European Health Data Space
TA-9-2023-0462 · P9_TA(2023)0462 · PE742.387
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
Parliament's amended version of the proposed regulation on the European Health Data Space sets up rules for access to and control of electronic health data for healthcare (primary use) and for research, innovation, policy-making and regulatory purposes (secondary use).¶ It gives natural persons rights to access, download, rectify, restrict and transmit their health data, and to opt out of secondary use, with opt-in for genetic, genomic and wellness data.¶¶¶ It requires Member States to join the MyHealth@EU cross-border infrastructure, to designate digital health authorities and health data access bodies, and to store personal electronic health data in the Union.¶¶¶ It lays down obligations for manufacturers of EHR systems, including conformity assessment, CE marking and registration, and rules for wellness applications claiming interoperability.¶¶¶ It sets conditions for secondary use through data permits issued by health data access bodies, prohibits certain uses, and provides for administrative fines and compensation.¶¶¶
Key points
- Establishes the European Health Data Space to improve access to and control over personal electronic health data for primary use and for secondary use such as research, innovation, policy-making and regulatory activities.¶
- Gives natural persons the right to access, download, rectify and transmit their electronic health data, to restrict access by health professionals, and to be informed of who accessed their data.¶¶¶
- Requires Member States to set up electronic health data access services, proxy services and support services, and to provide information and digital literacy programmes.¶¶
- Requires Member States to join the MyHealth@EU infrastructure and connect healthcare providers and pharmacies, and makes participation mandatory.¶
- Requires Member States to designate digital health authorities and one or more health data access bodies, with independence and resources.¶¶¶
- Sets rules for EHR systems: manufacturers must obtain a certificate of compliance, affix CE marking, draw up technical documentation and register in an EU database.¶¶¶
- Allows wellness applications claiming interoperability with EHR systems to carry a mandatory label, and requires user consent for sharing data with EHR systems.¶¶
- Requires health data holders to make electronic health data available for secondary use upon request, with micro-enterprises exempt, and within three months extendable by two months.¶¶¶
- Allows natural persons to opt out of secondary use of their health data, and requires opt-in for genetic, genomic, proteomic and wellness application data.¶¶
- Prohibits secondary use for decisions detrimental to natural persons, insurance or credit decisions, advertising, developing harmful products, and automated decision-making.¶¶¶
- Requires health data access bodies to issue data permits for secondary use, with conditions, fees, and access through a secure processing environment located in the Union.¶¶¶
- Requires storage of personal electronic health data within the Union, and allows international transfers only under Chapter V of Regulation (EU) 2016/679 and reciprocity conditions.¶¶¶
Who is affected
- Natural persons in the EU, who gain rights over their electronic health data and can opt out of secondary use.¶¶
- Health professionals and healthcare providers, who must register and share data and use interoperable systems.¶¶
- Manufacturers of EHR systems and wellness applications, who must comply with conformity assessment and labelling rules.¶¶
- Health data holders and users, who must make data available and comply with data permits.¶¶
- Member States, which must designate authorities, join MyHealth@EU and store data in the Union.¶¶¶
Figures and deadlines
- EUR 220 million can be made available under the EU4Health and Digital Europe programmes for the EHDS.¶
- Partial evaluation of the regulation 5 years after entry into force, and overall evaluation 7 years after entry into force.¶
- Regulation applies from 24 months after entry into force.¶¶
- Data permit duration shall not exceed 5 years, extendable once for up to 5 years.¶
- Health data access body shall issue or refuse a data permit within 2 months of receiving a complete application, extendable by 2 additional months.¶
- Health data holder shall put data at the disposal of the health data access body within three months, extendable by a maximum of two months.¶
- Health data users shall make public the results of secondary use no later than 18 months after completion of processing.¶
- Manufacturers shall keep technical documentation and EU declaration of conformity for at least 10 years after the last EHR system is placed on the market.¶
Legal basis: Article 114 TFEU¶