Sittings · Compare

What changed

From · opinion parliamentary committee draft · 2023-02-14 ITRE-PA-742310 on the proposal for a regulation of the European Parliament and of the Council on European Health Data Space
To · opinion parliamentary committee · 2023-05-25 IMCO-AD-740773 on the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space
+672 added · −189 removed · 33 modified paragraphs

SHORT JUSTIFICATION

The Rapporteur supports many elements of the European Health Data Space (EHDS) initiative, especially the provisions aimed at providing better health outcomes and promoting health innovation and research. The Rapporteur believes that the availability of cross-border health data can significantly improve patient care and contribute to more effective health policies at a European level. The Rapporteur also believes that this proposal can lead to significant benefits for individuals, patients, healthcare professionals, and society as a whole. Additionally, the Rapporteur supports this proposal as it can boost research and innovation, support the development of new drugs, devices, and treatments, and increase the efficiency and sustainability of healthcare systems.

This opinion focuses on the second pillar, Chapter III, which aims to implement a mandatory self-certification scheme for EHR systems, while complying with essential requirements on interoperability and security.

However, the Rapporteur is of the opinion that some changes are necessary to ensure the success of the initiative. The Rapporteur believes that a prudent implementation of the GDPR is necessary to avoid unnecessary restrictions for health research and data sharing, key to apply artificial intelligence and machine learning tools to research, and to enabling the digital transformation of healthcare, to tackle disparities in prevention, diagnosis, and treatment around Europe. The EHDS will be a critical tool in managing and sharing health data across the European Union, but it must do so in a way that respects the privacy and rights of patients. As contact person for the EMA, the Rapporteur understands that the EMA and other regulatory authorities, such as national medicines’ agencies need to be seen and treated differently from all other data users in EHDS. The legal proposal already foresees this by recognizing regulatory authorities’ needs, and the Rapporteur further strengthens the text by allowing better informed regulatory decision making on benefits and risks of medicinal products, robust and speed up regulatory assessment of new medicinal products with the goal of making them faster available to patients and enhanced tools and processes available to monitor safety and effectiveness of medicines to the benefit of EU patients. Furthermore, the Rapporteur thinks that in order for health data to be useful across different systems, it is essential that we establish interoperable and common rules and standards. This means that data should be able to be exchanged seamlessly between different health systems, regardless of the platform or software used. Therefore, the Rapporteur opinion also underline that the lack of standardization in health data is a major obstacle to interoperability.

As Rapporteur for the IMCO Committee, I streamline the monitoring of the internal market. My draft opinion focuses on clarifying the definitions related to EHR, EHR systems, as well as introducing some new definition to allow for clear interpretation of the conditions set out in Chapter III of the proposal. Additionally, I propose to specify clearly the way in which the Commission will be creating the standards to apply to EHR systems through a clear reference to the use of international and harmonised standards, as well as the participation of all relevant stakeholders in this process.

Finally, the Rapporteur is of the opinion that EHDS should build upon the already existing legislation such as the Data Governance Act and Data Act. These acts provide a solid foundation for the governance and management of health data, and we should work to align our efforts with their provisions. By doing so, the Rapporteur wants to ensure that the collection, processing, and use of health data is conducted in a responsible and transparent manner, while also protecting the privacy and security of individuals.

My amendments further aim to define clearly the interplay between the EHDS and other sectoral legislation, especially for scenarios where devices would fall within the scope of more than one of these legislative acts.

An important addition is the requirement for the Commission and Member States to set explicit time-based targets for implementation and progress on cross-border health data interoperability and the relevant infrastructure.

This draft opinion aims to improve EHR systems by clarifying relevant definitions, ensuring that the Commission uses harmonised standards as the basis for setting EU-wide standards on security and interoperability for EHR systems, as well as reconciling the scope of the European Health Data Space with other sectoral legislation, such as the Medical Devices Regulation, the In-vitro Medical Device Regulation and the upcoming AI Act, and Data Act. By providing these clarifications, the proposed amendments intend to make the Commission’s proposal clearer and more predictable for stakeholders as well as clearly ensure the EU remains well connected globally and does not impose standards, which are not interoperable with global partners.

AMENDMENTS

The Committee on Industry,the ResearchInternal Market and EnergyConsumer Protection calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take into account the following amendments:

Amendment 1

Proposal for a regulation

Recital 47

Text proposed by the Commission

Amendment

(4) The processing of personal electronic health data is subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council43 and, for Union institutions and bodies, Regulation (EU) 2018/1725 of the European Parliament and of the Council44 . References to the provisions of Regulation (EU) 2016/679 should be understood also as references to the corresponding provisions of Regulation (EU) 2018/1725 for Union institutions and bodies, where relevant.

(7) In health systems, personal electronic health data is usually gathered in electronic health records, which typically contain a natural person’s medical history, diagnoses and treatment, medications, allergies, immunisations, as well as radiology images and laboratory results, spread between different entities from the health system (general practitioners, hospitals, pharmacies, care services). In order to enable that electronic health data to be accessed, shared and changed by the natural persons or health professionals, some Member States have taken the necessary legal and technical measures and set up centralised infrastructures connecting EHR systems used by healthcare providers and natural persons. Alternatively, some Member States support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. Several Member States have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). They have also taken measures to ensure that EHR systems or wellness applications are able to transmit electronic health data with the central EHR system (some Member States do this by ensuring, for instance, a system of certification). However, not all Member States have put in place such systems, and the Member States that have implemented them have done so in a fragmented manner. In order to facilitate the free movement of personal health data across the Union and avoid negative consequences for patients when receiving healthcare in cross-border context, Union action is needed in order to ensure individuals have improved acess to their own personal electronic health data and are empowered to share it.

(4) The processing of personal electronic health data is subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council43 and, for Union institutions and bodies, Regulation (EU) 2018/1725 of the European Parliament and of the Council44 . References to the provisions of Regulation (EU) 2016/679 should be understood also as references to the corresponding provisions of Regulation (EU) 2018/1725 for Union institutions and bodies, where relevant. The present Regulation should also comply with the proposed Cyber Resilience Act (“CRA”), with respect to further requirements for security.

(7) In health systems, personal electronic health data is usually gathered in electronic health records, which typically contain a natural person’s medical history, diagnoses and treatment, medications, allergies, immunisations, as well as radiology images and laboratory results, spread between different entities from the health system (general practitioners, hospitals, pharmacies, care services). In order to enable that electronic health data to be accessed, shared and changed by the natural persons or health professionals, some Member States have taken the necessary legal and technical measures and set up centralised infrastructures connecting EHR systems used by healthcare providers and natural persons. Alternatively, some Member States support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. Several Member States have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). They have also taken measures to ensure that EHR systems or wellness applications are able to transmit electronic health data with the central EHR system (some Member States do this by ensuring, for instance, a system of certification). However, not all Member States have put in place such systems, and the Member States that have implemented them have done so in a fragmented manner. In order to facilitate the free movement of personal health data across the Union and avoid negative consequences for patients when receiving healthcare in cross-border context, Union action is needed in order to ensure individuals have improved acess to their own personal electronic health data and are empowered to share it. The implementation costs for connecting healthcare professionals to the EHDS, including new infrastructure and cybersecurity maintenance, capacity building and additional administrative data workload, should not be carried by healthcare professionals themselves in justified cases. Therefore, Member States should ensure that for such justified cases, financial incentives of the Union are distributed evenly and fairly among those impacted by the EHDS.

__________________

__________________

43 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

43 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

44 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

44 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Or. en

Amendment 2

Proposal for a regulation

Recital 1711

Text proposed by the Commission

Amendment

(17) The relevance of different categories of electronic health data for different healthcare scenarios varies. Different categories have also achieved different levels of maturity in standardisation, and therefore the implementation of mechanisms for their exchange may be more or less complex depending on the category. Therefore, the improvement of interoperability and data sharing should be gradual and prioritisation of categories of electronic health data is needed. Categories of electronic health data such as patient summary, electronic prescription and dispensation, laboratory results and reports, hospital discharge reports, medical images and reports have been selected by the eHealth Network as most relevant for the majority of healthcare situations and should be considered as priority categories for Member States to implement access to them and their transmission. When further needs for the exchange of more categories of electronic health data are identified for healthcare purposes, the list of priority categories should be expanded. The Commission should be empowered to extend the list of priority categories, after analysing relevant aspects related to the necessity and possibility for the exchange of new datasets, such as their support by systems established nationally or regionally by the Member States. Particular attention should be given to the data exchange in border regions of neighbouring Member States where the provision of cross-border health services is more frequent and needs even quicker procedures than across the Union in general.

(11) Natural persons should be further empowered to exchange and to provide access to personal electronic health data to the health professionals of their choice, going beyond the right to data portability as established in Article 20 of Regulation (EU) 2016/679. This is necessary to tackle objective difficulties and obstacles in the current state of play. Under Regulation (EU) 2016/679, portability is limited only to data processed based on consent or contract, which excludes data processed under other legal bases, such as when the processing is based on law, for example when their processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It only concerns data provided by the data subject to a controller, excluding many inferred or indirect data, such as diagnoses, or tests. Finally, under Regulation (EU) 2016/679, the natural person has the right to have the personal data transmitted directly from one controller to another only where technically feasible. That Regulation, however, does not impose an obligation to make this direct transmission technically feasible. All these elements limit the data portability and may limit its benefits for provision of high-quality, safe and efficient healthcare services to the natural person.

(17) The relevance of different categories of electronic health data for different healthcare scenarios varies. Different categories have also achieved different levels of maturity in standardisation, and therefore the implementation of mechanisms for their exchange may be more or less complex depending on the category. Specifications should be commonly agreed and aligned with activities for furthering the maturity of global standardisation and harmonisation and existing standards that address different data domains. Therefore, the improvement of interoperability and data sharing should be gradual and prioritisation of categories of electronic health data is needed. Categories of electronic health data such as patient summary, electronic prescription and dispensation, laboratory results and reports, hospital discharge reports, medical images and reports have been selected by the eHealth Network as most relevant for the majority of healthcare situations and should be considered as priority categories for Member States to implement access to them and their transmission. When further needs for the exchange of more categories of electronic health data are identified for healthcare purposes, the list of priority categories should be expanded. The Commission should be empowered to extend the list of priority categories, after analysing relevant aspects related to the necessity and possibility for the exchange of new datasets, such as their support by systems established nationally or regionally by the Member States. Particular attention should be given to the data exchange in border regions of neighbouring Member States where the provision of cross-border health services is more frequent and needs even quicker procedures than across the Union in general.

