Skip to content
REPORT (COM(2022)0197 – C90167/2022 – 2022/0140(COD))

On the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space

A-9-2023-0395

Committee on the Environment, Public Health and Food Safety Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Tomislav Sokol, Annalisa Tardino

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the Commission proposal for a regulation on the European Health Data Space sets up rules for access to and exchange of electronic health data for healthcare (primary use) and for research, innovation, policy-making and other purposes (secondary use). It gives natural persons rights to access, download, rectify and share their health data, to restrict access, and to opt out of secondary use, with opt-in for genetic, genomic and wellness data. It requires Member States to designate digital health authorities and health data access bodies, makes participation in MyHealth@EU mandatory, and sets up an EHDS Board and an advisory forum. It bans secondary use without a data permit or data request, prohibits re-identification and certain decisions based on health data, and requires storage of personal electronic health data in the Union. It sets rules for EHR systems, including conformity assessment, CE marking, market surveillance, and labelling of wellness applications claiming interoperability. It provides for administrative fines and enforcement measures by health data access bodies, and for compensation and judicial remedies for infringements.

Committee position. The committees propose to amend the Commission proposal to strengthen patients' rights over their health data, clarify the relationship with the GDPR, add safeguards for secondary use including opt-out and opt-in, require storage of health data in the Union, and set up conformity assessment for EHR systems.

Key points

  1. Natural persons get the right to access, download and receive a copy of their electronic health data, and to have incorrect data rectified online free of charge.
  2. Natural persons may restrict access of specific health professionals to all or part of their data, and must be informed of the healthcare impact of such restrictions.
  3. Natural persons have the right to opt out of secondary use of their health data, while genetic, genomic, proteomic and wellness data require explicit consent (opt-in).
  4. Member States must establish digital health authorities and health data access bodies, and participation in the MyHealth@EU infrastructure becomes mandatory.
  5. Health data access bodies issue data permits for secondary use only for listed purposes, and may charge fees that are transparent, non-discriminatory and proportionate.
  6. Secondary use is prohibited without a data permit or data request, and for purposes such as decisions detrimental to persons, advertising, or developing harmful products.
  7. Health data users must not re-identify natural persons, must publish results within 18 months, and must process data only in a secure processing environment located in the Union.
  8. Personal electronic health data must be stored exclusively within the territory of the Union, without prejudice to transfers under Chapter V of Regulation (EU) 2016/679.
  9. EHR systems must undergo conformity assessment by notified bodies, bear CE marking, and comply with essential requirements in Annex II and common specifications.
  10. Wellness applications claiming interoperability with EHR systems must carry a label, and may not access or extract information from EHRs.
  11. Health data access bodies may impose administrative fines and exclude non-compliant data users or holders from the EHDS for up to 5 years.
  12. Natural persons have the right to compensation for damage and to lodge complaints with digital health authorities or health data access bodies, with access to judicial remedies.

Who is affected

  • Natural persons in the EU, who gain rights to access, control and share their electronic health data, and to opt out of secondary use.
  • Health professionals and healthcare providers, who must use interoperable EHR systems and respect patients' rights and data minimisation.
  • Manufacturers of EHR systems and wellness applications, who must comply with conformity assessment, CE marking and labelling rules.
  • Health data holders and health data users, who must provide or access data under permits and in secure processing environments.
  • Member States, which must designate digital health authorities and health data access bodies and ensure storage of data in the Union.

Figures and deadlines

  • EUR 220 million can be made available under the EU4Health and Digital Europe programmes for the EHDS.
  • The regulation should apply from 24 months after entry into force.
  • A partial evaluation is due 5 years after entry into force, and an overall evaluation 7 years after entry into force.
  • Data permits are issued for a duration not exceeding 5 years, extendable once for up to 5 years.
  • Health data holders must put data at the disposal of the health data access body within three months, extendable by up to two months.
  • Health data access bodies must issue or refuse a data permit within 2 months of receiving a complete application, extendable by 2 additional months.
  • Health data users must make public the results of secondary use no later than 18 months after completion of processing.
  • Manufacturers must keep technical documentation and the EU declaration of conformity for at least 10 years after the last EHR system is placed on the market.

Legal basis: Article 294(2) and Articles 16 and 114 of the Treaty on the Functioning of the European Union.