(1)

Citizens have the right to access their personal data, including their health data as provided for by Regulation (EU) 2016/679 of the European Parliament and of the Council (1), which lays down the conditions for lawful processing of personal data, including data concerning health, as defined therein (2) (health data). However most citizens cannot yet access (nor securely share) their health data across borders.

(2)

The ability of citizens and healthcare providers to securely access and share electronic health records (‘EHR's), that is to say collections of longitudinal medical records or similar documentation of an individual, in digital form, within and across borders has a number of benefits: an improvement in the quality of care for citizens, reduction in the cost of healthcare to households, and it supports the modernisation of health systems in the Union that are under pressure from demographic changes, rising expectations and costs of treatment. For example, sharing the results of blood tests in a digital format among clinical teams prevents repeating invasive and costly tests on the same person. Similarly, where patients need to see different health professionals, sharing electronic health records can avoid a repetition of the same information about their medical history saving time for all parties involved and improving the quality of care.

(3)

Enabling the secure access and sharing of health records across borders in the Union will facilitate citizens' life in a number of cross-border situations, such as citizens, and their families, who are currently living in another Member State for work purposes or retired people living in another country, enabling them to have access to health records between the Member States in which they have been resident. It will also improve the quality of care in situations which require medical treatment while travelling in the Union or as part of a cross border agreement. There are over two million recorded instances a year where a citizen living in one Member State has sought healthcare in another (3). Moreover, in the future, it can be usefully linked to European Union initiatives in the field of social security coordination.

(4)

Healthcare needs are expected to further increase in the future as a result of population ageing, rising prevalence of chronic conditions and a rise in demand for long-term care. This is evidenced by health spending amounting to 9,6 % of Gross Domestic Product in the Union as a whole in 2017, up from 8,8 % in 2008 (4). Similarly, evidence from various countries suggest that up to 20 % of healthcare spending is wasteful, for example because patients receive unnecessary tests or treatments, or as a result of avoidable hospital admissions.

(5)

Digital technologies are powerful solutions to address those issues and to adapt health systems to future challenges. For example, digital solutions linked to health apps, or wearable devices, combined with a system that allows a citizen secure access to their own health data, should enable patients with chronic conditions, such as diabetes, or cancer, to monitor their own symptoms at home and share them quickly with their clinical teams. This should reduce the number of visits to a health facility for monitoring. Digital technologies can also help to detect early a need for a change in treatments, resulting in fewer hospitalisations due to complications. Better management of chronic conditions in the community, alongside reducing duplication of healthcare actions (such as tests) should not only make systems more sustainable but also improve overall quality of life, the quality of healthcare provided to citizens, and reduce the costs associated with healthcare for individuals and households.

(6)

The Council has regularly called for Member States to strengthen the implementation of their digital health strategies. In particular, the Council conclusions on Health in the Digital Society adopted on 8 December 2017 (5) stress the need for Member States to make their electronic health systems more interoperable in order to give citizens greater control over their health data.

(7)

To support the digital transformation of health and care, the Commission adopted the Communication on ‘enabling the digital transformation of health and care in the Digital Single Market: empowering citizens and building a healthier society’ (6). That Communication adapts for the health sector, the objectives set out in the Communication ‘A Digital Single Market Strategy for Europe’ adopted on 6 May 2015 (7) and the Communication ‘EU eGovernment Action Plan — Accelerating the Digital Transformation of Government’, adopted on 19 April 2016 (8). It addresses the concerns raised in the Communication on the Mid-Term Review on the implementation of the Digital Single Market Strategy, ‘A Connected Digital Single Market for All’ (9) regarding the fact that the uptake of digital solutions for health and care remains slow and varies significantly across the Member States and regions.

(8)

Digitising health records, and creating systems that enable them to be securely accessed by citizens and securely shared within and between the different actors in the health system (patients, their clinical teams in the community and hospital facilities) is an important step towards integrating digital technologies into health and care approaches. That integration requires electronic health records, to be interoperable across the Union whereas currently many of the formats and standards in electronic health record systems — that are information systems for recording, retrieving and managing electronic health records — used across the Union are incompatible.

(9)

New technologies for health should support citizens to become active agents of their own health journey. To this end, citizens' and patients' needs should be taken into account when designing health information systems including making these systems more accessible to users, in particular to persons with disabilities, according to the accessibility requirements laid down by Directive (EU) 2016/2102 of the European Parliament and of the Council (10), where applicable

(10)

The aim of interoperability with regard to electronic health records is to allow for the processing of information in a consistent manner between those health information systems, regardless of their technology, application or platform in a way that it can be meaningfully interpreted by the recipient.

(11)

The lack of interoperability with regard to electronic health records leads to fragmentation and a lower quality of cross-border healthcare provision. The Commission has already identified specific ‘Integrating the Healthcare Enterprise’ (IHE) profiles listed in the Annex to Commission Decision (EU) 2015/1302 (11) (12) with the potential to increase interoperability of eHealth services and applications to the benefit of citizens and the healthcare professional community and to be eligible for referencing in public procurement. Those profiles provide detailed specifications for different layers of interoperability. Some of those profiles are already used to address specific business requirements in the eHealth Digital Service Infrastructure (‘eHDSI’).

(12)

The highest possible standards for security and data protection are central to developing and exchanging electronic health records. The General Data Protection Regulation requires patient data to be protected and properly secured so that its confidentiality, integrity and availability are ensured. As a consequence, systems must be secure, safe, trustable and integrate data protection by design and by default. A series of European wide digital solutions and common approaches for government and institutions lay the basis for this.

(13)

The use of secure electronic identification and authentication means provided for in Regulation (EU) No 910/2014 of the European Parliament and of the Council (13) (eIDAS) should enhance access, security and trust in electronic health record systems. That Regulation lays down the conditions under which recognised electronic identification means, falling under a notified electronic identification scheme of a Member State, may be used by citizens to gain access to online public services from abroad, including access to health services and health data. It also lays down rules for trust services such as electronic signatures, electronic seals and electronic registered delivery services, to securely manage and exchange health data by minimising the risk of possible tampering and misuse.

(14)

Under Directive (EU) 2016/1148 of the European Parliament and of the Council (14) healthcare providers, that are identified as operators of essential services by Member States and digital service providers falling in its scope are required to take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems they use in their operations of provision of service. They are also required to notify security incidents having a significant or substantial impact on the continuity of the services they provide to the competent national authorities or to the national Computer Security Incident Response Teams (CSIRTs). As regards in particular cybersecurity for electronic health record systems, cybersecurity certification may allow the demonstration that cybersecurity requirements are fulfilled, under the relevant Union cybersecurity framework (15).

(15)

Member States have taken important steps to foster interoperability with the support of the Commission, through the activities of the eHealth Network established under Article 14 of Directive 2011/24/EU. The eHealth Network's main objective is to support the development of sustainable eHealth systems, services and interoperable applications, facilitate cooperation and the exchange of information among Member States, enhance continuity of care and ensure access to safe and high-quality healthcare. Consequently it plays a crucial role for the interoperability of electronic health records.

(16)

In particular, in order to facilitate the interoperability of European eHealth systems, a number of Member States participating in the eHealth Network have worked together with the Commission to build the eHealth Digital Services Infrastructure, supported by the Connecting Europe Facility (CEF) Programme (16). In some of those Member States, the exchange of ‘ePrescriptions’ between health professionals across borders through the eHealth Digital Services Infrastructure has started, while the exchange of ‘Patient Summaries’ is expected to start soon. Enhancing the interoperability of electronic health records should help expanding the datasets currently being exchanged within the eHealth Digital Services Infrastructure to include valuable information concerning laboratory results, medical imaging and reports, and hospital discharge reports, which would enhance continuity of care. A number of tools developed for the eHealth Digital Services Infrastructure are a resource for Member States for the exchange of electronic health records.

(17)

In the context of exchanging electronic health records, the eHealth Network plays a valuable role in further developing the European electronic health record exchange format, by using it for the eHealth Digital Services Infrastructure and promoting its use for exchanges between healthcare providers at national level.

(18)

Digitising health records and enabling their exchange could also support the creation of large health data structures which combined with the use of new technologies, such as big data analytics and artificial intelligence can support the search for new scientific discoveries.

(19)

Existing national specifications for electronic health record systems may continue to apply in parallel with a European electronic health record exchange format,