What changed

From · act followup · 2024-08-08 SP-2024-394-TA-9-2023-0462 Follow up to T9-0462/2023

→

To · opinion parliamentary committee · 2023-05-23 ITRE-AD-742310 on the proposal for a regulation of the European Parliament and of the Council on European Health Data Space

+552 added · −7 removed · 1 modified paragraphs hide unchanged text

~~ORDINARY LEGISLATIVE procedure~~

PA_Legam

~~Follow up to the European Parliament legislative resolution on the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space~~

SHORT JUSTIFICATION

~~1. Rapporteur: Tomislav SOKOL (EPP / HR), Annalisa TARDINO (ID / IT)~~

The Rapporteur supports many elements of the European Health Data Space (EHDS) initiative, especially the provisions aimed at providing better health outcomes and promoting health innovation and research. The Rapporteur believes that the availability of cross-border health data can significantly improve patient care and contribute to more effective health policies at a European level. The Rapporteur also believes that this proposal can lead to significant benefits for individuals, patients, healthcare professionals, and society as a whole. Additionally, the Rapporteur supports this proposal as it can boost research and innovation, support the development of new drugs, devices, and treatments, and increase the efficiency and sustainability of healthcare systems.

~~2. Reference numbers: 2022/0140 (COD) / A9-0395/2023 / P9_TA(2024)0331~~

However, the Rapporteur is of the opinion that some changes are necessary to ensure the success of the initiative. The Rapporteur believes that a prudent implementation of the GDPR is necessary to avoid unnecessary restrictions for health research and data sharing, key to apply artificial intelligence and machine learning tools to research, and to enabling the digital transformation of healthcare, to tackle disparities in prevention, diagnosis, and treatment around Europe. The EHDS will be a critical tool in managing and sharing health data across the European Union, but it must do so in a way that respects the privacy and rights of patients. As contact person for the EMA, the Rapporteur understands that the EMA and other regulatory authorities, such as national medicines’ agencies need to be seen and treated differently from all other data users in EHDS. The legal proposal already foresees this by recognizing regulatory authorities’ needs, and the Rapporteur further strengthens the text by allowing better informed regulatory decision making on benefits and risks of medicinal products, robust and speed up regulatory assessment of new medicinal products with the goal of making them faster available to patients and enhanced tools and processes available to monitor safety and effectiveness of medicines to the benefit of EU patients. Furthermore, the Rapporteur thinks that in order for health data to be useful across different systems, it is essential that we establish interoperable and common rules and standards. This means that data should be able to be exchanged seamlessly between different health systems, regardless of the platform or software used. Therefore, the Rapporteur opinion also underline that the lack of standardization in health data is a major obstacle to interoperability.

~~3. Date of adoption of the resolution: 24 April 2024~~

Finally, the Rapporteur is of the opinion that EHDS should build upon the already existing legislation such as the Data Governance Act and Data Act. These acts provide a solid foundation for the governance and management of health data, and we should work to align our efforts with their provisions. By doing so, the Rapporteur wants to ensure that the collection, processing, and use of health data is conducted in a responsible and transparent manner, while also protecting the privacy and security of individuals.

~~4. Legal basis: Articles 16 and 114 of the Treaty on the Functioning of the European Union~~

AMENDMENTS

~~5. Competent Parliamentary Committee:~~The Committee on ~~Environment, Public~~Industry, ~~Health~~Research and ~~Food~~Energy ~~Safety~~calls ~~(ENVI),~~on the Committee on Civil Liberties, Justice and Home ~~Affairs~~Affairs, ~~(LIBE)~~as the committee responsible, to take into account the following amendments:

~~6. Commission's position: accepts all amendments.~~

Amendment 1

Proposal for a regulation

Recital 1 a (new)

Text proposed by the Commission

Amendment

(1a) The EHDS is a crucial element in establishing a robust and durable European Health Union that can effectively safeguard the well-being of European citizens and improve resilience of Union health systems.

Amendment 2

Proposal for a regulation

Recital 1 b (new)

Text proposed by the Commission

Amendment

(1b) In order to effectively implement the EHDS, it is important that this Regulation is aligned and coordinated horizontally with other Union legislative acts and programmes, including the Digital Europe Programme, Connecting Europe Facility and Horizon Europe.

Amendment 3

Proposal for a regulation

Recital 1 c (new)

Text proposed by the Commission

Amendment

(1c) To enhance data interoperability and contribute to achieving the objectives of Article 9 of Regulation (EU) 2016/679, it is imperative that Member States cooperate when using common standards alongside the European Digital Identity.

Amendment 4

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) The processing of personal electronic health data is subject to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council43 and, for Union institutions and bodies, Regulation (EU) 2018/1725 of the European Parliament and of the Council44. References to the provisions of Regulation (EU) 2016/679 should be understood also as references to the corresponding provisions of Regulation (EU) 2018/1725 for Union institutions and bodies, where relevant.

_________________

43 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

44 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

Amendment 5

Proposal for a regulation

Recital 17

Text proposed by the Commission

Amendment

(17) The relevance of different categories of electronic health data for different healthcare scenarios varies. Different categories have also achieved different levels of maturity in standardisation, and therefore the implementation of mechanisms for their exchange may be more or less complex depending on the category. Therefore, the improvement of interoperability and data sharing should be gradual and prioritisation of categories of electronic health data is needed. Categories of electronic health data such as patient summary, electronic prescription and dispensation, laboratory results and reports, hospital discharge reports, medical images and reports have been selected by the eHealth Network as most relevant for the majority of healthcare situations and should be considered as priority categories for Member States to implement access to them and their transmission. When further needs for the exchange of more categories of electronic health data are identified for healthcare purposes, the list of priority categories should be expanded. The Commission should be empowered to extend the list of priority categories, after analysing relevant aspects related to the necessity and possibility for the exchange of new datasets, such as their support by systems established nationally or regionally by the Member States. Particular attention should be given to the data exchange in border regions of neighbouring Member States where the provision of cross-border health services is more frequent and needs even quicker procedures than across the Union in general.

