data protection authorities of any penalties

imposed and any potential issues related to data processing for secondary use and exchange

any relevant information at their disposal to ensure enforcement of the relevant rules. In

addition to the tasks necessary to ensure effective secondary use of health data, the health

data access body should strive to expand the availability of additional health datasets, and

promote the development of common standards. They should apply tested state-of-the-art

techniques that ensure electronic health data are processed in a manner that preserves the

privacy of the information contained in the data for which secondary use is allowed,

including techniques for pseudonymisation, anonymisation, generalisation, suppression

and randomisation of personal data. Health data access bodies can prepare datasets for the

health data user as required under the issued data permit. In that regard, health data access

bodies should cooperate across borders to develop and exchange best practices and

techniques. This includes rules for pseudonymisation and anonymisation of micro datasets.

When relevant, the Commission should set out the procedures and requirements, and

provide technical tools, for a unified procedure for pseudonymising and anonymising

electronic health data.

**18** Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of
micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

PE-CONS 76/24 61

# LIFE.5 EN

(66) Health data access bodies should ensure that secondary use is transparent by providing

public information about the data permits granted and their justifications, the measures

taken to protect the rights of natural persons, the means for natural persons to exercise their

rights in relation to secondary use, and the outcomes of secondary use including through

links to scientific publications. Where appropriate, that information on the outcomes of

secondary use should also include a lay summary to be provided by the health data user.

Those transparency obligations complement the obligations laid down in Article 14 of

Regulation (EU) 2016/679. The exceptions provided for in Article 14(5) of that Regulation

could apply. Where such exceptions do apply, the transparency obligations established in

this Regulation should contribute to ensuring fair and transparent processing as referred to

in Article 14(2) of Regulation (EU) 2016/679, for example through providing information

on the purpose of the processing and the data categories processed, thereby enabling

natural persons to understand whether their data are being made available for secondary

use pursuant to data permits.

PE-CONS 76/24 62

# LIFE.5 EN

(67) Natural persons should be informed by the health data holders about significant findings

related to their health made by health data users. Natural persons should have the right to

request not to be informed of such findings. Member States could lay down conditions on

the arrangements for the provision by the health data holders of such information to the

natural persons concerned and on the exercise of the right not to be informed. Member

States should be able, in accordance with Article 23(1), point (i), of Regulation

(EU) 2016/679, to restrict the scope of the obligation to inform natural persons whenever

necessary for their protection based on patient safety and ethics, by delaying the

communication of their information until a health professional can communicate and

explain to the natural persons concerned information that potentially can have an impact on

their health.

PE-CONS 76/24 63

# LIFE.5 EN

(68) In order to promote transparency, health data access bodies should also publish activity

reports, every two years, providing an overview of their activities. Where a Member State

has designated more than one health data access body, the coordinating body should

prepare and publish a common report every two years. Activity reports should follow a

structure agreed by the EHDS Board and provide an overview of activities, including

information regarding decisions on applications, audits and engagement with relevant

stakeholders. Such stakeholders can include representatives of natural persons, patient

organisations, health professionals, researchers and ethical committees.

(69) In order to support secondary use, health data holders should refrain from withholding the

data, requesting unjustified fees that are not transparent or proportionate to the costs of

making the data available or, where relevant, to marginal costs of data collection,

requesting the health data users to co-publish the research or other practices that could

dissuade the health data users from requesting the data. Where a health data holder is a

public sector body, the part of the fees linked to its costs should not cover the costs of the

initial collection of the data. Where ethical approval is necessary for providing a data

permit, the evaluation related to ethical approval should be based on its own merits.

PE-CONS 76/24 64

# LIFE.5 EN

(70) Health data access bodies should be allowed to charge fees, taking into account the

horizontal rules provided by Regulation (EU) 2022/868, in relation to their tasks. Such fees

could take into account the situation and interest of small and medium-sized enterprises

(SMEs), individual researchers or public sector bodies. In particular, Member States should

be able to establish measures for health data access bodies in their jurisdiction which make

it possible to charge certain categories of health data users reduced fees. Health data access

bodies should be able to cover the costs of their operations with fees set up in a

proportionate, justified and transparent manner. This could result in higher fees for some

health data users, if handling their health data access applications and health data requests

requires more work. Health data holders should be allowed to also ask for fees for making

data available, which reflect their costs. Health data access bodies should decide on the

amount of such fees, which could also include the fees requested by health data holders.

The health data user ought to be charged such fees by the health data access body in a

single invoice. The health data access body should then transfer the relevant part of the

paid fees to the health data holder. In order to ensure a harmonised approach concerning

fee policies and structure, implementing powers should be conferred on the Commission.

Article 10 of Regulation (EU) 2023/2854 should apply to fees charged under this

Regulation.

PE-CONS 76/24 65

# LIFE.5 EN

(71) In order to strengthen the enforcement of the rules on secondary use, appropriate measures

that can lead to administrative fines or enforcement measures by health data access bodies

or temporary or definitive exclusions from the EHDS framework of health data users or

health data holders that do not comply with their obligations should be envisaged. Health

data access bodies should be empowered to verify compliance of health data users and

health data holders and give them the opportunity to reply to any findings and to remedy

any infringement. When deciding on the amount of the administrative fine or on an

enforcement measure for each individual case, health data access bodies should take into

account the cost margins and the criteria set out in this Regulation, ensuring that those

fines or measures are proportionate.

PE-CONS 76/24 66

# LIFE.5 EN

(72) Given the sensitivity of electronic health data, it is necessary to reduce risks for the privacy

of natural persons by applying the data minimisation principle. Therefore, non-personal

electronic health data should be made available in all cases where the provision of such

data is sufficient. If the health data user needs to use personal electronic health data, it

should clearly indicate in its request the justification for the use of that type of data and the

health data access body should assess whether that justification is valid. The personal

electronic health data should only be made available in pseudonymised format. Taking into

account the specific purposes of the processing, personal electronic health data should be

pseudonymised or anonymised as early as possible in the process of making data available

for secondary use. It should be possible for pseudonymisation and anonymisation to be

carried out by health data access bodies or by health data holders. As controllers, health

data access bodies and health data holders should be allowed to delegate those tasks to

processors. When providing access to a pseudonymised or anonymised dataset, a health

data access body should use state-of-the-art pseudonymisation or anonymisation

technology and standards, ensuring to the maximum extent possible that natural persons

cannot be re-identified by health data users. Such technologies and standards for data

pseudonymisation or anonymisation should be further developed. Health data users should

not attempt to re-identify natural persons from the dataset provided under this Regulation,

and where they do so they should be subject to administrative fines and enforcement

measures laid down in this Regulation or possible criminal penalties, where national law so

provides. Moreover, a health data applicant should be able to request a response to a health

data request in an anonymised statistical format. In such cases, the health data user will

only process non-personal data, and the health data access body will remain sole controller

for any personal data necessary to provide the response to the health data request.

PE-CONS 76/24 67

# LIFE.5 EN

(73) In order to ensure that all health data access bodies issue data permits in a similar way, it is

necessary to establish a standard common process for the issuance of data permits, with

similar requests in different Member States. The health data applicant should provide

health data access bodies with several elements of information that would help the body

evaluate the health data access application and decide if the health data applicant can

receive a data permit, and coherence should be ensured between different health data

access bodies. The information provided as part of the health data access application

should comply with the requirements established under this Regulation in order to enable it

to be thoroughly assessed, as a data permit should only be issued if all the necessary

conditions set out in this Regulation are met. In addition, where relevant, that information

should include a declaration by the health data applicant that the intended use of the health

data requested does not pose a risk of stigmatisation, or of causing harm to the dignity, of

natural persons or groups to which the dataset requested relates. An ethical assessment

could be requested based on national law. In that case, it should be possible for existing

ethics bodies to carry out such assessments for the health data access body. Existing ethics

bodies of Member States should make their expertise available to the health data access

body for that purpose. Alternatively, Member States should be able to provide for ethics

bodies to be part of the health data access body. The health data access body, and where

relevant health data holders, should assist health data users in the selection of the suitable

datasets or data sources for the intended purpose of secondary use. Where the health data

applicant needs data in an anonymised statistical format, it should submit a health data

request, requiring the health data access body to provide the result directly. A refusal of a

data permit by the health data access body should not preclude the health data applicant

from submitting a new health data access application. In order to ensure a harmonised

approach between health data access bodies and to limit the administrative burden for the

health data applicants, the Commission should support the harmonisation of health data

access applications, as well as health data requests, including by establishing the relevant

templates. In justified cases, such as in the case of a complex and burdensome request, the

health data access body should be allowed to extend the time period for health data holders

to make the requested electronic health data available to it.

PE-CONS 76/24 68

# LIFE.5 EN

(74) As their resources are limited, health data access bodies should be allowed to apply

prioritisation rules, for instance prioritising public institutions over private entities, but

they should not discriminate between the national organisations and organisations from

other Member States within the same category of priorities. A health data user should be

able to extend the duration of the data permit in order, for example, to allow access to the

datasets to reviewers of scientific publications or to enable additional analysis of the

dataset based on the initial findings. This should require an amendment of the data permit

and could be subject to an additional fee. However, in all cases, the data permit should

reflect such additional uses of the dataset. Preferably, the health data user should mention

them in their initial health data access application. In order to ensure a harmonised

approach between health data access bodies, the Commission should support the

harmonisation of data permits.

(75) As the COVID-19 crisis has shown, the Union institutions, bodies, offices and agencies

with a legal mandate in the field of public health, especially the Commission, need access

to health data for a longer period and on a recurring basis. This may be the case not only

for specific circumstances provided for in Union or national law in times of crisis but also

to provide scientific evidence and technical support for Union policies on a regular basis.

Access to such data could be required in specific Member States or throughout the whole

territory of the Union. Such Union institutions, bodies, offices and agencies should be able

to benefit from an accelerated procedure for having data made available, ordinarily in less

than two months, with a possibility of prolonging the timeline by one month in more

complex cases.

PE-CONS 76/24 69

# LIFE.5 EN

(76) Member States should be able to designate trusted health data holders for which the data

permit issuing procedure can be performed in a simplified manner, in order to alleviate the

administrative burden for health data access bodies of managing requests for the data

processed by them. Trusted health data holders should be allowed to assess the health data

access applications submitted under this simplified procedure, based on their expertise in

dealing with the type of health data they are processing, and issue a recommendation

regarding a data permit. The health data access body should remain responsible for issuing

the final data permit and should not be bound by the recommendation provided by the

trusted health data holder. Health data intermediation entities should not be designated as

trusted health data holders.

PE-CONS 76/24 70

# LIFE.5 EN

(77) Given the sensitivity of electronic health data, health data users should not have

unrestricted access to such data. All secondary use access to the requested electronic health

data should be done through a secure processing environment. In order to ensure there are

strong technical and security safeguards in place for the electronic health data, the health

data access body or, where relevant, the trusted health data holder should provide access to

such data in a secure processing environment, complying with the high technical and

security standards set out pursuant to this Regulation. The processing of personal data in

such a secure processing environment should comply with Regulation (EU) 2016/679,

including, where the secure processing environment is managed by a third party, the

requirements of Article 28 of that Regulation and, where applicable, Chapter V thereof.

Such secure processing environment should reduce the privacy risks related to such

processing activities and prevent the electronic health data from being transmitted directly

to the health data users. The health data access body or the health data holder providing

that service should remain at all times in control of the access to the electronic health data,

and the access granted to the health data users should be determined by the conditions of

the issued data permit. Only non-personal electronic health data which do not contain any

personal electronic health data should be downloaded by the health data users from such

secure processing environment. Thus, such a secure processing environment is an essential

safeguard to preserve the rights and freedoms of natural persons in relation to the

processing of their electronic health data for secondary use. The Commission should assist

the Member States in developing common security standards in order to promote the

security and interoperability of the various secure processing environments.

PE-CONS 76/24 71

# LIFE.5 EN

(78) Regulation (EU) 2022/868 sets out the general rules for the management of data altruism.

Given that the health sector manages sensitive data, additional criteria should be

established through the rulebook referred to in that Regulation. Where such rules provide

for the use of a secure processing environment for that sector, such secure processing

environment should comply with the criteria established in this Regulation. The health data

access bodies should cooperate with the competent authorities designated under Regulation

(EU) 2022/868 to supervise the activity of data altruism organisations in the health or care

sector.

PE-CONS 76/24 72

# LIFE.5 EN

(79) For the processing of electronic health data in the scope of a data permit or a health data

request, health data holders, including trusted health data holders, health data access bodies

and health data users should be deemed each of them, in turn, controllers for a specific part

of the process and according to their respective roles therein. Health data holders should be

deemed controllers for the disclosure of the requested personal electronic health data to the

health data access bodies, while the health data access bodies should in turn be deemed

controllers for the processing of the personal electronic health data when preparing the data

and making them available to the health data users. Health data users should be deemed

controllers for the processing of personal electronic health data in pseudonymised form in

the secure processing environment pursuant to their data permits. Health data access bodies

should be deemed processors on behalf of the health data user for the processing carried

out by the health data user pursuant to a data permit in the secure processing environment

as well as for the processing to generate a response to a health data request. Similarly,

trusted health data holders should be deemed controllers for their processing of personal

electronic health data related to the provision of electronic health data to the health data

user pursuant to a data permit or a health data request. The trusted health data holders

should be deemed processors for the health data user when providing data through a secure

processing environment.

PE-CONS 76/24 73

# LIFE.5 EN

(80) In order to achieve an inclusive and sustainable framework for multi-country secondary

use, a cross-border infrastructure should be established (‘HealthData@EU’).

HealthData@EU should accelerate secondary use while increasing legal certainty,

respecting the privacy of natural persons and being interoperable. Due to the sensitivity of

health data, principles such as ‘privacy by design’ and ‘privacy by default’ and the concept

of bringing questions to data instead of moving those data should be respected whenever

possible. Member States should designate national contact points for secondary use, as

organisational and technical gateways for health data access bodies, and connect those

contact points to HealthData@EU. The Union health data access service should also be

connected to HealthData@EU. In addition, authorised participants in HealthData@EU

could be research infrastructures established as a European Research Infrastructure

Consortium (‘ERIC’) under Council Regulation (EC) No 723/2009 **[19]**, as a European digital

infrastructure consortium (‘EDIC’) under Decision (EU) 2022/2481 or similar

infrastructures established under other Union legal acts, as well as other types of entities,

including infrastructures under the European Strategy Forum on Research Infrastructures

(ESFRI) or infrastructures federated under the European Open Science Cloud (EOSC).

Third countries and international organisations could also become authorised participants

in HealthData@EU, provided that they are compliant with the requirements in this

Regulation.

**19** Council Regulation (EC) No 723/2009 of 25 June 2009 on the Community legal framework
for a European Research Infrastructure Consortium (ERIC) (OJ L 206, 8.8.2009, p. 1).

PE-CONS 76/24 74

# LIFE.5 EN

The Commission communication of 19 February 2020 entitled ‘A European strategy for

data’ promoted the linking of the various common European data spaces. HealthData@EU

should therefore enable the secondary use of different categories of electronic health data,

including linking of the health data with data from other data spaces such as those relating

to the environment, agriculture and social sector. Such interoperability between the health

sector and other sectors such as the environmental, agricultural or social sectors could be

relevant for obtaining additional insights on health determinants. The Commission could

provide a number of services within HealthData@EU, including supporting the exchange

of information amongst health data access bodies and authorised participants in

HealthData@EU for the handling of cross-border access requests, maintaining catalogues

of electronic health data available through the infrastructure, network discoverability and

metadata queries, connectivity and compliance services. The Commission could also set up

a secure processing environment, allowing data from different national infrastructures to be

transmitted and analysed, at the request of the controllers. For the sake of IT efficiency,

rationalisation and interoperability of data exchanges, existing systems for data sharing

should be reused as much as possible, such as those being built for the exchange of

evidence under the ‘once-only’ technical system of Regulation (EU) 2018/1724 of the

European Parliament and of the Council **[20]** .

**20** Regulation (EU) 2018/1724 of the European Parliament and of the Council of 2 October
2018 establishing a single digital gateway to provide access to information, to procedures
and to assistance and problem-solving services and amending Regulation
(EU) No 1024/2012 (OJ L 295, 21.11.2018, p. 1).

PE-CONS 76/24 75

# LIFE.5 EN

(81) In addition, given that the connection to HealthData@EU could entail transfers of personal

data related to the applicant or the health data user to third countries, relevant transfer

instruments under Chapter V of Regulation (EU) 2016/679 need to be in place for such

transfers.

(82) In the case of cross-border registries or databases, such as the registries of European

Reference Networks for Rare Diseases, which receive data from different healthcare

providers in several Member States, the health data access body of the Member State

where the coordinator of the registry is located should be responsible for providing access

to data.

PE-CONS 76/24 76

# LIFE.5 EN

(83) The authorisation process to gain access to personal electronic health data in different

Member States can be repetitive and cumbersome for health data users. Whenever

possible, synergies should be established to reduce the burden and barriers for health data

users. One way to achieve that aim is to adhere to the ‘single application’ principle

whereby, with one application, the health data user can obtain authorisation from multiple

health data access bodies in different Member States or authorised participants in

HealthData@EU.

(84) The health data access bodies should provide information about the available datasets and

their characteristics so that health data users can be informed of elementary facts about the

dataset and assess the possible relevance of those facts to those users. For this reason, each

dataset should include, at least, information concerning the source and nature of the data

and the conditions for making the data available. The health data holder should, at least

every year, check that its dataset description in the national dataset catalogue is accurate

and up to date. Therefore, an EU dataset catalogue should be established to: facilitate the

discoverability of datasets available in the EHDS; help health data holders to publish their

datasets; provide all stakeholders, including the general public, taking into account the

specific needs of people with disabilities, with information about datasets placed on the

EHDS, such as quality and utility labels and dataset information sheets; and provide health

data users with up-to-date data quality and utility information about datasets.

PE-CONS 76/24 77

# LIFE.5 EN

(85) Information on the quality and utility of datasets increases the value of outcomes from

data-intensive research and innovation significantly while, at the same time, promoting

evidence-based regulatory and policy decision-making. Improving the quality and utility of

datasets through informed customer choice and harmonising related requirements at Union

level, taking into account existing Union and international standards, guidelines and

recommendations for data collection and data exchange, such as FAIR principles, also

benefits health data holders, health professionals, natural persons and the Union economy

overall. A data quality and utility label for datasets would inform health data users about

the quality and utility characteristics of a dataset and enable them to choose the datasets

that best fit their needs. The data quality and utility label should not prevent datasets from

being made available through the EHDS, but provide a transparency mechanism between

health data holders and health data users. For example, a dataset that does not fulfil any

requirement of data quality and utility should be labelled with the class representing the

poorest quality and utility, but should still be made available. Expectations set by

frameworks created pursuant to Article 10 of Regulation (EU) 2024/1689 and the relevant

technical documentation specified in Annex IV to that Regulation should be taken into

account when developing the data quality and utility framework. Member States should

raise awareness about the data quality and utility label through communication activities.

The Commission could support those activities. The use of datasets could be prioritised by

their users according to their usefulness and quality.

PE-CONS 76/24 78

# LIFE.5 EN

(86) The EU dataset catalogue should minimise the administrative burden for the health data

holders and other database users, be user-friendly, accessible and cost-effective, connect

national dataset catalogues and avoid redundant registration of datasets. Without prejudice

to the requirements set out in Regulation (EU) 2022/868, the EU dataset catalogue could be

aligned with the data.europa.eu initiative. Interoperability should be ensured between the

EU dataset catalogue, the national dataset catalogues and the dataset catalogues from

European research infrastructures and other relevant data sharing infrastructures.

(87) Cooperation and work is ongoing between different professional organisations, the

Commission and other institutions to set up minimum data fields and other characteristics

of different datasets, for instance registries. That work is more advanced in areas such as

cancer, rare diseases, cardiovascular and metabolic diseases, risk factor assessment and

statistics, and should be taken into account when defining new standards and disease

specific harmonised templates for structured data elements. However, many datasets are

not harmonised, raising comparability issues and making cross-border research difficult.

Therefore, more detailed rules should be set out in implementing acts to ensure a

harmonised coding and registration of electronic health data to enable the supply of such

data for secondary use in a consistent way. Such datasets could include data from registries

of rare diseases, orphan drugs databases, cancer registries and registries of highly relevant

infectious diseases. Member States should work towards ensuring that European electronic

health systems and services and interoperable applications deliver sustainable economic

and social benefits, with a view to achieving a high level of trust and security, enhancing

continuity of healthcare and ensuring access to safe and high-quality healthcare. Existing

health data infrastructures and registries can provide models that are useful for defining

and implementing data standards and interoperability and should be leveraged to enable

continuity and to build on existing expertise.

PE-CONS 76/24 79

# LIFE.5 EN

(88) The Commission should support Member States in building capacity and enhancing

effectiveness in the area of digital health systems for primary use and secondary use.

Member States should be supported to strengthen their capacity. Activities at Union level,

such as benchmarking and exchange of best practices, are relevant measures in that respect.

Those activities should take into account the specific circumstances of different categories

of stakeholders, such as representatives of civil society, researchers, medical societies and

SMEs.

PE-CONS 76/24 80

# LIFE.5 EN

(89) Improving digital health literacy for both natural persons and health professionals is

essential to trust and safety and appropriate use of health data and thus is essential to

achieving a successful implementation of this Regulation. Health professionals are faced

with profound changes in the context of digitalisation and will be offered further digital

tools as part of the implementation of the EHDS. Consequently, health professionals need

to develop their digital health literacy and digital skills and Member States should provide

access for health professionals to digital literacy courses so that they can prepare to work

with EHR systems. Such courses should allow health professionals and IT operators to

receive sufficient training in working with new digital infrastructures to ensure

cybersecurity and ethical management of health data. The training courses should be

developed and reviewed, and kept up to date, on a regular basis in consultation and

cooperation with relevant experts. Improving digital health literacy is fundamental in order

to empower natural persons to have true control over their health data, actively manage

their health and care, and understand the implications of the management of such data for

both primary use and secondary use. Different demographic groups have varying degrees

of digital literacy, which can affect natural persons’ ability to exercise their rights to

control their electronic health data. Member States, including regional and local

authorities, should therefore support digital health literacy and public awareness, while

ensuring that the implementation of this Regulation contributes to reducing inequalities

and does not discriminate against people lacking digital skills. Particular attention should

be given to persons with disabilities and vulnerable groups including migrants and the

elderly. Member States should create targeted national digital literacy programmes,

including programmes to maximise social inclusion and to ensure all natural persons can

effectively exercise their rights under this Regulation. Member States should also provide

patient-centric guidance to natural persons in relation to the use of electronic health records

and primary use of their personal electronic health data. Guidance should be tailored to the

patient’s level of digital health literacy, with specific attention to be given to the needs of

vulnerable groups.

PE-CONS 76/24 81

# LIFE.5 EN

(90) The use of funds should also contribute to attaining the objectives of the EHDS. Public

procurers, national competent authorities in the Member States, including digital health

authorities and health data access bodies, and the Commission should make references to

applicable technical specifications, standards and profiles on interoperability, security and

data quality, as well as other requirements developed under this Regulation, when defining

the conditions for public procurement, calls for proposals and allocation of Union funds,

including structural and cohesion funds. Union funds need to be distributed transparently

among the Member States, taking into account the different levels of health system

digitalisation. Making data available for secondary use requires additional resources for

healthcare systems, in particular public healthcare systems. That additional burden should

be addressed and minimised during the implementation phase of the EHDS.

(91) The implementation of the EHDS requires appropriate investment in capacity-building and

training and a well-funded commitment to public consultation and engagement both at

Union and national level. The economic costs of implementing this Regulation will need to

be borne at both Union and national level, and a fair sharing of that burden between Union

and national funds will need to be found.

PE-CONS 76/24 82

# LIFE.5 EN

(92) Certain categories of electronic health data can remain particularly sensitive even when

they are in anonymised format and thus non-personal, as already specifically provided for

in Regulation (EU) 2022/868. Even where state-of-the-art anonymisation techniques are

used, there remains a residual risk that the capacity to re-identify could be or become

available, beyond the means reasonably likely to be used. Such residual risk is present in

relation to rare diseases, that is to say a life-threatening or chronically debilitating

condition affecting not more than 5 in 10 thousand persons in the Union, where the limited

numbers of cases reduce the possibility of fully aggregating the published data in order to

preserve the privacy of natural persons while also maintaining an appropriate level of

granularity in order to remain meaningful. Such residual risk can affect different categories

of health data and can lead to the re-identification of the data subjects using means that are

beyond those reasonably likely to be used. Such risk depends on the level of granularity,

on the description of the characteristics of data subjects, on the number of people affected,

for instance in cases of data included in electronic health records, disease registries,

biobanks and person-generated data, where the range of identification characteristics is

broader, and on the possible combination with other information, for example in very small

geographical areas, or through the technological evolution of methods which had not been

available at the moment of anonymisation. Such re-identification of natural persons would

present a major concern and would be likely to put the acceptance of the rules on

secondary use provided for in this Regulation at risk.

PE-CONS 76/24 83

# LIFE.5 EN

Furthermore, aggregation techniques are less tested for non-personal data containing for

example trade secrets, as is the case in the reporting on clinical trials and clinical

investigations, and enforcement of breaches of trade secrets outside the Union is more

difficult in the absence of a sufficient international protection standard. Therefore, for

those categories of health data, there remains a risk of re-identification after the

anonymisation or aggregation, which cannot be reasonably mitigated initially. This falls

within the criteria indicated in Article 5(13) of Regulation (EU) 2022/868. Those types of

health data would thus fall within the empowerment set out in Article 5(13) of that

Regulation for transfer to third countries. The special conditions provided for under the

empowerment set out in Article 5(13) of Regulation (EU) 2022/868 will be detailed in the

context of the delegated act adopted under that empowerment, and need to be proportional

to the risk of re-identification and to take into account the specificities of different data

categories or of different anonymisation or aggregation techniques.

PE-CONS 76/24 84

# LIFE.5 EN

(93) The processing of large amounts of personal electronic health data for the purposes of the

EHDS, as part of data processing activities in the context of handling health data access

applications, data permits and health data requests entails higher risks of unauthorised

access to such personal data, as well as the possibility of cybersecurity incidents. Personal

electronic health data are particularly sensitive as they often contain information covered

by medical secrecy, the disclosure of which to unauthorised third parties can cause

significant distress. Taking fully into consideration the principles outlined in the case law

of the Court of Justice of the European Union, this Regulation ensures full respect for

fundamental rights, for the right to privacy and for the principle of proportionality. In order

to ensure the full integrity and confidentiality of personal electronic health data under this

Regulation, to guarantee a particularly high level of protection and security, and to reduce

the risk of unlawful access to those personal electronic health data, this Regulation allows

Member States to require that personal electronic health data be stored and processed

solely within the Union for the purpose of carrying out the tasks provided for in this

Regulation, unless an adequacy decision adopted pursuant to Article 45 of Regulation

(EU) 2016/679 applies.

PE-CONS 76/24 85

# LIFE.5 EN

(94) Access to electronic health data for health data users established in third countries or for

international organisations should take place only on the basis of the reciprocity principle.

Making electronic health data available to a third country should be allowed to take place

only where the Commission has established, by means of an implementing act, that the

third country concerned allows access to electronic health data originating from that third

country by Union entities under the same conditions and with the same safeguards as

would be the case if they were accessing electronic health data within the Union. The

Commission should monitor and carry out a periodic review of the situation in those third

countries and for international organisations and list those implementing acts. Where the

Commission finds that a third country no longer ensures access on the same terms, it

should revoke the corresponding implementing act.

PE-CONS 76/24 86

# LIFE.5 EN

(95) In order to promote the consistent application of this Regulation, including as regards

cross-border interoperability of electronic health data, a European Health Data Space

Board should be set up. The Commission should participate in its activities and co-chair it.

The EHDS Board should be able to issue written contributions related to the consistent

application of this Regulation throughout the Union, including by helping Member States

to coordinate the use of electronic health data for healthcare and certification, but also

concerning secondary use, and the funding for those activities. This could also include

sharing information on risks and incidents in the secure processing environments. The

sharing of that kind of information does not affect obligations under other legal acts, such

as data breach notifications under Regulation (EU) 2016/679. More generally, the activities

of the EHDS Board are without prejudice to the powers of the supervisory authorities

pursuant to Regulation (EU) 2016/679. Given that, at national level, digital health

authorities dealing with primary use may be different from the health data access bodies

dealing with secondary use, the functions are different and there is a need for distinct

cooperation in each of those areas, the EHDS Board should be able to set up subgroups

dealing with those two functions, as well as other subgroups, as needed. In order for there

to be an efficient working method, the digital health authorities and health data access

bodies should create networks and links at national level with other bodies and authorities,

but also at Union level. Such bodies could comprise data protection authorities,

cybersecurity, eID and standardisation bodies, as well as bodies and expert groups under

Regulations (EU) 2022/868, (EU) 2023/2854 and (EU) 2024/1689 and Regulation

(EU) 2019/881 of the European Parliament and of the Council **[21]** . The EHDS Board should

operate independently, in the public interest and in line with its code of conduct.

