Article 91 Health data access applications and health data requests from third countries
1. Without prejudice to Articles 67, 68 and 69, health data access applications and health data requests submitted by a health data applicant established in a third country shall be considered eligible by health data access bodies and the Union health data access service if the third country concerned: (a) is an authorised participant on the basis of having a national contact point for secondary use covered by an implementing act referred to in Article 75(5); or (b) allows Union health data applicants access to electronic health data in that third country under conditions that are not more restrictive than those provided for in this Regulation, and therefore such access is covered by an implementing act referred to in paragraph 2 of this Article. 2. By means of implementing acts, the Commission may determine that a third country meets the requirement set out in paragraph 1, point (b), of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2). The Commission shall make the list of implementing acts adopted pursuant to this paragraph publicly available. 3. The Commission shall monitor developments in third countries and international organisations that could affect the application of the implementing acts adopted pursuant to paragraph 2, and shall provide for a periodic review of the application of this Article. Where the Commission considers that a third country no longer meets the requirement laid down in paragraph 1, point (b), of this Article, it shall adopt an implementing act repealing the implementing act referred to in paragraph 2 of this Article relating to that third country that benefits from access. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 98(2).
Article 92 European Health Data Space Board
1. A European Health Data Space Board (the ‘EHDS Board’) is hereby established to facilitate cooperation and the exchange of information among Member States and the Commission. The EHDS Board shall be composed of two representatives per Member State, namely one representative for primary use purposes and one for secondary use purposes, nominated by each Member State. Each Member State shall have one vote. Members of the EHDS Board shall undertake to act in the public interest and in an independent manner. 2. A representative of the Commission and one of the representatives of the Member States referred to in paragraph 1 shall co-chair the meetings of the EHDS Board. 3. Market surveillance authorities referred to in Article 43, the EDPB and the European Data Protection Supervisor, the European Medicines Agency, the European Centre for Disease Prevention and Control and the European Union Agency for Cybersecurity (ENISA) shall be invited to attend the meetings, where relevant according to the EHDS Board. 4. The EHDS Board may invite national authorities, experts and observers as well as Union institutions, bodies, offices and agencies, in addition to those referred to in paragraph 3, and research infrastructures and other similar infrastructures to attend its meetings. 5. The EHDS Board may cooperate with external experts where appropriate. 6. Depending on the functions related to the use of electronic health data, the EHDS Board may work in subgroups for certain topics, in which digital health authorities or health data access bodies shall be represented. Those subgroups shall support the EHDS Board with specific expertise and may have joint meetings, as required. 7. The EHDS Board shall adopt its rules of procedure and a code of conduct, following a proposal from the Commission. Those rules of procedure shall provide for the composition, organisation, functioning and cooperation of the subgroups referred to in paragraph 6 of this Article and the cooperation of the EHDS Board with the stakeholder forum referred to in Article 93. The EHDS Board shall adopt decisions by consensus as far as possible. If a consensus cannot be reached, the EHDS Board shall adopt decisions by a majority of two-thirds of the Member States. 8. The EHDS Board shall cooperate with other relevant bodies, entities and experts, such as the European Data Innovation Board established by Article 29 of Regulation (EU) 2022/868, competent authorities designated in accordance with Article 37 of Regulation (EU) 2023/2854, supervisory bodies designated in accordance with Article 46b of Regulation (EU) No 910/2014, the EDPB established by Article 68 of Regulation (EU) 2016/679, cybersecurity bodies, including ENISA, and the European Open Science Cloud, with a view to reaching advanced solutions towards findable, accessible, interoperable and reusable (FAIR) data usage in research and innovation. 9. The EHDS Board shall be assisted by a secretariat provided by the Commission. 10. The EHDS Board shall publish its meeting dates and the minutes of its deliberations, and publish an activity report every two years. 11. The Commission shall, by means of implementing acts, adopt the necessary measures for the establishment and operation of the EHDS Board. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
Article 93 Stakeholder forum
1. A stakeholder forum is hereby established for the purpose of facilitating the exchange of information and promoting cooperation among stakeholders in relation to the implementation of this Regulation. 2. The stakeholder forum shall have a balanced composition and be composed of relevant stakeholders, including representatives of patient organisations, health professionals, industry, consumer organisations, scientific researchers and academia, and shall represent their views. Where commercial interests are represented in the stakeholder forum, the representation of such interests shall be based on a balanced combination of large companies, small and medium-sized enterprises and start-ups. The tasks of the stakeholder forum shall encompass equally primary use and secondary use. 3. Members of the stakeholder forum shall be appointed by the Commission following a public call for interest and a transparent selection procedure. Members of the stakeholder forum shall make an annual declaration of interests which shall be made publicly available and updated, when relevant. 4. The stakeholder forum may establish standing or temporary subgroups, as appropriate, for the purpose of examining specific questions related to the objectives of this Regulation. The stakeholder forum shall adopt its rules of procedure. 5. The stakeholder forum shall hold regular meetings, which shall be chaired by a Commission representative. 6. The stakeholder forum shall prepare an annual report of its activities. That report shall be made publicly available.
Article 94 Tasks of the EHDS Board
1. The EHDS Board shall have the following tasks relating to primary use in accordance with Chapters II and III: (a) assisting Member States in coordinating practices of digital health authorities; (b) issuing written contributions and exchanging best practices on matters related to the coordination of the implementation at Member State level, taking into account the regional and local level, of this Regulation and of the delegated and implementing acts adopted pursuant to it, in particular as regards: (i) the provisions set out in Chapters II and III; (ii) the development of online services facilitating secure access, including secure electronic identification, to electronic health data for health professionals and natural persons; (iii) other aspects relating to primary use; (c) facilitating cooperation between digital health authorities through capacity building, establishing the framework for activity-reporting referred to in Article 20 and the exchange of information; (d) sharing among its members information concerning risks posed by EHR systems and serious incidents as well as the handling of such risks and incidents; (e) facilitating the exchange of views on primary use with the stakeholder forum referred to in Article 93, as well as with regulators and policy-makers in the health sector. 2. The EHDS Board shall have the following tasks related to secondary use in accordance with Chapter IV: (a) assisting Member States in coordinating practices of health data access bodies in the implementation of provisions set out in Chapter IV, to ensure a consistent application of this Regulation; (b) issuing written contributions and exchanging best practices on matters related to the coordination of the implementation at Member State level of this Regulation and of the delegated and implementing acts adopted pursuant to it, in particular as regards: (i) implementation of rules for access to electronic health data; (ii) technical specifications or existing standards regarding the requirements set out in Chapter IV; (iii) incentives for promoting data quality and interoperability improvement; (iv) policies concerning fees to be charged by the health data access bodies and health data holders; (v) measures to protect the personal data of health professionals involved in the treatment of natural persons; (vi) other aspects of secondary use; (c) creating, in consultation and cooperation with relevant stakeholders, including representatives of patients, health professionals and researchers, guidelines in order to help health data users to fulfil their duties under Article 61(5), and in particular to determine whether their findings are clinically significant; (d) facilitating cooperation between health data access bodies through capacity building, establishing the framework for activity-reporting referred to in Article 59(1), and the exchange of information; (e) sharing information concerning risks and incidents related to secondary use, as well as the handling of such risks and incidents; (f) facilitating the exchange of views on secondary use with the stakeholder forum referred to in Article 93, as well as with health data holders, health data users, regulators and policy-makers in the health sector.
