EHDSEuropean Health Data Space

What it is

Regulation (EU) 2025/327 of 11 February 2025 was published in the Official Journal on 5 March 2025 and entered into force that month. It provides common rules, standards and infrastructures and a governance framework for electronic health data. According to its Article 1(2)(a), it specifies and complements GDPR rights; it does not replace the GDPR.

Primary use: care

• Rights: access to one's own data (Art. 3), restricting health professionals' access (Art. 8) and, where national law provides for it, a reversible opt-out from access through the EHDS services (Art. 10).
• Priority categories (Art. 14): patient summaries, electronic prescriptions and dispensations, medical imaging studies, test results and discharge reports.
• European electronic health record exchange format (Art. 15): the Commission must set its technical specifications through implementing acts by 26 March 2027; they include harmonised datasets, coding systems and technical interoperability specifications.
• MyHealth@EU (Art. 23): the cross-border infrastructure for primary use.
• EHR systems (Chapter III): rules for two mandatory harmonised software components, one for interoperability and one for logging (Art. 1(2)(b)).

Secondary use: research and policy

Each Member State designates health data access bodies (Art. 55), which issue data permits (Art. 68). Data are processed in secure processing environments (Art. 73), and the cross-border infrastructure is HealthData@EU (Art. 75). People can opt out of secondary use at any time and without giving reasons (Art. 71).

Timeline (Art. 105)

Governance

The European Health Data Space Board brings together two representatives per Member State, one for primary use and one for secondary use (Art. 92). At national level, digital health authorities act (Art. 19).

Common misconceptions

• Believing it already fully applies. As of October 2026 it is in force, but its main obligations do not yet apply.
• Believing it mandates a specific technical standard. The text refers to implementing acts; it does not name a messaging standard.
• Confusing opt-out with consent. Secondary use is not based on consent: the person can object, except for the national mechanism of Art. 71(4), which a Member State may provide for certain public health purposes or scientific research for important reasons of public interest, at the request of public sector bodies or bodies with a public health mandate.