European Union. Health data. Regulation (EU)
EHDSRegulation (EU) 2025/327 on the European Health Data Space
Partially in force
§1Summary
- Synopsis
Gives individuals stronger rights to access and control their electronic health data and makes it portable across the EU through MyHealth@EU. It sets requirements for electronic health record systems, and creates a permit-based framework for secondary use of health data for research, innovation and policy.
- Key themes
- Unique features
It has a self-certification and CE-like regime for EHR systems, and lets individuals opt out of secondary use.
- SaaS relevance
Health-tech SaaS that is an EHR system or a wellness app claiming interoperability faces product requirements. Holders of health data may have to make it available for secondary use.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- As GDPR
- Cross-border transfers
- Restrictions on non-personal electronic health data transfers; GDPR for personal data
- Maximum penalty
- Set by national law (with ceilings for secondary use breaches)
§3Dates
- Key dates
- Adopted
- In force
- Published in OJ 2025-03-05; in force 2025-03-26. Primary use (Ch II–III) from 2027-03-26; EHR system manufacturer obligations 2028-03-26; secondary use (Ch IV) 2029-03-26; further categories up to 2031.
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- National digital health authorities; health data access bodies; EHDS Board
§5Where it applies
§6Sources and verification
- Verification
High confidence.