Article 95 Steering groups for MyHealth@EU and HealthData@EU
1. The MyHealth@EU steering group and the HealthData@EU steering group (the ‘steering groups’) are hereby established for the cross-border infrastructures provided for in Articles 23 and 75. Each steering group shall be composed of one representative per Member State appointed from the relevant national contact points. 2. The steering groups shall take operational decisions concerning the development and operation of MyHealth@EU and HealthData@EU. 3. The steering groups shall take decisions by consensus. Where a consensus cannot be reached, a decision shall be adopted by two-thirds of the members. For the adoption of the decisions, each Member State shall have one vote. 4. The steering groups shall adopt rules of procedure, setting out their composition, organisation, functioning and cooperation. 5. Other authorised participants may be invited to exchange information and views on relevant matters related to MyHealth@EU and HealthData@EU. Where those authorised participants are invited, they shall have an observer role. 6. Stakeholders and relevant third parties, including representatives of patients, health professionals, consumers and industry, may be invited to attend the meetings of the steering groups as observers. 7. The steering groups shall elect chairs for their meetings. 8. The steering groups shall be assisted by a secretariat provided by the Commission.
Article 96 Roles and responsibilities of the Commission regarding the functioning of the EHDS
1. In addition to its role in making available electronic health data held by Union institutions, bodies, offices or agencies, in accordance with Article 55, Article 56 and Article 75(2), and its tasks under Chapter III, in particular Article 40, the Commission shall develop, maintain, host and operate the infrastructures and central services required to support the functioning of the EHDS, for all relevant connected entities, by means of: (a) an interoperable, cross-border identification and authentication mechanism for natural persons and health professionals, in accordance with Article 16(3) and (4); (b) the central services and infrastructures for digital health of MyHealth@EU, in accordance with Article 23(1); (c) compliance checks for connecting authorised participants to MyHealth@EU, in accordance with Article 23(9); (d) the supplementary cross-border digital health services and infrastructures referred to in Article 24(1); (e) as part of HealthData@EU, a service to submit health data access applications seeking access to electronic health data held by health data holders in more than one Member State or by other authorised participants in HealthData@EU and to automatically forward the health data access applications to the relevant contact points, in accordance with Article 67(3); (f) the central services and infrastructures of HealthData@EU, in accordance with Article 75(7) and (8); (g) a secure processing environment, in accordance with Article 75(9), in which health data access bodies can decide to make data available, in accordance with Article 68(8); (h) compliance checks for connecting authorised participants to HealthData@EU, in accordance with Article 75(5); (i) a federated EU dataset catalogue connecting the national dataset catalogues, in accordance with Article 79; (j) a secretariat for the EHDS Board, in accordance with Article 92(9); (k) a secretariat for the steering groups, in accordance with Article 95(8). 2. The services referred to in paragraph 1 of this Article shall meet sufficient quality standards in terms of availability, security, capacity, interoperability, maintenance, monitoring and development to ensure the EHDS functions effectively. The Commission shall provide those services in accordance with the operational decisions of the relevant steering groups established in Article 95. 3. The Commission shall prepare a report on the infrastructures and services supporting the EHDS that it provides in accordance with paragraph 1 every two years and make it publicly available.
Article 97 Exercise of the delegation
1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Article 14(2), Article 49(4) and Article 78(5) shall be conferred on the Commission for an indeterminate period of time from 25 March 2025. 3. The power to adopt delegated acts referred to in Article 14(2), Article 49(4) and Article 78(5) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. A delegated act adopted pursuant to Article 14(2), Article 49(4) or Article 78(5) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of three months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.
Article 98 Committee procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.
Article 99 Penalties
Member States shall lay down the rules on penalties applicable to infringements of this Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64, and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, by 26 March 2027, notify the Commission of those rules and of those measures and shall notify it, without delay, of any subsequent amendment affecting them. Member States shall take into account the following non-exhaustive and indicative criteria for the imposition of penalties for infringements of this Regulation, where appropriate: (a) the nature, gravity, scale and duration of the infringement; (b) any action taken by the infringer to mitigate or remedy the damage caused by the infringement; (c) any previous infringements by the infringer; (d) the financial benefits gained or losses avoided by the infringer due to the infringement, insofar as such benefits or losses can be reliably established; (e) any other aggravating or mitigating factors applicable to the circumstances of the case; (f) the infringer’s annual turnover in the Union in the preceding financial year.
