The European Health Data Space (EHDS) is the EU regulation on electronic health data, adopted as Regulation (EU) 2025/327, that creates a common framework for primary use of health data in patient care and secondary use of the same data for research, innovation, public health and policymaking. Within Data regulation, it is the first sector-specific common European data space to receive its own binding legal act.
In tech regulation more broadly, the EHDS sits on top of the GDPR rather than replacing it. The GDPR still decides whether processing of health data is lawful, while the EHDS adds specific patient rights, technical obligations for electronic health record systems and a permit-based access regime for secondary use, supported by two cross-border infrastructures.
How the European Health Data Space is structured
The EHDS rests on two pillars that share one data source: the electronic records produced during care. Each pillar has its own governance body in every member state and its own EU-level infrastructure, so a hospital record can serve a treating physician abroad and, after pseudonymization or anonymization, a research project.
The following table summarizes the building blocks of each pillar and what they do.
| Building block | Pillar | Role |
|---|---|---|
| Digital health authority | Primary use | Enforces patient rights and supervises EHR market rules nationally |
| MyHealth@EU | Primary use | Cross-border exchange of records between national contact points |
| EEHRxF | Primary use | European exchange format for priority data categories |
| Health data access body | Secondary use | Assesses applications and issues data permits |
| HealthData@EU | Secondary use | Connects access bodies and research infrastructures across borders |
| Secure processing environment | Secondary use | Controlled workspace where permitted users analyze the data |
The European Health Data Space Board, composed of member state representatives and chaired by the Commission, coordinates implementation, while implementing acts fix technical specifications such as the exchange format and the requirements for logging access.
Primary use: patient rights and EHR systems
For primary use, the EHDS gives every natural person a right of immediate, free electronic access to priority categories of their health data, together with the right to add information, request corrections, restrict access by specific professionals and see who accessed their data. Member states may also offer an opt-out from cross-border or national access in care settings.
Six priority categories must be exchangeable in the common format, and they become mandatory in two waves.
| Data category | Typical content | Exchange obligation from |
|---|---|---|
| Patient summary | Allergies, medication, diagnoses | March 2029 |
| ePrescription and eDispensation | Prescribed and dispensed medicines | March 2029 |
| Medical images and reports | Radiology studies with findings | March 2031 |
| Laboratory results | Test values with reference ranges | March 2031 |
| Discharge reports | Hospital stay summary | March 2031 |
Manufacturers of EHR systems must include two harmonized software components: a European interoperability component and a European logging component. Conformity is shown through self-certification and CE marking, and the systems are registered in an EU database. Wellness applications that claim interoperability with EHR systems receive a labeling scheme.
Secondary use: data permits and safeguards
For secondary use, data holders such as hospitals, registries and insurers must make listed categories of electronic health data available to a health data access body, which decides on applications. Micro-enterprises are generally exempt from the holder duty. Users never receive raw records by default; they work inside a secure processing environment and may export only anonymized results.
The access body chooses one of two instruments depending on what the applicant needs.
| Instrument | What the user gets | Typical case |
|---|---|---|
| Data request | Anonymized statistical answer | Prevalence of a disease by region |
| Data permit | Pseudonymized data in a secure environment | Training and validating a diagnostic model |
Permitted purposes include scientific research, public health, official statistics, education, and the development of AI systems and medical devices. Prohibited purposes include decisions detrimental to individuals, setting insurance premiums, advertising to health professionals or patients, and developing harmful products. Individuals have a right to opt out of secondary use, with narrow exceptions that member states may define for public interest purposes.
How the EHDS compares with related data laws
The EHDS is a lex specialis for health within the EU data strategy. It borrows concepts from horizontal acts but applies stricter, health-specific rules.
| Instrument | Scope | Relationship to the EHDS |
|---|---|---|
| GDPR | All personal data | Legal basis and core data subject rights still apply |
| Data Governance Act | Reuse of protected public data, intermediaries | Model for access bodies; EHDS prevails for health data |
| Data Act | Data from connected products | Covers device data access; EHDS governs health records |
| Data altruism | Voluntary donation of data | Complements permits for consent-based research |
| Medical Device Regulation | Safety of medical devices | Applies to software that is a device; EHR systems follow EHDS rules |
A frequent misconception is that the EHDS creates one central EU database. In fact the data stays with national holders, and the infrastructures only route requests, results and records between authorized nodes.
Implementation timeline and practical pitfalls
The regulation entered into force in March 2025 and becomes generally applicable in March 2027, after which the staged dates for exchange formats and most secondary-use obligations follow in 2029 and 2031. Organizations that wait for the final dates usually discover that data quality and coding are the longest tasks.
- Inconsistent coding: local terminologies must be mapped to standards such as SNOMED CT, LOINC or ICD before exchange works.
- Underestimated dataset descriptions: holders must publish dataset metadata in national catalogs, which requires curation effort.
- Confusing anonymization with pseudonymization: pseudonymized data remains personal data under the GDPR.
- Ignoring opt-out handling: access bodies and holders need a reliable way to exclude records of people who opted out.
- Treating fees as optional: access bodies may charge fees for permits, which applicants should budget.
A non-technical view
Today a medical record often stays locked in the clinic that created it. The European Health Data Space changes that. You get a free digital copy of your key health records, you can see who looked at them, and a doctor in another EU country can read your summary if you fall ill while traveling.
The same records can also help science, but only under strict conditions. Researchers must ask an official body for permission, they work with data that does not show names, and they can take out only results, not personal files. You can say no to this reuse if you do not want your data included.
A concrete example
A university team wants to train a model that detects early signs of heart failure from routine laboratory values and imaging reports. Instead of negotiating separately with dozens of hospitals, it files one application with the national health data access body, describing the purpose, the variables needed and the security measures.
The access body checks that the purpose is permitted, confirms that records of people who opted out are excluded, and issues a data permit for pseudonymized data from 2018 to 2024. The team trains and validates the model inside a secure processing environment and exports only model weights and aggregate performance figures. The result is a lawful, auditable project completed without moving any patient record outside the controlled environment.