**21** Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019
on ENISA (the European Union Agency for Cybersecurity) and on information and
communications technology cybersecurity certification and repealing Regulation
(EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, p. 15).

PE-CONS 76/24 87

# LIFE.5 EN

(96) Where issues that are considered by the EHDS Board to be of specific relevance are

discussed, it should be able to invite observers, for instance the EDPS, representatives of

Union institutions, including of the European Parliament, and other stakeholders.

(97) A stakeholder forum should be set up to advise the EHDS Board in the fulfilment of its

tasks by providing stakeholder input on matters pertaining to this Regulation. The

stakeholder forum should be composed, inter alia, of representatives of patient and

consumer organisations, health professionals, industry, scientific researchers and academia.

It should have a balanced composition and represent the views of different relevant

stakeholders. Both commercial and non-commercial interests should be represented.

(98) In order to ensure proper day-to-day management of the cross-border infrastructures for

primary use and secondary use, it is necessary to create steering groups consisting of

Member State representatives. These steering groups should take operational decisions on

the technical day-to-day management of the cross-border infrastructures and their technical

development, including on technical changes to the infrastructures, improving

functionalities or services, or ensuring interoperability with other infrastructures, digital

systems or data spaces. Their activities should not include contributing to the development

of implementing acts affecting those infrastructures. The steering groups should also be

able to invite representatives of other authorised participants in HealthData@EU as

observers to their meetings and should consult relevant experts when carrying out their

tasks.

PE-CONS 76/24 88

# LIFE.5 EN

(99) Without prejudice to any other administrative, judicial or non-judicial remedy, any natural

or legal person should have the right to lodge a complaint with a digital health authority or

with a health data access body, if the natural or legal person considers that his or her rights

or interests under this Regulation have been affected. The investigation following a

complaint should be carried out, subject to judicial review, to the extent appropriate in the

specific case. The digital health authority or health data access body should inform the

natural or legal person of the progress and the outcome of the complaint within a

reasonable period. If the case requires further investigation or coordination with another

digital health authority or health data access body, information on the progress made in

dealing with the complaint should be given to the natural or legal person. In order to

facilitate the submission of complaints, each digital health authority and health data access

body should take measures such as providing a complaint submission form which can also

be completed electronically, without excluding the possibility of using other means of

communication. Where the complaint concerns the rights of natural persons related to the

protection of their personal data, the digital health authority or health data access body

should transmit the complaint to the supervisory authorities under Regulation

(EU) 2016/679. Digital health authorities or health data access bodies should cooperate to

handle and resolve complaints, including by exchanging all relevant information by

electronic means, without undue delay.

PE-CONS 76/24 89

# LIFE.5 EN

(100) Where a natural person considers that his or her rights under this Regulation have been

infringed, he or she should have the right to mandate a not-for-profit body, organisation or

association constituted in accordance with national law, having statutory public interest

objectives and active in the field of the protection of personal data, to lodge a complaint on

his or her behalf.

(101) The digital health authority, health data access body, health data holder or health data user

should compensate any damage which a natural or legal person suffers as a result of an

infringement of this Regulation. The concept of damage should be broadly interpreted in

the light of the case law of the Court of Justice of the European Union, in a manner which

fully reflects the objectives of this Regulation. This is without prejudice to any claims for

damage deriving from the violation of other provisions in Union or national law. Natural

persons should receive full and effective compensation for the damage they have suffered.

(102) In order to strengthen the enforcement of the rules of this Regulation, penalties, including

administrative fines, should be imposed for any infringement of this Regulation, in

addition to, or instead of, appropriate measures imposed by health data access bodies

pursuant to this Regulation. The imposition of penalties, including administrative fines,

should be subject to appropriate procedural safeguards in accordance with the general

principles of Union law and the Charter of Fundamental Rights of the European Union,

including effective judicial protection and due process.

PE-CONS 76/24 90

# LIFE.5 EN

(103) It is appropriate to lay down provisions enabling health data access bodies to apply

administrative fines for certain infringements of this Regulation which should be

considered under this Regulation to be serious infringements, such as the re-identification

of natural persons, downloading personal electronic health data outside of the secure

processing environment or processing of data for prohibited uses or uses not covered by a

data permit. This Regulation should specify those infringements and the upper limit and

criteria for setting the related administrative fines, which should be determined by the

competent health data access body in each individual case, taking into account all the

relevant circumstances of the specific situation, having due regard in particular to the

nature, gravity and duration of the infringement and its consequences and the measures

taken to ensure compliance with the obligations under this Regulation and to prevent or

mitigate the consequences of the infringement. For the purposes of the imposition of

administrative fines under this Regulation, the concept of undertaking should be

understood in accordance with Articles 101 and 102 TFEU. It should be for the Member

States to determine whether and to what extent public authorities should be subject to

administrative fines. Imposing an administrative fine or giving a warning should not affect

the enforcement of other powers of the health data access bodies or of other penalties under

this Regulation.

PE-CONS 76/24 91

# LIFE.5 EN

(104) In order to ensure that the EHDS fulfils its objectives, the power to adopt acts in

accordance with Article 290 TFEU should be delegated to the Commission in respect of

the modification, addition or removal in Annex I of the main characteristics of the priority

categories of personal electronic health data, the list of required data to be entered by the

manufacturers of EHR systems and wellness applications into the EU database for

registration of EHR systems and wellness applications as well as the modification, addition

or removal of elements to be covered by the data quality and utility label. It is of particular

importance that the Commission carry out appropriate consultations during its preparatory

work, including at expert level, and that those consultations be conducted in accordance

with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on

Better Law-Making **[22]** . In particular, to ensure equal participation in the preparation of

delegated acts, the European Parliament and the Council receive all documents at the same

time as Member States’ experts, and their experts systematically have access to meetings

of Commission expert groups dealing with the preparation of delegated acts.

**22** OJ L 123, 12.5.2016, p. 1.

PE-CONS 76/24 92

# LIFE.5 EN

(105) In order to ensure uniform conditions for the implementation of this Regulation,

implementing powers should be conferred on the Commission as regards:

–
technical specifications for the interoperability of the proxy services of the Member

States,

–
data quality requirements for the registration of personal electronic health data in an

EHR system,

–
cross-border specifications for priority categories of personal electronic health data,

–
technical specifications for the categories of personal electronic health data, setting

out the European electronic health record exchange format,

–
updates of the European electronic health record exchange format to integrate

relevant revisions of the healthcare coding systems and nomenclatures,

–
technical specifications to extend the European electronic health record exchange

format to additional categories of personal electronic health data,

–
requirements for the interoperable, cross-border identification and authentication

mechanism for natural persons and health professionals, in accordance with

Regulation (EU) No 910/2014,

–
requirements for the technical implementation of the rights of natural persons in

relation to the primary use of their personal electronic health data,

PE-CONS 76/24 93

# LIFE.5 EN

–
necessary measures for the technical development of MyHealth@EU, detailed rules

concerning the security, confidentiality and protection of personal electronic health

data and the conditions for compliance checks necessary to join and remain

connected to MyHealth@EU,

–
rules regarding the requirements of cybersecurity, technical interoperability, semantic

interoperability, operations and service management in relation to the processing by

the Commission and its responsibilities towards the controllers,

–
technical aspects of supplementary services provided through MyHealth@EU,

–
technical aspects of exchanges of personal electronic health data between

MyHealth@EU and other services or infrastructures,

–
connection and disconnection of other infrastructures, of national contact points for

digital health of third countries or of systems established at international level by

international organisations to or from the central interoperability platform of

MyHealth@EU,

–
common specifications in respect of the essential requirements laid down in

Annex II,

–
common specifications for the European digital testing environment,

–
justifications of national measures taken by market surveillance authorities in the

case of non-compliance by EHR systems,

PE-CONS 76/24 94

# LIFE.5 EN

–
format and content of the label of wellness applications,

–
principles for the fee policies and fee structures regarding the fees that health data

access bodies and trusted health data holders can charge for making electronic health

data available for secondary use,

–
the architecture of an IT tool aimed at supporting and making transparent to health

data access bodies enforcement measures,

–
the logo for acknowledging the contribution of the EHDS,

–
templates for the health data access application, the data permit and the health data

request,

–
technical, organisational, information security, confidentiality, data protection and

interoperability requirements for the secure processing environments,

–
templates for agreements between controllers and processors,

–
decisions on the compliance of a national contact point for secondary use of a third

country or a system established at international level by international organisations

with the requirements of HealthData@EU for the purposes of secondary use of

health data, on the compliance with Chapter IV and on whether that national contact

point for secondary use or that system provides equivalent access for health data

users located in the Union to the electronic health data it has access to,

PE-CONS 76/24 95

# LIFE.5 EN

–
HealthData@EU’s requirements, technical specifications and IT architecture;

conditions and compliance checks to join and remain connected to HealthData@EU;

minimum criteria to be met by national contact points for secondary use and the

authorised participants in HealthData@EU; responsibilities of the controllers and

processors which participate in HealthData@EU; responsibilities of the controllers

and processors for the secure processing environment managed by the Commission;

and common specifications for the architecture of HealthData@EU and for its

interoperability with other common European data spaces,

–
decisions to connect individual authorised participants to HealthData@EU,

– minimum elements for datasets and the characteristics of those elements to be

provided by health data holders,

–
visual characteristics and technical specifications of the data quality and utility label,

–
minimum specifications for datasets of high impact for secondary use,

–
decisions on whether a third country allows Union health data applicants to access

electronic health data in that third country under conditions that are not more

restrictive than those provided for in this Regulation,

–
necessary measures for the establishment and operation of the EHDS Board.

Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the

European Parliament and of the Council **[23]** .

**23** Regulation (EU) No 182/2011 of the European Parliament and of the Council of
16 February 2011 laying down the rules and general principles concerning mechanisms for
control by the Member States of the Commission's exercise of implementing powers
(OJ L 55, 28.2.2011, p. 13).

PE-CONS 76/24 96

# LIFE.5 EN

(106) Member States should take all measures necessary to ensure that the provisions of this

Regulation are implemented, including by laying down effective, proportionate and

dissuasive penalties for their infringement. When deciding on the amount of the penalty for

each individual case, Member States should take into account the limits and criteria set out

in this Regulation. Re-identification of natural persons should be considered a serious

breach of this Regulation.

(107) Implementing the EHDS will require significant development work across Member States

and central services. To track the progress made in that regard, the Commission should,

until the full application of this Regulation, report annually on that progress, taking into

account information provided by the Member States. Those reports could include

recommendations for remedial measures, as well as an assessment of the progress made.

(108) In order to assess whether this Regulation reaches its objectives effectively and efficiently,

is coherent and still relevant and provides added value at Union level, the Commission

should carry out an evaluation of this Regulation. The Commission should carry out a

targeted evaluation of this Regulation within eight years of its entry into force, and an

overall evaluation within 10 years of its entry into force. The Commission should submit

reports on its main findings following each evaluation to the European Parliament and to

the Council, the European Economic and Social Committee and the Committee of the

Regions.

PE-CONS 76/24 97

# LIFE.5 EN

(109) For a successful cross-border implementation of the EHDS, the European Interoperability

Framework, the scope of which was updated and extended by the Commission

communication of 23 March 2017 entitled ‘European Interoperability Framework –

Implementation Strategy’ to take on board new or revised interoperability requirements,

should be considered as a common reference to ensure legal, organisational, semantic and

technical interoperability.

(110) Since the objectives of this Regulation, namely to empower natural persons by providing

them with increased control over their personal electronic health data and supporting their

freedom of movement by ensuring that their health data follow them, to foster a genuine

internal market for digital health services and products and to ensure a consistent and

efficient framework for the reuse of natural persons’ health data for research, innovation,

policy-making and regulatory activities, cannot be sufficiently achieved by the Member

States through coordination measures alone, as shown by the evaluation of the digital

aspects of Directive 2011/24/EU, but can rather, by reason of harmonising measures for

rights of natural persons in relation to their electronic health data, interoperability of

electronic health data and a common framework and safeguards for the primary use and

secondary use, be better achieved at Union level, the Union may adopt measures, in

accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on

European Union. In accordance with the principle of proportionality as set out in that

Article, this Regulation does not go beyond what is necessary in order to achieve those

objectives.

PE-CONS 76/24 98

# LIFE.5 EN

(111) The evaluation of the digital aspects of Directive 2011/24/EU shows that the effectiveness

of the eHealth Network is limited, but also that there is strong potential for work at Union

level in the area of digital health, as demonstrated by the work carried out during the

COVID-19 pandemic. Directive 2011/24/EU should therefore be amended accordingly.

(112) This Regulation complements the essential cybersecurity requirements laid down in

Regulation (EU) 2024/2847. EHR systems which are products with digital elements within

the meaning of Regulation (EU) 2024/2847 should therefore also comply with the essential

cybersecurity requirements set out in that Regulation. The manufacturers of those EHR

systems should demonstrate conformity as required by this Regulation. To facilitate that

conformity, manufacturers should be allowed to draw up a single set of technical

documents containing the elements required by both legal acts. It should be possible to

demonstrate conformity of EHR systems with essential cybersecurity requirements laid

down in Regulation (EU) 2024/2847 through the assessment framework under this

Regulation. However, the parts of the conformity assessment procedure under this

Regulation which relate to the use of testing environments should not be applied, since

those testing environments do not allow for an assessment of conformity with the essential

cybersecurity requirements. As Regulation (EU) 2024/2847 does not cover Software as a

Service (SaaS) directly as such, EHR systems offered through the SaaS licensing and

delivery model do not fall within the scope of that Regulation. Similarly, EHR systems that

are developed and used in-house do not fall within the scope of that Regulation, as they are

not placed on the market.

PE-CONS 76/24 99

# LIFE.5 EN

(113) The EDPS and the EDPB were consulted in accordance with Article 42(1) and (2) of

Regulation (EU) 2018/1725 and delivered their joint opinion on 12 July 2022.

(114) This Regulation should not affect the application of the rules of competition, and in

particular Articles 101 and 102 TFEU. The measures provided for in this Regulation

should not be used to restrict competition in a manner contrary to the TFEU.

(115) Given the need for technical preparation, this Regulation should apply from … [24 months

from the date of entry into force]. In order to support the successful implementation of the

EHDS and the creation of effective conditions for European health data cooperation, the

implementation should take place in stages,

HAVE ADOPTED THIS REGULATION:

PE-CONS 76/24 100

# LIFE.5 EN

## **Chapter I** **General provisions**

_Article 1_

_Subject matter and scope_

1. This Regulation establishes the European Health Data Space (EHDS) by providing for

common rules, standards and infrastructures and a governance framework, with a view to

facilitating access to electronic health data for the purposes of primary use of electronic

health data and secondary use of those data.

2. This Regulation:

(a) specifies and complements the rights laid down in Regulation (EU) 2016/679 of

natural persons in relation to the primary use and secondary use of their personal

electronic health data;

(b) lays down common rules for electronic health record systems (‘EHR systems’) in

relation to two mandatory harmonised software components, namely the European

interoperability software component for EHR systems and the European logging

software component for EHR systems, as defined in Article 2(2), points (n) and (o)

respectively, and for wellness applications which are claimed to be interoperable

with EHR systems in relation to those two harmonised software components, as

regards primary use of electronic health data;

PE-CONS 76/24 101

# LIFE.5 EN

(c) lays down common rules and mechanisms for primary use of electronic health data

and secondary use of electronic health data;

(d) establishes a cross-border infrastructure enabling the primary use of personal

electronic health data across the Union;

(e) establishes a cross-border infrastructure for secondary use of electronic health data;

(f) establishes governance and coordination mechanisms at Union and national level for

both primary use of electronic health data and secondary use of electronic health

data.

PE-CONS 76/24 102

# LIFE.5 EN

3. This Regulation shall be without prejudice to other Union legal acts regarding access to,

and sharing of or secondary use of, electronic health data, or Union requirements related to

the processing of data in relation to electronic health data, in particular Regulations

(EC) No 223/2009 **[24]**, (EU) No 536/2014 **[25]**, (EU) 2016/679, (EU) 2018/1725,

(EU) 2022/868 and (EU) 2023/2854 of the European Parliament and of the Council and

Directives 2002/58/EC **[26]** and (EU) 2016/943 **[27]** of the European Parliament and of the

Council.

4. References in this Regulation to the provisions of Regulation (EU) 2016/679 shall be

understood also as references to the corresponding provisions of Regulation

(EU) 2018/1725, where relevant, as regards Union institutions, bodies, offices and

agencies.

**24** Regulation (EC) No 223/2009 of the European Parliament and of the Council of
11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No
1101/2008 of the European Parliament and of the Council on the transmission of data
subject to statistical confidentiality to the Statistical Office of the European Communities,
Council Regulation (EC) No 322/97 on Community Statistics, and Council Decision
89/382/EEC, Euratom establishing a Committee on the Statistical Programmes of the
European Communities (OJ L 87, 31.3.2009, p. 164).
**25** Regulation (EU) No 536/2014 of the European Parliament and of the Council of
16 April 2014 on clinical trials on medicinal products for human use, and repealing
Directive 2001/20/EC (OJ L 158, 27.5.2014, p. 1).
**26** Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002
concerning the processing of personal data and the protection of privacy in the electronic
communications sector (Directive on privacy and electronic communications)
(OJ L 201, 31.7.2002, p. 32).
**27** Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on
the protection of undisclosed know-how and business information (trade secrets) against
their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1).

PE-CONS 76/24 103

# LIFE.5 EN

5. This Regulation shall be without prejudice to Regulations (EU) 2017/745, (EU) 2017/746

and (EU) 2024/1689, as regards the security of medical devices, in vitro diagnostic medical

devices and artificial intelligence (AI) systems that interact with EHR systems.

6. This Regulation shall be without prejudice to Union or national law regarding electronic

health data processing for the purposes of reporting, complying with access to information

requests or demonstrating or verifying compliance with legal obligations, or to Union or

national law regarding the granting of access to and disclosure of official documents.

7. This Regulation shall be without prejudice to specific provisions in Union or national law

providing for access to electronic health data for further processing by Member States’

public sector bodies, by Union institutions, bodies, offices and agencies, or by private

entities entrusted under Union or national law with a task of public interest, for the purpose

of carrying out such task.

8. This Regulation shall not affect access to electronic health data for secondary use agreed in

the framework of contractual or administrative arrangements between public or private

entities.

PE-CONS 76/24 104

# LIFE.5 EN

9. This Regulation does not apply to the processing of personal data in the following cases:

(a) where the processing is carried out in the course of an activity which falls outside the

scope of Union law;

(b) where the processing is carried out by competent authorities for the purposes of the

prevention, investigation, detection or prosecution of criminal offences or the

execution of criminal penalties, including the safeguarding against and the

prevention of threats to public security.

_Article 2_

_Definitions_

1. For the purposes of this Regulation, the following definitions apply:

(a) the definitions of ‘personal data’, ‘processing’, ‘pseudonymisation’, ‘controller’,

‘processor’, ‘third party’, ‘consent’, ‘genetic data’, ‘data concerning health’ and

‘international organisation’ laid down in Article 4, points (1), (2), (5), (7), (8), (10),

(11), (13), (15) and (26), respectively, of Regulation (EU) 2016/679;

(b) the definitions of ‘healthcare’, ‘Member State of affiliation’, ‘Member State of

treatment’, ‘health professional’, ‘healthcare provider’, ‘medicinal product’ and

‘prescription’ laid down in Article 3, points (a), (c), (d), (f), (g), (i) and (k),

respectively, of Directive 2011/24/EU;

PE-CONS 76/24 105

# LIFE.5 EN

(c) the definitions of ‘data’, ‘access’, ‘data altruism’, ‘public sector body’ and ‘secure

processing environment’ laid down in Article 2, points (1), (13), (16), (17) and (20),

respectively, of Regulation (EU) 2022/868;

(d) the definitions of ‘making available on the market’, ‘placing on the market’, ‘market

                                        surveillance’, ‘market surveillance authority’, ‘non compliance’, ‘manufacturer’,

‘importer’, ‘distributor’, ‘economic operator’, ‘corrective action’, ‘recall’ and

‘withdrawal’ laid down in Article 3, points (1), (2), (3), (4), (7), (8), (9), (10), (13),

(16), (22) and (23), respectively, of Regulation (EU) 2019/1020;

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’,

‘performance’, ‘health institution’ and ‘common specifications’ laid down in

Article 2, points (1), (12), (14), (22), (36) and (71), respectively, of Regulation

(EU) 2017/745;

(f) the definitions of ‘electronic identification’ and ‘electronic identification means’ laid

down in Article 3, points (1) and (2), respectively, of Regulation (EU) No 910/2014;

(g) the definition of ‘contracting authorities’ laid down in Article 2(1), point (1), of

Directive 2014/24/EU of the European Parliament and of the Council **[28]** ;

(h) the definition of ‘public health’ laid down in Article 3, point (c), of Regulation

(EC) No 1338/2008 of the European Parliament and of the Council **[29]** .

**28** Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014
on public procurement and repealing Directive 2004/18/EC (OJ L 94, 28.3.2014, p. 65).
**29** Regulation (EC) No 1338/2008 of the European Parliament and of the Council of
16 December 2008 on Community statistics on public health and health and safety at work
(OJ L 354, 31.12.2008, p. 70).

PE-CONS 76/24 106

# LIFE.5 EN

2. In addition, for the purposes of this Regulation the following definitions apply:

(a) ‘personal electronic health data’ means data concerning health and genetic data,

processed in an electronic form;

(b) ‘non-personal electronic health data’ means electronic health data other than personal

electronic health data, including both data that have been anonymised so that they no

longer relate to an identified or identifiable natural person (the ‘data subject’) and

data that have never related to a data subject;

(c) ‘electronic health data’ means personal or non-personal electronic health data;

(d) ‘primary use’ means the processing of electronic health data for the provision of

healthcare, in order to assess, maintain or restore the state of health of the natural

person to whom those data relate, including the prescription, dispensation and

provision of medicinal products and medical devices, as well as for relevant social,

administrative or reimbursement services;

(e) ‘secondary use’ means the processing of electronic health data for the purposes set

out in Chapter IV of this Regulation, other than the initial purposes for which they

were collected or produced;

PE-CONS 76/24 107

# LIFE.5 EN

(f) ‘interoperability’ means the ability of organisations, as well as of software

applications or devices from the same manufacturer or different manufacturers, to

interact through the processes they support, involving the exchange of information

and knowledge, without changing the content of the data, between those

organisations, software applications or devices;

(g) ‘registration of electronic health data’ means the recording of health data in an

electronic format, through the manual entry of such data, through the collection of

such data by a device, or through the conversion of non-electronic health data into an

electronic format, to be processed in an EHR system or a wellness application;

(h) ‘electronic health data access service’ means an online service, such as a portal or an

application for mobile devices, that enables natural persons not acting in a

professional capacity to access their own electronic health data or the electronic

health data of those natural persons whose electronic health data they are legally

authorised to access;

(i) ‘health professional access service’ means a service, supported by an EHR system,

that enables health professionals to access data of natural persons under their

treatment;

(j) ‘electronic health record’ or ‘EHR’ means a collection of electronic health data

related to a natural person and collected in the health system, processed for the

purpose of the provision of healthcare;

PE-CONS 76/24 108

# LIFE.5 EN

(k) ‘electronic health record system’ or ‘EHR system’ means any system whereby the

software, or a combination of the hardware and the software of that system, allows

personal electronic health data that belong to the priority categories of personal

electronic health data established under this Regulation to be stored, intermediated,

exported, imported, converted, edited or viewed, and intended by the manufacturer to

be used by healthcare providers when providing patient care or by patients when

accessing their electronic health data;

(l) ‘putting into service’ means the first use, for its intended purpose, in the Union of an

EHR system covered by this Regulation;

(m) ‘software component’ means a discrete part of software which provides a specific

functionality or performs specific functions or procedures and which can operate

independently or in conjunction with other components;

(n) ‘European interoperability software component for EHR systems’ means a software

component of the EHR system which provides and receives personal electronic

health data under a priority category for primary use established under this

Regulation in the European electronic health record exchange format provided for in

this Regulation and which is independent of the European logging software

component for EHR systems;

PE-CONS 76/24 109

# LIFE.5 EN

(o) ‘European logging software component for EHR systems’ means a software

component of the EHR system which provides logging information related to access

by health professionals or other individuals to priority categories of personal

electronic health data established under this Regulation, in the format defined in

point 3.2. of Annex II thereto, and which is independent of the European

interoperability software component for EHR systems;

(p) ‘CE marking of conformity’ means a marking by which the manufacturer indicates

that the EHR system is in conformity with the applicable requirements set out in this

Regulation and other applicable Union law providing for its affixing pursuant to

Regulation (EC) No 765/2008 of the European Parliament and of the Council **[30]** ;

(q) ‘risk’ means the combination of the probability of an occurrence of a hazard causing

harm to health, safety or information security and the degree of severity of such

harm;

(r) ‘serious incident’ means any malfunction or deterioration in the characteristics or

performance of an EHR system made available on the market that directly or

indirectly leads, might have led or might lead to any of the following:

(i) the death of a natural person or serious harm to a natural person’s health;

(ii) serious prejudice to a natural person’s rights;

**30** Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008
setting out the requirements for accreditation and market surveillance relating to the
marketing of products and repealing Regulation (EEC) No 339/93
(OJ L 218, 13.8.2008, p. 30).

PE-CONS 76/24 110

# LIFE.5 EN

(iii) serious disruption of the management and operation of critical infrastructure in

the health sector;

(s) ‘care’ means a professional service the purpose of which is to address the specific

needs of a natural person who, on account of impairment or other physical or mental

conditions, requires assistance, including preventive and supportive measures, to

carry out essential activities of daily living in order to support his or her personal

autonomy;

(t) ‘health data holder’ means any natural or legal person, public authority, agency or

other body in the healthcare or the care sectors, including reimbursement services

where necessary, as well as any natural or legal person developing products or

services intended for the health, healthcare or care sectors, developing or

manufacturing wellness applications, performing research in relation to the

healthcare or care sectors or acting as a mortality registry, as well as any Union

institution, body, office or agency, that has either:

(i) the right or obligation, in accordance with applicable Union or national law and

in its capacity as a controller or joint controller, to process personal electronic

health data for the provision of healthcare or care or for the purposes of public

health, reimbursement, research, innovation, policy making, official statistics

or patient safety or for regulatory purposes; or

PE-CONS 76/24 111

# LIFE.5 EN

(ii) the ability to make available non-personal electronic health data through the

control of the technical design of a product and related services, including by

registering, providing, restricting access to or exchanging such data;

(u) ‘health data user’ means a natural or legal person, including Union institutions,

bodies, offices or agencies, which has been granted lawful access to electronic health

data for secondary use pursuant to a data permit, a health data request approval or an

access approval by an authorised participant in HealthData@EU;

(v) ‘data permit’ means an administrative decision issued to a health data user by a

health data access body to process certain electronic health data specified in the data

permit for specific secondary use purposes, based on conditions laid down in

Chapter IV of this Regulation;

(w) ‘dataset’ means a structured collection of electronic health data;

(x) ‘dataset of high impact for secondary use’ means a dataset the re-use of which is

associated with significant benefits due to its relevance for health research;

(y) ‘dataset catalogue’ means a collection of dataset descriptions, arranged in a

systematic manner and including a user-oriented public part, in which information

concerning individual dataset parameters is accessible by electronic means through

an online portal;

PE-CONS 76/24 112

# LIFE.5 EN

(z) ‘data quality’ means the degree to which the elements of electronic health data are

suitable for their intended primary use and secondary use;

(aa) ‘data quality and utility label’ means a graphic diagram, including a scale, describing

the data quality and conditions of use of a dataset;

(ab) ‘wellness application’ means any software, or any combination of hardware and

software, intended by the manufacturer to be used by a natural person, for the

processing of electronic health data, specifically for providing information on the

health of natural persons, or the delivery of care for purposes other than the provision

of healthcare.

PE-CONS 76/24 113

# LIFE.5 EN

## **Chapter II** **Primary use**

### **S ECTION 1** **R IGHTS OF NATURAL PERSONS IN RELATION TO THE PRIMARY USE** **OF THEIR PERSONAL ELECTRONIC HEALTH DATA, AND RELATED PROVISIONS**

_Article 3_

_Right of natural persons to access their personal electronic health data_

1. Natural persons shall have the right to access at least personal electronic health data

relating to them that belong to the priority categories referred to in Article 14 and are

processed for the provision of healthcare through the electronic health data access services

referred to in Article 4. Access shall be provided immediately after the personal electronic

health data have been registered in an EHR system, while respecting the need for

technological practicability, and shall be provided free of charge and in an easily readable,

consolidated and accessible format.

2. Natural persons, or their representatives referred to in Article 4(2), shall have the right to

download free of charge an electronic copy of at least the personal electronic health data in

the priority categories referred to in Article 14 related to those natural persons, through the

electronic health data access services referred to in Article 4, in the European electronic

health record exchange format referred to in Article 15.

PE-CONS 76/24 114

# LIFE.5 EN

3. In accordance with Article 23 of Regulation (EU) 2016/679, Member States may restrict

the scope of rights provided for in paragraphs 1 and 2 of this Article, in particular

whenever those restrictions are necessary to protect natural persons, on the basis of patient

safety and ethical considerations by delaying access to their personal electronic health data

for a limited period of time until a health professional is able to properly communicate and

explain to the natural persons concerned information that can have a significant impact on

their health.

_Article 4_

_Electronic health data access services for natural persons and their representatives_

1. Member States shall ensure that one or more electronic health data access services at

national, regional or local level are established, thereby enabling natural persons to access

their personal electronic health data and exercise their rights provided for in Articles 3 and

5 to 10. Such electronic health data access services shall be free of charge for the natural

persons and their representatives referred to in paragraph 2 of this Article.

2. Member States shall ensure that one or more proxy services are established as a

functionality of electronic health data access services which enables:

(a) natural persons to authorise other natural persons of their choice to access their

personal electronic health data, or part thereof, on their behalf for a limited or

unlimited period and, if needed, for a specific purpose only, and to manage those

authorisations; and

PE-CONS 76/24 115

# LIFE.5 EN

(b) legal representatives of natural persons to access personal electronic health data of

those natural persons whose affairs they administer, in accordance with national law.

Member States shall establish rules regarding the authorisations referred to in point (a) of

the first subparagraph and actions of guardians and other legal representatives.

3. The proxy services referred to in paragraph 2 shall provide authorisations in a transparent

and easily understandable way, free of charge, and electronically or on paper. Natural

persons and their representatives shall be informed about their authorisation rights,

including about how to exercise those rights, and about the authorisation process.

The proxy services shall provide an easy complaint mechanism for natural persons.

4. The proxy services referred to in paragraph 2 of this Article shall be interoperable among

Member States. The Commission shall, by means of implementing acts, lay down the

technical specifications for the interoperability of the proxy services of the Member States.

Those implementing acts shall be adopted in accordance with the examination procedure

referred to in Article 98(2).

5. The electronic health data access services and the proxy services shall be easily accessible

for persons with disabilities, vulnerable groups and persons with low digital literacy.

PE-CONS 76/24 116

# LIFE.5 EN

_Article 5_

_Right of natural persons to insert information in their own EHR_

Natural persons, or their representatives referred to in Article 4(2), shall have the right to insert

information in the EHR of those natural persons through electronic health data access services or

applications linked to those services as referred to in that Article. That information shall be clearly

distinguishable as having been inserted by the natural person or by his or her representative. Natural

persons, or their representatives referred to in Article 4(2), shall not be able to directly alter the

electronic health data and related information inserted by health professionals.

_Article 6_

_Right of natural persons to rectification_

Electronic health data access services referred to in Article 4 shall enable natural persons to easily

request online the rectification of their personal electronic health data in accordance with Article 16

of Regulation (EU) 2016/679. Where appropriate, the controller shall verify with a relevant health

professional the accuracy of the information provided in the request.

Member States may also enable natural persons to exercise online other rights pursuant to

Chapter III of Regulation (EU) 2016/679 through electronic health data access services.

PE-CONS 76/24 117

# LIFE.5 EN

_Article 7_

_Right to data portability for natural persons_

1. Natural persons shall have the right to give access to, or to request a healthcare provider to

transmit, all or part of their personal electronic health data to another healthcare provider of

their choice immediately, free of charge and without hindrance from the healthcare

provider or from the manufacturers of the systems used by that healthcare provider.

2. Natural persons shall have the right, where the healthcare providers are located in different

Member States, to request the transmission of their personal electronic health data in the

European electronic health record exchange format referred to in Article 15 through the

cross-border infrastructure referred to in Article 23. The receiving healthcare provider shall

accept such data and shall be able to read them.

3. Natural persons shall have the right to request a healthcare provider to transmit a part of

their personal electronic health data to a clearly identified recipient in the social security or

reimbursement services sector. Such transmission shall be carried out immediately, free of

charge and without hindrance from the healthcare provider or from the manufacturers of

the systems used by that healthcare provider, and shall be one-way only.

PE-CONS 76/24 118

# LIFE.5 EN

4. Where natural persons have downloaded an electronic copy of their priority categories of

personal electronic health data in accordance with Article 3(2) they shall be able to

transmit those data to healthcare providers of their choice in the European electronic health

record exchange format referred to in Article 15. The receiving healthcare provider shall

accept such data and be able to read them, as applicable.

_Article 8_

_Right to restrict access_

Natural persons shall have the right to restrict the access of health professionals and healthcare

providers to all or parts of their personal electronic health data as referred to in Article 3.

When exercising the right referred to in the first paragraph, natural persons shall be made aware that

restricting access might impact the provision of healthcare to them.

The fact that a natural person has restricted access under the first paragraph shall not be visible to

healthcare providers.

Member States shall establish the rules and specific safeguards regarding such restriction

mechanisms.

PE-CONS 76/24 119

# LIFE.5 EN

_Article 9_

_Right to obtain information on accessing data_

1. Natural persons shall have the right to obtain information, including through automatic

notifications, on any access to their personal electronic health data through the health

professional access service obtained in the context of healthcare, including access provided

in accordance with Article 11(5).

2. The information referred to in paragraph 1 shall be provided free of charge and without

delay through electronic health data access services and shall be available for at least three

years from each date of access to the data. That information shall include at least the

following:

(a) information on the healthcare provider or other individuals who accessed the

personal electronic health data;

(b) the date and time of access;

(c) which personal electronic health data were accessed.

3. Member States may provide for restrictions to the right referred to in paragraph 1 in

exceptional circumstances, where there are factual indications that disclosure would

endanger the vital interests or rights of the health professional or the care of the natural

person.

PE-CONS 76/24 120

# LIFE.5 EN

_Article 10_

_Right of natural persons to opt out in primary use_

1. Member States’ laws may provide that natural persons have the right to opt out from the

access to their personal electronic health data registered in an EHR system through the

electronic health data access services referred to in Articles 4 and 12. In such cases,

Member States shall ensure that the exercise of that right is reversible.

2. If a Member State provides for a right referred to in paragraph 1 of this Article, it shall

establish the rules and specific safeguards regarding the opt-out mechanism. In particular,

Member States may provide for a healthcare provider or health professional to be able to

get access to the personal electronic health data in cases where processing is necessary in

order to protect the vital interests of the data subject or of another natural person as

referred to in Article 9(2), point (c), of Regulation (EU) 2016/679, even if the patient has

exercised the right to opt out in primary use.

_Article 11_

_Access by health professionals to personal electronic health data_

1. Where health professionals process data in an electronic format, they shall have access to

the relevant and necessary personal electronic health data of natural persons under their

treatment through the health professional access services referred to in Article 12,

irrespective of the Member State of affiliation and the Member State of treatment.

PE-CONS 76/24 121

# LIFE.5 EN

2. Where the Member State of affiliation of the natural person under treatment and the

Member State of treatment of such natural person differ, cross-border access to the

personal electronic health data of the natural person under treatment shall be provided

through the cross-border infrastructure referred to in Article 23.

3. The access referred to in paragraphs 1 and 2 of this Article shall include at least the priority

categories of personal electronic health data referred to in Article 14.

In line with the principles provided for in Article 5 of Regulation (EU) 2016/679, Member

States shall establish rules providing for the categories of personal electronic health data

accessible by different categories of health professionals or for different healthcare tasks.

Such rules shall take into account the possibility of restrictions imposed under Article 8 of

this Regulation.

4. In the case of treatment in a Member State other than the Member State of affiliation, the

rules referred to in paragraph 3 shall be those of the Member State of treatment.

5. Where access to personal electronic health data has been restricted by a natural person

pursuant to Article 8, the healthcare provider or health professional shall not be informed

of the restricted content of those data.

By way of derogation from the first paragraph of Article 8, where necessary in order to

protect the vital interests of the data subject, the healthcare provider or health professional

may be granted access to the restricted electronic health data. Such cases shall be logged in

a clear and understandable format and shall be easily accessible for the data subject.

Member States may provide for additional safeguards.

PE-CONS 76/24 122

# LIFE.5 EN

_Article 12_

_Health professional access services_

For the provision of healthcare, Member States shall ensure that health professionals are able to

access free of charge the priority categories of personal electronic health data referred to in

Article 14, including for cross-border care, through health professional access services.

The services referred to in the first paragraph of this Article shall be accessible only to health

professionals who are in possession of electronic identification means which are recognised

pursuant to Article 6 of Regulation (EU) No 910/2014 or other electronic identification means

compliant with common specifications referred to in Article 36 of this Regulation.

Personal electronic health data shall be presented in a user-friendly manner in the electronic health

records to allow for easy use by health professionals.

_Article 13_

_Registration of personal electronic health data_

1. Member States shall ensure that, where electronic health data are processed for the

provision of healthcare, healthcare providers register the relevant personal electronic health

data falling fully or partially under at least the priority categories of personal electronic

health data referred to in Article 14 in an electronic format in an EHR system.

PE-CONS 76/24 123

# LIFE.5 EN

2. When processing data in an electronic format, healthcare providers shall ensure that the

personal electronic health data of the natural persons under their treatment are updated with

information related to the healthcare.

3. Where personal electronic health data are registered in a Member State of treatment that

differs from the Member State of affiliation of the natural person concerned, the Member

State of treatment shall ensure that the registration is performed under the identification

data of the natural person in the Member State of affiliation.

4. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, determine data quality requirements, including in

relation to semantics, uniformity, consistency, accuracy and completeness, for the

registration of personal electronic health data in an EHR system as relevant. Those

implementing acts shall be adopted in accordance with the examination procedure referred

to in Article 98(2).

When personal electronic health data are registered or updated, the electronic health

records shall identify the health professional and healthcare provider that carried out such

registration or update, and the time at which such registration or update was carried out.

Member States may require other aspects of data registration to be recorded.

PE-CONS 76/24 124

# LIFE.5 EN

_Article 14_

_Priority categories of personal electronic health data for primary use_

1. For the purposes of this Chapter, where data are processed in electronic format the priority

categories of personal electronic health data shall be the following:

(a) patient summaries;

(b) electronic prescriptions;

(c) electronic dispensations;

(d) medical imaging studies and related imaging reports;

(e) medical test results, including laboratory and other diagnostic results and related

reports; and

(f) discharge reports.

The main characteristics of the priority categories of personal electronic health data for

primary use shall be as set out in Annex I.

PE-CONS 76/24 125

# LIFE.5 EN

Member States may provide in their national law for additional categories of personal

electronic health data to be accessed and exchanged for primary use pursuant to this

Chapter.

The Commission may, by means of implementing acts, lay down cross-border

specifications for the categories of personal electronic health data referred to in the third

subparagraph of this paragraph pursuant to Article 15(3) and Article 23(8). Those

implementing acts shall be adopted in accordance with the examination procedure referred

to in Article 98(2).

2. The Commission is empowered to adopt delegated acts in accordance with Article 97 to

amend this Regulation by amending Annex I through the addition, modification or removal

of the main characteristics of the priority categories of personal electronic health data as

referred to in paragraph 1, provided that the amendments are aimed at adapting the priority

categories of personal electronic health data to technical developments and international

standards. Moreover, additions and modifications of those characteristics shall satisfy both

of the following criteria:

(a) the characteristic is relevant for healthcare provided to natural persons;

(b) the characteristic is used in the majority of Member States according to the most

recent information.

PE-CONS 76/24 126

# LIFE.5 EN

_Article 15_

_European electronic health record exchange format_

1. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, lay down the technical specifications for the priority

categories of personal electronic health data referred to in Article 14(1), setting out the

European electronic health record exchange format. Such format shall be commonly used,

machine-readable and allow transmission of personal electronic health data between

different software applications, devices and healthcare providers. Such format shall support

transmission of structured and unstructured health data and shall include the following

elements:

(a) harmonised datasets containing electronic health data and defining structures, such as

data fields and data groups for the representation of clinical content and other parts of

the electronic health data;

(b) coding systems and values to be used in datasets containing electronic health data;

(c) technical interoperability specifications for the exchange of electronic health data,

including its content representation, standards and profiles.

The implementing acts referred to in the first subparagraph of this paragraph shall be

adopted in accordance with the examination procedure referred to in Article 98(2).

PE-CONS 76/24 127

# LIFE.5 EN

2. The Commission shall, by means of implementing acts, provide regular updates of the

European electronic health record exchange format to integrate relevant revisions of the

healthcare coding systems and nomenclatures. Those implementing acts shall be adopted in

accordance with the examination procedure referred to in Article 98(2).

3. The Commission may, by means of implementing acts, lay down technical specifications

to extend the European electronic health record exchange format to additional categories of

personal electronic health data referred to in Article 14(1), third subparagraph. Those

implementing acts shall be adopted in accordance with the examination procedure referred

to in Article 98(2).

4. Member States shall ensure that the priority categories of personal electronic health data

referred to in Article 14 are issued in the European electronic health record exchange

format referred to in paragraph 1 of this Article. Where such data are transmitted by

automated means for primary use, the receiving provider shall accept the format of the data

and be able to read them.

PE-CONS 76/24 128

# LIFE.5 EN

_Article 16_

_Identification management_

1. Where natural persons use electronic health data access services referred to in Article 4,

those natural persons shall have the right to identify themselves electronically using any

electronic identification means which are recognised pursuant to Article 6 of Regulation

(EU) No 910/2014. Member States may provide complementary mechanisms to ensure

appropriate identity matching in cross-border situations.

2. The Commission shall, by means of implementing acts, determine the requirements for the

interoperable, cross-border identification and authentication mechanism for natural persons

and health professionals, in accordance with Regulation (EU) No 910/2014. That

mechanism shall facilitate the transferability of personal electronic health data in a

cross-border context. Those implementing acts shall be adopted in accordance with the

examination procedure referred to in Article 98(2).

3. The Commission, in cooperation with Member States, shall implement services required

by the interoperable, cross-border identification and authentication mechanism referred to

in paragraph 2 of this Article at Union level, as part of the cross-border infrastructure

referred to in Article 23.

PE-CONS 76/24 129

# LIFE.5 EN

4. The Member States’ competent authorities and the Commission shall implement the

interoperable, cross-border identification and authentication mechanism at Member State

and Union level, respectively.

_Article 17_

_Requirements for technical implementation_

The Commission shall, by means of implementing acts, determine the requirements for the

technical implementation of the rights set out in this Section.

Those implementing acts shall be adopted in accordance with the examination procedure referred to

in Article 98(2).

_Article 18_

_Compensation for making personal electronic health data available_

Providers receiving data under this Chapter shall not be required to compensate the healthcare

provider for making personal electronic health data available. A healthcare provider or a third party

shall not directly or indirectly charge data subjects a fee or costs, or require compensation, for

sharing or accessing data.

PE-CONS 76/24 130

# LIFE.5 EN

### **S ECTION 2** **G OVERNANCE FOR PRIMARY USE**

_Article 19_

_Digital health authorities_

1. Each Member State shall designate one or more digital health authorities responsible for

the implementation and enforcement of this Chapter at national level. The Member States

shall inform the Commission of the identity of the digital health authorities by … [the date

of entry into force of this Regulation + 24 months]. Where a Member State designates

more than one digital health authority or where the digital health authority consists of

multiple organisations, the Member State concerned shall communicate to the Commission

a description of the distribution of tasks between those various authorities or organisations.

Where a Member State designates several digital health authorities, it shall designate one

digital health authority to act as coordinator. The Commission shall make that information

publicly available.

2. Each digital health authority shall be entrusted with the following tasks and powers:

(a) ensuring the implementation of the rights and obligations provided for in this

Chapter and Chapter III by adopting necessary national, regional or local technical

solutions and by establishing relevant rules and mechanisms;

PE-CONS 76/24 131

# LIFE.5 EN

(b) ensuring that complete and up-to-date information about the implementation of rights

and obligations provided for in this Chapter and Chapter III is made readily available

to natural persons, health professionals and healthcare providers;

(c) in the implementation of technical solutions referred to in point (a) of this paragraph,

ensuring that such technical solutions comply with this Chapter, Chapter III and

Annex II;

(d) contributing at Union level to the development of technical solutions enabling natural

persons and health professionals to exercise their rights and comply with their

obligations set out in this Chapter;

(e) facilitating persons with disabilities to exercise their rights under this Chapter in

accordance with Directive (EU) 2019/882 of the European Parliament and of the

Council **[31]** ;

(f) supervising the national contact points for digital health and cooperating with other

digital health authorities and the Commission on further development of

MyHealth@EU;

(g) ensuring the implementation at national level of the European electronic health

record exchange format, in cooperation with national authorities and stakeholders;

**31** Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on
the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70).

PE-CONS 76/24 132

# LIFE.5 EN

(h) contributing at Union level to the development of the European electronic health

record exchange format, to the elaboration of common specifications, in accordance

with Article 36, which address quality, interoperability, security, safety, ease of use,

accessibility, non-discrimination or fundamental right concerns, and to the

elaboration of the specifications of the EU database for registration of EHR systems

and wellness applications referred to in Article 49;

(i) where applicable, performing market surveillance activities in accordance with

Article 43, while ensuring that any conflicts of interest are avoided;

(j) building national capacity for implementing requirements concerning interoperability

and security of electronic health data for primary use and participating in information

exchanges and capacity building activities at Union level;

(k) cooperating with market surveillance authorities, participating in the activities related

to handling of risks posed by EHR systems and of serious incidents and supervising

the implementation of corrective action in accordance with Article 44;

(l) cooperating with other relevant entities and bodies at local, regional, national or

Union level, to ensure interoperability, portability and security of electronic health

data;

(m) cooperating with supervisory authorities in accordance with Regulations

(EU) No 910/2014 and (EU) 2016/679 and Directive (EU) 2022/2555 of the

European Parliament and of the Council **[32]** and with other relevant authorities,

including those competent for cybersecurity and electronic identification.

**32** Directive (EU) 2022/2555 of the European Parliament and of the Council of
14 December 2022 on measures for a high common level of cybersecurity across the Union,
amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing
Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80).

PE-CONS 76/24 133

# LIFE.5 EN

3. Each Member State shall ensure that each digital health authority is provided with the

human, technical and financial resources, premises and infrastructure necessary for the

effective performance of its tasks and exercise of its powers.

4. In the performance of its tasks, each digital health authority shall avoid any conflicts of

interest. Each member of staff of the digital health authority shall act in the public interest

and in an independent manner.

5. In the performance of their tasks, the relevant digital health authorities shall actively

cooperate and consult with relevant stakeholders’ representatives, including patients’

representatives, healthcare providers and health professionals’ representatives, including

health professional associations, as well as consumer organisations and industry

associations.

PE-CONS 76/24 134

# LIFE.5 EN

_Article 20_

_Reporting by digital health authorities_

Digital health authorities designated pursuant to Article 19 shall publish an activity report every two

years, which shall contain a comprehensive overview of their activities. If a Member State

designates more than one digital health authority, one of them shall be responsible for the drawing

up of the report and, in doing so, it shall request the necessary information from the other digital

health authorities. That activity report shall follow a structure agreed at Union level within the

European Health Data Space Board (the ‘EHDS Board’) referred to in Article 92. That activity

report shall contain at least information concerning:

(a) the measures taken to implement this Regulation;

(b) the percentage of natural persons having access to the various data categories of their

electronic health records;

(c) the handling of requests from natural persons regarding the exercise of their rights pursuant

to this Regulation;

PE-CONS 76/24 135

# LIFE.5 EN

(d) the number of healthcare providers of different types, including pharmacies, hospitals and

other points of care, connected to MyHealth@EU calculated:

(i) in absolute terms;

(ii) as a share of all healthcare providers of the same type; and

(iii) as a share of natural persons that are able to use the services;

(e) the volumes of electronic health data of different categories shared across borders through

MyHealth@EU;

(f) the number of cases of non-compliance with mandatory requirements.

_Article 21_

_Right to lodge a complaint with a digital health authority_

1. Without prejudice to any other administrative or judicial remedy, natural and legal persons

shall have the right to lodge a complaint in relation to the provisions laid down in this

Chapter, individually or, where relevant, collectively, with the competent digital health

authority, provided that their rights or interests are negatively affected.

PE-CONS 76/24 136

# LIFE.5 EN

2. Where the complaint concerns the rights of natural persons pursuant to Articles 3 and 5 to

10 of this Regulation, the digital health authority shall transmit the complaint to the

competent supervisory authorities under Regulation (EU) 2016/679. The digital health

authority shall provide the necessary information at its disposal to the competent

supervisory authority under Regulation (EU) 2016/679 in order to facilitate the assessment

and investigation of the complaint.

3. The competent digital health authority with which the complaint has been lodged shall

inform, in accordance with national law, the complainant of the progress made in dealing

with the complaint, of the decision taken on the complaint, of any referral of the complaint

to the competent supervisory authority under Regulation (EU) 2016/679 and, in cases of

such a referral, that that supervisory authority is, from that moment on, to be the sole point

of contact for the complainant in that matter.

4. Digital health authorities in the Member States concerned shall cooperate to handle and

resolve complaints related to cross-border exchange of and access to personal electronic

health data, including by exchanging all relevant information by electronic means, without

undue delay.

5. Digital health authorities shall facilitate the submission of complaints and provide easily

accessible tools for the submission of complaints.

PE-CONS 76/24 137

# LIFE.5 EN

_Article 22_

_Relationship with supervisory authorities under Regulation (EU) 2016/679_

The supervisory authority or supervisory authorities responsible for monitoring and enforcing the

application of Regulation (EU) 2016/679 shall also be competent for monitoring and enforcing the

application of Articles 3 and 5 to 10 of this Regulation. The relevant provisions of Regulation

(EU) 2016/679 shall apply _mutatis mutandis_ . Supervisory authorities shall be empowered to impose

administrative fines up to the amount referred to in Article 83(5) of Regulation (EU) 2016/679.

The supervisory authorities referred to in the first paragraph of this Article and digital health

authorities referred to in Article 19 shall, where relevant, cooperate in the enforcement of this

Regulation, within the remit of their respective competences.

### **S ECTION 3** **C ROSS - BORDER INFRASTRUCTURE**

**FOR PRIMARY USE OF PERSONAL ELECTRONIC HEALTH DATA**

_Article 23_

_MyHealth@EU_

1. The Commission shall establish a central interoperability platform for digital health

(‘MyHealth@EU’) to provide services to support and facilitate the exchange of personal

electronic health data between the national contact points for digital health of the Member

States.

PE-CONS 76/24 138

# LIFE.5 EN

2. Each Member State shall designate one national contact point for digital health, as an

organisational and technical gateway for the provision of services linked to the

cross-border exchange of personal electronic health data in the context of primary use.

Each national contact point for digital health shall be connected to all other national

contact points for digital health in other Member States and to the central interoperability

platform for digital health in the cross-border infrastructure MyHealth@EU. Where a

national contact point for digital health is an entity consisting of multiple organisations

responsible for implementing different services, the Member State concerned shall

communicate to the Commission a description of the distribution of tasks between the

organisations. Each Member State shall inform the Commission of the identity of its

national contact point for digital health by … [the date of entry into force of this

Regulation + 24 months]. The national contact point for digital health may be designated

within the digital health authority referred to in Article 19. Member States shall inform the

Commission of any subsequent modification of the identity of those national contact points

for digital health. The Commission and the Member States shall make that information

publicly available.

PE-CONS 76/24 139

# LIFE.5 EN

3. Each national contact point for digital health shall enable the exchange of the personal

electronic health data referred to in Article 14(1) with national contact points for digital

health in other Member States through MyHealth@EU. That exchange shall be based on

the European electronic health record exchange format.

Where Member States provide for additional categories of personal electronic health data

under Article 14(1), third subparagraph, the national contact point for digital health shall

enable the exchange of the additional categories of personal electronic health data referred

to in Article 14(1), third subparagraph, insofar as the Member State concerned has

provided for those additional categories of personal electronic health data to be accessed

and exchanged in accordance with Article 14(1), third subparagraph.

4. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, adopt the necessary measures for the technical

development of MyHealth@EU, detailed rules concerning the security, confidentiality and

protection of personal electronic health data and the conditions for compliance checks

necessary to join and remain connected to MyHealth@EU. Those implementing acts shall

be adopted in accordance with the examination procedure referred to in Article 98(2).

5. Member States shall ensure the connection of all healthcare providers to their national

contact points for digital health. Member States shall ensure that connected healthcare

providers are able to perform two-way exchanges of electronic health data with the

national contact point for digital health.

PE-CONS 76/24 140

# LIFE.5 EN

6. Member States shall ensure that pharmacies operating on their territories, including online

pharmacies, are able to dispense electronic prescriptions issued in other Member States,

under the conditions laid down in Article 11 of Directive 2011/24/EU.

Pharmacies shall access and accept electronic prescriptions transmitted to them from other

Member States through MyHealth@EU, provided that the conditions laid down in

Article 11 of Directive 2011/24/EU are fulfilled.

Following the dispensation of medicinal products based on an electronic prescription from

another Member State, the pharmacy concerned shall report through MyHealth@EU such

dispensation to the national contact point for digital health of the Member State in which

that prescription was issued.

7. The national contact points for digital health shall act as joint controllers of the personal

electronic health data communicated through MyHealth@EU for the processing operations

in which they are involved. The Commission shall act as processor.

8. The Commission shall, by means of implementing acts, lay down the rules regarding the

requirements of cybersecurity, technical interoperability, semantic interoperability,

operations and service management in relation to the processing by the processor referred

to in paragraph 7 of this Article and its responsibilities towards the controllers, in

accordance with Chapter IV of Regulation (EU) 2016/679. Those implementing acts shall

be adopted in accordance with the examination procedure referred to in Article 98(2).

PE-CONS 76/24 141

# LIFE.5 EN

9. The national contact points for digital health shall fulfil the conditions to join and to

remain connected to MyHealth@EU as laid down in the implementing acts referred to in

paragraph 4. The compliance of the national contact points for digital health with those

conditions shall be verified by the Commission through compliance checks.

_Article 24_

_Supplementary cross-border digital health services and infrastructures_

1. Member States may provide through MyHealth@EU supplementary services that facilitate

telemedicine, mobile health, access by natural persons to existing translations of their

health data, exchange or verification of health-related certificates, including vaccination

card services supporting public health and public health monitoring or digital health

systems, services and interoperable applications, with a view to achieving a high level of

trust and security, enhancing continuity of care and ensuring access to safe and high

quality healthcare. The Commission shall, by means of implementing acts, set out the

technical aspects of such supplementary services. Those implementing acts shall be

adopted in accordance with the examination procedure referred to in Article 98(2).

2. The Commission and Member States may facilitate the exchange of personal electronic

health data with other infrastructures, such as the Clinical Patient Management System or

other services or infrastructures in the health, care or social security fields which may

become authorised participants in MyHealth@EU. The Commission shall, by means of

implementing acts, set out the technical aspects of such exchanges. Those implementing

acts shall be adopted in accordance with the examination procedure referred to in

Article 98(2).

PE-CONS 76/24 142

# LIFE.5 EN

The connection and disconnection of another infrastructure to the central platform for

digital health shall be subject to a decision of the Commission adopted by means of an

implementing act, based on the result of compliance checks of the technical aspects of

exchanges as referred to in the first subparagraph of this paragraph. That implementing act

shall be adopted in accordance with the examination procedure referred to in Article 98(2).

3. A national contact point for digital health of a third country or a system established at

international level by an international organisation may become an authorised participant

in MyHealth@EU provided that it fulfils the requirements of MyHealth@EU for the

purposes of the personal electronic health data exchange as referred to in Article 23, that

the transfer stemming from the connection to MyHealth@EU complies with the rules in

Chapter V of Regulation (EU) 2016/679, and that the requirements concerning legal,

organisational, operational, semantic, technical and cybersecurity measures are equivalent

to those applicable to Member States in the operation of MyHealth@EU services. Those

requirements shall be verified by the Commission through compliance checks.

Based on the outcome of the compliance checks referred to in the first subparagraph of this

paragraph, the Commission may, by means of implementing acts, decide to connect or

disconnect the national contact point for digital health of the third country or the system

established at international level by an international organisation, as applicable, to or from

MyHealth@EU. Those implementing acts shall be adopted in accordance with the

examination procedure referred to in Article 98(2).

The Commission shall establish and maintain a list of national contact points for digital

health of third countries or of systems established at international level by international

organisations which are connected to MyHealth@EU pursuant to this paragraph and shall

make it publicly available.

PE-CONS 76/24 143

# LIFE.5 EN

## **Chapter III** **EHR systems and wellness applications**

### **S ECTION 1** **S COPE AND GENERAL PROVISIONS FOR EHR SYSTEMS**

_Article 25_

_Harmonised software components of EHR systems_

1. EHR systems shall include a European interoperability software component for EHR

systems and a European logging software component for EHR systems (the ‘harmonised

software components of EHR systems’), in accordance with the provisions laid down in

this Chapter.

2. This Chapter shall not apply to general purpose software used in a healthcare environment.

_Article 26_

_Placing on the market and putting into service_

1. EHR systems shall be placed on the market or put into service only if they comply with the

provisions laid down in this Chapter.

PE-CONS 76/24 144

# LIFE.5 EN

2. EHR systems that are manufactured and used within health institutions established in the

Union, as well as EHR systems offered as a service as defined in Article 1(1), point (b), of

Directive (EU) 2015/1535 of the European Parliament and of the Council **[33]** to a natural or

legal person established in the Union, shall be considered as having been put into service.

3. Member States shall not prohibit or restrict the placing on the market of EHR systems

which comply with this Regulation, on account of considerations relating to aspects

concerning the harmonised software components of EHR systems regulated by this

Regulation.

_Article 27_

_Relation to Union law governing medical devices, in vitro diagnostic medical devices_

_and AI systems_

1. Manufacturers of medical devices or in vitro diagnostic medical devices, as defined in

Article 2, point (1), of Regulation (EU) 2017/745 and Article 2, point (2), of Regulation

(EU) 2017/746 respectively, that claim interoperability of those medical devices or in vitro

diagnostic medical devices with the harmonised software components of EHR systems

shall prove compliance with the essential requirements on the European interoperability

software component for EHR systems and the European logging software component for

EHR systems, laid down in Section 2 of Annex II to this Regulation. Article 36 of this

Regulation shall apply to those medical devices and in vitro diagnostic medical devices.

**33** Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September
2015 laying down a procedure for the provision of information in the field of technical
regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1).

PE-CONS 76/24 145

# LIFE.5 EN

2. Providers of AI systems considered to be high-risk in accordance with Article 6 of

                             Regulation (EU) 2024/1689 (the ‘high risk AI system’) and which do not fall within the

scope of Regulation (EU) 2017/745 or (EU) 2017/746, that claim interoperability of those

high-risk AI systems with the harmonised software components of EHR systems, shall

prove compliance with the essential requirements on the European interoperability

software component for EHR systems and the European logging software component for

EHR systems, as laid down in Section 2 of Annex II to this Regulation. Article 36 of this

Regulation shall apply to those high-risk AI systems.

_Article 28_

_Claims_

In the information sheet, instructions for use or other information accompanying EHR systems, and

in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and

figurative or other signs that may mislead the professional user as defined in Article 3, point (8), of

Regulation (EU) 2018/1807 with regard to their intended purpose, interoperability and security by:

(a) ascribing functions and properties to the EHR system which it does not have;

(b) failing to inform the professional user of likely limitations related to interoperability or

security features of the EHR system in relation to its intended purpose;

(c) suggesting uses for the EHR system other than those stated to form part of the intended

purpose in the technical documentation.

PE-CONS 76/24 146

# LIFE.5 EN

_Article 29_

_Procurement, reimbursement and financing_

Member States may maintain or define specific rules for the procurement or financing of, or

reimbursement for, EHR systems in the context of the organisation, delivery or financing of

healthcare services provided that such rules are compliant with Union law and do not affect the

functioning or compliance of the harmonised software components of EHR systems.

### **S ECTION 2** **O BLIGATIONS OF ECONOMIC OPERATORS WITH REGARD TO EHR SYSTEMS**

_Article 30_

_Obligations of manufacturers of EHR systems_

1. Manufacturers of EHR systems shall:

(a) ensure that the harmonised software components of their EHR systems and the EHR

systems themselves, to the extent that this Chapter establishes requirements for them,

are in conformity with the essential requirements laid down in Annex II and with the

common specifications in accordance with Article 36;

(b) ensure that the harmonised software components of their EHR systems are not

adversely affected by other software components of the same EHR system;

PE-CONS 76/24 147

# LIFE.5 EN

(c) draw up the technical documentation of their EHR systems in accordance with

Article 37 before placing those EHR systems on the market, and subsequently keep it

up to date;

(d) ensure that their EHR systems are accompanied, free of charge for the user, by the

information sheet provided for in Article 38 and clear and complete instructions for

use;

(e) draw up the EU declaration of conformity in accordance with Article 39;

(f) affix the CE marking of conformity in accordance with Article 41;

(g) indicate the name, registered trade name or registered trade mark, the postal address,

and the website, e-mail address or other digital contact details through which they

can be contacted, in the EHR system; indicate in the contact details a single point at

which the manufacturer can be contacted; the contact details shall be in a language

that is easily understood by users and market surveillance authorities;

(h) comply with the registration obligations in Article 49;

PE-CONS 76/24 148

# LIFE.5 EN

(i) take without undue delay any necessary corrective action in respect of their EHR

systems, where they consider or have reason to believe that such systems are not or

are no longer in conformity with the essential requirements laid down in Annex II, or

recall or withdraw such systems; the manufacturers of EHR systems shall

subsequently inform the national authorities of the Member States in which they

made their EHR systems available on the market or put them into service of the non

conformity, of any corrective action taken, including the timetable for

implementation, and of the date at which the harmonised software components of

their EHR systems have been brought into conformity or been recalled or withdrawn;

(j) inform the distributors of their EHR systems and, where applicable, the authorised

representative, importers and users of the non-conformity and of any corrective

action, recall or withdrawal of those EHR systems;

(k) inform the distributors of their EHR systems and, where applicable, the authorised

representative, importers and users of any mandatory preventive maintenance of the

EHR systems and its frequency;

(l) upon request, provide, in an official language of the Member State concerned, market

surveillance authorities in that Member State with all the information and

documentation necessary to demonstrate the conformity of the EHR systems which

they have placed on the market or put into service with the essential requirements

laid down in Annex II;

PE-CONS 76/24 149

# LIFE.5 EN

(m) cooperate with market surveillance authorities, at their request, on any action taken to

bring the EHR systems which they have placed on the market or put into service into

conformity with the essential requirements laid down in Annex II and with any

requirements adopted pursuant to Article 42 in an official language of the Member

State concerned;

(n) establish channels of complaint and keep distributors informed thereof;

(o) keep a register of complaints and a register of non-conforming EHR systems and

keep distributors informed thereof.

2. Manufacturers of EHR systems shall ensure that procedures are in place to ensure that the

design, development and deployment of the harmonised software components of an EHR

system continue to comply with the essential requirements laid down in Annex II and the

common specifications referred to in Article 36. Changes in EHR system design or

characteristics with regard to the harmonised software components of an EHR system shall

be adequately taken into account and reflected in the technical documentation.

3. Manufacturers of EHR systems shall keep the technical documentation referred to in

Article 37 and the EU declaration of conformity referred to in Article 39 for 10 years after

the EHR system covered by the EU declaration of conformity has been placed on the

market.

PE-CONS 76/24 150

# LIFE.5 EN

Manufacturers of EHR systems shall make available the source code or the programming

logic included in the technical documentation, upon a reasoned request, to the relevant

authorities, if that source code or programming logic is necessary in order for those

authorities to be able to check compliance with the essential requirements laid down in

Annex II.

4. A manufacturer of EHR systems established outside the Union shall ensure that its

authorised representative has the necessary documentation readily available in order to

fulfil the tasks referred to in Article 31(2).

5. Manufacturers of EHR systems shall, upon a reasoned request from a market surveillance

authority, provide it with all the information and documentation, in paper or electronic

form, necessary to demonstrate the conformity of the EHR system with the essential

requirements laid down in Annex II and the common specifications referred to in Article

36, in a language which can be easily understood by that market surveillance authority.

The manufacturers of EHR systems shall cooperate with the market surveillance authority,

at its request, on any measures taken to eliminate the risks posed by an EHR system which

they have placed on the market or put into service.

_Article 31_

_Authorised representatives_

1. Prior to making an EHR system available on the Union market, a manufacturer of an EHR

system established outside of the Union shall, by written mandate, appoint an authorised

representative which is established in the Union.

PE-CONS 76/24 151

# LIFE.5 EN

2. An authorised representative shall perform the tasks specified in the mandate agreed with

the manufacturer. The mandate shall allow the authorised representative to do at least the

following:

(a) keep the EU declaration of conformity and the technical documentation referred to in

Article 37 at the disposal of market surveillance authorities for the period referred to

in Article 30(3);

(b) further to a reasoned request from a market surveillance authority, provide authorities

of the Member State concerned with a copy of the mandate and all the information

and documentation necessary to demonstrate the conformity of an EHR system with

the essential requirements laid down in Annex II as well as the common

specifications referred to in Article 36;

(c) inform without undue delay the manufacturer if the authorised representative has

reason to believe that an EHR system is no longer in conformity with the essential

requirements laid down in Annex II;

(d) inform without undue delay the manufacturer about any complaint received from

consumers or professional users;

(e) cooperate with the market surveillance authorities, at their request, on any corrective

action taken in relation to the EHR systems covered by their mandate;

PE-CONS 76/24 152

# LIFE.5 EN

(f) terminate the mandate if the manufacturer does not comply with its obligations under

this Regulation;

(g) ensure that the technical documentation referred to in Article 37 can be made

available to relevant authorities, upon request.

3. In the event of a change of the authorised representative, the detailed arrangements for

such change shall address at least the following:

(a) the date of termination of the mandate of the outgoing authorised representative and

the date of the beginning of the mandate of the incoming authorised representative;

(b) the transfer of documents, including confidentiality aspects and property rights.

4. Where the manufacturer is established outside the Union and has not complied with the

obligations laid down in Article 30, the authorised representative shall be jointly and

severally liable for non-compliance with this Regulation on the same basis as the

manufacturer.

_Article 32_

_Obligations of importers_

1. Importers shall place on the Union market only EHR systems which are in conformity with

the essential requirements laid down in Annex II as well as the common specifications

referred to in Article 36.

PE-CONS 76/24 153

# LIFE.5 EN

2. Before making an EHR system available on the market, importers shall ensure that:

(a) the manufacturer has drawn up the technical documentation referred to in Article 37

and the EU declaration of conformity;

(b) the manufacturer is identified and an authorised representative has been appointed in

accordance with Article 31;

(c) the EHR system bears the CE marking of conformity referred to in Article 41 after

the conformity assessment procedure has been completed;

(d) the EHR system is accompanied by the information sheet referred to in Article 38

with clear and complete instructions for use, including for its maintenance, in

accessible formats.

3. Importers shall indicate their name, registered trade name or registered trade mark, the

postal address, website, e-mail address or other digital contact details through which they

can be contacted in a document accompanying the EHR system. The contact details shall

indicate a single point at which the manufacturer can be contacted and shall be in a

language which can be easily understood by users and market surveillance authorities.

Importers shall ensure that any additional label does not conceal or obscure any of the

information provided by the manufacturer that appears on any original label which is

provided for the EHR system.

PE-CONS 76/24 154

# LIFE.5 EN

4. Importers shall ensure that, while an EHR system is under their responsibility, the EHR

system is not altered in such a way that its conformity with the essential requirements laid

down in Annex II and with any requirements adopted pursuant to Article 42 is jeopardised.

5. Where an importer considers or has reason to believe that an EHR system is not or is no

longer in conformity with the essential requirements laid down in Annex II and with any

requirements adopted pursuant to Article 42, it shall not make that EHR system available

on the market, or, if that EHR system was already placed on the market, shall recall or

withdraw it, until the EHR system has been brought into conformity. In the event of such

recall or withdrawal, the importer shall inform without undue delay the manufacturer of

such EHR system, the users and the market surveillance authorities of the Member State in

which it made the EHR system available on the market of such recall or withdrawal, giving

details, in particular, of the non-conformity and of any corrective measures taken.

Where an importer considers or has reason to believe that an EHR system presents a risk to

the health or safety of natural persons, it shall without undue delay inform the market

surveillance authorities of the Member State in which it is established, as well as the

manufacturer and, where applicable, the authorised representative.

6. Importers shall keep a copy of the EU declaration of conformity at the disposal of the

market surveillance authorities for the period referred to in Article 30(3) and ensure that

the technical documentation referred to in Article 37 can be made available to those

authorities, upon request.

PE-CONS 76/24 155

# LIFE.5 EN

7. Importers shall, further to a reasoned request from market surveillance authorities of the

Member States concerned, provide them with all the information and documentation

necessary to demonstrate the conformity of an EHR system. Importers shall cooperate with

those authorities, at their request, and with the manufacturer and, where applicable, with

the authorised representative in an official language of the Member State where the market

surveillance authority is located. Importers shall cooperate with those authorities, at their

request, on any action taken to bring their EHR systems into conformity with the essential

requirements in relation to the harmonised software components as laid down in Annex II

or to ensure that the EHR systems which are not in conformity with those essential

requirements are recalled or withdrawn.

8. Importers shall establish reporting channels and ensure that they are accessible to allow

users to submit complaints, and shall keep a register of complaints, of non-conforming

EHR systems and EHR system recalls and withdrawals. Importers shall verify whether the

channels of complaint established pursuant to Article 30(1), point (n), are publicly

available allowing users to submit complaints and to receive any communication

concerning any risk related to their health and safety or to other aspects of public interest

protection and allowing users to be informed of any serious incident involving an EHR

system. Where such channels of complaint were not established, the importers shall

establish them and take into account the accessibility needs of vulnerable groups and

persons with disabilities.

PE-CONS 76/24 156

# LIFE.5 EN

9. Importers shall investigate complaints and follow up on information received on incidents

involving an EHR system they made available on the market. Importers shall register those

complaints, any recalls or withdrawals of EHR systems and any corrective measure taken

to bring the EHR system into conformity, in the register referred to in Article 30(1),

point (o), or in their own internal register. Importers shall keep the manufacturer,

distributors and, where relevant, authorised representatives informed in a timely manner of

the investigation and follow-up carried out and of the results of the investigation and

follow-up.

_Article 33_

_Obligations of distributors_

1. Before making an EHR system available on the market, distributors shall verify that:

(a) the manufacturer has drawn up the EU declaration of conformity;

(b) the EHR system bears the CE marking of conformity;

(c) the EHR system is accompanied by the information sheet referred to in Article 38

with clear and complete instructions for use in accessible formats;

(d) where applicable, the importer has complied with the requirements set out in

Article 32(3).

PE-CONS 76/24 157

# LIFE.5 EN

2. Distributors shall ensure that, while an EHR system is under their responsibility, the EHR

system is not altered in such a way that its conformity with the essential requirements laid

down in Annex II and with any requirements adopted pursuant to Article 42 is jeopardised.

3. Where a distributor considers or has reason to believe that an EHR system is not in

conformity with the essential requirements laid down in Annex II and with any

requirements adopted pursuant to Article 42, it shall not make that EHR system available

on the market until it has been brought into conformity. The distributor shall inform

without undue delay the manufacturer or the importer, as well as the market surveillance

authorities of the Member States where the EHR system has been or is to be made

available on the market, to that effect. Where a distributor considers or has reason to

believe that an EHR system presents a risk to the health or safety of natural persons, it shall

inform the market surveillance authorities of the Member State in which the distributor is

established, as well as the manufacturer and the importer.

4. Distributors shall, further to a reasoned request from a market surveillance authority,

provide it with all the information and documentation necessary to demonstrate the

conformity of an EHR system. They shall cooperate with that authority, at its request, and

with the manufacturer, the importer and, where applicable, with the manufacturer’s

authorised representative on any action taken to bring an EHR system into conformity with

the essential requirements laid down in Annex II and with any requirements adopted

pursuant to Article 42 or to recall or withdraw it.

PE-CONS 76/24 158

# LIFE.5 EN

_Article 34_

_Cases in which obligations of manufacturers of an EHR system apply_

_to other entities or individuals_

An importer, distributor or user shall be considered a manufacturer for the purposes of this

Regulation and shall be subject to the obligations laid down in Article 30 where they:

(a) make an EHR system available on the market under their own name or trademark;

(b) modify an EHR system already placed on the market in such a way that conformity with

the applicable requirements might be affected; or

(c) modify an EHR system in such a way that it leads to changes in the intended purpose

declared by the manufacturer.

_Article 35_

_Identification of economic operators_

Economic operators shall, on request, identify the following to the market surveillance authorities,

for 10 years from the date when the last EHR system covered by the EU declaration of conformity

has been placed on the market:

(a) any economic operator who has supplied them with an EHR system; and

(b) any economic operator to whom they have supplied an EHR system.

PE-CONS 76/24 159

# LIFE.5 EN

### **S ECTION 3** **C ONFORMITY OF THE HARMONISED SOFTWARE COMPONENTS OF EHR SYSTEMS**

_Article 36_

_Common specifications_

1. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, adopt common specifications in respect of the

essential requirements laid down in Annex II, including a common template and a time

limit for implementing those common specifications. Where relevant, those common

specifications shall take into account the specificities of medical devices and high-risk AI

systems referred to in Article 27(1) and (2), respectively, including the state-of-the-art

standards for health informatics and the European electronic health record exchange

format. Those implementing acts shall be adopted in accordance with the examination

procedure referred to in Article 98(2).

2. The common specifications referred to in paragraph 1 shall include the following

information and elements:

(a) their scope;

(b) their applicability to different categories of EHR systems or functions included in

them;

(c) their version;

PE-CONS 76/24 160

# LIFE.5 EN

(d) their validity period;

(e) a normative part;

(f) an explanatory part, including any relevant implementation guidelines.

3. The common specifications referred to in paragraph 1 may include elements related to the

following:

(a) datasets containing electronic health data and defining structures, such as data fields

and data groups for the representation of clinical content and other parts of the

electronic health data;

(b) coding systems and values to be used in datasets containing electronic health data,

taking due account of both potential future harmonisation of terminologies and their

compatibility with existing national terminologies;

(c) other requirements related to data quality, such as the completeness and accuracy of

electronic health data;

(d) technical specifications, standards and profiles for the exchange of electronic health

data;

(e) requirements and principles related to patient safety and the security, confidentiality,

integrity and protection of electronic health data;

(f) specifications and requirements related to identification management and the use of

electronic identification.

PE-CONS 76/24 161

# LIFE.5 EN

4. EHR systems, medical devices, in vitro diagnostic medical devices and high-risk AI

systems referred to in Articles 25 and 27 that are in conformity with the common

specifications referred to in paragraph 1 of this Article shall be considered to be in

conformity with the essential requirements covered by those common specifications or

parts thereof, laid down in Annex II, and covered by those common specifications or the

relevant parts thereof.

5. Where common specifications covering interoperability and security requirements of EHR

systems affect medical devices, in vitro diagnostic medical devices or high-risk AI systems

falling under other legal acts, such as Regulation (EU) 2017/745, (EU) 2017/746 or

(EU) 2024/1689, the adoption of those common specifications may be preceded by a

consultation with the Medical Device Coordination Group (MDCG) established by

Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board

established by Article 65 of Regulation (EU) 2024/1689 and the European Data Protection

Board (EDPB), as applicable.

6. Where common specifications covering interoperability and security requirements of

medical devices, in vitro diagnostic medical devices or high-risk AI systems falling under

other legal acts, such as Regulation (EU) 2017/745, (EU) 2017/746 or (EU) 2024/1689,

affect EHR systems, the Commission shall ensure that the adoption of those common

specifications is preceded by a consultation with the EHDS Board and the EDPB, as

applicable.

PE-CONS 76/24 162

# LIFE.5 EN

_Article 37_

_Technical documentation_

1. Manufacturers shall draw up technical documentation before the EHR system is placed on

the market or put into service, and shall keep that documentation up to date.

2. The technical documentation referred to in paragraph 1 of this Article shall demonstrate

that the EHR system complies with the essential requirements laid down in Annex II and

provide market surveillance authorities with all the necessary information to assess the

conformity of the EHR system with those requirements. That technical documentation

shall contain, as a minimum, the elements set out in Annex III and a reference to the results

obtained from a European digital testing environment referred to in Article 40.

3. The technical documentation referred to in paragraph 1 shall be drawn up in an official

language of the Member State concerned or a language that is easily understandable in that

Member State. Following a reasoned request from the market surveillance authority of a

Member State, the manufacturer shall provide a translation of the relevant parts of the

technical documentation into an official language of that Member State.

PE-CONS 76/24 163

# LIFE.5 EN

4. When a market surveillance authority requests the technical documentation or a translation

of parts thereof from a manufacturer, the manufacturer shall provide such technical

documentation or translation within 30 days of the date of the request, unless a shorter

deadline is justified because of a serious and immediate risk. If the manufacturer does not

comply with the requirements of paragraphs 1, 2 and 3 of this Article, the market

surveillance authority may require it to have a test performed by an independent body at its

own expense within a specified period in order to verify the conformity with the essential

requirements laid down in Annex II and the common specifications referred to in

Article 36.

_Article 38_

_Information sheet accompanying the EHR system_

1. EHR systems shall be accompanied by an information sheet that includes concise,

complete, correct and clear information that is relevant, accessible and comprehensible to

professional users.

2. The information sheet referred to in paragraph 1 shall specify:

(a) the identity, registered trade name or registered trademark, and contact details of the

manufacturer and, where applicable, of its authorised representative;

(b) the name and version of the EHR system and date of its release;

(c) the intended purpose of the EHR system;

PE-CONS 76/24 164

# LIFE.5 EN

(d) the categories of electronic health data that the EHR system has been designed to

process;

(e) the standards, formats and specifications supported by the EHR system and versions

of those standards, formats and specifications.

3. As an alternative to supplying the information sheet referred to in paragraph 1 of this

Article with the EHR system, manufacturers may enter the information referred to in

paragraph 2 of this Article into the EU database for registration of EHR systems and

wellness applications referred to in Article 49.

_Article 39_

_EU declaration of conformity_

1. The EU declaration of conformity referred to in Article 30(1), point (e), shall state that the

manufacturer of an EHR system has demonstrated that the essential requirements laid

down in Annex II have been fulfilled.

2. Where an EHR system is subject to other Union legal acts in respect of aspects not covered

by this Regulation, which also require an EU declaration of conformity by the

manufacturer in which it is stated that the fulfilment of the requirements of those legal acts

has been demonstrated, a single EU declaration of conformity shall be drawn up in respect

of all Union legal acts applicable to the EHR system. That EU declaration of conformity

shall contain all the information required for the identification of the Union legal acts to

which it relates.

PE-CONS 76/24 165

# LIFE.5 EN

3. The EU declaration of conformity shall contain the information set out in Annex IV and

shall be translated into one or more official Union languages determined by the Member

States in which the EHR system is made available.

4. Where an EU declaration of conformity is drawn up in a digital format, it shall be made

accessible online for the expected lifetime of the EHR system and, in any event, for at least

10 years from the placing on the market or the putting into service of the EHR system.

5. By drawing up the EU declaration of conformity, the manufacturer shall assume

responsibility for the compliance of the harmonised software components of the EHR

system with the requirements laid down in this Regulation when it is placed on the market

or put into service.

6. The Commission shall publish a standard uniform template for the EU declaration of

conformity and make it available in a digital format in all official languages of the Union.

_Article 40_

_European digital testing environment_

1. The Commission shall develop a European digital testing environment for the assessment

of harmonised software components of EHR systems. The Commission shall make the

software supporting the European digital testing environment available as open-source.

PE-CONS 76/24 166

# LIFE.5 EN

2. Member States shall operate digital testing environments for the assessment of harmonised

software components of EHR systems. Such digital testing environments shall comply with

the common specifications for the European digital testing environment laid down

pursuant to paragraph 4. Member States shall inform the Commission about their digital

testing environments.

3. Before placing EHR systems on the market, manufacturers shall use the digital testing

environments referred to in paragraphs 1 and 2 of this Article for the assessment of

harmonised software components of EHR systems. The results of that assessment shall be

included in the technical documentation referred to in Article 37. The elements in relation

to which the results of the assessment are positive shall be presumed to be in conformity

with this Regulation.

4. The Commission shall, by means of implementing acts, lay down the common

specifications for the European digital testing environment. Those implementing acts shall

be adopted in accordance with the examination procedure referred to in Article 98(2).

_Article 41_

_CE marking of conformity_

1. The CE marking of conformity shall be affixed visibly, legibly and indelibly to the

accompanying documents of the EHR system and, where applicable, to the packaging of

the EHR system.

PE-CONS 76/24 167

# LIFE.5 EN

2. The CE marking of conformity shall be affixed before placing the EHR system on the

market.

3. The CE marking of conformity shall be subject to the general principles set out in

Article 30 of Regulation (EC) No 765/2008.

_Article 42_

_National requirements and reporting to the Commission_

1. Member States may adopt national requirements for EHR systems and provisions on their

conformity assessment in relation to aspects other than the harmonised software

components of EHR systems.

2. The national requirements or provisions referred to in paragraph 1 shall not adversely

affect the harmonised software components of EHR systems.

3. When Member States adopt requirements or provisions in accordance with paragraph 1,

they shall inform the Commission thereof.

PE-CONS 76/24 168

# LIFE.5 EN

### **S ECTION 4** **M ARKET SURVEILLANCE OF EHR SYSTEMS**

_Article 43_

_Market surveillance authorities_

1. Regulation (EU) 2019/1020 shall apply to EHR systems in relation to the requirements

applicable to, and risks posed by, EHR systems covered by this Chapter.

2. Member States shall designate the market surveillance authority or authorities responsible

for the implementation of this Chapter. Member States shall entrust their market

surveillance authorities with the necessary powers and shall provide them with the human,

financial and technical resources, the equipment and the knowledge necessary for the

proper performance of their tasks pursuant to this Regulation. Market surveillance

authorities shall be empowered to take the market surveillance measures referred to in

Article 16 of Regulation (EU) 2019/1020 to enforce the obligations laid down in this

Chapter. Member States shall communicate the identity of the market surveillance

authorities they designate to the Commission. The Commission and the Member States

shall make that information publicly available.

PE-CONS 76/24 169

# LIFE.5 EN

3. Market surveillance authorities designated pursuant to paragraph 2 of this Article may be

the same authorities as the digital health authorities designated pursuant to Article 19.

Where a digital health authority carries out tasks of a market surveillance authority,

Member States shall ensure that any conflicts of interest are avoided.

4. Market surveillance authorities shall report to the Commission on a yearly basis the

outcomes of relevant market surveillance activities.

5. Where a manufacturer or another economic operator fails to cooperate with a market

surveillance authority or where the information and documentation they have provided is

incomplete or incorrect, the market surveillance authority may take all appropriate

measures to prohibit or restrict the relevant EHR system from being made available on the

market until the manufacturer or the economic operator concerned cooperates or provides

complete and correct information, or to recall or withdraw such EHR system from the

market.

6. The market surveillance authorities of the Member States shall cooperate with each other

and with the Commission. The Commission shall enable the organisation of exchanges of

information necessary for such cooperation.

7. For medical devices, in vitro diagnostic medical devices or high-risk AI systems referred to

in Article 27(1) and (2), the responsible authorities for market surveillance shall be those

referred to in Article 93 of Regulation (EU) 2017/745, Article 88 of Regulation

(EU) 2017/746 or Article 70 of Regulation (EU) 2024/1689, as applicable.

PE-CONS 76/24 170

# LIFE.5 EN

_Article 44_

_Handling of risks posed by EHR systems and of serious incidents_

1. Where a market surveillance authority of one Member State has reason to believe that an

EHR system poses a risk to the health, safety or rights of natural persons or to the

protection of personal data, that market surveillance authority shall carry out an evaluation

in relation to the EHR system concerned covering all relevant requirements laid down in

this Regulation. The manufacturer, the manufacturer’s authorised representative and all

other relevant economic operators shall cooperate as necessary with the market

surveillance authority for that purpose and take all appropriate measures to ensure that the

EHR system concerned no longer poses that risk when placed on the market or to recall or

withdraw the EHR system from the market within a reasonable period.

2. Where the market surveillance authorities of a Member State consider that the non

compliance of the EHR system is not limited to their national territory, they shall inform

the Commission and the other Member States’ market surveillance authorities of the results

of the evaluation referred to in paragraph 1 of this Article and of the corrective action

which they have required the economic operator to take pursuant to Article 16(2) of

Regulation (EU) 2019/1020.

PE-CONS 76/24 171

# LIFE.5 EN

3. Where a market surveillance authority finds that an EHR system has caused harm to the

health or safety of natural persons or to certain aspects of public interest protection, the

manufacturer shall immediately provide information and documentation, as applicable, to

the affected natural person or user and, where applicable, other third parties affected by

that harm, without prejudice to data protection rules.

4. The economic operator concerned referred to in paragraph 1 shall ensure that corrective

action is taken in respect of all the EHR systems concerned that it has placed on the market

throughout the Union.

5. The market surveillance authority shall without undue delay inform the Commission and

the market surveillance authorities, or, if applicable, the supervisory authorities under

Regulation (EU) 2016/679, of other Member States of the corrective action referred to in

paragraph 2. That information shall include all available details, in particular the data

necessary for the identification of the EHR system concerned, the origin and the supply

chain of the EHR system, the nature of the risk involved and the nature and duration of the

national measures taken.

6. Where a finding of a market surveillance authority, or a serious incident it is informed of,

concerns personal data protection, that market surveillance authority shall without undue

delay inform the relevant supervisory authorities under Regulation (EU) 2016/679 and

cooperate with them.

PE-CONS 76/24 172

# LIFE.5 EN

7. Manufacturers of EHR systems placed on the market or put into service shall report any

serious incident involving an EHR system to the market surveillance authorities of the

Member States where such serious incident occurred and of the Member States where such

EHR systems are placed on the market or put into service. That reporting shall also include

a description of the corrective action taken or envisaged by the manufacturer. Member

States may provide for users of EHR systems placed on the market or put into service to be

able to report such incidents.

The reporting required pursuant to the first subparagraph of this paragraph shall be carried

out, without prejudice to incident notification requirements under Directive

(EU) 2022/2555, immediately after the manufacturer has established a causal link between

the EHR system and the serious incident or the reasonable likelihood of such a link and, in

any event, not later than three days after the manufacturer becomes aware of the serious

incident involving the EHR system.

8. The market surveillance authorities referred to in paragraph 7 shall inform the other market

surveillance authorities, without delay, of the serious incident and the corrective action

taken or envisaged by the manufacturer or required of it to minimise the risk of recurrence

of the serious incident.

9. Where its tasks are not performed by the digital health authority, the market surveillance

authority shall cooperate with the digital health authority. The market surveillance

authority shall inform the digital health authority of any serious incidents and of EHR

systems presenting a risk, including risks related to interoperability, security and patient

safety, and of any corrective action, and of any recall or withdrawal of such EHR systems.

PE-CONS 76/24 173

# LIFE.5 EN

10. In the event of incidents putting at risk patient safety or information security, the market

surveillance authorities may take immediate action and require the manufacturer of the

EHR system concerned, its authorised representative and other economic operators, if

applicable, to take immediate corrective action.

_Article 45_

_Handling of non-compliance_

1. Where a market surveillance authority makes a finding of non-compliance, it shall require

the manufacturer of the EHR system concerned, its authorised representative and all other

relevant economic operators to take, by a specific deadline, adequate corrective action to

bring the EHR system into conformity. Such findings of non-compliance include, but are

not limited to, the following:

(a) the EHR system is not in conformity with essential requirements laid down in

Annex II or with the common specifications referred to in Article 36;

(b) the technical documentation is not available, not complete or not in accordance with

Article 37;

(c) the EU declaration of conformity has not been drawn up or has not been drawn up

correctly in accordance with Article 39;

(d) the CE marking of conformity has been affixed in breach of Article 41 or has not

been affixed;

(e) the registration obligations of Article 49 have not been fulfilled.

PE-CONS 76/24 174

# LIFE.5 EN

2. Where the manufacturer of the EHR system concerned, its authorised representative or any

other relevant economic operator does not take adequate corrective action within a

reasonable period, the market surveillance authorities shall take all appropriate provisional

measures to prohibit or restrict the EHR system from being made available on the market

of their Member States, or to recall or withdraw the EHR system from that market.

The market surveillance authorities shall inform the Commission and the other Member

States’ market surveillance authorities, without delay, of those provisional measures. That

information shall include all available details, in particular the data necessary for the

identification of the non-compliant EHR system, the origin of that EHR system, the nature

of the non-compliance alleged and the risk involved, the nature and duration of the

measures taken by the market surveillance authorities and the arguments put forward by

the relevant economic operator. In particular, the market surveillance authorities shall

indicate whether the non-compliance is due to any of the following:

(a) failure of the EHR system to meet the essential requirements set out in Annex II;

(b) shortcomings regarding the common specifications referred to in Article 36.

3. Market surveillance authorities other than the market surveillance authorities initiating the

procedure under this Article shall inform without delay the Commission and the other

Member States’ market surveillance authorities of any measures adopted, of any additional

information at their disposal relating to the non-compliance of the EHR system concerned

and, in the event of disagreement with the adopted national measure, of their objections.

PE-CONS 76/24 175

# LIFE.5 EN

4. Where, within three months of receipt of the information referred to in the second

subparagraph of paragraph 2, no objection has been raised by either a market surveillance

authority from another Member State or the Commission in respect of a provisional

measure taken by a market surveillance authority, that measure shall be deemed justified.

5. Where the non-compliance referred to in paragraph 1 persists, the market surveillance

authority concerned shall take all appropriate measures to prohibit or restrict the EHR

system from being made available on the market or ensure that it is recalled or withdrawn

from the market.

_Article 46_

_Union safeguard procedure_

1. Where, under Article 44(2) and Article 45(3), objections are raised against a national

measure taken by a market surveillance authority, or where the Commission considers a

national measure to be contrary to Union law, the Commission shall without delay enter

into consultations with that market surveillance authority and the relevant economic

operators and shall evaluate the national measure concerned. On the basis of the results of

that evaluation, the Commission shall adopt an implementing decision determining

whether the national measure is justified. That implementing decision shall be adopted in

accordance with the examination procedure referred to in Article 98(2). The Commission

shall address its implementing decision to all Member States and shall immediately

communicate it to them and to the relevant economic operators.

PE-CONS 76/24 176

# LIFE.5 EN

2. If the national measure referred to in paragraph 1 is considered justified by the

Commission, all Member States concerned shall take the necessary measures to ensure that

the non-compliant EHR system is withdrawn from their market, and shall inform the

Commission accordingly.

If the national measure referred to in paragraph 1 is considered unjustified by the

Commission, the Member State concerned shall revoke that measure.

### **S ECTION 5** **O THER PROVISIONS ON INTEROPERABILITY**

_Article 47_

_Labelling of wellness applications_

1. Where a manufacturer of a wellness application claims interoperability with an EHR

system in relation to the harmonised software components of EHR systems and therefore

compliance with the common specifications referred to in Article 36 and essential

requirements laid down in Annex II, such wellness application shall be accompanied by a

label, clearly indicating its compliance with those specifications and requirements. That

label shall be issued by the manufacturer of the wellness application.

PE-CONS 76/24 177

# LIFE.5 EN

2. The label referred to in paragraph 1 shall indicate the following information:

(a) the categories of electronic health data for which compliance with essential

requirements laid down in Annex II has been confirmed;

(b) a reference to common specifications to demonstrate compliance;

(c) the validity period of the label.

3. The Commission shall, by means of implementing acts, determine the format and content

of the label referred to in paragraph 1. Those implementing acts shall be adopted in

accordance with the examination procedure referred to in Article 98(2).

4. The label shall be drawn-up in one or more official languages of the Union or in an easily

understandable language determined by the Member State in which the wellness

application is placed on the market or put into service.

5. The validity of the label shall not exceed three years.

6. If the wellness application is an integral part of a device or is embedded in a device after it

has been put into service, the accompanying label shall be shown in the application itself or

placed on that device. Where the wellness application consists only of software, the label

shall have a digital format and shall be shown in the application itself. Two-dimensional

(2D) barcodes may also be used to display the label.

PE-CONS 76/24 178

# LIFE.5 EN

7. The market surveillance authorities shall check the compliance of wellness applications

with the essential requirements laid down in Annex II.

8. Each supplier of a wellness application for which a label has been issued shall ensure that

the wellness application that is placed on the market or put into service is accompanied by

the label for each individual unit, free of charge.

9. Each distributor of a wellness application for which a label has been issued shall make the

label available to customers at the point of sale in electronic form.

_Article 48_

_Interoperability of wellness applications with EHR systems_

1. Manufacturers of wellness applications may claim interoperability with an EHR system,

provided that the relevant common specifications and essential requirements referred to in

Article 36 and Annex II, respectively, are met. In the event of such claim, those

manufacturers shall duly inform users of the interoperability of such wellness applications

and the effects of such interoperability.

PE-CONS 76/24 179

# LIFE.5 EN

2. The interoperability of wellness applications with EHR systems shall not entail the

automatic sharing of all or part of the health data from the wellness application with, or

automatic transmission of all or part of such data to, the EHR system. The sharing or

transmission of such data shall only be possible if it is in accordance with Article 5 and

after consent is given by the natural person concerned and interoperability shall be limited

exclusively to those purposes. The manufacturers of wellness applications claiming

interoperability with an EHR system shall ensure that the natural person concerned is able

to choose which categories of health data from the wellness application are to be inserted

in the EHR system and the circumstances for the sharing or transmission of those

categories of data.

### **S ECTION 6** **R EGISTRATION OF EHR SYSTEMS AND WELLNESS APPLICATIONS**

_Article 49_

_EU database for registration of EHR systems and wellness applications_

1. The Commission shall establish and maintain a publicly available EU database with data

on EHR systems for which an EU declaration of conformity has been issued pursuant to

Article 39 and wellness applications for which a label has been issued pursuant to

Article 47 (the ‘EU database for registration of EHR systems and wellness applications’).

PE-CONS 76/24 180

# LIFE.5 EN

2. Before placing on the market or putting into service an EHR system referred to in

Article 26 or a wellness application referred to in Article 47, the manufacturer of such

EHR system or wellness application or, where applicable, its authorised representative

shall enter the required data as referred to in paragraph 4 of this Article into the EU

database for registration of EHR systems and wellness applications, including, in the case

of EHR systems, the results of the assessment referred to in Article 40.

3. Medical devices, in vitro diagnostic medical devices or high-risk AI systems referred to in

Article 27(1) and (2) of this Regulation shall also be registered in the databases established

pursuant to Regulation (EU) 2017/745, (EU) 2017/746 or (EU) 2024/1689, as applicable.

In such cases, the data to be entered shall also be forwarded to the EU database for

registration of EHR systems and wellness applications.

4. The Commission is empowered to adopt delegated acts in accordance with Article 97 to

supplement this Regulation by determining the list of required data to be entered into the

EU database for registration of EHR systems and wellness applications by the

manufacturers of EHR systems and wellness applications pursuant to paragraph 2 of this

Article.

PE-CONS 76/24 181

# LIFE.5 EN

## **Chapter IV** **Secondary use**

### **S ECTION 1** **G ENERAL CONDITIONS WITH REGARD TO SECONDARY USE**

_Article 50_

_Applicability to health data holders_

1. The following categories of health data holders shall be exempt from the obligations on

health data holders laid down in this Chapter:

(a) natural persons, including individual researchers;

(b) legal persons that qualify as microenterprises as defined in Article 2(3) of the Annex

to Commission Recommendation 2003/361/EC.

2. Member States may provide in their national law that the obligations of health data holders

laid down in this Chapter apply to the health data holders referred to in paragraph 1 which

fall under their jurisdiction.

PE-CONS 76/24 182

# LIFE.5 EN

3. Member States may provide in their national law that the duties of certain categories of

health data holders are to be fulfilled by health data intermediation entities. In that case, the

data shall nevertheless be considered as being made available by several health data

holders.

4. Member States shall notify to the Commission the national law referred to in paragraphs 2

and 3 by … [date of entry into force of this Regulation + 48 months]. Any subsequent law

or amendment affecting such law shall be notified to the Commission without delay.

_Article 51_

_Minimum categories of electronic health data for secondary use_

1. Health data holders shall make the following categories of electronic health data available

for secondary use in accordance with this Chapter:

(a) electronic health data from EHRs;

(b) data on factors impacting on health, including socio-economic, environmental and

behavioural determinants of health;

(c) aggregated data on healthcare needs, resources allocated to healthcare, the provision

of and access to healthcare, healthcare expenditure and financing;

(d) data on pathogens that impact human health;

PE-CONS 76/24 183

# LIFE.5 EN

(e) healthcare-related administrative data, including on dispensations, reimbursement

claims and reimbursements;

(f) human genetic, epigenomic and genomic data;

(g) other human molecular data such as proteomic, transcriptomic, metabolomic,

lipidomic and other omic data;

(h) personal electronic health data automatically generated through medical devices;

(i) data from wellness applications;

(j) data on professional status, and on the specialisation and institution of health

professionals involved in the treatment of a natural person;

(k) data from population-based health data registries such as public health registries;

(l) data from medical registries and mortality registries;

(m) data from clinical trials, clinical studies, clinical investigations and performance

studies subject to Regulation (EU) No 536/2014, Regulation (EU) 2024/1938 of the

European Parliament and of the Council **[34]**, Regulation (EU) 2017/745 and Regulation

(EU) 2017/746;

(n) other health data from medical devices;

**34** Regulation (EU) 2024/1938 of the European Parliament and of the Council of 13 June 2024
on standards of quality and safety for substances of human origin intended for human
application and repealing Directives 2002/98/EC and 2004/23/EC
(OJ L 2024/1938, 17.7.2024, ELI: http://data.europa.eu/eli/reg/2024/1938/oj).

PE-CONS 76/24 184

# LIFE.5 EN

(o) data from registries for medicinal products and medical devices;

(p) data from research cohorts, questionnaires and surveys related to health, after the first

publication of the related results;

(q) health data from biobanks and associated databases.

2. Member States may provide in their national law that additional categories of electronic

health data are to be made available for secondary use pursuant to this Regulation.

3. Member States may establish rules for the processing and use of electronic health data

containing improvements related to the processing of those data, such as correction,

annotation or enrichment, based on a data permit pursuant to Article 68.

4. Member States may introduce stricter measures and additional safeguards at national level

aimed at safeguarding the sensitivity and value of the data that fall under paragraph 1,

points (f), (g), (i) and (q). Member States shall notify the Commission of those measures

and safeguards and, without delay, of any subsequent amendment affecting them.

PE-CONS 76/24 185

# LIFE.5 EN

_Article 52_

_Intellectual property rights and trade secrets_

1. Electronic health data protected by intellectual property rights, trade secrets or covered by

the regulatory data protection right laid down in Article 10(1) of Directive 2001/83/EC of

the European Parliament and of the Council **[35]** or Article 14(11) of Regulation

(EC) No 726/2004 of the European Parliament and of the Council **[36]** shall be made available

for secondary use in accordance with the rules laid down in this Regulation.

2. Health data holders shall inform the health data access body of any electronic health data

containing content or information protected by intellectual property rights, trade secrets or

covered by the regulatory data protection right laid down in Article 10(1) of Directive

2001/83/EC or Article 14(11) of Regulation (EC) 726/2004. Health data holders shall

identify which parts of the datasets are concerned and justify the need for the specific

protection of the data. Health data holders shall provide that information when

communicating to the health data access body the description of the dataset they hold

pursuant to Article 60(3) of this Regulation or, at the latest, following a request received

from the health data access body.

**35** Directive 2001/83/EC of the European Parliament and of the Council of 6 November 2001
on the Community code relating to medicinal products for human use
(OJ L 311, 28.11.2001, p. 67).
**36** Regulation (EC) No 726/2004 of the European Parliament and of the Council of 31 March
2004 laying down Union procedures for the authorisation and supervision of medicinal
products for human use and establishing a European Medicines Agency
(OJ L 136, 30.4.2004, p. 1).

PE-CONS 76/24 186

# LIFE.5 EN

3. Health data access bodies shall take all specific appropriate and proportionate measures,

including of a legal, organisational and technical nature, they deem necessary to protect the

intellectual property rights, trade secrets or the regulatory data protection right laid down in

Article 10(1) of Directive 2001/83/EC or Article 14(11) of Regulation (EC) 726/2004.

Health data access bodies shall remain responsible for determining whether such measures

are necessary and appropriate.

4. When issuing data permits in accordance with Article 68, health data access bodies may

make the access to certain electronic health data conditional on legal, organisational and

technical measures, which may include contractual arrangements between health data

holders and health data users for the sharing of data containing information or content

protected by intellectual property rights or trade secrets. The Commission shall develop

and recommend non-binding models of contractual terms for such arrangements.

5. Where the granting of access to electronic health data for secondary use entails a serious

risk of infringing intellectual property rights, trade secrets or the regulatory data protection

right laid down in Article 10(1) of Directive 2001/83/EC or Article 14(11) of Regulation

(EC) No 726/2004 which cannot be addressed in a satisfactory manner, the health data

access body shall refuse access to the health data applicant to such data. The health data

access body shall inform the health data applicant of, and provide to the health data

applicant a justification for, that refusal. Health data holders and health data applicants

shall have the right to lodge a complaint in accordance with Article 81 of this Regulation.

PE-CONS 76/24 187

# LIFE.5 EN

_Article 53_

_Purposes for which electronic health data can be processed for secondary use_

1. Health data access bodies shall only grant access to electronic health data referred to in

Article 51 for secondary use to a health data user where the processing of the data by that

health data user is necessary for one of the following purposes:

(a) the public interest in the areas of public or occupational health, such as activities to

protect against serious cross-border threats to health, public health surveillance or

activities ensuring high levels of quality and safety of healthcare, including patient

safety, and of medicinal products or medical devices;

(b) policy-making and regulatory activities to support public sector bodies or Union

institutions, bodies, offices or agencies, including regulatory authorities, in the health

or care sector to carry out their tasks defined in their mandates;

(c) statistics as defined in Article 3, point (1), of Regulation (EU) No 223/2009, such as

national, multi-national and Union-level official statistics, related to health or care

sectors;

(d) education or teaching activities in health or care sectors at vocational or higher

education level;

PE-CONS 76/24 188

# LIFE.5 EN

(e) scientific research related to health or care sectors that contributes to public health or

health technology assessments, or ensures high levels of quality and safety of

healthcare, of medicinal products or of medical devices, with the aim of benefiting

end-users, such as patients, health professionals and health administrators, including:

(i) development and innovation activities for products or services;

(ii) training, testing and evaluation of algorithms, including in medical devices, in

vitro diagnostic medical devices, AI systems and digital health applications;

(f) improvement of the delivery of care, of the optimisation of treatment and of the

provision of healthcare, based on the electronic health data of other natural persons.

2. Access to electronic health data for the purposes referred to in paragraph 1, points (a), (b)

and (c), shall be reserved for public sector bodies and Union institutions, bodies, offices

and agencies exercising the tasks conferred on them by Union or national law, including

where processing of data for carrying out those tasks is done by a third party on behalf of

that public sector body or of Union institutions, bodies, offices and agencies.

PE-CONS 76/24 189

# LIFE.5 EN

_Article 54_

_Prohibited secondary use_

Health data users shall only process electronic health data for secondary use on the basis of and in

accordance with the purposes contained in a data permit issued pursuant to Article 68, health data

requests approved pursuant to Article 69 or, in situations referred to in Article 67(3), an access

approval from the relevant authorised participant in HealthData@EU referred to in Article 75.

In particular, seeking access to and processing electronic health data obtained via a data permit

issued pursuant to Article 68 or a health data request approved pursuant to Article 69 for the

following uses shall be prohibited:

(a) taking decisions detrimental to a natural person or a group of natural persons based on their

electronic health data; in order to qualify as ‘decisions’ for the purposes of this point, they

have to produce legal, social or economic effects or similarly significantly affect those

natural persons;

(b) taking decisions in relation to a natural person or a group of natural persons in relation to

job offers, offering less favourable terms in the provision of goods or services, including

exclusion of such persons or groups from the benefit of an insurance or credit contract, the

modification of their contributions and insurance premiums or conditions of loans, or

taking any other decisions in relation to a natural person or a group of natural persons

which result in discriminating against them on the basis of the health data obtained;

PE-CONS 76/24 190

# LIFE.5 EN

(c) carrying out advertising or marketing activities;

(d) developing products or services that may harm individuals, public health or society at

large, such as illicit drugs, alcoholic beverages, tobacco and nicotine products, weaponry

or products or services which are designed or modified in such a way that they create

addiction, contravene public order or cause a risk for human health;

(e) carrying out activities in conflict with ethical provisions laid down in national law;

### **S ECTION 2** **G OVERNANCE AND MECHANISMS FOR SECONDARY USE**

_Article 55_

_Health data access bodies_

1. Member States shall designate one or more health data access bodies responsible for

carrying out the tasks and obligations set out in Articles 57, 58 and 59. Member States may

either establish one or more new public sector bodies or rely on existing public sector

bodies or on internal services of public sector bodies that fulfil the conditions set out in this

Article. The tasks set out in Article 57 may be distributed between different health data

access bodies. Where a Member State designates several health data access bodies, it shall

designate one health data access body to act as coordinator, with responsibility for

coordinating tasks with the other health data access bodies both within the territory of that

Member State and in other Member States.

PE-CONS 76/24 191

# LIFE.5 EN

Each health data access body shall contribute to the consistent application of this

Regulation throughout the Union. For that purpose, health data access bodies shall

cooperate with each other, with the Commission and, for concerns regarding data

protection, with the relevant supervisory authorities.

2. In order to support the effective performance of the tasks and the exercise of the powers of

the health data access bodies, Member States shall ensure that each health data access body

is provided with the following elements:

(a) the necessary human, financial and technical resources;

(b) the necessary expertise; and

(c) the necessary premises and infrastructure.

Where an assessment by ethics bodies is required under national law, those bodies shall

make expertise available to the health data access body. As an alternative, Member States

may provide for ethics bodies to form part of the health data access body.

3. Member States shall ensure that any conflicts of interest between the organisational parts

of health data access bodies performing the different tasks of such bodies is avoided by, for

example, providing for organisational safeguards such as segregation between health data

access bodies’ different functions, including assessing applications, the reception and

preparation of datasets, for example pseudonymisation and anonymisation of datasets, and

the provision of data in secure processing environments.

PE-CONS 76/24 192

# LIFE.5 EN

4. In the performance of their tasks, health data access bodies shall actively cooperate with

relevant stakeholders’ representatives, especially with representatives of patients, health

data holders and health data users and shall avoid any conflicts of interest.

5. In the performance of their tasks and exercise of their powers, health data access bodies

shall avoid any conflicts of interest. Health data access bodies’ staff shall act in the public

interest and in an independent manner.

6. Member States shall inform the Commission of the identity of the health data access bodies

designated pursuant to paragraph 1 by … [the date of entry into force of this Regulation +

24 months]. They shall also inform the Commission of any subsequent modification of the

identity of those bodies. The Commission and the Member States shall make that

information publicly available.

_Article 56_

_Union health data access service_

1. The Commission shall perform the tasks set out in Articles 57 and 59 where the health data

holders are Union institutions, bodies, offices or agencies.

2. The Commission shall ensure that the necessary human, technical and financial resources,

premises and infrastructure are allocated for the effective performance of the tasks set out

in Articles 57 and 59 and the exercise of its duties.

PE-CONS 76/24 193

# LIFE.5 EN

3. Unless otherwise explicitly excluded, references to health data access bodies in this

Regulation in relation to the performance of tasks and exercise of duties shall be

understood to also apply to the Commission, where the health data holders are Union

institutions, bodies, offices or agencies.

_Article 57_

_Tasks of health data access bodies_

1. Health data access bodies shall carry out the following tasks:

(a) deciding on health data access applications pursuant to Article 67 of this Regulation,

authorising and issuing data permits pursuant to Article 68 of this Regulation to

access electronic health data falling within their remit for secondary use and deciding

on health data requests submitted pursuant to Article 69 of this Regulation in

accordance with this Chapter and Chapter II of Regulation (EU) 2022/868, including

with regard to:

(i) providing access to electronic health data to health data users pursuant to a data

permit in a secure processing environment in accordance with Article 73;

(ii) monitoring and supervising compliance by health data users and health data

holders with the requirements laid down in this Regulation;

(iii) requesting electronic health data referred to in Article 51 from relevant health

data holders pursuant to a data permit issued or a health data request approved;

PE-CONS 76/24 194

# LIFE.5 EN

(b) processing electronic health data referred to in Article 51 such as by receiving,

combining, preparing and compiling such data when requested from health data

holders and the pseudonymisation or anonymisation of those data;

(c) taking all measures necessary to preserve the confidentiality of intellectual property

rights, for regulatory data protection and to preserve the confidentiality of trade

secrets as provided for in Article 52, taking into account the relevant rights of both

the health data holder and health data user;

(d) cooperating with and supervising health data holders to ensure the consistent and

accurate implementation of the provisions on data quality and utility label in

Article 78;

(e) maintaining a management system to record and process health data access

applications, health data requests, decisions on those applications and requests and

the data permits issued and health data requests handled, providing at least

information on the name of the health data applicant, the purpose of access, the date

of issuance, the duration of the data permit and a description of the health data access

application or the health data request;

(f) maintaining a public information system to comply with the obligations laid down in

Article 58;

PE-CONS 76/24 195

# LIFE.5 EN

(g) cooperating at Union and national level to lay down common standards, technical

requirements and appropriate measures for accessing electronic health data in a

secure processing environment;

(h) cooperating at Union and national level and providing advice to the Commission on

techniques and best practices for secondary use and the management of electronic

health data;

(i) facilitating cross-border access to electronic health data for secondary use hosted in

other Member States through HealthData@EU referred to in Article 75 and

cooperating closely with each other and with the Commission;

(j) making public, through electronic means:

(i) a national dataset catalogue that includes details about the source and nature of

electronic health data, in accordance with Articles 77, 78 and 80, and the

conditions for making electronic health data available;

(ii) any health data access application and health data request without undue delay

after initial reception;

(iii) all data permits issued or health data requests approved as well as refusal

decisions, including their justification, within 30 working days of the issuance,

approval or refusal;

(iv) measures related to non-compliance pursuant to Article 63;

PE-CONS 76/24 196

# LIFE.5 EN

(v) results communicated by health data users pursuant to Article 61(4);

(vi) an information system to comply with the obligations laid down in Article 58;

(vii) information, at a minimum on an easily accessible website or web portal, on

the connection to HealthData@EU of national contact points for secondary use

of a third country, or of a system established at international level by an

international organisation, as soon as the third country or the international

organisation becomes an authorised participant in HealthData@EU.

(k) fulfilling obligations towards natural persons pursuant to Article 58;

(l) fulfilling any other tasks related to making possible the secondary use of electronic

health data in the context of this Regulation.

The national dataset catalogue referred to in point (j)(i) of this paragraph shall also be

made available to single information points under Article 8 of Regulation (EU) 2022/868.

2. In the exercise of their tasks, health data access bodies shall:

(a) cooperate with supervisory authorities under Regulation (EU) 2016/679 in relation to

personal electronic health data and the EHDS Board;

(b) cooperate with all relevant stakeholders, including patient organisations,

representatives of natural persons, health professionals, researchers, and ethics

committees, where applicable in accordance with Union or national law;

PE-CONS 76/24 197

# LIFE.5 EN

(c) cooperate with other national competent bodies, including the national competent

authorities supervising data altruism organisations under Regulation (EU) 2022/868,

the competent authorities under Regulation (EU) 2023/2854 and the national

competent authorities under Regulations (EU) 2017/745, (EU) 2017/746 and

(EU) 2024/1689, where relevant.

3. Health data access bodies may provide assistance to public sector bodies where those

public sector bodies access electronic health data in accordance with Article 14 of

Regulation (EU) 2023/2854.

4. Health data access bodies may provide support to a public sector body where it obtains

data in the circumstances referred to in Article 15, point (a) or (b), of Regulation

(EU) 2023/2854, in accordance with the rules laid down in that Regulation, by providing

technical support to process those data or combining them with other data for joint

analysis.

_Article 58_

_Obligations of health data access bodies towards natural persons_

1. Health data access bodies shall make information on the conditions under which electronic

health data are made available for secondary use publicly available, easily searchable

through electronic means and accessible for natural persons. That information shall cover

the following:

(a) the legal basis under which access to electronic health data is granted to the health

data user;

PE-CONS 76/24 198

# LIFE.5 EN

(b) the technical and organisational measures taken to protect the rights of natural

persons;

(c) the applicable rights of natural persons in relation to secondary use;

(d) the arrangements for natural persons to exercise their rights in accordance with

Chapter III of Regulation (EU) 2016/679;

(e) the identity and the contact details of the health data access body;

(f) who has been granted access to datasets of electronic health data and to which

datasets they were granted access and details of the data permit regarding the

purposes for processing such data as referred to in Article 53(1);

(g) the results or outcomes of the projects for which the electronic health data were used.

2. If a Member State has provided for the right to opt out pursuant to Article 71 to be

exercised through the health data access bodies, the relevant health data access bodies shall

provide public information about the procedure to opt out and facilitate the exercise of that

right.

PE-CONS 76/24 199

# LIFE.5 EN

3. Where a health data access body is informed by a health data user of a significant finding

related to the health of a natural person, as referred to in Article 61(5), the health data

access body shall inform the health data holder about that finding. The health data holder

shall, under the conditions laid down by national law, inform the natural person or health

professional treating the natural person concerned. Natural persons shall have the right to

request not to be informed of such findings.

4. Member States shall inform the public at large about the role and benefits of health data

access bodies.

