EHDS: the European Health Data Space

Short answer: The European Health Data Space (EHDS), established by Regulation (EU) 2025/327, entered into force on 25 March 2025 and applies broadly from 26 March 2027. The regulation has two pillars: primary use (citizen rights in direct care) and secondary use (controlled reuse of health data for research and policy). Article 105 sets phased application dates; full roll-out for all priority categories is planned by 26 March 2031.

What the EHDS Regulates

Regulation (EU) 2025/327 was adopted on 11 February 2025 and published in the EU Official Journal on 5 March 2025. It establishes a common framework for electronic health data in the EU across three pillars: individual rights (primary use), reuse for research and innovation (secondary use), and interoperability requirements for EHR systems.

Pillar 1 — Primary Use: Citizen Rights

Chapter II of the Regulation grants citizens the following rights:

• Article 3 — Right to immediate and free-of-charge access to personal electronic health data in priority categories, including the ability to download data in a machine-readable European exchange format.
• Article 4 — Obligation on Member States to provide electronic health data access services (portals/apps); Article 4(2) provides for the appointment of digital representatives.
• Article 5 — Right to enter information into one's own health record.
• Article 6 — Right to rectification of incorrect personal electronic health data, immediately and free of charge.
• Article 7 — Right to cross-border data portability: individuals may transmit their data to a healthcare provider in another Member State, applicable regardless of the legal basis for processing (broader than the GDPR).

Article 14 defines the priority categories: patient summaries, ePrescriptions, eDispensations, medical images, laboratory results, and discharge reports. Patient summaries and ePrescriptions must be available by 26 March 2029; the remaining categories follow by 26 March 2031.

Pillar 2 — Secondary Use: Research and Innovation

Article 53 lists the permitted purposes: public health, policy support, scientific research, education, and testing of AI algorithms. Reuse requires a permit from the national Health Data Access Body (HDAB), established under Article 55. Data is provided only in pseudonymised or anonymised form, within a secure processing environment; use for advertising, re-identification, and discriminatory purposes is prohibited.

Infrastructure

• MyHealth@EU (Article 23): the central cross-border interoperability platform for primary use, managed by the Commission.
• HealthData@EU (Article 75): the federated platform connecting national HDAB infrastructures for secondary use.

Supervision and Enforcement

Each Member State must designate digital health authorities (primary use and interoperability) and a HDAB (secondary use). Infringements may be sanctioned with fines of up to €20 million or 4% of annual turnover.