(17) The relevance of different categories of electronic health data for different healthcare scenarios varies. Different categories have also achieved different levels of maturity in standardisation, and therefore the implementation of mechanisms for their exchange may be more or less complex depending on the category. In order to advance the maturity of European standardisation and harmonisation, specifications should be established through a collaborative and inclusive process, that is appropriate to achieve policy goals. This includes ensuring coherence with different data spaces and initiatives and their subsequent standards. Therefore, the improvement of interoperability and data sharing should be gradual and prioritisation of categories of electronic health data is needed. Categories of electronic health data such as patient summary, electronic prescription and dispensation, laboratory results and reports, hospital discharge reports, medical images and reports have been selected by the eHealth Network as most relevant for the majority of healthcare situations and should be considered as priority categories for Member States to implement access to them and their transmission. When further needs for the exchange of more categories of electronic health data are identified for healthcare purposes, the list of priority categories should be expanded. The Commission should be empowered to extend the list of priority categories, after analysing relevant aspects related to the necessity and possibility for the exchange of new datasets, such as their support by systems established nationally or regionally by the Member States. Particular attention should be given to the data exchange in border regions of neighbouring Member States where the provision of cross-border health services is more frequent and needs even quicker procedures than across the Union in general.

Amendment 6

Proposal for a regulation

Recital 27 a (new)

Text proposed by the Commission

Amendment

(27a) EHDS uses European and national electronic health record systems, databases, and registries. While obligations as regards EHR systems are laid down in this Regulation, further research into the digital technology behind those systems is needed to support Europe's leadership in health data usage and to promote innovation.

Amendment 7

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system, within the meaning of this Regulation. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

_________________

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

Amendment 8

Proposal for a regulation

Recital 40

Text proposed by the Commission

Amendment

(40) The data holders can be public, non for profit or private health or care providers, public, non for profit and private organisations, associations or other entities, public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. In order to avoid a disproportionate burden on small entities, micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of EHDS. The public or private entities often receive public funding, from national or Union funds to collect and process electronic health data for research, statistics (official or not) or other similar purposes, including in area where the collection of such data is fragmented of difficult, such as rare diseases, cancer etc. Such data, collected and processed by data holders with the support of Union or national public funding, should be made available by data holders to health data access bodies, in order to maximise the impact of the public investment and support research, innovation, patient safety or policy making benefitting the society. In some Member States, private entities, including private healthcare providers and professional associations, play a pivotal role in the health sector. The health data held by such providers should also be made available for secondary use. At the same time, data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. However, public authorities and regulators should have access to such data, for instance in the event of pandemics, to verify defective devices and protect human health. In times of severe public health concerns (for example, PIP breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. The COVID-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. Such data should be made available for public and regulatory activities, supporting public bodies to carry out their legal mandate, while complying with, where relevant and possible, the protection enjoyed by commercial data. Specific rules in relation to the secondary use of health data should be provided. Data altruism activities may be carried out by different entities, in the context of Regulation […] [Data Governance Act COM/2020/767 final] and taking into account the specificities of the health sector.

(40) The data holders can be public, non for profit or private health or care providers, public, non for profit and private organisations, associations or other entities, public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. In order to avoid a disproportionate burden on small entities, micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of EHDS. The public or private entities often receive public funding, from national or Union funds to collect and process electronic health data for research, statistics (official or not) or other similar purposes, including in area where the collection of such data is fragmented of difficult, such as rare diseases, cancer etc. Such data, collected and processed by data holders with the support of Union or national public funding, should be made available by data holders to health data access bodies, in order to maximise the impact of the public investment and support research, innovation, patient safety or policy making benefitting the society. In some Member States, private entities, including private healthcare providers and professional associations, play a pivotal role in the health sector. The health data held by such providers should also be made available for secondary use. At the same time, data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection, which should be treated accordingly, in the context of the TRIPS Agreement and Directive (EU) 2016/943. However, public authorities and regulators should have access to such data, for instance in the event of pandemics, to verify defective devices and protect human health. In times of severe public health concerns (for example, PIP breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. The COVID-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. Such data should be made available for public and regulatory activities, supporting public bodies to carry out their legal mandate, while complying with, where relevant and possible, the protection enjoyed by commercial data. Specific rules in relation to the secondary use of health data should be provided. Data altruism activities may be carried out by different entities, in the context of Regulation […] [Data Governance Act COM/2020/767 final] and taking into account the specificities of the health sector.

Amendment 9

Proposal for a regulation

Recital 41

Text proposed by the Commission

Amendment

(41) The secondary use of health data under EHDS should enable the public, private, not for profit entities, as well as individual researchers to have access to health data for research, innovation, policy making, educational activities, patient safety, regulatory activities or personalised medicine, in line with the purposes set out in this Regulation. Access to data for secondary use should contribute to the general interest of the society. Activities for which access in the context of this Regulation is lawful may include using the electronic health data for tasks carried out by public bodies, such as exercise of public duty, including public health surveillance, planning and reporting duties, health policy making, ensuring patient safety, quality of care, and the sustainability of health care systems. Public bodies and Union institutions, bodies, offices and agencies may require to have regular access to electronic health data for an extended period of time, including in order to fulfil their mandate, which is provided by this Regulation. Public sector bodies may carry out such research activities by using third parties, including sub-contractors, as long as the public sector body remain at all time the supervisor of these activities. The provision of the data should also support activities related to scientific research (including private research), development and innovation, producing goods and services for the health or care sectors, such as innovation activities or training of AI algorithms that could protect the health or care of natural persons. In some cases, the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. There is a need for public bodies to go beyond the emergency scope of Chapter V of Regulation […] [Data Act COM/2022/68 final]. However, the public sector bodies may request the support of health data access bodies for processing or linking data. This Regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law, but does not extend the mandate of such public sector bodies. Any attempt to use the data for any measures detrimental to the natural person, to increase insurance premiums, to advertise products or treatments, or develop harmful products should be prohibited.

(41) The secondary use of health data under EHDS should enable the public, private, not for profit entities, as well as individual researchers to have access to health data for research, innovation, policy making, educational activities, patient safety, regulatory activities or personalised medicine, in line with the purposes set out in this Regulation. Access to data for secondary use should contribute to the general interest of the society. Access to secondary health data for research and innovation should also aim to contribute to affordable and fair pricing for all European citizens when resulting products or services are placed on the market. Activities for which access in the context of this Regulation is lawful may include using the electronic health data for tasks carried out by public bodies, such as exercise of public duty, including public health surveillance, planning and reporting duties, health policy making, ensuring patient safety, quality of care, and the sustainability of health care systems. Public bodies and Union institutions, bodies, offices and agencies may require to have regular access to electronic health data for an extended period of time, including in order to fulfil their mandate, which is provided by this Regulation. Public sector bodies may carry out such research activities by using third parties, including sub-contractors, as long as the public sector body remain at all time the supervisor of these activities. The provision of the data should also support activities related to scientific research (including private research), development and innovation, producing goods and services for the health or care sectors, such as innovation activities or training of AI algorithms that could protect the health or care of natural persons. In some cases, the information of some natural persons (such as genomic information of natural persons with a certain disease) could support the diagnosis or treatment of other natural persons. There is a need for public bodies to go beyond the emergency scope of Chapter V of Regulation […] [Data Act COM/2022/68 final]. However, the public sector bodies may request the support of health data access bodies for processing or linking data. This Regulation provides a channel for public sector bodies to obtain access to information that they require for fulfilling their tasks assigned to them by law, but does not extend the mandate of such public sector bodies. Any attempt to use the data for any measures detrimental to the natural person, to increase insurance premiums, to advertise products or treatments, or develop harmful products should be prohibited.

Amendment 10

Proposal for a regulation

Recital 43

Text proposed by the Commission

Amendment

(43) The health data access bodies should monitor the application of Chapter IV of this Regulation and contribute to its consistent application throughout the Union. For that purpose, the health data access bodies should cooperate with each other and with the Commission, without the need for any agreement between Member States on the provision of mutual assistance or on such cooperation. The health data access bodies should also cooperate with stakeholders, including patient organisations. Since the secondary use of health data involves the processing of personal data concerning health, the relevant provisions of Regulation (EU) 2016/679 apply and the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 should be tasked with enforcing these rules. Moreover, given that health data are sensitive data and in a duty of loyal cooperation, the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use, including penalties. In addition to the tasks necessary to ensure effective secondary use of health data, the health data access body should strive to expand the availability of additional health datasets, support the development of AI in health and promote the development of common standards. They should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed, including techniques for pseudonymisation, anonymisation, generalisation, suppression and randomisation of personal data. Health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. This includes rules for anonymization of microdata sets.

(43) The health data access bodies should monitor the application of Chapter IV of this Regulation and contribute to its consistent application throughout the Union. For that purpose, the health data access bodies should cooperate cross-border with each other and with the Commission, inter alia by adopting a convergent approach with regard to common definitions and techniques, without the need for any agreement between Member States on the provision of mutual assistance or on such cooperation. The health data access bodies should also cooperate with stakeholders, including patient organisations. Since the secondary use of health data involves the processing of personal data concerning health, the relevant provisions of Regulation (EU) 2016/679 apply and the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 should be tasked with enforcing these rules. Moreover, given that health data are sensitive data and in a duty of loyal cooperation, the health data access bodies should inform the data protection authorities of any issues related to the data processing for secondary use, including penalties. In addition to the tasks necessary to ensure effective secondary use of health data, the health data access body should strive to expand the availability of additional health datasets, support the development of AI in health and promote the development of common standards. They should apply tested techniques that ensure electronic health data is processed in a manner that preserves the privacy of the information contained in the data for which secondary use is allowed, including techniques for pseudonymisation, anonymisation, generalisation, suppression and randomisation of personal data. Health data access bodies can prepare datasets to the data user requirement linked to the issued data permit. This includes rules for anonymization of microdata sets.

Amendment 11

Proposal for a regulation

Recital 53

Text proposed by the Commission

Amendment

(53) For requests to access electronic health data from a single data holder in a single Member State and in order to alieviate the administrative burden for heath data access bodies of managing such request, the data user should be able to request this data directly from the data holder and the data holder should be able to issue a data permit while complying with all the requirements and safeguards linked to such request and permit. Multi-country requests and requests requiring combination of datasets from several data holders should always be channelled through health data access bodies. The data holder should report to the health data access bodies about any data permits or data requests they provide.

deleted

Amendment 12

Proposal for a regulation

Recital 54

Text proposed by the Commission

Amendment

(54) Given the sensitivity of electronic health data, data users should not have an unrestricted access to such data. All secondary use access to the requested electronic health data should be done through a secure processing environment. In order to ensure strong technical and security safeguards for the electronic health data, the health data access body or, where relevant, single data holder should provide access to such data in a secure processing environment, complying with the high technical and security standards set out pursuant to this Regulation. Some Member States took measures to locate such secure environments in Europe. The processing of personal data in such a secure environment should comply with Regulation (EU) 2016/679, including, where the secure environment is managed by a third party, the requirements of Article 28 and, where applicable, Chapter V. Such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. The health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. Only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. Thus, it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. The Commission should assist the Member State in developing common security standards in order to promote the security and interoperability of the various secure environments.

(54) Given the sensitivity of electronic health data, data users should not have an unrestricted access to such data. All secondary use access to the requested electronic health data should be done through a secure processing environment. In order to ensure strong technical and security safeguards for the electronic health data, the health data access body or, where relevant, single data holder should provide access to such data in a secure processing environment, complying with the high technical and security standards set out pursuant to this Regulation. The requirements for secure processing environment should achieve the best possible security, while taking into account functionality and technical feasibility and building on existing best practices. Some Member States took measures to locate such secure environments in Europe. The processing of personal data in such a secure environment should comply with Regulation (EU) 2016/679, including, where the secure environment is managed by a third party, the requirements of Article 28 and, where applicable, Chapter V. Such secure processing environment should reduce the privacy risks related to such processing activities and prevent the electronic health data from being transmitted directly to the data users. The health data access body or the data holder providing this service should remain at all time in control of the access to the electronic health data with access granted to the data users determined by the conditions of the issued data permit. Only non-personal electronic health data which do not contain any electronic health data should be extracted by the data users from such secure processing environment. Thus, it is an essential safeguard to preserve the rights and freedoms of natural persons in relation to the processing of their electronic health data for secondary use. The Commission should assist the Member State in developing common security standards in order to promote the security and interoperability of the various secure environments.

