Sittings · Compare

What changed

From · opinion parliamentary committee draft · 2023-02-08 IMCO-PA-740773 on the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space

→

To · opinion parliamentary committee draft · 2023-02-14 ITRE-PA-742310 on the proposal for a regulation of the European Parliament and of the Council on European Health Data Space

+231 added · −80 removed · 29 modified paragraphs hide unchanged text

SHORT JUSTIFICATION

This opinion focuses on the second pillar, Chapter III, which aims to implement a mandatory self-certification scheme for EHR systems, while complying with essential requirements on interoperability and security.

The Rapporteur supports many elements of the European Health Data Space (EHDS) initiative, especially the provisions aimed at providing better health outcomes and promoting health innovation and research. The Rapporteur believes that the availability of cross-border health data can significantly improve patient care and contribute to more effective health policies at a European level. The Rapporteur also believes that this proposal can lead to significant benefits for individuals, patients, healthcare professionals, and society as a whole. Additionally, the Rapporteur supports this proposal as it can boost research and innovation, support the development of new drugs, devices, and treatments, and increase the efficiency and sustainability of healthcare systems.

As Rapporteur for the IMCO Committee, I streamline the monitoring of the internal market. My draft opinion focuses on clarifying the definitions related to EHR, EHR systems, as well as introducing some new definition to allow for clear interpretation of the conditions set out in Chapter III of the proposal. Additionally, I propose to specify clearly the way in which the Commission will be creating the standards to apply to EHR systems through a clear reference to the use of international and harmonised standards, as well as the participation of all relevant stakeholders in this process.

However, the Rapporteur is of the opinion that some changes are necessary to ensure the success of the initiative. The Rapporteur believes that a prudent implementation of the GDPR is necessary to avoid unnecessary restrictions for health research and data sharing, key to apply artificial intelligence and machine learning tools to research, and to enabling the digital transformation of healthcare, to tackle disparities in prevention, diagnosis, and treatment around Europe. The EHDS will be a critical tool in managing and sharing health data across the European Union, but it must do so in a way that respects the privacy and rights of patients. As contact person for the EMA, the Rapporteur understands that the EMA and other regulatory authorities, such as national medicines’ agencies need to be seen and treated differently from all other data users in EHDS. The legal proposal already foresees this by recognizing regulatory authorities’ needs, and the Rapporteur further strengthens the text by allowing better informed regulatory decision making on benefits and risks of medicinal products, robust and speed up regulatory assessment of new medicinal products with the goal of making them faster available to patients and enhanced tools and processes available to monitor safety and effectiveness of medicines to the benefit of EU patients. Furthermore, the Rapporteur thinks that in order for health data to be useful across different systems, it is essential that we establish interoperable and common rules and standards. This means that data should be able to be exchanged seamlessly between different health systems, regardless of the platform or software used. Therefore, the Rapporteur opinion also underline that the lack of standardization in health data is a major obstacle to interoperability.

My amendments further aim to define clearly the interplay between the EHDS and other sectoral legislation, especially for scenarios where devices would fall within the scope of more than one of these legislative acts.

Finally, the Rapporteur is of the opinion that EHDS should build upon the already existing legislation such as the Data Governance Act and Data Act. These acts provide a solid foundation for the governance and management of health data, and we should work to align our efforts with their provisions. By doing so, the Rapporteur wants to ensure that the collection, processing, and use of health data is conducted in a responsible and transparent manner, while also protecting the privacy and security of individuals.

An important addition is the requirement for the Commission and Member States to set explicit time-based targets for implementation and progress on cross-border health data interoperability and the relevant infrastructure.

This draft opinion aims to improve EHR systems by clarifying relevant definitions, ensuring that the Commission uses harmonised standards as the basis for setting EU-wide standards on security and interoperability for EHR systems, as well as reconciling the scope of the European Health Data Space with other sectoral legislation, such as the Medical Devices Regulation, the In-vitro Medical Device Regulation and the upcoming AI Act, and Data Act. By providing these clarifications, the proposed amendments intend to make the Commission’s proposal clearer and more predictable for stakeholders as well as clearly ensure the EU remains well connected globally and does not impose standards, which are not interoperable with global partners.