_Article 59_

_Reporting by health data access bodies_

1. Each health data access body shall publish an activity report every two years and make it

publicly available on its website. If a Member State designates more than one health data

access body, the coordinating body referred to in Article 55(1) shall be responsible for the

activity report and request the necessary information from the other health data access

bodies. That activity report shall follow a structure agreed by the EHDS Board pursuant to

Article 94(2), point (d), and contain at least the following categories of information:

(a) information relating to the health data access applications and health data requests

submitted, such as the types of health data applicants, number of data permits issued

or refused, categories of purposes of access and categories of electronic health data

accessed, and a summary of the results of the electronic health data uses, where

applicable;

PE-CONS 76/24 200

# LIFE.5 EN

(b) information on the fulfilment of regulatory and contractual commitments by health

data users and health data holders, as well as the number and amount of

administrative fines imposed by health data access bodies;

(c) information on audits carried out on health data users to ensure compliance of the

processing they carry out in the secure processing environment pursuant to

Article 73(1), point (e);

(d) information on internal and third party audits on compliance of secure processing

environments with the defined standards, specifications and requirements, as referred

to in Article 73(3);

(e) information on the handling of requests from natural persons relating to the exercise

of their data protection rights;

(f) a description of the health data access body’s activities carried out in relation to

engagement with and consultation of relevant stakeholders;

(g) revenues from data permits and health data requests;

(h) the average number of days between health data access applications or health data

requests and access to data;

(i) the number of data quality labels issued by health data holders, disaggregated per

quality category;

PE-CONS 76/24 201

# LIFE.5 EN

(j) the number of peer-reviewed research publications, policy documents and regulatory

procedures using data accessed via the EHDS;

(k) the number of digital health products and services, including AI applications,

developed using data accessed via the EHDS.

2. The activity report referred to in paragraph 1 shall be submitted to the Commission and the

EHDS Board within six months of the end of the second year of the relevant reporting

period. The activity report shall be accessible via the Commission's website.

_Article 60_

_Duties of health data holders_

1. Health data holders shall make relevant electronic health data referred to in Article 51

available upon request to the health data access body, in accordance with a data permit

issued pursuant to Article 68, or upon a health data request approved pursuant to

Article 69.

2. Health data holders shall put the requested electronic health data referred to in paragraph 1

at the disposal of the health data access body within a reasonable time and no later than

three months from the receipt of the request by the health data access body. In justified

cases, the health data access body may extend that period by a maximum of three months.

PE-CONS 76/24 202

# LIFE.5 EN

3. The health data holder shall communicate to the health data access body a description of

the dataset it holds in accordance with Article 77. The health data holder shall, at a

minimum on an annual basis, check that its dataset description in the national dataset

catalogue is accurate and up to date.

4. Where a data quality and utility label accompanies the dataset pursuant to Article 78, the

health data holder shall provide sufficient documentation to the health data access body for

that body to verify the accuracy of the label.

5. Health data holders of non-personal electronic health data shall provide access to data

through trusted open databases to ensure unrestricted access for all users and data storage

and preservation. Trusted open public databases shall have in place robust, transparent and

sustainable governance and a transparent model of user access.

_Article 61_

_Duties of health data users_

1. Health data users may access and process the electronic health data referred to in Article 51

for secondary use only in accordance with a data permit issued pursuant to Article 68, a

health data request approved pursuant to Article 69 or, in situations referred to in

Article 67(3), an access approval from the relevant authorised participant in

HealthData@EU referred to in Article 75.

PE-CONS 76/24 203

# LIFE.5 EN

2. When processing electronic health data within the secure processing environments referred

to in Article 73, health data users shall not provide access to the electronic health data, or

make those data available, to third parties not mentioned in the data permit.

3. Health data users shall not re-identify or attempt to re-identify the natural persons to whom

the electronic health data obtained by the health data users on the basis of a data permit, a

health data request or an access approval by an authorised participant in HealthData@EU

relate.

4. Health data users shall make public the results or output of secondary use, including

information relevant for the provision of healthcare, within 18 months of the completion of

the processing of the electronic health data in the secure processing environment or of

having received the response to the health data request referred to in Article 69.

In justified cases related to the permitted purposes of the processing of electronic health

data, the period referred to in the first subparagraph may be extended by the health data

access body, in particular in cases where the result is published in a scientific journal or

other scientific publication.

The results or output of secondary use shall contain only anonymous data.

Health data users shall inform the health data access bodies from which a data permit was

obtained about the results or output of secondary use and assist them to make that

information public on health data access bodies’ websites. Such publication shall be

without prejudice to publication rights in scientific journals or other scientific publications.

PE-CONS 76/24 204

# LIFE.5 EN

When health data users use electronic health data in accordance with this Chapter, they

shall acknowledge the sources of the electronic health data and the fact that the electronic

health data have been obtained in the framework of the EHDS.

5. Without prejudice to paragraph 2, health data users shall inform the health data access

body of any significant finding related to the health of the natural person whose data are

included in the dataset.

6. Health data users shall cooperate with health data access bodies in those bodies’

performance of their tasks.

_Article 62_

_Fees_

1. Health data access bodies, including the Union health data access service, or trusted health

data holders referred to in Article 72 may charge fees for making electronic health data

available for secondary use.

The fees shall be in proportion to the cost of making the data available and they shall not

restrict competition.

PE-CONS 76/24 205

# LIFE.5 EN

The fees shall cover all or part of the costs related to the procedure for assessing a health

data access application or a health data request, for issuing, refusing or amending a data

permit pursuant to Articles 67 and 68 or for providing a response to a health data request

submitted pursuant to Article 69, including costs related to the consolidation, preparation,

pseudonymisation, anonymisation and provision of the electronic health data.

Member States may establish reduced fees for certain types of health data users located in

the Union, such as public sector bodies or Union institutions, bodies, offices and agencies

with a legal mandate in the field of public health, university researchers or

microenterprises.

2. The fees referred to in paragraph 1 of this Article may include compensation for the costs

incurred by the health data holder for compiling and preparing the electronic health data to

be made available for secondary use. In such cases, the health data holder shall provide an

estimate of such costs to the health data access body. Where the health data holder is a

public sector body, Article 6 of Regulation (EU) 2022/868 shall not apply. The part of the

fees linked to the health data holder’s costs shall be paid to the health data holder.

3. Any fees charged to health data users pursuant to this Article shall be transparent and

non-discriminatory.

PE-CONS 76/24 206

# LIFE.5 EN

4. Where health data holders and health data users do not agree on the level of the fees within

one month of the data permit being issued, the health data access body may set the fees in

proportion to the cost of making electronic health data available for secondary use. Where

health data holders or health data users disagree with the fee set by the health data access

body, they shall have access to dispute settlement bodies in accordance with Article 10 of

Regulation (EU) 2023/2854.

5. Before issuing a data permit pursuant to Article 68 or providing a response to a health data

request submitted pursuant to Article 69, the health data access body shall inform the

health data applicant of the estimated fees. The health data applicant shall be informed

about the option to withdraw the health data access application or health data request. If the

health data applicant withdraws its application or request, the health data applicant shall

only be charged the costs that have already been incurred.

6. The Commission shall, by means of implementing acts, lay down principles for the fee

policies and fee structures, including deductions for the entities referred to in paragraph 1,

fourth subparagraph, of this Article in order to support consistency and transparency

between Member States regarding such fee policies and fee structures. Those

implementing acts shall be adopted in accordance with the examination procedure referred

to in Article 98(2).

PE-CONS 76/24 207

# LIFE.5 EN

_Article 63_

_Enforcement by health data access bodies_

1. When carrying out their monitoring and supervisory tasks, as referred to in Article 57(1),

point (a)(ii), health data access bodies shall have the right to request and receive all the

necessary information from health data users and health data holders to verify compliance

with this Chapter.

2. Where health data access bodies find that a health data user or health data holder does not

comply with the requirements of this Chapter, they shall immediately notify the health data

user or health data holder of those findings and take appropriate measures. The health data

access body concerned shall give the health data user or health data holder concerned the

opportunity to state their views within a reasonable period that shall not exceed four weeks.

Where the finding of non-compliance concerns a possible breach of Regulation

(EU) 2016/679, the health data access body concerned shall immediately inform the

supervisory authorities under that Regulation and provide them with all relevant

information concerning that finding.

3. With regard to non-compliance by health data users, health data access bodies shall have

the power to revoke the data permit issued pursuant to Article 68 and stop without undue

delay the affected electronic health data processing operation carried out by the health data

user, and shall take appropriate and proportionate measures aimed at ensuring compliant

processing by the health data user.

PE-CONS 76/24 208

# LIFE.5 EN

As part of such enforcement measures, the health data access bodies may also, where

appropriate, exclude, or initiate proceedings to exclude, in accordance with national law,

the health data user concerned from any access to electronic health data within the EHDS

in the context of secondary use for a period of up to five years.

4. With regard to non-compliance by health data holders, where a health data holder

withholds the electronic health data from health data access bodies with the manifest

intention of obstructing the use of electronic health data, or does not respect the deadlines

set out in Article 60(2), the health data access body shall have the power to fine the health

data holder for each day of delay with a periodic penalty payment, which shall be

transparent and proportionate. The amount of the fines shall be established by the health

data access body in accordance with national law. In the event of repeated breaches by the

health data holder of the obligation of cooperation with the health data access body, that

body may exclude or initiate proceedings to exclude, in accordance with national law, the

health data holder concerned from submitting health data access applications pursuant to

this Chapter for a period of up to five years. During the period of that exclusion, the health

data holder shall remain obliged to make data accessible under this Chapter, where

applicable.

5. The health data access body shall communicate the enforcement measures taken pursuant

to paragraphs 3 and 4, and the reasons on which they are based, to the health data user or

health data holder concerned, without delay, and shall lay down a reasonable period for the

health data user or health data holder to comply with those measures.

PE-CONS 76/24 209

# LIFE.5 EN

6. Any enforcement measures taken by the health data access body pursuant to paragraph 3

shall be notified to other health data access bodies through the IT tool referred to in

paragraph 7. Health data access bodies may make that information publicly available on

their websites.

7. The Commission shall, by means of implementing acts, set out the architecture of an IT

tool, as part of the infrastructure of HealthData@EU referred to in Article 75, aimed at

supporting and making transparent to other health data access bodies the enforcement

measures referred to in this Article, especially periodic penalty payments, the revoking of

data permits and exclusions. Those implementing acts shall be adopted in accordance with

the examination procedure referred to in Article 98(2).

8. The Commission shall issue guidelines, by … [the date of entry into force of this

Regulation + 84 months], in close cooperation with the EHDS Board, on enforcement

measures including periodic penalty payments and other measures to be taken by the health

data access bodies.

PE-CONS 76/24 210

# LIFE.5 EN

_Article 64_

_General conditions for the imposition of administrative fines by health data access bodies_

1. Each health data access body shall ensure that the imposition of administrative fines

pursuant to this Article in respect of infringements referred to in paragraphs 4 and 5 is

effective, proportionate and dissuasive in each individual case.

2. Administrative fines shall, depending on the circumstances of each individual case, be

imposed in addition to, or instead of, enforcement measures referred to in Article 63(3) and

(4). Health data access bodies shall decide whether to impose an administrative fine and

the amount of the administrative fine in each individual case by giving due regard to the

following circumstances:

(a) the nature, gravity and duration of the infringement;

(b) whether any penalties or administrative fines have already been imposed by other

competent authorities for the same infringement;

(c) the intentional or negligent character of the infringement;

(d) any action taken by the health data holder or health data user to mitigate the damage

caused;

PE-CONS 76/24 211

# LIFE.5 EN

(e) the degree of responsibility of the health data user, taking into account technical and

organisational measures implemented by that health data user pursuant to

Article 67(2), point (g), and Article 67(4);

(f) any relevant previous infringements by the health data holder or health data user;

(g) the degree of cooperation of the health data holder or health data user with the health

data access body as regards remedying the infringement and mitigating its possible

adverse effects;

(h) the manner in which the health data access body became aware of the infringement,

in particular whether, and to what extent, the health data user notified it of the

infringement;

(i) compliance with any enforcement measures referred to in Article 63(3) and (4) which

have been ordered previously against the controller or processor concerned with

regard to the same subject matter;

(j) any other aggravating or mitigating factor applicable to the circumstances of the

case, such as financial benefits gained or losses avoided, directly or indirectly,

through the infringement.

3. If a health data holder or a health data user intentionally or negligently infringes several

provisions of this Regulation for the same or a linked data permit or health data request, the

total amount of the administrative fine shall not exceed the amount specified for the most

serious infringement.

PE-CONS 76/24 212

# LIFE.5 EN

4. In accordance with paragraph 2 of this Article, infringements of the duties of the health

data holder or health data user pursuant to Article 60 and Article 61(1), (5) and (6) shall be

subject to administrative fines of a maximum of EUR 10 000 000 or, in the case of an

undertaking, of a maximum of 2 % of its total worldwide annual turnover in the preceding

financial year, whichever is higher.

5. In accordance with paragraph 2, the following infringements shall be subject to

administrative fines of a maximum of EUR 20 000 000 or, in the case of an undertaking, of

a maximum of 4 % of its total worldwide annual turnover in the preceding financial year,

whichever is higher:

(a) health data users processing electronic health data obtained via a data permit issued

pursuant to Article 68 for the uses referred to in Article 54;

(b) health data users extracting personal electronic health data from secure processing

environments;

(c) re-identifying or attempting to re-identify the natural persons to whom the electronic

health data obtained by the health data users on the basis of a data permit or a health

data request pursuant to Article 61(3) relate;

(d) non-compliance with enforcement measures taken by the health data access body

pursuant to Article 63(3) and (4).

PE-CONS 76/24 213

# LIFE.5 EN

6. Without prejudice to the powers of health data access bodies pursuant to Article 63, each

Member State may lay down rules on whether and to what extent administrative fines may

be imposed on public authorities and public sector bodies established in that Member State.

7. The exercise by a health data access body of its powers under this Article shall be subject

to appropriate procedural safeguards in accordance with Union and national law, including

effective judicial remedies and due process.

8. Where the legal system of a Member State does not provide for administrative fines, this

Article may be applied in a manner that, in accordance with its national legal framework,

ensures that those legal remedies are effective and have an equivalent effect to the

administrative fines imposed by health data access bodies. In any event, the fines imposed

shall be effective, proportionate and dissuasive. The Member State concerned shall notify

the Commission of the provisions of the laws which it adopts pursuant to this paragraph

by … [the date of entry into force of this Regulation + 48 months] and, without delay, of

any subsequent law amending such provisions or amendments affecting such provisions.

_Article 65_

_Relationship with supervisory authorities under Regulation (EU) 2016/679_

The supervisory authority or authorities responsible for monitoring and enforcing the application of

Regulation (EU) 2016/679 shall also be competent for monitoring and enforcing the application of

the right to opt out from the processing of personal electronic health data for secondary use pursuant

to Article 71. Those supervisory authorities shall be empowered to impose administrative fines up

to the amount referred to in Article 83 of Regulation (EU) 2016/679.

PE-CONS 76/24 214

# LIFE.5 EN

The supervisory authorities referred to in the first paragraph of this Article and the health data

access bodies referred to in Article 55 of this Regulation shall, where relevant, cooperate in the

enforcement of this Regulation, within the remit of their respective competences. The relevant

provisions of Regulation (EU) 2016/679 shall apply _mutatis mutandis_ .

### **S ECTION 3** **A CCESS TO ELECTRONIC HEALTH DATA FOR SECONDARY USE**

_Article 66_

_Data minimisation and purpose limitation_

1. Where health data access bodies receive a health data access application, they shall ensure

that access is only provided to electronic health data that are adequate, relevant and limited

to what is necessary in relation to the purpose of processing indicated in the health data

access application by the health data user and in line with the data permit issued pursuant

to Article 68.

2. Health data access bodies shall provide electronic health data in an anonymised format,

where the purpose of processing by the health data user can be achieved with such data,

taking into account the information provided by the health data user.

PE-CONS 76/24 215

# LIFE.5 EN

3. Where the health data user has sufficiently demonstrated that the purpose of processing

cannot be achieved with anonymised data in accordance with Article 68(1), point (c),

health data access bodies shall provide access to electronic health data in pseudonymised

format. The information necessary to reverse the pseudonymisation shall be available only

to the health data access body or an entity that acts as a trusted third party in accordance

with national law.

_Article 67_

_Health data access applications_

1. A natural or legal person may submit a health data access application for the purposes

referred to in Article 53(1) to a health data access body.

2. The health data access application shall include:

(a) the health data applicant’s identity, a description of that health data applicant’s

professional functions and activities, including the identity of the natural persons

who would have access to the electronic health data if a data permit were issued; the

health data applicant shall notify the health data access body of any update of the list

of natural persons;

(b) the purposes referred to in Article 53(1) for which access to data is applied for;

PE-CONS 76/24 216

# LIFE.5 EN

(c) a detailed explanation of the intended use of the electronic health data and expected

benefit related to that use and how that benefit would contribute to the purposes

referred to in Article 53(1);

(d) a description of the requested electronic health data, including their scope, time

range, format, sources and, where possible, the geographical coverage where such

data are requested from health data holders in several Member States or from

authorised participants in HealthData@EU referred to in Article 75;

(e) a description explaining whether the electronic health data need to be made available

in a pseudonymised or anonymised format; in the case of a pseudonymised format, a

justification as to why the processing cannot be carried out using anonymised data;

(f) where the health data applicant intends to bring datasets already held by that health

data applicant into the secure processing environment, a description of those

datasets;

(g) a description of the safeguards, which are to be proportionate to the risks, planned to

prevent any misuse of the electronic health data, as well as to protect the rights and

interests of the health data holder and of the natural persons concerned, including to

prevent any re-identification of natural persons in the dataset;

(h) a justified indication of the period during which the electronic health data are needed

for processing in a secure processing environment;

PE-CONS 76/24 217

# LIFE.5 EN

(i) a description of the tools and computing resources needed for a secure processing

environment;

(j) where applicable, information on any assessment of ethical aspects of the processing,

required under national law, which may serve to replace the health data applicant’s

own ethics assessment;

(k) where the health data applicant intends to make use of an exception under

Article 71(4), the justification required by national law pursuant to that Article.

3. When seeking access to electronic health data held by health data holders established in

more than one Member State or from the relevant authorised participants in

HealthData@EU referred to in Article 75, the health data applicant shall submit a single

health data access application through the health data access body of the Member State

where the main establishment of the health data applicant is located, through the health

data access body of the Member State in which one of those health data holders is

established or through the services provided by the Commission in HealthData@EU

referred to in Article 75. The health data access application shall be automatically

forwarded to the relevant authorised participants in HealthData@EU and to the health data

access bodies of the Member States where the health data holders identified in the health

data access application are established.

PE-CONS 76/24 218

# LIFE.5 EN

4. When seeking access to the personal electronic health data in a pseudonymised format, the

health data applicant shall provide, together with the health data access application, a

description of how the processing would comply with applicable Union and national law

on data protection and privacy, in particular with Regulation (EU) 2016/679 and, more

specifically, with Article 6(1) thereof.

5. Public sector bodies and Union institutions, bodies, offices and agencies shall provide the

same information as required under paragraphs 2 and 4, except for paragraph 2, point (h),

in which case they shall submit instead information concerning the period for which the

electronic health data can be accessed, the frequency of that access or the frequency of the

data updates.

_Article 68_

_Data permit_

1. For the purposes of granting access to electronic health data, the health data access bodies

shall assess whether all the following criteria are fulfilled:

(a) the purposes described in the health data access application correspond to one or

more of the purposes listed in Article 53(1);

(b) the requested data are necessary, adequate and proportionate for the purposes

described in the health data access application, taking into account data minimisation

and purpose limitation requirements provided for in Article 66;

PE-CONS 76/24 219

# LIFE.5 EN

(c) the processing complies with Article 6(1) of Regulation (EU) 2016/679 and, in the

case of pseudonymised data, there is sufficient justification that the purpose cannot

be achieved with anonymised data;

(d) the health data applicant is qualified in relation to the intended purposes of data use

and has appropriate expertise, including professional qualifications in the areas of

healthcare, care, public health or research, consistent with ethical practice and

applicable laws and regulations;

(e) the health data applicant demonstrates sufficient technical and organisational

measures to prevent the misuse of the electronic health data and to protect the rights

and interests of the health data holder and of the natural persons concerned;

(f) the information on the assessment of ethical aspects of the processing, referred to in

Article 67(2), point (j), where applicable, complies with national law;

(g) where the health data applicant intends to make use of an exception under

Article 71(4), the justification required by national law adopted pursuant to that

Article has been provided;

(h) all other requirements in this Chapter are fulfilled by the health data applicant.

PE-CONS 76/24 220

# LIFE.5 EN

2. The health data access body shall also take into account the following:

(a) risks for national defence, security, public security and public order;

(b) the risk of undermining the confidentiality of data in governmental databases of

regulatory authorities.

3. Where the health data access body concludes that the requirements in paragraph 1 are

fulfilled and the risks referred to in paragraph 2 are sufficiently mitigated, the health data

access body shall grant access to electronic health data by issuing a data permit. Health

data access bodies shall refuse all health data access applications where the requirements in

this Chapter are not fulfilled.

Where the requirements for issuing a data permit are not met, but the requirements to

provide a response in an anonymised statistical format under Article 69 are, the health data

access body may decide to provide such response, on condition that providing that

response would mitigate the risks and, if the purpose of the health data access application

can be fulfilled in this manner, that the health data applicant agrees to receiving a response

in an anonymised statistical format under Article 69.

PE-CONS 76/24 221

# LIFE.5 EN

4. By way of derogation from Regulation (EU) 2022/868, the health data access body shall

issue or refuse a data permit within three months of receiving a complete health data access

application. If the health data access body finds that the health data access application is

incomplete, it shall notify the health data applicant, who shall be given the possibility of

completing that application. If the health data applicant does not complete the health data

access application within four weeks, the data permit shall not be issued.

The health data access body may extend the period for responding to a health data access

application by three additional months where necessary, taking into account the urgency

and complexity of the health data access application and the volume of health data access

applications submitted for decision. In such cases, the health data access body shall notify

the health data applicant as soon as possible that more time is needed for examining the

health data access application, together with the reasons for the delay.

5. When handling a health data access application for cross-border access to electronic health

data referred to in Article 67(3), health data access bodies and relevant authorised

participants in HealthData@EU referred to in Article 75 shall remain responsible for

adopting decisions to grant or refuse access to electronic health data within their remit in

accordance with this Chapter.

The health data access bodies and authorised participants in HealthData@EU concerned

shall inform each other of their decisions. They may take that information into

consideration when deciding on granting or refusing access to electronic health data.

A data permit issued by one health data access body may benefit from mutual recognition

by the other health data access bodies.

PE-CONS 76/24 222

# LIFE.5 EN

6. Member States shall provide for an accelerated health data access application procedure for

public sector bodies and Union institutions, bodies, offices and agencies with a legal

mandate in the field of public health if the processing of electronic health data is to be

carried out for the purposes established in Article 53(1), points (a), (b) and (c).

When such accelerated procedure applies, the health data access body shall issue or refuse

a data permit within two months of receiving a complete health data access application.

The health data access body may extend the period for responding to a health data access

application by one additional month where necessary.

7. Following the issuance of the data permit, the health data access body shall immediately

request the electronic health data from the health data holder. The health data access body

shall make available the electronic health data to the health data user within two months of

receiving them from the health data holders, unless the health data access body specifies

that the data are to be provided within a longer specified timeframe.

8. In cases referred to in paragraph 5, first subparagraph, the health data access bodies and

authorised participants in HealthData@EU which issued a data permit or access approval,

respectively, may decide to provide access to the electronic health data in the secure

processing environment provided by the Commission as referred to in Article 75(9).

9. Where the health data access body refuses to issue a data permit, it shall provide a

justification for that refusal to the health data applicant.

PE-CONS 76/24 223

# LIFE.5 EN

10 When issuing a data permit, the health data access body shall set out in that data permit the

general conditions applicable to the health data user. The data permit shall contain the

following:

(a) the categories, specification and format of the electronic health data to be accessed,

which are covered by the data permit, including their sources and an indication of

whether the electronic health data are to be accessed in a pseudonymised format in

the secure processing environment;

(b) a detailed description of the purpose for which the electronic health data are made

available;

(c) where a mechanism to implement an exception is provided for and applicable under

Article 71(4), information on whether it has been applied and the reason for the

related decision;

(d) the identity of authorised persons, in particular the identity of the principal

investigator, with access rights to the electronic health data in the secure processing

environment;

(e) the duration of the data permit;

(f) information about the technical characteristics and tools available to the health data

user within the secure processing environment;

PE-CONS 76/24 224

# LIFE.5 EN

(g) the fees to be paid by the health data user;

(h) any specific conditions.

11. Health data users shall have the right to access and process the electronic health data in a

secure processing environment in accordance with the data permit issued to them on the

basis of this Regulation.

12. A data permit shall be issued for the duration necessary to fulfil the requested purposes and

that duration shall not exceed 10 years. That duration may be extended once for a period

which does not exceed 10 years, at the request of the health data user, based on arguments

and documents to justify that extension which shall be provided one month before the

expiry of the data permit. The health data access body may charge fees which increase to

reflect the costs and risks of storing electronic health data for a period exceeding the initial

period. In order to reduce such costs and fees, the health data access body may also

propose to the health data user to store the dataset in a storage system with reduced

capabilities. Such reduced capabilities shall not affect the security of the processed dataset.

The electronic health data within the secure processing environment shall be deleted within

six months of the expiry of the data permit. At the request of the health data user, the

formula for the creation of the requested dataset may be stored by the health data access

body.

13. If the data permit needs to be updated, the health data user shall submit a request for an

amendment of the data permit.

PE-CONS 76/24 225

# LIFE.5 EN

14. The Commission may, by means of an implementing act, develop a logo for

acknowledging the contribution of the EHDS. That implementing act shall be adopted in

accordance with the examination procedure referred to in Article 98(2).

_Article 69_

_Health data request_

1. The health data applicant may submit a health data request for the purposes referred to in

Article 53 with the aim of obtaining a response only in an anonymised statistical format. A

health data access body shall not provide a response to a health data request in any other

format and the health data user shall have no access to the electronic health data used to

provide that response.

2. A health data request as referred to in paragraph 1 shall include the following information:

(a) the identity of the health data applicant and a description of that health data

applicant’s professional functions and activities;

(b) a detailed explanation of the intended use of the electronic health data, including the

purposes referred to in Article 53(1) for which the health data request is submitted;

(c) a description of the requested electronic health data, their format and the sources of

those data, where possible;

PE-CONS 76/24 226

# LIFE.5 EN

(d) a description of the statistical content;

(e) a description of the safeguards planned to prevent any misuse of the requested

electronic health data;

(f) a description of how the processing would comply with Article 6(1) of Regulation

(EU) 2016/679 or Article 5(1) and Article 10(2) of Regulation (EU) 2018/1725;

(g) where the health data applicant intends to make use of an exception under

Article 71(4), the justification required in that regard by national law pursuant to that

Article.

3. The health data access body shall assess if the health data request is complete and take into

account the risks referred to in Article 68(2).

4. The health data access body shall assess the health data request within three months of

receipt of the request and, where possible, subsequently provide the response to the health

data user within a further three months.

_Article 70_

_Templates to support access to electronic health data for secondary use_

By … [two years from the date of entry into force of this Regulation], the Commission shall, by

means of implementing acts, set out the templates for the health data access application, the data

permit and the health data request referred to in Articles 67, 68 and 69, respectively. Those

implementing acts shall be adopted in accordance with the examination procedure referred to in

Article 98(2).

PE-CONS 76/24 227

# LIFE.5 EN

_Article 71_

_Right to opt out from the processing of personal electronic health data for secondary use_

1. Natural persons shall have the right to opt out at any time, and without providing any

reason, from the processing of personal electronic health data relating to them for

secondary use under this Regulation. The exercise of that right shall be reversible.

2. Member States shall provide for an accessible and easily understandable opt-out

mechanism to exercise the right established in paragraph 1, whereby natural persons may

explicitly state that they do not wish to have their personal electronic health data processed

for secondary use.

3. Once natural persons have exercised the right to opt out, and where personal electronic

health data relating to them can be identified in a dataset, personal electronic health data

relating to those natural persons shall not be made available or otherwise processed

pursuant to data permits issued under Article 68 or health data requests under Article 69

approved after the natural person has exercised the right to opt out.

The first subparagraph of this paragraph shall not affect the processing for secondary use

of personal electronic health data relating to those natural persons pursuant to data permits

or health data requests that were issued or approved before the natural persons exercised

their right to opt out.

PE-CONS 76/24 228

# LIFE.5 EN

4. By way of exception from the right to opt out provided for in paragraph 1, a Member State

may provide in its national law for a mechanism to make data for which a right to opt out

has been exercised available provided that all the following conditions are fulfilled:

(a) the health data access application or health data request is submitted by a public

sector body or a Union institution, body, office or agency with a mandate to carry out

tasks in the area of public health, or by another entity entrusted with carrying out

public tasks in the area of public health, or acting on behalf of or commissioned by a

public authority, and the processing of those data is necessary for any of the

following purposes:

(i) the purposes referred to in Article 53(1), points (a), (b) and (c);

(ii) scientific research for important reasons of public interest;

(b) those data cannot be obtained by alternative means in a timely and effective manner

under equivalent conditions;

(c) the health data applicant has provided the justification referred to in Article 68(1),

point (g), or in Article 69(2), point (g).

The national law providing for such a mechanism shall provide for specific and suitable

measures in order to protect the fundamental rights and the personal data of natural

persons.

PE-CONS 76/24 229

# LIFE.5 EN

Where a Member State has provided in its national law for the possibility to request access

to data for which a right to opt out has been exercised and the conditions referred to in the

first subparagraph of this paragraph are fulfilled, those data may be included when carrying

out the tasks under Article 57(1), points (a)(i), (a)(iii) and (b).

5. The rules on any mechanism to implement exceptions provided for under paragraph 4 by

way of exception from paragraph 1 shall respect the essence of the fundamental rights and

freedoms and shall be a necessary and proportionate measure in a democratic society to

fulfil purposes of public interest in the area of legitimate scientific and societal objectives.

6. Any processing carried out in accordance with a mechanism to implement exceptions

provided for under paragraph 4 of this Article shall comply with the requirements of this

Chapter, in particular the prohibition on re-identifying or attempting to re-identify natural

persons in accordance with Article 61(3). Any legislative measure providing for a

mechanism in national law as referred to in paragraph 4 of this Article shall include

specific provisions for the safety, and the protection of the rights, of natural persons.

7. Member States shall notify without delay the Commission of the provisions of their

national law which they adopt pursuant to paragraph 4 and of any subsequent amendment

affecting them.

PE-CONS 76/24 230

# LIFE.5 EN

8. When the purposes of the processing of personal electronic health data by a health data

holder do not or no longer require the identification of a data subject by the controller, that

health data holder shall not be obliged to maintain, acquire or process additional

information in order to identify the data subject for the sole purpose of complying with the

right to opt out under this Article.

_Article 72_

_Simplified procedure for access to electronic health data_

_from a trusted health data holder_

1. Where a health data access body receives a health data access application pursuant to

Article 67 or a health data request pursuant to Article 69 that only covers electronic health

data held by a trusted health data holder designated in accordance with paragraph 2 of this

Article, the procedure set out in paragraphs 4 to 6 of this Article shall apply.

2. Member States may establish a procedure whereby health data holders can apply to be

designated as trusted health data holders, provided the health data holders meet the

following conditions:

(a) they are able to provide access to health data through a secure processing

environment that complies with Article 73;

(b) they have the necessary expertise to assess health data access applications and health

data requests;

(c) they provide the necessary guarantees to ensure compliance with this Regulation.

PE-CONS 76/24 231

# LIFE.5 EN

Member States shall designate trusted health data holders following an assessment of the

fulfilment of those conditions by the relevant health data access body.

Member States shall establish a procedure to regularly review whether the trusted health

data holder continues to fulfil those conditions.

Health data access bodies shall indicate the trusted health data holders in the dataset

catalogue referred to in Article 77.

3. Health data access applications and health data requests referred to in paragraph 1 shall be

submitted to the health data access body, which may forward them to the relevant trusted

health data holder.

4. Following receipt of a health data access application or health data request pursuant to

paragraph 3 of this Article, the trusted health data holder shall assess the health data access

application or health data request against the criteria listed in Article 68(1) and (2) or

Article 69(2) and (3), as applicable.

5. The trusted health data holder shall submit the assessment it carries out pursuant to

paragraph 4, accompanied by a proposal for decision, to the health data access body within

two months of receipt of the health data access application or health data request from the

health data access body. Within two months of receipt of the assessment, the health data

access body shall issue a decision on the health data access application or health data

request. The health data access body shall not be bound by the proposal submitted by the

trusted health data holder.

PE-CONS 76/24 232

# LIFE.5 EN

6. Following the health data access body’s decision to issue the data permit or to approve the

health data request, the trusted health data holder shall carry out the tasks referred to in

Article 57(1), points (a)(i) and (b).

7. The Union health data access service referred to in Article 56 may designate health data

holders that are Union institutions, bodies, offices or agencies which comply with the

conditions laid down in paragraph 2, first subparagraph, points (a), (b) and (c), of this

Article as trusted health data holders. Where it does so, paragraph 2, third and fourth

subparagraphs, and paragraphs 3 to 6 of this Article shall apply _mutatis mutandis_ .

_Article 73_

_Secure processing environment_

1. Health data access bodies shall provide access to electronic health data pursuant to a data

permit only through a secure processing environment which is subject to technical and

organisational measures and security and interoperability requirements. In particular, the

secure processing environment shall comply with the following security measures:

(a) the restriction of access to the secure processing environment to authorised natural

persons listed in the data permit issued pursuant to Article 68;

(b) the minimisation of the risk of the unauthorised reading, copying, modification or

removal of electronic health data hosted in the secure processing environment

through state-of-the-art technical and organisational measures;

PE-CONS 76/24 233

# LIFE.5 EN

(c) the limitation of the input of electronic health data and the inspection, modification

or deletion of electronic health data hosted in the secure processing environment to a

limited number of authorised identifiable individuals;

(d) ensuring that health data users have access only to the electronic health data covered

by their data permit, by means of individual and unique user identities and

confidential access modes only;

(e) the keeping of identifiable logs of access to and activities in the secure processing

environment for the period necessary to verify and audit all processing operations in

that environment; logs of access shall be kept for at least one year;

(f) ensuring compliance and monitoring the security measures referred to in this

paragraph to mitigate potential security threats.

2. Health data access bodies shall ensure that electronic health data from health data holders

in the format specified in the data permit can be uploaded by those health data holders and

can be accessed by the health data user in a secure processing environment.

Health data access bodies shall review the electronic health data included in a download

request to ensure that health data users are only able to download non-personal electronic

health data, including electronic health data in an anonymised statistical format, from the

secure processing environment.

PE-CONS 76/24 234

# LIFE.5 EN

3. Health data access bodies shall ensure that audits of the secure processing environments

are carried out on a regular basis, including by third parties, and shall take corrective action

for any shortcomings, risks or vulnerabilities identified by those audits in the secure

processing environments.

4. Where recognised data altruism organisations under Chapter IV of Regulation

(EU) 2022/868 process personal electronic health data using a secure processing

environment, those environments shall also comply with the security measures set out in

paragraph 1, points (a) to (f), of this Article.

5. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, lay down the technical, organisational, information

security, confidentiality, data protection and interoperability requirements for the secure

processing environments, including with regard to the technical characteristics and tools

available to the health data user within the secure processing environments. Those

implementing acts shall be adopted in accordance with the examination procedure referred

to in Article 98(2).

PE-CONS 76/24 235

# LIFE.5 EN

_Article 74_

_Controllership_

1. The health data holder shall be deemed controller for the making available of personal

electronic health data requested pursuant to Article 60(1) to the health data access body.

The health data access body shall be deemed controller for the processing of the personal

electronic health data when fulfilling its tasks pursuant to this Regulation.

Notwithstanding the second subparagraph of this paragraph, the health data access body

shall be deemed to act as a processor on behalf of the health data user acting as a controller

for the processing of the personal electronic health data pursuant to a data permit issued

under Article 68 in the secure processing environment when providing data through such

environment or for the processing of such data pursuant to a health data request approved

under Article 69 for a response to be generated.

2. In situations referred to in Article 72(6), the trusted health data holder shall be deemed

controller for its processing of personal electronic health data related to the provision of

electronic health data to the health data user pursuant to a data permit or a health data

request. The trusted health data holder shall be deemed to act as a processor on behalf of

the health data user when providing data through a secure processing environment.

PE-CONS 76/24 236

# LIFE.5 EN

3. The Commission may, by means of implementing acts, establish a template for agreements

between controllers and processors under paragraphs (1) and (2) of this Article. Those

implementing acts shall be adopted in accordance with the examination procedure set out

in Article 98(2).

### **S ECTION 4** **C ROSS - BORDER INFRASTRUCTURE FOR SECONDARY USE**

_Article 75_

_HealthData@EU_

1. Each Member State shall designate one national contact point for secondary use. That

national contact point for secondary use shall be an organisational and technical gateway,

enabling and responsible for the making available of electronic health data for secondary

use in a cross-border context. The national contact point for secondary use may be the

coordinator health data access body pursuant to Article 55. Each Member State shall

inform the Commission of the name and contact details of the national contact point for

secondary use by … [the date of entry into force of this Regulation + 24 months]. The

Commission and the Member States shall make that information publicly available.

PE-CONS 76/24 237

# LIFE.5 EN

2. The Union health data access service shall act as the contact point of the Union’s

institutions, bodies, offices and agencies for secondary use and shall be responsible for

making electronic health data available for secondary use.

3. The national contact points for secondary use referred to in paragraph 1 and the Union

health data access service referred to in paragraph 2 shall connect to the cross-border

infrastructure for secondary use, namely HealthData@EU. The national contact points for

secondary use and the Union health data access service shall facilitate the cross-border

access to electronic health data for secondary use for different authorised participants in

HealthData@EU. The national contact points for secondary use shall cooperate closely

with each other and with the Commission.

4. Health-related research infrastructures or similar infrastructures whose functioning is based

on Union law and which provide support for the use of electronic health data for research,

policy making, statistical, patient safety or regulatory purposes may become authorised

participants in HealthData@EU and connect to it.

PE-CONS 76/24 238

# LIFE.5 EN

5. Third countries or international organisations may become authorised participants in

HealthData@EU where they comply with the rules of this Chapter and provide access to

health data users located in the Union, on equivalent terms and conditions, to the electronic

health data available to their health data access bodies, subject to compliance with

Chapter V of Regulation (EU) 2016/679.

The Commission may, by means of implementing acts, determine that a national contact

point for secondary use of a third country or a system established at international level by

an international organisation is compliant with the requirements of HealthData@EU for the

purposes of secondary use of health data, is compliant with this Chapter and provides

access to health data users located in the Union to the electronic health data it has access to

on terms and conditions equivalent to those of HealthData@EU. Compliance with those

legal, organisational, technical and security requirements, including with the requirements

for secure processing environments provided for in Article 73 of this Regulation, shall be

checked under the control of the Commission. Those implementing acts shall be adopted in

accordance with the examination procedure referred to in Article 98(2) of this Regulation.

The Commission shall make the list of implementing acts adopted pursuant to this

paragraph publicly available.

PE-CONS 76/24 239

# LIFE.5 EN

6. Each national contact point for secondary use and each authorised participant in

HealthData@EU shall acquire the required technical capability to connect to and

participate in HealthData@EU. They shall comply with the requirements and technical

specifications needed to operate HealthData@EU and to allow them to connect to it.

7. The Member States and the Commission shall set up HealthData@EU to support and

facilitate the cross-border access to electronic health data for secondary use, connecting the

national contact points for secondary use and authorised participants in HealthData@EU

and the central platform referred to in paragraph 8.

8. The Commission shall develop, deploy and operate a central platform for HealthData@EU

by providing information technology services needed to support and facilitate the exchange

of information between health data access bodies as part of HealthData@EU. The

Commission shall only process electronic health data on behalf of the controllers as a

processor.

9. Where requested by two or more national contact points for secondary use, the

Commission may provide a secure processing environment which is compliant with the

requirements of Article 73 for data from more than one Member State. Where two or more

national contact points for secondary use or authorised participants in HealthData@EU put

electronic health data in the secure processing environment managed by the Commission,

they shall be joint controllers and the Commission shall be processor for the purpose of

processing data in that environment.

PE-CONS 76/24 240

# LIFE.5 EN

10. The national contact points for secondary use shall act as joint controllers of the processing

operations carried out in HealthData@EU in which they are involved and the Commission

shall act as processor on behalf of those national contact points for secondary use, without

affecting the tasks of health data access bodies prior to and following those processing

operations.

11. Member States and the Commission shall seek to ensure that HealthData@EU is

interoperable with other relevant common European data spaces as referred to in

Regulations (EU) 2022/868 and (EU) 2023/2854.

12. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, set out:

(a) requirements, technical specifications and the IT architecture of HealthData@EU,

which shall ensure state-of-the-art data security, confidentiality, and protection of

electronic health data in HealthData@EU;

(b) conditions and compliance checks required to be able to join and remain connected

to HealthData@EU and conditions for temporary disconnection or definitive

exclusion from HealthData@EU, including specific provisions for cases of serious

misconduct or repeated infringements;

(c) the minimum criteria that need to be met by the national contact points for secondary

use and the authorised participants in HealthData@EU;

PE-CONS 76/24 241

# LIFE.5 EN

(d) the responsibilities of the controllers and processors participating in

HealthData@EU;

(e) the responsibilities of the controllers and processors for the secure processing

environment managed by the Commission;

(f) common specifications for the architecture of HealthData@EU and for its

interoperability with other common European data spaces.

The implementing acts referred to in the first subparagraph of this paragraph shall be

adopted in accordance with the examination procedure referred to in Article 98(2).

13. Where there is a positive outcome of the compliance check referred to in paragraph 5 of

this Article, the Commission may, by means of implementing acts, take decisions to

connect individual authorised participants to HealthData@EU. Those implementing acts

shall be adopted in accordance with the examination procedure referred to in Article 98(2).

PE-CONS 76/24 242

# LIFE.5 EN

_Article 76_

_Access to cross-border registries or databases of electronic health data for secondary use_

1. In the case of cross-border registries and databases, the health data access body with which

the health data holder for the specific registry or database is registered shall be competent

to decide on health data access applications to provide access to electronic health data

pursuant to a data permit. Where such registries or databases have joint controllers, the

health data access body that decides on the health data access applications to be used to

provide access to electronic health data shall be the health data access body of the Member

State where one of the joint controllers is established.

2. Where registries or databases from a number of Member States organise themselves into a

single network of registries or databases at Union level, the associated registries or

databases may designate a coordinator to ensure the provision of data from the registries’

or databases’ network for secondary use. The health data access body of the Member State

in which the coordinator of the network is established shall be competent to decide on the

health data access applications to be used to provide access to electronic health data for the

network of registries or databases.

PE-CONS 76/24 243

# LIFE.5 EN

### **S ECTION 5** **H EALTH DATA QUALITY AND UTILITY FOR SECONDARY USE**

_Article 77_

_Dataset description and dataset catalogue_

1. Health data access bodies shall, through a publicly available and standardised

machine-readable dataset catalogue, provide a description in the form of metadata of the

available datasets and their characteristics. The description of each dataset shall include

information concerning the source, scope, main characteristics, and nature of the electronic

health data in the dataset and the conditions for making those data available.

2. The dataset descriptions in the national dataset catalogue shall be available in at least one

official language of the Union. The dataset catalogue for Union institutions, bodies, offices

and agencies provided by the Union health data access service shall be available in all

official languages of the Union.

3. The dataset catalogue shall be made available to single information points established or

designated under Article 8 of Regulation (EU) 2022/868.

PE-CONS 76/24 244

# LIFE.5 EN

4. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, set out the minimum elements health data holders

are to provide for datasets and the characteristics of those elements. Those implementing

acts shall be adopted in accordance with the examination procedure referred to in

Article 98(2).

_Article 78_

_Data quality and utility label_

1. Datasets made available through health data access bodies may have a Union data quality

and utility label applied by the health data holders.

2. Datasets with electronic health data collected and processed with the support of Union or

national public funding shall have a data quality and utility label covering the elements set

out in paragraph 3.

3. The data quality and utility label shall cover the following elements, where applicable:

(a) for data documentation: metadata, support documentation, the data dictionary, the

format and standards used, the source of the data and, where applicable, the data

model;

(b) for assessment of technical quality: completeness, uniqueness, accuracy, validity,

timeliness and consistency of the data;

PE-CONS 76/24 245

# LIFE.5 EN

(c) for data quality management processes: the level of maturity of the data quality

management processes, including review and audit processes, and bias examination;

(d) for assessment of coverage: the period, population coverage and, where applicable,

representativity of the population sampled, and the average timeframe in which a

natural person appears in a dataset;

(e) for information on access and provision: the time between the collection of the

electronic health data and their addition to the dataset and the time needed to provide

electronic health data following the issuing of a data permit or a health data request

approval;

(f) for information on data modifications: merging and adding data to an existing

dataset, including links with other datasets.

4. Where a health data access body has reason to believe that a data quality and utility label

might be inaccurate, it shall assess whether the dataset covered by the label meets the

quality requirements forming part of the elements of the data quality and utility label as

referred to in paragraph 3 and, in the event the dataset does not meet the quality

requirements, shall revoke the label.

5. The Commission is empowered to adopt delegated acts in accordance with Article 97 to

amend this Regulation by modifying, adding or removing elements to be covered by the

data quality and utility label provided for in paragraph 3.

PE-CONS 76/24 246

# LIFE.5 EN

6. By … [two years from the date of entry into force of this Regulation], the Commission

shall, by means of implementing acts, set out the visual characteristics and technical

specifications of the data quality and utility label, based on the elements referred to in

paragraph 3 of this Article. Those implementing acts shall be adopted in accordance with

the examination procedure referred to in Article 98(2) of this Regulation. Those

implementing acts shall take into account the requirements in Article 10 of Regulation

(EU) 2024/1689 and any adopted common specifications or harmonised standards

supporting those requirements, where applicable.

_Article 79_

_EU dataset catalogue_

1. The Commission shall establish an EU dataset catalogue connecting the national dataset

catalogues established by the health data access bodies in each Member State as well as the

dataset catalogues of authorised participants in HealthData@EU.

2. The EU dataset catalogue, the national dataset catalogues and the dataset catalogues of

authorised participants in HealthData@EU shall be made publicly available.

PE-CONS 76/24 247

# LIFE.5 EN

_Article 80_

_Minimum specifications for datasets of high impact_

The Commission may, by means of implementing acts, determine the minimum specifications for

datasets of high impact for secondary use, taking into account existing Union infrastructures,

standards, guidelines and recommendations. Those implementing acts shall be adopted in

accordance with the examination procedure referred to in Article 98(2).

### **S ECTION 6** **C OMPLAINTS**

_Article 81_

_Right to lodge a complaint with a health data access body_

1. Without prejudice to any other administrative or judicial remedy, natural and legal persons

shall have the right to lodge a complaint in relation to the provisions laid down in this

Chapter, individually or, where relevant, collectively, with a health data access body,

provided that their rights or interests are negatively affected.

2. The health data access body with which the complaint has been lodged shall inform the

complainant of the progress made in dealing with the complaint and of the decision taken

on the complaint.

PE-CONS 76/24 248

# LIFE.5 EN

3. Health data access bodies shall provide easily accessible tools for the submission of

complaints.

4. Where the complaint concerns the rights of natural persons pursuant to Article 71 of this

Regulation, the complaint shall be transmitted to the competent supervisory authority

under Regulation (EU) 2016/679. The relevant health data access body shall provide the

necessary information at its disposal to that supervisory authority under Regulation

(EU) 2016/679 in order to facilitate the assessment and investigation of the complaint.

## **Chapter V** **Additional actions**

_Article 82_

_Capacity building_

The Commission shall support the sharing of best practices and expertise to build capacity within

Member States to strengthen digital health systems for primary use and secondary use taking into

account the specific circumstances of the different categories of stakeholders involved. To support

that capacity building, the Commission shall in close cooperation and consultation with Member

States establish indicators for self-assessment for primary use and secondary use.

PE-CONS 76/24 249

# LIFE.5 EN

_Article 83_

_Training programmes and information for health professionals_

1. Member States shall develop and implement or provide access to training programmes and

provide access to information for health professionals in order for them to understand and

effectively carry out their role in the primary use of and in the accessing of electronic

health data, including in relation to Articles 11, 13 and 16. The Commission shall support

Member States in that regard.

2. The training programmes and information shall be accessible to and affordable for all

health professionals, without prejudice to the organisation of healthcare systems at national

level.

_Article 84_

_Digital health literacy and digital health access_

1. Member States shall promote and support digital health literacy and the development of

relevant competences and skills for patients. The Commission shall support Member States

in this regard. Awareness-raising campaigns or programmes shall aim, in particular, to

inform patients and the public at large about primary use and secondary use in the

framework of the EHDS, including the rights arising from it, as well as the advantages,

risks and potential gains for science and society of primary use and secondary use.

PE-CONS 76/24 250

# LIFE.5 EN

2. The awareness-raising campaigns and programmes referred to in paragraph 1 shall be

tailored to the needs of specific groups and shall be developed, reviewed and, where

necessary, updated.

3. Member States shall promote access to the infrastructure necessary for the effective

management of natural persons’ electronic health data, both for primary use and secondary

use.

_Article 85_

_Additional requirements for public procurement and Union funding_

1. Contracting authorities, including digital health authorities and health data access bodies

and Union institutions, bodies, offices or agencies, shall make reference to the applicable

technical specifications, standards and profiles as referred to in Articles 15, 23, 36, 73, 75

and 78 for public procurement procedures and when formulating their tender documents or

calls for proposals, as well as when defining the conditions for Union funding regarding

this Regulation, including enabling conditions for the structural and cohesion funds.

2. The criteria for obtaining funding from the Union shall take into account the requirements

developed in the framework of Chapters II, III and IV.

PE-CONS 76/24 251

# LIFE.5 EN

_Article 86_

_Storage of personal electronic health data for primary use_

In accordance with the general principles of Union law, which include the fundamental rights

enshrined in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, Member

States shall ensure that a particularly high level of protection and security is in place when

processing personal electronic health data for primary use, by means of appropriate technical and

organisational measures. In this respect, this Regulation shall not preclude a requirement under

national law, taking into account the national context, that, in cases where personal electronic health

data are processed by healthcare providers for the provision of healthcare or by the national contact

points for digital health connected to MyHealth@EU, the storage of personal electronic health data

referred to in Article 14 of this Regulation for the purpose of primary use be located within the

Union, in compliance with Union law and international commitments.

PE-CONS 76/24 252

# LIFE.5 EN

_Article 87_

_Storage of personal electronic health data by health data access bodies_

_and secure processing environments_

1. Health data access bodies, trusted health data holders and the Union health data access

service shall store and process personal electronic health data in the Union when

performing pseudonymisation, anonymisation and any other personal data processing

operations referred to in Articles 67 to 72, through secure processing environments within

the meaning of Article 73 and Article 75(9) or through HealthData@EU. That requirement

shall apply to any entity performing those tasks on behalf of such bodies, holders or

service.

2. By way of exception from paragraph 1 of this Article, the data referred to in that paragraph

may be stored and processed in a third country, or a territory or one or more specified

sectors within that third country, where such country, territory or sector is covered by an

adequacy decision adopted pursuant to Article 45 of Regulation (EU) 2016/679.

PE-CONS 76/24 253

# LIFE.5 EN

_Article 88_

_Third-country transfer of non-personal electronic data_

1. Non-personal electronic health data made available by health data access bodies to a health

data user in a third country under a data permit issued pursuant to Article 68 of this

Regulation or a health data request approved pursuant to Article 69 of this Regulation, to

authorised participants in a third country or to an international organisation, and based on a

natural person’s electronic health data falling within one of the categories referred to in

Article 51, shall be deemed highly sensitive within the meaning of Article 5(13) of

Regulation (EU) 2022/868 where the transfer of such non-personal electronic data to third

countries presents a risk of re-identification through means going beyond those reasonably

likely to be used, in particular in view of the limited number of natural persons to whom

those data relate, the fact that they are geographically scattered or the technological

developments expected in the near future.

2. The protective measures for the categories of data mentioned in paragraph 1 of this Article

shall be detailed in a delegated act referred to in Article 5(13) of Regulation

(EU) 2022/868.

PE-CONS 76/24 254

# LIFE.5 EN

_Article 89_

_International governmental access to non-personal electronic health data_

1. Digital health authorities, health data access bodies, authorised participants in the

cross-border infrastructures provided for in Articles 23 and 75 and health data users shall

take all reasonable technical, legal and organisational measures, including contractual

arrangements, in order to prevent the transfer of non-personal electronic health data held in

the Union to a third country or an international organisation, including for governmental

access in a third country, where such transfer would create a conflict with Union law or the

national law of the relevant Member State.

2. Any judgment of a third-country court or tribunal and any decision of a third-country

administrative authority requiring a digital health authority, health data access body or

health data users to transfer or give access to non-personal electronic health data within the

scope of this Regulation held in the Union shall be recognised or enforceable in any

manner only if based on an international agreement, such as a mutual legal assistance

treaty, in force between the requesting third country and the Union, or any such agreement

between the requesting third country and a Member State.

PE-CONS 76/24 255

# LIFE.5 EN

3. In the absence of an international agreement as referred to in paragraph 2, where a digital

health authority, a health data access body or a health data user is the addressee of a

decision or judgment of a third-country court or tribunal or of a decision of a third-country

administrative authority requiring them to transfer or to give access to non-personal data

within the scope of this Regulation held in the Union, and compliance with such a decision

or judgment would risk putting the addressee in conflict with Union law or with the

national law of the relevant Member State, the transfer to, or accessing of such data by, that

third-country court, tribunal or administrative authority shall only take place or be provided

where:

(a) the third-country legal system requires the reasons and proportionality of such a

decision or judgment to be set out and requires such a decision or judgment to be

specific in character, for instance by establishing a sufficient link to certain suspected

persons or infringements;

(b) the reasoned objection of the addressee is subject to a review by a competent

third-country court or tribunal; and

(c) the competent third-country court or tribunal issuing the decision or judgment or

reviewing the decision of an administrative authority is empowered by the national

law of the third-country to take duly into account the relevant legal interests of the

provider of the data protected under Union law or the national law of the relevant

Member State.

PE-CONS 76/24 256

# LIFE.5 EN

4. If the conditions laid down in paragraph 2 or 3 are met, a digital health authority, a health

data access body or a data altruism organisation shall provide the minimum amount of data

permissible in response to a request, based on a reasonable interpretation of the request.

5. The digital health authorities, health data access bodies and health data users shall inform

the health data holder about the existence of a request of a third-country administrative

authority to access its data before complying with that request, except where the request

serves law enforcement purposes and for as long as compliance is necessary to preserve the

effectiveness of the law enforcement activity.

_Article 90_

_Additional conditions for transfer of personal electronic health data to a third country_

_or an international organisation_

Transfer of personal electronic health data to a third country or an international organisation shall

be granted in accordance with Chapter V of Regulation (EU) 2016/679. Member States may

maintain or introduce further conditions on international access to, and transfer of, personal

electronic health data, including limitations, in accordance with Article 9(4) of Regulation

(EU) 2016/679, in addition to the requirements laid down in Article 24(3) and Article 75(5) of this

Regulation and in Chapter V of Regulation (EU) 2016/679.

PE-CONS 76/24 257

# LIFE.5 EN

_Article 91_

_Health data access applications and health data requests from third countries_

1. Without prejudice to Articles 67, 68 and 69, health data access applications and health data

requests submitted by a health data applicant established in a third country shall be

considered eligible by health data access bodies and the Union health data access service if

the third country concerned:

(a) is an authorised participant on the basis of having a national contact point for

secondary use covered by an implementing act referred to in Article 75(5); or

(b) allows Union health data applicants access to electronic health data in that third

country under conditions that are not more restrictive than those provided for in this

Regulation, and therefore such access is covered by an implementing act referred to

in paragraph 2 of this Article.

2. By means of implementing acts, the Commission may determine that a third country meets

the requirement set out in paragraph 1, point (b), of this Article. Those implementing acts

shall be adopted in accordance with the examination procedure referred to in Article 98(2).

The Commission shall make the list of implementing acts adopted pursuant to this

paragraph publicly available.

PE-CONS 76/24 258

# LIFE.5 EN

3. The Commission shall monitor developments in third countries and international

organisations that could affect the application of the implementing acts adopted pursuant to

paragraph 2, and shall provide for a periodic review of the application of this Article.

Where the Commission considers that a third country no longer meets the requirement laid

down in paragraph 1, point (b), of this Article, it shall adopt an implementing act repealing

the implementing act referred to in paragraph 2 of this Article relating to that third country

that benefits from access. That implementing act shall be adopted in accordance with the

examination procedure referred to in Article 98(2).

## **Chapter VI** **European governance and coordination**

_Article 92_

_European Health Data Space Board_

1. A European Health Data Space Board (the ‘EHDS Board’) is hereby established to

facilitate cooperation and the exchange of information among Member States and the

Commission. The EHDS Board shall be composed of two representatives per Member

State, namely one representative for primary use purposes and one for secondary use

purposes, nominated by each Member State. Each Member State shall have one vote.

Members of the EHDS Board shall undertake to act in the public interest and in an

independent manner.

PE-CONS 76/24 259

# LIFE.5 EN

2. A representative of the Commission and one of the representatives of the Member States

referred to in paragraph 1 shall co-chair the meetings of the EHDS Board.

3. Market surveillance authorities referred to in Article 43, the EDPB and the European Data

Protection Supervisor, the European Medicines Agency, the European Centre for Disease

Prevention and Control and the European Union Agency for Cybersecurity (ENISA) shall

be invited to attend the meetings, where relevant according to the EHDS Board.

4. The EHDS Board may invite national authorities, experts and observers as well as Union

institutions, bodies, offices and agencies, in addition to those referred to in paragraph 3,

and research infrastructures and other similar infrastructures to attend its meetings.

5. The EHDS Board may cooperate with external experts where appropriate.

6. Depending on the functions related to the use of electronic health data, the EHDS Board

may work in subgroups for certain topics, in which digital health authorities or health data

access bodies shall be represented. Those subgroups shall support the EHDS Board with

specific expertise and may have joint meetings, as required.

7. The EHDS Board shall adopt its rules of procedure and a code of conduct, following a

proposal from the Commission. Those rules of procedure shall provide for the

composition, organisation, functioning and cooperation of the subgroups referred to in

paragraph 6 of this Article and the cooperation of the EHDS Board with the stakeholder

forum referred to in Article 93.

The EHDS Board shall adopt decisions by consensus as far as possible. If a consensus

cannot be reached, the EHDS Board shall adopt decisions by a majority of two-thirds of

the Member States.

PE-CONS 76/24 260

# LIFE.5 EN

8. The EHDS Board shall cooperate with other relevant bodies, entities and experts, such as

the European Data Innovation Board established by Article 29 of Regulation

(EU) 2022/868, competent authorities designated in accordance with Article 37 of

Regulation (EU) 2023/2854, supervisory bodies designated in accordance with Article 46b

of Regulation (EU) No 910/2014, the EDPB established by Article 68 of Regulation

(EU) 2016/679, cybersecurity bodies, including ENISA, and the European Open Science

Cloud, with a view to reaching advanced solutions towards findable, accessible,

interoperable and reusable (FAIR) data usage in research and innovation.

9. The EHDS Board shall be assisted by a secretariat provided by the Commission.

10. The EHDS Board shall publish its meeting dates and the minutes of its deliberations, and

publish an activity report every two years.

11. The Commission shall, by means of implementing acts, adopt the necessary measures for

the establishment and operation of the EHDS Board. Those implementing acts shall be

adopted in accordance with the examination procedure referred to in Article 98(2).

_Article 93_

_Stakeholder forum_

1. A stakeholder forum is hereby established for the purpose of facilitating the exchange of

information and promoting cooperation among stakeholders in relation to the

implementation of this Regulation.

PE-CONS 76/24 261

# LIFE.5 EN

2. The stakeholder forum shall have a balanced composition and be composed of relevant

stakeholders, including representatives of patient organisations, health professionals,

industry, consumer organisations, scientific researchers and academia, and shall represent

their views. Where commercial interests are represented in the stakeholder forum, the

representation of such interests shall be based on a balanced combination of large

companies, small and medium-sized enterprises and start-ups. The tasks of the stakeholder

forum shall encompass equally primary use and secondary use.

3. Members of the stakeholder forum shall be appointed by the Commission following a

public call for interest and a transparent selection procedure. Members of the stakeholder

forum shall make an annual declaration of interests which shall be made publicly available

and updated, when relevant.

4. The stakeholder forum may establish standing or temporary subgroups, as appropriate, for

the purpose of examining specific questions related to the objectives of this Regulation.

The stakeholder forum shall adopt its rules of procedure.

5. The stakeholder forum shall hold regular meetings which shall be chaired by a

Commission representative.

6. The stakeholder forum shall prepare an annual report of its activities. That report shall be

made publicly available.

PE-CONS 76/24 262

# LIFE.5 EN

_Article 94_

_Tasks of the EHDS Board_

1. The EHDS Board shall have the following tasks relating to primary use in accordance with

Chapters II and III:

(a) assisting Member States in coordinating practices of digital health authorities;

(b) issuing written contributions and exchanging best practices on matters related to the

coordination of the implementation at Member State level, taking into account the

regional and local level, of this Regulation and of the delegated and implementing

acts adopted pursuant to it, in particular as regards:

(i) the provisions set out in Chapters II and III;

(ii) the development of online services facilitating secure access, including secure

electronic identification, to electronic health data for health professionals and

natural persons;

(iii) other aspects relating to primary use;

(c) facilitating cooperation between digital health authorities through capacity building,

establishing the framework for activity-reporting referred to in Article 20(1) and the

exchange of information;

PE-CONS 76/24 263

# LIFE.5 EN

(d) sharing among its members information concerning risks posed by EHR systems and

serious incidents as well as the handling of such risks and incidents;

(e) facilitating the exchange of views on primary use with the stakeholder forum referred

to in Article 93, as well as with regulators and policy makers in the health sector.

2. The EHDS Board shall have the following tasks related to secondary use in accordance

with Chapter IV:

(a) assisting Member States in coordinating practices of health data access bodies in the

implementation of provisions set out in Chapter IV, to ensure a consistent application

of this Regulation;

(b) issuing written contributions and exchanging best practices on matters related to the

coordination of the implementation at Member State level of this Regulation and of

the delegated and implementing acts adopted pursuant to it, in particular as regards:

(i) implementation of rules for access to electronic health data;

(ii) technical specifications or existing standards regarding the requirements set out

in Chapter IV;

(iii) incentives for promoting data quality and interoperability improvement;

(iv) policies concerning fees to be charged by the health data access bodies and

health data holders;

PE-CONS 76/24 264

# LIFE.5 EN

(v) measures to protect the personal data of health professionals involved in the

treatment of natural persons;

(vi) other aspects of secondary use;

(c) creating, in consultation and cooperation with relevant stakeholders, including

representatives of patients, health professionals and researchers, guidelines in order

to help health data users to fulfil their duties under Article 61(5), and in particular to

determine whether their findings are clinically significant;

(d) facilitating cooperation between health data access bodies through capacity building,

establishing the framework for activity-reporting referred to in Article 59(1), and the

exchange of information;

(e) sharing information concerning risks and incidents related to secondary use, as well

as the handling of such risks and incidents;

(f) facilitating the exchange of views on secondary use with the stakeholder forum

referred to in Article 93, as well as with health data holders, health data users,

regulators and policy makers in the health sector.

PE-CONS 76/24 265

# LIFE.5 EN

_Article 95_

_Steering groups for MyHealth@EU and HealthData@EU_

1. The MyHealth@EU steering group and the HealthData@EU steering group (the ‘steering

groups’) are hereby established for the cross-border infrastructures provided for in

Articles 23 and 75. Each steering group shall be composed of one representative per

Member State appointed from the relevant national contact points.

2. The steering groups shall take operational decisions concerning the development and

operation of MyHealth@EU and HealthData@EU.

3. The steering groups shall take decisions by consensus. Where a consensus cannot be

reached, a decision shall be adopted by two-thirds of the members. For the adoption of the

decisions, each Member State shall have one vote.

4. The steering groups shall adopt rules of procedure, setting out their composition,

organisation, functioning and cooperation.

5. Other authorised participants may be invited to exchange information and views on

relevant matters related to MyHealth@EU and HealthData@EU. Where those authorised

participants are invited, they shall have an observer role.

6. Stakeholders and relevant third parties, including representatives of patients, health

professionals, consumers and industry, may be invited to attend the meetings of the

steering groups as observers.

PE-CONS 76/24 266

# LIFE.5 EN

7. The steering groups shall elect chairs for their meetings.

8. The steering groups shall be assisted by a secretariat provided by the Commission.

_Article 96_

_Roles and responsibilities of the Commission regarding the functioning of the EHDS_

1. In addition to its role in making available electronic health data held by Union institutions,

bodies, offices or agencies, in accordance with Article 55, Article 56 and Article 75(2), and

its tasks under Chapter III, in particular Article 40, the Commission shall develop,

maintain, host and operate the infrastructures and central services required to support the

functioning of the EHDS, for all relevant connected entities, by means of:

(a) an interoperable, cross-border identification and authentication mechanism for

natural persons and health professionals, in accordance with Article 16(3) and (4);

(b) the central services and infrastructures for digital health of MyHealth@EU, in

accordance with Article 23(1);

(c) compliance checks for connecting authorised participants to MyHealth@EU, in

accordance with Article 23(9);

(d) the supplementary cross-border digital health services and infrastructures referred to

in Article 24(1);

PE-CONS 76/24 267

# LIFE.5 EN

(e) as part of HealthData@EU, a service to submit health data access applications

seeking access to electronic health data held by health data holders in more than one

Member State or by other authorised participants in HealthData@EU and to

automatically forward the health data access applications to the relevant contact

points, in accordance with Article 67(3);

(f) the central services and infrastructures of HealthData@EU in accordance with

Article 75(7) and (8);

(g) a secure processing environment in accordance with Article 75(9), in which health

data access bodies can decide to make data available in accordance with

Article 68(8);

(h) compliance checks for connecting authorised participants to HealthData@EU, in

accordance with Article 75(5);

(i) a federated EU dataset catalogue connecting the national dataset catalogues, in

accordance with Article 79;

(j) a secretariat for the EHDS Board, in accordance with Article 92(9);

(k) a secretariat for the steering groups, in accordance with Article 95(8).

PE-CONS 76/24 268

# LIFE.5 EN

2. The services referred to in paragraph 1 of this Article shall meet sufficient quality

standards in terms of availability, security, capacity, interoperability, maintenance,

monitoring and development to ensure the EHDS functions effectively. The Commission

shall provide those services in accordance with the operational decisions of the relevant

steering groups established in Article 95.

3. The Commission shall prepare a report on the infrastructures and services supporting the

EHDS that it provides in accordance with paragraph 1 every two years and make it

publicly available.

## **Chapter VII** **Delegation of powers and committee procedure**

_Article 97_

_Exercise of the delegation_

1. The power to adopt delegated acts is conferred on the Commission subject to the

conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Article 14(2), Article 49(4) and

Article 78(5) shall be conferred on the Commission for an indeterminate period of time

from … [date of entry into force of this Regulation].

PE-CONS 76/24 269

# LIFE.5 EN

3. The power to adopt delegated acts referred to in Article 14(2), Article 49(4) and

Article 78(5) may be revoked at any time by the European Parliament or by the Council. A

decision to revoke shall put an end to the delegation of the power specified in that decision.

It shall take effect the day following the publication of the decision in the _Official Journal_

_of the European Union_ or at a later date specified therein. It shall not affect the validity of

any delegated acts already in force.

4. Before adopting a delegated act, the Commission shall consult experts designated by each

Member State in accordance with the principles laid down in the Interinstitutional

Agreement of 13 April 2016 on Better Law-Making.

5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the

European Parliament and to the Council.

6. A delegated act adopted pursuant to Article 14(2), Article 49(4) or Article 78(5) shall enter

into force only if no objection has been expressed either by the European Parliament or by

the Council within a period of three months of notification of that act to the European

Parliament and to the Council or if, before the expiry of that period, the European

Parliament and the Council have both informed the Commission that they will not object.

That period shall be extended by three months at the initiative of the European Parliament

or of the Council.

PE-CONS 76/24 270

# LIFE.5 EN

_Article 98_

_Committee procedure_

1. The Commission shall be assisted by a committee. That committee shall be a committee

within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall

apply.

## **Chapter VIII** **Miscellaneous**

_Article 99_

_Penalties_

Member States shall lay down the rules on penalties applicable to infringements of this Regulation,

in particular for infringements which are not subject to administrative fines pursuant to Articles 63

and 64, and shall take all measures necessary to ensure that they are implemented. The penalties

provided for shall be effective, proportionate and dissuasive. Member States shall, by … [the date

of entry into force of this Regulation + 24 months], notify the Commission of those rules and of

those measures and shall notify it, without delay, of any subsequent amendment affecting them.

PE-CONS 76/24 271

# LIFE.5 EN

Member States shall take into account the following non-exhaustive and indicative criteria for the

imposition of penalties for infringements of this Regulation, where appropriate:

(a) the nature, gravity, scale and duration of the infringement;

(b) any action taken by the infringer to mitigate or remedy the damage caused by the

infringement;

(c) any previous infringements by the infringer;

(d) the financial benefits gained or losses avoided by the infringer due to the infringement,

insofar as such benefits or losses can be reliably established;

(e) any other aggravating or mitigating factors applicable to the circumstances of the case;

(f) the infringer’s annual turnover in the Union in the preceding financial year.

_Article 100_

_Right to receive compensation_

Any natural or legal person that has suffered material or non-material damage as a result of an

infringement of this Regulation shall have the right to receive compensation, in accordance with

Union and national law.

PE-CONS 76/24 272

# LIFE.5 EN

_Article 101_

_Representation of a natural person_

Where a natural person considers that his or her rights under this Regulation have been infringed, he

or she shall have the right to mandate a not-for-profit body, organisation or association, constituted

in accordance with national law, having statutory public interest objectives and active in the field of

the protection of personal data, to lodge a complaint on his or her behalf or to exercise the rights

referred to in Articles 21 and 81.

_Article 102_

_Evaluation, review and progress report_

1. By … [eight years from the date of entry into force of this Regulation], the Commission

shall carry out a targeted evaluation of this Regulation, and submit a report on its main

findings to the European Parliament, the Council, the European Economic and Social

Committee and the Committee of the Regions, accompanied, where appropriate, by a

proposal for its amendment. That evaluation shall cover the following:

(a) the possibilities of further extending interoperability between EHR systems and

electronic health data access services other than those established by the Member

States;

(b) the need to update the data categories referred to in Article 51 and the purposes listed

in Article 53(1);

PE-CONS 76/24 273

# LIFE.5 EN

(c) the implementation and use by natural persons of the mechanisms to opt out from

secondary use referred to in Article 71, in particular on the impact of those

mechanisms on public health, scientific research and fundamental rights;

(d) the use and implementation of any stricter measures introduced pursuant to

Article 51(4);

(e) the exercise and implementation of the right referred to in Article 8;

(f) an assessment of the certification framework for EHR systems established in

Chapter III and the need to introduce further tools regarding conformity assessment;

(g) an assessment of the functioning of the internal market for EHR systems;

(h) an assessment of the costs and benefits of the implementation of the provisions for

secondary use laid down in Chapter IV;

(i) the application of fees as referred to in Article 62.

2. By … [10 years from the entry into force of this Regulation], the Commission shall carry

out an overall evaluation of this Regulation, and submit a report on its main findings to the

European Parliament, the Council, the European Economic and Social Committee and the

Committee of the Regions, accompanied, where appropriate, by a proposal for its

amendment or other appropriate measures. That evaluation shall include an assessment of

the efficiency and functioning of the systems providing for access to electronic health data

for further processing, carried out on the basis of Union or national law referred to in

Article 1(7), with regard to their impact on the implementation of this Regulation.

PE-CONS 76/24 274

# LIFE.5 EN

3. Member States shall provide the Commission with the information necessary for the

preparation of the reports referred to in paragraphs 1 and 2 and the Commission shall take

that information duly into account in those reports.

4. Every year following … [date of the entry into force of this Regulation] until the end of the

year in which all provisions of this Regulation apply as provided for in Article 105, the

Commission shall submit a progress report to the Council on the preparations for the full

implementation of this Regulation. That progress report shall contain information about the

degree of progress and the readiness of the Member States in relation to the

implementation of this Regulation, including an assessment of the feasibility of reaching

the timeframes laid down in Article 105 and may also contain recommendations for

Member States to improve preparedness for the application of this Regulation.

_Article 103_

_Amendment to Directive 2011/24/EU_

Article 14 of Directive 2011/24/EU is deleted with effect from … [six years from the date of entry

into force of this Regulation].

PE-CONS 76/24 275

# LIFE.5 EN

_Article 104_

_Amendment to Regulation (EU) 2024/2847_

Regulation (EU) 2024/2847 is amended as follows:

(1) in Article 13, paragraph 4 is replaced by the following:

‘4. When placing a product with digital elements on the market, the manufacturer shall

include the cybersecurity risk assessment referred to in paragraph 3 of this Article in

the technical documentation required pursuant to Article 31 and Annex VII. For

products with digital elements as referred to in Article 12 and Article 32(5a), which

are also subject to other Union legal acts, the cybersecurity risk assessment may be

part of the risk assessment required by those Union legal acts. Where certain

essential cybersecurity requirements are not applicable to the product with digital

elements, the manufacturer shall include a clear justification to that effect in that

technical documentation.’;

(2) in Article 31, paragraph 3 is replaced by the following:

‘3. For products with digital elements as referred to in Article 12 and Article 32(5a),

which are also subject to other Union legal acts which provide for technical

documentation, a single set of technical documentation shall be drawn up containing

the information referred to in Annex VII and the information required by those

Union legal acts.’;

PE-CONS 76/24 276

# LIFE.5 EN

(3) in Article 32, the following paragraph is inserted:

‘5a. Manufacturers of products with digital elements that are classified as EHR systems

under Regulation (EU) 2024/… **[*]** [+] of the European Parliament and of the Council

shall demonstrate conformity with the essential requirements set out in Annex I to

this Regulation using the relevant conformity assessment procedure provided for in

Chapter III of Regulation (EU) 2024/… [++] .

________________

*****
Regulation (EU) 2024/… of the European Parliament and of the Council of … on the
European Health Data Space and amending Directive 2011/24/EU and Regulation
(EU) 2024/2847 (OJ …, ELI: …).’.

+ OJ: Please insert in the text the number of the Regulation contained in document
PE-CONS 76/24 (2022/0140(COD)) and insert the number, date, title and OJ reference of
that Regulation in the footnote.
++ OJ: Please insert in the text the number of the Regulation contained in document
PE-CONS 76/24 (2022/0140(COD)).

PE-CONS 76/24 277

# LIFE.5 EN

## **Chapter IX** **Deferred application, transitional and final provisions**

_Article 105_

_Entry into force and application_

This Regulation shall enter into force on the twentieth day following that of its publication in the

_Official Journal of the European Union_ .

This Regulation shall apply from … [two years from the date of entry into force of this Regulation].

However, Articles 3 to 15, Article 23(2) to (6), Articles 25, 26, 27, 47, 48 and 49 shall apply as

follows:

(a) from … [four years from the date of entry into force of this Regulation] to priority

categories of personal electronic health data referred to in Article 14(1), points (a), (b) and

(c), and to EHR systems intended by the manufacturer to process such categories of data;

(b) from … [six years from the date of entry into force of this Regulation] to priority

categories of personal electronic health data referred to in Article 14(1), points (d), (e) and

(f), and to EHR systems intended by the manufacturer to process such categories of data;

PE-CONS 76/24 278

# LIFE.5 EN

(c) from one year from the date established in a delegated act to be adopted pursuant to

Article 14(2) for each amendment of the main characteristics of personal electronic health

data set out in Annex I, provided that that date is subsequent to the date of application

referred to in points (a) and (b) of this subparagraph for the categories of personal

electronic health data concerned.

Chapter III shall apply to EHR systems put into service in the Union referred to in Article 26(2)

from … [six years from the date of entry into force of this Regulation].

Chapter IV shall apply from … [four years from the date of entry into force of this Regulation].

However, Article 55(6), Article 70, Article 73(5), Article 75(1), Article 75(12), Article 77(4) and

Article 78(6) shall apply from … [two years from the date of entry into force of this Regulation],

Article 51(1), points (b), (f), (g), (m) and (p), shall apply from … [six years from the date of entry

into force of this Regulation], and Article 75(5) shall apply from … [10 years from the date of entry

into force of this Regulation].

The implementing acts referred to in Article 13(4), Article 15(1), Article 23(4) and Article 36(1)

shall apply from the dates referred to in the third paragraph of this Article depending on the

categories of personal electronic health data referred to in Article 14(1), points (a), (b) and (c), or

Article 14(1), points (d), (e) and (f), respectively.

PE-CONS 76/24 279

# LIFE.5 EN

The implementing acts referred to in Article 70, Article 73(5), Article 75(12), Article 77(4) and

Article 78(6) shall apply from … [four years from the date of entry into force of this Regulation].

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at …,

_For the European Parliament_ _For the Council_

_The President_ _The President_

PE-CONS 76/24 280

# LIFE.5 EN

**ANNEX I**

Main characteristics of priority categories of personal electronic health data for primary use

|Electronic<br>health data category|Main characteristics of electronic health data<br>included under the category|
|---|---|
|1.<br>Patient<br>summaries|Electronic health data that include significant clinical facts related to<br>an identified natural person and that are essential for the provision of<br>safe and efficient healthcare to that person. The following information<br>is part of a patient summary:<br>1.<br>Personal details.<br>2.<br>Contact information.<br>3.<br>Information on insurance.<br>4.<br>Allergies.<br>5.<br>Medical alerts.<br>6.<br>Vaccination/prophylaxis information, possibly in the form of<br>a vaccination card.<br>7.<br>Current, resolved, closed or inactive problems, including in an<br>international classification coding.<br>8.<br>Textual information related to medical history.<br>9.<br>Medical devices and implants.<br>10.<br>Medical or care procedures.<br>11.<br>Functional status.<br>12.<br>Current and relevant past medicines.<br>13.<br>Social history observations related to health.<br>14.<br>Pregnancy history.<br>15.<br>Patient-provided data.<br>16.<br>Observation results pertaining to the health condition.<br>17.<br>Plan of care.<br>18.<br>Information on a rare disease, such as details about the impact<br>or characteristics of the disease.|

PE-CONS 76/24 1

# ANNEX I LIFE.5 EN

|Electronic<br>health data category|Main characteristics of electronic health data<br>included under the category|
|---|---|
|2.<br>Electronic<br>prescriptions|Electronic health data constituting a prescription for a medicinal<br>product as defined in Article 3, point (k), of Directive 2011/24/EU.|
|3.<br>Electronic<br>dispensations|Information on the supply of a medicinal product to a natural person<br>by a pharmacy based on an electronic prescription.|
|4.<br>Medical imaging<br>studies and<br>related imaging<br>reports|Electronic health data related to the use of or produced by technologies<br>that are used to view the human body in order to prevent, diagnose,<br>monitor or treat medical conditions.|
|5.<br>Medical test<br>results, including<br>laboratory and<br>other diagnostic<br>results and<br>related reports|Electronic health data representing results of studies performed in<br>particular through in vitro diagnostics such as clinical biochemistry,<br>haematology, transfusion medicine, microbiology, immunology and<br>others, and including, where relevant, reports supporting the<br>interpretation of the results.|
|6.<br>Discharge reports|Electronic health data related to a healthcare encounter or episode of<br>care and including essential information about admission, treatment<br>and discharge of a natural person.|

PE-CONS 76/24 2

# ANNEX I LIFE.5 EN

**ANNEX II**

Essential requirements for the harmonised software components of EHR systems

and for products for which interoperability with EHR systems has been claimed

The essential requirements laid down in this Annex shall apply _mutatis mutandis_ to medical

devices, in vitro diagnostic medical devices, AI systems and wellness applications claiming

interoperability with EHR systems.

1. General requirements

1.1. The harmonised software components of an EHR system shall achieve the

performance intended by its manufacturer and shall be designed and manufactured in

such a way that, during normal conditions of use, they are suitable for their intended

purpose and their use does not put at risk patient safety.

1.2. The harmonised software components of the EHR system shall be designed and

developed in such a way that the EHR system can be supplied and installed, taking

into account the instructions and information provided by the manufacturer, without

adversely affecting its characteristics and performance during its intended use.

1.3. An EHR system shall be designed and developed in such a way that its

interoperability, safety and security features uphold the rights of natural persons, in

line with the intended purpose of the EHR system, as set out in Chapter II.

PE-CONS 76/24 1

# ANNEX II LIFE.5 EN

1.4. The harmonised software components of an EHR system that is intended to be

operated together with other products, including medical devices, shall be designed

and manufactured in such a way that interoperability and compatibility are reliable

and secure, and personal electronic health data can be shared between the device and

the EHR system in relation to those harmonised software components of an EHR

system.

2. Requirements for interoperability

2.1. Where an EHR system is designed to store or intermediate personal electronic health

data, it shall provide an interface enabling access to the personal electronic health

data processed by it in the European health record exchange format, by means of the

European interoperability software component for EHR systems.

2.2. Where an EHR system is designed to store or intermediate personal electronic health

data, it shall be able to receive personal electronic health data in the European health

record exchange format, by means of the European interoperability software

component for EHR systems.

2.3. Where an EHR system is designed to provide access to personal electronic health

data, it shall be able to receive personal electronic health data in the European health

record exchange format, by means of the European interoperability software

component for EHR systems.

PE-CONS 76/24 2

# ANNEX II LIFE.5 EN

2.4. An EHR system that includes a functionality for entering structured personal

electronic health data shall enable the entry of data with sufficient granularity to

enable the provision of the entered personal electronic health data in the European

health record exchange format.

2.5. The harmonised software components of an EHR system shall not include features

that prohibit, restrict or place an undue burden on authorised access, personal

electronic health data sharing or use of personal electronic health data for permitted

purposes.

2.6. The harmonised software components of an EHR system shall not include features

that prohibit, restrict or place an undue burden on authorised exporting of personal

electronic health data for the reasons of replacing the EHR system by another

product.

3. Requirements for security and logging.

3.1. An EHR system designed to be used by health professionals shall provide reliable

mechanisms for the identification and authentication of health professionals.

3.2. The European logging software component of an EHR system designed to enable

access by healthcare providers or other individuals to personal electronic health data

shall provide sufficient logging mechanisms that record at least the following

information on every access event or group of events:

(a) identification of the healthcare provider or other individuals having accessed

the personal electronic health data;

PE-CONS 76/24 3

# ANNEX II LIFE.5 EN

(b) identification of the specific natural person or persons having accessed the

personal electronic health data;

(c) the categories of data accessed;

(d) the time and date of access;

(e) the origin or origins of data.

3.3. The harmonised software components of an EHR system shall include tools or

mechanisms to review and analyse the log data, or it shall support the connection and

use of external software for the same purposes.

3.4. The harmonised software components of an EHR system that store personal

electronic health data shall support different retention periods and access rights that

take into account the origins and categories of electronic health data.

PE-CONS 76/24 4

# ANNEX II LIFE.5 EN

**ANNEX III**

Technical documentation

The technical documentation referred to in Article 37 shall contain at least the following

information, as applicable to the harmonised software components of an EHR system in the relevant

EHR system:

1. A detailed description of the EHR system including:

(a) its intended purpose, and the date and version of the EHR system;

(b) the categories of personal electronic health data that the EHR system has been

designed to process;

(c) how the EHR system interacts or can be used to interact with hardware or software

that is not part of the EHR system itself;

(d) the versions of relevant software or firmware and any requirement related to version

update;

(e) the description of all forms in which the EHR system is placed on the market or put

into service;

(f) the description of hardware on which the EHR system is intended to run;

PE-CONS 76/24 1

# ANNEX III LIFE.5 EN

(g) a description of the system architecture explaining how software components build

on or feed into each other and integrate into the overall processing, including, where

appropriate, labelled pictorial representations (e.g. diagrams and drawings), clearly

indicating key parts or software components and including sufficient explanation to

understand the drawings and diagrams;

(h) the technical specifications, such as features, dimensions and performance attributes,

of the EHR system and any variants or configurations and accessories that would

typically appear in the product specification made available to the user, for example

in brochures, catalogues and similar publications, including a detailed description of

the data structures, storage and input/output of data;

(i) a description of any change made to the system throughout its lifecycle;

(j) the instructions for use for the user and, where applicable, installation instructions.

2. A detailed description of the system in place to evaluate the EHR system performance,

where applicable.

3. The references to any common specification used in accordance with Article 36 and in

relation to which conformity is declared.

PE-CONS 76/24 2

# ANNEX III LIFE.5 EN

4. The results and critical analyses of all verifications and validation tests undertaken to

demonstrate conformity of the EHR system with the requirements laid down in Chapter III,

in particular the applicable essential requirements.

5. A copy of the information sheet referred to in Article 38.

6. A copy of the EU declaration of conformity.

PE-CONS 76/24 3

# ANNEX III LIFE.5 EN

**ANNEX IV**

EU declaration of conformity

The EU declaration of conformity for the harmonised software components of an EHR system shall

contain all of the following information:

1. The name of the EHR system, version and any additional unambiguous reference allowing

identification of the EHR system.

2. Name and address of the manufacturer or, where applicable, its authorised representative.

3. A statement that the EU declaration of conformity is issued under the sole responsibility of

the manufacturer.

4. A statement that the EHR system in question is in conformity with the provisions laid

down in Chapter III and, if applicable, with any other relevant Union law that provides for

the issuing of an EU declaration of conformity, complemented by the result from the

testing environment mentioned in Article 40.

5. References to any relevant harmonised standards used and in relation to which conformity

is declared.

6. References to any common specifications used and in relation to which conformity is

declared.

7. Place and date of issue of the declaration, signature plus name and function of the person

who signed and, if applicable, an indication of the person on whose behalf it was signed.

8. Where applicable, additional information.

PE-CONS 76/24 1

# ANNEX IV LIFE.5 EN