Digital & AI
Regulation (EU) 2025/327
EHDS
European Health Data Space
Your health data should follow you across the Union for care, and — with safeguards — be reusable for research and policy, under a new set of health-data access bodies.
Does this hit me?
You should see your own record and take it to another Member State. Secondary use is the fight: research vs. a market in hospital files. Use the opt-out when it exists.
Check in the wizardPick a country in the header to see who enforces this at home. Union text is not the last word for directives.
How it rolls in
2025
Regulation adopted and entered into force.
2027–2029
Staggered application of primary-use categories and secondary-use infrastructure.
Why it exists
Hospitals could not read each other’s files. Researchers drowned in 27 permission cultures. GDPR stayed; a sector rail was missing.
What actually changes
- Primary use: patients and professionals can access and exchange priority health data (summaries, e-prescriptions, images) across borders.
- Secondary use: a permit from a health-data access body for research, innovation and policy — not a free scrape.
- Opt-out on many secondary uses, with stricter rules for sensitive subsets.
- EHR systems and wellness apps that claim interoperability must meet specifications.
How it hits you
You should see your own record and take it to another Member State. Secondary use is the fight: research vs. a market in hospital files. Use the opt-out when it exists.
For citizens
What this does to everyday life
Rights, bills, and what you can ignore. You are usually not the one who files — companies and states are.
Your health file should travel with you — and not silently train a model
Primary use is care: summaries, prescriptions, images across borders. Secondary use for research needs a permit and, in many cases, an opt-out. This is not open data of your hospital chart.
Rights you actually get
- Access to your electronic health data
- Opt-out of many secondary uses
- GDPR rights still apply
Costs and trade-offs
- Health systems will spend years on IT. That can mean clunky portals before it means magic.
What you can do
- Ask how to see your record and how to opt out of secondary use when the national body offers it.
What you can ignore
- You do not have to donate your file to a start-up.
If something goes wrong
Hospital / national health portal first; health-data access body and DPA for secondary use.
More citizen notes across files: For people
Heard this? Not quite.
Claim: All hospital files become open data.
Secondary use is permit-based, purpose-limited, and usually anonymised or pseudonymised. It is not a public dump.
Latest official statements
All EU NewsNo tagged Commission, Parliament or Council statement in the current feeds.
Board one-pager
Board one-pager
Who this is for: EU digital, product and data teams. Regulation (EU) 2025/327. Primary and secondary use duties stagger from the late 2020s.
Scope
- You supply EHR systems in the Union, provide care, run a wellness app that interoperates, or you want health data for research/AI.
First 90 days
- This year: Classify the product: EHR, wellness, medical device — or all three.
- Before secondary use: Permit path via a health-data access body; do not scrape.
Penalties: Market-surveillance of EHR systems; withdrawal of secondary-use permits; GDPR fines underneath.
For companies
How to stay on the right side of this file
Practical order of work, not a substitute for counsel. EHR vendors, care providers, wellness apps that claim interoperability, and secondary-use applicants.
You are probably
EHR vendors, care providers, wellness apps that claim interoperability, and secondary-use applicants.
Effort
A scoped programme this year beats a scramble at the apply-date.
Budget
SME: owner time plus one honest vendor. Large: a named lead, not a taskforce slide.
Roles in this file
The same company can wear more than one hat. Classify before you buy a tool.
Regulatory
This pack names Regulatory as an owner of early work.
Classify the product: EHR, wellness, medical device — or all three.
Legal / science
This pack names Legal / science as an owner of early work.
Permit path via a health-data access body; do not scrape.
Are you in scope?
Build toward- You supply EHR systems in the Union, provide care, run a wellness app that interoperates, or you want health data for research/AI.
Usually not, if
- A consumer fitness gadget that does not claim EHR interoperability and does not seek secondary-use data.
First moves
- This yearClassify the product: EHR, wellness, medical device — or all three.Regulatory
- Before secondary usePermit path via a health-data access body; do not scrape.Legal / science
- A clinic’s job is to pick a conforming EHR, not to invent a Union architecture.
If you skip this
- Calling a wellness app a health record to harvest data.
Done looks like
- EHR conformity
- Permits
- Opt-out handling
- DPIAs
Keep this evidence
- EHR conformity
- Permits
- Opt-out handling
- DPIAs
Ask vendors
- Is this EHR going to meet EHDS specifications on your calendar?
- Will you support patient opt-out for secondary use?
Where programmes usually break
- Calling a wellness app a health record to harvest data.
Call counsel when
- Market-surveillance of EHR systems; withdrawal of secondary-use permits; GDPR fines underneath.
- A supervisor letter, a dawn information request, or a deal that warrants this file.
Enforcement
Market-surveillance of EHR systems; withdrawal of secondary-use permits; GDPR fines underneath.
Health-data access bodies; medical-device and EHR market surveillance; DPAs.
Need a stack, not one file? Open the company desk
Professional briefing
Legal architecture and duties
For counsel, compliance, and policy teams. Not advice. The Official Journal still wins.
- Instrument
- Regulation
- Legal basis
- Arts 16 and 114 TFEU · Regulation (EU) 2025/327
- Application
- Staggered; primary-use categories and secondary-use infrastructure land in the late 2020s.
A sectoral data space on top of the GDPR. Primary use is care continuity. Secondary use is permit-based research and policy. EHR vendors and applicants for secondary use are the company addressees.
How the file is built
Primary use
Patient access and cross-border exchange of priority datasets.
Secondary use
Health-data access bodies issue permits; opt-out on many uses.
Operators
| Role | Who | Core duties |
|---|---|---|
| EHR / care provider | Holds and exchanges primary-use data. | Access, portability, specifications. |
| Data user | Research, innovation, policy. | Permit, purpose limitation, no re-identification. |
Scope
Union care and Union-based secondary use; extra-EU transfers remain GDPR Ch V.
In
- Electronic health data as defined
- EHR systems
- Certain wellness apps claiming interoperability
Out, or narrower than assumed
- Processing outside the health-data definition
- National security as carved out
Operative provisions
| Anchor | Rule | What it does in practice |
|---|---|---|
| Secondary-use chapter | Permit, not scrape. | AI training on hospital files without a permit is the failure mode. |
Secondary law and guidance
- Implementing acts on datasets and EHR specifications
- MyHealth@EU
National layer. Access bodies, hospitals and opt-out UX are national capacity.
How it sits with other files
Enforcement and private rights
Who
Health-data access bodies, EHR market surveillance, DPAs.
Tools
Permit withdrawal, product measures, GDPR fines.
Private rights
Access to one’s own data; complaints on secondary use.
Risk register
| Risk | Signal | Control |
|---|---|---|
| Unpermitted training | Model trained on identifiable hospital extracts | Permit or a true anonymisation opinion. |
Open issues
- Opt-out design.
- Who pays EHR upgrades.
- Wellness-app border.
Primary sources
Your health data should follow you across the Union for care, and — with safeguards — be reusable for research and policy, under a new set of health-data access bodies.
You feel it now
The on-switch is still coming — do not wait for the headline.
Next
Primary and secondary use duties stagger from the late 2020s
Where it lands
| Channel | People | Companies |
|---|---|---|
| Primary use is infrastructure | You should see your own record and take it to another Member State. Secondary use is the fight: research vs. a market in hospital files. Use the opt-out when it exists. | Cross-border summaries and e-prescriptions — a vendor and hospital file. |
| Secondary use is a permit | You should see your own record and take it to another Member State. Secondary use is the fight: research vs. a market in hospital files. Use the opt-out when it exists. | No silent training of a model on hospital files. |
Who gains
Patients who move; researchers if the permits are real and the opt-out is usable.
Who pays
Health systems and EHR vendors; industry that wants secondary access.
Who pays
Health systems and EHR vendors; industry that wants secondary access.
Who benefits
Patients who move; researchers if the permits are real and the opt-out is usable.
Read the official text