AMENDMENTS

The Committee on ~~the Internal~~Industry, ~~Market~~Research and ~~Consumer Protection~~Energy calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take into account the following amendments:

Amendment 1

Proposal for a regulation

Recital 164

Text proposed by the Commission

Amendment

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

(4) The processing of personal electronic health data is subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council43 and, for Union institutions and bodies, Regulation (EU) 2018/1725 of the European Parliament and of the Council44 . References to the provisions of Regulation (EU) 2016/679 should be understood also as references to the corresponding provisions of Regulation (EU) 2018/1725 for Union institutions and bodies, where relevant.

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the Commission and Member States should agree on time-based targets to implement improved health data interoperability across the Union. The access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

__________________

43 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

44 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Or. en

Proposal for a regulation

Recital 1917

Text proposed by the Commission

Amendment

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. In order to make electronic health data accesible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data.

(17) The relevance of different categories of electronic health data for different healthcare scenarios varies. Different categories have also achieved different levels of maturity in standardisation, and therefore the implementation of mechanisms for their exchange may be more or less complex depending on the category. Therefore, the improvement of interoperability and data sharing should be gradual and prioritisation of categories of electronic health data is needed. Categories of electronic health data such as patient summary, electronic prescription and dispensation, laboratory results and reports, hospital discharge reports, medical images and reports have been selected by the eHealth Network as most relevant for the majority of healthcare situations and should be considered as priority categories for Member States to implement access to them and their transmission. When further needs for the exchange of more categories of electronic health data are identified for healthcare purposes, the list of priority categories should be expanded. The Commission should be empowered to extend the list of priority categories, after analysing relevant aspects related to the necessity and possibility for the exchange of new datasets, such as their support by systems established nationally or regionally by the Member States. Particular attention should be given to the data exchange in border regions of neighbouring Member States where the provision of cross-border health services is more frequent and needs even quicker procedures than across the Union in general.

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. In order to make electronic health data accessible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data. Moreover, an agreement on time-based EU level targets for implementation of health data interoperability, should be reached. In order to support the successful implementation of the EHDS and the execution of an effective landscape of European health data cooperation, the Commission shall agree with Member States a range of targets for health data interoperability milestones.

(17) The relevance of different categories of electronic health data for different healthcare scenarios varies. Different categories have also achieved different levels of maturity in standardisation, and therefore the implementation of mechanisms for their exchange may be more or less complex depending on the category. Specifications should be commonly agreed and aligned with activities for furthering the maturity of global standardisation and harmonisation and existing standards that address different data domains. Therefore, the improvement of interoperability and data sharing should be gradual and prioritisation of categories of electronic health data is needed. Categories of electronic health data such as patient summary, electronic prescription and dispensation, laboratory results and reports, hospital discharge reports, medical images and reports have been selected by the eHealth Network as most relevant for the majority of healthcare situations and should be considered as priority categories for Member States to implement access to them and their transmission. When further needs for the exchange of more categories of electronic health data are identified for healthcare purposes, the list of priority categories should be expanded. The Commission should be empowered to extend the list of priority categories, after analysing relevant aspects related to the necessity and possibility for the exchange of new datasets, such as their support by systems established nationally or regionally by the Member States. Particular attention should be given to the data exchange in border regions of neighbouring Member States where the provision of cross-border health services is more frequent and needs even quicker procedures than across the Union in general.

~~__________________~~

~~45 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, p. 18).~~

~~46 Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).~~

Or. en

Proposal for a regulation

~~Recital 25~~

Recital 22 a (new)

Text proposed by the Commission

Amendment

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor.

(22 a) This Regulation contributes to reducing inequalities in quality healthcare access across Europe. There should be no first and second-class citizens in Europe. Therefore, barriers to reimbursement for telemedicine and other barriers should be removed.

Or. en

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(29) Software or module(s) of software which ~~fall~~falls within the definition of ~~an EHR system as well as the definition of~~ a medical device or high-risk artificial intelligence (AI) system should ~~only~~ be ~~required~~certified toin ~~comply~~accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. These types of software should exclusively follow the relevant conformity assessment in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council 49 and Regulation […]system, ofwithin the ~~European Parliament and~~meaning of the ~~Council [AI Act COM/2021/206 final], as~~EHDS ~~applicable.~~Regulation. In such case, ~~only~~ the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

__________________

Proposal for a regulation

~~Recital 72 a (new)~~

Recital 63

Text proposed by the Commission

Amendment

(72a) In order to mitigate risks of delay in implementation, the Commission and Member States should agree on a range of time-based targets for EHDS, including in respect to health data interoperability.

(63) The use of funds should also contribute to attaining the objectives of the EHDS. Public procurers, national competent authorities in the Member States, including digital health authorities and health data access bodies, as well as the Commission should make references to applicable technical specifications, standards and profiles on interoperability, security and data quality, as well as other requirements developed under this Regulation when defining the conditions for public procurement, calls for proposals and allocation of Union funds, including structural and cohesion funds. EU funds must be distributed adequately among the Member States taking into account different levels of health system digitalisation and the costs involved in making national data infrastructures interoperable and compatible with the requirements of the EHDS.

Or. en

Proposal for a regulation

Article 21 – paragraph 1 ~~– point d a (new)~~

Text proposed by the Commission

Amendment

~~(da) the definition of ‘professional user’ pursuant to Article 3 point (8) of Regulation (EU) 2018/1807;~~

1. This Regulation establishes the European Health Data Space (‘EHDS’) by providing for rules, common standards and practices, infrastructures and a governance framework for the primary and secondary use of electronic health data.

1. This Regulation establishes the European Health Data Space (‘EHDS’) by providing for common and harmonized rules, standards and practices, interoperable infrastructures and a governance framework for the primary and secondary use of electronic health data.

Or. en

Proposal for a regulation

Article 21 – paragraph 13 – point eb

Text proposed by the Commission

Amendment

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 (1), (12), (14), (22), (36) and (71) of the Regulation (EU) 2017/745;

(b) controllers and processors established in the Union processing electronic health data of Union citizens and third-country nationals legally residing in the territories of Member States;

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘putting into service’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 points (1), (12), (14), (22), (29), (36) and (71) of Regulation (EU) 2017/745;

(b) controllers and processors established in the Union processing personal electronic health data of Union citizens and third-country nationals legally residing in the territories of Member States;

Or. en

Justification

Alignment with GDPR provisions and Recital 5 of the current proposal.

Amendment 8

Proposal for a regulation

Article 21 – paragraph 23 – point ib a (new)

Text proposed by the Commission

Amendment

(ia) ‘economic operator’ means the manufacturer, the authorised representative, the importer, the distributor, the fulfilment service provider or any other natural or legal person who is subject to obligations in relation to the manufacture of EHR systems, making them available on the market, putting them into service or maintaining them in accordance with the relevant Union harmonisation legislation;

(b a) health data holders and data holders as defined in this regulation when the relevant provisions concern non-personal electronic health data.

Or. en

Proposal for a regulation

Article 21 – paragraph 23 – point md

Text proposed by the Commission

Amendment

~~(m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for healthcare purposes;~~

(d) data users to whom electronic health data are made available by data holders in the Union.

(m) ‘EHR’ (electronic health record) means a comprehensive medical record or similar documentation of the past and present physical and mental state of health of a natural person in electronic form, collected in the health system, providing for ready availability of these data for medical treatment and other closely related purposes;

(d) data recipients and data users to whom electronic health data are made available by data holders in the Union.

Or. en

Proposal for a regulation

Article 21 – paragraph ~~2 –~~4 ~~point~~a n(new)

Text proposed by the Commission

Amendment

(n) ‘EHR system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

4 a. This regulation shall be without prejudice to the Directive on the Protection of Trade Secrets (Directive (EU) 2016/943) which shall take precedence.

(n) ‘EHR system’ (electronic health record system) means any product (hardware or software) primarily intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records, whose main purpose is to facilitate sharing patient information with authorised providers, healthcare professionals, or patients and to a data flow between healthcare facilities;

Or. en

Proposal for a regulation

Article 2 – paragraph 2 – point ~~n a (new)~~b

Text proposed by the Commission

Amendment

~~(na) ‘general software’ means any software whose main intended purpose is other than the intended purpose of EHR systems;~~

(b) ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

(b) ‘non-personal electronic health data’ means on a case by case, anonymised or pseudonymised data concerning health and genetic data relevant for health research in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

Or. en

Proposal for a regulation

Article 122 – paragraph 42 – point d

Text proposed by the Commission

Amendment

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

(d) ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess, maintain or restore the state of health of the natural person to whom that data relates, including the prescription, dispensation and provision of medicinal products and medical devices, as well as for relevant social security, administrative or reimbursement services;

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those measures shall also include target implementation dates, including for improved cross border health data interoperability. The Commission shall consult the EHDS Board when preparing the implementing acts. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

(d) ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess, maintain or restore the state of health of the natural person to whom that data relates, including the prescription, dispensation and provision of medicinal products and medical devices, as well as related services aimed at promoting their safe and rational use and at ensuring better treatment, as well as for relevant social security, administrative or reimbursement services;

Or. en

Proposal for a regulation

Article 142 – paragraph 2 a– ~~(new)~~point e

Text proposed by the Commission

Amendment

2a. Manufacturers of EHR systems that also qualify as medical devices as defined in Article 2 point (1) of Regulation (EU) 2017/745 and claim interoperability of those medical devices with EHR systems under this Regulation shall prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II to this Regulation. Article 23 of this Regulation shall be applicable to those medical devices.

(e) ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in Chapter IV of this Regulation. The data used may include personal electronic health data initially collected in the context of primary use, but also electronic health data collected for the purpose of the secondary use;

(e) ‘secondary use of electronic health data’ means the compatible further processing of electronic health data for purposes set out in Chapter IV of this Regulation, and where such electronic health data is personal data, in accordance with Article 5(1)(b) of Regulation (EU) 2016/679 . The data used may include personal electronic health data initially collected in the context of primary use, but also electronic health data collected for the purpose of the secondary use;

Or. en

Justification

The definition of "secondary use of electronic health data" needs to be clarified to exclude the processing of electronic health data otherwise than for the purposes of Chapter IV and by ensuring compatibility with secondary use as described in GDPR.

Amendment 14

Proposal for a regulation

Article 152 – paragraph 12 – point f

Text proposed by the Commission

Amendment

~~1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in this Chapter.~~

(f) ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals, involving the exchange of information and knowledge without changing the content of the data between these organisations, software applications or devices, through the processes they support;

~~1. EHR systems may be placed on the market or put into service only if they comply with Article 23 and the requirements laid down in Annex II.~~

(f) ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact, connect and communicate in a compatible and coordinated manner, allowing the exchange of information and knowledge without changing the content of the data between these organisations, software applications or devices, through the processes they support, and without effort from the end user;

Or. en

Proposal for a regulation

Article 162 – paragraph 12 – ~~introductory~~point ~~part~~g

Text proposed by the Commission

Amendment

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user with regard to its intended purpose, interoperability and security by:

(g) ‘European electronic health record exchange format’ means a structured, commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications, devices and healthcare providers;

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the professional user with regard to its intended purpose, interoperability and security by:

(g) ‘European electronic health record exchange format’ means a structured, standardized, commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications, devices and healthcare providers;

Or. en

Proposal for a regulation

Article 162 – paragraph 12 – point bk

Text proposed by the Commission

Amendment

~~(b) failing to inform the user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;~~

(k) ‘data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data;

~~(b) failing to inform the professional user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;~~

(k) ‘health data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data;

Or. en

Justification

This amendment should apply across the whole text.

Amendment 17

Proposal for a regulation

Article 172 – paragraph 32 – point y

Text proposed by the Commission

Amendment

(y) ‘data holder’ means any natural or legal person, which is an entity or a body in the health or care sector, or performing research in relation to these sectors, as well as Union institutions, bodies, offices and agencies who has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation implementing Union law, or in the case of non-personal data, through control of the technical design of a product and related services, the ability to make available, including to register, provide, restrict access or exchange certain data;

3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity for 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market and ensure that the technical documentation and the declaration of conformity are made available to the market surveillance authorities upon request.

(y) ‘health data holder’ means any natural or legal person, which is an entity or a body in the health or care sector, or performing research in relation to these sectors, as well as Union agencies who has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation implementing Union law, or in the case of non-personal data and through both control of the technical design of a product and related services, and as allowed by the natural or legal person owning, renting or leasing the product or related services, and:

- acts as a controller under the GDPR regarding the processing of personal electronic health data for primary use, and/or

- has an obligation under the Regulation, other Union law or national legislation implementing Union law to make electronic health data available for secondary use, and/or

- in the case of non-personal electronic health data, controls and has the ability to make data generated by a medical device, authorized wellness application, EHR system or related services available

Or. en

Justification

The addition of health to 'data holder' should apply across the whole text

Amendment 18

Proposal for a regulation

Article 212 – ~~title~~paragraph 2 – point z

Text proposed by the Commission

Amendment

~~Cases in which obligations of manufacturers of an EHR system apply to importers and distributors~~

(z) ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use;

~~Cases in which obligations of manufacturers of an EHR system apply to importers, distributors and other economic operators~~

(z) ‘health data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use;

Or. en

Justification

The amendment should apply across the whole text.

Amendment 19

Proposal for a regulation

Article 2110 – paragraph 12 – point g

Text proposed by the Commission

Amendment

An importer or distributor shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

(g) ensure the implementation, at national level, of the European electronic health record exchange format, in cooperation with national authorities and stakeholders;

An importer, distributor or another economic operator who makes modifications to the EHR system while deploying or using it, which lead to changes in the intended purpose and deployments recommendations for the EHR system as declared by the manufacturer, shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

(g) ensure the implementation, at national level, of the European electronic health record exchange format to be interoperable, inter alia cross-border, in cooperation with national authorities and stakeholders;

Or. en

Proposal for a regulation

Article 2110 – paragraph 12 a– ~~(new)~~point h

Text proposed by the Commission

Amendment

In the event of any malfunctioning or deterioration in performance quality due to the changes made by economic operators during deployment or use of the EHR system contrary to the manufacturers' recommendations for technical deployment of the system or purpose of its use, the economic operator shall bear full responsibility for those modifications.

(h) contribute, at Union level, to the development of the European electronic health record exchange format and to the elaboration of common specifications addressing interoperability, security, safety or fundamental right concerns in accordance with Article 23 and of the specifications of the EU database for EHR systems and wellness applications referred to in Article 32;

(h) contribute, at Union level, to the development of the European electronic health record exchange format and to the elaboration of common specifications addressing interoperability, inter alia cross-border, security, safety or fundamental right concerns in accordance with Article 23 and of the specifications of the EU database for EHR systems and wellness applications referred to in Article 32;

Or. en

Proposal for a regulation

Article 2310 – paragraph 12 – ~~subparagraph~~point 1k

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

(k) offer, in compliance with national legislation, telemedicine services and ensure that such services are easy to use, accessible to different groups of natural persons and health professionals, including natural persons with disabilities, do not discriminate and offer the possibility of choosing between in person and digital services;

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Those common specifications shall be based on existing harmonised standards or international standards and shall be adopted only after consulting the European standardisation organisations as well as the relevant stakeholders. Where relevant, the common specifications shall take into account the specificities and verify compatibility with sectorial legislation and harmonised standards of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14, including the state-of-the-art standards for health informatics and the European electronic health record exchange format.

(k) offer, in compliance with national legislation, telemedicine services, joint telemedicine solutions, and ensure that such services are available as provided for in Directive 2011/24/EC, and are easy to use, accessible to different groups of natural persons and health professionals, including natural persons with disabilities, do not discriminate and offer the possibility of choosing between in person and digital services;

Or. en

Proposal for a regulation

Article 2923 – paragraph 31 – subparagraph 1

Text proposed by the Commission

Amendment

3. The market surveillance authority shall immediately inform the Commission and the market surveillance authorities of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the existing standardisation and harmonisation of different data domains and the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

Or. en

Proposal for a regulation

Article 3123 – paragraph 65

Text proposed by the Commission

Amendment

~~6. If the wellness application is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label.~~

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications may be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

6. If the wellness application is an integral part of a device or is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label. If the wellness application is embedded in a device after its putting into service, the wellness application label may be shown in the application itself.