Amendment 13

Proposal for a regulation

Recital 61 a (new)

Text proposed by the Commission

Amendment

(61a) One year after the date of entry into force of this Regulation, the Commission should conduct a public study, examining the impact of this Regulation on various types of research studies. That study should include recommendations in order to solve any problems identified during that study.

Amendment 14

Proposal for a regulation

Recital 63

Text proposed by the Commission

Amendment

(63) The use of funds should also contribute to attaining the objectives of the EHDS. Public procurers, national competent authorities in the Member States, including digital health authorities and health data access bodies, as well as the Commission should make references to applicable technical specifications, standards and profiles on interoperability, security and data quality, as well as other requirements developed under this Regulation when defining the conditions for public procurement, calls for proposals and allocation of Union funds, including structural and cohesion funds. Union funds are to be distributed adequately among the Member States taking into account different levels of health system digitalisation and the costs involved in making national data infrastructures interoperable and compatible with the requirements of the EHDS.

Amendment 15

Proposal for a regulation

Recital 64

Text proposed by the Commission

Amendment

(64) Certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal, as already specifically foreseen in the Data Governance Act. Even in situations of the use of state of the art anonymization techniques, there remains a residual risk that the capacity to re-identify could be or become available, beyond the means reasonably likely to be used. Such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the Union), where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. It can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects, the number of people affected or and for instance in cases of data included in electronic health records, disease registries, biobanks, person generated data etc. where the identification characteristics are broader and where, in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation, can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. The realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this Regulation at risk. Furthermore, aggregation techniques are less tested for non-personal data containing for example trade secrets, as in the reporting on clinical trials, and enforcement of breaches of trade secrets outside the Union is more difficult in the absence of a sufficient international protection standard. Therefore, for these types of health data, there remains a risk for re-identification after the anonymisation or aggregation, which could not be reasonably mitigated initially. This falls within the criteria indicated in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final]. These types of health data would thus fall within the empowerment set out in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final] for transfer to third countries. The protective measures, proportional to the risk of re-identification, would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the Delegated Act under the empowerment set out in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final].

(64) Certain categories of electronic health data can remain particularly sensitive even when they are in anonymised format and thus non-personal, as already specifically foreseen in the Data Governance Act. Even in situations of the use of state of the art anonymization techniques, there remains a residual risk that the capacity to re-identify could be or become available, beyond the means reasonably likely to be used. Such residual risk is present in relation to rare diseases (a life-threatening or chronically debilitating condition affecting not more than five in 10 thousand persons in the Union), where the limited numbers of case reduce the possibility to fully aggregate the published data in order to preserve the privacy of natural persons while also maintaining an appropriate level of granularity in order to remain meaningful. It can affect different types of health data depending on the level of granularity and description of the characteristics of data subjects, the number of people affected or and for instance in cases of data included in electronic health records, disease registries, biobanks, person generated data etc. where the identification characteristics are broader and where, in combination with other information (e.g. in very small geographical areas) or through the technological evolution of methods which had not been available at the moment of anonymisation, can lead to the re-identification of the data subjects using means that are beyond those reasonably likely to be used. The realisation of such risk of re-identification of natural persons would present a major concern and is likely to put the acceptance of the policy and rules on secondary use provided for in this Regulation at risk. This underlines the need for a harmonised interpretation of anonymisation and application of pseudonymisation across the Member States. Furthermore, aggregation techniques are less tested for non-personal data containing for example trade secrets, as in the reporting on clinical trials, and enforcement of breaches of trade secrets outside the Union is more difficult in the absence of a sufficient international protection standard. Therefore, for these types of health data, there remains a risk for re-identification after the anonymisation or aggregation, which could not be reasonably mitigated initially. This falls within the criteria indicated in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final]. These types of health data would thus fall within the empowerment set out in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final] for transfer to third countries. The protective measures, proportional to the risk of re-identification, would need to take into account the specificities of different data categories or of different anonymization or aggregation techniques and will be detailed in the context of the Delegated Act under the empowerment set out in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final].

Amendment 16

Proposal for a regulation

Article 1 – paragraph 1

Text proposed by the Commission

Amendment

1. This Regulation establishes the European Health Data Space (‘EHDS’) by providing for rules, common standards and practices, infrastructures and a governance framework for the primary and secondary use of electronic health data.

1. This Regulation establishes the European Health Data Space (‘EHDS’) by providing for rules, common and interoperable standards, harmonised practices and infrastructures and a governance framework for the primary and secondary use of electronic health data.

Amendment 17

Proposal for a regulation

Article 1 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) strengthens the rights of natural persons in relation to the availability and control of their electronic health data;

(a) strengthens the rights of natural persons in relation to the availability, sharing and control of their electronic health data;

Amendment 18

Proposal for a regulation

Article 1 – paragraph 3 – point b

Text proposed by the Commission

Amendment

(b) controllers and processors established in the Union processing electronic health data of Union citizens and third-country nationals legally residing in the territories of Member States;

(b) controllers and processors established in the Union processing personal electronic health data of Union citizens and third-country nationals legally residing in the territories of Member States;

Amendment 19

Proposal for a regulation

Article 1 – paragraph 3 – point d

Text proposed by the Commission

Amendment

(d) data users to whom electronic health data are made available by data holders in the Union.

(d) data recipients and users to whom electronic health data are made available by data holders in the Union.

Amendment 20

Proposal for a regulation

Article 2 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals, involving the exchange of information and knowledge without changing the content of the data between these organisations, software applications or devices, through the processes they support;

(f) ‘interoperability’ means the ability of organisations as well as software applications or devices from the same manufacturer or different manufacturers to interact towards mutually beneficial goals, using commonly accepted standards and data formats, involving the exchange of information and knowledge without changing the content or quality of the data between these organisations, software applications or devices, through the processes they support, enabling data portability across data holders and health care providers for data recipients and data users, and without effort from the end user;

Amendment 21

Proposal for a regulation

Article 2 – paragraph 2 – point g

Text proposed by the Commission

Amendment

(g) ‘European electronic health record exchange format’ means a structured, commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications, devices and healthcare providers;

(g) ‘European electronic health record exchange format’ means a structured, standardised, commonly used and machine-readable format that allows transmission of personal electronic health data between different software applications, devices and healthcare providers;

Amendment 22

Proposal for a regulation

Article 2 – paragraph 2 – point ae a (new)

Text proposed by the Commission

Amendment

(aea) ‘data sharing’ means data sharing as defined in Article 2, point (10), of Regulation (EU) 2022/868;

Amendment 23

Proposal for a regulation

Article 2 – paragraph 2 – point ae b (new)

Text proposed by the Commission

Amendment

(aeb) 'pseudonymisation' means pseudonymisation as defined in Article 4, point (5), of Regulation (EU) 2016/679.

Amendment 24

Proposal for a regulation

Article 9 – paragraph 2

Text proposed by the Commission

Amendment

2. The Commission shall, by means of implementing acts, determine the requirements for the interoperable, cross-border identification and authentication mechanism for natural persons and health professionals, in accordance with Regulation (EU) No 910/2014 as amended by [COM(2021) 281 final]. The mechanism shall facilitate the transferability of electronic health data in a cross-border context. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

2. The Commission shall adopt delegated acts in accordance with Article 67 supplementing this Regulation by laying down the requirements for the interoperable, cross-border identification and authentication mechanism for natural persons and health professionals, in accordance with Regulation (EU) No 910/2014 as amended by [COM(2021) 281 final]. The mechanism shall facilitate the secure transferability of electronic health data in a cross-border context.

Amendment 25

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission

Amendment

3. The Commission shall implement services required by the interoperable, cross-border identification and authentication mechanism referred to in paragraph 2 of this Article at Union level, as part of the cross-border digital health infrastructure referred to in Article 12(3).

3. The Commission together with the Member States shall implement services required by the interoperable, cross-border identification and authentication mechanism referred to in paragraph 2 of this Article at Union level, as part of the cross-border digital health infrastructure referred to in Article 12(3).

Amendment 26

Proposal for a regulation

Article 9 – paragraph 4

Text proposed by the Commission

Amendment

4. The digital health authorities and the Commission shall implement the cross-border identification and authentication mechanism at Union and Member States’ level, respectively.

4. The Commission together with the Member States shall develop the cross-border identification and authentication mechanism at Union and Member States’ level, respectively, in accordance with Regulation (EU) No 910/2014 as amended by [COM(2021) 281 final].

Amendment 27

Proposal for a regulation

Article 10 – paragraph 2 – point g

Text proposed by the Commission

Amendment

(g) ensure the implementation, at national level, of the European electronic health record exchange format, in cooperation with national authorities and stakeholders;

(g) ensure the implementation, at national level, of the European electronic health record exchange format, to be interoperable and facilitate cross-border exchanges, in cooperation with national authorities and stakeholders;

Amendment 28

Proposal for a regulation

Article 23 – paragraph 1 – subparagraph 1

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the existing European standards and different data spaces, as well as the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

Amendment 29

Proposal for a regulation

Article 23 – paragraph 5

Text proposed by the Commission

Amendment

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications may be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications shall, where relevant, be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

Amendment 30

Proposal for a regulation

Article 33 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) EHRs;

(a) electronic health data from EHRs;

Amendment 31

Proposal for a regulation

Article 33 – paragraph 1 – point d

Text proposed by the Commission

Amendment

(d) health-related administrative data, including claims and reimbursement data;

deleted

Amendment 32

Proposal for a regulation

Article 33 – paragraph 1 – point e

Text proposed by the Commission

Amendment

(e) human genetic, genomic and proteomic data;

(e) anonymised human genetic, genomic and proteomic data;

Amendment 33

Proposal for a regulation

Article 33 – paragraph 1 – point i

Text proposed by the Commission

Amendment

(i) electronic health data from medical registries for specific diseases;

(i) electronic health data from medical registries;

Amendment 34

Proposal for a regulation

Article 33 – paragraph 1 – point j

Text proposed by the Commission

Amendment

(j) electronic health data from clinical trials;

(j) electronic health data from clinical trials in accordance with Regulation (EU) No 536/2014;

Amendment 35

Proposal for a regulation

Article 33 – paragraph 3

Text proposed by the Commission

Amendment

3. The electronic health data referred to in paragraph 1 shall cover data processed for the provision of health or care or for public health, research, innovation, policy making, official statistics, patient safety or regulatory purposes, collected by entities and bodies in the health or care sectors, including public and private providers of health or care, entities or bodies performing research in relation to these sectors, and Union institutions, bodies, offices and agencies.

3. The electronic health data referred to in paragraph 1 shall cover data processed for the provision of health or care or for public health, research, innovation, policy making, official statistics, patient safety or regulatory purposes, collected by entities and bodies in the health sector, including public and private providers of health or care, entities or bodies performing research in relation to these sectors, and Union institutions, bodies, offices and agencies.

Amendment 36

Proposal for a regulation

Article 33 – paragraph 4

Text proposed by the Commission

Amendment

4. Electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

4. Electronic health data entailing protected intellectual property and trade secrets from health data holders shall be made available for secondary use. For electronic health data from medical devices referred to in Article 33(1), point (k) where data holder can demonstrate that data are derived or inferred by means of complex proprietary algorithms and can lead to reverse engineering, data holder shall be entitled to refer to data coordinator as established under Article 31 of Regulation (Data Act) to request a restriction or limitation of the sharing of such data. Where such data is made available for secondary use, all measures necessary to preserve IP rights and confidentiality of trade secrets shall be taken. This Regulation is without prejudice to Union and national law providing for the protection of intellectual property rights, including Directives 2001/29/EC, 2004/48/EC, (EU) 2016/943 and (EU) 2019/790.

Amendment 37

Proposal for a regulation

Article 33 – paragraph 5

Text proposed by the Commission

Amendment

5. Where the consent of the natural person is required by national law, health data access bodies shall rely on the obligations laid down in this Chapter to provide access to electronic health data.

5. Where the consent of the natural person is required by Union or national law, health data access bodies shall rely on the obligations laid down in the applicable law and this Chapter to provide access to electronic health data ensuring that individual fundamental rights are duly respected.

Amendment 38

Proposal for a regulation

Article 33 – paragraph 7

Text proposed by the Commission

Amendment

7. The Commission is empowered to adopt delegated acts in accordance with Article 67 to amend the list in paragraph 1 to adapt it to the evolution of available electronic health data.

deleted

Amendment 39

Proposal for a regulation

Article 33 – paragraph 8

Text proposed by the Commission

Amendment

8. Health data access bodies may provide access to additional categories of electronic health data that they have been entrusted with pursuant to national law or based on voluntary cooperation with the relevant data holders at national level, in particular to electronic health data held by private entities in the health sector.

Amendment 40

Proposal for a regulation

Article 33 a (new)

Text proposed by the Commission

Amendment

Article 33a

Rights of natural persons in relation to the secondary use

Natural persons shall have the right to restrict access by health data access bodies to all or part of their electronic health data. Member States shall establish the rules and specific safeguards regarding such restriction mechanisms.

Amendment 41

Proposal for a regulation

Article 34 – paragraph 1 – point g

Text proposed by the Commission

Amendment

(g) training, testing and evaluating of algorithms, including in medical devices, AI systems and digital health applications, contributing to the public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices;

(g) training, testing and validating of algorithms, including in medical devices, AI systems and digital applications related to health in accordance with the AI Act (COM/2021/206 final);

Amendment 42

Proposal for a regulation

Article 35 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

Seeking access to and processing electronic health data obtained via a data permit issued pursuant to Article 46 for the following purposes shall be prohibited:

Seeking or obtaining access to and processing electronic health data obtained via a data permit issued pursuant to Article 46 for the following purposes shall be prohibited:

Amendment 43

Proposal for a regulation

Article 35 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) the sale of electronic health data made available under this Regulation.

Amendment 44

Proposal for a regulation

Article 36 – paragraph 3

Text proposed by the Commission

Amendment

3. In the performance of their tasks, health data access bodies shall actively cooperate with stakeholders’ representatives, especially with representatives of patients, data holders and data users. Staff of health data access bodies shall avoid any conflicts of interest. Health data access bodies shall not be bound by any instructions, when making their decisions.

3. Member States shall ensure that representatives of essential health stakeholders, including patient organisations, healthcare professionals and research community are present in the governance and decision-making structures of the health data access bodies. In the performance of their tasks, health data access bodies shall actively cooperate with stakeholders’ representatives, especially with representatives of patients, data holders and data users. Staff of health data access bodies shall avoid any conflicts of interest. Health data access bodies shall not be bound by any instructions, when making their decisions.

Amendment 45

Proposal for a regulation

Article 37 – paragraph 1 – point m

Text proposed by the Commission

Amendment

(m) cooperate at Union and national level to lay down appropriate measures and requirements for accessing electronic health data in a secure processing environment;

(m) cooperate at Union and national level to lay down a common approach, technical requirements and appropriate measures for accessing electronic health data in a secure processing environment;

Amendment 46

Proposal for a regulation

Article 37 – paragraph 1 – point t a (new)

Text proposed by the Commission

Amendment

(ta) disseminate information about the benefits of providing access to health data for secondary use.

Amendment 47

Proposal for a regulation

Article 37 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(aa) make public through electronic means the penalties applied pursuant to Article 43;

Amendment 48

Proposal for a regulation

Article 37 – paragraph 2 – point c

Text proposed by the Commission

Amendment

(c) cooperate with stakeholders, including patient organisations, representatives from natural persons, health professionals, researchers, and ethical committees, where applicable in accordance with Union and national law;

(c) cooperate with all relevant stakeholders, including patient organisations, representatives from natural persons, health professionals, researchers, industry representatives and ethical committees, where applicable in accordance with Union and national law;

Amendment 49

Proposal for a regulation

Article 38 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the applicable rights of natural persons in relation to secondary use of electronic health data, including the right to restrict the access to certain type of data as referred to in Article 33a;

Amendment 50

Proposal for a regulation

Article 39 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Each health data access body shall publish an annual activity report which shall contain at least the following:

1. Each health data access body shall publish biennial activity report which shall include summary data containing only the following:

Amendment 51

Proposal for a regulation

Article 39 – paragraph 2

Text proposed by the Commission

Amendment

2. The report shall be transmitted to the Commission.

2. The reports shall be transmitted to the Commission.

Amendment 52

Proposal for a regulation

Article 39 – paragraph 3

Text proposed by the Commission

Amendment

3. The Commission is empowered to adopt delegated acts in accordance with Article 67 to modify the content of the annual activity report.

3. The Commission is empowered to adopt delegated acts in accordance with Article 67 to modify the content of the biennial activity reports.

Amendment 53

Proposal for a regulation

Article 41 – paragraph 1

Text proposed by the Commission

Amendment

1. Where a data holder is obliged to make electronic health data available under Article 33 or under other Union law or national legislation implementing Union law, it shall cooperate in good faith with the health data access bodies, where relevant.

Amendment 54

Proposal for a regulation

Article 44 – paragraph 1

Text proposed by the Commission

Amendment

1. The health data access body shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.

1. The health data access body or the data holder shall ensure that access is only provided to requested electronic health data relevant for the purpose of processing indicated in the data access application by the data user and in line with the data permit granted.

Amendment 55

Proposal for a regulation

Article 45 – paragraph 4 – point a

Text proposed by the Commission

Amendment

(a) a description of how the processing would comply with Article 6(1) of Regulation (EU) 2016/679;

(a) a description of the legal basis for carrying out the processing within the meaning of Article 6(1) of Regulation (EU) 2016/679;

Amendment 56

Proposal for a regulation

Article 46 – paragraph 3

Text proposed by the Commission

Amendment

3. A health data access body shall issue or refuse a data permit within 2 months of receiving the data access application. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final], the health data access body may extend the period for responding to a data access application by 2 additional months where necessary, taking into account the complexity of the request. In such cases, the health data access body shall notify the applicant as soon as possible that more time is needed for examining the application, together with the reasons for the delay. Where a health data access body fails to provide a decision within the time limit, the data permit shall be issued.

Amendment 57

Proposal for a regulation

Article 46 – paragraph 11

Text proposed by the Commission

Amendment

11. Data users shall make public the results or output of the secondary use of electronic health data, including information relevant for the provision of healthcare, no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in Article 47. Those results or output shall only contain anonymised data. The data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. Whenever the data users have used electronic health data in accordance with this Chapter, they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the EHDS.

11. Data users shall make public the results or output of the secondary use of electronic health data, including information relevant for the provision of healthcare, no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in Article 47. Those results or output shall only contain anonymised data. The data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites with due regard to safeguards set out in the Union legislative acts. Whenever the data users have used electronic health data in accordance with this Chapter, they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the EHDS.

Amendment 58

Proposal for a regulation

Article 46 – paragraph 14

Text proposed by the Commission

Amendment

14. The liability of health data access bodies as joint controller is limited to the scope of the issued data permit until the completion of the processing activity.

14. The liability of health data access bodies or of the data holder as joint controller, depending on who makes the data available to the data user, is limited to the scope of the issued data permit until the completion of the processing activity.

Amendment 59

Proposal for a regulation

Article 48 – paragraph 1

Text proposed by the Commission

Amendment

By derogation from Article 46 of this Regulation, a data permit shall not be required to access the electronic health data under this Article. When carrying out those tasks under Article 37 (1), points (b) and (c), the health data access body shall inform public sector bodies and the Union institutions, offices, agencies and bodies, about the availability of data within 2 months of the data access application, in accordance with Article 9 of Regulation […] [Data Governance Act COM/2020/767 final]. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final ], the health data access body may extend the period by 2 additional months where necessary, taking into account the complexity of the request. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless it specifies that it will provide the data within a longer specified timeframe.

By derogation from Article 46 of this Regulation, a data permit shall not be required in the case of justified requests for access to the electronic health data under this Article by public sector bodies and Union institutions, bodies, offices and agencies that carry out relevant activities under this Regulation where their legal mandate provides for such data access. For the purpose of the evaluation of the benefits and risks of medicinal products and of the identification and assessment of threats to human health posed by infectious diseases, the EMA and ECDC shall be granted rapid access to the health data within the EHDS within the limits of their mandate and applicable law. When carrying out those tasks under Article 37 (1), points (b) and (c), the health data access body shall inform public sector bodies and the Union institutions, offices, agencies and bodies, about the availability of data within 2 months of the data access application, in accordance with Article 9 of Regulation […] [Data Governance Act COM/2020/767 final]. By way of derogation from that Regulation […] [Data Governance Act COM/2020/767 final ], the health data access body may extend the period by 2 additional months where necessary, taking into account the complexity of the request. The health data access body shall make available the electronic health data to the data user within 2 months after receiving them from the data holders, unless it specifies that it will provide the data within a longer specified timeframe.

Amendment 60

Proposal for a regulation

Article 49

Text proposed by the Commission

Amendment

Article 49

deleted

Access to electronic health data from a single data holder

1. Where an applicant requests access to electronic health data only from a single data holder in a single Member State, by way of derogation from Article 45(1), that applicant may file a data access application or a data request directly to the data holder. The data access application shall comply with the requirements set out in Article 45 and the data request shall comply with requirements in Article 47. Multi-country requests and requests requiring a combination of datasets from several data holders shall be adressed to health data access bodies.

2. In such case, the data holder may issue a data permit in accordance with Article 46 or provide an answer to a data request in accordance with Article 47. The data holder shall then provide access to the electronic health data in a secure processing environment in compliance with Article 50 and may charge fees in accordance with Article 42.

3. By way of derogation from Article 51, the single data provider and the data user shall be deemed joint controllers.

4. Within 3 months the data holder shall inform the relevant health data access body by electronic means of all data access applications filed and all the data permits issued and the data requests fulfilled under this Article in order to enable the health data access body to fulfil its obligations under Article 37(1) and Article 39.

Amendment 61

Proposal for a regulation

Article 52 – paragraph 3

Text proposed by the Commission

Amendment

3. Union institutions, bodies, offices and agencies involved in research, health policy or analysis, shall be authorised participants of HealthData@EU.

3. Union institutions, bodies, offices and agencies in the health sector involved in research, health policy or analysis, shall be authorised participants of HealthData@EU.

Amendment 62

Proposal for a regulation

Article 52 – paragraph 4

Text proposed by the Commission

Amendment

4. Health-related research infrastructures or similar structures whose functioning is based on Union law and which support the use of electronic health data for research, policy making, statistical, patient safety or regulatory purposes shall be authorised participants of HealthData@EU.

4. Health-related research infrastructures or similar structures which support the use of electronic health data in the health sector for research, policy making, statistical, patient safety or regulatory purposes shall be authorised participants of HealthData@EU.

Amendment 63

Proposal for a regulation

Article 52 – paragraph 7

Text proposed by the Commission

Amendment

7. The Commission is empowered to adopt delegated acts in accordance with Article 67 in order to amend this Article to add or remove categories of authorised participants in HealthData@EU, taking into account the opinion of the joint controllership group pursuant to Article 66 of this Regulation.

7. The Commission is empowered to adopt delegated acts in accordance with Article 67 in order to amend this Article to add or remove categories of authorised health sector participants in HealthData@EU, taking into account the opinion of the joint controllership group pursuant to Article 66 of this Regulation.

Amendment 64

Proposal for a regulation

Article 52 – paragraph 8

Text proposed by the Commission

Amendment

8. The Member States and the Commission shall set up HealthData@EU to support and facilitate the cross-border access to electronic health data for secondary use, connecting the national contact points for secondary use of electronic health data of all Member States and authorised participants in that infrastructure.

8. The Member States and the Commission shall set up HealthData@EU to support and facilitate the cross-border access to electronic health data for secondary use in the health sector, connecting the national contact points for secondary use of electronic health data of all Member States and authorised participants in that infrastructure.

Amendment 65

Proposal for a regulation

Article 61 – paragraph 2

Text proposed by the Commission

Amendment

2. The protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization techniques and shall be detailed in the Delegated Act under the empowerment set out in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final].

2. Additional protective measures for the categories of data mentioned in paragraph 1 shall depend on the nature of the data and anonymization and pseudonymisation techniques and shall be detailed in the Delegated Act under the empowerment set out in Article 5(13) of Regulation […] [Data Governance Act COM/2020/767 final].

Amendment 66

Proposal for a regulation

Article 64 – paragraph 1

Text proposed by the Commission

Amendment

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor may be invited to the meetings, where the issues discussed are of relevance for them. The Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor shall be invited to the meetings, where the issues discussed are of relevance for them. The Board shall, where relevant, invite experts and other relevant stakeholders to attend its meetings, and to cooperate on aspects of its work. Such stakeholders may include actors of the public and private sector, patients, health professionals and researchers, as well at least one patient organisation and one healthcare professional organisation. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

Amendment 67

Proposal for a regulation

Article 64 – paragraph 4

Text proposed by the Commission

Amendment

4. Stakeholders and relevant third parties, including patients’ representatives, shall be invited to attend meetings of the EHDS Board and to participate in its work, depending on the topics discussed and their degree of sensitivity.

4. Stakeholders and relevant third parties, including healthcare professionals, researchers and patients’ representatives, shall be invited to attend meetings of the EHDS Board and to participate in its work, depending on the topics discussed and their degree of sensitivity.

Amendment 68

Proposal for a regulation

Article 64 – paragraph 5

Text proposed by the Commission

Amendment

5. The EHDS Board shall cooperate with other relevant bodies, entities and experts, such as the European Data Innovation Board referred to in Article 26 of Regulation […] [Data Governance Act COM/2020/767 final], competent bodies set up under Article 7 of Regulation […] [Data Act COM/2022/68 final], supervisory bodies set up under Article 17 of Regulation […] [eID Regulation], European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679 and cybersecurity bodies.

Amendment 69

Proposal for a regulation

Article 65 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) to facilitate the exchange of views on the secondary use of electronic health data with the relevant stakeholders, including representatives of patients, health professionals, researchers, regulators and policy makers in the health sector.

Amendment 70

Proposal for a regulation

Annex II – point 2 – point 2.4

Text proposed by the Commission

Amendment

2.4. An EHR system shall not include features that prohibit, restrict or place undue burden on authorised access, personal electronic health data sharing, or use of personal electronic health data for permitted purposes, in particular on the basis of commercial considerations and beyond security and legal safeguards requirements.

Amendment 71

Proposal for a regulation

Annex II – point 3 – point 3.1

Text proposed by the Commission

Amendment

3.1. An EHR system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data, and that it prevents unauthorised access to such data.

3.1. An EHR system shall be designed and developed in such a way that it ensures highly safe and secure processing of electronic health data, and that it prevents unauthorised access to such data.

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

European Health Data Space

References

COM(2022)0197 – C9-0167/2022 – 2022/0140(COD)

Committees responsible

Date announced in plenary

ENVI

6.6.2022

LIBE

6.6.2022

Opinion by

Date announced in plenary

ITRE

6.6.2022

Associated committees - date announced in plenary

16.2.2023

Rapporteur for the opinion

Date appointed

Cristian-Silviu Buşoi

9.6.2022

Rule 58 – Joint committee procedure

Date announced in plenary

16.2.2023

Discussed in committee

9.3.2023

Date adopted

23.5.2023

Result of final vote

–:

Members present for the final vote

Matteo Adinolfi, Nicola Beer, Hildegard Bentele, Tom Berendsen, Vasile Blaga, Michael Bloss, Paolo Borchia, Cristian-Silviu Buşoi, Jerzy Buzek, Maria da Graça Carvalho, Ignazio Corrao, Ciarán Cuffe, Josianne Cutajar, Nicola Danti, Marie Dauchy, Pilar del Castillo Vera, Christian Ehler, Valter Flego, Niels Fuglsang, Lina Gálvez Muñoz, Nicolás González Casares, Bart Groothuis, Christophe Grudler, Henrike Hahn, Robert Hajšel, Ivars Ijabs, Romana Jerković, Seán Kelly, Izabela-Helena Kloc, Łukasz Kohut, Zdzisław Krasnodębski, Andrius Kubilius, Miapetra Kumpula-Natri, Thierry Mariani, Eva Maydell, Marina Mesure, Dan Nica, Angelika Niebler, Ville Niinistö, Johan Nissinen, Mikuláš Peksa, Morten Petersen, Markus Pieper, Manuela Ripa, Robert Roos, Sara Skyttedal, Beata Szydło, Riho Terras, Grzegorz Tobiszowski, Patrizia Toia, Henna Virkkunen, Pernille Weiss, Carlos Zorrinho

Substitutes present for the final vote

Jakop G. Dalunde, Matthias Ecke, Gheorghe Falcă, Klemen Grošelj, Marian-Jean Marinescu, Jutta Paulus, Susana Solís Pérez, Nils Torvalds

Substitutes under Rule 209(7) present for the final vote

Achille Variati, Petar Vitanov

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols: