I. Introduction
The European Strategy for Data, adopted on February 19, 2020, aims to create a single market for data while ensuring high data protection, data privacy, security, and ethical use. This strategy envisions the creation of common European data spaces in 14 domains such as health, finance, agriculture, manufacturing, energy, mobility, research, and innovation.
The first common EU data space to emerge from the European Strategy for Data is the European Health Data Space (EHDS). In April 2024, the European Parliament and the Council reached a provisional agreement on the proposal for the Regulation on the EHDS. As a next step, the provisional agreement will have to be endorsed and formally adopted. Then, the Regulation will enter into force 20 days after publication in the EU’s Official Journal. The main objective of the Regulation is twofold. Firstly, to facilitate the exchange of data for the delivery of healthcare across the EU. Secondly, to allow reuse of health data for research, innovation, policy-making, and regulatory activities. These are called primary and secondary health data use, respectively. There is no doubt that the EHDS will bring considerable benefits to individuals, health professionals, healthcare providers, researchers, and innovators.
At this point, you must be thinking, ’How will the Regulation on the EHDS ensure data protection, data privacy, and ethical use?’, ’What are the conditions for accessing health data for secondary use?’, and ’What rights do individuals have over their health data?’ In this article, we will answer all those questions to provide a clear picture of what the EHDS exactly means to individuals, health professionals, healthcare providers, researchers, and innovators.
II. Primary use of e-health data
The lack of harmonized laws, rules, and procedures in Member States across the EU makes it difficult to access and share personal health data. Patient health summaries and e-prescription services are available in two thirds of Member States, but only a few Member States allow the transfer of health data across borders. While most patients are willing to share their health data to advance healthcare, medicine, and research, or even to get healthcare in another Member State, this willingness is often hindered by regulatory barriers. To overcome the above challenges, the Regulation on EHDS provides the rules and mechanisms for primary and secondary use of electronic health data. To begin with, the primary use of health data means the processing of electronic health data for the provision of healthcare to assess, maintain, or restore the state of health of the natural person to whom that data relates. In this section, we will dig deeper into the primary use of personal electronic health data.
The Regulation on EHDS is built based on the General Data Protection Regulation (GDPR), Data Governance Act, Data Act, and Network and Information Systems Directive. In terms of rights and freedoms, the EHDS ensures that individuals have the right to access, the right to rectification, the right to transmission of their personal electronic health data, and the right to lodge a complaint with the digital health authority. Soon, our personal electronic health data can be accessed at no cost using patient portals on computers or smartphones, depending on how the Member States make health data available at the national level. More importantly, individuals will have control over their health as they will have the right to limit access, or even opt-out from the primary use of their health data and can receive automatic notifications on who is accessing their health data. This is quite relevant in cases of sensitive health problems such as mental or sexual health and sensitive procedures that may include abortion. The supervisory authorities established in Member States under GDPR will be responsible for enforcement and monitoring of the processing of personal electronic health data and the rights of natural persons.
Regarding health professionals and healthcare providers, they will have access to patients’ health data at no cost. The access to health data can bring significant benefits and improve the efficiency of healthcare systems. For instance, the Organization for Economic Co-operation and Development estimates that hospitals can save up to 15% of their expenditure if health data-sharing becomes a reality. On the other hand, it also means that health professionals and healthcare providers need to ensure high-quality data, use common formats for keeping health records, and enroll in training programs to understand and effectively exercise their role in the primary use of health data.
Furthermore, to harmonize the primary use of health data, mandatory requirements for interoperability, privacy, security, and safety will be introduced. For instance, the European Commission will be tasked to adopt Implementing Acts on the technical specifications for electronic health record exchange formats, data quality, and the rules regarding the requirements on cybersecurity.
In summary, the EHDS represents a significant step towards harmonizing health data access and sharing across the EU while facilitating more efficient healthcare delivery. It also empowers individuals with greater control over their health data by establishing clear rights for patients, responsibilities for healthcare providers, and standardized mechanisms for data exchange
III Secondary use of E-health data
In the EU, researchers, innovators, and policymakers face important obstacles in accessing the health data they need to develop new medical devices, test medicinal products, and train AI systems that could improve healthcare systems. In practice, consent is the common way to access health data for research, innovation, policy-making, and regulatory activities. It is very costly and burdensome for them to get consent from every patient to use their health data. In fact, over half of the Member States do not have specific laws on the secondary use of health data for research, innovation, policy-making, or regulatory purposes. Therefore, the EHDS goes a step further by enabling the secondary use of health data beyond direct patient care. The secondary use of electronic health data simply means processing health data for purposes other than the initial purposes for which they were collected or produced. In this section, we will delve into the rights of individuals in the secondary use of their health data and the competent authorities for ensuring the data protection, data privacy, and ethical reuse of health data.
Similarly to the primary use, individuals will have all the previously mentioned rights including the right to opt out from secondary use of their health data. To protect the rights of natural persons, each Member State may introduce stricter rules for the secondary use of health data. The Regulation on EHDS requires each Member State to establish a Health Data Access Body (HDAB) whose primary role is to decide on data access applications, issue data permits, and provide access to electronic health data. In relation to the rights of natural persons, the HDAB must ensure the following things. Firstly, the HDAB will not allow any processing of health data to take decisions detrimental to natural persons in relation to job offers, insurance decisions, loan conditions, or credit contracts. The Regulation on EHDS also bans the use of health data for advertising or marketing activities and for developing products harmful to public health such as illicit drugs, nicotine products, or alcohol. Secondly, the HDAB must ensure that those who are applying for access to health data have all necessary legal, operational, and technical measures to preserve the protection of the rights of natural persons. Also, the HDAB must only provide access to pseudonymized or anonymized health data. Last but not least, if researchers discover a significant finding that may impact the health of a patient whose data was used in the scientific research, they must notify the HDAB who will inform the trusted data holders (e.g., healthcare providers) who are in turn obligated to inform the patient.
In short, the EHDS strikes a delicate balance between unlocking the potential of health data for secondary use and safeguarding individual rights. The opt-out option, restrictions on detrimental use of data, and measures to ensure pseudonymization or anonymization demonstrate a commitment to ethical data practices. Reuse of health data opens unprecedented opportunities for advancing research, improving public health policies, and driving innovation in healthcare.
IV PERMIT to Access E-HEALTH DATA for secondary use
In the previous section, we learned about certain restrictions on the secondary use of health data. In addition to that, those wishing to get access to health data for secondary use will need to apply for a permit from an HDAB in their Member States. In this section, we will discover the main requirements for permit applications to access health data.
Firstly, the purposes for accessing health data must be one of the following:
(i) public interest including medicinal products, medical devices, quality, and safety of healthcare;
(ii) policy-making and regulatory activities of public bodies, union institutions and agencies;
(iii) statistics such as national or EU level official statistics;
(iv) education or teaching activities in health or care sectors;
(v) scientific research including training, testing, and evaluating medical devices, AI systems and digital health apps to benefit end-users;
(vi) improving delivery of care and treatment optimization.
It must be noted that the first three purposes are reserved for public sector bodies, Union institutions, bodies, offices, and agencies only. The last three purposes may be utilized by private healthcare providers, researchers, and innovators. Secondly, applicants must provide a detailed explanation of the intended use and expected benefits related to the use of health data. Thirdly, the application must include a description of safeguards planned to prevent misuse, protect the rights and interests of individuals, and prevent re-identification. Moreover, if healthcare providers, researchers, and innovators seek to access health data not in anonymized but in a pseudonymized format, they must describe how the processing would comply with applicable laws, including GDPR. Finally, when the permit is granted, the HDAB will provide access to pseudonymized or anonymized health data and may charge fees for making electronic health data available for secondary use. Additionally, the HDAB has the authority to request and receive necessary information to verify compliance, revoke permits, and impose fines in cases of infringement of the Regulation on EHDS.
In a nutshell, private healthcare providers, researchers, and innovators will be able to access health data in a more effective and less expensive way, through a data access body that maintains data protection, data privacy, and ethical use. By implementing a permit system through HDABs, the EHDS ensures that data access is granted only for legitimate purposes that serve the public interest or advance healthcare and scientific research.
Conclusion
The European Health Data Space (EHDS) represents a significant leap forward in harmonizing health data access and sharing across the EU. It facilitates both primary and secondary uses of health data to improve healthcare delivery, advance research, and drive innovation while maintaining strong data protection, data privacy, and ethical use. The establishment of Health Data Access Bodies (HDAB) and a permit system for secondary data use ensures legitimate access to health data. As the EHDS implementation progresses, it will be crucial for stakeholders to adapt to these new regulations and leverage the potential of shared health data responsibly. Eris Law Advokatbyrå AB can assist private healthcare providers, researchers, and innovators in navigating the complex landscape of the EHDS, ensuring compliance with regulations, and helping to reap the benefits of the secondary use of health data.
References:
European Commission (2020) Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions a European strategy for data. Available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020DC0066
European Commission (2021) Assessment of the EU Member States’ rules on health data in the light of GDPR. Available at https://health.ec.europa.eu/publications/assessment-eu-member-states-rules-health-data-light-gdpr_en
European Commission (2022) Proposal for a Regulation of the European Parliament and of the Council on the European Health Data Space. Available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52022PC0197
European Commission (2022) Commission Staff Working Document on Common European Data Spaces. Available at https://digital-strategy.ec.europa.eu/en/library/staff-working-document-data-spaces
European Commission (2022) Commission Staff Working Document Impact Assessment Report accompanying the document Proposal for a Regulation on the European Health Data Space. Available at https://health.ec.europa.eu/publications/impact-assessment-european-health-data-space_en
European Commission (2022) Final Report: Study supporting the Impact Assessment of policy options for an EU initiative on a European Health Data Space. Available at https://health.ec.europa.eu/publications/study-supporting-impact-assessment-policy-options-eu-initiative-european-health-data-space_en
European Commission (2022) Communication from the Commission to the European Parliament and the Council: A European Health Data Space: harnessing the power of health data for people, patients
and innovation. Available at https://health.ec.europa.eu/document/download/17c7065c-c432-445f-9b27-8ccf283581bc_en?filename=com_2022-196_en.pdf
European Commission (2024) Public Health: European Health Data Space. Available at https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space_en
European Commission (2024) Public Health: Electronic cross-border health services. Available at https://health.ec.europa.eu/ehealth-digital-health-and-care/electronic-cross-border-health-services_en
European Parliament (2024) Legislative Observatory: European Health Data Space. Available at https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2022/0140(COD)&l=en