Article 100 Right to receive compensation
Any natural or legal person that has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation in accordance with Union and national law.
Article 101 Representation of a natural person
Where a natural person considers that his or her rights under this Regulation have been infringed, he or she shall have the right to mandate a not-for-profit body, organisation or association, constituted in accordance with national law, having statutory public interest objectives and active in the field of the protection of personal data, to lodge a complaint on his or her behalf or to exercise the rights referred to in Articles 21 and 81.
Article 102 Evaluation, review and progress report
1. By 26 March 2033, the Commission shall carry out a targeted evaluation of this Regulation, and submit a report on its main findings to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. That evaluation shall cover the following: (a) the possibilities of further extending interoperability between EHR systems and electronic health data access services other than those established by the Member States; (b) the need to update the data categories referred to in Article 51 and the purposes listed in Article 53(1); (c) the implementation and use by natural persons of the mechanisms to opt out from secondary use referred to in Article 71, in particular on the impact of those mechanisms on public health, scientific research and fundamental rights; (d) the use and implementation of any stricter measures introduced pursuant to Article 51(4); (e) the exercise and implementation of the right referred to in Article 8; (f) an assessment of the certification framework for EHR systems established in Chapter III and the need to introduce further tools regarding conformity assessment; (g) an assessment of the functioning of the internal market for EHR systems; (h) an assessment of the costs and benefits of the implementation of the provisions for secondary use laid down in Chapter IV; (i) the application of fees as referred to in Article 62. 2. By 26 March 2035, the Commission shall carry out an overall evaluation of this Regulation, and submit a report on its main findings to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment or other appropriate measures. That evaluation shall include an assessment of the efficiency and functioning of the systems providing for access to electronic health data for further processing, carried out on the basis of Union or national law referred to in Article 1(7), with regard to their impact on the implementation of this Regulation. 3. Member States shall provide the Commission with the information necessary for the preparation of the reports referred to in paragraphs 1 and 2 and the Commission shall take that information duly into account in those reports. 4. Every year following 25 March 2025 until the end of the year in which all provisions of this Regulation apply as provided for in Article 105, the Commission shall submit a progress report to the Council on the preparations for the full implementation of this Regulation. That progress report shall contain information about the degree of progress and the readiness of the Member States in relation to the implementation of this Regulation, including an assessment of the feasibility of reaching the timeframes laid down in Article 105, and may also contain recommendations for Member States to improve preparedness for the application of this Regulation.
Article 103 Amendment to Directive 2011/24/EU
Article 14 of Directive 2011/24/EU is deleted with effect from 26 March 2031.
Article 104 Amendment to Regulation (EU) 2024/2847
Regulation (EU) 2024/2847 is amended as follows: (3) in Article 32, the following paragraph is inserted: ‘5a. Manufacturers of products with digital elements that are classified as EHR systems under Regulation (EU) 2025/327 of the European Parliament and of the Council ( *1 ) shall demonstrate conformity with the essential requirements set out in Annex I to this Regulation using the relevant conformity assessment procedure provided for in Chapter III of Regulation (EU) 2025/327. ( *1 ) Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 ( OJ L, 2025/327, 5.3.2025, ELI: http://data.europa.eu/eli/reg/2025/327/oj ).’."
Article 105 Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . This Regulation shall apply from 26 March 2027. However, Articles 3 to 15, Article 23(2) to (6), Articles 25, 26, 27, 47, 48 and 49 shall apply as follows: (a) from 26 March 2029 to priority categories of personal electronic health data referred to in Article 14(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data; (b) from 26 March 2031 to priority categories of personal electronic health data referred to in Article 14(1), points (d), (e) and (f), and to EHR systems intended by the manufacturer to process such categories of data; (c) from one year from the date established in a delegated act to be adopted pursuant to Article 14(2) for each amendment of the main characteristics of personal electronic health data set out in Annex I, provided that that date is subsequent to the date of application referred to in points (a) and (b) of this subparagraph for the categories of personal electronic health data concerned.