Sittings · Document

OPINION (COM(2022)0197 – C90167/2022 – 2022/0140(COD)) 2023-05-25

On the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space

Committee on the Internal Market and Consumer Protection · Rapporteur: Andrey Kovatchev

PA_Legam

SHORT JUSTIFICATION

This opinion focuses on the second pillar, Chapter III, which aims to implement a mandatory self-certification scheme for EHR systems, while complying with essential requirements on interoperability and security.

As Rapporteur for the IMCO Committee, I streamline the monitoring of the internal market. My draft opinion focuses on clarifying the definitions related to EHR, EHR systems, as well as introducing some new definition to allow for clear interpretation of the conditions set out in Chapter III of the proposal. Additionally, I propose to specify clearly the way in which the Commission will be creating the standards to apply to EHR systems through a clear reference to the use of international and harmonised standards, as well as the participation of all relevant stakeholders in this process.

My amendments further aim to define clearly the interplay between the EHDS and other sectoral legislation, especially for scenarios where devices would fall within the scope of more than one of these legislative acts.

An important addition is the requirement for the Commission and Member States to set explicit time-based targets for implementation and progress on cross-border health data interoperability and the relevant infrastructure.

This draft opinion aims to improve EHR systems by clarifying relevant definitions, ensuring that the Commission uses harmonised standards as the basis for setting EU-wide standards on security and interoperability for EHR systems, as well as reconciling the scope of the European Health Data Space with other sectoral legislation, such as the Medical Devices Regulation, the In-vitro Medical Device Regulation and the upcoming AI Act, and Data Act. By providing these clarifications, the proposed amendments intend to make the Commission’s proposal clearer and more predictable for stakeholders as well as clearly ensure the EU remains well connected globally and does not impose standards, which are not interoperable with global partners.

AMENDMENTS

The Committee on the Internal Market and Consumer Protection calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take into account the following amendments:

Amendment 1

Proposal for a regulation

Recital 7

Text proposed by the Commission

Amendment

(7) In health systems, personal electronic health data is usually gathered in electronic health records, which typically contain a natural person’s medical history, diagnoses and treatment, medications, allergies, immunisations, as well as radiology images and laboratory results, spread between different entities from the health system (general practitioners, hospitals, pharmacies, care services). In order to enable that electronic health data to be accessed, shared and changed by the natural persons or health professionals, some Member States have taken the necessary legal and technical measures and set up centralised infrastructures connecting EHR systems used by healthcare providers and natural persons. Alternatively, some Member States support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. Several Member States have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). They have also taken measures to ensure that EHR systems or wellness applications are able to transmit electronic health data with the central EHR system (some Member States do this by ensuring, for instance, a system of certification). However, not all Member States have put in place such systems, and the Member States that have implemented them have done so in a fragmented manner. In order to facilitate the free movement of personal health data across the Union and avoid negative consequences for patients when receiving healthcare in cross-border context, Union action is needed in order to ensure individuals have improved acess to their own personal electronic health data and are empowered to share it.

(7) In health systems, personal electronic health data is usually gathered in electronic health records, which typically contain a natural person’s medical history, diagnoses and treatment, medications, allergies, immunisations, as well as radiology images and laboratory results, spread between different entities from the health system (general practitioners, hospitals, pharmacies, care services). In order to enable that electronic health data to be accessed, shared and changed by the natural persons or health professionals, some Member States have taken the necessary legal and technical measures and set up centralised infrastructures connecting EHR systems used by healthcare providers and natural persons. Alternatively, some Member States support public and private healthcare providers to set up personal health data spaces to enable interoperability between different healthcare providers. Several Member States have also supported or provided health data access services for patients and health professionals (for instance through patients or health professional portals). They have also taken measures to ensure that EHR systems or wellness applications are able to transmit electronic health data with the central EHR system (some Member States do this by ensuring, for instance, a system of certification). However, not all Member States have put in place such systems, and the Member States that have implemented them have done so in a fragmented manner. In order to facilitate the free movement of personal health data across the Union and avoid negative consequences for patients when receiving healthcare in cross-border context, Union action is needed in order to ensure individuals have improved acess to their own personal electronic health data and are empowered to share it. The implementation costs for connecting healthcare professionals to the EHDS, including new infrastructure and cybersecurity maintenance, capacity building and additional administrative data workload, should not be carried by healthcare professionals themselves in justified cases. Therefore, Member States should ensure that for such justified cases, financial incentives of the Union are distributed evenly and fairly among those impacted by the EHDS.

Amendment 2

Proposal for a regulation

Recital 11

Text proposed by the Commission

Amendment

(11) Natural persons should be further empowered to exchange and to provide access to personal electronic health data to the health professionals of their choice, going beyond the right to data portability as established in Article 20 of Regulation (EU) 2016/679. This is necessary to tackle objective difficulties and obstacles in the current state of play. Under Regulation (EU) 2016/679, portability is limited only to data processed based on consent or contract, which excludes data processed under other legal bases, such as when the processing is based on law, for example when their processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It only concerns data provided by the data subject to a controller, excluding many inferred or indirect data, such as diagnoses, or tests. Finally, under Regulation (EU) 2016/679, the natural person has the right to have the personal data transmitted directly from one controller to another only where technically feasible. That Regulation, however, does not impose an obligation to make this direct transmission technically feasible. All these elements limit the data portability and may limit its benefits for provision of high-quality, safe and efficient healthcare services to the natural person.

(11) Natural persons should be further empowered to exchange and to provide access to personal electronic health data to the health professionals of their choice, going beyond the right to data portability as established in Article 20 of Regulation (EU) 2016/679. This is necessary to tackle objective difficulties and obstacles in the current state of play. Under Regulation (EU) 2016/679, portability is limited only to data processed based on consent or contract, which excludes data processed under other legal bases, such as when the processing is based on law, for example when their processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It only concerns data provided by the data subject to a controller, excluding many inferred or indirect data, such as diagnoses, or tests. Finally, under Regulation (EU) 2016/679, the natural person has the right to have the personal data transmitted directly from one controller to another only where technically feasible. That Regulation, however, does not impose an obligation to make this direct transmission technically feasible. All these elements limit the data portability and may limit its benefits for provision of high-quality, safe and efficient healthcare services to the natural person. Portability should give consumers more choice in the selection of a healthcare provider, resulting in reduced healthcare costs, faster diagnosis and treatment time and overall better health outcomes.

Amendment 3

Proposal for a regulation

Recital 16

Text proposed by the Commission

Amendment

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the Commission and the Member States should agree on ambitious time-based targets to implement improved health data interoperability across the Union. The access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

Amendment 4

Proposal for a regulation

Recital 19

Text proposed by the Commission

Amendment

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. In order to make electronic health data accesible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data.

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. The EHDS should also contribute to other requirements, mainly to apply the once-only principle, where possible. In order to make electronic health data accessible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data. Moreover, an agreement on time-based Union level targets for implementation of health data interoperability, should be reached. In order to support the successful implementation of the EHDS and the execution of an effective landscape of European health data cooperation, the Commission should agree with Member States a range of targets for health data interoperability milestones.

__________________

__________________

45 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, p. 18).

45 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, p. 18).

46 Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

46 Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

Amendment 5

Proposal for a regulation

Recital 19 a (new)

Text proposed by the Commission

Amendment

(19a) The once-only principle means that natural or legal persons provide data only once under the primary or secondary use regime, while all actors concerned by this Regulation should be able to access such data for primary or secondary use, while respecting the rules laid down in the corresponding chapters. The implementation of the once-only principle would ensure that healthcare professionals and providers are not obliged to provide the same data more than once, avoiding duplication and unnecessary burdens.

Amendment 6

Proposal for a regulation

Recital 23

Text proposed by the Commission

Amendment

(23) Digital health authorities should have sufficient technical skills, possibly bringing together experts from different organisations. The activities of digital health authorities should be well-planned and monitored in order to ensure their efficiency. Digital health authorities should take necessary measures to ensuring rights of natural persons by setting up national, regional, and local technical solutions such as national EHR, patient portals, data intermediation systems. When doing so, they should apply common standards and specifications in such solutions, promote the application of the standards and specifications in procurements and use other innovative means including reimbursement of solutions that are compliant with interoperability and security requirements of the EHDS. To carry out their tasks, the digital health authorities should cooperate at national and Union level with other entities, including with insurance bodies, healthcare providers, manufacturers of EHR systems and wellness applications, as well as stakeholders from health or information technology sector, entities handling reimbursement schemes, health technology assessment bodies, medicinal products regulatory authorities and agencies, medical devices authorities, procurers and cybersecurity or e-ID authorities.

(23) Digital health authorities should have sufficient technical skills, possibly bringing together experts from different organisations. The activities of digital health authorities should be well-planned and monitored in order to ensure their efficiency. Digital health authorities should take necessary measures to ensuring rights of natural persons by setting up national, regional, and local technical solutions such as national EHR, patient portals, data intermediation systems. When doing so, they should apply common standards and specifications in such solutions, promote the application of the standards and specifications in procurements and use other innovative means including reimbursement of solutions that are compliant with interoperability and security requirements of the EHDS. To carry out their tasks, the digital health authorities should cooperate and exchange best practices at national and Union level with other entities, including with insurance bodies, healthcare providers, manufacturers of EHR systems and wellness applications, as well as stakeholders from health or information technology sector, entities handling reimbursement schemes, health technology assessment bodies, medicinal products regulatory authorities and agencies, medical devices authorities, procurers and cybersecurity or e-ID authorities. Additionally, cybersecurity is of utmost importance in the healthcare sector, especially when it comes to protecting health data. Therefore, digital health authorities should implement robust cybersecurity measures in order to protect sensitive health data of users to thwart any attempts to breach the systems and steal or damage the data.

Amendment 7

Proposal for a regulation

Recital 24

Text proposed by the Commission

Amendment

(24) Access to and transmission of electronic health data is relevant in cross-border healthcare situations, as it may support continuity of healthcare when natural persons travel to other Member States or change their place of residence. Continuity of care and rapid access to personal electronic health data is even more important for residents in border regions, crossing the border frequently to get health care. In many border regions, some specialised health care services may be available closer across the border rather than in the same Member State. An infrastructure is needed for the transmission of personal electronic health data across borders, in situations where a natural person is using services of a healthcare provider established in another Member State. A voluntary infrastructure for that purpose, MyHealth@EU, has been established as part of the actions provided for in Article 14 of Directive 2011/24/EU. Through MyHealth@EU, Member States started to provide natural persons with the possibility to share their personal electronic health data with healthcare providers when travelling abroad. To further support such possibilities, the participation of Member States in the digital infrastructure MyHealth@EU should become mandatory. All Member States should join the infrastructure and connect healthcare providers and pharmacies to it, as this is necessary for the implementation of the rights of natural persons to access and make use of their personal electronic health data regardless of the Member State. The infrastructure should be gradually expanded to support further categories of electronic health data.

(24) Access to and transmission of electronic health data is relevant in cross-border healthcare situations, as it may support continuity of healthcare when natural persons travel to other Member States or change their place of residence. Continuity of care and rapid access to personal electronic health data is even more important for residents in border regions, crossing the border frequently to get health care. In many border regions, some specialised health care services may be available closer across the border rather than in the same Member State. An infrastructure is needed for the transmission of personal electronic health data across borders, in situations where a natural person is using services of a healthcare provider established in another Member State. A voluntary infrastructure for that purpose, MyHealth@EU, has been established as part of the actions provided for in Article 14 of Directive 2011/24/EU. Through MyHealth@EU, Member States started to provide natural persons with the possibility to share their personal electronic health data with healthcare providers when travelling abroad. To further support such possibilities, the participation of Member States in the digital infrastructure MyHealth@EU should become mandatory. All Member States should join the infrastructure and connect healthcare providers and pharmacies to it, as this is necessary for the implementation of the rights of natural persons to access and make use of their personal electronic health data regardless of the Member State. The infrastructure should be gradually expanded to support further categories of electronic health data. Making interoperability mandatory would overcome the market coordination failure. Introducing interoperability standards at Union level is likely to be more effective than at national level.

Amendment 8

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor.

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor. Moreover, the Commission and Member States should develop time-based targets to reach that objective. To ensure the highest security standards, where deemed appropriate, parts of or the entirety of the platform should be licenced under an open source licence in line with the Open Source Strategy 2020-2023 and Commission Decision 2021/C 495 I/011a. This will increase transparency and ensure consumer trust and confidence in the platform.

______________

1a Commission Decision of 8 December 2021 on the open source licensing and reuse of Commission software 2021/C 495 I/01 (OJ C 495I, 9.12.2021, p. 1).

Amendment 9

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(29) Software or module(s) of software which fall within the definition of an EHR system, medical device or high-risk artificial intelligence (AI) system should only be required to comply with the essential requirements on interoperability of this Regulation to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. These types of software should exclusively follow the relevant conformity assessment in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. In such case, only the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

__________________

__________________

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

Amendment 10

Proposal for a regulation

Recital 34

Text proposed by the Commission

Amendment

(34) In order to ensure an appropriate and effective enforcement of the requirements and obligations laid down in Chapter III of this Regulation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply. Depending on the organisation defined at national level, such market surveillance activities could be carried out by the digital health authorities ensuring the proper implementation of Chapter II or a separate market surveillance authority responsible for EHR systems. While designating digital health authorities as market surveillance authorities could have important practical advantages for the implementation of health and care, any conflicts of interest should be avoided, for instance by separating different tasks.

(34) In order to ensure an appropriate and effective enforcement of the requirements and obligations laid down in Chapter III of this Regulation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply. Depending on the organisation defined at national level, such market surveillance activities could be carried out by the digital health authorities ensuring the proper implementation of Chapter II or a separate market surveillance authority responsible for EHR systems. While designating digital health authorities as market surveillance authorities could have important practical advantages for the implementation of health and care, any conflicts of interest should be avoided, for instance by separating different tasks. Member States should ensure that market surveillance authorities have the necessary human, technical and financial resources, premises, infrastructure, and expertise to carry out their duties effectively.

Amendment 11

Proposal for a regulation

Recital 40

Text proposed by the Commission

Amendment

(40) The data holders can be public, non for profit or private health or care providers, public, non for profit and private organisations, associations or other entities, public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. In order to avoid a disproportionate burden on small entities, micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of EHDS. The public or private entities often receive public funding, from national or Union funds to collect and process electronic health data for research, statistics (official or not) or other similar purposes, including in area where the collection of such data is fragmented of difficult, such as rare diseases, cancer etc. Such data, collected and processed by data holders with the support of Union or national public funding, should be made available by data holders to health data access bodies, in order to maximise the impact of the public investment and support research, innovation, patient safety or policy making benefitting the society. In some Member States, private entities, including private healthcare providers and professional associations, play a pivotal role in the health sector. The health data held by such providers should also be made available for secondary use. At the same time, data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies often enjoy copyright protection or similar types of protection. However, public authorities and regulators should have access to such data, for instance in the event of pandemics, to verify defective devices and protect human health. In times of severe public health concerns (for example, PIP breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. The COVID-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. Such data should be made available for public and regulatory activities, supporting public bodies to carry out their legal mandate, while complying with, where relevant and possible, the protection enjoyed by commercial data. Specific rules in relation to the secondary use of health data should be provided. Data altruism activities may be carried out by different entities, in the context of Regulation […] [Data Governance Act COM/2020/767 final] and taking into account the specificities of the health sector.

(40) The data holders can be public, non for profit or private health or care providers, public, non for profit and private organisations, associations or other entities, public and private entities that carry out research with regards to the health sector that process the categories of health and health related data mentioned above. In order to avoid a disproportionate burden on small entities, micro-enterprises are excluded from the obligation to make their data available for secondary use in the framework of EHDS. The public or private entities often receive public funding, from national or Union funds to collect and process electronic health data for research, statistics (official or not) or other similar purposes, including in area where the collection of such data is fragmented of difficult, such as rare diseases, cancer etc. Such data, collected and processed by data holders with the support of Union or national public funding, should be made available by data holders to health data access bodies, in order to maximise the impact of the public investment and support research, innovation, patient safety or policy making benefitting the society. In some Member States, private entities, including private healthcare providers and professional associations, play a pivotal role in the health sector. The health data held by such providers should also be made available for secondary use. At the same time, data benefiting from specific legal protection such as intellectual property from medical device companies or pharmaceutical companies should be provided with the level of confidentiality protection mandated by the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) and the Directive (EU) 2016/9431a, with the protection of the main IP rights i.e. patents, supplementary protection certificates (SPCs), utility models, copyright, trademarks, database and design rights. However, public authorities and regulators should have access to such data, for instance in the event of pandemics, to verify defective devices and protect human health. In times of severe public health concerns (for example, PIP breast implants fraud) it appeared very difficult for public authorities to get access to such data to understand the causes and knowledge of manufacturer concerning the defects of some devices. The COVID-19 pandemic also revealed the difficulty for policy makers to have access to health data and other data related to health. Such data should be made available for public and regulatory activities, supporting public bodies to carry out their legal mandate, while complying with, where relevant and possible, the protection enjoyed by commercial data. Specific rules in relation to the secondary use of health data should be provided. Data altruism activities may be carried out by different entities, in the context of Regulation […] [Data Governance Act COM/2020/767 final] and taking into account the specificities of the health sector.

___________________

1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1).

Amendment 12

Proposal for a regulation

Recital 51

Text proposed by the Commission

Amendment

(51) As the resources of health data access bodies are limited, they can apply prioritisation rules, for instance prioritising public institutions before private entities, but they should not make any discrimination between the national or from organisations from other Member States within the same category of priorities. The data user should be able to extend the duration of the data permit in order, for example, to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. This would require an amendment of the data permit and may be subject to an additonal fee. However, in all the cases, the data permit should reflect theses additionals uses of the dataset. Preferably, the data user should mention them in their initial request for the issuance of the data permit. In order to ensure a harmonised approach between health data access bodies, the Commission should support the harmonisation of data permit.

(51) As the resources of health data access bodies are limited, they can apply prioritisation rules, the Commission should issue guidance on prioritisation criteria. In general, the request with potential overall highest benefit for the citizens and Union should be prioritised. The prioritisation criteria should avoid fragmentation of the single market. The data user should be able to extend the duration of the data permit in order, for example, to allow access to the datasets to reviewers of scientific publication or to enable additional analysis of the dataset based on the initial findings. This would require an amendment of the data permit and may be subject to an additonal fee. However, in all the cases, the data permit should reflect theses additionals uses of the dataset. Preferably, the data user should mention them in their initial request for the issuance of the data permit. In order to ensure a harmonised approach between health data access bodies, the Commission should support the harmonisation of data permit.

Amendment 13

Proposal for a regulation

Recital 68

Text proposed by the Commission

Amendment

(68) In order to ensure that EHDS fulfils its objectives, the power to adopt acts in accordance with Article 290 Treaty on the Functioning of the European Union should be delegated to the Commission in respect of different provisions of primary and secondary use of electronic health data. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making52 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(68) In order to ensure that EHDS fulfils its objectives, the power to adopt acts in accordance with Article 290 Treaty on the Functioning of the European Union should be delegated to the Commission in respect of different provisions of primary and secondary use of electronic health data. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making52. In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States’ experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. In accordance with the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making, the Commission will also resort to public consultations to gather the necessary expertise.

__________________

__________________

52 OJ L 123, 12.5.2016, p. 1.

52 OJ L 123, 12.5.2016, p. 1.

Amendment 14

Proposal for a regulation

Recital 69

Text proposed by the Commission

Amendment

(69) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council53 .

(69) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council53. In accordance with the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making, the Commission will make use of expert groups, consult targeted stakeholders and carry out public consultations to gather broader expertise in the early preparation of draft implementing acts.

__________________

__________________

53 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

53 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by the Member States of the Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

Amendment 15

Proposal for a regulation

Recital 70

Text proposed by the Commission

Amendment

(70) Member States should take all necessary measures to ensure that the provisions of this Regulation are implemented, including by laying down effective, proportionate and dissuasive penalties for their infringement. For certain specific infringements, Member States should take into account the margins and criteria set out in this Regulation.

(70) Member States should take all necessary measures to ensure that the provisions of this Regulation are implemented, including by laying down effective, proportionate and dissuasive penalties for their infringement. For certain specific infringements, Member States should take into account the margins and criteria set out in this Regulation. Moreover, the Member states should put in place communication campaigns to inform all relevant stakeholders, especially the industry, and society, about the infringements and all provisions of the Regulation in order to facilitate its implementation, which needs to take especially into account the different digital developments of health systems across the Union.

Amendment 16

Proposal for a regulation

Recital 71 a (new)

Text proposed by the Commission

Amendment

(71a) The Commission should assess whether this Regulation should be added to the list of provisions of Union law covered by Annex I of Directive (EU) 2020/1828 of the European Parliament and of the Council.

Amendment 17

Proposal for a regulation

Recital 72 a (new)

Text proposed by the Commission

Amendment

(72a) In order to mitigate risks of delay in implementation, the Commission and Member States should agree on a range of time-based targets for the EHDS, including in respect to health data interoperability.

Amendment 18

Proposal for a regulation

Article 1 – paragraph 4

Text proposed by the Commission

Amendment

4. This Regulation shall be without prejudice to other Union legal acts regarding access to, sharing of or secondary use of electronic health data, or requirements related to the processing of data in relation to electronic health data, in particular Regulations (EU) 2016/679, (EU) 2018/1725, […] [Data Governance Act COM/2020/767 final] and […] [Data Act COM/2022/68 final].

4. This Regulation shall be without prejudice to other Union legal acts regarding access to, sharing of or secondary use of electronic health data, or requirements related to the processing of data in relation to electronic health data, in particular Regulations (EU) 2016/679, (EU) 2018/1725, […] [Data Governance Act COM/2020/767 final], Directive (EU) 2016/943 and […] [Data Act COM/2022/68 final].

Amendment 19

Proposal for a regulation

Article 2 – paragraph 1 – point d a (new)

Text proposed by the Commission

Amendment

(da) the definition of ‘professional user’ pursuant to Article 3 (8) of the Regulation (EU) 2018/1807;

Amendment 20

Proposal for a regulation

Article 2 – paragraph 1 – point e

Text proposed by the Commission

Amendment

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 (1), (12), (14), (22), (36) and (71) of the Regulation (EU) 2017/745;

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘putting into service’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 (1), (12), (14), (22), (29), (36) and (71) of the Regulation (EU) 2017/745;

Amendment 21

Proposal for a regulation

Article 2 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) ‘non-personal electronic health data’ means data concerning health and genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

(b) ‘non-personal electronic health data’ means data concerning health and aggregated genetic data in electronic format that falls outside the definition of personal data provided in Article 4(1) of Regulation (EU) 2016/679;

Amendment 22

Proposal for a regulation

Article 2 – paragraph 2 – point i a (new)

Text proposed by the Commission

Amendment

(ia) ‘economic operator’ means the manufacturer, the authorised representative, the importer, the distributor, the fulfilment service provider or any other natural or legal person who is subject to obligations in relation to the manufacture of EHR systems, making them available on the market, putting them into service or maintaining them in accordance with the relevant Union harmonisation legislation;

Amendment 23

Proposal for a regulation

Article 2 – paragraph 2 – point m

Text proposed by the Commission

Amendment

(m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for healthcare purposes;

(m) ‘EHR’ (electronic health record) means a comprehensive medical record or similar documentation of the past and present state of health of a natural person, including physical and mental health, in electronic form, collected in the health system, processed for healthcare purposes;

Amendment 24

Proposal for a regulation

Article 2 – paragraph 2 – point n

Text proposed by the Commission

Amendment

(n) ‘EHR system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

(n) ‘EHR system’ (electronic health record system) means any product (hardware, software or other product) primarily intended by the manufacturer to be used or that can be reasonably expected by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records, whose main purpose is to facilitate sharing patient information with authorised providers, healthcare professionals, or patients and data flow between healthcare providers;

Amendment 25

Proposal for a regulation

Article 2 – paragraph 2 – point n a (new)

Text proposed by the Commission

Amendment

(na) ‘general software’ means any software that is not primarily intended by the manufacturer to be used or that cannot be reasonably expected by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

Amendment 26

Proposal for a regulation

Article 2 – paragraph 2 – point o

Text proposed by the Commission

Amendment

(o) ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data for other purposes than healthcare, such as well-being and pursuing healthy life-styles;

(o) ‘wellness application’ means any product or software intended by the manufacturer to be used or that can be reasonably expected by the manufacturer to be mainly used by a natural person for processing electronic health data for healthy life-style and well-being purposes related to healthcare;

Amendment 27

Proposal for a regulation

Article 3 – paragraph 10

Text proposed by the Commission

Amendment

10. Natural persons shall have the right to obtain information on the healthcare providers and health professionals that have accessed their electronic health data in the context of healthcare. The information shall be provided immediately and free of charge through electronic health data access services.

10. Natural persons shall have the right to obtain information on which healthcare providers and health professionals have specifically accessed their electronic health data and when available the reason why these actors accessed this data in the context of healthcare. The information shall be provided immediately and free of charge through electronic health data access services.

Amendment 28

Proposal for a regulation

Article 4 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. Natural or legal persons shall be requested to provide data to public sector bodies or EHR providers under the primary or secondary use regime only once, while all actors may request access to and use such data for secondary purposes in accordance with the provisions laid down in Chapter IV.

Amendment 29

Proposal for a regulation

Article 6 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. The Commission shall, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data referred to in Article 5, setting out the European electronic health record exchange format. The format shall include the following elements:

1. The Commission shall, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data referred to in Article 5, setting out the European electronic health record exchange format. When setting out the European electronic health record exchange format, the Commission shall take into consideration existing international standards and formats already used in the Member States. The format shall include the following elements:

Amendment 30

Proposal for a regulation

Article 10 – paragraph 2 – point i a (new)

Text proposed by the Commission

Amendment

(ia) ensure robust cybersecurity measures to protect sensitive health data of users to thwart any attempts to breach the systems and steal or damage the data;

Amendment 31

Proposal for a regulation

Article 12 – paragraph 1

Text proposed by the Commission

Amendment

1. The Commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the Member States.

1. The Commission shall establish a central platform for digital health to provide services to support and facilitate the exchange of electronic health data between national contact points for digital health of the Member States. Where deemed appropriate, parts of or the entirety of the central platform shall be licenced under an open-source licence and published in the Open Source code repository of the Union institutions.

Amendment 32

Proposal for a regulation

Article 12 – paragraph 4

Text proposed by the Commission

Amendment

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

4. No later than 12 months after the entry into force of the Regulation, the Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those measures shall also include target implementation dates, including for improved cross border health data interoperability. The Commission shall consult the EHDS Board, ENISA and EDPB when preparing the implementing acts. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Amendment 33

Proposal for a regulation

Article 14 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. Manufacturers of EHR systems that also qualify as medical devices as defined in Article 2 point (1) of Regulation (EU) 2017/745 and claim interoperability of those medical devices with EHR systems under this Regulation shall prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II to this Regulation. Section 3 of this Chapter shall be applicable to those medical devices.

Amendment 34

Proposal for a regulation

Article 14 – paragraph 4

Text proposed by the Commission

Amendment

4. Providers of high-risk AI systems as defined in Article 6 of Regulation […] [AI act COM/2021/206 final], which does not fall within the scope of Regulation (EU) 2017/745, that claim interoperability of those AI systems with EHR systems will need to prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II of this Regulation. Article 23 of this Chapter shall be applicable to those high-risk AI systems.

4. Notwithstanding the obligations laid down in Regulation [AI act COM/2021/206 final], providers of high-risk AI systems as defined in Article 6 of Regulation […] [AI act COM/2021/206 final], which does not fall within the scope of Regulation (EU) 2017/745, that claim interoperability of those AI systems with EHR systems will need to prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II of this Regulation. Article 23 of this Chapter shall be applicable to those high-risk AI systems.

Amendment 35

Proposal for a regulation

Article 15 – paragraph 1

Text proposed by the Commission

Amendment

1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in this Chapter.

1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in Section 3 of this Chapter and in Annex II.

Amendment 36

Proposal for a regulation

Article 16 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user with regard to its intended purpose, interoperability and security by:

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the professional user, and where appropriate other types of users with regard to its intended purpose, interoperability and security by:

Amendment 37

Proposal for a regulation

Article 16 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) failing to inform the user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

(b) failing to inform the professional user, and where appropriate other types of users of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

Amendment 38

Proposal for a regulation

Article 17 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) draw up the technical documentation of their EHR systems in accordance with Article 24;

(b) draw up and keep up to date the technical documentation of their EHR systems in accordance with Article 24;

Amendment 39

Proposal for a regulation

Article 17 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) ensure that their EHR systems are accompanied, free of charge for the user, by the information sheet provided for in Article 25 and clear and complete instructions for use;

(c) ensure that their EHR systems are accompanied, free of charge for the user, by the information sheet provided for in Article 25 and by clear and complete instructions for use in accessible formats for persons with disabilities;

Amendment 40

Proposal for a regulation

Article 17 – paragraph 1 – point g

Text proposed by the Commission

Amendment

(g) take without undue delay any necessary corrective action in respect of their EHR systems which are not in conformity with the essential requirements laid down in Annex II, or recall or withdraw such systems;

(g) take immediately any necessary corrective action in respect of their EHR systems when manufacturers consider or have reasons to believe that such systems are not in conformity with the essential requirements laid down in Annex II, or recall or withdraw such systems;

Amendment 41

Proposal for a regulation

Article 17 – paragraph 1 – point h

Text proposed by the Commission

Amendment

(h) inform the distributors of their EHR systems and, where applicable, the authorised representative and importers of any corrective action, recall or withdrawal;

(h) immediately inform the distributors of their EHR systems and, where applicable, the authorised representative and importers of any corrective action, recall or withdrawal;

Amendment 42

Proposal for a regulation

Article 17 – paragraph 1 – point i

Text proposed by the Commission

Amendment

(i) inform the market surveillance authorities of the Member States in which they made their EHR systems available or put them into service of the non-conformity and of any corrective action taken;

(i) immediately inform the market surveillance authorities of the Member States in which they made their EHR systems available or put them into service of the non-conformity and of any corrective action taken;

Amendment 43

Proposal for a regulation

Article 17 – paragraph 1 – point i a (new)

Text proposed by the Commission

Amendment

(ia) immediately inform the market surveillance authorities of the Member States in which they made their EHR systems available, where manufacturers consider or have reasons to believe that such systems present a risk to the health or safety of natural persons;

Amendment 44

Proposal for a regulation

Article 17 – paragraph 1 – point k a (new)

Text proposed by the Commission

Amendment

(ka) establish reporting channels and ensure their accessibility to allow for users to submit complaints or concerns regarding potential non-conformity of products, assess the complaints and concerns received and inform market surveillance authorities in case of suspected non-compliance of the product, and keep a register of complaints and concerns received and make it available upon request from a market surveillance authority.

Amendment 45

Proposal for a regulation

Article 17 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. If the manufacturer fails to cooperate with market surveillance authorities or if the information and documentation provided is incomplete or incorrect, market surveillance authorities shall take all appropriate and proportionate measures to prohibit or restrict the relevant EHR system from being available on the market, to withdraw it from the market or to recall it until the manufacturer cooperates or provides complete and correct information;

Amendment 46

Proposal for a regulation

Article 17 – paragraph 3

Text proposed by the Commission

Amendment

3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity for 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market.

3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity for 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market and ensure that the technical documentation and the declaration of conformity are made available to the market surveillance authorities upon request.

Amendment 47

Proposal for a regulation

Article 17 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. Natural or legal persons may claim compensation for damage caused by a defective EHR system in accordance with applicable Union and national law.

Amendment 48

Proposal for a regulation

Article 17 – paragraph 3 b (new)

Text proposed by the Commission

Amendment

3b. Manufacturers shall make publicly available communication channels such as a telephone number, electronic address or dedicated section of their website, taking into account accessibility needs for persons with disabilities, allowing users to file complaints and to inform them of risks related to their health and safety or to other aspects of public interest protection and of any serious incident involving an EHR system.

Amendment 49

Proposal for a regulation

Article 17 – paragraph 3 c (new)

Text proposed by the Commission

Amendment

3c. Manufacturers shall investigate complaints and information on incidents involving an EHR system they made available on the market without undue delay and shall keep an internal register of those complaints as well as of systems recalls and any corrective measures taken to bring the EHR system into conformity.

Amendment 50

Proposal for a regulation

Article 17 – paragraph 3 d (new)

Text proposed by the Commission

Amendment

3d. Personal data stored in the internal register of complaints shall only be those personal data that are necessary for the manufacturer to investigate the complaint. Such data shall only be kept as long as it is necessary for the purpose of investigation and no longer than 5 years after they have been encoded.

Amendment 51

Proposal for a regulation

Article 18 – paragraph 1

Text proposed by the Commission

Amendment

1. Prior to making an EHR system available on the Union market, a manufacturer of an EHR system established outside of the Union shall, by written mandate, appoint an authorised representative which is established in the Union.

1. Where a manufacturer of an EHR system is established outside of the Union, the EHR system may only be made available on the Union market if the manufacturer appoints, by written mandate, an authorised representative which is established in the Union.

Amendment 52

Proposal for a regulation

Article 18 – paragraph 2 – introductory part

Text proposed by the Commission

Amendment

2. An authorised representative shall perform the tasks specified in the mandate received from the manufacturer. The mandate shall allow the authorised representative to do at least the following:

2. An authorised representative shall perform the tasks specified in the mandate agreed with the manufacturer. The mandate shall allow the authorised representative to do at least the following:

Amendment 53

Proposal for a regulation

Article 18 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) further to a reasoned request from a market surveillance authority, provide that authority with all the information and documentation necessary to demonstrate the conformity of an EHR system with the essential requirements laid down in Annex II;

(b) further to a reasoned request from a market surveillance authority, provide that authority, in an official language of the Member State where the market surveillance authority is located, with all the information and documentation necessary to demonstrate the conformity of an EHR system with the essential requirements laid down in Annex II;

Amendment 54

Proposal for a regulation

Article 18 – paragraph 2 – point b a (new)

Text proposed by the Commission

Amendment

(ba) immediately inform the manufacturer if the authorised representative has a reason to believe that an EHR system presents a risk to the health or safety of natural persons or to other aspects of public interest protection or if it is aware of any serious incident involving an EHR system;

Amendment 55

Proposal for a regulation

Article 18 – paragraph 2 – point b b (new)

Text proposed by the Commission

Amendment

(bb) immediately inform the manufacturer about complaints received by users;

Amendment 56

Proposal for a regulation

Article 18 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. In case of change of the authorised representative, the detailed arrangements for the change shall address at least the following aspects:

(a) the date of termination of the mandate of the outgoing authorised representative and date of beginning of the mandate of the incoming authorised representative;

(b) the transfer of documents, including confidentiality aspects and property rights;

Amendment 57

Proposal for a regulation

Article 19 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(aa) the manufacturer is identified and an authorised representative in accordance with Article 18 has been appointed;

Amendment 58

Proposal for a regulation

Article 19 – paragraph 2 – point c

Text proposed by the Commission

Amendment

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and appropriate instructions for use.

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and by clear and complete instructions for use in accessible formats for persons with disabilities.

Amendment 59

Proposal for a regulation

Article 19 – paragraph 3

Text proposed by the Commission

Amendment

3. Importers shall indicate their name, registered trade name or registered trade mark and the address at which they can be contacted in a document accompanying the EHR system.

3. Importers shall indicate their name, registered trade name or registered trade mark, the postal and electronic address at which they can be contacted in a document accompanying the EHR system. They shall ensure that any additional label does not obscure any information on the label provided by the manufacturer.

Amendment 60

Proposal for a regulation

Article 19 – paragraph 5

Text proposed by the Commission

Amendment

5. Where an importer considers or has reason to believe that an EHR system is not in conformity with the essential requirements in Annex II, it shall not make that system available on the market until that system has been brought into conformity. The importer shall inform without undue delay the manufacturer of such EHR system and the market surveillance authorities of the Member State in which it made the EHR system available, to that effect.

5. Where an importer considers or has reason to believe that an EHR system is not in conformity with the essential requirements in Annex II, it shall not make that system available on the market until that system has been brought into conformity. The importer shall inform without undue delay the manufacturer of such EHR system and the market surveillance authorities of the Member State in which it made the EHR system available, to that effect. Where an importer considers or has reason to believe that an EHR system presents a risk to the health or safety of natural persons, it shall immediately inform the market surveillance authority of the Member State in which the importer is established, as well as the manufacturer and where applicable, the authorised representative.

Amendment 61

Proposal for a regulation

Article 19 – paragraph 7

Text proposed by the Commission

Amendment

7. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system in the official language of the Member State where the market surveillance authority is located. They shall cooperate with that authority, at its request, on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II.

7. Importers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system in the official language of the Member State where the market surveillance authority is located. Importers shall cooperate with that authority, at its request, and with the manufacturer and, where applicable, with the manufacturer’s authorised representative on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II, or to ensure that their EHR systems are withdrawn or recalled.

Amendment 62

Proposal for a regulation

Article 19 – paragraph 7 a (new)

Text proposed by the Commission

Amendment

7a. Importers shall verify whether the communication channels referred to in Article 17(3b), are publicly available to users allowing them to submit complaints and communicate any risk related to their health and safety or to any serious incident involving an EHR system. If such channels are not available, the importer shall provide for them, taking into account accessibility needs for persons with disabilities.

Amendment 63

Proposal for a regulation

Article 19 – paragraph 7 b (new)

Text proposed by the Commission

Amendment

7b. Importers shall investigate complaints and information on incidents involving an EHR system they made available on the market and file those complaints, as well as of systems recalls and any corrective measures taken to bring the EHR system into conformity, in the register referred to in Article 17(3c) or in their own internal register. Importers shall keep the manufacturer, distributors and, where relevant, authorised representatives informed in a timely manner of the investigation performed and of the results of the investigation.

Amendment 64

Proposal for a regulation

Article 19 – paragraph 7 c (new)

Text proposed by the Commission

Amendment

7c. Personal data stored in the internal register of complaints shall only be those personal data that are necessary for the importer to investigate the complaint. Such data shall only be kept as long as it is necessary for the purpose of investigation and no longer than five years after they have been encoded.

Amendment 65

Proposal for a regulation

Article 20 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and appropriate instructions for use;

(c) the EHR system is accompanied by the information sheet referred to in Article 25 and by clear and complete instructions for use in accessible formats for persons with disabilities;

Amendment 66

Proposal for a regulation

Article 20 – paragraph 3

Text proposed by the Commission

Amendment

3. Where a distributor considers or has reason to believe that an EHR system is not in conformity with the essential requirements laid down in Annex II, it shall not make the EHR system available on the market until it has been brought into conformity. Furthermore, the distributor shall inform without undue delay the manufacturer or the importer, as well as the market surveillance authorities of the Member states where the EHR system has been made available on the market, to that effect.

3. Where a distributor considers or has reason to believe that an EHR system is not in conformity with the essential requirements laid down in Annex II, it shall not make the EHR system available on the market until it has been brought into conformity. Furthermore, the distributor shall inform without undue delay the manufacturer or the importer, as well as the market surveillance authorities of the Member states where the EHR system has been made available on the market, to that effect. Where a distributor considers or has reason to believe that an EHR system presents a risk to the health or safety of natural persons, it shall immediately inform the market surveillance authority of the Member State in which the distributor is established, as well as the manufacturer, the importer and where applicable, the authorised representative.

Amendment 67

Proposal for a regulation

Article 20 – paragraph 4

Text proposed by the Commission

Amendment

4. Distributors shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system. They shall cooperate with that authority, at its request, on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II.

4. Distributors shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation necessary to demonstrate the conformity of an EHR system..They shall cooperate with that authority, at its request, and with the manufacturer, the importer and, where applicable, with the manufacturer’s authorised representative on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II or to ensure that their EHR systems are withdrawn or recalled.

Amendment 68

Proposal for a regulation

Article 21 – title

Text proposed by the Commission

Amendment

Cases in which obligations of manufacturers of an EHR system apply to importers and distributors

Cases in which obligations of manufacturers of an EHR system apply to importers and distributors and other economic operators

Amendment 69

Proposal for a regulation

Article 21 – paragraph 1

Text proposed by the Commission

Amendment

An importer or distributor shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

An importer, distributor or another economic operator who makes modifications to the EHR system while deploying or using it, which lead to changes in the intended purpose and deployments recommendations for the EHR system as declared by the manufacturer, shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or substantially modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

Amendment 70

Proposal for a regulation

Article 21 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. In the event of any malfunctioning or deterioration in performance quality due to the changes made by economic operators during deployment or use of the EHR system contrary to the manufacturers’ recommendations for technical deployment of the system or purpose of its use, the economic operator shall bear full responsibility for those modifications.

Amendment 71

Proposal for a regulation

Article 21 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. Placing on the market of second-hand EHR systems, whether prepared for re-use, checked, cleaned, repaired, refurbished or without any action on the product shall not be considered as a substantial modification in line with relevant Union or national law on product safety, in case the second-hand economic operators’ interventions do not lead to changes in the intended purpose, deployments, recommendations and level of risk for the EHR system as declared by the manufacturer and the conformity with applicable requirements is not affected.

Amendment 72

Proposal for a regulation

Article 23 – paragraph 1 – subparagraph 1

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. When drafting common specifications, the Commission shall take into account the existing harmonised standards or international standards. Where relevant, the common specifications shall take into account the specificities and verify compatibility with sectorial legislation and harmonised standards of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14, including the state-of-the-art standards for health informatics and the European electronic health record exchange format. Before adopting the implementing act, the Commission shall consult the relevant European standardisation organisations and European stakeholder organisations receiving Union financing under Regulation (EU) No 1025/2012, the European Data Protection Supervisor and the European Data Protection Board where common specifications have an impact on the data protection requirements of EHR systems.

Amendment 73

Proposal for a regulation

Article 23 – paragraph 5

Text proposed by the Commission

Amendment

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications may be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Board referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable.

5. Where common specifications covering interoperability and security requirements of EHR systems affect medical devices or high-risk AI systems falling under other acts, such as Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], the adoption of those common specifications shall be preceded by a consultation with the Medical Devices Coordination Group (MDCG) referred to in Article 103 of Regulation (EU) 2017/745 or the European Artificial Intelligence Office referred to in Article 56 of Regulation […] [AI Act COM/2021/206 final], as applicable, as well as the European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679.

Amendment 74

Proposal for a regulation

Article 23 – paragraph 6

Text proposed by the Commission

Amendment

6. Where common specifications covering interoperability and security requirements of medical devices or high-risk AI systems falling under other acts such as Regulation (EU) 2017/745 or Regulation […] [AI Act COM/2021/206 final], impact EHR systems, the adoption of those common specifications shall be preceded by a consultation with the EHDS Board, especially its subgroup for Chapters II and III of this Regulation.

6. Where common specifications covering interoperability and security requirements of medical devices or high-risk AI systems falling under other acts such as Regulation (EU) 2017/745 or Regulation […] [AI Act COM/2021/206 final], impact EHR systems, the adoption of those common specifications shall be preceded by a consultation with the EHDS Board, especially its subgroup for Chapters II and III of this Regulation, and, where applicable, the European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679).

Amendment 75

Proposal for a regulation

Article 24 – paragraph 1

Text proposed by the Commission

Amendment

1. The technical documentation shall be drawn up before the EHR system is placed on the market or put into service and shall be kept up-to-date.

1. Manufacturers shall draw up and keep up-to-date technical documentation before the EHR system is placed on the market or put into service.

Amendment 76

Proposal for a regulation

Article 24 – paragraph 2

Text proposed by the Commission

Amendment

2. The technical documentation shall be drawn up in such a way as to demonstrate that the EHR system complies with the essential requirements laid down in Annex II and provide market surveillance authorities with all the necessary information to assess the conformity of the EHR system with those requirements. It shall contain, at a minimum, the elements set out in Annex III.

2. The technical documentation shall be drawn up in such a way as to demonstrate that the EHR system complies with the essential requirements laid down in Annex II and provide market surveillance authorities with all the necessary information to assess the conformity of the EHR system with those requirements. It shall contain, at a minimum, the elements set out in Annex III. In case the system or any part of it complies with European standards or common specifications, the list of the relevant European standards and common specifications shall also be indicated.

Amendment 77

Proposal for a regulation

Article 25 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the identity, registered trade name or registered trademark, and the contact details of the manufacturer and, where applicable, of its authorised representative;

(a) the identity, registered trade name or registered trademark, and the contact details of the manufacturer, including the postal and electronic address and, where applicable, of its authorised representative;

Amendment 78

Proposal for a regulation

Article 26 – paragraph 4

Text proposed by the Commission

Amendment

4. By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the conformity of the EHR system.

4. By drawing up the EU declaration of conformity, the manufacturer shall assume responsibility for the compliance with the requirements of this Regulation.

Amendment 79

Proposal for a regulation

Article 26 – paragraph 4 a (new)

Text proposed by the Commission

Amendment

4a. The Commission is empowered to adopt delegated acts in accordance with Article 67 amending the minimum content of the EU declaration of conformity set out in Annex IV.

Amendment 80

Proposal for a regulation

Article 27 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The CE marking shall be affixed before making the EHR system available on the market.

Amendment 81

Proposal for a regulation

Article 28 – paragraph 2

Text proposed by the Commission

Amendment

2. Member States shall designate the market surveillance authority or authorities responsible for the implementation of this Chapter. They shall entrust their market surveillance authorities with the powers, resources, equipment and knowledge necessary for the proper performance of their tasks pursuant to this Regulation. Member States shall communicate the identity of the market surveillance authorities to the Commission which shall publish a list of those authorities.

2. Member States shall designate the market surveillance authority or authorities responsible for the implementation of this Chapter. They shall entrust their market surveillance authorities with the powers, human, technical and financial resources, equipment, IT tools, premises, infrastructure, knowledge and ongoing training necessary for the proper and effective performance of their tasks pursuant to this Regulation. Member States shall communicate the identity of the market surveillance authorities to the Commission which shall publish a list of those authorities.

Amendment 82

Proposal for a regulation

Article 29 – paragraph 3

Text proposed by the Commission

Amendment

3. The market surveillance authority shall immediately inform the Commission and the market surveillance authorities of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken.

3. The market surveillance authority shall immediately inform the Commission and the market surveillance authorities of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken. The market surveillance authority shall also notify and cooperate with data protection authorities.

Amendment 83

Proposal for a regulation

Article 30 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. Where a market surveillance authority makes one of the following findings, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to put an end to the non-compliance concerned:

1. Where a market surveillance authority makes, inter alia, one of the following findings, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to bring the EHR system into conformity:

Amendment 84

Proposal for a regulation

Article 30 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the EHR system is not in conformity with essential requirements laid down in Annex II;

(a) the EHR system is not in conformity with essential requirements laid down in Annex II and with the common specifications in accordance with Article 23;

Amendment 85

Proposal for a regulation

Article 30 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) the technical documentation is either not available or not complete;

(b) the technical documentation is either not available or not complete, or not in accordance with Article 24;

Amendment 86

Proposal for a regulation

Article 30 – paragraph 1 – point b a (new)

Text proposed by the Commission

Amendment

(ba) the EHR system is not accompanied by the information sheet provided for in Article 25;

Amendment 87

Proposal for a regulation

Article 30 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the EU declaration of conformity has not been drawn up or has not been drawn up correctly;

(c) the EU declaration of conformity has not been drawn up or has not been drawn up correctly as referred to in Article 26;

Amendment 88

Proposal for a regulation

Article 30 – paragraph 1 – point d a (new)

Text proposed by the Commission

Amendment

(da) the registration obligations of Article 32 has not been fulfilled.

Amendment 89

Proposal for a regulation

Article 31 – paragraph 6

Text proposed by the Commission

Amendment

6. If the wellness application is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label.

6. If the wellness application is an integral part of a device or is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label. If the wellness application is embedded in a device after its putting into service, the wellness application label may be shown in the application itself.

Amendment 90

Proposal for a regulation

Article 31 – paragraph 9

Text proposed by the Commission

Amendment

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form or, upon request, in physical form.

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.

Amendment 91

Proposal for a regulation

Article 33 – paragraph 1 – point j

Text proposed by the Commission

Amendment

(j) electronic health data from clinical trials;

(j) electronic health data from fully completed or terminated clinical trials;

Amendment 92

Proposal for a regulation

Article 33 – paragraph 4

Text proposed by the Commission

Amendment

4. Electronic health data entailing protected intellectual property and trade secrets from private enterprises shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken.

4. Electronic health data entailing protected intellectual property and trade secrets from health data holders shall be made available for secondary use. Where such data is made available for secondary use, all measures necessary preserve IP rights and the confidentiality of trade secrets must be taken. The sharing of health data for secondary use including the sharing of clinical trial data, shall be shared without prejudice to existing relevant Union legislation including Directive 2004/48/EC, Directive 2001/29/EC, Directive (EU) 2016/943, Directive (EU) 2019/790 and Regulation (EU) No 536/2014.

Amendment 93

Proposal for a regulation

Article 34 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(aa) activities for reasons of public interest in cases of serious public health threats.

Amendment 94

Proposal for a regulation

Article 34 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) development and innovation activities for products or services contributing to public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices;

(f) development and innovation activities for products or services contributing to public health or social security, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices, including supporting operational efficiency, improving the patient pathway and post-market monitoring to identify side effects and adverse events;

Amendment 95

Proposal for a regulation

Article 34 – paragraph 1 – point f a (new)

Text proposed by the Commission

Amendment

(fa) development and innovation activities for products or services, including health economics and health outcomes research studies;

Amendment 96

Proposal for a regulation

Article 37 – paragraph 1 – point i

Text proposed by the Commission

Amendment

(i) support the development of AI systems, the training, testing and validating of AI systems and the development of harmonised standards and guidelines under Regulation […] [AI Act COM/2021/206 final] for the training, testing and validation of AI systems in health;

(i) the data access bodies shall support with expertise the development of AI systems, the training, testing and validating of AI systems and the development of harmonised standards and guidelines under Regulation […] [AI Act COM/2021/206 final] for the training, testing and validation of AI systems in health.

Amendment 97

Proposal for a regulation

Article 41 – paragraph 1

Text proposed by the Commission

Amendment

1. Where a data holder is obliged to make electronic health data available under Article 33 or under other Union law or national legislation implementing Union law, it shall cooperate in good faith with the health data access bodies, where relevant.

1. A data holder is obliged to make electronic health data available under Article 33 or under other Union law or national legislation implementing Union law, it shall cooperate in a methodical and supervised process with the health data access bodies and other involved actors.

Amendment 98

Proposal for a regulation

Article 42 – paragraph 1

Text proposed by the Commission

Amendment

1. Health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. Any fees shall include and be derived from the costs related to conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final]

1. Health data access bodies and single data holders may charge fees for making electronic health data available for secondary use. Any fees shall be proportionate in relation to the costs related to conducting the procedure for requests, including for assessing a data application or a data request, granting, refusing or amending a data permit pursuant to Articles 45 and 46 or providing an answer to a data request pursuant to Article 47, in accordance with Article 6 of Regulation […] [Data Governance Act COM/2020/767 final]

Amendment 99

Proposal for a regulation

Article 44 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. The Commission shall, by means of an implementing act, set out rules for risk-based anonymisation methodology, taking into consideration risk factors such as type of use, the safeguards in place, probability of re-identification of patients, sensitivity of type of data.

Amendment 100

Proposal for a regulation

Article 46 – paragraph 11

Text proposed by the Commission

Amendment

11. Data users shall make public the results or output of the secondary use of electronic health data, including information relevant for the provision of healthcare, no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in Article 47. Those results or output shall only contain anonymised data. The data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites. Whenever the data users have used electronic health data in accordance with this Chapter, they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the EHDS.

11. Data users shall make public the results or output of the secondary use of electronic health data, including information relevant for the provision of healthcare, no later than 18 months after the completion of the electronic health data processing or after having received the answer to the data request referred to in Article 47. Those results or output shall only contain anonymised data. The data user shall inform the health data access bodies from which a data permit was obtained and support them to make the information public on health data access bodies’ websites without prejudice to IP rights and relevant Union law. Whenever the data users have used electronic health data in accordance with this Chapter, they shall acknowledge the electronic health data sources and the fact that electronic health data has been obtained in the context of the EHDS.

Amendment 101

Proposal for a regulation

Article 49 – paragraph 1

Text proposed by the Commission

Amendment

1. Where an applicant requests access to electronic health data only from a single data holder in a single Member State, by way of derogation from Article 45(1), that applicant may file a data access application or a data request directly to the data holder. The data access application shall comply with the requirements set out in Article 45 and the data request shall comply with requirements in Article 47. Multi-country requests and requests requiring a combination of datasets from several data holders shall be adressed to health data access bodies.

1. Where an applicant requests access to electronic health data only from a single data holder in a single Member State, by way of derogation from Article 45(1), that applicant may file a data access application or a data request directly to the data holder. The applicant may file a data access application or a data request also by other means of sharing health data using existing infrastructures and registries that have established data flows, technical architectures, governance models and data access. The Regulation shall not impede existing data sharing initiatives already in place in Union and Member States in order to enhance the interoperability and data exchange in the internal market. The data access application shall comply with the requirements set out in Article 45 and the data request shall comply with requirements in Article 47. Multi-country requests and requests requiring a combination of datasets from several data holders may be adressed to health data access bodies.

Amendment 102

Proposal for a regulation

Article 64 – paragraph 1

Text proposed by the Commission

Amendment

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor may be invited to the meetings, where the issues discussed are of relevance for them. The Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

1. A European Health Data Space Board (EHDS Board) is hereby established to facilitate cooperation and the exchange of information among Member States. The EHDS Board shall be composed of the high level representatives of digital health authorities and health data access bodies of all the Member States. Other national authorities, including market surveillance authorities referred to in Article 28, European Data Protection Board and European Data Protection Supervisor shall be invited to the meetings. The Board may also invite experts and observers to attend its meetings, and may cooperate with other external experts as appropriate. Other Union institutions, bodies, offices and agencies, research infrastructures and other similar structures shall have an observer role.

Amendment 103

Proposal for a regulation

Article 65 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the primary use of electronic health data;

Amendment 104

Proposal for a regulation

Article 65 – paragraph 1 – point e b (new)

Text proposed by the Commission

Amendment

(eb) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the secondary use of electronic health data.

Amendment 105

Proposal for a regulation

Article 67 – paragraph 4

Text proposed by the Commission

Amendment

4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making.

4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State and relevant stakeholders, in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making.

Amendment 106

Proposal for a regulation

Article 68 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. In accordance with the Inter-Institutional Agreement of 13 April 2016 on Better Law-Making, the Commission shall make use of expert groups, consult targeted stakeholders and carry out public consultations to gather broader expertise in the early preparation of draft implementing acts.

Amendment 107

Proposal for a regulation

Article 69 – paragraph 1

Text proposed by the Commission

Amendment

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties shall be effective, proportionate and dissuasive. Member States shall notify the Commission of those rules and measures by date of application of this Regulation and shall notify the Commission without delay of any subsequent amendment affecting them.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are properly and effectively implemented. The penalties shall be effective, proportionate and dissuasive. Member States shall notify the Commission of those rules and measures by date of application of this Regulation and shall notify the Commission without delay of any subsequent amendment affecting them.

Amendment 108

Proposal for a regulation

Article 69 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. Penalties shall cover infringements not addressed by Regulation (EU) 2017/745, Regulation (EU) 2017/746, Regulation (EU) No 536/2014 and Regulation (EU) 2016/679 and shall depend on the circumstances of each individual case. When deciding whether to impose a penalty and deciding on the amount of the penalty in each individual case, due regard shall be given to the criteria stated in Article 83(2) of Regulation (EU) 2016/679, where applicable.

Amendment 109

Proposal for a regulation

Article 69 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. Penalties shall at least include fines proportionate to the extent of non-compliance and to the turnover of the relevant economic operator. Fines shall be calculated in such a way as to make sure that they effectively deprive the economic operator of the economic benefits derived from their infringements. Fines shall be gradually increased for repeated infringements.

Amendment 110

Proposal for a regulation

Article 69 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

1c. If the EHR system provider or data holder intentionally or negligently, for the same or linked operations, infringes several provisions of this Regulation, the total amount of the penalty shall not exceed the amount specified for the gravest infringement.

Amendment 111

Proposal for a regulation

Article 69 – paragraph 1 d (new)

Text proposed by the Commission

Amendment

1d. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including effective judicial remedy and due process.

Amendment 112

Proposal for a regulation

Article 69 – paragraph 1 e (new)

Text proposed by the Commission

Amendment

1e. Where the law of the Member State does not provide for penalties, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the penalties imposed by supervisory authorities.

Amendment 113

Proposal for a regulation

Article 69 – paragraph 1 f (new)

Text proposed by the Commission

Amendment

1f. Member States shall ensure that any decision containing penalties related to the breach of the provisions of this Regulation is published no later than one month after the penalty is imposed.

Amendment 114

Proposal for a regulation

Article 70 – paragraph 1

Text proposed by the Commission

Amendment

1. After 5 years from the entry into force of this Regulation, the Commission shall carry out a targeted evaluation of this Regulation especially with regards to Chapter III, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The evaluation shall include an assessment of the self-certification of EHR systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies.

1. After 5 years from the entry into force of this Regulation, the Commission shall carry out a targeted evaluation of this Regulation especially with regards to Chapter III, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The evaluation shall include an assessment of:

(a) the effectiveness of self-certification of EHR systems and reflect on the need to introduce a conformity assessment procedure performed by notified bodies or any other measure to facilitate market surveillance of EHR systems and ensure the functioning of the market; Member States shall provide the data and information necessary to conduct a thorough assessment;

(b) impacts of EHR systems on health outcomes for patients;

(c) impacts of EHR systems on healthcare economic performance;

(d) security, resilience and flexibility of the EHR systems and secondary data sharing framework in order to assess the readiness for potential future crisis;

(e) interoperability model in place in Member States, including best practices analysis;

(f) quality and coverage of access of health professionals to the medical records of patients per Member State, including impact on reduction of duplications and errors and reduction of administration time and costs;

(g) overlaps and incoherences with other Union and national legislation, including the quantification of related extra costs of overlaps and related regulatory uncertainty. Inter alia, the assessment shall analyse alignment with the General Data Protection Regulation, Data Governance Act, Data Act, AI Act and Regulations on cybersecurity.

Amendment 115

Proposal for a regulation

Article 70 – paragraph 2

Text proposed by the Commission

Amendment

2. After 7 years from the entry into force of this Regulation, the Commission shall carry out an overall evaluation of this Regulation, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment.

2. After 7 years from the entry into force of this Regulation, the Commission shall carry out an overall evaluation of this Regulation, and submit a report on its main findings to the European Parliament and to the Council, the European Economic and Social Committee and the Committee of the Regions, accompanied, where appropriate, by a proposal for its amendment. The overall evaluation shall also identify best practices and assess the health outcomes for patients and consumers resulting from implementation of the EHDS.

Amendment 116

Proposal for a regulation

Article 70 – paragraph 3

Text proposed by the Commission

Amendment

3. Member States shall provide the Commission with the information necessary for the preparation of that report.

3. Member States shall provide the Commission with the information necessary for the preparation of that report and shall report to the Commission on the common indicators.

Amendment 117

Proposal for a regulation

Article 70 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. The Commission shall be empowered to adopt, by ... [12 months after the date of entry into force of this Regulation], delegated acts to supplement this Regulation in order to

(a) set out the common result and impact oriented indicators to be used for reporting on the progress and for the purpose of monitoring and evaluation of this Regulation;

(b) measure the costs, benefits and other health and economic results including trends per Member State in order to compare the effectiveness of implementation of this Regulation; and

(c) define a methodology for reporting by Member States.

The Commission shall regularly revise and, if necessary, update the common indicators.

Amendment 118

Proposal for a regulation

Article 72 – paragraph 3 – point a

Text proposed by the Commission

Amendment

(a) from 1 year after date of entry into application to categories of personal electronic health data referred to in Article 5(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data.;

(a) from 3 years after date of entry into application to categories of personal electronic health data referred to in Article 5(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data;

Amendment 119

Proposal for a regulation

Annex II – point 3 – point 3.1

Text proposed by the Commission

Amendment

3.1. An EHR system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data, and that it prevents unauthorised access to such data.

3.1. An EHR system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data, and that it prevents unauthorised access to such data, and that it duly takes into consideration the principles of data minimization and data protection by design.

Amendment 120

Proposal for a regulation

Annex II – point 3 – point 3.8

Text proposed by the Commission

Amendment

3.8. An EHR system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data.

3.8. An EHR system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data and the specific purpose of the data processing operations.

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:

Entity and/or person

DIGITALEUROPE

COCIR

EDPB

EDPS

BEUC

Medtech Europe

Roche

AmCham

European Cancer Organisation

EURORDIS

France Digitale

EFPIA

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

European Health Data Space

References

COM(2022)0197 – C9-0167/2022 – 2022/0140(COD)

Committees responsible

Date announced in plenary

ENVI

6.6.2022

LIBE

6.6.2022

Opinion by

Date announced in plenary

IMCO

6.6.2022

Associated committees - date announced in plenary

16.2.2023

Rapporteur for the opinion

Date appointed

Andrey Kovatchev

8.7.2022

Rule 58 – Joint committee procedure

Date announced in plenary

16.2.2023

Discussed in committee

1.3.2023

28.3.2023

25.4.2023

Date adopted

23.5.2023

Result of final vote

+:

–:

0:

39

0

1

Members present for the final vote

Alex Agius Saliba, Andrus Ansip, Alessandra Basso, Adam Bielan, Biljana Borzan, Vlad-Marius Botoş, Anna Cavazzini, Dita Charanzová, Deirdre Clune, David Cormand, Alexandra Geese, Sandro Gozi, Krzysztof Hetman, Eugen Jurzyca, Arba Kokalari, Kateřina Konečná, Andrey Kovatchev, Maria-Manuel Leitão-Marques, Morten Løkkegaard, Adriana Maldonado López, Leszek Miller, Anne-Sophie Pelletier, Christel Schaldemose, Andreas Schwab, Tomislav Sokol, Ivan Štefanec, Róża Thun und Hohenstein, Tom Vandenkendelaere, Marion Walsmann

Substitutes present for the final vote

Marc Angel, Anna-Michelle Asimakopoulou, Christian Doleschal, Carlo Fidanza, Claude Gruffat, Ivars Ijabs, Katrin Langensiepen, Antonio Maria Rinaldi, Edina Tóth

Substitutes under Rule 209(7) present for the final vote

Elisabetta Gualmini, Francisco José Millán Mon

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols: