European Health Data Space: The Council of the EU and the European Parliament have crossed a hurdle and signed a provisional agreement on the European health data space
Healthcare is a sensitive area that has been particularly hard hit by the Covid-19 pandemic. Although it is practically the only field that does not fall under European competence, the European Council and Parliament have managed to find a roadmap towards a common health data space (EEDS), amid a sea of new European texts (DSA, DMA, Data Act, DGA, IA Act, RGPD).
Indeed, on April 24, 2024, the European Parliament adopted the proposed regulation on the European Health Data Space (EHDS) as approved in mid-March. This is the first of nine European data spaces announced in the 2020 communication entitled “A European Data Strategy“, which aims to facilitate access to and exchange of healthcare data.
Its adoption is the culmination of a series of challenges:
- Give patients control to reassure them, by recognizing their control rights and organizing the sharing of their health data;
- Digitize them, codify them in the form of standards and organize their interoperability;
- Administering them is a complex role that involves managing duplications and/or conflicting regulations, secondary/derivative uses and intellectual property rights;
- Facilitating scientific research;
- Pilot new standards, new professions (such as trusted third parties), new sharing platforms alongside or in place of the Health Data Hub.
What’s more, the future EEDS relies on 3 key players: patients, who need to have access to and control over the use of their data; researchers-developers, who need interoperability and therefore a data exchange format; and administrative authorities, who need to orchestrate the smooth, secure operation of data within and outside the EU.
The agreement adopted by the European Parliament to facilitate access to and exchange of healthcare data is innovative in several respects:
- Each State may or may not authorize the patient to prohibit the use of his or her data (except in cases of general interest) and restrict secondary uses;
- Member States will be able to designate trusted data holders to manage access requests, and will have to appoint a “digital health authority” responsible for applying the new provisions;
- A European exchange format for electronic medical records will enable interoperability;
- The location where health data will be hosted must be known.
Member States will be required to provide national health data access services based on the European MyHealth@EU platform.
The Commission has already announced that it will provide more than 810 million euros to support the EHDS[1] .
Key aspects of the proposed regulation on the European Health Data Space
Improving access to and control over health data for European patients and healthcare professionals in the EU (primary use of data[2] ). Access must be provided immediately and free of charge, after registration of health data in an electronic medical record (EMR) system, and in an easily readable and consolidated form.[3]
Patients will have greater control over how their data is used: right to rectify data (art. 8c.3.), right to obtain information on access to data (art. 8f).
To ensure compliance with these provisions, Member States will be required to designate a digital health authority[4] , which will receive individual or collective complaints and pass them on to the competent authority if they are relevant.
Facilitating the collection, circulation and use of secure health data within the European Union (secondary use of data[5] ). These measures are designed to improve healthcare delivery, research, innovation and policy-making, enabling researchers and policy-makers to exploit the full potential of health data.
Secondary use of health data will only be possible for the reasons exhaustively set out in the text, i.e.[6] :
- Public interest;
- Policy development ;
- Regulatory activities ;
- Statistics ;
- Vocational or secondary education;
- Scientific research related to the health or healthcare sectors, contributing to public health or health technology assessment, or guaranteeing high levels of quality and safety of healthcare, drugs or medical devices, with the aim of benefiting end-users;
- Improving care delivery, optimizing treatments and providing healthcare.
Any secondary use for any other purpose will be prohibited[7] . MEPs have thus ensured that secondary use of collected data is not permitted in decisions relating to employment, loans or other types of discrimination.
This use will also have to comply with the provisions of the RGPD relating to the principles of minimization and purpose limitation of the processing[8] .
Finally, if the data is protected by intellectual property rights or business secrecy ([9] ), or by its sensitive nature (genetic data, for example), the holders of such data must inform the health data access organization and justify their rights to this protected data. The organization may then limit or refuse access to such data. This decision may be the subject of a complaint.
The establishment of a uniform legal and technical framework for electronic medical records (EMRs), which all Member States will henceforth be required to have[10] . These records will have to comply with the future European format for the exchange of electronic medical records prescribed by the future regulation to facilitate their legibility and electronic transmission. This data interoperability was already provided for in the RGPD, which therefore continues to apply and is supplemented.[11]
Major changes brought about by the agreement on the proposed regulation on the European Health Data Space
The agreement adopted by the European Parliament modifies several elements of the initial 2022 proposal, including[12] :
The restriction or refusal of access to health data by healthcare professionals or providers (“opt out”)[13] . Firstly, individuals have the right to restrict access to their data by healthcare professionals and providers, which may have an impact on the healthcare they receive. It is up to Member States to establish specific rules and safeguards concerning this restriction mechanism.
Similarly, Member States may allow patients to object to access to their data, either by healthcare professionals (primary use) or for other uses (secondary use).
Member States are obliged to allow opt-out for secondary use of data, but are free to authorize it or not for primary use of health data.
However, as a result of tough negotiations, exceptions are provided for in the text.
With regard to the primary use of their data, patients will not be able to refuse access by healthcare professionals if such access is necessary to protect their vital interests[14] .
With regard to the secondary use of such data, Member States may provide, in their legislation, for justified exceptions (i) for reasons of general interest, (ii) for the development of policies or statistics, (iii) for the protection of intellectual property and trade secrets[15] ; (iv) for scientific research carried out for important reasons of public interest by public sector bodies.
The assessment of justifications will be carried out by the health data access body, and Member States will have to notify the Commission of national laws adopted on the opt-out mechanism.
Consideration of more sensitive data. Member States may introduce stricter measures concerning access to certain types of sensitive data, such as genetic data, for research purposes. [16]
Involvement of a trusted data holder. To simplify administrative formalities, the text provides for a procedure before a trusted data holder, who will be able to process requests for access to health data in complete security[17] ;
Informing patients of clinically significant findings. If researchers become aware of findings that are likely to affect the health of a patient whose data has been used for scientific research, they will inform the bodies responsible for access to health data, who will in turn inform the trusted data holder, who will be responsible for communicating this information to the person concerned, or to the relevant healthcare professional[18] . However, the person concerned must also have the right to ask not to be informed of these findings.
What’s next?
This agreement therefore differs on several major points from the initial proposal for a regulation, notably on the delicate question of the grounds for access to health data for secondary use, i.e. use not linked to patient care despite the restriction or opposition formulated by the patient.
In particular, the notion of “vital interests”, which would justify overriding the patient’s wishes in the context of primary use, needs to be clarified.
However, the provisional agreement reached in mid-March has now been fully adopted by Parliament. The Council will now formally adopt the new regulation, which should be published in autumn 2024 in the Official Journal of the European Union, and will then enter into force twenty days later.[19]
According to the European Commission, EHDS exchanges should begin in 2028 for all member states. Additional data categories should also be added in 2030, giving member states and healthcare providers sufficient time to prepare[20] .
In France, the Direction au numérique en santé (DNS) will coordinate the application of the European regulation, bringing together all the players in the ecosystem to implement this step forward in digital healthcare in Europe.
UGGC Avocats – IP/IT/healthcare column
Elisabeth Logeais | Chloé Hégly
[1] Questions and Answers on the European Health Data Space, European Commission, April 24, 2024.
[2] In other words, data is collected during patient care.
[3] Art. 8a.1 of the agreement
[4] Art. 10 of the agreement
[5] The use of data for purposes other than patient care.
[6] Art. 34.1 of the agreement
[7] Art. 35 of the agreement
[8] Art. 44 of the agreement
[9] Art. 33a of the agreement
[10] Art. 1.2 (b) and art. 8g.1 of the agreement
[11] Art. 1.2 (a) of the provisional agreement.
[12] Press release, Council of the EU and European Council, March 15, 2024: European Health Data Area: Council and Parliament reach agreement.
[13] Art. 8e and 8h of the agreement.
[14] Art. 8h.1 of the agreement.
[15] Art 34(1) points a-c of the agreement.
[16] Recital 9a, 13a.
[17] Recital 53 and art. 49 of the agreement.
[18] Recital 44a and art. 35e of the agreement.
[19] Press release, Council of the EU and European Council, March 15, 2024: European Health Data Area: Council and Parliament reach agreement.
[20] Questions and Answers on the European Health Data Space, European Commission, April 24, 2024.