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications shall be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

Or. en

Proposal for a regulation

Article 3133 – paragraph 91 – introductory part

Text proposed by the Commission

Amendment

~~9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form or, upon request, in physical form.~~

1. Data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this Chapter:

~~9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.~~

1. Data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this Chapter, with the right to refuse access to their data for reasons set out in paragraph 1a new:

Or. en

Proposal for a regulation

Article 6533 – paragraph 1 – point ~~e a (new)~~d

Text proposed by the Commission

Amendment

~~(ea) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the primary use of electronic health data;~~

(d) health-related administrative data, including claims and reimbursement data;

(d) healthcare-related administrative data, including claims and reimbursement data;

Or. en

Proposal for a regulation

Article 6533 – paragraph 1 – point ed ba (new)

Text proposed by the Commission

Amendment

~~(eb) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the secondary use of electronic health data.~~

(d a) dispensing and prescribing data;

Or. en

Proposal for a regulation

Article 6933 – paragraph 1 a– ~~(new)~~point g

Text proposed by the Commission

Amendment

Penalties shall cover infringements not addressed by Regulations (EU) 2017/745, (EU) 2022/112, and (EU) 2016/679, and shall depend on the circumstances of each individual case. When deciding whether to impose a penalty and deciding on the amount of the penalty in each individual case due regard shall be given to the following:

(g) identification data related to health professionals involved in the treatment of a natural person;

~~(a) the nature, gravity and duration of the infringement taking into account the nature scope and level of the damage done;~~

(g) identification data related to health professionals involved in research should be limited to data which is absolutely necessary;

~~(b) the intentional or negligent character of the infringement;~~

~~(c) any action taken by the EHR system provider, deployer or data holder to mitigate the damage of the infringement;~~

~~(d) the degree of responsibility by the infringing party taking into account technical and organisational measures implemented to prevent the infringement;~~

~~(e) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;~~

~~(f) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement;~~

Or. en

Proposal for a regulation

Article 6933 – paragraph 1 b– ~~(new)~~point j

Text proposed by the Commission

Amendment

If the EHR system provider or data holder intentionally or negligently, for the same or linked operations, infringes several provisions of this Regulation, the total amount of the penalty shall not exceed the amount specified for the gravest infringement.

(j) electronic health data from clinical trials;

(j) electronic health data from fully completed clinical trials and in accordance with Regulation (EU) No 536/2014;

Or. en

Justification

There is already an existing mechanism for the disclosure of data as already required in Clinical Trial Regulation and EHSD should comply with.

Amendment 29

Proposal for a regulation

Article 6933 – paragraph 1 c– ~~(new)~~point l

Text proposed by the Commission

Amendment

The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including effective judicial remedy and due process.

(l) research cohorts, questionnaires and surveys related to health;

(l) data from research cohorts, questionnaires and surveys related to health;

Or. en

Proposal for a regulation

Article 6933 – paragraph 1 da (new)

Text proposed by the Commission

Amendment

Where the legal system of the Member State does not provide for penalties, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the penalties imposed by supervisory authorities.

1 a. Health data holders have the right to refuse access to their data if there are legal or contractual impediments that prevent the data holder from sharing; if it could compromise the scientific integrity of a scientific research study, including a clinical trial; or if it could compromise the protection of data entailing IP rights (including trade secrets) or commercial property, with the scope of each category of data to be further clarified.

Or. en

~~ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT~~

Amendment 31

The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:

Proposal for a regulation

~~Entity and/or person~~

Article 33 – paragraph 2

~~DIGITALEUROPE~~

Text proposed by the Commission

~~COCIR~~

Amendment

~~EDPB~~

2. The requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC59 .

~~EDPS~~

2. The requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC59 and to health data holders that qualify as small enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC.

~~BEUC~~

__________________

~~Medtech Europe~~

__________________

~~Roche~~

59 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

~~AmCham~~

59 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

~~European Cancer Organisation~~

Or. en

~~EURORDIS~~

Amendment 32

~~France Digitale~~

Proposal for a regulation

~~EFPIA~~

Article 33 – paragraph 4

Text proposed by the Commission

Amendment

4. Electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

4. Without prejudice to the law relating to the protection of intellectual property, industrial property and commercial property rights, electronic health data entailing protected intellectual property rights from private enterprises shall be made available for secondary use. Data sharing should be based on a data sharing agreement that respects the provisions of Union legislation, in particular of Directive on the Protection of Trade Secrets (Directive (EU) 2016/943, Article 6(2)(e) of the Data Act, Article 39 of TRIPS, and of Articles 9, 11 and 13 Directive 2004/48 on the enforcement of intellectual property rights in relation to preliminary injunctions, injunctions and damages. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

Or. en

Amendment 33

Proposal for a regulation

Article 33 – paragraph 8 a (new)

Text proposed by the Commission

Amendment

8 a. Clinical trial data sharing under the EHDS shall be without prejudice to existing sectoral legislation, such as Clinical Trials Regulation and IP rights.

Or. en

Amendment 34

Proposal for a regulation

Article 34 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) activities for reasons of public interest in the area of public and occupational health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality, safety and efficacy of healthcare and of medicinal products or medical devices, for the purpose of the evaluation of the benefits and risks of medicinal products the EMA and ECDC shall be granted rapid and unrestricted access to the health data within the EHDS;

Or. en

Amendment 35

Proposal for a regulation

Article 35 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) advertising or marketing activities towards health professionals, organisations in health or natural persons, with the exception of communication in line with approved regulatory information or to provide up-to date, verifiable and complete scientific information to health care professionals for educational purpose in line with Directive 2001/83/EC;

Or. en

Amendment 36

Proposal for a regulation

Article 36 – paragraph 1

Text proposed by the Commission

Amendment

1. Member States shall designate one or more health data access bodies responsible for granting access to electronic health data for secondary use. Member States may either establish one or more new public sector bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions set out in this Article. Where a Member State designates several health data access bodies, it shall designate one health data access body to act as coordinator, with responsibility for coordinating requests with the other health data access bodies.

1. Member States shall designate one or more health data access bodies responsible for fullfilling the tasks set out in Article 37, 38 and 39. Member States may either establish one or more new public sector bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions set out in this Article. Where a Member State designates several health data access bodies, it shall designate one health data access body to act as coordinator, with responsibility for coordinating requests to access to electronic health data with the other health data access bodies.

Or. en

Amendment 37

Proposal for a regulation

Article 39 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Each health data access body shall publish an annual activity report which shall contain at least the following:

1. Each health data access body shall publish an biennial activity report which shall include summary data only containing the following:

Or. en

Amendment 38

Proposal for a regulation

Article 39 – paragraph 1 – point n a (new)

Text proposed by the Commission

Amendment

(n a) Restricted information on patent rights which could appear as part of a disclosure of a “summary of the results of the electronic health data uses”, aligned closely with the existing transparency requirements under the Clinical Trials Regulation and the Appendix.

Or. en

Amendment 39

Proposal for a regulation

Article 39 – paragraph 1 – point n b (new)

Text proposed by the Commission

Amendment

(n b) Information from health data holders only after prior consultation on any results or output of the secondary use being made publicly available to allow for vetting for any unauthorised disclosure related to the IP rights, trade secrets and confidential information of data holders.

Or. en

Amendment 40

Proposal for a regulation

Article 39 – paragraph 1 – point n c (new)

Text proposed by the Commission

Amendment

(n c) Information on clinical trials should be restricted based on the rules applicable to current disclosures and notifications.

Or. en

Amendment 41

Proposal for a regulation

Article 39 – paragraph 2

Text proposed by the Commission

Amendment

2. The report shall be transmitted to the Commission.

2. The report shall be sent to the Commission.

Or. en

Amendment 42

Proposal for a regulation

Article 44 – paragraph 3

Text proposed by the Commission

Amendment

3. Where the purpose of the data user’s processing cannot be achieved with anonymised data, taking into account the information provided by the data user, the health data access bodies shall provide access to electronic health data in pseudonymised format. The information necessary to reverse the pseudonymisation shall be available only to the health data access body. Data users shall not re-identify the electronic health data provided to them in pseudonymised format. The data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.

