New law is a “game changer” for sharing health data

Better care for citizens across Europe: that is the goal of the European Health Data Space (EHDS), which came into force in 2025. This European legislation is designed to ensure that health data becomes more readily available, both for healthcare provision and for research and innovation. Each Member State must establish a ‘Health Data Access Body’ (HDAB) to assess access to health data for research, grant approvals and cooperate with HDABs in other EU countries.

1. What implications does the European Health Data Space have for organisations?

“The EHDS will have a major impact on the way we share data with one another in the future. The law applies to any organisation that manages health data: hospitals and research institutes, but also a university of applied sciences conducting research into the mental health of the Dutch population, a foundation managing a population cohort, or a commercial company developing a wellness app. They will be obliged to make their data discoverable and make it available upon request.

In the scientific world, we are now used to forming communities where you collaborate and agree amongst yourselves which data to share. If you have no interest in it, if there is no funding, or if you don’t like someone, you can say: I’m not doing it. But under the new legislation, you have to deliver. So that is a massive game changer.

Under the EHDS, it is no longer the individual researcher but the organisation that is responsible for providing data. This means, for example, that a researcher anywhere in Europe can use a central portal to request data for research into a condition such as diabetes, sourced from hospitals in a specific region. As an institution, you must then be able to supply that data, even if the researcher with all the subject-matter expertise regarding that cohort, that study or that patient population has since left the organisation.

There are financial consequences to this: the EHDS provides for fines if this is not complied with. We do not yet know what the scale and dynamics will be. Will parties actually use that legal stick, or will we continue to make our data requests primarily through the usual channels? I think many parties do not yet realise what is looming over them. We need to work together to see what this means for the workflow, the responsibilities and the digital infrastructure required — and how we can ensure that everything fits together properly.”

2. How can institutions better prepare for this?

“The EHDS will be introduced in phases. From 2029, the obligation will apply to 12 data categories, including electronic patient records (EPRs), administrative data and data from medical devices. From March 2031, the law will be fully in force and genetic and genomic data, molecular data, clinical trial data and research cohorts will also fall under the requirements.

This final phase will particularly affect research and educational institutions. However, 2029 is already relevant for many institutions, for example regarding data from wearables and wellness apps, or medical registers maintained within academic institutions.

In recent years, collaborations have emerged in various regions between healthcare institutions, the social sector and research institutes to conduct data-driven research into, for example, prevention and maintaining access to care. These ‘regional health data spaces’ are a good starting point for helping one another. This allows you to jointly meet the requirements of the EHDS and connect to national facilities, such as a catalogue and an application portal.”

As CSIO at Erasmus MC, Robert translates questions and needs from the research sector into what the organisation can offer in terms of ICT and digitalisation. For example, he set up the research infrastructure at the Rotterdam university medical centre. “Whereas researchers used to arrange everything themselves up until about 10 years ago, we now offer this centrally from within the organisation: from computing clusters and cloud solutions to access to data from the EPD for scientific research. Together with Radboudumc and UMCU, we have developed a secure processing environment, MyDRE. This enables researchers to collaborate securely with sensitive data whilst easily meeting the privacy and information security requirements we set as organisations.”

Health-RI essentially does the same on a national scale: organising a health infrastructure that improves and accelerates access to healthcare data for research and innovation. This includes agreement frameworks that make it easier for parties to meet the conditions for data sharing, tools for privacy-friendly data exchange, and a national catalogue where you can find data.

3. What opportunities do you see for collaboration with other academic disciplines that also work with privacy-sensitive data, such as the social sciences?

“The great thing about the EHDS is that you’ll soon be able to link all sorts of data much more effectively. You’ll then be able to submit a research query to 10 hospitals at once. Or you can link medical images to symptoms that were recorded much earlier by the GP when the illness first arose.

It is, of course, very appealing to have a shared infrastructure that meets the requirements set by the HDAB. Secure processing environments and federated solutions for analysing data will soon be essential: secure, certified solutions that allow you to collaborate under a single set of agreements.

This also offers the Netherlands an opportunity to catch up. In the field of data exchange in healthcare, we are more than 10 years behind the frontrunners in Europe. The EHDS is now forcing a harmonisation that we never managed to achieve through voluntary cooperation.”

4. What is the first step that institutions can take now to ensure they are ready for this legislation when it comes into force?

“Appoint a project lead within your own organisation to assess the impact on existing processes and policies; that is what we did at Erasmus MC. Don’t be too reactive — we don’t want procrastination to turn compliance with the EHDS into a revenue model for commercial parties, whilst there is an opportunity to better regulate data exchange in the Netherlands. This is a strategic choice with long-term consequences.

In addition, join forces with parties in your own environment to prepare together: sector-wide or within your own region. Finally, what I advocate is that the government, umbrella organisations and other parties identify which solutions already exist that, with additional investment, could develop into utilities and infrastructures to make all this possible. Because the law is in place, the deadline is approaching, and the organisation around the EHDS is still up in the air. Those who take the initiative now will help determine what that landscape will look like.”

Want to know more?

Would you like to know more about working securely with sensitive data? Take a look at the SURF theme page on sensitive data. You can find more information about the Health Data Access Body at datavoorgezondheid.nl.

Text: Josje Spinhoven