EU Institutions reach a deal on the European Health Data Space (EHDS)

Negotiators from the European Council and the European Parliament reached a provisional agreement on the EHDS in the early morning of Friday, 15 March 2024. This means that there is just enough time for formal adoption before the new political mandate following the European elections in June. While the text may still be subject to minor technical changes, it is expected that this will be the final legislative text.

On March 19, the ENVI committee reported back on the negotiations. Regardless of ongoing frustrations among MEPs, it is expected that the text will most likely be adopted in plenary on 24 April. The Council will present the final agreement on 22 March for political endorsement.

Key elements of the provisional agreements

Use and re-use of health data

The agreement establishes clearer rules for the use of health data for better healthcare delivery, research and innovation. Citizens and patients have faster and simplified access to their electronic health data regardless of their location (primary use). The EHDS will also grant researchers and innovators access to large and high-quality data sets for R&D purposes (secondary use).

Opt-out provisions

The text says that citizens have a right to opt out of sharing their data for secondary use purposes. The agreement introduces a harmonised opt-out approach that require Member States to introduce ‘‘an accessible and easily understandable opt-out mechanism’’, meaning that once individuals object to sharing their health data for secondary use, their data shall not be made available or processed.

However, the opt-out can be overridden if a public health body, Union institution or office requests data for “scientific research for important public interest.” The Member State override of the opt-out is very broad and it run the risk of uneven implementation of the agreement across Europe. Member States also keep the right to implement additional safeguards at national level for specific categories of data, such as genomic data, wellness application data and biobanks / databases.

Intellectual property rights, trade secrets and/or regulatory data protection rights

Contrary to the original Commission proposal, the text introduces a specific article dedicated to intellectual property (IP) rights. trade secrets and/or regulatory data protection rights. The specific article clarifies that health data holders should notify the health data access bodies of any datasets containing content or information protected by IP rights or trade secrets. This can be done either before or during a data request.

Health data access bodies are mandated to take all measures subject to relevant regulations such as the Clinical Trials Regulation, SoHO, MDR/IVDR. The text also specifies that health data access bodies should take all specific appropriate legal, organisational and technical measures deemed necessary to preserve protected data. According to the text, such measures may also conclude contractual arrangements between health data holders and health data users in order to share protected data. The article calls on the Commission to develop and recommend non-binding model contractual terms for such arrangements.

The health data access body shall refuse access for secondary use purposes if there is a risk of infringing IP rights, trade secrets and/or regulatory data protection rights. Both data holders and users can lodge a complaint with the health data access body should they disagree with the decision.

Data localisation in secure processing environments and international data transfers

The text requires that personal data, which refers to health and genetic information defined in the General Data Protection Regulation (GDPR), must be stored and processed within the European Union when performing anonymisation and pseudonymisation, among other processing operations. By way of exception, data may be internationally stored and processed in a third country by way of adequacy decision, pursuant to Article 45 of the GDPR.

Anonymised or pseudonymised health data transferred to third countries is deemed highly sensitive and at risk of re-identification. The European Commission will specify protective measures for international data transfers in Delegated Act. Current ongoing bilateral discussions on data flows between friendly countries such as the United States may provide further insights into localisation requirements in the future.

Stakeholder Forum

A Stakeholder Forum will be established to facilitate the exchange of information and to promote cooperation with stakeholders on the implementation of the EHDS Regulation. The Forum will be composed of relevant stakeholders, including representatives of patient organisations, healthcare professionals, industry, consumer groups, scientific researchers and academia. The forum shall have a balanced composition. Where commercial interests are represented, they shall be balanced between large companies, SMEs and start-ups.

Entry into force and application

The Regulation shall apply two years after its entry into force. Chapter IV, secondary use of health data shall apply 4 years after the date of entry into force, with some exception of categories of electronic data for secondary such as human genetic, epigenomic and genomic data, data from clinical trials and data from research, which shall apply six years after the date of entry into force. It is expected that the EHDS infrastructure and governance framework will be fully operational within three to five years.

Next steps

The next step for EHDS to become law is for the Council and the Parliament to endorse and later adopt it. While there is still a small number of Member States within the Council that have uttered concerns regarding the current text, it is expected that COREPER will endorse text on 22 March. Also within Parliament are still existing frustrations among MEPs. The text is likely to be adopted during the April plenary vote on 24 April.

EUCOPE will continue to urge policymakers to keep in mind the best interests of our membership as the file moves forward. Should you want to learn more about our work on the EHDS or other related digital health topics, such as AI or MDR, please feel free to reach out to Leander Vranken (vranken@eucope.org).