(11) Natural persons should be further empowered to exchange and to provide access to personal electronic health data to the health professionals of their choice, going beyond the right to data portability as established in Article 20 of Regulation (EU) 2016/679. This is necessary to tackle objective difficulties and obstacles in the current state of play. Under Regulation (EU) 2016/679, portability is limited only to data processed based on consent or contract, which excludes data processed under other legal bases, such as when the processing is based on law, for example when their processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It only concerns data provided by the data subject to a controller, excluding many inferred or indirect data, such as diagnoses, or tests. Finally, under Regulation (EU) 2016/679, the natural person has the right to have the personal data transmitted directly from one controller to another only where technically feasible. That Regulation, however, does not impose an obligation to make this direct transmission technically feasible. All these elements limit the data portability and may limit its benefits for provision of high-quality, safe and efficient healthcare services to the natural person. Portability should give consumers more choice in the selection of a healthcare provider, resulting in reduced healthcare costs, faster diagnosis and treatment time and overall better health outcomes.

Or. en

Amendment 3

Proposal for a regulation

Recital 22 a (new)

Recital 16

Text proposed by the Commission

Amendment

(22 a) This Regulation contributes to reducing inequalities in quality healthcare access across Europe. There should be no first and second-class citizens in Europe. Therefore, barriers to reimbursement for telemedicine and other barriers should be removed.

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

Or. en

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the Commission and the Member States should agree on ambitious time-based targets to implement improved health data interoperability across the Union. The access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

Amendment 4

Proposal for a regulation

Recital 2919

Text proposed by the Commission

Amendment

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. In order to make electronic health data accesible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data.

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system, within the meaning of the EHDS Regulation. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. The EHDS should also contribute to other requirements, mainly to apply the once-only principle, where possible. In order to make electronic health data accessible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data. Moreover, an agreement on time-based Union level targets for implementation of health data interoperability, should be reached. In order to support the successful implementation of the EHDS and the execution of an effective landscape of European health data cooperation, the Commission should agree with Member States a range of targets for health data interoperability milestones.

__________________

__________________

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

45 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, p. 18).

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

45 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, p. 18).

Or. en

46 Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

46 Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

Amendment 5

Proposal for a regulation

Recital 63

Recital 19 a (new)

Text proposed by the Commission

Amendment

(63) The use of funds should also contribute to attaining the objectives of the EHDS. Public procurers, national competent authorities in the Member States, including digital health authorities and health data access bodies, as well as the Commission should make references to applicable technical specifications, standards and profiles on interoperability, security and data quality, as well as other requirements developed under this Regulation when defining the conditions for public procurement, calls for proposals and allocation of Union funds, including structural and cohesion funds.

(19a) The once-only principle means that natural or legal persons provide data only once under the primary or secondary use regime, while all actors concerned by this Regulation should be able to access such data for primary or secondary use, while respecting the rules laid down in the corresponding chapters. The implementation of the once-only principle would ensure that healthcare professionals and providers are not obliged to provide the same data more than once, avoiding duplication and unnecessary burdens.

(63) The use of funds should also contribute to attaining the objectives of the EHDS. Public procurers, national competent authorities in the Member States, including digital health authorities and health data access bodies, as well as the Commission should make references to applicable technical specifications, standards and profiles on interoperability, security and data quality, as well as other requirements developed under this Regulation when defining the conditions for public procurement, calls for proposals and allocation of Union funds, including structural and cohesion funds. EU funds must be distributed adequately among the Member States taking into account different levels of health system digitalisation and the costs involved in making national data infrastructures interoperable and compatible with the requirements of the EHDS.

Or. en

Amendment 6

Proposal for a regulation

Article 1 – paragraph 1

Recital 23

Text proposed by the Commission

Amendment

1. This Regulation establishes the European Health Data Space (‘EHDS’) by providing for rules, common standards and practices, infrastructures and a governance framework for the primary and secondary use of electronic health data.

(23) Digital health authorities should have sufficient technical skills, possibly bringing together experts from different organisations. The activities of digital health authorities should be well-planned and monitored in order to ensure their efficiency. Digital health authorities should take necessary measures to ensuring rights of natural persons by setting up national, regional, and local technical solutions such as national EHR, patient portals, data intermediation systems. When doing so, they should apply common standards and specifications in such solutions, promote the application of the standards and specifications in procurements and use other innovative means including reimbursement of solutions that are compliant with interoperability and security requirements of the EHDS. To carry out their tasks, the digital health authorities should cooperate at national and Union level with other entities, including with insurance bodies, healthcare providers, manufacturers of EHR systems and wellness applications, as well as stakeholders from health or information technology sector, entities handling reimbursement schemes, health technology assessment bodies, medicinal products regulatory authorities and agencies, medical devices authorities, procurers and cybersecurity or e-ID authorities.

1. This Regulation establishes the European Health Data Space (‘EHDS’) by providing for common and harmonized rules, standards and practices, interoperable infrastructures and a governance framework for the primary and secondary use of electronic health data.

(23) Digital health authorities should have sufficient technical skills, possibly bringing together experts from different organisations. The activities of digital health authorities should be well-planned and monitored in order to ensure their efficiency. Digital health authorities should take necessary measures to ensuring rights of natural persons by setting up national, regional, and local technical solutions such as national EHR, patient portals, data intermediation systems. When doing so, they should apply common standards and specifications in such solutions, promote the application of the standards and specifications in procurements and use other innovative means including reimbursement of solutions that are compliant with interoperability and security requirements of the EHDS. To carry out their tasks, the digital health authorities should cooperate and exchange best practices at national and Union level with other entities, including with insurance bodies, healthcare providers, manufacturers of EHR systems and wellness applications, as well as stakeholders from health or information technology sector, entities handling reimbursement schemes, health technology assessment bodies, medicinal products regulatory authorities and agencies, medical devices authorities, procurers and cybersecurity or e-ID authorities. Additionally, cybersecurity is of utmost importance in the healthcare sector, especially when it comes to protecting health data. Therefore, digital health authorities should implement robust cybersecurity measures in order to protect sensitive health data of users to thwart any attempts to breach the systems and steal or damage the data.

Or. en

Amendment 7

Proposal for a regulation

Article 1 – paragraph 3 – point b

Recital 24

Text proposed by the Commission

Amendment

(b) controllers and processors established in the Union processing electronic health data of Union citizens and third-country nationals legally residing in the territories of Member States;

(24) Access to and transmission of electronic health data is relevant in cross-border healthcare situations, as it may support continuity of healthcare when natural persons travel to other Member States or change their place of residence. Continuity of care and rapid access to personal electronic health data is even more important for residents in border regions, crossing the border frequently to get health care. In many border regions, some specialised health care services may be available closer across the border rather than in the same Member State. An infrastructure is needed for the transmission of personal electronic health data across borders, in situations where a natural person is using services of a healthcare provider established in another Member State. A voluntary infrastructure for that purpose, MyHealth@EU, has been established as part of the actions provided for in Article 14 of Directive 2011/24/EU. Through MyHealth@EU, Member States started to provide natural persons with the possibility to share their personal electronic health data with healthcare providers when travelling abroad. To further support such possibilities, the participation of Member States in the digital infrastructure MyHealth@EU should become mandatory. All Member States should join the infrastructure and connect healthcare providers and pharmacies to it, as this is necessary for the implementation of the rights of natural persons to access and make use of their personal electronic health data regardless of the Member State. The infrastructure should be gradually expanded to support further categories of electronic health data.

(b) controllers and processors established in the Union processing personal electronic health data of Union citizens and third-country nationals legally residing in the territories of Member States;

(24) Access to and transmission of electronic health data is relevant in cross-border healthcare situations, as it may support continuity of healthcare when natural persons travel to other Member States or change their place of residence. Continuity of care and rapid access to personal electronic health data is even more important for residents in border regions, crossing the border frequently to get health care. In many border regions, some specialised health care services may be available closer across the border rather than in the same Member State. An infrastructure is needed for the transmission of personal electronic health data across borders, in situations where a natural person is using services of a healthcare provider established in another Member State. A voluntary infrastructure for that purpose, MyHealth@EU, has been established as part of the actions provided for in Article 14 of Directive 2011/24/EU. Through MyHealth@EU, Member States started to provide natural persons with the possibility to share their personal electronic health data with healthcare providers when travelling abroad. To further support such possibilities, the participation of Member States in the digital infrastructure MyHealth@EU should become mandatory. All Member States should join the infrastructure and connect healthcare providers and pharmacies to it, as this is necessary for the implementation of the rights of natural persons to access and make use of their personal electronic health data regardless of the Member State. The infrastructure should be gradually expanded to support further categories of electronic health data. Making interoperability mandatory would overcome the market coordination failure. Introducing interoperability standards at Union level is likely to be more effective than at national level.

Or. en

Justification

Alignment with GDPR provisions and Recital 5 of the current proposal.

Amendment 8

Proposal for a regulation

Article 1 – paragraph 3 – point b a (new)

Recital 25

Text proposed by the Commission

Amendment

(b a) health data holders and data holders as defined in this regulation when the relevant provisions concern non-personal electronic health data.

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor.

Or. en

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor. Moreover, the Commission and Member States should develop time-based targets to reach that objective. To ensure the highest security standards, where deemed appropriate, parts of or the entirety of the platform should be licenced under an open source licence in line with the Open Source Strategy 2020-2023 and Commission Decision 2021/C 495 I/011a. This will increase transparency and ensure consumer trust and confidence in the platform.

______________

1a Commission Decision of 8 December 2021 on the open source licensing and reuse of Commission software 2021/C 495 I/01 (OJ C 495I, 9.12.2021, p. 1).

Amendment 9

Proposal for a regulation

Article 1 – paragraph 3 – point d

Recital 29

Text proposed by the Commission

Amendment

(d) data users to whom electronic health data are made available by data holders in the Union.

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(d) data recipients and data users to whom electronic health data are made available by data holders in the Union.

(29) Software or module(s) of software which fall within the definition of an EHR system, medical device or high-risk artificial intelligence (AI) system should only be required to comply with the essential requirements on interoperability of this Regulation to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. These types of software should exclusively follow the relevant conformity assessment in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. In such case, only the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

Or. en

__________________

__________________

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

Amendment 10

Proposal for a regulation

Article 1 – paragraph 4 a (new)

Recital 34

Text proposed by the Commission

Amendment

4 a. This regulation shall be without prejudice to the Directive on the Protection of Trade Secrets (Directive (EU) 2016/943) which shall take precedence.

(34) In order to ensure an appropriate and effective enforcement of the requirements and obligations laid down in Chapter III of this Regulation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply. Depending on the organisation defined at national level, such market surveillance activities could be carried out by the digital health authorities ensuring the proper implementation of Chapter II or a separate market surveillance authority responsible for EHR systems. While designating digital health authorities as market surveillance authorities could have important practical advantages for the implementation of health and care, any conflicts of interest should be avoided, for instance by separating different tasks.

Or. en

(34) In order to ensure an appropriate and effective enforcement of the requirements and obligations laid down in Chapter III of this Regulation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply. Depending on the organisation defined at national level, such market surveillance activities could be carried out by the digital health authorities ensuring the proper implementation of Chapter II or a separate market surveillance authority responsible for EHR systems. While designating digital health authorities as market surveillance authorities could have important practical advantages for the implementation of health and care, any conflicts of interest should be avoided, for instance by separating different tasks. Member States should ensure that market surveillance authorities have the necessary human, technical and financial resources, premises, infrastructure, and expertise to carry out their duties effectively.

Amendment 11

Proposal for a regulation

Article 2 – paragraph 2 – point b

Recital 40

Text proposed by the Commission

Amendment

(b) ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

(40) The data holders can be public, non for profit or private health or care providers, public, non for profit and private organisations, associations or other entities, public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. In order to avoid a disproportionate burden on small entities, micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of EHDS. The public or private entities often receive public funding, from national or Union funds to collect and process electronic health data for research, statistics (official or not) or other similar purposes, including in area where the collection of such data is fragmented of difficult, such as rare diseases, cancer etc. Such data, collected and processed by data holders with the support of Union or national public funding, should be made available by data holders to health data access bodies, in order to maximise the impact of the public investment and support research, innovation, patient safety or policy making benefitting the society. In some Member States, private entities, including private healthcare providers and professional associations, play a pivotal role in the health sector. The health data held by such providers should also be made available for secondary use. At the same time, data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. However, public authorities and regulators should have access to such data, for instance in the event of pandemics, to verify defective devices and protect human health. In times of severe public health concerns (for example, PIP breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. The COVID-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. Such data should be made available for public and regulatory activities, supporting public bodies to carry out their legal mandate, while complying with, where relevant and possible, the protection enjoyed by commercial data. Specific rules in relation to the secondary use of health data should be provided. Data altruism activities may be carried out by different entities, in the context of Regulation […] [Data Governance Act COM/2020/767 final] and taking into account the specificities of the health sector.

(b) ‘non-personal electronic health data’ means on a case by case, anonymised or pseudonymised data concerning health and genetic data relevant for health research in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

(40) The data holders can be public, non for profit or private health or care providers, public, non for profit and private organisations, associations or other entities, public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. In order to avoid a disproportionate burden on small entities, micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of EHDS. The public or private entities often receive public funding, from national or Union funds to collect and process electronic health data for research, statistics (official or not) or other similar purposes, including in area where the collection of such data is fragmented of difficult, such as rare diseases, cancer etc. Such data, collected and processed by data holders with the support of Union or national public funding, should be made available by data holders to health data access bodies, in order to maximise the impact of the public investment and support research, innovation, patient safety or policy making benefitting the society. In some Member States, private entities, including private healthcare providers and professional associations, play a pivotal role in the health sector. The health data held by such providers should also be made available for secondary use. At the same time, data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies should be provided with the level of confidentiality protection mandated by the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) and the Directive (EU) 2016/9431a, with the protection of the main IP rights i.e. patents, supplementary protection certificates (SPCs), utility models, copyright, trademarks, database and design rights. However, public authorities and regulators should have access to such data, for instance in the event of pandemics, to verify defective devices and protect human health. In times of severe public health concerns (for example, PIP breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. The COVID-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. Such data should be made available for public and regulatory activities, supporting public bodies to carry out their legal mandate, while complying with, where relevant and possible, the protection enjoyed by commercial data. Specific rules in relation to the secondary use of health data should be provided. Data altruism activities may be carried out by different entities, in the context of Regulation […] [Data Governance Act COM/2020/767 final] and taking into account the specificities of the health sector.

Or. en

___________________

1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1).

Amendment 12

Proposal for a regulation

Article 2 – paragraph 2 – point d

Recital 51

Text proposed by the Commission

Amendment

(d) ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess, maintain or restore the state of health of the natural person to whom that data relates, including the prescription, dispensation and provision of medicinal products and medical devices, as well as for relevant social security, administrative or reimbursement services;

(51) As the resources of health data access bodies are limited, they can apply prioritisation rules, for instance prioritising public institutions before private entities, but they should not make any discrimination between the national or from organisations from other Member States within the same category of priorities. The data user should be able to extend the duration of the data permit in order, for example, to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. This would require an amendment of the data permit and may be subject to an additonal fee. However, in all the cases, the data permit should reflect theses additionals uses of the dataset. Preferably, the data user should mention them in their initial request for the issuance of the data permit. In order to ensure a harmonised approach between health data access bodies, the Commission should support the harmonisation of data permit.

(d) ‘primary use of electronic health data’ means the processing of personal electronic health data for the provision of health services to assess, maintain or restore the state of health of the natural person to whom that data relates, including the prescription, dispensation and provision of medicinal products and medical devices, as well as related services aimed at promoting their safe and rational use and at ensuring better treatment, as well as for relevant social security, administrative or reimbursement services;

(51) As the resources of health data access bodies are limited, they can apply prioritisation rules, the Commission should issue guidance on prioritisation criteria. In general, the request with potential overall highest benefit for the citizens and Union should be prioritised. The prioritisation criteria should avoid fragmentation of the single market. The data user should be able to extend the duration of the data permit in order, for example, to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. This would require an amendment of the data permit and may be subject to an additonal fee. However, in all the cases, the data permit should reflect theses additionals uses of the dataset. Preferably, the data user should mention them in their initial request for the issuance of the data permit. In order to ensure a harmonised approach between health data access bodies, the Commission should support the harmonisation of data permit.

Or. en

Amendment 13

Proposal for a regulation

Article 2 – paragraph 2 – point e

Recital 68

Text proposed by the Commission

Amendment

(e) ‘secondary use of electronic health data’ means the processing of electronic health data for purposes set out in Chapter IV of this Regulation. The data used may include personal electronic health data initially collected in the context of primary use, but also electronic health data collected for the purpose of the secondary use;

(68) In order to ensure that EHDS fulfils its objectives, the power to adopt acts in accordance with Article 290 Treaty on the Functioning of the European Union should be delegated to the Commission in respect of different provisions of primary and secondary use of electronic health data. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making52 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(e) ‘secondary use of electronic health data’ means the compatible further processing of electronic health data for purposes set out in Chapter IV of this Regulation, and where such electronic health data is personal data, in accordance with Article 5(1)(b) of Regulation (EU) 2016/679 . The data used may include personal electronic health data initially collected in the context of primary use, but also electronic health data collected for the purpose of the secondary use;

(68) In order to ensure that EHDS fulfils its objectives, the power to adopt acts in accordance with Article 290 Treaty on the Functioning of the European Union should be delegated to the Commission in respect of different provisions of primary and secondary use of electronic health data. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making52. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. In accordance with the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making, the Commission will also resort to public consultations to gather the necessary expertise.

Or. en

__________________

Justification

__________________

The definition of "secondary use of electronic health data" needs to be clarified to exclude the processing of electronic health data otherwise than for the purposes of Chapter IV and by ensuring compatibility with secondary use as described in GDPR.

52 OJ L 123, 12.5.2016, p. 1.

52 OJ L 123, 12.5.2016, p. 1.

Amendment 14

Proposal for a regulation

Article 2 – paragraph 2 – point f

Recital 69

Text proposed by the Commission

Amendment

(f) ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals, involving the exchange of information and knowledge without changing the content of the data between these organisations, software applications or devices, through the processes they support;

(69) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council53 .

(f) ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact, connect and communicate in a compatible and coordinated manner, allowing the exchange of information and knowledge without changing the content of the data between these organisations, software applications or devices, through the processes they support, and without effort from the end user;

(69) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council53. In accordance with the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making, the Commission will make use of expert groups, consult targeted stakeholders and carry out public consultations to gather broader expertise in the early preparation of draft implementing acts.

Or. en

__________________

__________________

53 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

53 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

Amendment 15

Proposal for a regulation

Article 2 – paragraph 2 – point g

Recital 70

Text proposed by the Commission

Amendment

(g) ‘European electronic health record exchange format’ means a structured, commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications, devices and healthcare providers;

(70) Member States should take all necessary measures to ensure that the provisions of this Regulation are implemented, including by laying down effective, proportionate and dissuasive penalties for their infringement. For certain specific infringements, Member States should take into account the margins and criteria set out in this Regulation.

(g) ‘European electronic health record exchange format’ means a structured, standardized, commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications, devices and healthcare providers;

(70) Member States should take all necessary measures to ensure that the provisions of this Regulation are implemented, including by laying down effective, proportionate and dissuasive penalties for their infringement. For certain specific infringements, Member States should take into account the margins and criteria set out in this Regulation. Moreover, the Member states should put in place communication campaigns to inform all relevant stakeholders, especially the industry, and society, about the infringements and all provisions of the Regulation in order to facilitate its implementation, which needs to take especially into account the different digital developments of health systems across the Union.

Or. en

Amendment 16

Proposal for a regulation

Article 2 – paragraph 2 – point k

Recital 71 a (new)

Text proposed by the Commission

Amendment

(k) ‘data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data;

(71a) The Commission should assess whether this Regulation should be added to the list of provisions of Union law covered by Annex I of Directive (EU) 2020/1828 of the European Parliament and of the Council.

(k) ‘health data recipient’ means a natural or legal person that receives data from another controller in the context of the primary use of electronic health data;

Or. en

Justification

This amendment should apply across the whole text.

Amendment 17

Proposal for a regulation

Article 2 – paragraph 2 – point y

Recital 72 a (new)

Text proposed by the Commission

Amendment

(y) ‘data holder’ means any natural or legal person, which is an entity or a body in the health or care sector, or performing research in relation to these sectors, as well as Union institutions, bodies, offices and agencies who has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation implementing Union law, or in the case of non-personal data, through control of the technical design of a product and related services, the ability to make available, including to register, provide, restrict access or exchange certain data;

(72a) In order to mitigate risks of delay in implementation, the Commission and Member States should agree on a range of time-based targets for the EHDS, including in respect to health data interoperability.

(y) ‘health data holder’ means any natural or legal person, which is an entity or a body in the health or care sector, or performing research in relation to these sectors, as well as Union agencies who has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation implementing Union law, or in the case of non-personal data and through both control of the technical design of a product and related services, and as allowed by the natural or legal person owning, renting or leasing the product or related services, and:

- acts as a controller under the GDPR regarding the processing of personal electronic health data for primary use, and/or

- has an obligation under the Regulation, other Union law or national legislation implementing Union law to make electronic health data available for secondary use, and/or

- in the case of non-personal electronic health data, controls and has the ability to make data generated by a medical device, authorized wellness application, EHR system or related services available

Or. en

Justification

The addition of health to 'data holder' should apply across the whole text

Amendment 18

Proposal for a regulation

Article 21 – paragraph 2 – point z4

Text proposed by the Commission

Amendment

(z) ‘data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use;

4. This Regulation shall be without prejudice to other Union legal acts regarding access to, sharing of or secondary use of electronic health data, or requirements related to the processing of data in relation to electronic health data, in particular Regulations (EU) 2016/679, (EU) 2018/1725, […] [Data Governance Act COM/2020/767 final] and […] [Data Act COM/2022/68 final].

(z) ‘health data user’ means a natural or legal person who has lawful access to personal or non-personal electronic health data for secondary use;

4. This Regulation shall be without prejudice to other Union legal acts regarding access to, sharing of or secondary use of electronic health data, or requirements related to the processing of data in relation to electronic health data, in particular Regulations (EU) 2016/679, (EU) 2018/1725, […] [Data Governance Act COM/2020/767 final], Directive (EU) 2016/943 and […] [Data Act COM/2022/68 final].

Or. en

Justification

The amendment should apply across the whole text.

Amendment 19

Proposal for a regulation

Article 102 – paragraph 21 – point gd a (new)

Text proposed by the Commission

Amendment

(g) ensure the implementation, at national level, of the European electronic health record exchange format, in cooperation with national authorities and stakeholders;

(da) the definition of ‘professional user’ pursuant to Article 3 (8) of the Regulation (EU) 2018/1807;

(g) ensure the implementation, at national level, of the European electronic health record exchange format to be interoperable, inter alia cross-border, in cooperation with national authorities and stakeholders;

Or. en

Amendment 20

Proposal for a regulation

Article 102 – paragraph 21 – point he

Text proposed by the Commission

Amendment

(h) contribute, at Union level, to the development of the European electronic health record exchange format and to the elaboration of common specifications addressing interoperability, security, safety or fundamental right concerns in accordance with Article 23 and of the specifications of the EU database for EHR systems and wellness applications referred to in Article 32;

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 (1), (12), (14), (22), (36) and (71) of the Regulation (EU) 2017/745;

(h) contribute, at Union level, to the development of the European electronic health record exchange format and to the elaboration of common specifications addressing interoperability, inter alia cross-border, security, safety or fundamental right concerns in accordance with Article 23 and of the specifications of the EU database for EHR systems and wellness applications referred to in Article 32;

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘putting into service’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 (1), (12), (14), (22), (29), (36) and (71) of the Regulation (EU) 2017/745;

Or. en

Amendment 21

Proposal for a regulation

Article 102 – paragraph 2 – point kb

Text proposed by the Commission

Amendment

(k) offer, in compliance with national legislation, telemedicine services and ensure that such services are easy to use, accessible to different groups of natural persons and health professionals, including natural persons with disabilities, do not discriminate and offer the possibility of choosing between in person and digital services;

(b) ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

(k) offer, in compliance with national legislation, telemedicine services, joint telemedicine solutions, and ensure that such services are available as provided for in Directive 2011/24/EC, and are easy to use, accessible to different groups of natural persons and health professionals, including natural persons with disabilities, do not discriminate and offer the possibility of choosing between in person and digital services;

(b) ‘non-personal electronic health data’ means data concerning health and aggregated genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

Or. en

Amendment 22

Proposal for a regulation

Article 232 – paragraph 12subparagraphpoint 1i a (new)

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

(ia) ‘economic operator’ means the manufacturer, the authorised representative, the importer, the distributor, the fulfilment service provider or any other natural or legal person who is subject to obligations in relation to the manufacture of EHR systems, making them available on the market, putting them into service or maintaining them in accordance with the relevant Union harmonisation legislation;

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the existing standardisation and harmonisation of different data domains and the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

Or. en

Amendment 23

Proposal for a regulation

Article 232 – paragraph 52 – point m

Text proposed by the Commission

Amendment

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications may be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

(m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for healthcare purposes;

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications shall be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

(m) ‘EHR’ (electronic health record) means a comprehensive medical record or similar documentation of the past and present state of health of a natural person, including physical and mental health, in electronic form, collected in the health system, processed for healthcare purposes;

Or. en

Amendment 24

Proposal for a regulation

Article 332 – paragraph 12introductorypoint partn

Text proposed by the Commission

Amendment

1. Data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this Chapter:

(n) ‘EHR system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

1. Data holders shall make the following categories of electronic data available for secondary use in accordance with the provisions of this Chapter, with the right to refuse access to their data for reasons set out in paragraph 1a new:

(n) ‘EHR system’ (electronic health record system) means any product (hardware, software or other product) primarily intended by the manufacturer to be used or that can be reasonably expected by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records, whose main purpose is to facilitate sharing patient information with authorised providers, healthcare professionals, or patients and data flow between healthcare providers;

Or. en

Amendment 25

Proposal for a regulation

Article 332 – paragraph 12 – point dn a (new)

Text proposed by the Commission

Amendment

(d) health-related administrative data, including claims and reimbursement data;

(na) ‘general software’ means any software that is not primarily intended by the manufacturer to be used or that cannot be reasonably expected by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

(d) healthcare-related administrative data, including claims and reimbursement data;

Or. en

Amendment 26

Proposal for a regulation

Article 332 – paragraph 12 – point d a (new)o

Text proposed by the Commission

Amendment

(d a) dispensing and prescribing data;

(o) ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for other purposes than healthcare, such as well-being and pursuing healthy life-styles;

Or. en

(o) ‘wellness application’ means any product or software intended by the manufacturer to be used or that can be reasonably expected by the manufacturer to be mainly used by a natural person for processing electronic health data for healthy life-style and well-being purposes related to healthcare;

Amendment 27

Proposal for a regulation

Article 333 – paragraph 1 – point g10

Text proposed by the Commission

Amendment

(g) identification data related to health professionals involved in the treatment of a natural person;

10. Natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. The information shall be provided immediately and free of charge through electronic health data access services.

(g) identification data related to health professionals involved in research should be limited to data which is absolutely necessary;

10. Natural persons shall have the right to obtain information on which healthcare providers and health professionals have specifically accessed their electronic health data and when available the reason why these actors accessed this data in the context of healthcare. The information shall be provided immediately and free of charge through electronic health data access services.

Or. en

Amendment 28

Proposal for a regulation

Article 334 – paragraph 1 –2 pointa j(new)

Text proposed by the Commission

Amendment

(j) electronic health data from clinical trials;

2a. Natural or legal persons shall be requested to provide data to public sector bodies or EHR providers under the primary or secondary use regime only once, while all actors may request access to and use such data for secondary purposes in accordance with the provisions laid down in Chapter IV.

(j) electronic health data from fully completed clinical trials and in accordance with Regulation (EU) No 536/2014;

Or. en

Justification

There is already an existing mechanism for the disclosure of data as already required in Clinical Trial Regulation and EHSD should comply with.

Amendment 29

Proposal for a regulation

Article 336 – paragraph 1 – pointintroductory lpart

Text proposed by the Commission

Amendment

(l) research cohorts, questionnaires and surveys related to health;

1. The Commission shall, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data referred to in Article 5, setting out the European electronic health record exchange format. The format shall include the following elements:

(l) data from research cohorts, questionnaires and surveys related to health;

1. The Commission shall, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data referred to in Article 5, setting out the European electronic health record exchange format. When setting out the European electronic health record exchange format, the Commission shall take into consideration existing international standards and formats already used in the Member States. The format shall include the following elements:

Or. en

Amendment 30

Proposal for a regulation

Article 3310 – paragraph 12 – point i a (new)

Text proposed by the Commission

Amendment

1 a. Health data holders have the right to refuse access to their data if there are legal or contractual impediments that prevent the data holder from sharing; if it could compromise the scientific integrity of a scientific research study, including a clinical trial; or if it could compromise the protection of data entailing IP rights (including trade secrets) or commercial property, with the scope of each category of data to be further clarified.

(ia) ensure robust cybersecurity measures to protect sensitive health data of users to thwart any attempts to breach the systems and steal or damage the data;

Or. en

Amendment 31

Proposal for a regulation

Article 3312 – paragraph 21

Text proposed by the Commission

Amendment

2. The requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC59 .

1. The Commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the Member States.

2. The requirement in the first subparagraph shall not apply to data holders that qualify as micro enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC59 and to health data holders that qualify as small enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC.

1. The Commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the Member States. Where deemed appropriate, parts of or the entirety of the central platform shall be licenced under an open-source licence and published in the Open Source code repository of the Union institutions.

__________________

__________________

59 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

59 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (OJ L 124, 20.5.2003, p. 36).

Or. en

Amendment 32

Proposal for a regulation

Article 3312 – paragraph 4

Text proposed by the Commission

Amendment

4. Electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

4. Without prejudice to the law relating to the protection of intellectual property, industrial property and commercial property rights, electronic health data entailing protected intellectual property rights from private enterprises shall be made available for secondary use. Data sharing should be based on a data sharing agreement that respects the provisions of Union legislation, in particular of Directive on the Protection of Trade Secrets (Directive (EU) 2016/943, Article 6(2)(e) of the Data Act, Article 39 of TRIPS, and of Articles 9, 11 and 13 Directive 2004/48 on the enforcement of intellectual property rights in relation to preliminary injunctions, injunctions and damages. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

4. No later than 12 months after the entry into force of the Regulation, the Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those measures shall also include target implementation dates, including for improved cross border health data interoperability. The Commission shall consult the EHDS Board, ENISA and EDPB when preparing the implementing acts. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Or. en

Amendment 33

Proposal for a regulation

Article 3314 – paragraph 82 a (new)

Text proposed by the Commission

Amendment

8 a. Clinical trial data sharing under the EHDS shall be without prejudice to existing sectoral legislation, such as Clinical Trials Regulation and IP rights.

2a. Manufacturers of EHR systems that also qualify as medical devices as defined in Article 2 point (1) of Regulation (EU) 2017/745 and claim interoperability of those medical devices with EHR systems under this Regulation shall prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II to this Regulation. Section 3 of this Chapter shall be applicable to those medical devices.

Or. en

Amendment 34

Proposal for a regulation

Article 3414 – paragraph 1 – point a4

Text proposed by the Commission

Amendment

(a) activities for reasons of public interest in the area of public and occupational health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality and safety of healthcare and of medicinal products or medical devices;

4. Providers of high-risk AI systems as defined in Article 6 of Regulation […] [AI act COM/2021/206 final], which does not fall within the scope of Regulation (EU) 2017/745, that claim interoperability of those AI systems with EHR systems will need to prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II of this Regulation. Article 23 of this Chapter shall be applicable to those high-risk AI systems.

(a) activities for reasons of public interest in the area of public and occupational health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality, safety and efficacy of healthcare and of medicinal products or medical devices, for the purpose of the evaluation of the benefits and risks of medicinal products the EMA and ECDC shall be granted rapid and unrestricted access to the health data within the EHDS;

4. Notwithstanding the obligations laid down in Regulation [AI act COM/2021/206 final], providers of high-risk AI systems as defined in Article 6 of Regulation […] [AI act COM/2021/206 final], which does not fall within the scope of Regulation (EU) 2017/745, that claim interoperability of those AI systems with EHR systems will need to prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II of this Regulation. Article 23 of this Chapter shall be applicable to those high-risk AI systems.

Or. en

Amendment 35

Proposal for a regulation

Article 3515 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) advertising or marketing activities towards health professionals, organisations in health or natural persons;

1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in this Chapter.

(c) advertising or marketing activities towards health professionals, organisations in health or natural persons, with the exception of communication in line with approved regulatory information or to provide up-to date, verifiable and complete scientific information to health care professionals for educational purpose in line with Directive 2001/83/EC;

1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in Section 3 of this Chapter and in Annex II.

Or. en

Amendment 36

Proposal for a regulation

Article 3616 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Member States shall designate one or more health data access bodies responsible for granting access to electronic health data for secondary use. Member States may either establish one or more new public sector bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions set out in this Article. Where a Member State designates several health data access bodies, it shall designate one health data access body to act as coordinator, with responsibility for coordinating requests with the other health data access bodies.

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user with regard to its intended purpose, interoperability and security by:

1. Member States shall designate one or more health data access bodies responsible for fullfilling the tasks set out in Article 37, 38 and 39. Member States may either establish one or more new public sector bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions set out in this Article. Where a Member State designates several health data access bodies, it shall designate one health data access body to act as coordinator, with responsibility for coordinating requests to access to electronic health data with the other health data access bodies.

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the professional user, and where appropriate other types of users with regard to its intended purpose, interoperability and security by:

Or. en

Amendment 37

Proposal for a regulation

Article 3916 – paragraph 1 – introductorypoint partb

Text proposed by the Commission

Amendment

1. Each health data access body shall publish an annual activity report which shall contain at least the following:

(b) failing to inform the user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

1. Each health data access body shall publish an biennial activity report which shall include summary data only containing the following:

(b) failing to inform the professional user, and where appropriate other types of users of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

Or. en

Amendment 38

Proposal for a regulation

Article 3917 – paragraph 1 – point n a (new)b

Text proposed by the Commission

Amendment

(n a) Restricted information on patent rights which could appear as part of a disclosure of a “summary of the results of the electronic health data uses”, aligned closely with the existing transparency requirements under the Clinical Trials Regulation and the Appendix.

(b) draw up the technical documentation of their EHR systems in accordance with Article 24;

Or. en

(b) draw up and keep up to date the technical documentation of their EHR systems in accordance with Article 24;

Amendment 39

Proposal for a regulation

Article 3917 – paragraph 1 – point n b (new)c

Text proposed by the Commission

Amendment

(n b) Information from health data holders only after prior consultation on any results or output of the secondary use being made publicly available to allow for vetting for any unauthorised disclosure related to the IP rights, trade secrets and confidential information of data holders.

(c) ensure that their EHR systems are accompanied, free of charge for the user, by the information sheet provided for in Article 25 and clear and complete instructions for use;

Or. en

(c) ensure that their EHR systems are accompanied, free of charge for the user, by the information sheet provided for in Article 25 and by clear and complete instructions for use in accessible formats for persons with disabilities;

Amendment 40

Proposal for a regulation

Article 3917 – paragraph 1 – point n c (new)g

Text proposed by the Commission

Amendment

(n c) Information on clinical trials should be restricted based on the rules applicable to current disclosures and notifications.

(g) take without undue delay any necessary corrective action in respect of their EHR systems which are not in conformity with the essential requirements laid down in Annex II, or recall or withdraw such systems;

Or. en

(g) take immediately any necessary corrective action in respect of their EHR systems when manufacturers consider or have reasons to believe that such systems are not in conformity with the essential requirements laid down in Annex II, or recall or withdraw such systems;

Amendment 41

Proposal for a regulation

Article 3917 – paragraph 21 – point h

Text proposed by the Commission

Amendment

2. The report shall be transmitted to the Commission.

(h) inform the distributors of their EHR systems and, where applicable, the authorised representative and importers of any corrective action, recall or withdrawal;

2. The report shall be sent to the Commission.

(h) immediately inform the distributors of their EHR systems and, where applicable, the authorised representative and importers of any corrective action, recall or withdrawal;

Or. en

Amendment 42

Proposal for a regulation

Article 4417 – paragraph 31 – point i

Text proposed by the Commission

Amendment

3. Where the purpose of the data user’s processing cannot be achieved with anonymised data, taking into account the information provided by the data user, the health data access bodies shall provide access to electronic health data in pseudonymised format. The information necessary to reverse the pseudonymisation shall be available only to the health data access body. Data users shall not re-identify the electronic health data provided to them in pseudonymised format. The data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.

(i) inform the market surveillance authorities of the Member States in which they made their EHR systems available or put them into service of the non-conformity and of any corrective action taken;

3. Where the purpose of the data user’s processing cannot be achieved with anonymised data, taking into account the information provided by the data user or for the purpose of regulatory procedures impacting public health, the health data access bodies shall provide access to electronic health data in pseudonymised format. The information necessary to reverse the pseudonymisation shall be available only to the health data access body. Data users shall not re-identify the electronic health data provided to them in pseudonymised format. The data user’s failure to respect the health data access body’s measures ensuring pseudonymisation shall be subject to appropriate penalties.

(i) immediately inform the market surveillance authorities of the Member States in which they made their EHR systems available or put them into service of the non-conformity and of any corrective action taken;

Or. en

Amendment 43

Proposal for a regulation

Article 4817 – paragraph 1 – point i a (new)

Text proposed by the Commission

Amendment

By derogation from Article 46 of this Regulation, a data permit shall not be required to access the electronic health data under this Article. When carrying out those tasks under Article 37 (1), points (b) and (c), the health data access body shall inform public sector bodies and the Union institutions, offices, agencies and bodies, about the availability of data within 2 months of the data access application, in accordance with Article 9 of Regulation […] [Data Governance Act COM/2020/767 final]. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final ], the health data access body may extend the period by 2 additional months where necessary, taking into account the complexity of the request. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless it specifies that it will provide the data within a longer specified timeframe.

(ia) immediately inform the market surveillance authorities of the Member States in which they made their EHR systems available, where manufacturers consider or have reasons to believe that such systems present a risk to the health or safety of natural persons;

By derogation from Article 46 of this Regulation, a data permit shall not be required to access the electronic health data under this Article. For the purpose of the evaluation of the benefits and risks of medicinal products, the EMA and ECDC shall be granted rapid and unrestricted access to the health data within the EHDS. When carrying out those tasks under Article 37 (1), points (b) and (c), the health data access body shall inform public sector bodies and the Union institutions, offices, agencies and bodies, about the availability of data within 2 months of the data access application, in accordance with Article 9 of Regulation […] [Data Governance Act COM/2020/767 final]. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final ], the health data access body may extend the period by 2 additional months where necessary, taking into account the complexity of the request. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless it specifies that it will provide the data within a longer specified timeframe.

Or. en

Amendment 44

Proposal for a regulation

Article 5217 – paragraph 21 – point k a (new)

Text proposed by the Commission

Amendment

2. The national contact points referred to in paragraph 1 shall be authorised participants in the cross-border infrastructure for secondary use of electronic health data (HealthData@EU). The national contact points shall facilitate the cross-border access to electronic health data for secondary use for different authorised participants in the infrastructure and shall cooperate closely with each other and with the Commission.

(ka) establish reporting channels and ensure their accessibility to allow for users to submit complaints or concerns regarding potential non-conformity of products, assess the complaints and concerns received and inform market surveillance authorities in case of suspected non-compliance of the product, and keep a register of complaints and concerns received and make it available upon request from a market surveillance authority.

2. The national contact points referred to in paragraph 1 shall be authorised participants in the cross-border infrastructure for secondary use of electronic health data (HealthData@EU). The national contact points shall facilitate the cross-border access to electronic health data for secondary use for different authorised participants in the infrastructure. The national contact points shall cooperate closely with each other and with the Commission.

Or. en

Amendment 45

Proposal for a regulation

Article 5617 – paragraph 3 –1 introductorya part(new)

Text proposed by the Commission

Amendment

3. The data quality and utility label shall comply with the following elements:

1a. If the manufacturer fails to cooperate with market surveillance authorities or if the information and documentation provided is incomplete or incorrect, market surveillance authorities shall take all appropriate and proportionate measures to prohibit or restrict the relevant EHR system from being available on the market, to withdraw it from the market or to recall it until the manufacturer cooperates or provides complete and correct information;

3. The data quality and utility label shall comply with the following standardized elements:

Or. en

Amendment 46

Proposal for a regulation

Article 6117 – paragraph 13

Text proposed by the Commission

Amendment

1. Non-personal electronic data made available by health data access bodies, that are based on a natural person’s electronic data falling within one of the categories of Article 33 [(a), (e), (f), (i), (j), (k), (m)] shall be deemed highly sensitive within the meaning of Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final], provided that their transfer to third countries presents a risk of re-identification through means going beyond those likely reasonably to be used, in view of the limited number of natural persons involved in that data, the fact that they are geographically scattered or the technological developments expected in the near future.

3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity for 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market.

1. Non-personal electronic data made available by health data access bodies, that are based on a natural person’s electronic data falling within one of the categories of Article 33 [(a), (e), (f), (i), (j), (k), (m)] shall be deemed highly sensitive within the meaning of Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final].

3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity for 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market and ensure that the technical documentation and the declaration of conformity are made available to the market surveillance authorities upon request.

Or. en

Justification

Inconsistent with GDPR provisions for data concerning health.

Amendment 47

Proposal for a regulation

Article 62

Article 17 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

[...]

3a. Natural or legal persons may claim compensation for damage caused by a defective EHR system in accordance with applicable Union and national law.

deleted

Or. en

Justification

This provisions are already covered in GDPR.

Amendment 48

Proposal for a regulation

Article 63

Article 17 – paragraph 3 b (new)

Text proposed by the Commission

Amendment

Article 63

3b. Manufacturers shall make publicly available communication channels such as a telephone number, electronic address or dedicated section of their website, taking into account accessibility needs for persons with disabilities, allowing users to file complaints and to inform them of risks related to their health and safety or to other aspects of public interest protection and of any serious incident involving an EHR system.

deleted

Amendment 49

International access and transfer of personal electronic health data

Proposal for a regulation

In the context of international access and transfer of personal electronic health data, Member States may maintain or introduce further conditions, including limitations, in accordance with and under the conditions of article 9(4) of the Regulation (EU) 2016/679.

Article 17 – paragraph 3 c (new)

Or. en

Text proposed by the Commission

Justification

Amendment

This provisions are already covered in GDPR.

3c. Manufacturers shall investigate complaints and information on incidents involving an EHR system they made available on the market without undue delay and shall keep an internal register of those complaints as well as of systems recalls and any corrective measures taken to bring the EHR system into conformity.

Amendment 50

Proposal for a regulation

Article 17 – paragraph 3 d (new)

Text proposed by the Commission

Amendment

3d. Personal data stored in the internal register of complaints shall only be those personal data that are necessary for the manufacturer to investigate the complaint. Such data shall only be kept as long as it is necessary for the purpose of investigation and no longer than 5 years after they have been encoded.

Amendment 51

Proposal for a regulation

Article 18 – paragraph 1

Text proposed by the Commission

Amendment

1. Prior to making an EHR system available on the Union market, a manufacturer of an EHR system established outside of the Union shall, by written mandate, appoint an authorised representative which is established in the Union.

1. Where a manufacturer of an EHR system is established outside of the Union, the EHR system may only be made available on the Union market if the manufacturer appoints, by written mandate, an authorised representative which is established in the Union.

Amendment 52

Proposal for a regulation

Article 18 – paragraph 2 – introductory part

Text proposed by the Commission

Amendment

2. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. The mandate shall allow the authorised representative to do at least the following:

2. An authorised representative shall perform the tasks specified in the mandate agreed with the manufacturer. The mandate shall allow the authorised representative to do at least the following:

Amendment 53

Proposal for a regulation

Article 18 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of an EHR system with the essential requirements laid down in Annex II;

(b) further to a reasoned request from a market surveillance authority, provide that authority, in an official language of the Member State where the market surveillance authority is located, with all the information and documentation necessary to demonstrate the conformity of an EHR system with the essential requirements laid down in Annex II;

Amendment 54

Proposal for a regulation

Article 18 – paragraph 2 – point b a (new)

Text proposed by the Commission

Amendment

(ba) immediately inform the manufacturer if the authorised representative has a reason to believe that an EHR system presents a risk to the health or safety of natural persons or to other aspects of public interest protection or if it is aware of any serious incident involving an EHR system;

Amendment 55

Proposal for a regulation

Article 18 – paragraph 2 – point b b (new)

Text proposed by the Commission

Amendment

(bb) immediately inform the manufacturer about complaints received by users;

Amendment 56

Proposal for a regulation

Article 18 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. In case of change of the authorised representative, the detailed arrangements for the change shall address at least the following aspects:

(a) the date of termination of the mandate of the outgoing authorised representative and date of beginning of the mandate of the incoming authorised representative;

(b) the transfer of documents, including confidentiality aspects and property rights;

Amendment 57

Proposal for a regulation

Article 19 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(aa) the manufacturer is identified and an authorised representative in accordance with Article 18 has been appointed;

Amendment 58

Proposal for a regulation

Article 19 – paragraph 2 – point c

Text proposed by the Commission

Amendment

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and appropriate instructions for use.

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and by clear and complete instructions for use in accessible formats for persons with disabilities.

Amendment 59

Proposal for a regulation

Article 19 – paragraph 3

Text proposed by the Commission

Amendment

3. Importers shall indicate their name, registered trade name or registered trade mark and the address at which they can be contacted in a document accompanying the EHR system.

3. Importers shall indicate their name, registered trade name or registered trade mark, the postal and electronic address at which they can be contacted in a document accompanying the EHR system. They shall ensure that any additional label does not obscure any information on the label provided by the manufacturer.

Amendment 60

Proposal for a regulation

Article 19 – paragraph 5

Text proposed by the Commission

Amendment

5. Where an importer considers or has reason to believe that an EHR system is not in conformity with the essential requirements in Annex II, it shall not make that system available on the market until that system has been brought into conformity. The importer shall inform without undue delay the manufacturer of such EHR system and the market surveillance authorities of the Member State in which it made the EHR system available, to that effect.

5. Where an importer considers or has reason to believe that an EHR system is not in conformity with the essential requirements in Annex II, it shall not make that system available on the market until that system has been brought into conformity. The importer shall inform without undue delay the manufacturer of such EHR system and the market surveillance authorities of the Member State in which it made the EHR system available, to that effect. Where an importer considers or has reason to believe that an EHR system presents a risk to the health or safety of natural persons, it shall immediately inform the market surveillance authority of the Member State in which the importer is established, as well as the manufacturer and where applicable, the authorised representative.

Amendment 61

Proposal for a regulation

Article 19 – paragraph 7

Text proposed by the Commission

Amendment

7. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system in the official language of the Member State where the market surveillance authority is located. They shall cooperate with that authority, at its request, on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II.

7. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system in the official language of the Member State where the market surveillance authority is located. Importers shall cooperate with that authority, at its request, and with the manufacturer and, where applicable, with the manufacturer’s authorised representative on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II, or to ensure that their EHR systems are withdrawn or recalled.

Amendment 62

Proposal for a regulation

Article 19 – paragraph 7 a (new)

Text proposed by the Commission

Amendment

7a. Importers shall verify whether the communication channels referred to in Article 17(3b), are publicly available to users allowing them to submit complaints and communicate any risk related to their health and safety or to any serious incident involving an EHR system. If such channels are not available, the importer shall provide for them, taking into account accessibility needs for persons with disabilities.

Amendment 63

Proposal for a regulation

Article 19 – paragraph 7 b (new)

Text proposed by the Commission

Amendment

7b. Importers shall investigate complaints and information on incidents involving an EHR system they made available on the market and file those complaints, as well as of systems recalls and any corrective measures taken to bring the EHR system into conformity, in the register referred to in Article 17(3c) or in their own internal register. Importers shall keep the manufacturer, distributors and, where relevant, authorised representatives informed in a timely manner of the investigation performed and of the results of the investigation.

Amendment 64

Proposal for a regulation

Article 19 – paragraph 7 c (new)

Text proposed by the Commission

Amendment

7c. Personal data stored in the internal register of complaints shall only be those personal data that are necessary for the importer to investigate the complaint. Such data shall only be kept as long as it is necessary for the purpose of investigation and no longer than five years after they have been encoded.

Amendment 65

Proposal for a regulation

Article 20 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and appropriate instructions for use;

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and by clear and complete instructions for use in accessible formats for persons with disabilities;

Amendment 66

Proposal for a regulation

Article 20 – paragraph 3

Text proposed by the Commission

Amendment

3. Where a distributor considers or has reason to believe that an EHR system is not in conformity with the essential requirements laid down in Annex II, it shall not make the EHR system available on the market until it has been brought into conformity. Furthermore, the distributor shall inform without undue delay the manufacturer or the importer, as well as the market surveillance authorities of the Member states where the EHR system has been made available on the market, to that effect.

3. Where a distributor considers or has reason to believe that an EHR system is not in conformity with the essential requirements laid down in Annex II, it shall not make the EHR system available on the market until it has been brought into conformity. Furthermore, the distributor shall inform without undue delay the manufacturer or the importer, as well as the market surveillance authorities of the Member states where the EHR system has been made available on the market, to that effect. Where a distributor considers or has reason to believe that an EHR system presents a risk to the health or safety of natural persons, it shall immediately inform the market surveillance authority of the Member State in which the distributor is established, as well as the manufacturer, the importer and where applicable, the authorised representative.

Amendment 67

Proposal for a regulation

Article 20 – paragraph 4

Text proposed by the Commission

Amendment

4. Distributors shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system. They shall cooperate with that authority, at its request, on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II.

4. Distributors shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system..They shall cooperate with that authority, at its request, and with the manufacturer, the importer and, where applicable, with the manufacturer’s authorised representative on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II or to ensure that their EHR systems are withdrawn or recalled.

Amendment 68

Proposal for a regulation

Article 21 – title

Text proposed by the Commission

Amendment

Cases in which obligations of manufacturers of an EHR system apply to importers and distributors

Cases in which obligations of manufacturers of an EHR system apply to importers and distributors and other economic operators

Amendment 69

Proposal for a regulation

Article 21 – paragraph 1

Text proposed by the Commission

Amendment

An importer or distributor shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

An importer, distributor or another economic operator who makes modifications to the EHR system while deploying or using it, which lead to changes in the intended purpose and deployments recommendations for the EHR system as declared by the manufacturer, shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or substantially modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

Amendment 70

Proposal for a regulation

Article 21 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. In the event of any malfunctioning or deterioration in performance quality due to the changes made by economic operators during deployment or use of the EHR system contrary to the manufacturers’ recommendations for technical deployment of the system or purpose of its use, the economic operator shall bear full responsibility for those modifications.

Amendment 71

Proposal for a regulation

Article 21 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. Placing on the market of second-hand EHR systems, whether prepared for re-use, checked, cleaned, repaired, refurbished or without any action on the product shall not be considered as a substantial modification in line with relevant Union or national law on product safety, in case the second-hand economic operators’ interventions do not lead to changes in the intended purpose, deployments, recommendations and level of risk for the EHR system as declared by the manufacturer and the conformity with applicable requirements is not affected.

Amendment 72

Proposal for a regulation

Article 23 – paragraph 1 – subparagraph 1

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. When drafting common specifications, the Commission shall take into account the existing harmonised standards or international standards. Where relevant, the common specifications shall take into account the specificities and verify compatibility with sectorial legislation and harmonised standards of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14, including the state-of-the-art standards for health informatics and the European electronic health record exchange format. Before adopting the implementing act, the Commission shall consult the relevant European standardisation organisations and European stakeholder organisations receiving Union financing under Regulation (EU) No 1025/2012, the European Data Protection Supervisor and the European Data Protection Board where common specifications have an impact on the data protection requirements of EHR systems.

Amendment 73

Proposal for a regulation

Article 23 – paragraph 5

Text proposed by the Commission

Amendment

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications may be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications shall be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Office referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable, as well as the European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679.

Amendment 74

Proposal for a regulation

Article 23 – paragraph 6

Text proposed by the Commission

Amendment

6. Where common specifications covering interoperability and security requirements of medical devices or high-risk AI systems falling under other acts such as Regulation (EU) 2017/745 or Regulation […] [AI Act COM/2021/206 final], impact EHR systems, the adoption of those common specifications shall be preceded by a consultation with the EHDS Board, especially its subgroup for Chapters II and III of this Regulation.

6. Where common specifications covering interoperability and security requirements of medical devices or high-risk AI systems falling under other acts such as Regulation (EU) 2017/745 or Regulation […] [AI Act COM/2021/206 final], impact EHR systems, the adoption of those common specifications shall be preceded by a consultation with the EHDS Board, especially its subgroup for Chapters II and III of this Regulation, and, where applicable, the European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679).

Amendment 75

Proposal for a regulation

Article 24 – paragraph 1

Text proposed by the Commission

Amendment

1. The technical documentation shall be drawn up before the EHR system is placed on the market or put into service and shall be kept up-to-date.

1. Manufacturers shall draw up and keep up-to-date technical documentation before the EHR system is placed on the market or put into service.

Amendment 76

Proposal for a regulation

Article 24 – paragraph 2

Text proposed by the Commission

Amendment

2. The technical documentation shall be drawn up in such a way as to demonstrate that the EHR system complies with the essential requirements laid down in Annex II and provide market surveillance authorities with all the necessary information to assess the conformity of the EHR system with those requirements. It shall contain, at a minimum, the elements set out in Annex III.

2. The technical documentation shall be drawn up in such a way as to demonstrate that the EHR system complies with the essential requirements laid down in Annex II and provide market surveillance authorities with all the necessary information to assess the conformity of the EHR system with those requirements. It shall contain, at a minimum, the elements set out in Annex III. In case the system or any part of it complies with European standards or common specifications, the list of the relevant European standards and common specifications shall also be indicated.

Amendment 77

Proposal for a regulation

Article 25 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the identity, registered trade name or registered trademark, and the contact details of the manufacturer and, where applicable, of its authorised representative;

(a) the identity, registered trade name or registered trademark, and the contact details of the manufacturer, including the postal and electronic address and, where applicable, of its authorised representative;

Amendment 78

Proposal for a regulation

Article 26 – paragraph 4

Text proposed by the Commission

Amendment

4. By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the conformity of the EHR system.

4. By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance with the requirements of this Regulation.

Amendment 79

Proposal for a regulation

Article 26 – paragraph 4 a (new)

Text proposed by the Commission

Amendment

4a. The Commission is empowered to adopt delegated acts in accordance with Article 67 amending the minimum content of the EU declaration of conformity set out in Annex IV.

Amendment 80

Proposal for a regulation

Article 27 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The CE marking shall be affixed before making the EHR system available on the market.

Amendment 81

Proposal for a regulation

Article 28 – paragraph 2

Text proposed by the Commission

Amendment

2. Member States shall designate the market surveillance authority or authorities responsible for the implementation of this Chapter. They shall entrust their market surveillance authorities with the powers, resources, equipment and knowledge necessary for the proper performance of their tasks pursuant to this Regulation. Member States shall communicate the identity of the market surveillance authorities to the Commission which shall publish a list of those authorities.

2. Member States shall designate the market surveillance authority or authorities responsible for the implementation of this Chapter. They shall entrust their market surveillance authorities with the powers, human, technical and financial resources, equipment, IT tools, premises, infrastructure, knowledge and ongoing training necessary for the proper and effective performance of their tasks pursuant to this Regulation. Member States shall communicate the identity of the market surveillance authorities to the Commission which shall publish a list of those authorities.

Amendment 82

Proposal for a regulation

Article 29 – paragraph 3

Text proposed by the Commission

Amendment

3. The market surveillance authority shall immediately inform the Commission and the market surveillance authorities of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken.

3. The market surveillance authority shall immediately inform the Commission and the market surveillance authorities of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken. The market surveillance authority shall also notify and cooperate with data protection authorities.

Amendment 83

Proposal for a regulation

Article 30 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Where a market surveillance authority makes one of the following findings, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to put an end to the non-compliance concerned:

1. Where a market surveillance authority makes, inter alia, one of the following findings, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to bring the EHR system into conformity:

Amendment 84

Proposal for a regulation

Article 30 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the EHR system is not in conformity with essential requirements laid down in Annex II;

(a) the EHR system is not in conformity with essential requirements laid down in Annex II and with the common specifications in accordance with Article 23;

Amendment 85

Proposal for a regulation

Article 30 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) the technical documentation is either not available or not complete;

(b) the technical documentation is either not available or not complete, or not in accordance with Article 24;

Amendment 86

Proposal for a regulation

Article 30 – paragraph 1 – point b a (new)

Text proposed by the Commission

Amendment

(ba) the EHR system is not accompanied by the information sheet provided for in Article 25;

Amendment 87

Proposal for a regulation

Article 30 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the EU declaration of conformity has not been drawn up or has not been drawn up correctly;

(c) the EU declaration of conformity has not been drawn up or has not been drawn up correctly as referred to in Article 26;

Amendment 88

Proposal for a regulation

Article 30 – paragraph 1 – point d a (new)

Text proposed by the Commission

Amendment

(da) the registration obligations of Article 32 has not been fulfilled.

Amendment 89

Proposal for a regulation

Article 31 – paragraph 6

Text proposed by the Commission

Amendment

6. If the wellness application is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label.

6. If the wellness application is an integral part of a device or is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label. If the wellness application is embedded in a device after its putting into service, the wellness application label may be shown in the application itself.

Amendment 90

Proposal for a regulation

Article 31 – paragraph 9

Text proposed by the Commission

Amendment

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form or, upon request, in physical form.

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.

Amendment 91

Proposal for a regulation

Article 33 – paragraph 1 – point j

Text proposed by the Commission

Amendment

(j) electronic health data from clinical trials;

(j) electronic health data from fully completed or terminated clinical trials;

Amendment 92

Proposal for a regulation

Article 33 – paragraph 4

Text proposed by the Commission

Amendment

4. Electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

4. Electronic health data entailing protected intellectual property and trade secrets from health data holders shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary preserve IP rights and the confidentiality of trade secrets must be taken. The sharing of health data for secondary use including the sharing of clinical trial data, shall be shared without prejudice to existing relevant Union legislation including Directive 2004/48/EC, Directive 2001/29/EC, Directive (EU) 2016/943, Directive (EU) 2019/790 and Regulation (EU) No 536/2014.

Amendment 93

Proposal for a regulation

Article 34 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(aa) activities for reasons of public interest in cases of serious public health threats.

Amendment 94

Proposal for a regulation

Article 34 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) development and innovation activities for products or services contributing to public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices;

(f) development and innovation activities for products or services contributing to public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices, including supporting operational efficiency, improving the patient pathway and post-market monitoring to identify side effects and adverse events;

Amendment 95

Proposal for a regulation

Article 34 – paragraph 1 – point f a (new)

Text proposed by the Commission

Amendment

(fa) development and innovation activities for products or services, including health economics and health outcomes research studies;

Amendment 96

Proposal for a regulation

Article 37 – paragraph 1 – point i

Text proposed by the Commission

Amendment

(i) support the development of AI systems, the training, testing and validating of AI systems and the development of harmonised standards and guidelines under Regulation […] [AI Act COM/2021/206 final] for the training, testing and validation of AI systems in health;

(i) the data access bodies shall support with expertise the development of AI systems, the training, testing and validating of AI systems and the development of harmonised standards and guidelines under Regulation […] [AI Act COM/2021/206 final] for the training, testing and validation of AI systems in health.

Amendment 97

Proposal for a regulation

Article 41 – paragraph 1

Text proposed by the Commission

Amendment

1. Where a data holder is obliged to make electronic health data available under Article 33 or under other Union law or national legislation implementing Union law, it shall cooperate in good faith with the health data access bodies, where relevant.

1. A data holder is obliged to make electronic health data available under Article 33 or under other Union law or national legislation implementing Union law, it shall cooperate in a methodical and supervised process with the health data access bodies and other involved actors.

Amendment 98

Proposal for a regulation

Article 42 – paragraph 1

Text proposed by the Commission

Amendment

1. Health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. Any fees shall include and be derived from the costs related to conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final]

1. Health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. Any fees shall be proportionate in relation to the costs related to conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final]

Amendment 99

Proposal for a regulation

Article 44 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. The Commission shall, by means of an implementing act, set out rules for risk-based anonymisation methodology, taking into consideration risk factors such as type of use, the safeguards in place, probability of re-identification of patients, sensitivity of type of data.

Amendment 100

Proposal for a regulation

Article 46 – paragraph 11

Text proposed by the Commission

Amendment

11. Data users shall make public the results or output of the secondary use of electronic health data, including information relevant for the provision of healthcare, no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in Article 47. Those results or output shall only contain anonymised data. The data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. Whenever the data users have used electronic health data in accordance with this Chapter, they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the EHDS.

11. Data users shall make public the results or output of the secondary use of electronic health data, including information relevant for the provision of healthcare, no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in Article 47. Those results or output shall only contain anonymised data. The data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites without prejudice to IP rights and relevant Union law. Whenever the data users have used electronic health data in accordance with this Chapter, they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the EHDS.

Amendment 101

Proposal for a regulation

Article 49 – paragraph 1

Text proposed by the Commission

Amendment

1. Where an applicant requests access to electronic health data only from a single data holder in a single Member State, by way of derogation from Article 45(1), that applicant may file a data access application or a data request directly to the data holder. The data access application shall comply with the requirements set out in Article 45 and the data request shall comply with requirements in Article 47. Multi-country requests and requests requiring a combination of datasets from several data holders shall be adressed to health data access bodies.

1. Where an applicant requests access to electronic health data only from a single data holder in a single Member State, by way of derogation from Article 45(1), that applicant may file a data access application or a data request directly to the data holder. The applicant may file a data access application or a data request also by other means of sharing health data using existing infrastructures and registries that have established data flows, technical architectures, governance models and data access. The Regulation shall not impede existing data sharing initiatives already in place in Union and Member States in order to enhance the interoperability and data exchange in the internal market. The data access application shall comply with the requirements set out in Article 45 and the data request shall comply with requirements in Article 47. Multi-country requests and requests requiring a combination of datasets from several data holders may be adressed to health data access bodies.

Amendment 102

Proposal for a regulation

Article 64 – paragraph 1

Text proposed by the Commission

Amendment

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor may be invited to the meetings, where the issues discussed are of relevance for them. The Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor shall be invited to the meetings. The Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

Amendment 103

Proposal for a regulation

Article 65 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the primary use of electronic health data;

Amendment 104

Proposal for a regulation

Article 65 – paragraph 1 – point e b (new)

Text proposed by the Commission

Amendment

(eb) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the secondary use of electronic health data.

Amendment 105

Proposal for a regulation

Article 67 – paragraph 4

Text proposed by the Commission

Amendment

4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making.

4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State and relevant stakeholders, in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making.

Amendment 106

Proposal for a regulation

Article 68 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. In accordance with the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making, the Commission shall make use of expert groups, consult targeted stakeholders and carry out public consultations to gather broader expertise in the early preparation of draft implementing acts.

Amendment 107

Proposal for a regulation

Article 69 – paragraph 1

Text proposed by the Commission

Amendment

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties shall be effective, proportionate and dissuasive. Member States shall notify the Commission of those rules and measures by date of application of this Regulation and shall notify the Commission without delay of any subsequent amendment affecting them.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. The penalties shall be effective, proportionate and dissuasive. Member States shall notify the Commission of those rules and measures by date of application of this Regulation and shall notify the Commission without delay of any subsequent amendment affecting them.

Amendment 108

Proposal for a regulation

Article 69 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. Penalties shall cover infringements not addressed by Regulation (EU) 2017/745, Regulation (EU) 2017/746, Regulation (EU) No 536/2014 and Regulation (EU) 2016/679 and shall depend on the circumstances of each individual case. When deciding whether to impose a penalty and deciding on the amount of the penalty in each individual case, due regard shall be given to the criteria stated in Article 83(2) of Regulation (EU) 2016/679, where applicable.

Amendment 109

Proposal for a regulation

Article 69 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. Penalties shall at least include fines proportionate to the extent of non-compliance and to the turnover of the relevant economic operator. Fines shall be calculated in such a way as to make sure that they effectively deprive the economic operator of the economic benefits derived from their infringements. Fines shall be gradually increased for repeated infringements.

Amendment 110

Proposal for a regulation

Article 69 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

1c. If the EHR system provider or data holder intentionally or negligently, for the same or linked operations, infringes several provisions of this Regulation, the total amount of the penalty shall not exceed the amount specified for the gravest infringement.

Amendment 111

Proposal for a regulation

Article 69 – paragraph 1 d (new)

Text proposed by the Commission

Amendment

1d. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including effective judicial remedy and due process.

Amendment 112

Proposal for a regulation

Article 69 – paragraph 1 e (new)

Text proposed by the Commission

Amendment

1e. Where the law of the Member State does not provide for penalties, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the penalties imposed by supervisory authorities.

Amendment 113

Proposal for a regulation

Article 69 – paragraph 1 f (new)

Text proposed by the Commission

Amendment

1f. Member States shall ensure that any decision containing penalties related to the breach of the provisions of this Regulation is published no later than one month after the penalty is imposed.

Amendment 114

Proposal for a regulation

Article 70 – paragraph 1

Text proposed by the Commission

Amendment

1. After 5 years from the entry into force of this Regulation, the Commission shall carry out a targeted evaluation of this Regulation especially with regards to Chapter III, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The evaluation shall include an assessment of the self-certification of EHR systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies.

1. After 5 years from the entry into force of this Regulation, the Commission shall carry out a targeted evaluation of this Regulation especially with regards to Chapter III, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The evaluation shall include an assessment of:

(a) the effectiveness of self-certification of EHR systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies or any other measure to facilitate market surveillance of EHR systems and ensure the functioning of the market; Member States shall provide the data and information necessary to conduct a thorough assessment;

(b) impacts of EHR systems on health outcomes for patients;

(c) impacts of EHR systems on healthcare economic performance;

(d) security, resilience and flexibility of the EHR systems and secondary data sharing framework in order to assess the readiness for potential future crisis;

(e) interoperability model in place in Member States, including best practices analysis;

(f) quality and coverage of access of health professionals to the medical records of patients per Member State, including impact on reduction of duplications and errors and reduction of administration time and costs;

(g) overlaps and incoherences with other Union and national legislation, including the quantification of related extra costs of overlaps and related regulatory uncertainty. Inter alia, the assessment shall analyse alignment with the General Data Protection Regulation, Data Governance Act, Data Act, AI Act and Regulations on cybersecurity.

Amendment 115

Proposal for a regulation

Article 70 – paragraph 2

Text proposed by the Commission

Amendment

2. After 7 years from the entry into force of this Regulation, the Commission shall carry out an overall evaluation of this Regulation, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment.

2. After 7 years from the entry into force of this Regulation, the Commission shall carry out an overall evaluation of this Regulation, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The overall evaluation shall also identify best practices and assess the health outcomes for patients and consumers resulting from implementation of the EHDS.

Amendment 116

Proposal for a regulation

Article 70 – paragraph 3

Text proposed by the Commission

Amendment

3. Member States shall provide the Commission with the information necessary for the preparation of that report.

3. Member States shall provide the Commission with the information necessary for the preparation of that report and shall report to the Commission on the common indicators.

Amendment 117

Proposal for a regulation

Article 70 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. The Commission shall be empowered to adopt, by ... [12 months after the date of entry into force of this Regulation], delegated acts to supplement this Regulation in order to

(a) set out the common result and impact oriented indicators to be used for reporting on the progress and for the purpose of monitoring and evaluation of this Regulation;

(b) measure the costs, benefits and other health and economic results including trends per Member State in order to compare the effectiveness of implementation of this Regulation; and

(c) define a methodology for reporting by Member States.

The Commission shall regularly revise and, if necessary, update the common indicators.

Amendment 118

Proposal for a regulation

Article 72 – paragraph 3 – point a

Text proposed by the Commission

Amendment

(a) from 1 year after date of entry into application to categories of personal electronic health data referred to in Article 5(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data.;

(a) from 3 years after date of entry into application to categories of personal electronic health data referred to in Article 5(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data;

Amendment 119

Proposal for a regulation

Annex II – point 3 – point 3.1

Text proposed by the Commission

Amendment

3.1. An EHR system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data, and that it prevents unauthorised access to such data.

3.1. An EHR system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data, and that it prevents unauthorised access to such data, and that it duly takes into consideration the principles of data minimization and data protection by design.

Amendment 120

Proposal for a regulation

Annex II – point 3 – point 3.8

Text proposed by the Commission

Amendment

3.8. An EHR system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data.

3.8. An EHR system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data and the specific purpose of the data processing operations.

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:

Entity and/or person

DIGITALEUROPE

COCIR

EDPB

EDPS

BEUC

Medtech Europe

Roche

AmCham

European Cancer Organisation

EURORDIS

France Digitale

EFPIA

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

European Health Data Space

References

COM(2022)0197 – C9-0167/2022 – 2022/0140(COD)

Committees responsible

Date announced in plenary

ENVI

6.6.2022

LIBE

6.6.2022

Opinion by

Date announced in plenary

IMCO

6.6.2022

Associated committees - date announced in plenary

16.2.2023

Rapporteur for the opinion

Date appointed

Andrey Kovatchev

8.7.2022

Rule 58 – Joint committee procedure

Date announced in plenary

16.2.2023

Discussed in committee

1.3.2023

28.3.2023

25.4.2023

Date adopted

23.5.2023

Result of final vote

+:

–:

0:

39

0

1

Members present for the final vote

Alex Agius Saliba, Andrus Ansip, Alessandra Basso, Adam Bielan, Biljana Borzan, Vlad-Marius Botoş, Anna Cavazzini, Dita Charanzová, Deirdre Clune, David Cormand, Alexandra Geese, Sandro Gozi, Krzysztof Hetman, Eugen Jurzyca, Arba Kokalari, Kateřina Konečná, Andrey Kovatchev, Maria-Manuel Leitão-Marques, Morten Løkkegaard, Adriana Maldonado López, Leszek Miller, Anne-Sophie Pelletier, Christel Schaldemose, Andreas Schwab, Tomislav Sokol, Ivan Štefanec, Róża Thun und Hohenstein, Tom Vandenkendelaere, Marion Walsmann

Substitutes present for the final vote

Marc Angel, Anna-Michelle Asimakopoulou, Christian Doleschal, Carlo Fidanza, Claude Gruffat, Ivars Ijabs, Katrin Langensiepen, Antonio Maria Rinaldi, Edina Tóth

Substitutes under Rule 209(7) present for the final vote

Elisabetta Gualmini, Francisco José Millán Mon

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols: