The European Health Data Space

On 5 March 2025, the Regulation on the European Health Data Space – Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 – was published in the Official Journal of the European Union.

The European Health Data Space has emerged as a solution to the need to facilitate the exchange of electronic health data between health service providers located in several Member States.

Thus, the European Union intends to create a cross-border infrastructure that regulates the primary use and secondary use of electronic health data. To this end, it also provides common rules for the development and commercialization of electronic health record systems (“EHR systems”), which will make it possible to ensure the interoperability of electronic health data within the Union.

Indeed, when discussing an European data space, the legislator clarified that this regulation does not affect the application of the General Data Protection Regulation (“GDPR”), but rather complements it, mainly with regard to the rights of data subjects in the provision of healthcare.

At this stage, it is relevant to highlight the key aspects of this crucial legislation for European citizens and organizations in the health sector:

The Processing of Electronic Health Data

The European Health Data Space («EHDS») concerns the processing in electronic format of health data and genetic data, as well as anonymized data or data that has never been linked to a data subject but has an impact on health.

This data will typically serves a primary use related to the provision of healthcare to the data subjects – i.e., assess, maintain or restore the state of health of the natural person to whom those data relate, including the prescription, dispensation and provision of medicinal products and medical devices, as well as for relevant social, administrative or reimbursement services [Article 2(2)(d)].

In addition, the Regulation creates a mechanism that allows access to and processing of electronic health data for a secondary use. In other words, it is possible to process health data for purposes other than those originally conceived which correspond to the following categories of purposes, within the meaning of Article 53:

• Public interest in the fields of public health or occupational health;
• Policymaking and regulatory activities to support public sector and EU organizations;
• Statistical purposes;
• Educational or teaching activities in the health sector
• Scientific research, covering the development of products and the training, testing and evaluation of algorithms; and
• Promotion of better care delivery.

Primary Use

With regard to the primary use of health data, the European legislator has given patient data subjects a new set of rights.

On the one hand, it reinforced rights already provided for in the GDPR, such as the right of access and the right to data portability. On the other hand, it conferred new rights to data subjects, such as the right of individuals to insert information into their own EHR, as well as the right to restrict access of health professionals to some or all of the personal electronic health data belonging to the priority categories.

A Utilização Secundária

Para operacionalizar a utilização secundária de dados de saúde eletrónicos, o legislador europeu criou as figuras do detentor de dados de saúde, do responsável pelo acesso aos dados de saúde e do utilizador de dados de saúde.

Este último deverá dirigir um pedido de acesso a dados de saúde ao responsável pelo acesso competente, o qual, se preenchidos os requisitos, emitirá uma autorização de tratamento de dados. Caso haja deferimento do pedido, os detentores de dados de saúde ficam obrigados a disponibilizar os dados ao organismo responsável, que, posteriormente, os reencaminhará para o agora utilizador de dados.

Assim, sendo uma entidade que atua no setor da saúde, é provável que seja enquadrada na figura do detentor de dados e que se veja obrigado no futuro, consequentemente, a ter de partilhar dados de saúde eletrónicos (inclusivamente com concorrentes).

Próximos desenvolvimentos…

O Regulamento aplicar-se-á faseadamente, estendendo-se no tempo até 2035.

Ademais, a Comissão está encarregue de elaborar atos delegados. Por sua vez, os Estados-Membros ainda terão de legislar sobre algumas matérias, nomeadamente, sanções.

De acrescentar também que a indústria e o setor da saúde também irão sofrer um período de adaptação aos sistemas eletrónicos que asseguraram a interoperabilidade dos dados.

All in all, the implementation of the Regulation on the European Health Data Space will be lengthy and complex.

In this regard, entities operating in the health sector should progressively draw up implementation projects to ensure a smooth transition to this new paradigm.