3. Where the purpose of the data user’s processing cannot be achieved with anonymised data, taking into account the information provided by the data user or for the purpose of regulatory procedures impacting public health, the health data access bodies shall provide access to electronic health data in pseudonymised format. The information necessary to reverse the pseudonymisation shall be available only to the health data access body. Data users shall not re-identify the electronic health data provided to them in pseudonymised format. The data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.

Or. en

Amendment 43

Proposal for a regulation

Article 48 – paragraph 1

Text proposed by the Commission

Amendment

By derogation from Article 46 of this Regulation, a data permit shall not be required to access the electronic health data under this Article. When carrying out those tasks under Article 37 (1), points (b) and (c), the health data access body shall inform public sector bodies and the Union institutions, offices, agencies and bodies, about the availability of data within 2 months of the data access application, in accordance with Article 9 of Regulation […] [Data Governance Act COM/2020/767 final]. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final ], the health data access body may extend the period by 2 additional months where necessary, taking into account the complexity of the request. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless it specifies that it will provide the data within a longer specified timeframe.

By derogation from Article 46 of this Regulation, a data permit shall not be required to access the electronic health data under this Article. For the purpose of the evaluation of the benefits and risks of medicinal products, the EMA and ECDC shall be granted rapid and unrestricted access to the health data within the EHDS. When carrying out those tasks under Article 37 (1), points (b) and (c), the health data access body shall inform public sector bodies and the Union institutions, offices, agencies and bodies, about the availability of data within 2 months of the data access application, in accordance with Article 9 of Regulation […] [Data Governance Act COM/2020/767 final]. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final ], the health data access body may extend the period by 2 additional months where necessary, taking into account the complexity of the request. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless it specifies that it will provide the data within a longer specified timeframe.

Or. en

Amendment 44

Proposal for a regulation

Article 52 – paragraph 2

Text proposed by the Commission

Amendment

2. The national contact points referred to in paragraph 1 shall be authorised participants in the cross-border infrastructure for secondary use of electronic health data (HealthData@EU). The national contact points shall facilitate the cross-border access to electronic health data for secondary use for different authorised participants in the infrastructure and shall cooperate closely with each other and with the Commission.

2. The national contact points referred to in paragraph 1 shall be authorised participants in the cross-border infrastructure for secondary use of electronic health data (HealthData@EU). The national contact points shall facilitate the cross-border access to electronic health data for secondary use for different authorised participants in the infrastructure. The national contact points shall cooperate closely with each other and with the Commission.

Or. en

Amendment 45

Proposal for a regulation

Article 56 – paragraph 3 – introductory part

Text proposed by the Commission

Amendment

3. The data quality and utility label shall comply with the following elements:

3. The data quality and utility label shall comply with the following standardized elements:

Or. en

Amendment 46

Proposal for a regulation

Article 61 – paragraph 1

Text proposed by the Commission

Amendment

1. Non-personal electronic data made available by health data access bodies, that are based on a natural person’s electronic data falling within one of the categories of Article 33 [(a), (e), (f), (i), (j), (k), (m)] shall be deemed highly sensitive within the meaning of Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final], provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used, in view of the limited number of natural persons involved in that data, the fact that they are geographically scattered or the technological developments expected in the near future.

Or. en

Justification

Inconsistent with GDPR provisions for data concerning health.

Amendment 47

Proposal for a regulation

Article 62

Text proposed by the Commission

Amendment

[...]

deleted

Or. en

Justification

This provisions are already covered in GDPR.

Amendment 48

Proposal for a regulation

Article 63

Text proposed by the Commission

Amendment

Article 63

deleted

International access and transfer of personal electronic health data

In the context of international access and transfer of personal electronic health data, Member States may maintain or introduce further conditions, including limitations, in accordance with and under the conditions of article 9(4) of the Regulation (EU) 2016/679.

Or. en

Justification

This provisions are already covered in GDPR.