Sittings · Document

DRAFT OPINION (COM(2022)0197 – C90167/2022 – 2022/0140(COD)) 2023-02-08

On the proposal for a regulation of the European Parliament and of the Council on the European Health Data Space

Committee on the Internal Market and Consumer Protection · Rapporteur: Andrey Kovatchev

PA_Legam

SHORT JUSTIFICATION

This opinion focuses on the second pillar, Chapter III, which aims to implement a mandatory self-certification scheme for EHR systems, while complying with essential requirements on interoperability and security.

As Rapporteur for the IMCO Committee, I streamline the monitoring of the internal market. My draft opinion focuses on clarifying the definitions related to EHR, EHR systems, as well as introducing some new definition to allow for clear interpretation of the conditions set out in Chapter III of the proposal. Additionally, I propose to specify clearly the way in which the Commission will be creating the standards to apply to EHR systems through a clear reference to the use of international and harmonised standards, as well as the participation of all relevant stakeholders in this process.

My amendments further aim to define clearly the interplay between the EHDS and other sectoral legislation, especially for scenarios where devices would fall within the scope of more than one of these legislative acts.

An important addition is the requirement for the Commission and Member States to set explicit time-based targets for implementation and progress on cross-border health data interoperability and the relevant infrastructure.

This draft opinion aims to improve EHR systems by clarifying relevant definitions, ensuring that the Commission uses harmonised standards as the basis for setting EU-wide standards on security and interoperability for EHR systems, as well as reconciling the scope of the European Health Data Space with other sectoral legislation, such as the Medical Devices Regulation, the In-vitro Medical Device Regulation and the upcoming AI Act, and Data Act. By providing these clarifications, the proposed amendments intend to make the Commission’s proposal clearer and more predictable for stakeholders as well as clearly ensure the EU remains well connected globally and does not impose standards, which are not interoperable with global partners.

AMENDMENTS

The Committee on the Internal Market and Consumer Protection calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take into account the following amendments:

Amendment 1

Proposal for a regulation

Recital 16

Text proposed by the Commission

Amendment

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

(16) Timely and full access of health professionals to the medical records of patients is fundamental for ensuring continuity of care and avoiding duplications and errors. However, due to a lack of interoperability, in many cases, health professionals cannot access the complete medical records of their patients and cannot make optimal medical decisions for their diagnosis and treatment, which adds considerable costs for both health systems and natural persons and may lead to worse health outcomes for natural persons. Electronic health data made available in interoperable format, which can be transmitted between healthcare providers can also reduce the administrative burden on health professionals of manually entering or copying health data between electronic systems. Therefore, health professionals should be provided with appropriate electronic means, such as health professional portals, to use personal electronic health data for the exercise of their duties. Moreover, the Commission and Member States should agree on time-based targets to implement improved health data interoperability across the Union. The access to personal health records should be transparent to the natural persons and natural persons should be able to exercise full control over such access, including by limiting access to all or part of the personal electronic health data in their records. Health professionals should refrain from hindering the implementation of the rights of natural persons, such as refusing to take into account electronic health data originating from another Member State and provided in the interoperable and reliable European electronic health record exchange format.

Or. en

Amendment 2

Proposal for a regulation

Recital 19

Text proposed by the Commission

Amendment

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. In order to make electronic health data accesible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data.

(19) The level of availability of personal health and genetic data in an electronic format varies between Member States. The EHDS should make it easier for natural persons to have those data available in electronic format. This would also contribute to the achievement of the target of 100% of Union citizens having access to their electronic health records by 2030, as referred to in the Policy Programme “Path to the Digital Decade”. In order to make electronic health data accessible and transmissible, such data should be accessed and transmitted in an interoperable common European electronic health record exchange format, at least for certain categories of electronic health data, such as patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results and discharge reports, subject to transition periods. Where personal electronic health data is made available to a healthcare provider or a pharmacy by a natural person, or is transmitted by another data controller in the European electronic health record exchange format, the electronic health data should be read and accepted for the provision of healthcare or for dispensation of a medicinal product, thus supporting the provision of the health care services or the dispensation of the electronic prescription. Commission Recommendation (EU) 2019/24345 provides the foundations for such a common European electronic health record exchange format. The use of European electronic health record exchange format should become more generalised at EU and national level. While the eHealth Network under Article 14 of Directive 2011/24/EU of the European Parliament and of the Council46 recommended Member States to use the European electronic health record exchange format in procurements, in order to improve interoperability, uptake was limited in practice, resulting in fragmented landscape and uneven access to and portability of electronic health data. Moreover, an agreement on time-based EU level targets for implementation of health data interoperability, should be reached. In order to support the successful implementation of the EHDS and the execution of an effective landscape of European health data cooperation, the Commission shall agree with Member States a range of targets for health data interoperability milestones.

__________________

45 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format (OJ L 39, 11.2.2019, p. 18).

46 Directive 2011/24/EU of the European Parliament and of the Council of 9 March 2011 on the application of patients’ rights in cross-border healthcare (OJ L 88, 4.4.2011, p. 45).

Or. en

Amendment 3

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) In the context of MyHealth@EU, a central platform should provide a common infrastructure for the Member States to ensure connectivity and interoperability in an efficient and secure way. In order to guarantee compliance with data protection rules and to provide a risk management framework for the transmission of personal electronic health data, the Commission should, by means of implementing acts, allocate specific responsibilities among the Member States, as joint controllers, and prescribe its own obligations, as processor.

Or. en

Amendment 4

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) Software or module(s) of software which falls within the definition of a medical device or high-risk artificial intelligence (AI) system should be certified in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. The essential requirements on interoperability of this Regulation should only apply to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. In such case, the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

(29) Software or module(s) of software which fall within the definition of an EHR system as well as the definition of a medical device or high-risk artificial intelligence (AI) system should only be required to comply with the essential requirements on interoperability of this Regulation to the extent that the manufacturer of a medical device or high-risk AI system, which is providing electronic health data to be processed as part of the EHR system, claims interoperability with such EHR system. These types of software should exclusively follow the relevant conformity assessment in accordance with Regulation (EU) 2017/745 of the European Parliament and of the Council 49 and Regulation […] of the European Parliament and of the Council [AI Act COM/2021/206 final], as applicable. In such case, only the provisions on common specifications for EHR systems should be applicable to those medical devices and high-risk AI systems.

__________________

49 Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (OJ L 117, 5.5.2017, p. 1).

Or. en

Amendment 5

Proposal for a regulation

Recital 72 a (new)

Text proposed by the Commission

Amendment

(72a) In order to mitigate risks of delay in implementation, the Commission and Member States should agree on a range of time-based targets for EHDS, including in respect to health data interoperability.

Or. en

Amendment 6

Proposal for a regulation

Article 2 – paragraph 1 – point d a (new)

Text proposed by the Commission

Amendment

(da) the definition of ‘professional user’ pursuant to Article 3 point (8) of Regulation (EU) 2018/1807;

Or. en

Amendment 7

Proposal for a regulation

Article 2 – paragraph 1 – point e

Text proposed by the Commission

Amendment

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 (1), (12), (14), (22), (36) and (71) of the Regulation (EU) 2017/745;

(e) the definitions of ‘medical device’, ‘intended purpose’, ‘instructions for use’, ‘putting into service’, ‘performance’, ‘health institution’ and ‘common specifications’, pursuant to Article 2 points (1), (12), (14), (22), (29), (36) and (71) of Regulation (EU) 2017/745;

Or. en

Amendment 8

Proposal for a regulation

Article 2 – paragraph 2 – point i a (new)

Text proposed by the Commission

Amendment

(ia) ‘economic operator’ means the manufacturer, the authorised representative, the importer, the distributor, the fulfilment service provider or any other natural or legal person who is subject to obligations in relation to the manufacture of EHR systems, making them available on the market, putting them into service or maintaining them in accordance with the relevant Union harmonisation legislation;

Or. en

Amendment 9

Proposal for a regulation

Article 2 – paragraph 2 – point m

Text proposed by the Commission

Amendment

(m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for healthcare purposes;

(m) ‘EHR’ (electronic health record) means a comprehensive medical record or similar documentation of the past and present physical and mental state of health of a natural person in electronic form, collected in the health system, providing for ready availability of these data for medical treatment and other closely related purposes;

Or. en

Amendment 10

Proposal for a regulation

Article 2 – paragraph 2 – point n

Text proposed by the Commission

Amendment

(n) ‘EHR system’ (electronic health record system) means any appliance or software intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records;

(n) ‘EHR system’ (electronic health record system) means any product (hardware or software) primarily intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records, whose main purpose is to facilitate sharing patient information with authorised providers, healthcare professionals, or patients and to a data flow between healthcare facilities;

Or. en

Amendment 11

Proposal for a regulation

Article 2 – paragraph 2 – point n a (new)

Text proposed by the Commission

Amendment

(na) ‘general software’ means any software whose main intended purpose is other than the intended purpose of EHR systems;

Or. en

Amendment 12

Proposal for a regulation

Article 12 – paragraph 4

Text proposed by the Commission

Amendment

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those measures shall also include target implementation dates, including for improved cross border health data interoperability. The Commission shall consult the EHDS Board when preparing the implementing acts. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Or. en

Amendment 13

Proposal for a regulation

Article 14 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. Manufacturers of EHR systems that also qualify as medical devices as defined in Article 2 point (1) of Regulation (EU) 2017/745 and claim interoperability of those medical devices with EHR systems under this Regulation shall prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II to this Regulation. Article 23 of this Regulation shall be applicable to those medical devices.

Or. en

Amendment 14

Proposal for a regulation

Article 15 – paragraph 1

Text proposed by the Commission

Amendment

1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in this Chapter.

1. EHR systems may be placed on the market or put into service only if they comply with Article 23 and the requirements laid down in Annex II.

Or. en

Amendment 15

Proposal for a regulation

Article 16 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the user with regard to its intended purpose, interoperability and security by:

In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the professional user with regard to its intended purpose, interoperability and security by:

Or. en

Amendment 16

Proposal for a regulation

Article 16 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) failing to inform the user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

(b) failing to inform the professional user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

Or. en

Amendment 17

Proposal for a regulation

Article 17 – paragraph 3

Text proposed by the Commission

Amendment

3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity for 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market and ensure that the technical documentation and the declaration of conformity are made available to the market surveillance authorities upon request.

Or. en

Amendment 18

Proposal for a regulation

Article 21 – title

Text proposed by the Commission

Amendment

Cases in which obligations of manufacturers of an EHR system apply to importers and distributors

Cases in which obligations of manufacturers of an EHR system apply to importers, distributors and other economic operators

Or. en

Amendment 19

Proposal for a regulation

Article 21 – paragraph 1

Text proposed by the Commission

Amendment

An importer or distributor shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

An importer, distributor or another economic operator who makes modifications to the EHR system while deploying or using it, which lead to changes in the intended purpose and deployments recommendations for the EHR system as declared by the manufacturer, shall be considered a manufacturer for the purposes of this Regulation and shall be subject to the obligations laid down in Article 17, where they made an EHR system available on the market under their own name or trademark or modify an EHR system already placed on the market in such a way that conformity with the applicable requirements may be affected.

Or. en

Amendment 20

Proposal for a regulation

Article 21 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

In the event of any malfunctioning or deterioration in performance quality due to the changes made by economic operators during deployment or use of the EHR system contrary to the manufacturers' recommendations for technical deployment of the system or purpose of its use, the economic operator shall bear full responsibility for those modifications.

Or. en

Amendment 21

Proposal for a regulation

Article 23 – paragraph 1 – subparagraph 1

Text proposed by the Commission

Amendment

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Where relevant, the common specifications shall take into account the specificities of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14.

The Commission shall, by means of implementing acts, adopt common specifications in respect of the essential requirements set out in Annex II, including a time limit for implementing those common specifications. Those common specifications shall be based on existing harmonised standards or international standards and shall be adopted only after consulting the European standardisation organisations as well as the relevant stakeholders. Where relevant, the common specifications shall take into account the specificities and verify compatibility with sectorial legislation and harmonised standards of medical devices and high risk AI systems referred to in paragraphs 3 and 4 of Article 14, including the state-of-the-art standards for health informatics and the European electronic health record exchange format.

Or. en

Amendment 22

Proposal for a regulation

Article 29 – paragraph 3

Text proposed by the Commission

Amendment

3. The market surveillance authority shall immediately inform the Commission and the market surveillance authorities of other Member States of the measures ordered pursuant to paragraph 1. That information shall include all available details, in particular the data necessary for the identification of the EHR system concerned, the origin and the supply chain of the EHR system, the nature of the risk involved and the nature and duration of the national measures taken.

Or. en

Amendment 23

Proposal for a regulation

Article 31 – paragraph 6

Text proposed by the Commission

Amendment

6. If the wellness application is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label.

6. If the wellness application is an integral part of a device or is embedded in a device, the accompanying label shall be placed on the device. 2D barcodes may also be used to display the label. If the wellness application is embedded in a device after its putting into service, the wellness application label may be shown in the application itself.

Or. en

Amendment 24

Proposal for a regulation

Article 31 – paragraph 9

Text proposed by the Commission

Amendment

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form or, upon request, in physical form.

9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.

Or. en

Amendment 25

Proposal for a regulation

Article 65 – paragraph 1 – point e a (new)

Text proposed by the Commission

Amendment

(ea) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the primary use of electronic health data;

Or. en

Amendment 26

Proposal for a regulation

Article 65 – paragraph 1 – point e b (new)

Text proposed by the Commission

Amendment

(eb) to advise the Commission and Member States on the status of achieving cross-border health data interoperability in respect to the secondary use of electronic health data.

Or. en

Amendment 27

Proposal for a regulation

Article 69 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

Penalties shall cover infringements not addressed by Regulations (EU) 2017/745, (EU) 2022/112, and (EU) 2016/679, and shall depend on the circumstances of each individual case. When deciding whether to impose a penalty and deciding on the amount of the penalty in each individual case due regard shall be given to the following:

(a) the nature, gravity and duration of the infringement taking into account the nature scope and level of the damage done;

(b) the intentional or negligent character of the infringement;

(d) the degree of responsibility by the infringing party taking into account technical and organisational measures implemented to prevent the infringement;

(e) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

(f) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement;

Or. en

Amendment 28

Proposal for a regulation

Article 69 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

If the EHR system provider or data holder intentionally or negligently, for the same or linked operations, infringes several provisions of this Regulation, the total amount of the penalty shall not exceed the amount specified for the gravest infringement.

Or. en

Amendment 29

Proposal for a regulation

Article 69 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and national law, including effective judicial remedy and due process.

Or. en

Amendment 30

Proposal for a regulation

Article 69 – paragraph 1 d (new)

Text proposed by the Commission

Amendment

Where the legal system of the Member State does not provide for penalties, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the penalties imposed by supervisory authorities.

Or. en

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

The following list is drawn up on a purely voluntary basis under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft opinion:

Entity and/or person

DIGITALEUROPE

COCIR

EDPB

EDPS

BEUC

Medtech Europe

Roche

AmCham

European Cancer Organisation

EURORDIS

France Digitale

EFPIA