EUROPEAN COMMISSION

Strasbourg, 3.5.2022

SWD(2022) 131 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT REPORT

Accompanying the document

PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Health Data Space

{COM(2022) 197 final} - {SEC(2022) 196 final} - {SWD(2022) 130 final} - {SWD(2022) 132 final}

Table of contents

1Introduction

1.1Technological context

1.2Socio-economic context

1.3Legal context

2Problem definition

2.1Lessons learnt from the evaluation of Article 14 of the Cross Border Health Care Directive (CBHC) Directive

2.2What are the problems?

2.3What are the problem drivers?

2.4How will the problem evolve?

3Why should the EU act?

3.1Legal basis

3.2Subsidiarity and Proportionality

4Objectives: What is to be achieved?

4.1General objective

4.2Specific objectives

4.3Objectives tree/intervention logic

5What are the available policy options?

5.1What is the baseline from which options are assessed?

5.2Description of the policy options

6What are the impacts of the policy options?

6.1Economic impact

6.2Single Market, competitiveness, innovation, SMEs and international aspects

6.3Impacts on fundamental rights

6.4Social and environmental impact

7How do the options compare?

8Preferred option

9How will actual impacts be monitored and evaluated?

End-notes

Glossary

11    Introduction 

This impact assessment accompanies the legislative proposal on a European Health Data Space (EHDS). EHDS is one of the priorities of the current College in the area of health I and will be an integral part of building a European Health Union II . It will ensure coherence with a number of other EU legislative frameworks, including the General Data Protection Regulation, the Data Governance Act, the AI Act, cybersecurity regulatory framework, the eIDAS regulation, the pharmaceutical regulatory framework and the medical device regulation III .

The COVID-19 pandemic has highlighted the imperative of having timely access to health data for research, innovation, regulatory, policy-making and statistical purposes, and the European Council has recognised the urgency to make progress towards and to give priority to the EHDS IV . Such timely access would have helped, through efficient public health surveillance and monitoring, a more effective management of the pandemic, and ultimately contributing to save lives. In 2020, the Commission adapted urgently its Clinical Patient Management System V (CPMS) to allow Member States share the data of COVID patients when moving between healthcare providers and Member States during the peak of the pandemic, but this was only an emergency solution, showing the need for a structural approach at Member States and cross-country level. The call for structural approach was further strengthened through Council Conclusions by the ministers of health during the German Presidency VI .

In February 2019, the European Parliament adopted a resolution on the implementation of Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare (hereinafter “CBHC Directive”) VII , where it stressed the need for action in the area of digital health data, personal records, ePrescriptions and telemedicine, while ensuring data protection.

The 2020 European Strategy for Data VIII announced the Commission’s plans for European data spaces, including the EHDS. The initiative on an EHDS builds upon and complements the proposal for a Data Governance Act IX and the proposal for a Data Act X , by providing specific measures for health. It also builds on the provisions of the GDPR for the area of health. The EHDS is a Commission priority XI , as reiterated in the State of the Union of 2020 XII and 2021 XIII , and is included in the 2021 Commission Work Programme (CWP) XIV . 

Digital health has been on the agenda of the European Commission for a long time XV , building on the CBHC Directive XVI and eHealth Action Plan 2012-2020 XVII . Prior to the COVID-19 health crisis, in the Communication on enabling digital transformation of health and care in the Digital Single Market (2018) XVIII , the Commission announced its intention to act in three areas: citizens' secure access to and sharing of health data across borders; better data to advance research, disease prevention and personalised health and care; and digital tools for citizen empowerment and person-centred care. Through MyHealth@EU XIX , in 2019, Member States started to provide patients the ability to share their data with healthcare providers (in the language of the healthcare professional) of their choice when traveling abroad. Also, progress was made on the interoperability of electronic health records (EHRs) XX . The COVID-19 crisis strongly anchored the work of the eHealth Network as the main pillar for the development of contact tracing and warning apps XXI and EU Digital COVID Certificates XXII .

At international level, the challenges and opportunities related to the growing digitalisation of data in the health area and to health data sharing have also been discussed. The Council of Europe issued in March 2019 a Recommendation on the protection of health-related data XXIII , providing guidelines on the processing of health-related data in line with the Convention for the Protection of Human Rights and Fundamental Freedoms. The Organisation for Economic Co-operation and Development (OECD) underlined in 2016 XXIV the important and growing opportunities of health data re-use and World Health Organization (WHO) adopted a Global Strategy on digital health 2020-2025 XXV . Moreover, WHO and OECD are looking into the state of play of digital health ecosystems of countries. The WHO has developed State of Digital Health report, which provides the snapshot throughout the world. The report presents data collected from the 22 countries across 6 regions that participate in the Global Digital Health Index (GDHI), analyses regional trends, and sets benchmarks to consider when charting future growth. XXVI . OECD regularly develops reports on the implementation, dissemination and continued relevance of the OECD Recommendation on Health Data Governance XXVII . Several third countries adopted specific legislation on data and interoperability XXVIII . Cooperation with WHO, OECD, G7 continues, as well as bilateral cooperation with different third countries, such as the US.

1.11.1    Technological context

Data concerning health is defined by the GDPR as personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. The scope of health data covered by the EHDS includes not only processing of electronic personal data concerning health and social care, but also non-personal data, for example, as anonymised or aggregated data related to health and social care XXIX which may fall outside the scope of the GDPR. It is important to distinguish between primary and secondary uses of health data to understand the challenges of the EHDS. In this context, primary and secondary uses should be understood as follows, unless indicated otherwise:

a)Primary use, or use, of heath data is defined as the use of health data to support or provide direct individual healthcare delivery to the data subject, including for ensuring continuity of care XXX . Such data comprises data stored in electronic health records (including patient summaries, ePrescriptions, images, laboratory results, discharge reports), as well as other types of data (e.g. genetic data, data generated by medical devices or wellness applications). The eHealth Network, the existing voluntary cooperation network established under article 14 of the CBHC Directive, has worked over the past years on the cross-border exchange of health data for primary uses. Key information domains that have been or are being standardised (coded, made interoperability for data exchange etc.) include patient summaries, ePrescriptions/eDispensations, laboratory reports, medical images and reports and hospital discharge reports. While these documents are not the only documents constituting an electronic health record (EHR) XXXI , they are key datasets identified as a baseline for a European Electronic Health Record Exchange Format (EEHRxF) XXXII .

b)Secondary use (or reuse) of health data is defined as the use of individual-level, personal or non-personal health data or aggregated datasets, particularly data generated during healthcare provision with the purpose of supporting research, innovation, policy making, regulatory activities and other uses, such as healthcare delivery to a patient, based on the data concerning other patients (e.g. personalised medicine). The scope of health data for reuse purposes is much wider than in the context of primary use. Such data could include electronic health records, other clinical documents, sickness claims, reimbursement data, diseases registries, but also relevant social data etc. Besides electronic health records and other digital health products and services, reusers may utilise sources such as disease-specific or subdomain-specific data registries (e.g. focused on brain research or communicable diseases, among many others) and networks of registries (such as EUROCAT or ENCR), health-related administrative data (e.g. reimbursement and claims data), as well as other specific datasets containing genetic and genomic data. The current landscape of health data reuse initiatives is characterised by disease-specific or subdomain-specific initiatives and infrastructures XXXIII .

Digital health refers to the use of digital technologies by people and healthcare systems for health. It covers a wide range of services and products, including medical devices XXXIV , such as those used for remote care delivery, health data and information management, patient management (including therapeutic decision-making) and telemonitoring and diagnosis XXXV . The rollout of digital technologies XXXVI is rapidly changing the way in which health and care services are provided, and the scope of health data processing, which has traditionally been limited to electronic health records systems and other IT systems managed by healthcare systems, is becoming more decentralised and more granular, as online and portable electronic devices become more popular. These technologies increasingly rely on health data generation, access, processing and transmission by patients themselves and their reach extends beyond traditional health systems. This decentralisation has also widened the data domains that are relevant for providing health care XXXVII , including, for example, data generated from digital health products such as wearables or mobile health applications XXXVIII (which can also be medical devices), as well as wellness mobile applications XXXIX and patient recorded outcomes.

An overview of user perspectives is available in Figure 1 of Annex 4 on graphical representation of different aspects in the impact assessment.

As defined by the GDPR XL , personal health data is highly sensitive for the repercussions its processing potentially has on the health and wellbeing of individuals, and its processing is therefore characterised by specific standards and protocols for interoperability and cybersecurity. The categories of relevant health data are widening and becoming more diverse and decentralised and are collected in different formats and repositories XLI . While GDPR foresee the right to access and portability of data, its practical implementation is hampered by different structures of data, different coding and different standards for sharing data between data sources. Technologically, the decentralisation has brought new challenges for interoperability beyond the interoperability between electronic health records, particularly regarding the interoperability among digital devices and digital health applications. Due to a lack of interoperability, in many cases, healthcare professionals cannot access the complete medical history of the patient and cannot make optimal medical decisions for the treatment and diagnosis of their patients, which adds considerable costs for both health systems and patients. Researchers and innovators cannot have access to sufficiently large amounts of health data that is necessary for breakthroughs in the medical field. Likewise, policy-makers and regulators lack the relevant health data in order to take efficient decisions and ensure the right surveillance of health issues. The picture below describes the challenges in terms of interoperability. According to eHealth Network’s Refined eHealth European Interoperability Framework XLII , for interoperability to be implemented, one should ensure legal interoperability (same rules), organisational (similar policy and care processes), semantic (similar way of codong the information that feeds into the system) and technical interoperability (for applications and IT infrastructure) XLIII . For more details on the interoperability challenges, including the interoperability framework and the state of play in Member States, see Annex 10.

Figure 2: Interoperability of the health ecosystem (source: MedTech Europe, Cocir, Interoperability standards in digital health. A white paper from the medical technology industry, 06/10/2021, interoperability-white-paper-cover (cocir.org) ).

1.21.2    Socio-economic context

Digital health products and the use and reuse of health data can enable models of care better suited to people and patients’ needs and preferences, by preventing the onset of disease or earlier treatment. The increased use of digital health solutions during the COVID-19 pandemic allowed healthcare systems to expand their support of patients from various socioeconomic backgrounds who would otherwise not seek or be able to access care during this crisis. The use and reuse of health data influences the quality and efficiency of health services received by individuals in many ways. The availability of health data to healthcare professionals is key for ensuring continuity of care and avoiding duplications and errors, and to policy-makers for proper decision-making, for example, regarding the assessment of new health technologies for pricing and reimbursement. The availability of health data to patients is also fundamental for transparency and better disease management. The use and reuse of health data can inform better clinical decisions, contribute to automation in health and accelerate R&D processes, helping close the current productivity gap both in the provision of healthcare and in the research and development of medical breakthroughs.

In order to ensure that the patients can control their health data, for the primary use of health data, one can distinguish three main product markets that can be impacted by the European Health Data Space initiative, as they entail use of data (especially access and portability): electronic health records, medical devices and wellness apps. Telemedicine is also another market (although it often contains a combination of medical devices, electronic health records and communication tools). The market of healthcare providers is also impacted by the proposal, as they need to ensure that data can be shared/made accessible and that the electronic health records, medical devices and other systems are interoperable.

The health services sector, representing approximately 10% of the EU’s GDP XLIV and including both public and private providers, is a fundamental ecosystem both for the wellbeing of Europeans and the economy of the EU. Europe’s healthcare systems are under pressure XLV as health costs increase at a faster rate than GDP due to, among others, structural issues such as ageing population and high development costs of new medicines and treatments XLVI . The COVID-19 pandemic exacerbated this issue. The sharing and reusing of health data, particularly combined with automation and digitalisation, would contribute to increased efficiencies. When all relevant health information is available at the point of care, tests no longer need to be duplicated, the administrative burden on healthcare professionals will be lowered when entering or copying health data between systems and medical errors can be reduced. Studies have estimates that up to 20% of spending in health could be wasteful and that, therefore, this waste could be reduced without hampering the performance of healthcare systems XLVII . Digitalisation and interoperability can contribute to reducing this waste by allowing the data to be shared between healthcare providers thus leading to better, more targeted diagnosis, avoiding duplications and additional unnecessary costs. Overall, studies have shown that the increased use of health data and increased interoperability could generate potential savings valued at EUR 4.6 billion per year for health services and 4.3 billion per year for patients XLVIII . The most recent estimates by the OECD suggest that the combined economic benefits of putting data and digital technology to work in the health sector could amount to 8% of the total health expenditure of all OECD countries XLIX . While the investments in digital health contribute to the competitivennes of Member States’ economies and their future growth, allowing the cost savings and increased efficiency of health systems, detailed estimations are not yet systematically available.

With regards to electronic health records (EHRs), the introduction of electronic health records for  medical coding  and billing has eased the process as data entering into computerized systems is more convenient than paper-based methods. The size of the global market in 2020 was estimated at USD 26.9 billion and is expected to grow to US 35 billion by 2028 L . While the market is competitive, some big players, such as Cerner Corporation, Allscripts Healthcare LLC, EPIC Corporation are among the major brands in the market, but smaller players are also active. Many providers tend to provide proprietary solutions, which lead to lock-in effects, although governmental initiatives (e.g. 21 Century Cures Act of the US government) can lead to increased interoperability and data unblocking. For instance, in August 2020, Cerner Corp. collaborated with Amazon to integrate its EHR solutions with the latter’s wearables, such as Amazon Halo. This would provide greater interoperability to its customers and strengthen its service portfolio LI . During the COVID-19 crisis, Electronic Health Records (EHR) vendors and organizations have started to help curbing the pandemic by making telehealth a mainstream alternative, enhancing data access through EHRs, and collaborating to develop Covid-19 dashboards in detail. In terms of regional distribution, North America is expected to dominate the global EHR market owing to rising support for the adoption of health information technology by providers and payers, big giants in the market focusing on improving patients’ clinical outcomes, coupled with increasing government initiatives and programmes for population health management. Asia Pacific seems the fastest growing region in this field, especially thanks to governmental initiatives in China. Europe (including Russia) is estimated to have a share of around 27% of the global market LII , which would mean by extrapolation around EUR 3.85 billion. However, this seems to be a conservative estimate, as shown by the estimates of Member States. Based on information received from experts in Member States, the cost of setting up nationally electronic health record systems ranges between few hundred million euros EUR 1.4 billion for mid-sized and large EU countries, depending on the service coverage. Based on Member States declarations, studies LIII  and extrapolations, the value of the EHR market can go up to EUR 16 billion, out of which EUR 3-9 billion need to be set up or further developed. Under the Recovery and Resilience Facility, Member States applied for around EUR 12 billion funding for digital health (out of a total of EUR 720 billion) including for investments in electronic health records. In terms of number of EHR products, Finland has registered around 400 electronic health record systems, including 80 connected to the national system (Kanta) and other digital health products processing electronic health data in its current database of certified products. By extrapolation (considering all EU Member States and that some products can overlap between different countries), one could expect around 4,000-5,000 EHR systems on the EU market, as some producers will provide services in several countries.

During the pandemic, faced with the unprecedented need for remote access to care in the context of the imposed social distancing restrictions, the use of digital health, including telemedicine has increased significantly (e.g. reflected in the use of teleconsultations LIV ), thus guaranteeing continuity of care for a large part of the population LV . According to Eurostat, 2% of the population report unmet needs for medical examination and care due to the healthcare service being too expensive or too far to travel. Digital health products and services, including telehealth, are increasingly becoming an intrinsic part of the delivery of care, allowing to reduce some of the inequalities in relation to access and affordability of healthcare. The integration of these digital products and services can positively contribute to improving the cost-effectiveness of healthcare systems, e.g. telemedicine is reported to be cost-effective in 73.3% of the cases covered by the literature LVI . A 2018 market study on telemedicine LVII considered that its market potential was strong and expected to grow in the EU at a compound annual growth rate of 14% in the coming years. Telemedicine is also expected to improve the efficiency of the healthcare systems, including by supporting triage. In fact, OECD estimated that 12% to 56% of emergency department visits are inappropriate LVIII . The COVID crisis has boosted strongly the telemedicine market. In the long run, it is expected that the global market is projected to grow from USD 41.63 in 2019, USD 79.79 billion in 2020 to USD 396.76 billion by 2027 LIX , with North America in the lead, followed by Europe. At the same time, further roll-out of telemedicine requires more mature and interoperable electronic health records and medical devices.

The global digital health market, which comprises various software and hardware solutions (which includes medical devices, but not necessarily) used in the processing of health data, has seen a steady increase in terms of size, and was expected to almost double in size, from EUR 16 billion in 2015 to EUR 31 billion in 2020 LX . For example, industry association COCIR estimates that the size of the European market for medical imaging IT technologies is worth EUR 500 million. The European digital health sector is a very important supplier of products and services for healthcare, but before the pandemic it clearly lagged behind the US both in terms of revenue and number of users per capita LXI . A consultancy considered that by using mHealth solutions to their potential, healthcare systems in the EU can save 99 billion EUR in total annual healthcare spend in 2017 after the cost of extra workforce to support mHealth LXII . According to Eurostat LXIII , in 2019, pharmaceutical goods and other medical non-durable goods made up approximately 14% of total health expenditure in the EU LXIV , or almost EUR 195 billion, while therapeutic appliances and other medical durable goods made up 4%, or around EUR 60 billion. According to the yearly analysis of an industry association LXV , the medical devices industry employs 760,000 workers, consists of 33,000 companies (of which 95% are SMEs), and represents almost 8% of healthcare expenditure. The European medical devices market, with a size of EUR 140 billion and growing steadily since 2017, is the second largest market after the US and represents 28% of the world market for medical devices. This sector contributed to the EU’s economy with a EUR 8.7 billion trade surplus in 2020.

Digital products that are medical devices are another sector impacted by EHDS in several ways: re-use of data is essential to develop some devices, especially those entailing AI. At the same time, these devices produce data that ideally should be ported to electronic health records if the two are interoperable and be consulted by the patient and the healthcare provider. An industry association listed around 500 000 products in the area of medical devices (including all types of devices, from digital to masks and PPE), but the exact numbers of devices that process patients’ data are difficult to identify. Devices processing patients’ data could include: personal (connected) health devices (including imaging and other diagnostic/monitoring devices in clinical settings, digital and robotic surgery equipment, telehealth and remote care/monitoring systems, glucose meters and insulin pens, pulse oximeters, blood pressure cuffs, thermometers, medical grade weight scales, etc.), cardiac implanted electronic devices, health apps ranging from personal monitoring/coaching to advanced clinical decision support software etc. The central database Eudamed LXVI is being set up and only a limited number of medical devices have been included (59 with software and around 1000 using electricity). A search in medical devices database of Italy revealed around 160 medical devices that process information such as images which, by extrapolation to the whole EU (taing into account the overlap on different markets and increased number of products), can lead to around 5,000-20,000 medical devices processing patients’ data.

Other m-health products that may produce relevant health data are wellness applications (which do not fit within the definition of medical device LXVII ). The size of the market is much bigger than for medical devices. A 2019 study published by the Dutch National Institute for Public Health and the Environment analysed the market of mobile health applications in the Netherlands and found that 21% of sampled applications were a medical device (i.e. a mobile health application according to the definition above), while the rest 79% were not (i.e. a wellness mobile application) LXVIII . With regards to the state of the market, over 71,000 health and fitness apps were launched globally in 2020 (24,000 in the Apple App Store and 47,000 in the Google Play Store) LXIX . According to the IQVIA Institute LXX the volume of health-related mobile applications would have surpassed 350,000 globally in 2021. According to industry analysts LXXI , sales in health and fitness apps in Europe accounted for 30% of global spending in the category, up from a 27% share in 2019. Therefore, there could be approximately 100,000 mobile wellness applications in the European market. The COVID-19 crisis boosted the use of such apps, with Europe as a global lead. European spending in health and fitness category mobile applicationss jumped by 70% year-over-year in 2020 to an estimated USD 544 million as consumers looked to keep fit and stay mindful during the COVID-19 pandemic and regional lockdowns. Downloads of Health & Fitness category apps saw a significant surge in Europe during 2020, rising by approximately 46% year-over-year in 2020 to 829 million LXXII .

Figure 3. The patient monitoring continuum (Source: Medtecheurope, Cocir, 2021).

For the secondary use of health data, the main sectors impacted are research and innovation (including on pharma, medical devices, AI), policy making and regulatory aspects, as well as the data market.

The yearly economic value of health data reuse, which can very notably benefit the development and placing in the market of new pharmaceutical products LXXIII , medical devices and other digital health products (e.g. those based on artificial intelligence), is estimated at around EUR 25-30 billion at present, expected to increase to around 50 billion in 10 years LXXIV . 

According to a recent retrospective analysis LXXV on the use of real-world evidence (RWE) to support marketing authorisation applications to the EMA for new pharmaceutical products and extensions of indications, 40% of initial marketing authorisation applications and 18% of applications for extension of indication for products currently on the market contained RWE (obtained from the re-use of data from electronic health records, registries etc). Another recent analysis LXXVI on the use of RWE during the pre-authorisation phase concluded that dearly all European Public Assessment Reports submitted in 2018-2019 relied on RWE for the discovery (98.2%) and life-cycle management (100.0%) LXXVII . However, the collection and management of RWE remains costly, particularly when it requires processing of personal health data originating from several national jurisdictions and when such data is being collected by obtaining the explicit consent of each data subject. Reducing the costs of accessing the data (fee to data access body as opposed to contacting data subjects and getting the consent) can stimulate new research, innovation and can facilitate the decision making of health authorities and regulators. For more details concerning the differences in costs, see Annex 5 on methodological approach.

According to the current evaluation of data markets for the countries that developed mapping and quality evaluation of different data sources, Finland has listed in its data catalogue around 450 data sources/datasets and France, 12. Therefore, extrapolating and considering that not all the countries will have from the beginning the same level of maturity and mapping and evaluation of data sources/datasets, one could have at the level of EU, at the end of 10 years between 3500-5000 data sources mapped and benefiting from a quality label (with some countries having more, others less).

Overall, Member States and stakeholders are supportive to the objectives of the EHDS initiative, as gathered in the public consultation and other stakeholder consultations. The most important objectives that respondents said a European framework on the access and exchange of personal health data should aim included: supporting and accelerating research in health (89%); promoting citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format (88%); and facilitating the delivery of healthcare for citizens across borders (83%) (see Annex 2).

1.31.3    Legal context

1.3.11.3.1    Horizontal framework

As shown in Annex 6, the EHDS builds upon legislation such as GDPR, Data Governance Act, Data Act and the Cross-border Healthcare Directive, while ensuring compliance with regulatory frameworks in the areas of sybersecurity, pharma and cross-border health threats.

Considering that a substantive amount of data to be accessed in EHDS are personal health data relating to individuals in the EU, the instrument must be designed in full compliance with the General Data Protection Regulation (GDPR) LXXVIII , but also with EU Data Protection Regulation LXXIX  (EUDPR). The instrument should also take account of the EU’s international trade commitments.

The use of data for health and the re-use of health-related data build on the possibilities for processing health data based on EU law, offered by the article 9 of GDPR LXXX for processing special categories of data, including health or genetic data, whereby processing is necessary for:

·healthcare provision (the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services and subject to professional secrecy (Article 9(2)(h));

·for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices (Article 9(2)(i));

·scientific or historical research, statistical purposes or archiving in the public interest (Article 9(2)(j)). 

With regards to processing of data for healthcare (primary use of health data), EHDS is intended to reinforce the control of patients over their health data by establishing clear rules on how the rights of data subjects under chapter III of the GDPR (right to access, portability, information, rectification, erasure, restriction of processing, right to object, with a focus on right to access and port the data) can be implemented in practice. EHDS would task the national digital health authorities with establishing a national framework supporting the implementation of these rights. Such a framework could entail establishing of national patient portal, as well as implementation of requirements that could stengthen the interoperability and allow the data to “flow” between healthcare providers (by certification, using such standards in procurements etc.).

In the context of EHDS, the notion of “control” on the part of the individuals concerning the rights remains the same as in Chapter III and IV of GDPR. More specifically, the EHDS aims at further strengthening the right to access and portability of the data subjects to their health data so that they can provide it to the healthcare professionals of their choice rapidly and in an easy, transparent common format. The need to reinforce the right to access in the field of the healthcare services derives from objective difficulties and obstacles, since, for instance, the data may not be available immediately or in an electronic format (for more details, see Annex 12 on the evaluation of the Cross-Border Healthcare Directive). Moreover, this right is difficult to implement in practice in an electronic format if no patient portal exists and if data is stored in electronic health records of healthcare providers which are not readily accessible to patients. A study LXXXI has shown that, while 26 EU/EEA countries generally provide their citizens with access to EHR data by law, 12 countries indicate that their citizens are not entitled to choose which healthcare professional or other party can access their EHR. Most countries specify conditions for alteration and archiving of electronic health data, but only around one third allow patients to correct data entered intheir EHR by themselves.

Furthermore, one of the major purposes of the EHDS is to facilitate the transfer of health data, upon request of the data subjects, between the healthcare or social providers of their choice. Article 20 GDPR provides the right to portability for data subjects. However, its fragmented implementation across Member States has shown some serious limitations concerning healthcare, as Article 20 GDPR excludes: a) health data that has not been provided by the data subject or observed (e.g. medical reports etc.), b) data that had been processed based on another legal basis other than consent or contract (which in practice excludessome categories of public entities the majority of which processes personal data on the legal basis of public interest). Consequently, on a practical level, patients may not exercise the right to portability of their health data when for example consulting a new doctor (patients need to ask for the data, bring it often in paper format, and the data may be incomplete) since it could be outside the scope of Article 20 of the GDPR. Moreover, the portability right cannot be implemented technically if there is no interoperability between different healthcare providers and with an electronic health record. If the standards and specifications used for different solutions are proprietary and cannot “talk” to each other, if data are kept in silos then even if the various healthcare providers are willing to fulfil the data subject’s demand in relation to their personal health data it will be challenging to do so in practice. Therefore, the EHDS proposal will also support the technical aspects that are necessary to operationalise some of the GDPR rights, as for instance, the electronic right of access and portability cannot be ensured without the necessary technical elements standards and specifications necessary to ensure interoperability between different data sources, authentication of individuals or setting up the national infrastructure for electronic health records.

Whilst consent (Article 6(1)(a) and 9(2)(a) of GDRPR) is one of the main legal bases for health data processing under GDPR, the GDPR also allows the processing of health data under other valid legal basis- ie provision of health or social care, public health, scientific purpose based on Union or national law. Thus, data can be processed as per Articles 9(2)(h), (i) (j) LXXXII  of the GDPR, which do not require explicit consent, provided that suitable and specific measures are put in place to safeguard the rights and freedoms of data subjects. Some Member States already use these possibilities under their national law (see Table 1. in section 2.2.).

For secondary use of health data, EHDS would build upon these possibilities offered by GDPR for a specific EU law with particular safeguards. It will develop a European framework, inspired from the actions taken by several Member States that adopted similar national legislation for the secondary use of health data. EHDS, similarly to these national laws, would specify the purposes for which data can be used, as well as limitations LXXXIII in full compliance with the provisions and requirements of the GDPR.

Similarly to national framework built upon GDPR, EHDS would ensure that data is processed in a legal, ethical and secure way by setting up a data access body/data permit authority LXXXIV deciding on every request to access to data, alone or in cooperation with other entities LXXXV . EHDS would provide access to a large array of health data (electronic health records, claims, genetic data etc.), but the technical implementation of the cooperation between the data access bodies and the data holders would be left to the national level.

The request for data access should provide information about the purpose of processing, ethical evaluation, data protection aspects etc LXXXVI which would allow the data access body to analyse and determine whether the request complies with the relevant data protection principles. In line with data minimisation principles under GDPR, data, by default, may be provided in an anonymised/aggregated way or in a pseudonymised way. In order to ensure security of the data, this can be processed in a virtual secure processing environment where the researcher has the necessary IT tools for data processing, but only the aggregated results can be downloaded. EHDS may foresee that data users can process data based on Union law and applicable data protection principles, provided that they comply with the security standards and data is processed in a secure environment. The proposed system will promote the processing of personal health data while maintaining strong legal and technical security safeguards to the rights of the data subjects as required by GDPR.

During the discussions with several Member States which have already set up such data access bodies, it appeared that they have encountered a high demand for such service and are currently facing long delays to satisfy all the requests.

Figure 4. Big picture of the secondary use of health and social data (source: Finland’s Ministry of Health).

The EHDS would build upon the horizontal framework on data access and reuse, including the proposal for a Data Governance Act (DGA) LXXXVII  adopted on 25 November 2020 (political agreement in November 2021) and the proposal for a Data Act LXXXVIII , to complement it and provide more specific rules for the health sector. These specific rules would cover standards and specifications for providers of data intermediation services in the health sector, minimum technical requirements for the portability of health data, criteria for security of data for bodies dealing with data altruism).

When providing a framework for data reuse in health, EHDS will build upon the DGA. As a horizontal framework, the DGA cannot address the specificities of sensitive data, such as health or genetic data. The DGA alone does not provide an adequate solution to the current uncoordinated patchwork of national laws arising from the fragmented implementation of the GDPR in the health domain. DGA does not provide a legal base for re-use of sensitive catagories of data, such as health data, whose processing is in principle prohibited, save exceptions listed in article 9(2) of GDPR (including an EU law providing the adequate safeguards). Furthermore, DGA does not impose any obligation to create “data access bodies” which could be empowered to grant access to health data. However, the technical framework set up under DGA (e.g. secure environments) could be used by the data access bodies under EHDS. As concerns data sharing intermediaries and data altruism organisations, the DGA provides for rules which apply regardless of the concerned sectors. However, specific rules are needed for example on security in order to take into account the specificities of personal health data, already outlined in section 1.1. In addition, the DGA regulates data sharing intermediaries mainly from a competition point of view (neutrality of marketplaces for data) and does not lay down rules mitigating specific risks of primary and secondary use of health data, including on technical formats for interoperability. For these reasons, with the EHDS, it should be possible to consolidate the requirements and technical framework needed to achieve a functioning system in the field of primary and secondary use of health data complementing the DGA rules with more detailed or more practical rules considering the specific nature of health data.

With regards to Data Act proposal, EHDS would build on provisions related to portability and access of data linked to devices (medical devices and wellness apps). The Data Act may set a general portability rule for data from such devices, irrespective whether health related or not. For health data, EHDS would extend to electronic health records and medical devices feeding data to EHRs. It would build upon the Data Act and establish the standards and specifications for portability and interoperability, thus making the portability and access technically and practically possible.

With regard to the use of data from entreprises (especially commercial data) by public sector bodies in exceptional circumstances, EHDS would build upon Data Act, by providing a secure framework for processing health data through data access bodies. At the same time, unlike the DA, EHDS would ensure that data held by both public and private healthcare providers can be made available through EHDS.

The aim of establishing the EHDS is also to aid all the parties involved in Artificial Intelligence (AI) in healthcare to carry out their tasks and fulfil their legal obligations under the proposal for a regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act (AIA)) LXXXIX . The AI Act provides the framework and rules that providers of some type of AI algorithms need to comply with. EHDS can support the providers with the provision of quality health data necessary for these algorithms to perform as intended and be compliant with AIA. Health data play a key role in the training, validation, testing and post-market monitoring of AI in healthcare. The training and use of AI algorithms in health needs to take place in a way that is ethical; discrimination and other adverse effects need to be avoided. The aim of establishing the EHDS is to also aid providers and users of AI as well as notified bodies and market surveillance authorities to carry out their tasks and effectively and efficiently fulfil their legal obligations under the AIA. The possibility to access diverse and a large amount of organized data within the EHDS infrastructure that provide transparency and information concerning the characteristics of these data would lead to the speedy development, upscale and uptake of trustworthy AI in healthcare. For instance, health data within the EHDS could share common standards and/or follow common rules and guidelines on issues like annotation, labelling, prevention of bias and avoidance of errors. Additionally, information might be provided on the characteristics of data within the EHDS infrastructure that would enable the developer of AI systems to use appropriate data to train, test and validate algorithms that reflect the geographical, behavioural or functional setting within which the AI system is intended to be used. In this regard, Health Data Access Bodies and/or national bodies might be involved to develop and oversee common rules.

The Directive on Security of Network and Information Systems (the NIS Directive, 2016/1148/EU) set the first EU-wide rules on cybersecurity. The objective of the Directive is to achieve a high common level of security of network and information systems within the EU and covers operators working in the healthcare sector. By promoting the use of compulsory common security standards and of the integration of electronic identification (eID) for healthcare professionals and patients, the EHDS initiative reinforce and complement the principles and security measures set out in the aforementioned cybersecurity regulatory framework. It is designed to enhance the security and trust in the technical framework designed to facilitate the exchange of health data both for primary and secondary use. The initiative would build on the new framework for eID, including the Digital eID Wallet. This would allow the online identification of patients. A pilot project has been launched in 2021 and aims to support the access of patients to their data, including in the context of MyHealth@EU.

The NIS Directive is being revised (NIS2 proposal XC ) and is currently undergoing negotiations with the co-legislators. It aims to raise the EU common level of ambition of the cybersecurity regulatory framework, through a wider scope, clearer rules and stronger supervision tools. The Commission proposal addresses these issues across three pillars: (1) Member State capabilities; (2) risk management; (3) cooperation and information exchange. Operators in the healthcare system remain under the scope. A proposal for a Cyber Resilience Act is also planned for adoption by the Commission in 2022, with the aim to set out horizontal cybersecurity requirements for digital products and ancillary services. The envisaged set of essential cybersecurity requirements to be laid down by the Cyber Resilience Act will be applied to all sectors and categories of digital products whose producers and vendors shall comply with, before placing the products on the market or, as applicable, when putting them into service and also through the entire product lifecycle. These requirements will be of general nature and technology neutral.

Although the horizontal initiatives affect some common issues that may be encountered in the health data sector, they often lack dedicated provisions addressing the specificities and peculiarities of the health data sector. The common provisions like those encountered in, for instance, the proposal for a Data Act, may in practice negatively impact on different sectors if no sectoral exclusions are allowed (e.g. an obligation for compensation in case of B2B data sharing could hamper the interoperability of medical devices and healthcare providers). If these proposals have provisions on health data, such as the GDPR, they do not always provide the necessary elements to translate these provisions into the expected operational practices or may only respond to some of the sectoral needs. For instance, access to health data is not immediate; the portability article excludes inferred data, such as tests or diagnoses, of data from some public healthcare providers; moreover, the portability right may be limited by the lack of interoperability between healthcare providers or cross-border.

1.3.21.3.2    Sectoral legislation

The current relevant applicable EU legal framework for the cross-border exchange of health data is laid down in the CBHC Directive. The EU supports and facilitates voluntary cooperation and the exchange of information among Member States working within a voluntary network connecting national authorities responsible for eHealth in the Member States (the ‘eHealth Network’), as well as other tasks related to patients access to data, telemedicine, interoperability of prescriptions. The EHDS proposal will repeal the relevant provisions of the CBHC Directive and replace the current article 14 (limited to governance) with completely new set of binding rules on data use and re-use. An evaluation of the key provisions related to digital health in the CBHC Directive (Article 14 and the articles related to patients’ access to their data, telemedicine, interoperability of prescriptions), as well as the national implementation of the European Electronic Health Record Exchange Format and the role of eHealth Network in this respect has been carried.

The current voluntary system to support patients’ access and sharing of health data, to deal with fragmentation and low interoperability of digital health at national and cross-border level has limited effectiveness XCI . The eHealth Network, with its voluntary structure and a decision making based on guidelines, has had a limited impact on supporting individual’s access to and control over their health data (including through the uptake and interoperability of digital health across the EU). The eHealth Network was very ineffective in supporting the re-use of health data for research and policy-making (also because its members often do not have tasks in this area at national level). On the other hand, during the COVID-19 crisis, the eHealth Network set up in a very short time two EU-wide interoperable infrastructures (the European Federation Gateway Services and the gateway for the EU Digital COVID Certificates), also supported in one case by a strong and harmonising legal basis (a regulation for EU Digital COVID Certificates XCII ). 

The medical device regulatory framework is composed of the medical devices Regulation (2017/745/EU) and the in vitro diagnostic medical devices Regulation (2017/746/EU). These regulations include provisions related to the assessment and marketing authorisation of medical devices in the Union. While the CE marking of medical devices comprise some elements related to security and interoperability of the device and its platform, it does not entail elements related to the interoperability of medical devices with electronic health records, which is a fundamental aspect for data portability. EHDS aims to tackle this, including by specific mandatory standards and specifications and a certification process for those devices that process data which is core for electronic health records.

Pharmaceutical regulatory framework The EU legal framework for human medicines sets standards to ensure a high level of public health protection and the quality, safety and efficacy of authorised medicines. Additionally, EU legislation provides for common rules for the conduct of clinical trials in the EU XCIII . Various rules have also been adopted to address the particularities of certain types of medicinal products and promote research in specific areas XCIV . The EHDS initiative complements the aims and scopes of the aforementioned Regulations and Directives by providing access to a wide range of health data that could be useful for regulatory purposes and enhance and streamline the collection of the necessary health data required to assess and supervise the introduction and surveillance of pharmaceutical products and devices in the Union. The set-up of the EHDS would be an integral part of building a European Health Union, a process launched by the adoption of a first set of proposals to reinforce preparedness and response during health crisis XCV , which pave the way for the participation of the European Medicines Agency (EMA) and the European Centre for Disease Prevention and Control (ECDC) in the future EHDS infrastructure, along with research institutes, public health bodies, and Health Data Access Bodies in the Member States. The EHDS infrastructure for secondary use of health data could also support the activities of European Health Emergency preparedness and Response Authority (HERA) XCVI  and “Europe’s Beating Cancer Plan” XCVII  and Horizon Europe EU Mission on Cancer.  XCVIII .

The EHDS proposal will ensure coherence with other sectoral regulatory frameworks. It will address the peculiarities and specific legal and securities issues related to the processing of health data both for primary and secondary use.

22    Problem definition

Figure 6 shows the link between the problems identified, their drivers and consequences. The evaluation of the existing framework under the CBHC Directive was used as a starting point for the identification of the problems and drivers.

Figure 5. Problem tree.

2.12.1    Lessons learnt from the evaluation of Article 14 of the Cross Border Health Care Directive (CBHC) Directive

The evalution of the Cross Border Healthcare Directive’s provisions related to eHealth concluded that due to the voluntary nature of the eHealth Network actions its effectiveness and efficiency has been rather limited.

Progress is slow on the use of health data for primary purpose in the context of cross-border healthcare with the MyHealth@EU platform being implemented only in 9 Member States and currently supporting two services only (ePrescriptions and Patient Summaries). The low and slow uptake is partly related to the fact that the Directive, whilst establishing the right of patients to receive a written record of the treatment carried out, does not require this medical record to be provided in electronic form. Patients’ access to their health data remains burdensome, citizens’ control over their own personal health data and the use of data for medical diagnosis and treatment is limited. While the eHealth Network recommended Member States to use the standards and specifications from Electronic Health Record Exchange Format in procurements, in order to build interoperability, their real uptake was limited, resulting in fragmented landscape and uneven access to and portability of health data.

Most Member States are expected to implement the MyHealth@EU platform by 2025. Only when more Member States will implement the MyHealth@EU platform and the developed tools, their use, development, and maintenance will become more efficient across the EU. However, advancements in eHealth in recent years call for a more coordinated action at EU level.

Nevertheless, following the outbreak of the COVID-19 pandemic in Europe, the eHealth Network proved to be very effective and efficient in times of public health crisis and political convergence following the COVID-19 pandemic outbreak.

On secondary use of health data, the eHealth Network activities were very limited and not very effective. The few non-binding documents on big data were not followed up by further specific actions and their implementation in practice remains very limited. At national level, other actors emerged on secondary use of health data than the ones represented in the eHealth Network. Some Member States set up different bodies to deal with the subject and participated in the Joint Action TEHDaS. However, neither the Joint Action TEHDaS, nor the numerous funds provided by the Commission under e.g. Horizon Europe to support the secondary use of health data have sufficiently been realized in coherence with eHN activities.

It can therefore be concluded that the current structure of the eHealth Network does not appear to be appropriate anymore, as it only allows for soft cooperation on primary use of data and interoperability, which did not solve in a systematic manner the problems of access and portability of data at national and cross-border level. Moreover, the eHealth Network is not able to address in particular the needs related to the secondary use of health data in an effective and efficient manner. The legal base for the use of health data for primary and secondary use is not sufficiently strong.

The COVID-19 pandemic has highlighted and emphasised the importance of access to and availability of public health and healthcare data beyond the Member States borders. However, progress on these issues seems to be hindered by the absence of binding or compulsory standards across the EU and consequently limited interoperability. Addressing this issue would not just benefit the patients, but also contribute to the achievement of the Digital Single Market and lowering the barriers to the free movement of digital healthcare products and services.

2.22.2    What are the problems?

As explained above, due to the voluntary measures, the current regulatory framework has shown a limited effectiveness in supporting patients’ control over their health data at national and cross-border level and very low effectiveness on secondary uses of health data. However, the COVID-19 crisis has revealed the need and the high potential for interoperability and harmonisation, building upon existing technical expertise at national level. The figure on Overview of problems in Annex 4 shows the key problems that were identified.

Individuals have difficulties to exercise their right to control their health data, including accessing and porting their data nationally and cross-borders, because of fragmented tools and infrastructures and limited interoperability between them. This hampers their access to health services and cause healthcare system ineffectiveness (reduced continuity of care) and inefficiencies (waste and administrative burden). It can result in medical errors, unnecessary repeated tests XCIX and substantial inefficiencies and costs for patients, healthcare professionals and healthcare systems C . 

The problem exists both at the EU, but also at the Member States level, despite the legal provisions of GDPR in this respect. The way the GDPR has been implemented is rather fragmented and made difficult the access and sharing of health data, as shown by the table below. As described in the section 1.3, data may not be available immediately and in electronic format and the portability right does not cover all the needs of the health sector (e.g. portability of images, laboratory results, which are not provided by the data subject, data processed on other legal basis than consent or contract or data from some public entities). The Annex 8 concerning the way the GDPR has been implemented in health sector shows the high legal fragmentation, which makes difficult to harmonise the framework both cross-border and between different healthcare providers at national level.

At the same time, without the technical elements aimed to ensure interoperability, these rights are not effectively implemented. A recent study on interoperability of EHRs CI shows that access to health information for citizens has been facilitated nationwide in seventeen EU/EEA countries, while six countries have ongoing pilot projects, three countries do not offer access to health data for patients, four countries offer mobile access, and two countries still use paper print-outs. In addition, citizens of 12 countries are not entitled to choose which healthcare professional or other party can access their EHR (often, general practitioners act as 'data gatekeepers', allowing additional parties to access a patient's EHR, while in other countries, this is not possible technically). The study also shows that 18 Member States allow the exchange of health data across borders and that almost half of the Member States have devolved powers in digital health to decentralised governments, often further exacerbating the current fragmentation and patchwork of incompatible health data exchange formats and networks. Three Member States do not have rules in place for the identification and authentication of healthcare professionals. Patient Summaries and ePresription exists in two-thirds of the Member States. When it comes to connecting healthcare providers to the national EHRs, general practitioners are largely connected in 20 Member States, pharmacies are connected in 19 Member States and labs are connected in 20 Member States. Several Member States score weak on the connection of different healthcare providers to the national EHR system.

With regards to cross-border data sharing, as part of the evaluation of the CBHC Directive, the volume of patient mobility was studied. The aggregated reported data on the number of requests for reimbursement shows that patient mobility under the Directive remains generally very low. When looking at the total expenditure on cross border healthcare, in those countries that were able to provide information about the amount reimbursed for healthcare subject and/or not subject to prior authorisation in 2019, the total healthcare spending amounted to EUR 882 billion. The share of the amount reimbursed under the Directive on the total government expenditure on healthcare amounted to 0.01% (EUR 92.1 million/EUR 882 billion). Cross-border healthcare in general remains very limited, and most of the healthcare spending occurs domestically. However, it should be noted that the demand for certain cross-border health services for which interoperability is highly relevant is growing rapidly. For example, the assessment of the cross-border prescriptions use case has provided indicative evidence of an estimated increase of approximately 300% for foreign prescriptions presented to pharmacists in the EU between 2012 and 2021 (from 1.46 foreign prescriptions per pharmacy per month in 2012 to 5.87 in 2021).

When travelling or moving to another EU country, few citizens can currently share their health data with foreign healthcare providers in a language understandable to the health professional, which can lead to wrong diagnosis or treatments and impact on free movement. The overall number of cross-border transactions so far remains low compared to potential demand: over 200 million Europeans have a European Health Insurance Card and 4% of employees are nationals of another Member State CII which could benefit from cross-border provision of healthcare. Patient summaries and e-prescription services exist in two-thirds of all Member States and are most frequently accessed via online portal, but only in few countries can have them be sent or received across borders and 11 countries are still using paper printouts for prescriptions CIII . Through MyHealth@EU CIV , 10 out of 27 Member States allow their patients to share their patient summaries and ePrescriptions with healthcare providers in other Member States, in the language of the country of destination. Since 2019 over 21,000 ePrescriptions have been dispensed and over 300 patient summaries have been accessed in other countries and other languages than the country of the origin of the patient. The number of ePrescriptions dispensed remains far from the target number of up to 8 million prescriptions issued in another Member State than the Member State where the patient tries to have them dispensed CV .

In an online stakeholder survey, a broad majority of consulted respondents (>80%) agree that lack of practical data portability driven by strong rules on interoperability drives healthcare costs up through repeated testing and examination, slows down time to diagnosis and treatment and increases the risk of errors CVI . Access and sharing of data are important for stakeholders, particularly the right to access one's health data in electronic format, including those stored by healthcare providers (88%), right to transmit one's health data in electronic format to another professional/entity of one's choice (84%), the right to request healthcare providers to transmit one's health data in one's electronic health record (83%), and the right to request public healthcare providers to share electronically one's health data with other healthcare providers/entities of one's choice (82%). 80% of EU citizens consider that a European framework on the access and exchange of personal health data should aim at facilitating the delivery of healthcare for citizens at national level and 84% abroad. 85% of EU citizens that participated in the public consultation believe that a European framework on the access and exchange of personal health data should aim at promoting citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format. More details concerning the opinion of different stakeholder group can be found in Annex 2.

Due to different standards and limited interoperability, manufacturers of digital health services and products face barriers and additional costs when entering the markets of other Member States, hampering their competitiveness. The digitalisation of health systems is limited and often the health IT solutions, whether they are health apps, medical device software, EHR systems or other health software, are not interoperable amongst each other, causing lock-in situations and inefficiencies in the provision of health and in the reuse of health data. The Commission has adopted the Recommendation on European Electronic Health Record Exchange Format (EEHRxF) CVII and the eHealth Network recommended CVIII  all the national and EU procurers to require EEHRxF standards and specifications to ensure national and cross-country interoperability. However, the implementation of these recommendations remains uneven is: four Member States do not have a fully functioning EHR system, six show an overall low level of use across all EHR data types, whilst only four have a very high level of use CIX . The voluntary recommendations on the EEHRxF have had little effect in promoting interoperability amongst health software solutions CX . Annex 10 provide an overview of the interoperability challenges and the opinions concerning the EEHRxF Recommendation.

The ePrescriptions, another information domain in the Recommendation also shows a mixed picture: in only half of EU Member States, the pharmacy sector in Europe is almost completely connected to national EHR systems and service-related data is being exchanged between pharmacies and EHRs. Five countries do not have an ePrescription system in place. At the same time, the limited use of ePrescriptions come with costs, as ePrescribing reduces medication errors. According to the Estonian Health Information Fund, 80,000 patients (6% of the total) could benefit from error reduction thanks to ePrescribing, while errors in prescription were down by 15% in Sweden CXI . ePrescribing systems can also provide useful data on patients’ adherence to prescribed medications CXII . When it comes to coding and structuring data, in most countries, the amount of clearly structured electronic health data is low and most of them do not maintain any programmes to train healthcare staff or to audit data quality CXIII . Moreover, only half of EU countries implement measures and perform mapping activities to international standards (including those in the EEHRxF Recommendation) to enable interoperability with digital health systems in other countries CXIV . Nine out of 27 Member States and Norway indicate to not refer to EU-level guidelines and documents on the patient summary and ePrescription/eDispensation in national policy documents and 19 do not refer to these resources in legislation documents. Although almost two thirds of EU countries have enacted compulsory technological standards, only half of national digital health authorities promote the use of the EU tools and building blocks of the MyHealth@EU CXV .

While the cooperation at EU level has focused mostly on interoperability of EHRs, some countries have started to implement legislative frameworks on assessment, reimbursement schemes, labelling and certification for the adoption of digital health, such as DiGA framework in Germany CXVI , the mHealth pyramid in Belgium CXVII , ANS eHealth label and HAS mHealth in France, or MAST CIMT in Denmark CXVIII (a more comprehensive overview is available in Annex 7). Some of these systems, such as DiGA take medical devices, analyse them from the perspective of interoperability with electronic health records and impact on health and propose them for prescription or reimbursement by healthcare providers. A similar system is being implemented by Belgium CXIX . France is also working on a law for a similar system. The United States also analyses the interoperability of medical devices with the hospital environment, but also with the electronic health records CXX . This analys is often done by digital health bodies (not notified bodies). However, this approach remains limited, and many Member States requested a mutual recognition of such products. The first technical specification on a quality label for health and wellness apps was published by ISO, CEN and IEC in 2021 CXXI . Although the volume of applications approved for prescription is currently very low, e.g. with only 24 mobile health applications approved for a population with statutory health insurance of over 70 million CXXII , as long as these approaches continue to be implemented without a common framework, there is an increasing risk of fragmentation within the EU. This adversely affects companies wishing to operate across the European digital single market, as their cross-border operations are hindered by differing digital structures, differing data formats and incompatible infrastructures. This is in line with the views of industry representatives who indicate that the European market is fragmented, with significant barriers for operation in more than one country CXXIII   CXXIV .

Individuals cannot benefit from innovative treatments and policy-makers cannot react effectively to health crises, due to barriers impeding researchers, innovators, policy-makers and regulators to access health data. The evaluation of the digital aspects of the CBHC Directive shows a very low effectiveness of the eHealth Network in dealing with secondary use of health data, while new entities (such as Health Data Access Bodies) have started to emerge in several Member States. Divergent rules and frameworks, prevent data holders from facilitating reuse of health data CXXV . The over-reliance on consent (which can be difficult CXXVI and costly to obtain) and a lack of specific Member State law has increased the costs for research. The wide variety of GDPR legal bases applied by different data holders in different Member States has made cross-country studies very difficult, as data re-users must comply with different requirements in each jurisdiction CXXVII   CXXVIII .

As indicated by experts consulted on pharmaceutical regulatory frameworks, currently, studies which inform regulatory decisions are often performed in a small set of databases clustered in a few EU Member States, limiting geographical and demographic representability. To overcome this fragmentation and the reliance on consent, some Member States started to adopt national law for processing health data for public interest, scientific research and policy making. For instance, 13 Member States have started to put forward more centralised national systems to provide access to data, but there is no link between them at EU level, the system remains fragmented and there ae differeencies between their tasks, even though they share many commonalities. Some Member States support access to data held by the original controller, others act as a Health Data Access Body. The best-known Health Data Access Bodies are Findata, French Data Hub, German Forschungsdatenzentren, Danish and Norwegian Health Data Access Bodies CXXIX (details about the state of play are available in Annex 9). 

During the public consultation, several barriers were identified by both the Member States and stakeholders, which include the divergencies in national legal frameworks and practices, which have repercussions on standards adopted and interoperability, as well the different national healthcare systems across Member States. Some Member States mentioned that one of the main issues was the sensitivity of the data which may make it difficult to transfer across countries on an individual level. This is aggravated by different data anonymization procedures across institutes and countries, as well as varying interpretations of GDPR. Other Memebr States stated that the different legal grounds for data sharing across Member States may require the researchers to travel across borders if the data must stay within a country. Furthermore, it was noted that data is currently not organized in one data centre base as various data sources are not linked in a structured way. Some decentralised countries underlined that most data collections for secondary use happen at the local level. Therefore, considerable collaboration between the public and private spheres would be needed. Several Member States underlined the need to ensure adequate financial resources. Moreover, interoperability issues could arise as some countries do not have plans to even introduce patient summaries. Some Member States also admit having difficulties with the legislation allowing for data sharing within the country, which would only be exacerbated at international level.

Table 1. Key characteristics of data governance bodies (‘centralised’ governance bodies) CXXX  (for some Member States information is missing, either as the country correspondent did not consider the body as a centralised body or the information was missing).

According to a report by Deloitte CXXXI , productivity of research and development in the biopharmaceutical sector has steadily decreased over the last decade, while the cost of bringing of a new product to market has significantly increased CXXXII . If this trend persists, the industry will see less and less incentives to invest in the risky and costly search for health innovations, limiting their future ability to provide innovative health products to tackle current and emerging health needs.

Similarly, the health data reuse ecosystem is characterised by fragmented infrastructures CXXXIII , structured around health-specific subdomains and limited interoperability. The lack of re-use of health data also poses problems for the work of regulators, which rely on Real World Evidence to check for the effectiveness of medicines. This can also stifle innovation and the development of new medicine, which in turn affects patients. Data quality issues play an important role as the data collected must fulfil certain uniform standards to be fit for purpose. The various degrees of data quality and availability across Member States and health subdomains also impacts on the ability to develop and evaluate AI algorithms, as health data that is comparable and representative of the EU’s population becomes difficult to obtain.

2.32.3    What are the problem drivers?

There are fragmented and limited tools for timely access to health data in electronic format and their digital transmission causing cumbersome problems for individuals to access and control their own health data, including in the cross-border setting. Not all the Member States have set up EHR systems and not all of them are interoperable between healthcare providers or with different data sources (e.g. mHealth, telehealth) CXXXIV   CXXXV . In a third of EU countries, digital health policy is not integrated into general healthcare policy CXXXVI . Divergent regulations at Member State level CXXXVII do not enable sustainable data-sharing amongst stakeholders and exercising portability of health data, both nationally and in the cross-border context. While the 'right to access one's health data in electronic format, including those stored by healthcare providers (public or private)' was deemed by 88% of the respondents in the public consulation as the most important right, evidence CXXXVIII shows that, while legislation in almost all (93%) Member States enables the electronic storage of health data, support for the access to and sharing of health related data is missing from legislation in almost one third of Member States. In 43% of Member States, legislation and national rules do not allow citizens to choose whom to provide access with to their health data. In 57% of Member States, less than half of Patient Summaries are consulted by a health professional in another medical institution. Imaging reports are predominantly exchanged non-electronically CXXXIX . At cross-border level, half of the EU population has a European Health Insurance Card and could potentially benefit from healthcare abroad, only 7 Member States (less than 10% of EU population) are able to share or consult patient summaries from another Member State through MyHealth@EU, and medical images are not exchanged yet. Preliminary results in the context of the evaluation of the CBHC Directive indicate that almost 8 million cross-border prescriptions are presented for dispensation per year in EU, with a non-dispensation rate CXL of 46% CXLI , which could generate up to EUR 240 million in unnecessary costs yearly CXLII .Verification and language issues and missing information are the key problem drivers for non-dispensation. These could be solved by the full rollout of cross-border services in MyHealth@EU CXLIII .

Limited legal and technical interoperability, including in relation to cybersecurity and data protection aspects, across Member States are barriers for providers of digital health services and products when entering the markets of other Member States. As shown above and in Annex 10, there is low and fragmented implementation of common standards and specifications at national and especially EU level. Many healthcare providers implement un-interoperable/locked in IT systems, which would require significant investment to be upgraded and contribute to perpetuate the lack of interoperability. Over the past 10 years, European cooperation has focused on data domains and interoperability of EHRs. However, with the deployment of other digital health technologies (such as wearable and mobile), Member States have started to develop separate national schemes to support uptake according to national needs, but without a common EU framework for assessing interoperability and cybersecurity, which are fundamental for the secure flow of health data in the single market. This is caused, at least partly, by the fact that by a lack of specific mandate of the EU and the eHealth Network in this area CXLIV . EIT Health analysed several use cases in digital health and concluded that a consolidated European assessment framework for digital health solutions could easy the route to market for small companies CXLV . The Data Act proposal will provide a general obligation to make data accesible and portable for the user of product or related services. But it is limited to tangible item and may not cover purely software or service-based health systems, such as electronic health records. Moreover, it will not impose specific standards and specifications that EHDS would come forward for the health sector.

Fragmented and divergent legal and administrative rules, frameworks, processes, standards and infrastructures for health data reuse restrict the access of researchers and innovators to health data, limiting the availability for individuals of innovative health products and services based on health data use and reuse, and reduce the access of policy-makers and regulators to health data for their tasks and to react to health crises, hampering optimal decision-making and particularly effective crisis management. 89% of respondents to the public consultation from all stakeholder groups completely agree that the European framework on access and exchange of personal health data should support and accelerate health research. Annex 10 shows the current fragmentation, at Member State level, of the legal basis available to researchers for the reuse of health data initially collected for healthcare purposes. Almost half of the Member States do not have any specific legislation for such reuse and rely on the provisions of the GDPR. Other Member States provide a legal basis based on public interest outside the traditional requirement of consent and rely on an independent public body for this (i.e. a Health Data Access Body CXLVI ). Not all the Member States have a Data Access Body, but where such a body exists, the demand is very high (the Finnish Health Data Access Body, Findata, has an average queueing time for data permits of around 7-9 months CXLVII , while the Danish counterpart has an average processing time of over 100 working days). There is also a need for cross-country cooperation between existing data access bodies. Data quality issues, such as lack of accurate metadata, divergent data collection procedures or unstructured data, pose a key challenge for extensive data-sharing, use and reuse in health. Most health data is unstructured CXLVIII , often fragmented, which becomes a barrier for the use and reuse of health data due to low technical and semantic interoperability CXLIX CL CLI . These challenges have become even more apparent during the COVID-19 pandemic, as researchers, innovators and policy-makers have struggled to gain access to comparable health datasets in a timely manner CLII .

2.42.4    How will the problem evolve?

Several problems will persist if no EU action is taken. The cross-border exchange of health data will remain limited, the expansion of MyHealth@EU will progress at a slow pace on a voluntary basis only and the barriers to a single digital health market will equally persist. With a slower uptake of digital health, patients will continue to experience disruption to continuity of care and healthcare providers will continue to struggle with accessing medical information timely in the provision of care, causing inefficiencies and ineffective healthcare and avoidable medical errors. Health software providers and researchers too will struggle to provide services that serve the interests of people and healthcare providers. Health software solutions will not sufficiently take into account the needs and preferences of end users, which will impede uptake from and value for the latter. Given the lack of adequate incentives for interoperability and health data exchanges, the digital health market will continue to cope with vendor lock-in situations, as there will be no common interoperability requirements facilitating provider changes and market entry. Such a situation will favour incumbents and prevent a level playing field. If the single digital health market is insufficiently supported, the uptake of digital health innovations will be slower and more expensive. Producers of digital health services will not market their products in other Member States or will incur additional costs stemming from the adaptation to the national standards. Policy makers will have insufficient access to evidence to support their regulatory activities. Citizens will continue to have limited digital access to and control over their health data in digital format, which will limit their empowerment and may weaken their trust in health technology. The limited reuse of health data for research, innovation, policy-making and regulatory purposes would hamper the introduction of more efficient and effective healthcare and public health policy.

With insufficient action taken, there will be untapped potential of digital health services and products for people and healthcare systems. Potential benefits for patients, through greater availability of health innovations, would not materialise. For example, telemonitoring can facilitate access to healthcare in medical deserts CLIII , and AI-based medical decision support systems can facilitate diagnosis and treatment, but both require extensive research and development based on health data and proper interoperability with healthcare IT systems. Lack of trust of the public in health technology tools would frustrate the potential benefits for health. In the case of a new pandemic, Europe will continue to struggle to provide data for policy making, regulatory purposes and support scientific research, statistics and innovation for the general interest.

33    Why should the EU act? 

3.13.1    Legal basis

The possible legal bases for the proposed initiative are Articles 16 (personal data protection) and 114 (internal market) of the Treaty on the Functioning of the European Union (TFEU).

The initiative will build on the possibilities offered by articles 9(2)(h), 9(2)(i) and 9(2)(j) of GDPR to use the data for healthcare and re-use it for public interest and for scientific research. Therefore, the initiative has two purposes: to further strengthen the rights of individuals in relation to control of their personal health data, building upon the rights already provided by the GDPR; to promote the exchange of health data for healthcare provision, to facilitating access to health and relevant social data for further processing for research, innovation, policy-making and regulatory decision. Health data are particularly sensitive data and their treatment is already strictly regulated by GDPR, which stipulated that national or EU law making use of e.g. Articles 9(2)(i) and 9(2)(j) must lay down suitable and specific safeguards The GDPR provides important safeguards in relation to rights of individuals over their health data (even though some additional requirements are needed for health sector CLIV ). However, as outlined in section 1, in practice, in the field of health data, limited harmonisation of requirements and technical standards implemented at national and EU level do not allow to implement these provisions in practice for every individual. Therefore, there is a need to introduce additional legally binding provisions and safeguards, as well as design specific requirements and standards in order to fully implement the rights provided in the GDPR in the field of the processing of health data and take advantage of the value of health data for the public interest. Hence, to the extent that Article 16 TFEU prescribes the purposes of both the protection of personal data and the free movement of such data, it is deduced that Article 16 TFEU is a relevant legal basis for the proposed initiative.

Digitalisation and data are transforming the way of healthcare is provided, in many cases offering an alternative to traditional physical interactions, which has a particularly beneficial impact for remote and rural areas. However, the growing diversity of national laws, regulations and administrative actions lead to obstacles to the free movement of data, which has a substantial impact on the free movement of digital technologies in healthcare that contact such data (including AI systems), the free movement of persons, as well as creating distortions to competition. Some Member States, for example, have already developed often different national or regional rules for the standards related to development and recognition of new digital health services and products, but others have not. This will likely lead to a further fragmentation of the internal market, as providers of these digital health products and services will need to adapt to these different rules when marketing and competing on digital health products and services.

The obstacles to free movement and distortions of competition have a detrimental impact on the functioning of the internal market. EU action on the basis of Article 114 of the TFEU can be taken for the purposes of the approximation of the provisions laid down by law, regulations or administrative actions in the Member States when it has as its object the establishment and functioning of the internal market. The measures assessed in this impact assessment for creation of an EHDS aim to improve the conditions for the establishment and functioning of the internal market for digital health and data and actually contribute to eliminating the obstacles to the free movement of healthcare goods and services.While a smoother flow of health data could eventually contribute to the protection of human health (through better, more efficient and targeted healthcare, more powered research and better tailored public health policies), the main drivers of this initiative are the free movement and protection of (non-)personal data and the internal market, which will reflect the selection of legal basis for the legal proposal. The EHDS is a tool aimed to improve access to quality health data for both primary and secondary use. It will be the task of data users to implement uses that could improve the health outcome of data subjects. Thus, Article 168 was not selected as a potential legal basis since the effect of such a tool on health outcomes is a secondary effect of the main aims of the initiative. Moreover, Article 168 of the TFEU provides for a more limited scope for Union intervention, which would not allow to tackle the problems that have been identified in the problem definition, such as supporting control of patients over their health data by improving interoperability, allowing the digital health products and services to circulate freely within the EU and re-using health data.

3.23.2    Subsidiarity and Proportionality

Even though the GDPR provides some extensive rights concerning individuals’ access to and transmission of their health data, their practical implementation is limited by low interoperability, which has been addressed so far mainly through soft law instruments. Such difference in national standards and specifications can also prevent producers of digital health services and products to enter new markets, where they need to adapt to new standards. Evidence from the public consultation shows, there is support for being able to transmit data from mHealth into the EHR systems (77%) and for the introduction of a certification scheme to assess interoperability of digital health products and services (52%). As the evaluation of Article 14 of the CBHC Directive shows, the approaches taken so far, consisting of low intensity/soft instruments, such as guidelines and recommendations aimed to support interoperability, have not produced the desired results. Moreover, national approaches in addressing the problems have only limited scope and do not fully address the EU-wide issue.

A true internal market of digital health products and services is promoted when people can take their health data with them and when health data can be accessed cross-border, while respecting data protection rules and a high level of security. The COVID-19 pandemic and EU Digital COVID Certificates shows that a strong legal basis and a common EU approach to use of health data for specific purposes, as well as EU efforts to ensure legal, semantic and technical interoperability, can significantly support the free movement of people and can transform the EU into a global standard setter. Therefore, EU-wide action in the content and form indicated is required to promote cross-border flow of health data and such action does not exceed what is necessary to achieve the Treaty objectives.

The extensive use of facultative specification clauses under the GDPR at national level CLV created fragmentation and difficulties for accessing data, both at national level and between Member States, impacting on the possibility of researchers, policy makers and regulators to carry out their tasks or to do research or innovation, with negative effects on the European economy. Moreover, Member States’ health datasets often lack the diversity or size required to detect weak health pattern or to being suitable for machine learning. Accessing EU-wide health datasets is a necessity, for actors in this domain can develop more accurate and inclusive AI-based devices solutions and AI algorithms.

The current situation of fragmentation, differences and barriers to access and use health data, shows that action by Member States alone is not sufficient and may hamper the rapid development and deployment of digital health products and services and of AI. Moreover, GDPR foresees the possibility of an EU law as the legal basis for processing health data for research, innovation, policy making, regulatory purposes and statistics. As analysed in section 6, concerted actions by all Member States will reduce the economic and administrative burden to access health data, supporting single market. The detailed analysis on the proposal’s financial impacts indicates that action at EU level complies with both the principle of subsidiarity and proportionality. Furthermore, the analysis on the impacts of different policy options, including economic, social and environmental, international impacts as well as impacts on fundamental rights, single market, competitiveness and SMEs show in both qualitative and quantitative terms that the Union objectives in question can be better achieved at Union level. Additionally, the detailed analysis of the different possible options in pursuing the Union objectives indicate the content and form of Union action that does not exceed what is necessary to achieve the objectives of the Treaties.

44    Objectives: What is to be achieved?

4.14.1    General objective 

The general objective of the intervention is to establish a genuine single market for digital health and to ensure that individuals have access to and control over their own health data, can benefit from a wealth of innovative health products and services based on health data use and reuse, and that researchers, innovators, policy-makers and regulators can make the most of the available health data for their work, while preserving trust and security.

4.24.2    Specific objectives 

4.2.14.2.1    Empower citizens through increased control of their personal health data and support their free movement by ensuring that health data follows them (SO1)

The EHDS would aim at empowering citizens through increased digital control of their personal health data and support their free movement by ensuring that health data follows them. The Public Consultation findings show that there is wide support for EHDS to promote citizens’ control over their own health data, with 85% of EU citizens, 83% of public authorities and 94% of industry supporting this objective. With measures strengthening the control of individuals over their own health data, the EHDS would allow health data to be used when and where individuals need it, regardless of the data source (e.g. EHR systems, medical devices, or wellness applications) or type of data controller (public or private), promoting continuity of care and patient safety. This empowerment of individuals will also help build confidence of society in the use and reuse of health data. The availability of the necessary health data when receiving health services, combined with a faster digitalisation in healthcare, would contribute to mitigate some of the inefficiencies in the health sector.

4.2.24.2.2    Unleash the data economy by fostering a genuine single market for digital health services and products (SO2)

The EHDS would aim at unleashing the data economy by fostering a genuine single market for digital health services and products. It will tackle issues related to interoperability, security and other related aspects in the exchange, use and reuse of health data for the provision of healthcare, research and innovation, policy-making and regulatory activities. The Public Consultation findings show that there is wide support for the EU to establish interoperability standards for secondary use of health data, with 88% support from public authorities and 91% support from industry. By addressing interoperability discrepancies within the single market, the EHDS would reduce obstacles to the free movement of goods and services, as well as distortions of competition within internal market, thus increasing efficiencies, the societal and economic welfare of individuals, manufacturers and healthcare providers.

4.2.34.2.3    Ensure a consistent and efficient framework for the reuse of individuals’ health data for research, innovation, policy-making and regulatory activities (SO3)

The EHDS would aim at ensuring a consistent and efficient framework for the reuse of health data in the EU, particularly regarding the handling of health data requests, access procedures and secure infrastructures, and common governance mechanisms. The Public Consultation findings show that there is great support for EU coordination to bring together national bodies on secondary use of health data on a range of issues, with 59% support from public authorities, 73% from EU citizens and 75% from industry. Reuse, or cases for secondary uses of health (including electronic health records, registries and networks of registries, genetic data etc.) and social data (including claims registries and other relevant information), on the basis of public/general interest are defined broadly as falling under four five categories, both for public or private entities: covering research, innovation, policy-making and regulatory activities and personalised medicine. This should enable trustful reuse of health and relevant social data for the public good, producing value for society, under strict control and safeguards to ensure respect for high standards of data protection and security and privacy, regardless the nature of the reuser (public or private entity). It would also impact on the data quality, as well as on the capacity of producing more effective policies and more research and innovation, by making data cheaper. Such a change would be possible by progressively shifting from a situation where data is obtained almost exclusively based on consent, which is very costly or not feasible in case of big cohorts to a situation where access to data can be done against a fee, which may often be cheaper (for more details, see the economic analysis of options 2 and 3 on secondary use of data and Annex 5 on methodological approach). The high demand towards the existing data access bodies reveals this situation.

4.34.3    Objectives tree/intervention logic

Figure 6. Intervention Logic.

Figure 6 shows the intervention logic based on the presented general and specific objectives, problem drivers and problems. 

55    What are the available policy options?

Three policy options, with increasing degrees of intensity, are presented in Table 2 and 3. The policy options build upon horizontal and sectorial existing and planned legislative frameworks, particularly on the Data Governance Act (DGA), Data Act and the GDPR, as explained in the Introduction and Annex 6. All three options benefit from a horizontal set of safety and security measures to ensure individuals trustworthiness on the European Health Data Space. These measures include:

Primary use of health data: health data is collected, stored, and in many cases also exchanged already now. The exchange is done through point-to-point encrypted connections, or in some Member States through national systems. The goal is to enable more Europeans to benefit from the availability of their data for a seamless diagnostic and treatment, also building on the Data Act. Under options 2 and 3, information blocking by healthcare providers and digital health services would be prohibited. Minimum requirements for data security will be defined and digital health products would show compliance with these requirements. Cross-border exchange of health data in MyHealth@EU is performed through National Contact Points for eHealth that have undergone audits/compliance checks. The audits include criteria related to information security, but also data protection, including Data Protection Impact Assessment. Similar mechanisms are envisaged for the infrastructure on secondary use of health data. With regards to data being shared with third country healthcare professionals, this may be done by the patient on a smart device. Online sharing/access of health data between systems is politically very sensitive and requires careful assessment from data protection and security perspective, as third countries need to meet the EU criteria.

Table 2. Overview for primary uses of health data (covering mainly SO1 and SO2).

Table 3. Overview for secondary use of health data (covering mainly SO2 and SO3).

Secondary use of health data: Jointly with the DGA, the EHDS would establish requirements and supervision duties, to ensure the secure and privacy preserving re-use of health data through a combination of measures. The legislative proposal will:

·Establish legal safeguards as specific data categories, suitable purposes and general conditions for the reuse of health data;

·Establish rules concerning data minimisation, pseudonymisation, ethical requirements;

·Require the use of secure processing environments when processing (reuse) sensitive personal health data, with security gates at entry (e.g. reliable identification, authentication and authorisation of users, belonging organisation and background); and security gates at exit (e.g. data export, to ensure that no re-identifiable data is exported. The pseudonymised data should be processed in the secure environment);

All three policy options are also framed according to the limitations of health data transfers and access to/from third countries as in the DGA. Third country stakeholders may access data via data access bodies, although a mechanism for identifying the requesters is needed. However, given the sensitivity of health data, the Commission could be empowered to adopt delegated acts in order to set specific conditions applicable for transfers to third-countries for certain non-personal health data categories, as per the DGA. For personal health data, the controller would need to take all reasonable technical, legal and organisational measures in order to prevent transfers or access to personal data held in the EU where appropriate safeguards for the use of data are not provided, and such transfer or access would create a conflict with EU law or the law of the relevant Member State. Specific standards and specifications could be set out for the security of the clouds/infrastructures where health data is being stored. Member States could use article 9(4) of GDPR for imposing more stringent conditions/restrictions.

The policy options build upon horizontal and sectorial existing and planned legislative frameworks, particularly on the Data Governance Act (DGA), Data Act and the GDPR, as explained in the Introduction and Annex 6.

All three options benefit from a horizontal set of safety and security measures to ensure individuals trustworthiness on the European Health Data Space. These measures include:

5.15.1    What is the baseline from which options are assessed? 

The baseline is a “no policy change” scenario. Member States would continue implementing Article 14 of the CBHC Directive, supported by the eHealth Network. The baseline also takes into account the creation of common European data spaces, through the horizontal legislative framework DGA, without specific health provisions. It would also include the impact of the Data Act upon its approval which provides for limited requirements (mostly for emergency health threat) of the access/sharing of health data generated by use of smart, connected products and related services.

For the exchange of patient data for health care (primary use) this would mean that the data exchange would continue between healthcare professionals pursuant to CBHC Directive, for specific use cases and on a voluntary basis (via MyHealth@EU infrastructure). The work of the eHealth Network would continue to focus mainly EHR-relevant data domains. Individuals would continue to exercise their rights in relation to their health data granted in the GDPR, meaning the right to access their own data under Article 15 GDPR and data portability under Article 20 GDPR, where it applies. However, due to the limitations due to the fragmented implementation of Article 20 of the GDPR, they would not be able to obtain all health data related to them (including medical examination results), from all data sources (as some of them may process the data on legal bases regarding which the GDPR portability right does not apply), in a digital interoperable format. The lack of a requirement of a digital interoperable format would continue to make it difficult for citizens and healthcare providers to share data digitally with another organisation, perpetuating healthcare system inefficiencies. The COVID pandemic showed even stronger the problems related to lack of interoperability and access to health data. For instance, in order to deal with the COVID-19 patients moved between healthcare providers, the Commission modified the Clinical Patient Management System (CPMS) to allow for upload and download of the data. Meanwhile, the COVID-19 crisis also accelerated the progress in digitalisation at national level and common work at EU level (e.g. EU-Digital COVID Certificates, contact tracing apps, etc.).

Under the baseline scenario, the rules for the provision of digital health services and products, including telemedicine, would remain fragmented. Whilst important investments in digital health are foreseen under the Recovery and Resilience Facility (RRF) and European Regional Development Fund (ERDF) (around 13 billion), the standards and specifications will remain fragmented and the interoperability between countries and at national level will remain limited. The lack of interoperability would hamper the free flow of health data across the EU.

For the access to and exchange of health data for research, innovation, public health, policy-making, statistics, regulatory activities and other uses like personalised medicine (secondary use), access to data would be based on consent of the data subject, which remains expensive or Member States would continue to develop their own national policies and legislation; however, they would do so in an uncoordinated manner, as this is an area that is not properly covered by the CBHC Directive. Member States actions would be guided and framed to a certain extent by the proposal for Data Governance Act. Thematic or disease specific infrastructures would continue to be developed in an uncoordinated and non-interoperable manner undermining the possibility of big data analytics. The COVID-19 pandemic also showed the difficulties to obtain quickly reliable and comparable data on healthcare for public health and healthcare. However, COVID-19 pandemic accelerated scientific research efforts in the fight against the SARS-CoV-2 in order to produce research results as fast as possible.

The economic benefit of the baseline includes potential savings for patients due to higher uptake of telemedicine (EUR 2,478 billion), potential savings for healthcare providers due to more efficient and effective health care services and contributions to the digital health single market, and the contribution of health data sharing to R&D and data-driven innovation in health research (EUR 1.5 billion in 10 years).

5.25.2    Description of the policy options

Policy Option 1 consists of soft-law measures, supporting coordination and voluntary mechanisms (e.g. guidance) among Member States, and expands the work on interoperability of data domains in the Commission Recommendation on a European Electronic Health Record exchange format (EEHRxF) CLVII  from the baseline to cover other relevant data domains in digital health (e.g. mobile health) and extends the scope to secondary uses of health data.

Policy Option 2 (and 2+) is a medium intensity legislative intervention, moving from the purely voluntary scheme of Option 1 to a regulatory framework that establishes a system of joint decision-making at European level on requirements on interoperability, security and other related aspects on Member States and market operators in the Single Market, supported by national implementation. It strengthens the rights of citizens to access and control their health data and an EU framework for re-use of health data. The governance relies on national bodies brought at EU level in expert groups that would implement and enforce nationally EU-level mandatory requirements.

Policy Option 3 (and 3+) consists of a high intensity legislative intervention, whereby an EU body, together with competent national authorities, is tasked with the implementation and enforcement of requirements on interoperability and cybersecurity. It also goes beyond Option 2 by designating a body at EU level as a European Health Data Access Body (EHDAB) for the reuse of health data held by EU bodies and for the coordination of multi-country data access requests. Here, option 3 foresees the re-use of an existing body or setting up of a new one (option 3+).

5.2.15.2.1    Primary use

5.2.1.15.2.1.1    Individuals’ and health professionals’ access and control over health data

Under Policy Option 1, the strengthened eHealth Network would issue guidance on implementing the right of citizens to access and transmit their health data and enable access to it. This will include standards and specifications.

Under Policy Option 2, the right of citizens to control their health data in electronic format, irrespective of data holder (public or private), type of data concerned, and data source (e.g. EHR systems, mHealth, telehealth, personal health data spaces or other health software solutions), will be strengthened. This would mean the rights under GDPR, such as access to data, CLVIII and portability of data CLIX  between different data sources under the GDPR. The right of access would entail immediate electronic access and the portability would entail also inferred data (images, test, diagnosis), irrespective of the GDPR legal basis for processing. In order to minimise the impact on people with low digital skills, access to health data should also be provided on smart phones CLX and individuals could also request access to data in paper format. Healthcare providers and manufacturers of digital health products would be obliged to share health data with user-selected third parties from the health/social sector or with other authorities, upon user’s request and could be fined if they would not comply. This would be based on the ground of EU law as provided by Article 9(2)(h) of the GDPR (processing is necessary for purposes such as medical diagnosis, provision of health, treatment or social care services). Applicable mandatory interoperability standards and specifications necessary to implement individuals’ rights (especially access and portability) would be defined through implementing/delegated acts, with the support of the Expert Group on Digital Health. The Public Consultation findings show large support for this Policy Option, with 85% support from EU citizens, 94% support from industry and 83% support from public authorities.

Under Policy Option 3, the same rights would be established. As in Policy Option 2, there would no distinction between public and private actors when sharing of data between healthcare providers. Neither private healthcare providers nor manufacturers would be allowed to block or restrict the individuals’ rights to access and control their health-related data.

5.2.1.25.2.1.2    Scope of data

Under Policy Option 1, the scope of data covered by the European framework for primary use of health data would continue to cover interoperability of data domains in the European electronic health record exchange format (EEHRxF) (that is, patient summaries, ePrescriptions/eDispensations, laboratory reports, medical images and reports and hospital discharge reports), as in the baseline, but it would be extended to cover other data domains in the area of digital health, such as the domain of data streams generated by wearable health devices, mobile health applications or personal health data storages/data intermediation services.

Under Policy Option 2 and Policy Option 3, the scope of data domains would also be extended to other digital health areas beyond the data domains under the EEHRxF, but aspects related to security and other quality aspects would also be covered, beyond interoperability, in relation to the flows generated by these data domains. These policy options would foresee the introduction of additional data domains through delegated acts once the standardisation work has advanced. Such data domains could include rare disease data for which work has been carried out concerning minimum datasets (for example, in the context of the European Reference Networks), genomic data and data streams from medical devices and mobile health applications or other types of data, to be defined in delegated acts.

5.2.1.35.2.1.3    Quality and interoperability requirements

Under Policy Option 1, non-compulsory guidelines by the eHealth Network and soft-law mechanisms are the main policy tool to advance in the removal of barriers hampering the free movement of digital health services and products. These guidelines would codify a common EU assessment framework under the strengthened eHealth Network. The scope of Commission Recommendation on a European Electronic Health Record exchange format (EEHRxF) CLXI would be broadened to cover interoperability between EHRs, providers of data intermediation services providing electronic health records (as defined in the DGA) and other software in health, such as medical devices feeding data into electronic health records. The developments should use, as much as possible, international standards. A voluntary quality label would aim at assisting procurers of software and digital infrastructure in health with their purchase decisions through clear information on the level of interoperability, cybersecurity and other key quality aspects, taking into account and building upon the existing framework (MDR, AIA, cybersecurity). For mobile health products that are not medical devices or are not covered by the AI Act, such as wellness applications, a common EU assessment framework would be developed by the eHealth Network, building on existing international standards CLXII and another voluntary label would be developed to provide transparency to the users.

Under Policy Option 2, the guidelines would be replaced by common EU minimum mandatory requirements for the digital products mentioned above (e.g. EHR systems, data intermediation services providing electronic health records, and medical devices that can provide data into the electronic health records) that would become binding through implementing acts by the Commission, and would be prepared with the support of the Expert Group on Digital Health in consultation with relevant bodies (Expert Group on Health Data Reuse, competent bodies dealing with cybersecurity, etc.), building on existing international standards and taking into account and building upon existing tasks and legislation (MDR, AIA, etc.). When the requirements touch upon medical devices, cooperation with Medical Device Coordination Group may be envisaged. Mandatory requirements through a certification scheme granted by third parties was supported by 52% of respondents to the Public Consultation, with most support coming from EU citizens (61%) and less support from public authorities (47%) and industry (39%). For wellness apps not classified as medical devices, the standards and specifications would be recommended. Such minimum requirements could include an obligation for market operators of such products to implement interoperability requirements and specific standards and specifications (e.g. specific Application Programming Interfaces (APIs)), building upon the domains of the EEHRxF for interoperability with the digital health ecosystem, but also covering other data domains. The requirements, adopted through implementing/delegated acts, may cover additional quality aspects, including (cyber) security, technical criteria for processing sensitive personal data or data protection. The mandatory requirements may be complemented by guidance and/or codes of conduct.

Compliance with these requirements would be monitored and enforced by national digital health authorities or notified bodies (in the case of medical devices) through a mandatory label, and would be complemented by an obligation of technology providers to share health data with user-selected third parties from the health sector upon user request. Under this option, although they would remain self-declared andvoluntary for wellness apps, the quality labels would become mandatory for digital products services and products such as EHR systems, data intermediation services providing electronic health records or medical devices feeding health information domains in the electronic health records, to ensure comparability of digital health products and services across the European digital single market.

For post-market surveillance, the enforcement would be done by national digital health authorities /market surveillance authorities through ex post measures, such as fines.

Rules on conditionality of public funding on the respect of EU level standards and specifications would be introduced whenever possible, as well as conditions for using the standards in procurements. Cross-border provision and reimbursement of such services would be done in accordance with rules on social security coordination and cross-border healthcare directive. These labels would be supported by a European database of certified/labelled products that would allow for verification by consumers, procurers and other stakeholders.

Under Policy Option 2+, most elements would remain like in option 2 (including mandatory requirements for EHRs, data intermediation services providing electronic health records and medical devices that feed health information domains into EHRs and medical devices and voluntary recommended standads for wellness apps), but the mandatory label for EHR systems based on a self-declaration would be replaced by a third-party certification. For medical devices having information feeding into EHR and where the manufacturers claim interoperability with EHR systems, this would in principle be part of the performance assessment carried out by notified bodies under MDR. It may entail the cooperation with national digital health authorities to support notified bodies to check the compliance with these requirements before the device is put on the market. This is relevant to medical devices, whose components store/transfer/process data in EHR systems (images, laboratory results, structured patient data, for instance related to patient summaries, ePrescriptions, discharge reports). Other devices including other types of datasets may be added later, once the technical requirements are finalised. For wellness applications, no changes would be introduced. An EU database to record the certified and labelled products and ensure transparency would be set up. Under Policy Option 3, the measures to strengthen the digital single market in health would become more stringent. The quality labels would be replaced by third party certification schemes and would also cover certain wellness applications besides EHR systems and digital health products that are medical devices and feed information in electronic health records. The criteria for wellness applications within the scope of third-party certification would be further clarified in implementing/delegated acts (e.g. applications that, even though not pursuing a medical use, process personal data that is relevant for disease prevention or monitoring).

Overall, respondents in the public consultation believed either an authorisation scheme managed by national bodies (a mandatory prior approval by a national authority) or a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level) would be appropriate (respectively 39% and 37%). The option of using a voluntary labelling scheme was the least popular (10%). There were some differences across stakeholder types. For instance, business associations were the most likely type of stakeholders to believe standards and technical requirements should be made applicable through a labelling scheme (34%, compared with only 1% of NGOs for instance), and the least likely to believe they should be made applicable by authorisation scheme (14% only, compared with 42% of NGOs and 47% of public authorities for instance).

5.2.1.45.2.1.4    Cross-border health data sharing

Under Policy Option 1, MyHealth@EU would remain a voluntary infrastructure, which is expanded to new services (laboratory results, medical images, discharge letters) and provides services enabling citizens to access their translated patient data. The identification of patients and health professionals would be based on the European Digital Identity Framework. In order to provide more specific instructions on its application in healthcare, the strengthened eHealth Network will develop voluntary guidelines for the use of eID by patients at points of care or in pharmacies, and for the identification of health professionals. In addition, it would provide guidelines on the interoperability of healthcare professionals’ registries.

Under Policy Option 2, MyHealth@EU becomes a mandatory infrastructure to cover all Member States, which would need to implement basic cross-border digital health services, covering the data sets as per above. It would also be expanded to provide access for citizens to data in the language of the country of destination and other services in relation to telehealth, mHealth, vaccination card etc. The target would be that MyHealth@EU could cover all accredited healthcare providers. The Public Consultation shows varying support for an EU infrastructure, with 71% support from EU citizens, 67% from industry and 43% from public authorities. The architecture for the implementation of specific services would be set out in implementing acts. Additional services, including advanced cross-border digital health services, or ways of implementing data access and sharing at national and cross-border level may be developed through implementing and delegated acts.

The identification of patients and health professionals would also be based on the European Digital Identity Framework. The Expert Group for Digital Health would contribute to the development of additional requirements and a minimum level of security for the electronic identification of health professionals. Additional compulsory requirements to accept eID for patient identification in points of care would be developed, building on the European Digital Identity Framework. There could also be voluntary cross-border digital services enabling the interoperability and mutual recognition of health professionals’ registries.

Under Policy Option 3, the same applies as under Policy Option 2, but would be complemented with a mandatory cross-border digital service ensuring the interoperability and mutual recognition of health professionals’ registries.

5.2.1.55.2.1.5    National governance and EU cooperation

Under Policy Option 1, Member States would be required to designate national digital health authorities. These bodies would convene at EU level in a compulsory eHealth Network, to which membership would be mandatory for all Member States. The Network will continue to issue guidelines and decision-making processes remain at national level. Collaboration with stakeholders, particularly health care professionals, would be sought as relevant, to strengthen co-creation of solutions.

Under Policy Option 2, at national level, Member States would be required to designate a national digital health authorities, supporting the implementation of the tasks below (individuals’ access to health data and sharing/providing access to the data to healthcare providers of their choice; implementation of standards, specifications and labels). Currently, such authorities exist in all the Member States and have tasks related to digitalisation, legislation on interoperability and standards etc. CLXIII Collaboration with Data Protection Authorities should be sought, to ensure treatment of non implementation of rights of individuals. Also, collaboration with notified bodies, cybersecurity authorities is necessary, especially for labels/certification. At EU level, these bodies would be brought into an expert group - the Expert Group on Digital Health, consisting of experts from national digital health authorities, which could be part of a wider governance body that would include secondary use of health data. The expert group (and its subgroups) would contribute to preparing the technical standards and specifications that would be adopted as implementing and delegated acts through comitology procedures. These standards and specifications would be implemented nationally by the digital health authorities, including through labels/certification. Additional services and ways of implementing data access and sharing at national and cross-border level (including through infrastructures, apps etc.) may be developed through implementing and delegated acts. The Expert Group on Digital Health would collaborate with the Expert Group on Health Data Reuse (5.2.1.3). Similar involvement of stakeholders as for Policy Option 1.

Under Policy Option 3, an EU body (European Digital Health Body) would be tasked with the implementation/enforcement of EU-wide requirements. Such body could be an existing one or a new one. The representatives of national digital health authorities would be brought at EU level for the supervision of such EU body. The European Digital Health Body would be in charge of the implementation of measures to ensure the fulfilment of requirements on interoperability and cybersecurity.

In all options, governance mechanisms for primary and secondary uses would collaborate closely on issues relating to data use.

5.2.25.2.2    Secondary use

5.2.2.15.2.2.1    Reusers’ access to health data (including researchers, innovators, policy-makers, regulators, but also healthcare providers for treating similar patients)

Under Policy Option 1, the European governance framework would provide guidelines on the reuse of health data, with Member States being free to implement separate laws for processing of health data or continue to process it based on consent.

Under Policy Option 2 and Policy Option 3, EHDS framework would provide a common European legal basis establishing the purposes of processing for health data reuse by third parties, with no distinction between public or private reusers or data holders, based on public interest, statistics or scientific research, alongside with the provision of the GDPR on the processing of health data based on consent. The secure provision of health data by Health Data Access Bodies, or other similarly empowered bodies CLXIV , would take place on the basis of such common EU legal basis, as possible in the GDPR on grounds of:

a)processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (Article 9(2)(g) of the GDPR);

b)processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 (Article 9(2)(h) of the GDPR);

c)public interest in the area of public health such as the protecting against serious cross-border threats to health, ensuring high standards of quality and safety of health care and of medicinal products or medical devices (Article 9(2)(i) of the GDPR);

d)archiving purposes in the public interest, or scientific or historical research purposes (Article 9(2)(j) of the GDPR).

Such legal basis would include specific purposes such as scientific research, development and innovation activities, national and European policy making and regulatory activities, safety of medicinal products and medical devices, combating health threats, knowledge management, steering and supervision of healthcare by authorities, planning and reporting activities, national and European statistics, education, information to healthcare professionals concerning the condition of similar patients, in order to treat another patient (e.g. for personalised medicine, identify genomic mutations that provoke certain diseases, rare diseases symptoms and treatments etc.). It would ensure that the same conditions apply throughout the EU, including common minimum requirements and safeguards (e.g. the lawful purposes of reuse, ethical and data protection safeguards, security measures, contractual commitments). It would not allow the use of data for purposes, such as marketing towards healthcare providers/professionals or change of insurance premiums for a person or group of persons.

As safeguards for processing, the conditions would mention the approval of requests for accessing the data by data access body, as well as processing in secure environments. In exceptional cases (e.g. data from one data holder), the access can be granted by the data holder respecting the conditions set out in the EHDS legislation and provided that the data is processed in a secure environment.

Policy Option 2 and Option 3 would enforce the compulsory access to and possibility of sharing of health data via Health Data Access Bodies. The provisions of the Data Governance Act on this domain would provide the technical support for the implementation of this requirement. However, the data access bodies would decide on each request, upon criteria established in EHDS law. While the processing of data would not be based on the consent of the data subjects, the policy option 2 and 3 would establish the safeguards that allow a high level of trust and security for the secondary use of data. For instance: data can only be processed for the purpose set in the law and it would be illegal to use the information against the data subject – for insurance, publicity etc; the data can be processed under EHDS framework only if the data access body provides a permit, taking into account the application submitted by the user and provided that the request meets the criteria set out in EHDS legislation; the data can only be processed in a secure environment, where the applicant has at its disposal the necessary IT tools; the data is pseudonymised by the data access body and the applicant does not have the decryption key. A compensation mechanism could also be implemented in order to determine a reasonable fee for the work of data access bodies and for the data holders in order to compensate them for the costs of access to the datasets held by them.

5.2.2.25.2.2.2    Data altruism

Under Policy Option 1, only the mechanisms for data altruism set up under the proposal for a DGA would apply and there would be no sector specific measures.

Under Policy Option 2, as lex specialis to the proposal for a Data Governance Act (DGA) and in compliance with GDPR requirements, data altruism is an opt-in system where individuals need to formally express their consent, being an active system, which requires the participation of the individual. Where data altruism is managed in the health sector by non-for profit/non-public entities, these would be supervised by the Health Data Access Bodies, in cooperation with bodies established under the DGA. Moreover, given the sensitivity of health data, specific additional requirements may be added through implementing/delegated acts under EHDS, to avoid fragmentation (e.g. processing in secure environments that need to comply with the standards and specifications set out at EU level). Where some categories of data have been processed based on consent according to national law, their further processing can be done using the EHDS mechanisms, without an additional consent being necessary. Given the absence of explicit consent of individual in such case, the data access body would monitor the implementation of such mechanism and ensure a strong protection of the rights and freedoms of the affected individual by implementing strong organisational and security safeguards.

Policy Option 3 would be the same as Option 2.

5.2.2.35.2.2.3    Types of data in scope for reuse

Under Policy Option 1, there would be guidelines on types of health-related data that could be made available for secondary use and on common modalities to facilitate access to health data for secondary use would be adopted by the EU network on secondary use of health data. This option also foresees guidelines concerning the provision for reuse (for free or against a nominal fee, covering the costs) of data that has been obtained in the framework of EHDS and has subsequently been enriched (e.g. annotated).

Under Policy option 2, the legislative framework would define the categories of health data that would be made accessible for secondary use in the EHDS and by Health Data Access Bodies. Available data could cover electronic health records, genomic data, administrative data, health research data, statistical data, claims/insurance data, relevant social data and other health-related data (from both public and private data holders/healthcare providers), data from disease registries and networks of registries. The data, including raw data or statistical data, obtained through public funding (national or EU), such as data from registries or research projects should be made available for reuse for free or against a nominal fee covering costs to make this data available. This option also foresees an obligation that data that has been obtained in the framework of EHDS and has been enriched by the user (e.g. annotated) is to be provided for reuse for free or against a nominal fee, covering the costs. Other data covered and managed by Data Access Bodies also include the data obtained from entreprises under the Data Act.

Policy Option 3 is the same as Policy Option 2.

5.2.2.45.2.2.4    Digital infrastructure for secondary uses

Under Policy Option 1, the EHDS infrastructure ecosystem would extend the current service for cross-border sharing of patients’ data (MyHealth@EU) to secondary uses of health data. The participation in the infrastructure would be voluntary. Each Member State may designate a national Health Data Access Body that would be connected to the infrastructure. Other EU bodies may also be connected to this infrastructure (such as the EMA, ECDC, HERA, etc.). Guidelines will set out the criteria for voluntary participation Also research infrastructures may connect to the EHDS infrastructure for secondary use of health data. The infrastructure, built as a peer-to-peer network, would offer the necessary means to know what institutions are connected, what data are available, and to allow the communication between the nodes of the infrastructure. The data consumer would need to submit a data access/permit application to each country’s access body and the different parties of the infrastructure will support access based on voluntary guidelines.

Under Policy Option 2, the participation in a Union-wide infrastructure for reuse of health data would be mandatory. The EHDS infrastructure ecosystem would be enhanced with new capabilities for secondary use of health data, based on a decentralised architecture (i.e. peer to peer network topology). Each Member State will need to designate a National Health Data Access Body that would be connected to the infrastructure. Criteria would be set out in the legislation for authorising the participation in the infrastructure by other stakeholders (e.g. research infrastructures, EMA, ECDC, European Health Emergency Preparedness and Response Authority (HERA)). The data consumer would have information about datasources through an EU catalogue of data and would submit only one application that is delivered to all nodes identified in the application. The approval of a data request remains an autonomous decision from each Health Data Access Body. EU institutions and agencies would provide access to relevant data they are holding, including through the infrastructure for secondary use of health data. Due to the highly technical nature of this infrastructure, Implementing and Delegated Acts would be envisaged to detail information about the infrastructure and its architecture, what and how data will be searched/accessed/exchanged, how interoperability and security will be achieved, as well as for additional services. In addition to services mentioned under Option 1, Option 2 could also support, as part of the central services, some secure environment services for pulling and analysis of data (e.g. by the Commission or by an IT provider for the Commission). Additional services and ways of accessing data may be set out in implementing/delegated acts.

Under Policy Option 3, as in Option 2, participation would be mandatory. However, the infrastructure would be based on a centralised architecture (i.e. star network topology). Under this infrastructure, a European Health Data Access Body (EHDAB) would act and work as an orchestrator, intermediating the communications between all participants in the infrastructure. Multi-country application requests would be submitted through the EHDAB. The data consumer will only need to submit one application. EHDAB would articulate with the necessary Health Data Access Bodies and the EHDAB’s access would include all underlying approvals and rejections from each Health Data Access Body. One option is that all multi-country data analysis would need to be performed in the EHDAB’s secure environment services. In addition, the EHDAB would host and provide access to transnational registries. Only certified partners would be able to join the infrastructure and EDHAB would orchestrate the implementation of the certification mechanism.

For all options, the request from data consumer must reach the relevant Health Data Access Body and, therefore, there is the need for an agreement on how an application process should look like. Without it, a data consumer may face a different process in each access body. For all options, there would be the need for central IT services to support the infrastructure. The type and range of IT services being provided at central level varies according to the policy option.

5.2.2.55.2.2.5    Data quality

Under Policy Option 1, voluntary data quality label would help to evaluate, according to a common data quality assessment framework, the quality of data (data source). The common assessment framework would be jointly prepared by the network dealing with primary and secondary use of health data, considering the interrelation between primary and secondary uses of health data regarding data quality, in collaboration with relevant stakeholders.

Under Policy Option 2, self-declared mandatory data quality label would ensure the evaluation, according to a common data quality assessment framework, of the quality of data (data source). The data quality assessment framework would provide transparency for data consumers and data access bodies about the quality of the data at source, without setting minimum data quality requirements for the data to be accessed by Data Access Bodies and would support reaching certain data-related requirements from AIA such as annotation, labelling, prevention of bias and avoidance of error. The framework would be jointly prepared by the Expert Group on Health Data Reuse and the Expert Group on Digital Health in collaboration with other relevant bodies, such as the ones in the AIA, and implemented through Implementing/Delegated acts and labels, to facilitate the reuse of health data. Pre-prepared data packages, provided by data access bodies, could support reserachers and innovators. The Public Consultation findings show there is varied support for a data quality label, with 41% support from industry and 30% support from public authorities.

Under Policy Option 3, mandatory data quality certification to ensure that only datasets that fulfil minimum mandatory data quality requirements are made available in the EHDS. These data quality certification would be prepared by an existing institution or agency would act as a European Health Data Access Body, in collaboration with the European Body for Digital Health, supporting the Commission adopting rules (through implementing/delegated acts) to facilitate the reuse of health data. EDHAB can orchestrate the implementation of the certification mechanism.Under option 3+, a new institution would fulfil these functions.

5.2.2.65.2.2.6    Support for artificial intelligence development and verification 

An appropriate use of data plays a fundamental role in ensuring the trustworthiness and creating trust in AI systems. The representativeness and quality of data used for training, validation and testing of AI applications that rely on machine learning could have an important impact on the resulting algorithm’s performance including, with regard to reducing bias and ensuring that the datasets are representative for Europe. The EHDS should be coherent with the Regulation on AIA.

Under Policy Option 1, codes of conduct, in line with Article 69 of AIA would be drawn up by individual manufacturers or by organisations representing them (or by both) on quality criteria for data used in development of AI in healthcare. The quality and representativeness of a data set always needs to be assessed in view of the purpose that it will be used for and each developer of AI systems needs to ensure that training, validation and testing data sets meet the appropriate quality criteria referred to in the AIA.

Under Policy Option 2, standards and/or common specifications would be adopted under the AIA to indicate how the essential requirements under the AI Act for health data could be fulfilled. In this regard, the Health Data Access Bodies, in addition to bodies under the AI Act, would aid in developing such standards/common specifications. Additionally, Health Data Access Bodies, along with Testing and Experimentation Facilities and regulatory sandboxes as foreseen under the AIA, would aid in the implementation of the AIA. The EHDS, including through the infrastructure for secondary uses, will provide high quality data for training, validation and testing of AI systems. Moreover, it would aid regulators in terms of data to scrutinise AI algorithms (e.g. control datasets, labelling, annotation, synthetic data etc.). Following the adoption of such data standards/common specifications, suitable information would be provided on data used in the EHDS infrastructure to support developers and other interested parties (e.g. regulators) in assessing the appropriateness of those data for the development/compliance checks of AI systems. One way to facilitate this is the development of common data catalogues and/or labelling of data in a uniform manner and/or other systems to provide this information in a clear, concise and comprehensive manner to researchers, developers, start-ups etc., but also control datasets.

Policy Option 3 strengthens Policy Option 2 with an obligation to structure all health data on the EHDS according to semantic interoperability requirements. Health Data Access Bodies would ensure that data on the EHDS fulfil these requirements.

5.2.2.75.2.2.7    Governance and EU cooperation

Under Policy Option 1, there would be no specific sectoral governance mechanism established at national level other than what is indicated in the DGA (i.e. a single point of information and a support function for public bodies). Member States would be encouraged to task national bodies to have a role in facilitating access to health data for secondary use. In parallel to the eHealth Network established on primary use of health data, a voluntary network on secondary use of health data would be established with relevant representatives from Member States to promote cooperation and guidance on this distinct topic.

Under Policy Option 2, all Member States would be required to ensure that there is a national body entrusted with decision-making powers and tasks in relation to health data access by third parties for secondary use. These Health Data Access Bodies would have as primary functions to: (a) handle requests for access to health data from different sources and act as a data controller (as specified in national law); (b) to grant a licence/permit for access when conditions set out in the basic act are met and to provide the secure physical infrastructure to enable access to health data for secondary purposes, including for the training and testing of AI algorithms. The tasks of these bodies and modalities for granting access would be harmonised. Access to cross-country registries will be provided by the Health Data Access Body of the country where the controller is located. The Health Data Access Bodies designated in all Member States would support manufacturers to datasets to train AI algorithms. It would support public institutions, including EMA, ECDC and HERA, as well as private entities, to have access to health data in a secure and trusted way. They could also support the notified bodies, Testing and Experimentation Facilities under the Digital Europe Programme and medicine agencies with controlled datasets for testing the AI algorithms. These bodies would also be involved in defining the quality framework for labels on data quality. An EU expert group to the Commission (Expert Group on Health Data Reuse), which could be part of a bigger body, entailing also the primary use of health data, would support the Commission in adopting further rules (through Implementing/ Delegated legislation) to facilitate the secondary use of health data, would be created. It would also be involved in defining the rules for the infrastructure on secondary use of health data, including with regards to security rules for the secure processing environments. It would also contribute to defining the rules on data quality, in collaboration with relevant stakeholders from respective fields. Various stakeholders participating in EHDS, such as researchers or industry would also collaborate with the EU expert group, as well as civil society and patients’ organisations. Collaboration and/or representation in European Data Innovation Board (under DGA) would be ensured. Health Data Access Bodies could serve both EU and international data users (under the condition that the data is being processed on the secure data space of the DAB). The Public Consultation findings show there is great support for EU coordination of national bodies dealing with secondary use of health data, with 73% support from EU citizens, 75% from industry and 59% from public authorities.

Under Policy Option 3, going further than Option 2, an existing EU regulatory body or agency could be tasked to act as a European Data Access Body (EHDAB) to grant access to health data held in transnational databases and registries (under the same conditions than those applying for Health Data Access Bodies). This would also coordinate the work of the national Health Data Access Bodies. In the context of cross-border research, it would facilitate cross-border access to health data held by national Health Data Access Bodies or by other infrastructures participating in the EHDS infrastructure (e.g. by centralising requests for cross-border research and coordinating the approval process with national authorities, issuing guidance on data access forms and data access agreement templates, etc.). Under option 3+, a new institution would fulfil these functions and would support the work on secondary use of health data.

In all options, governance mechanisms for primary and secondary uses would collaborate closely on issues relating to data use.

5.2.35.2.3    Stakeholders’ views on different Policy Options

There is overall widespread support for the different policy options (particularly policy Options 2 and 3), perceived from the outcomes of the Public Consultation on stakeholder views.

On primary use, there is large support for the strengthening of patients’ rights to control their health data in an electronic format. 88% of respondents think EHDS should promote citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format. 83% of respondents say that EHDS whould facilitate delivery of healthcare for citizens across borders. 84% of respondents say that citizens should have the right to transmit one’s health data in electronic format to another professional or entity of their choice and 82% feel that they should have the right to request public healthcare providers to share electronically one's health data with other healthcare providers/entities of one's choice. 72% of the respondents support accessing one’s health data that is exchanged between health professionals or with other entities via a digital infrastructure and 69% support this exchange to take place via an EU electronic infrastructure. 77% of respondents said it would be useful if citizens were able to transmit the data from mHealth and telehealth into their electronic health records. Respondents believed a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level) would be most appropriate to foster the uptake of digital health producrs and services (52% support).On secondary use, 89% of respondents said that EHDS should support and accelerate research in health. There is support from 55% of respondents for the mandatory appointment of a national body that authorises access to health data by third parties to facilitate access to health data for research, innovation, policy-making and regulatory decisions.

The two options that respondents said were most appropriate in facilitating access to health data held by private stakeholders was to have access to health data granted by a national body (rather than by the data holder), either subject to the agreement of data subjects (most support from industry (57%), least support from public authorities (24%), or in accordance with national law (most support from public authorities (65%), least support from industry (21%)). Only a small proportion of respondents said a fee would facilitate the sharing of health data held by private stakeholders (20%), while many highlighted the limitations of using this incentive (e.g. difficult to manage, not stimulating enough to share data etc.) and a few said it would have a negative impact (e.g. potentially endangering patient interest by commercialising health data). Many respondents said that other types of incentives would facilitate the sharing of health data held by private stakeholders, such as: legal/mandatory obligations, and greater interoperability between systems, databases and registries or a more transparent system for sharing data.

A large majority of respondents said an EU body could facilitate access to health data for research, innovation, policy making and regulatory decisions if it had a number of functions, the most important ones being: setting standards on interoperability together with national bodies dealing with secondary use of health data (87% support); bringing together the national bodies dealing with secondary use of health data, for decisions in this area (79% support); and facilitating cross-border queries to locate relevant datasets in collaboration with national bodies dealing with secondary use of health data (78% support).

Overall, 67% of respondents believed the mandatory use of specific technical requirements and standards would be most useful to address interoperability and data quality issues for facilitating cross-border access to health data for research, innovation, policy-making and regulatory decision, which is in line with the policy options.

Also in line with the policy options, 65% of respondents recommended allowing access to health data by AI manufacturers for the development and testing of AI systems in a secure way (including compliance with GDPR rules), by bodies established within the EHDS, to facilitate the sharing and use of data sets for the development and testing of AI in healthcare. For more information on stakeholders’ views and different positions, please consult Annex 2.

66    What are the impacts of the policy options?

6.16.1    Economic impact CLXV

6.1.16.1.1    Baseline scenario

With regard to the costs of governance for primary use of health data, the baseline would see a continuation of current efforts in the eHealth Network. These efforts are supported and funded partially through Joint Actions, with an approximate cost of EUR 16 million over ten years. The total cost over 10 years for this governance framework, including potentially two joint actions, is expected to be approximately EUR 20 million, for the Commission and the Member States CLXVI .

With the current voluntary framework, there is no clear prospect for the completion of MyHealth@EU in terms of full geographical coverage of the EU/EEA, full deployment of data exchange services and use of common electronic identification CLXVII . Although the deployment of the National Contact Points for eHealth (NCPeHs) could be completed across 27 EU Member States, Norway and Iceland by 2027, based on the estimates from Member States, less than two thirds are expected to deploy the full portfolio of data exchange services. The costs for the partial completion of MyHealth@EU, including investments and maintenance costs over 10 years, range between EUR 165-414 million CLXVIII  (assuming a costs per service between EUR 0.3-2.5 million).

At national level, depending on the existing degree of digitalisation and willingness to invest in this area, the effort to support national digitalisation and introduce nationally the digital services for the exchange of data domains in the EEHRxF could vary between EUR 3-9 billion. However, around half of Member States already have systems allowing to share patients’ data between healthcare providers, whilst several others are in the process of strengthening the level of digitalisation supported by national and EU funds. For instance, under the Multi-annual Financial Framework 2014-2020, around EUR 1 billion were allocated for digital health from the European Regional Development Fund (ERDF) and almost EUR 12 billion have been negotiated by the Commission and Member States under Recovery and Resilience Facility (RRF) in this area. Therefore, the EU funding is expected to cover most (if not fully) the national effort for digitalisation that would be needed to support patients’ control over their own health data. However, without clear efforts on standardisation and interoperability at EU level, these digitalisation efforts risk perpetuating the fragmented landscape that currently exists.

The benefits of automatic data sharing could lead to a direct financial impact is as high as 15% of hospital expenditure CLXIX , stemming from avoidance of costs associated with paper data capture, and minimisation of errors that occur from transcription of information. It can also have overall positive effects on healthcare expenditure. For instance, during the financial crisis years, digitalisation was one of the main actions taken for the countries in crisis (although the positive effect is difficult to demonstrate systematically, as the digitalisation of health and social care was part of the policy mix applied during the financial crisis in countries like Greece, Portugal, Romania that contributed to important savings and positive effects, but was not monitored separately).

Overall, regarding the benefits for primary use of data, it is expected that the economic impact stemming from potential savings for patients due to higher use of telemedicine, more efficient and effective healthcare systems and contribution to the digital health single market would amount to EUR 2.5 billion. To this, one could add the cost of not duplicating tests. Ensuring interoperability at national level could contribute to reduce duplicated medical imaging, which is estimated at EUR 14 billion CLXX in the EU over ten years (calculated as 10% average of duplicated tests for a total of EUR 14 billion per year for examinations requiring Computed Tomography, Magnetic Resonance Imaging and PET scans). It is estimated that MyHealth@EU, in the cross-border context, could result in EUR 1.9-2.8 billion in savings through the services of electronic cross-border prescriptions (corresponding to EUR 37-52 million additional dispensations over 10 years) CLXXI  and could save additional EUR 19-75 million through the exchange of medical images alone. For ePrescriptions, the estimate is based on the evaluation of the CBHC Directive, indicating that around 7.8 million cross-border prescriptions are presented for dispensation per year in EU, with an approximate non-dispensation rate of 46%, down from 55% in 2012. The lower bound assumes a 10% yearly growth in cross-border prescriptions, while the upper bound assumes a 20% yearly growth. This is expected to be a conservative estimate, given that the growth between 2012-2021 was estimated at 400%. Such benefits would recoup to a large extent the investments that would be made to set up MyHealth@EU.

Regarding secondary uses of health data, some Member States would establish national Health Data Access Bodies CLXXII to address the specific needs of health data access without a common European framework in health (the baseline assumes 16 data access bodies to be operational within 10 years, buidling upon the existing ones). The costs could vary greatly depending on national choices, e.g. whether to designate an existing body with the functions of health access bodies or whether to create an independent body such as the French Health Data Hub or Findata, but it is estimated that the establishment and functioning costs (for personnel) range between EUR 33 and 117 million over 10 years (assuming a 4 FTE team per Member State as a lower bound, and a combination of organisational arrangements across the EU -ranging between 4-FTE and 50-FTE entities, for the upper bound). In addition, there would be costs estimated at EUR 445 million for the set-up and maintenance of secure environments for data processing as infrastructure, which are included already in the framework of Article 7 bodies of the Data Governance Act (considers, as per the Data Governance Act, a set up cost of EUR 10.6 million and a maintenance cost of EUR 0.6 million yearly). The costs of data altruism authorisation framework would be aligned with Data Governance Act CLXXIII . Should access to health data continue to be organised under the current fragmented framework, the overall costs incurred by data re-users in health for cross-country researches could reach at least EUR 2.7 billion over 10 years, steming mainly from costs related to getting the consent as opposed to paying a fee to data access body (this estimate is calculated based on the monetary costs incurred by researchers or research institutions to gather the consent of data subjects (assuming 30 min required for contacting and getting the consent of the data subjects. The cost depends on the size of the cohort).

For secondary use of health data, the benefits, registerd in the value of health data could increase from the estimated EUR 25 billion to EUR 43 billion in 2028 (based on the baseline of the impact assessment of the Data Governance Act - EUR 306 billion as overall value of data in 2020, its growth by 2028 - EUR 533 billion- and the share of health in the overall value of data as proportional to the EU’s health expenditure share of the GDP- 8.3%). The investments in data access bodies could be recuperated, at least partially, through the fees charged by these bodies. Assuming a yearly growth of 5% in requests, it is estimated that these fees could amount to EUR 92-166 million (based on Findata prices, for more details, see Annex 5). The reuse of health data in the existing framework could yield additional EUR 0.8 billion in savings through information transparency for policy-makers and regulators, with initiatives such as the Data Analysis and Real World Interrogation Network (DARWIN) led by the EMA supporting regulators’ to health data CLXXIV CLXXV and contributing to more efficient regulatory and policy-making processes and improved negotiation power.

The economic contribution of the framework under Article 14 of the CBHC Directive, to the growth of the single market for digital health, as shown by the evaluation of this Article, is expected to be limited beyond MyHealth@EU, given that it does not include specific actions targeting the single market for digital health products and services. On secondary use of health data, as shown by the evaluation of the directive, the actions taken under the eHealth Network are expected to be limited, even though the Joint Action TEHDaS is expected to provide a form of cooperation. The DGA foresees a support to data holders through Article 7 bodies of DGA, which can also provide a secure processing environment. However, it is difficult to separate the impact of DGA from the impact of national law in countries that set up a data access body and it is not clear what the impact of DGA would be in the absence of a mandate to provide access to health data.

6.1.26.1.2    Policy Option 1

6.1.2.16.1.2.1    Impact of actions on primary uses of health data

This policy option is expected to have a limited economic impact, modestly above the baseline, given the voluntary nature of the considered actions. At the same time, this policy option does not provide a strong incentive to overcome the fragmentation of the internal market for digital health products and services, nor the competitiveness of the EU digital health sector. However, there is potential for savings from using telehealth services (more cost-effective) CLXXVI , as well as for a reduction of duplications and errors, direct time savings across healthcare systems, reduced hospitalisation or deterioration of health stemming from continuous monitoring of some patients, as well as a more efficient functioning of the single market for digital health services and products in the EU. The efficiency gains in healthcare are expected to result in savings for partients and healthcare providers with a net present value of EUR 0.4 billion within the first 10 years (this amount is expected to be relatively small, only 1% above the baseline, given that Option 1 continues with a voluntary framework, as in the baseline).

In Policy Option 1, the governance framework will continue to be based on a network of Member States’ authorities, including digital health authorities, which would make decisions to build and strengthen current systems for accessing and sharing health data for healthcare delivery purposes. Given the new areas of cooperation, more meetings would be necessary (as it was the case during COVID-19 crisis), generating potential additional costs (participation in meetings, mostly online, but also travel, accommodation for some physical meetings during the year, etc.). These costs, estimated at EUR 8 million above the baseline, are expected to be borne by the Commission and Member States (for the Commission and Member States, taking as a reference the current costs for the eHealth Network and the potential physical and virtual meeting needs for the upcoming 10 years).

Member States will be able to develop and deploy their national and cross-border digital infrastructures on a voluntary basis, including those linked to electronic identification in health, in a similar way to the baseline, and the services under MyHealth@EU would be extended to provide services to citizens. The strengthened mandate of the eHealth Network on the cross-border exchange of health falling within the scope of the EEHRxF is expected to promote the gradual completion of MyHealth@EU, but requiring at least 10 additional years. The investment requirements and maintenance costs for Member States and the Commission for MyHealth@EU are estimated at EUR 38-106 million above the baseline over 10 years. A faster deployment of MyHealth@EU would also yield additional savings for patients and healthcare systems, estimated at EUR 89-115 million, thanks to a reduction on the non-dispensation rate of cross-border prescriptions.

The costs for the implementation (already included in the costs of governance) and adoption of voluntary quality labels for digital health products (e.g. EHR systems, personal health data storages, mHealth products falling under MDR), and mHealth products not falling under MDR (e.g. wellness apps), based on a self-declaration, are expected to be relatively limited, between EUR 42 and 227 million. This includes the cost for internal preparations by manufacturers for the self-declaration, but not the costs of adaptation of existing products. The costs for labels are between EUR 9,000-32,000. The volume of EHRs labelled, about 1,840-3,000 over 10 years, for digital health products labelled, 1,400-2,800 and for wellness apps labelled, 1,200-2,200 over 10 years. It is assumed that labels will have to be renewed after 5 years. Moreover, given the low costs of self-declaration in combination with measures on reimbursement and compensation, it is expected that the volume of labelled applications will increase steadily across the EU and will provide further incentives for digital health developers and market operators to adopt interoperable formats and to support control of patients over their data. This is expected to contribute to a faster growth of the digital health market (5% to 10% per year), both at the EU and Member State level.

6.1.2.26.1.2.2    Impact of actions on secondary uses of health data

A voluntary basis intervention on secondary use of health data matters is expected to result in an economic impact of EUR 2.8 billion in total, over 10 years and above the baseline. Such benefits for reusers, including researchers, innovators, regulators and policy-makers, would stem from a more efficient and less costly access to health data for reusers (EUR 1.7 billion) and an increased value of health data thanks to sharing (EUR 1.1 billion) (for more details on methodology, see annex 5).

The actions on governance through the voluntary network of Health Data Access Bodies are expected to cost EUR 8-9 million for the Commission and Member States. The actions on data quality CLXXVII and interoperability are estimated to have a cost of approximately EUR 144-313 million over 10 years for the Commission and Member States (extrapolating from the current situation, the total number of data sets made available by Health Data Access Bodies that adhere to a voluntary label along for the 10 years period in all MS is expected to be 2 900-3 800 datasets). The establishment of a voluntary self-assessment data quality label will make some contribution to the consistency of a common framework. The costs of the voluntary mechanism for manufacturers are expected to be overall low, especially in the case of self-assessment (around EUR 7,000-17,500 in internal preparation costs). The creation of a European network of national Health Data Access Bodies could promote the establishment of new Health Data Access Bodies above the baseline scenario, so the costs related to such bodies for the Member States and the Commission should be expected to increase slightly, between EUR 7 and 28 million above the baseline (assumes 3 additional health data access bodies could be established in the first 10 years). 

The extension of the current infrastructure MyHealth@EU to secondary uses could simplify processes to access and share health data only to a certain extent, particularly for multi-country requests. Given that the national institutions dealing with primary and secondary use of data are different, such an infrastructure would require substantial change to ensure that both primary and secondary use can be served through the same infrastructure without compromising interoperability, security and reliability CLXXVIII . The deployment and operation of the European network of Health Data Access Bodies, and corresponding infrastructure for national and cross-country data access requests, is estimated to have implementation and maintenance costs of EUR 136-183 million for the Commission and Member States (including costs for the extension of central services as part of MyHealth@EU, implementation of new central and generic services across Member States, deployment of connections for EU bodies and overall maintenance), but it is expected to only lead to a partial coverage, given the voluntary participation. However, it is not expected to lead to the achievement of a full standardisation of practices, given that the establishment of a consistent framework across Member States will largely depend on the rate of adoption of common guidelines. As in the baseline, part of these costs could be covered by revenues through fees charged by Health Data Access Bodies. The deployment of new Health Data Access Bodies could increase such revenues with additional EUR 40 million.

6.1.2.36.1.2.3    Overview of overall costs and benefits

Table 4. Summary of economic incremental costs and benefits for Policy Option 1 (above the baseline).

6.1.36.1.3    Policy Option 2

6.1.3.16.1.3.1    Impact of actions on primary uses of health data

This policy option is expected to have a stronger economic impact than Policy Option 1, and it is estimated to result in EUR 5.4 billion savings for patients and healthcare providers over the course of 10 years, including those stemming from a greater uptake of telemedicine and cross-border interoperability of ePrescriptions and medical images.

In this option, an expert group will be established consisting of national digital health authorities. The costs for the Commission and Member States to support the work of such expert group, and the corresponding subgroups, are estimated at EUR 12 million, over 10 years, above the baseline (same calculation methodology as in Policy Option 1, but assuming greater workload due to stringent governance structure (e.g. assumed for the Commission one additional FTE). The costs for the Commission and Member States for the implementation of the labels for interoperability, cybersecurity and quality of digital health products and services are included in these governance costs.

Under this option, Member States will be required to implement the services of MyHealth@EU, including those linked to electronic identification in health, and the services under MyHealth@EU would be extended to provide services to citizens and possibly additional services. The investment and maintenance costs for MyHealth@EU are estimated to require in the range of EUR 39-109 million in 10 years, above the baseline, depending on the cost and speed of implementation. The faster rollout of MyHealth@EU would also yield additional EUR 173-232 million in cost savings in the area of ePrescriptions and medical imaging alone.

The mandatory labelling for digital health products and EHR systems (personal health data storages, mHealth products falling under MDR), and voluntary labelling of wellness applications would be more costly than in Policy Option 1, EUR 0.1-1.1 billion above the baseline, given the need for market operators and developers to obtain the mandatory label for their products and services (a transitional rollout is assumed for this label (faster than in Policy Option 1), with an annual growth rate of 15%-20%. These costs include the cost for internal preparations by manufacturers for the self-declaration, but do not include any cost of adaptation of the product to the requirements of the label). The Commission would be required to develop and maintain a database for certified/labelled products to support the rollout of mandatory labelling, which is estimated to cost approximately EUR 32 million (based on costs of Eudamed for development and maintenance). In Policy Option 2+, the higher cost of third-party certifications, affects only the medical devices that process data that feed into electronic health records, is expected to increase costs for developers and market operators to EUR 0.3-1.7 billion (for an overview of the market size, please see the Annex 5 on methodological approach the purpose of calculating the market sizes, the assumptions are derived from industry analyses and information retrieved from product databases in Finland and Italy: 3,800-5,000 products in the EHR systems market; 5,000-20,000 products in the digital health products market (medical devices with EHR data); 20,000 products in the wellness applications market). The costs for mandatory certification for EHRs: EUR 20,000-50,000, of which half (EUR 10,000-25,000) of internal costs for manufacturers, and half certification fees. Re-certification is assumed after 5 years, with costs 80% of the initial certification costs. The costs for labelling are between EUR 9,000-32,000).

Member States are expected to incur costs similar to those under Policy Option 1 to adapt their requirements, guidelines and frameworks to those defined at EU level, and/or to design them in compliance with the EU standards and frameworks in absence of a national framework. The synergies between the labelling systems and other measures are expected to generate a rapid increase in the presence of such products on the European single market, with an annual growth of 20%-30%. There is also an estimated growth of such products on the market of 15%-20% per year.

6.1.3.26.1.3.2    Impact of actions on secondary uses of health data

A mandatory but flexible intervention on secondary use of health data is likely to result in a significant positive economic impact of at least EUR 5.4 billion over the next 10 years, stemming from efficiency gains in data access as a results of a less costly access to health data by reusers, be it researchers, innovators, regulators and policy-makers EUR 3.4 billion), greater information transparency for policy-makers and regulators (EUR 0.8 billion), and increased value for patients, healthcare providers and innovators thanks to further reuse of health data, through the development of innovative products and services in health thanks to data-intensive technologies, such a AI-based systems (EUR 1.2 billion).

The more intensive use of real-world evidence (RWE) in health policy-making could yield substantial additional savings, estimated at EUR 0.8 billion, thanks to greater transparency of the effectiveness of medicinal products, resulting in a reduction of costs in the regulatory processes, including in public procurement in health CLXXIX . Under this option, IT infrastructures, such as the EMA’s DARWIN, could be fully integrated in the network of Health Data Access Bodies, supporting the EMA, national medicines agencies and HTA bodies in better decision-making and renegotiating the prices of different medicinal products based on the observed real-world effects, post-authorisation. According to experts consulted, in a medium-sized EU country, a 5% saving from re-negotiating the prices in drug cost in oncology, diabetes, cardiovascular, respiratory/neurology could result in an annual saving of EUR 50 million, which can lead to sizeable effects at EU level. With increasing prices of new medicines, this saving is expected to increase in the future.

This policy option requires the establishment of an expert group consisting of Health Data Access Bodies to govern the area of secondary uses and to ensure a consistent framework. Such a group is expected to incur costs of EUR 13 million. The increase in governance costs originates from the need for additional FTEs for managing the governance framework. While including an obligation to designate Health Data Access Bodies, Policy Option 2 provides sufficient flexibility to Member States to decide on the organisation of the function to be fulfilled by a Health Data Access Body, which could be established as a unit in a larger organisation (e.g. Article 7 body under Data Governance Act) or as an independent entity (e.g. like Findata or French Health Data Hub). The cost of establishment and operation over 10 years can vary significantly depending on national choices, ranging between EUR 3.3-12.4 million for a 4-Fulltime Equivalent (FTE) or 15-FTE unit, respectively, and EUR 20.6-41.3 million for a 25-FTE or 50-FTE independent entity, respectively. The expectation is that total costs for 27 Member States and EEA countries will comprise a variety of organisational arrangements for Health Data Access Bodies. The overall costs for this option could range between EUR 39-157 million for all countries, partially recovered through the fees charged to re-users (EUR 36-58 million).

The requirements for infrastructure and security will increase harmonisation for secure data spaces, promote interoperability and standardisation of practices between Health Data Access Bodies to enable multi-country data access requests. Such infrastructure is expected to cost EUR 176-287 million, including the central services to operate the network and the services to be deployed at the level of Health Data Access Bodies. EMA, ECDC (and HERA) would also be connected to this infrastructure, but their financing is already foreseen under other legislative initiatives.

The establishment of a mandatory data quality label granted by a third party will increase the consistency of a common framework. The total number of data sets made available by Health Data Access Bodies that adhere to a voluntary label along for the 10 years period in all MS is expected to be 4,300-5,600 datasets, with a cost estimated to EUR 25-81 million. This action, combined with costs for data reusers to access the data made available through the EHDS (EUR 97-204 million), is expected to carry costs of approximately EUR 122-285 million. The costs are higher in Policy Option 1 than in Policy Option 2, due to multi-country data access requests being more expensive in the formern as the latter provides for common data request and reuse procedures. Not having such common data request and reuse arrangement increases the cost for data reusers in Policy Option 1. The governance and interoperability and data quality requirements also translate into simpler procedures/lower burden for stakeholders to request data and process the requests, which are reported as part of the benefits (as ‘efficiency gains’). The one-off cost of a labelling scheme on data quality could amount to EUR 20,000 and EUR 50,000 for obtaining the label and EUR 20,000 to EUR 35,000 per year for renewing the label for data holders (the figures are derived from the costs of the DiGA system and from the impact assessment on Data Governance Act, and consistent with those for primary use of health data). The costs of the label are expected to be not so high, especially in the case of self-assessment (around EUR 7,000-17,500 in internal preparation costs). In case of the third-partly labelling mechanism, it is expected that the costs will be somewhat higher, including at least the third-party labelling fee. The costs for AI would entail trainings, but also development of standards together with bodies of AI Act and would be between EUR 8-11 million.

6.1.3.36.1.3.3    Overview of overall costs and benefits

Table 5. Summary of economic incremental costs and benefits for Policy Option 2 (above the baseline).

6.1.46.1.4    Policy Option 3

6.1.4.16.1.4.1    Impact of actions on primary uses of health data

This policy option is expected to produce an economic benefit that is lower than Policy Option 2, given the stringency of the framework, which could function as a disincentive for market operators when entering the European market and the additional costs for the EU body. This policy option is expected to provide similar mechanisms (mandatory labels replaced by certification) for the adoption of interoperable systems across the EU, reducing fragmentation of the digital health market and increasing competitiveness of the EU IT sector. Therefore, similarly to Policy Option 2, this option is estimated that EUR 5.4 billion could be saved, by patients and healthcare providers, over the course of 10 years.

Binding decisions at EU level through a European Digital Health Body will help overcome gaps in regulation of digital health systems. If such function would be established as new task of an existing body, the Comission is expected to incur costs of approximately EUR 9 million, over the baseline (assuming a requirement of 12 FTE). If such function would be established based on a new agency (Option 3+), the Comission is expected to incur costs of approximately EUR 321 million, including set-up and yearly operation (using the costs of the European Labour Authority as a proxy). Under this option, in a similar fashion to Policy Option 2, Member States will be required to implement the services of MyHealth@EU, including those linked to electronic identification in health, and the services under MyHealth@EU would be extended to provide services to citizens and possibly additional services. Assuming that a full rollout of MyHealth@EU within the first three years since entry into force of the EHDS, the investment and maintenance costs for MyHealth@EU would be marginally higher than for Policy Option 2 (EUR 42-117 million above the baseline, assuming mandatory adoption of digital health services for the exchange all of data domains under the EEHRxF by Year 3). The full rollout of MyHealth@EU within a set timeframe would contribute to additional savings of EUR 173-232 million from cross-border prescriptions and medical imaging alone.

The actions to support common European interoperability in Policy Option 3 are similar to those in Policy Option 2, but include a third-party certification scheme for ensuring interoperability and quality of data flows for digital health products (including EHR systems, personal health data storages, mHealth products falling under MDR, already certified by the MDR notified bodies) and for wellness applications. This mandatory certification is expected to generate compliance costs of approximately EUR 0.6-2.9 billion for market operators, including developers and suppliers of EHR systems, digital health products and wellness applications. While the European market for wellness applications is estimated to comprise approximately 100,000 products, for the purpose of the calculations, an assumption was made that 20% (20,000) could fall under the scope for certification. If one considers that all the wellness apps were certified, the costs could reach over EUR 8 billion, which would be very unproportionate and cost ineffective. The potential benefits of easier cross-border market access could off-set such costs, at least to some extent. Synergies between the certification schemes and other measures (such as reimbursement and compensation policies) are expected to generate a rapid increase in the presence of such products on the market, with annual growth of 10%-20%. A lower increase compared to Policy Option 2 is due to the higher costs for certification, which can represent a barrier for technology developers and vendors. Under such circumstances, wellness applications are estimated to grow at a lower pace (5%-10% per year).

6.1.4.26.1.4.2    Impact of actions on secondary uses of health data

A high-intensity legislative intervention aiming at harmonisation on secondary use of health data matters is likely to result in a positive impact of EUR 6.1 billion during the next 10 years, stemming from efficiency gains, increased value of health data and greater information transparency for policy-makers and regulators in health.

The creation of a centralised function at EU level, the European Health Data Access Body (EHDAB) that could regulate and govern the functioning of the space for secondary uses could contribute to reduce fragmentation. Such function could be established within an existing body, with an estimated additional of EUR 106 million, or be assigned to a new European Digital Health Body as an additional task (Option 3+). The establishment and associated costs of Health Data Access Bodies would remain unchanged from Policy Option 2 (EUR 39-157 million), as that option already includes several obligations regarding the designation of these entities. However, Policy Option 3 would entail implementing a centralised architecture with increased costs at European level for the infrastructure of the European Health Data Access Body (EHDAB). The total costs for the infrastructure, including implementation and maintenance, could range between EUR 202 and 313 million. These costs would be partially recovered through the fees charged to re-users (EUR 36-58 million, as in Policy Option 2).

A compulsory certification framework for data quality would cost between EUR 20,000 and EUR 50,000 to obtain the certification (the total number of data sets for the 10 years period in all MS is expected to be 3,400-4,400 datasets). The total amount for the compulsory certification scheme for data owners and the costs for reusers to access health data across borders is estimated to be between EUR 191-457 million (EUR 57-143 million for dataquality and EUR 134-314 million for data reusers). Costs for carrying out the certification system are considered to be in line with those incurred in national contexts (i.e. EUR 10,000 to EUR 25,000), while costs for processing and redistributing multi-country data access requests are expected to be limited. High costs of the certification scheme for data quality are likely to reduce the availability of niche datasets, lower the offer in the EHDS, and possibly have a disproportionally adverse impact on smaller dataset owners.

6.1.4.36.1.4.3    Overview of overall costs and benefits

Table 6. Summary of economic incremental costs and benefits for Policy Option 3 (above the baseline).

6.26.2    Single Market, competitiveness, innovation, SMEs and international aspects

6.2.16.2.1    Baseline scenario

In the Baseline scenario, the cooperation framework is limited to primary uses of health data and mostly to the exchange of health data across national health systems, with no or limited intervention in the single market. It provides no incentives at EU level for manufacturers to improve the interoperability and connectivity across national borders. The reliance on consent as the legal basis for data processing is expected to continue with prohibitive costs for researchers and SMEs to reuse health data, constraining the capacity of the latter to innovate in the area of data-driven technologies in health. The position of the EU in the international arena and as a standard setter would not be coherent, as many of the initiatives would remain voluntary.

6.2.26.2.2    Policy Option 1

Policy Option 1 relies on a decision-making system based on consensus and voluntary participation does not provide a strong incentive to overcome the fragmentation of the EU’s digital health market, nor does it create forces that will increase the competitiveness of the EU IT sector. The heterogeneity of standards and specifications and limited interoperability raise barriers and additional costs for manufacturers, especially SMEs, to enter new markets. With regard to the secondary use of health data, Option 1, like the baseline, in terms of governance, voluntary participation will not provide strong instruments to overcome the fragmentation of initiatives and frameworks for the reuse of health data.

6.2.36.2.3    Policy Option 2

Policy Option 2 is expected to have a relatively strong positive impact on competitiveness and the single market. The main aspects of the national and EU governance structures are expected to provide strong incentives for the adoption of systems that allow individuals to control their health data, with interoperable systems within and between Member States, which, in turn, will help reduce the fragmentation of the eHealth market and increase the competitiveness of the EU’s IT sector. National reimbursement and compensation policies for digital health services and products will be based on EU frameworks and guidelines, better aligned with international standards. Legal frameworks will therefore become more similar, and this is expected to reduce cross-border market entry barriers, including for SMEs. This could create new competitiveness opportunities for European SMEs on the global market. This measure will impact the development of a whole new scenario for scalable innovation, competitiveness, and overall operationalisation of digital products and services. Overall, respondents in the public consultation believed a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level) would be most appropriate to foster the uptake of digital health products and services at national and EU level (52%). A smaller proportion of respondents said an authorisation scheme managed by national bodies would be appropriate (43%). The option of using a voluntary labelling scheme was the least popular (19%). With regards to the secondary use of health data, a system where access to data is simplified, but the trust and security are enhanced can fuel research and innovation. A system where access to data becomes cheaper (compared to getting the individual consent of data subjects) and volume of available data increases, would support different players, including SMEs, to bring forward innovation. Over time, this is expected to contribute to the development of a common EU system for secondary use of health data which, in turn, is expected to support research, development of new products and services, delivery of personalised medicine and more evidence-based policy-making. This could boost the global competitiveness of the EU. This holds the potential for new medical discoveries, better predictive capabilities, better preventative measures and improved ability to adapt, optimise and react to largescale health risks. An EU wide infrastructure would allow access to data from several Member States. SMEs would be able to have easier access to diverse data which would allow them to compete with large players within the EU and globally. Respondents in the Public Consultation also said that measures supporting secondary use of health data would have benefits in terms of providing access to cutting-edge, efficient and safe care (e.g. thanks to faster innovation in health – 77% of respondents said the impact would be high – and increased safety of healthcare and of medicinal products or medical devices – 75%), as well as benefits on healthcare systems efficiencies (e.g. better informed decision-making – 77% – and technological progress – 76%).

At global level, the EU can become a standards setter, as it happened with the EU Digital COVID certificate (which was only possible under of a strong legal basis and a harmonised approach CLXXX . A more systematic implementation of international standards can open new international markets to European companies. Translation of patients’ data in English or other languages can support European citizens travelling or leaving to third countries. International cooperation in research and innovation area could be facilitated by the new framework on secondary use of health data.

6.2.46.2.4    Policy Option 3

Policy Option 3 is expected to have a relatively strong positive impact on competitiveness and the single market. The harmonisation efforts concerning standards and specifications can support manufacturers to enter new markets. On secondary use of health data, the situation would be similar to Policy Option 2 and the European Data Access Body would further facilitate the cross-border access to health data, creating more research and innovation. The EU’s international position could be stronger and defended by an EU body. However, the costs for certification of standards could impact negatively on companies, especially SMEs.

6.36.3    Impacts on fundamental rights

6.3.16.3.1    Baseline scenario

The expected impact on fundamental rights of the baseline is rather limited. Although GDPR provides a common framework, the different national level legislations linked to its implementation will remain, perpetuating the current landscape of divergent rules, processes, standards and infrastructures as described in section 2.2.

6.3.26.3.2    Policy Option 1

The impact on fundamental rights is expected to be moderate. The voluntary network of Member States authorities will allow for the exchange of experiences, including in relation to the implementation of procedures and frameworks that protect privacy of individuals. The voluntary adoption of guidelines and voluntary participation in infrastructure will not guarantee patients effective data portability rights cross-borders and the impact will be minimal at national level if there is variation in standards across Member States.

6.3.36.3.3    Policy Option 2

This policy option is expected to have a significant positive impact on fundamental rights related to data protection and free movement, as through MyHealth@EU, citizens will be able to effectively share their health data when travelling abroad in the language of the country of destination or take the data with them when moving to another country. Citizens will be given additional possibilities to access and transmit digitally their health data, building upon the provisions of GDPR and market operators in health (either healthcare providers or providers of digital services and products) will be obliged to share health data with user-selected third parties from the health sector. The proposal will provide the technical and practical means to enforce these rights (common standards, specifications, labels) without compromising on the required safety measures to protect data subject’s rights under the GDPR. It would contribute to the increased protection of health personal data and the promotion of the free movement of such data as enshrined in Article 16 of the TFEU.

This option defines an EU framework for accessing the health data for public interest and scientific, historical research and statistical purposes, building upon the possibilities offered by the GDPR in this respect. It will include suitable and specific measures required to safeguard the fundamental rights and the interests of data subjects. Setting up Health Data Access Bodies will ensure a predictable and simplified access to health data, a higher level of transparency, accountability and security in the data processing. Coordinating these bodies at EU level and enshrining their common decision in implementing and delegated acts will ensure a level playing field, which will support cross-border analysis of health data for research, innovation, statistics, policy making and regulatory purposes. The promotion of interoperability of health data and its reuse will contribute to promoting a common internal market for health data in line with Article 114 of TFEU.

6.3.46.3.4    Policy Option 3

In Policy Option 3, the impact on fundamental rights is expected to be very similar to that of Policy Option 2, given that the right of citizens to access and transmit digitally their health data is the same under this option. However, a comparatively greater positive impact on freedom of movement and patients’ control over their health data can be expected through stronger requirements of certification for digital health services and products (that could also cover security and confidentiality of data).

Establishing a regulatory agency would have a strong positive effect on the protection of personal data and privacy, as it would ensure the implementation of a consistent framework for reuse of health data in compliance with the GDPR and in collaboration with National and European personal data supervisory authority. The agency could also ensure a simplified access to cross-country types of data.

6.46.4    Social and environmental impact

6.4.16.4.1    Baseline scenario

Regarding the cross-border digital infrastructure for primary uses of health data, there is no clear prospect, in the baseline scenario, for MyHealth@EU to achieve full EU coverage and complete the rollout of its services portfolio. This has direct negative consequences where EU citizens and residents seek healthcare services in a Member State that is different from their country of affiliation, as healthcare professionals will not be able to access crucial medical information. The gap between digitally skilled and digitally unskilled citizens and end-users will persist in the baseline. The baseline scenario will see a slower realisation of the potential benefits of the reuse of health data. In the absence of coordinated EU action for the reuse of health data subject to rights of others and data altruism mechanisms, the societal and environmental benefits would be limited.

6.4.26.4.2    Policy Option 1

This option is expected to have a moderate social impact. The guidance and label for the assessment and use of digital tools is expected to lead to an increased uptake and wider implementation of these solutions by healthcare providers, with positive effects in areas such as chronic disease management. However, while the cross-border digital infrastructure in health would be strengthened, and likely completed within 10 years, the progress is expected to be slow, leaving in the meantime a large share of the European population with no access to MyHealth@EU. Citizens and end-users will require guidance on digital skills in order to prevent the digital divide from widening. The exchange of experiences in a voluntary network of national authorities responsible for secondary use of health data will aid those Member States that have not yet implemented legislation in place on public and private use of data for research purposes. However, given its voluntary nature, the impacts on unlocking the health value from data in the EU would be limited.

This option is expected to have a small environmental impact overall. Interoperability, reuse of health data and the portability of patients’ data and quality criteria for telehealth are likely to improve the efficiency of use of resources, for instance by reducing unnecessary tests and visits of patients to hospitals, and the need for paper documentation and health records. This effect should reduce the overall carbon footprint of healthcare. However, greater digitalisation of health data and data portability will require larger scale IT infrastructure. This may increase the use of energy and other resources, and increase the carbon footprint of the healthcare sector, and partially offset the resource-efficiency gains stemming from interoperability.

6.4.36.4.3    Policy Option 2

This option is expected to have a significant social impact. This will put the patient at the centre with regards to management of his/her data in relation to healthcare professionals. If digital solutions are interoperable and supported by reimbursement, it will encourage their growth and uptake. With more data flowing in the system, new innovations can be put forward out, to the benefits of the patients. This option should lead to enhanced equal accessibility and availability of innovative products for diagnosis, and treatments, contributing to a reduction in health inequalities, including facilitating better access to healthcare in remote or rural areas a more consistent monitoring and early intervention of some patients with chronic diseases, preventing hospitalisations and more aggressive and expensive treatments and reducing costs. As explained in problem description, it can contribute to better adherence to medication, reduction of unnecessary tests, prevention of misdiagnosis and treatment, positively impacting individuals and healthcare systems. The mandatory requirement for Member States to deploy MyHealth@EU services within a certain timeframe will reduce disparities within the EU when accessing healthcare services in the cross-border context.

Access to data that represent different geographical, behavioural or functional settings and depicting the health of different population sub-groups improve research into targeted prevention and treatment methods. This policy option would also facilitate access to larger volumes of health data, enhancing the capacity of research, policy making and regulatory initiatives, increasing representativeness of datasets and fostering innovation, including in the area of AI. This holds the potential for new medical discoveries, more accurate predictive capabilities, more effective preventive measures and improved ability to adapt, optimise and react to largescale health risks, as well as low occurrence but high impact pathologies.

Abundance and diversity of data would support better decision making, including of regulatory authorities. It would increase transparency, negotiation capacity, bringing down the prices for some drugs, supporting the repurposing of medicinal products, to the benefit of patients. For example, rare diseases include small population sizes were clinical trials may not be feasible. A mix of randomised trials and access to high quality health data would be required to study populations with unmet medical needs and contextualisation of treatment benefits for single-arm studies. Reliable and timely evidence is required for the regulatory decisions after a serious adverse drug reactions that impacts the benefit-risk balance. As an illustrative example, a 1-year time saving in regulatory action for a medicine with 1,000,000 users in the EU and an uncommon adverse drug reaction frequency (0.001) at 20% case fatality proportion could potentially prevent 1,000 cases, including 200 deaths.

With regard to environmental impacts, similarly to Option 1, the establishment of extensive digital infrastructure, high volume of data traffic and storage, and manufacturing of digital devices to support research and innovation may lead to digital pollution including some negative environmental impacts. On the other hand, it will also reduce resources required for different processes related to healthcare or policy-making (e.g. travel-related pollution, energy and paper used in refinement of policy measures) and research (e.g. digital pollution from having to replicate processes as additional data becomes available).

6.4.46.4.4    Policy Option 3

This option is expected to have a significant social impact. The action in this option for assessment and use of digital tools should accelerate further organisational change, at a greater speed than in Policy Option 2. The mandatory connection of all healthcare providers would ensure frictionless movement of health data across the EU. The development of digital tools would encourage the advancement of digital healthcare services. As explained, there are substantial societal benefits with the advancement of digital healthcare solutions.

As in Policy Option 2, access to more coherent and granular data on the health of different sub-groups of population will benefit research into targeted prevention and treatment methods. This would in turn broader availability of innovative health products that could improve health outcomes and foster inclusion of neglected groups of citizens through increased knowledge. A higher intensity intervention to a greater extent than in option 2, as explained above can optimise capacity to conduct research and innovate, and improve policy making.

With regard to environmental impacts, this option is expected to have a similar impact to Policy Option 2.

77    How do the options compare? 

Annex 11 provides the comparison of expected impacts for each measure or dimension characterising the assessed options. This dimension-by-dimension comparison is the basis for the overall comparison in this section and the choice in chapter 8 of the best-performing combination of measures for the Preferred Option. Table 7  presents an overview of the ratings of the impacts of each policy option against a series of assessment criteria, covering effectiveness, efficiency, coherence, feasibility, EU added value and proportionality.

Table 7. Overall comparison of policy options.

For efficiency, effectiveness and EU added value, the scores are given on the expected magnitude of impact as explained above: + + + being strongly positive, + + positive, + moderately positive, –/+ neutral, – moderately negative, – – negative and – – strongly negative. For legal/political feasibility and coherence, + means that the assessment is positive, and – means that it is negative.

In terms of the effectiveness in achieving the policy objectives, Option 2 and 3 are the highest-scoring options in comparison with Option 1, mostly as a consequence of their stronger governance system, the establishment of new citizens’ rights and appropriate measures to address health data sharing issues related to interoperability and other aspects and a common legal basis for processing health data for reuse. Option 3 scores higher than Option 2 when it comes fostering a genuine single market for digital health as it includes a more effective mechanism (third party certification for EHR systems and digital health products that are medical devices) to regulate the market of electronic health records and digital health products. The need under Option 3 for third party certification for wellness applications, which do not pursue a medical use, risks erecting too high barriers for SMEs to enter the market, with a subsequent negative effect on the promotion of the uptake of such products across the EU. Therefore, Option 2+ provides a better balance by ensuring trustworthiness on the fulfilment of the mandatory requirements through third party certification for EHR systems and digital health products that are medical devices transmitting data to EHRs, while keeping market entry requirements to the minimum in the wellness applications market with a self-declared quality label. With regards to central governance under option 3, existing EU health-related bodies, such as the ECDC or the EMA have specific mandates in subdomains in health that do not match the transversal nature of the European Health Data Access Body function. Moreover, EMA and ECDC do not have the necessary skills and capacity to deal with primary use of health data and interoperability, which makes the re-use of an existing agency for primary and secondary use of health data an unfeasible option. At the same time, creating a new EU body would require a large investment (over EUR 300 million over 10 years) making this option cost-inefficient. In addition, such an approach and the setting up of a new EU body is unlikely to get the needed political support with the co-legislators. Therefore, option 2 with reinforced cooperation through expert groups remains the best performing option.

Option 1 would generally have a very limited impact on achieving the objectives on primary and secondary uses of health data, particularly when it comes to completing the deployment of the necessary digital infrastructures. The combination of the infrastructures for primary and secondary uses does not seem to be a feasible option, given its technical complexity and the fact that actors involved and purposes are different CLXXXI . While voluntary participation and guidelines could help improve the practical implementation initiative among the Member States participating, measures under Option 1 remain non-binding and their outcomes are highly dependent on the willingness of Member States to follow guidelines and adapt national (and regional) legal, technological and organisational frameworks. Given the poor results demonstrated by such an approach in the Evaluation of Article 14 of the CBHC Directive, expectations of achieving the objectives through Policy Option 1 are low.

As regards social impacts, Policy Option 2+ and 3 provide the greatest impacts on the provision of digital health services in general and of cross-border health services in particular, as it strengthens the legal, organisational, semantic and technical interoperability of (digital) health services in the EU. This, in turn, is expected to contribute to the financial sustainability of health systems, in a context of an ageing population, shrinking resources and a likely lack of medical personnel in the next decades. This option has the highest potential to provide access to more coherent and disaggregated health data, reduce research silos and help research and policymaking in providing targeted prevention and treatment methods (also using AI), fostering research and new medical discoveries. The mandatory certification of medical devices that feed data in electronic health records (option 2+), albeit more expensive than a voluntary approach, is the most effective way of ensuring that data which represents essential information of patients can be shared. Other voluntary approaches would allow the manufacturers to opt for proprietary standards, limiting the sharing of data between their devices and own platorms in hospitals, whithout sharing data between different healthcare providers. Policy Option 2 has a positive impact on these aspects as well, albeit to a lower degree due to the less structured governance and lower harmonisation of standards recognition. Policy Option 1, based on voluntary participation and guidelines, will provide a reduced contribution, limited to the number of Member States participating and their willingness to follow common guidelines. Policy Option 1, based on voluntary participation and guidelines, will provide a reduced contribution, limited to the number of Member States participating and their willingness to follow common guidelines.

With the introduction of AI for healthcare, which is dependent on access to health data, the health sector would see great benefits flowing from the increased opportunities for innovation. Through the better functioning of the internal market, this societal value will be further unleashed, while allowing for the necessary measures to protect against discrimination and bias and to promote quality predictions on the basis of high-quality data.

Concerning the impacts on fundamental rights and freedoms, the analysis focussed on the (indirect) effects of the options on the right to freedom of movement and on the protection of privacy and personal data. All the policy options will have positive impacts on these elements because of their support to interoperability and (cross-border) provision of health services, and because they include security features to protect sensitive personal data. Overall, Policy Option 2 and 3 scores higher on fundamental rights and freedoms due to the integration of electronic identification in the system, which is expected to provide further security and rights to individuals in the protection of their personal data (as the option guarantees better harmonised EU standards), with option 3 having a more stringent governance. For secondary uses of health data, both Option 2 and Option 3 are considered to have similar positive impacts, as they both guarantee increased harmonisation and coordination of efforts on the protection of personal data and privacy, with designated national Health Data Access Bodies responsible for supporting such protections.

All policy options are likely to have (limited) environmental impacts, resulting from the improved efficiency of resources and data use, which will translate into a reduction in unnecessary tests and patient hospital visits, and reduce the need for paper documentation (with higher positive impacts for the policy options 3 and 2). On the other hand, digital infrastructures and data centres are energy-intensive, and this aspect may (partially) offset the benefits listed above. Policy Options 2 and 3 are expected to have similar environmental impacts.

On international aspects, option 3, followed by option 2 has the highest chances to impose the EU as a global standard setter. Option 3 would support best the international collaboration. All the options would support EU citizens to access their data in English, facilitating their travel to third countries, but options 2 and 3 would have the highest coverage. Also, options 2 and 3 would support a more uniform approach to third country stakeholders to access to data through data access bodies (but solid authentication of researchers is needed). In general, options 2 and 3 have the highest impact on single market, while option 1 would continue the current fragmentation. In terms of impact on SMEs, option 2 ensures harmonisation and opens new markets for European companies and SMEs, while impacting less on SMEs compared to option 3. Option 1 would fail to address the current fragmentation, with the associated costs for companies and SMEs.

For the efficiency criterion, the analysis focussed on investments, savings and benefits, and impacts on competitiveness and the functioning of the Single Market. All policy options require investments from the Commission and Member States to support the governance systems and the digital infrastructure, and from manufacturers to support the measures on interoperability, data and software quality standards and artificial intelligence. Similarly, the policy options generate compliance costs for the different stakeholders to maintain the governance and digital infrastructure once in place, and to ensure adherence to the standards and requirements for interoperability and quality of digital health products and services (e.g. for setting-up and carrying out labelling and certification schemes, as well as to implement standards compliant with the requirements, which are likely to increase the production costs for manufacturers). The costs are highest in option 3, followed by option 2+/2 and 1.

Investments and compliance costs will generate benefits in terms of cost savings for patients (e.g. moving from traditional medicine to telehealth services that are well connected with the rest of the health digital ecosystem) and patients’ time saved (reducing visits to doctors and hospitals, duplication of tests, etc.). It would support manufacturers enter new markets and would support researchers, innovators, policy makers and regulators have access to more health data easier and at lower prices. The deployment of the measures on the use of health data will impact on EU’s competitiveness and the functioning of the Single Market by reducing the fragmentation of the digital health markets across the EU and the competitiveness of the EU IT sector, and by increasing the volume and quality of health data available for reuse purposes, with positive implications for healthcare provision (including in an emerging domain such as the use of Artificial Intelligence).

In this regard, Option 2 scores highest in terms of efficiency, providing the better balance among investments and costs required to sustain the system, savings and economic benefits for society at large, and competitiveness and the functioning of the EU market. Option 3 is the one requiring the most investments, being the most ambitious in terms of governance, digital infrastructure and interoperability and quality standards. However, Option 3 risks stifling innovation with too resource-intensive requirements for market operators, reducing the availability of niche data sources, lowering their presence on the EHDS, and having a disproportionally adverse impact on smaller dataset owners. Option 1, based on voluntary participation, risks producing benefits only for the participating Member States, widening the existing gaps among Member States in terms of research and technological development competitiveness and ultimately economic growth.

As regards competiveness of the single market, this refers to the actual and potential barriers to entry and exit, the number of companies in the sector, the relative share of the market across companies and the level of profitability. The competitiveness of the single market depends on the degree the EU business sector is able to offer better quality products and services at the same or lower costs compared with business from other geographic areas CLXXXII . Hence, most of the effect on competitiveness depends on the effect of measures on costs structure, productivity and innovation. Option 2 and Option 3 are more coherent with the existing legal framework and policies for data governance, support and supervision of Artificial Intelligence and the protection of personal data. There may be some feasibility issues with these two options, but Option 1, while having fewer feasibility issues, risks hindering the implementation of the EU frameworks on data governance and AI in the domain of digital health.

Finally, concerning coherence, Option 2 and Option 3 are more coherent with the existing legal framework and policies for data governance, support and supervision of Artificial Intelligence and the protection of personal data. Option 3’s stronger governance systems (EU bodies for primary and secondary uses) may generate feasibility concerns, as not all Member States may be likely to agree on proposals, making the decision-making difficult to achieve and slowing EU action in the domain. On the other hand, Option 1, while having fewer feasibility issues, risks hindering the implementation of the EU frameworks on data governance and artificial intelligence in the domain of digital health. Option 2 offers the best balance.

With regards to proportionality and subsidiarity, a number of options were considered in pursuing the Treaty objectives. These options looked at the impacts of both primary and secondary use of data based on a number of indicators including economic, social, environmental, fundamental, rights, SMEs, single market, competitiveness and international. The analysis concluded that the preferred option is Option 2. Option 2 pursues the Treaty objectives aimed to be achieved by this proposal. At the same time, the content and form option 2 shows that in both qualitative and quantitative terms, it better promotes the Union objectives at Union level and does not exceed what is necessary to achieve these objectives. Option 1 provides only marginal improvements the Baseline, which has been shown as highly ineffective by the evaluation of the digital aspects of the CBHC Directive.

88    Preferred option

After the assessment of the effectiveness, efficiency and coherence of the Policy Options for primary and secondary uses of health data, the preferred option for the EHDS is Option 2+. Option 2+ builds upon Option 2 and ensures a strong governance system for primary uses of health data, a mandatory digital infrastructure CLXXXIII encompassing basic cross-border digital health services (the five current health domains of the European Electronic Health Record Exchange Format), with possible additions to provide other cross-border services to citizens and interoperability of healthcare professionals’ registries, and the integration of electronic identification (eID) for healthcare professionals and patients. This option also implement sat a practical level the rights of citizens to control their health data, and enable access to it, irrespective of healthcare provider (public or private) and data source, supported by an obligation of healthcare and technology providers to share the user’s health data with user-selected third parties belonging to the health sector subject to fines charged by data protection authorities. This option provides for mandatory requirements and enforced through third-party certification for EHR systems and digital health products that are medical devices transmitting data to EHRs and voluntary labels for wellness applications. Third-party certification for digital health products and services at EU level is expected to enhance the interoperability of data and thus the availability of quality data for secondary use, contributing to that objective as well. 

Table 8. Estimated distribution per stakeholder of total direct costs and benefits in the Preferred Option (Policy Option 2+) (all costs and benefits are above the baseline and in EUR million).

The preferred option for the EHDS in the area of primary use of health data is visualised in Annex 4. The impact assessment shows that Option 2+ is expected to be highly effective in achieving the policy objectives of the intervention regarding the digital single market in health. Option 2+ is preferred over Option 2 and Option 3, as Option 2+ is slightly less cost-efficient, but highly effective at achieving the objectives (for more details, see overall table on cost-effectiveness in Annex 3), while it promotes the use of health data and of digital health services and products without imposing excessively stringent requirements on market operators for wellness applications. Additionally, Option 2+ is preferred over Option 1, as Option 1 would only provide marginal improvements over the baseline and would fall short of achieving the objectives. Option 2+ is also efficient, requiring a balanced mix of investments from the Member States, the Commission and other stakeholders, while remaining ambitious in terms of governance, digital infrastructure and interoperability and quality standards, and it is also highly promising in terms of impacts on competitiveness and Single Market. Finally, Option 2+ is coherent with the existing legal framework and policies for data governance, support and supervision of AI and protection of personal data.

Regarding secondary uses of health data, the federated governance structure of Option 2 and its measures for promoting interoperability are the most cost-effective. Figure 7 depicts the interplay between the governance frameworks for primary and secondary uses in the context of the EHDS, whereby the expert groups for each subspace prepare the necessary guidelines, requirements and assessments frameworks, liaising where necessary, and delegated or implementing acts are used for binding decision making. The operational implementation is then performed by digital health authorities and Health Data Access Bodies for primary and secondary uses, respectively.

The preferred option for the EHDS in the area of secondary use of health data is visualised in Annex 4.

Figure 7. EHDS Overall governance.

Concerning effectiveness, Option 2+ will ensure a full deployment of the European network of Health Data Access Bodies and a common framework for data discovery, access and processing in health across the EU. Option 2+ provides the best balance between investments and costs required to sustain the system, savings and economic benefits for society at large, unleashing the potential of the health data economy and competitiveness and the functioning of the EU market. Finally, regarding coherence, Option 2+ will grant a high level of coherence with the existing legal framework and policies for data governance, support and supervision of AI and the protection of personal data, as well as with the increasing interest on setting-up systems for supporting access to health data for secondary use across Member States, guaranteeing stronger coordination at EU level. Option 3 is less preferred, for it would introduce a governance mechanism at EU level for which no existing EU body seems to fit. Option 1 is unlikely to achieve the objectives of the EHDS in the area of secondary uses of health data.

The preferred Option 2/2+, for both primary and secondary uses, will yield the best outcomes given that the required investments can be covered largely through EU funds, including EU4Health for specific investments in digital health infrastructure, governance and actions supporting interoperability, Digital Europe Programme for additional actions supporting interoperability and cross-sectorial investments in the European common data spaces (e.g. secure clouds), Horizon Europe for digital health research, as well as the Recovery and Resilience Facility and cohesion funds for national implementation. As a point of reference, investments supported by the EU funds under the 2014-2020 financial cycle included EUR 1 billion for digital health, and the national plans include investments linked to digitisation and modernisation of the health sector of over EUR 12 billion under the Recovery and Resilience Facility.

99    How will actual impacts be monitored and evaluated? 

The evolution and performance of the EHDS wouldneed to be closely monitored to assess how this initiative contributes to the better functioning of the single market in the area of digital health and to more effective and efficient health research, innovation, policy-making and other regulatory activities. The indicators for the monitoring and evaluation framework for the preferred option are described in section 9. The indicators selected for Specific Objective 1 build upon the existing monitoring framework for MyHealth@EU. The Commission will review the indicators periodically and evaluate the impacts of the legislative act after 7 years.

In light of the current challenges to monitor the progress in Member States on digitisation in healthcare, the monitoring and evaluation framework below foresees a series of yearly indicators collected at national level and monitored at EU level. The preferred option foresees a federated approach for governance and for the infrastructure rollout, which would allow for monitoring progress while the system is gradually being implemented.

The bodies responsible for governing the EHDS would compile evidence about the progress and main achievements of this initiative at EU and Member State level. This will help improve the existing services and the uptake and experience of citizens, healthcare providers and professionals, researchers and businesses with digital health. To this end, the responsible authorities at Member State level would be asked to regularly report on the efficiency and impact of the services to be provided through the EHDS. The table below presents the indicators and data sources proposed for the specific objectives of the EHDS.

Table 9. Monitoring and evaluation framework for the preferred option.

End-notes

(I)

As mentioned in the mission-letter-stella-kyriakides_en.pdf (europa.eu)

(II)

The European Commission is building a strong European Health Union, in which all EU countries prepare and respond together to health crises, medical supplies are available, affordable and innovative, and countries work together to improve prevention, treatment and aftercare for diseases such as cancer. In addition to the European Health Data Space, the other pillars are: crisis preparedness and response, Europe’s beating cancer plan and the pharmaceutical strategy for Europe. The new EU4Health financial programme, with a budget of more than EUR 5.3 billion, will go beyond crisis response and provide investments to build stronger and more resilient national healthcare systems.

(III)

Including the following proposals: Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 851/2004 establishing a European Centre for disease prevention and control, Proposal for a Regulation of the European Parliament and of the Council on serious cross-border threats to health and repealing Decision No 1082/2013/EU, Proposal for a Regulation of the European Parliament and of the Council on a reinforced role for the European Medicines Agency in crisis preparedness and management for medicinal products and medical devices.

(IV)

  https://data.consilium.europa.eu/doc/document/ST-13-2020-INIT/en/pdf  

(V)

https://ec.europa.eu/health/ern/covid-19_en

(VI)

Council of the European Union Conclusions (18 December 2020), https://data.consilium.europa.eu/doc/document/ST-14196-2020-INIT/en/pdf

(VII)

  https://www.europarl.europa.eu/doceo/document/TA-8-2019-0083_EN.html  

(VIII)

COM(2020) 66 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52020DC0066  

(IX)

COM/2020/767 final, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52020PC0767

(X)

  https://digital-strategy.ec.europa.eu/en/library/data-act-proposal-regulation-harmonised-rules-fair-access-and-use-data

(XI)

  https://ec.europa.eu/info/sites/default/files/state_of_the_union_2020_letter_of_intent_en.pdf  

(XII)

  state_of_the_union_2020_letter_of_intent_en.pdf (europa.eu)

(XIII)

  soteu_2021_address_en_0.pdf (Europa.eu)

(XIV)

  2021 Commission work programme – key documents | European Commission (europa.eu)

(XV)

C(2008) 3282, available at: EUR-Lex - 32008H0594 - EN - EUR-Lex (europa.eu)

(XVI)

  EUR-Lex - 32011L0024 - EN - EUR-Lex (europa.eu)  

(XVII)

  https://ec.europa.eu/commission/presscorner/detail/en/MEMO_12_959  

(XVIII)

COM(2018) 233 final

(XIX)

  Electronic cross-border health services | Public Health (europa.eu) ; EUR-Lex - 32019D1765 - EN - EUR-Lex (europa.eu)  

(XX)

 Commission Recommendation on European Electronic Health Record Exchange Format Recommendation on a European Electronic Health Record exchange format | Shaping Europe’s digital future (europa.eu)

(XXI)

  EUR-Lex - 32020D1023 - EN - EUR-Lex (europa.eu)

(XXII)

  eHealth and COVID-19 | Public Health (europa.eu)

(XXIII)

Recommendation CM/Rec(2019)2 of the Committee of Ministers to member States on the protection of health-related data, available at: https://search.coe.int/cm/pages/result_details.aspx?objectid=090000168093b26e  

(XXIV)

Recommendation of the OECD Council on Health Data Governance adopted on 13 December 2016, available at: https://www.oecd.org/health/health-systems/Recommendation-of-OECD-Council-on-Health-Data-Governance-Booklet.pdf  

(XXV)

  gs4dhdaa2a9f352b0445bafbc79ca799dce4d.pdf (who.int)

(XXVI)

https://www.digitalhealthindex.org/stateofdigitalhealth19  

(XXVII)

https://www.oecd.org/health/health-systems/Recommendation-of-OECD-Council-on-Health-Data-Governance-Booklet.pdf  

(XXVIII)

In the United States, legislation has been introduced that gives citizens the right to access their health data in an electronic format if it is already stored in such a fashion.

(XXIX)

In this impact assessment, “health data” is used as a term to refer to both personal and non-personal electronic data concerning health and social care.

(XXX)

There are exceptions to this definition. For example, the purpose of personal health data processed in the context of clinical trials is generally research and development, i.e. its primary use is not healthcare. Disease registries have been collected with the primary purpose of research, innovation and policy making.

(XXXI)

Electronic health record, or EHR, refers to collections of longitudinal medical records or similar documentation of an individual, in digital form (source: Commission Recommendation on European Electronic Health Record Exhange Format). An electronic health record system refers to a system for recording, retrieving and manipulating information in electronic health records.

(XXXII)

  https://digital-strategy.ec.europa.eu/en/library/recommendation-european-electronic-health-record-exchange-format  

(XXXIII)

Notable examples such as the Biobanking and Biomolecular Resources Research Infrastructure (BBMRI-ERIC) or the ELIXIR Data Platform https://elixir-europe.org/platforms/data#:~:text=The%20goal%20of%20the%20ELIXIR%20Data%20Platform%20is,within%20a%20coordinated%2C%20scalable%20and%20connected%20data%20ecosystem .

(XXXIV)

As laid down in Regulation 2017/745, a medical device means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more specific medical purposes that may include, for example, the diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease.

(XXXV)

 Lupiáñez-Villanueva, F., Gunderson, L., Vitiello, S., Febrer, N., Folkvord, F., Chabanier, L., Filali, N., Hamonic, R., Achard, E., Couret, H., Arredondo, M. T., Cabrera, M. F., García, R., López, L., Merino, B., Fico, G. (2022). Study on Health Data, Digital Health and Artificial Intelligence in Healthcare, Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/179e7382-b564-11ec-b6f4-01aa75ed71a1/language-en   

(XXXVI)

The technological enablers for digital health include mobile, connected medical devices, edge and cloud computing technologies, artificial intelligence, nano and wearable sensors and actuators, the internet of things, distributed ledger technologies, high-performance computing and high capacity (wireless) internet networks, and are leading to ever-more pervasive software and the growing amount of data collected in health.

(XXXVII)

Literature on health data specifically highlights the relevance of multiple types of health data, including: (i) EHR, which can contain information on symptoms, medical exams, tests, referral patterns, prescriptions and death records as well as pharmacy records, diagnostic procedures, hospitalisations and other healthcare services; (ii) claims data giving indications of the nature of service usage, insurance and other administrative hospital data; (iii) omics data: genomics, transcriptomics, proteomics, epigenomics, metagenomics, metabolomics, nutriomics; (iv) clinical trials data; (v) pharmaceutical data such as pharmacovigilance (medicines safety) data; (vi) social media including web data pertaining to health such as data from patients forums on health topics; (vii) mobile apps, telemedicine and sensor data; (viii) geospatial health data (health data disaggregated by location); (ix) ambient data from ‘smart’ environments (e.g. electricity and gates data on the way people walk which can be used to estimate the occurrence of falling); (x) information on wellbeing, socio-economic, behavioural data; and (xi) other records of relevance to health such as occupational records, sociodemographic profiles or environmental monitoring data such as on pollution.

(XXXVIII)

 Mobile health application refers to a software-based medical device that processes health data on a mobile device and is intended by the manufacturer to be used, alone or in combination, for human beings for one or more specific medical purposes that may include, for example, the diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease. A mobile wellness application distinguishes for not being intended by the manufacturer for a medical purpose and, therefore, not being a medical device itself. A 2019 study published by the Dutch National Institute for Public Health and the Environment analysed the market of mobile health applications in the Netherlands and found that 21% of sampled applications were a medical device (i.e. a mobile health application according to the definition above), while the rest 79% were not (i.e. a wellness mobile application). Study available here: https://www.rivm.nl/publicaties/apps-under-medical-devices-legislation-apps-onder-medische-hulpmiddelen-wetgeving  

(XXXIX)

 Marjanovic, S., Ghiga, I., Yang, M., & Knack, A. (2017). Understanding value in health data ecosystems: A review of current evidence and ways forward. https://www.rand.org/pubs/research_reports/RR1972.html .

(XL)

Article 9 of the GDPR

(XLI)

Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(XLII)

  ev_20151123_co03_en.pdf (europa.eu)

(XLIII)

European Commission, European Interoperability Framework .

(XLIV)

Eurostat, 2018.

(XLV)

 Health Spending Projections to 2030: New results based on a revised OECD methodology, Lorenzoni, L., et al., 2019; OECD Health Working Papers, No. 110, OECD Publishing. https://doi.org/10.1787/5667f23d-en

(XLVI)

McKinsey (2020). Shaping the digital transformation in Europe .

(XLVII)

OECD/EU (2018), Health at a Glance: Europe 2018: State of Health in the EU Cycle, OECD Publishing, Paris. https://doi.org/10.1787/health_glance_eur-2018-en  

(XLVIII)

 Lupiáñez-Villanueva, F., Gunderson, L., Vitiello, S., Febrer, N., Folkvord, F., Chabanier, L., Filali, N., Hamonic, R., Achard, E., Couret, H., Arredondo, M. T., Cabrera, M. F., García, R., López, L., Merino, B., Fico, G. (2022). Study on Health Data, Digital Health and Artificial Intelligence in Healthcare, Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/179e7382-b564-11ec-b6f4-01aa75ed71a1/language-en

(XLIX)

  https://www.oecd.org/health/health-systems/Empowering-Health-Workforce-Digital-Revolution.pdf

(L)

Grand View Research, Electronic Health Records (EHR), Market analysis 2016-2028, base year 2020. Opportunities beyond COVID-19 crisis, Electronic Health Records Market Size Report, 2021-2028 (grandviewresearch.com) .

(LI)

  Electronic Health Records Market Worth $35.1 Billion By 2028 (grandviewresearch.com)

(LII)

Idem

(LIII)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897

(LIV)

 Webb, E., Hernández-Quevedo, C., Williams, G., Scarpetti, G., Reed, S., & Panteli, D. (2021). Providing health services effectively during the first wave of COVID-19: A cross-country comparison on planning services, managing cases, and maintaining essential services. Health Policy (Amsterdam, Netherlands). https://doi.org/10.1016/j.healthpol.2021.04.016  

(LV)

For example, according to the 2021 Country Health Profile for Belgium, the number of teleconsultations in Belgium peaked during the two waves of COVID-19 in 2020, but fell when restrictions were lifted.

(LVI)

European Commission (2018). Market study on telemedicine. Available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/2018_provision_marketstudy_telemedicine_en.pdf

(LVII)

Ibid.

(LVIII)

  https://www.oecd.org/health/tackling-wasteful-spending-on-health-9789264266414-en.htm

(LIX)

  Telemedicine Market Size, Share, Growth & Trends [2020-2027] (fortunebusinessinsights.com)

(LX)

European Commission (2018). Market study on telemedicine. Available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/2018_provision_marketstudy_telemedicine_en.pdf

(LXI)

Ibid.

(LXII)

  Socio-economic impact of mHealth: An assessment report for the European Union (pwc.in)

(LXIII)

Online data code: HLTH_SHA11_HC

(LXIV)

No data available for Malta.

(LXV)

MedTech Europe (2021). The European Medical Technology Industry in figures 2021. Available at: https://www.medtecheurope.org/wp-content/uploads/2021/06/medtech-europe-facts-and-figures-2021.pdf  

(LXVI)

  Devices - EUDAMED (europa.eu)

(LXVII)

  REGULATION (EU) 2017/ 745 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL - of 5 April 2017 - on medical devices, amending Directive 2001/ 83/ EC, Regulation (EC) No 178/ 2002 and Regulation (EC) No 1223/ 2009 and repealing Council Directives 90/ 385/ EEC and 93/ 42/ EEC (europa.eu)

(LXVIII)

  https://www.rivm.nl/publicaties/apps-under-medical-devices-legislation-apps-onder-medische-hulpmiddelen-wetgeving

(LXIX)

  71,000 new health and fitness apps launched in 2020, estimates App Annie report (leisureopportunities.co.uk)  

(LXX)

  Digital Health Trends 2021 - IQVIA

(LXXI)

  Mobile Health & Fitness App Spending Jumped 70% Last Year in Europe to a Record $544 Million (sensortower.com)

(LXXII)

Ibid.

(LXXIII)

Flynn, R., Plueschke, K., Quinten, C., Strassmann, V., Duijnhoven, R. G., Gordillo-Marañon, M., Rueckbeil, M., Cohet, C., & Kurz, X. (2021). Marketing Authorization Applications Made to the European Medicines Agency in 2018–2019: What was the Contribution of Real-World Evidence? Clinical Pharmacology & Therapeutics. https://doi.org/10.1002/cpt.2461  

(LXXIV)

Calculated as a share of the estimated value of data sharing in the EU. For more details, see Annex 5.

(LXXV)

Flynn et al. (2021).

(LXXVI)

Eskola, S. M., Leufkens, H. G. M., Bate, A., De Bruin, M. L., & Gardarsdottir, H. (2021). Use of Real-World Data and Evidence in Drug Development of Medicinal Products Centrally Authorized in Europe in 2018–2019. Clinical Pharmacology & Therapeutics. https://doi.org/10.1002/cpt.2462  

(LXXVII)

Half of them included RWE for the full development phase (48.6%) and for supporting regulatory decisions at the registration (46.8%), whereas over a third (35.1%) included RWE for the early development.

(LXXVIII)

  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(LXXIX)

Regulation (EU) 2018/1725

(LXXX)

Such processing also requires a basis under Article 6 GDPR, like any other processing of personal data, but the specificity of health data is in article 9.

(LXXXI)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897

(LXXXII)

These conditions apply on top of the requirements for lawfulness of processing in Article 6 GDPR.

(LXXXIII)

The Finnish Act on secondary use of health data covers both public and private data holders; in France, the beneficiaries of data obtained through French Data Hub can be public or private entities that carry out research projects of public interest – e.g. that contributes to information concerning health, definition and evaluation of health policies, innovation in the area of health and healthcare etc; FR law forbids to use the health data for marketing towards healthcare providers or patients or to exclude or modify the insurance premia of data subject based on the data obtained from FR Data Hub; the DE law goes further and punishes under criminal law the de-identification of data subjects

(LXXXIV)

Findata, French Data Hub, German Data Lab, Danish and Norwegian data access bodies.

(LXXXV)

E.g. CNIL, in France

(LXXXVI)

 For details, see Page d'accueil | Health Data Hub (health-data-hub.fr) ; Réaliser sa demande d’autorisation auprès de la CNIL | Health Data Hub (health-data-hub.fr) ; Findata ; Data requests - Findata ; Data permits - Findata

(LXXXVII)

  EUR-Lex - 52020PC0767 - EN - EUR-Lex (europa.eu)

(LXXXVIII)

  https://digital-strategy.ec.europa.eu/en/library/data-act-proposal-regulation-harmonised-rules-fair-access-and-use-data  

(LXXXIX)

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0206

(XC)

Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148, COM(2020) 823 final

(XCI)

Evaluation in Annex 12.

(XCII)

Regulation (EU) 2021/953 of the European Parliament and of the Council of 14 June 2021 on a framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, test and recovery certificates (EU Digital COVID Certificate) to facilitate free movement during the COVID-19 pandemic (Text with EEA relevance)

(XCIII)

  https://ec.europa.eu/health/medicinal-products/clinical-trials_en  

(XCIV)

  Medicinal products for rare diseases (‘Orphan medicines’)  ( Regulation (EC) No 141/2000 , Medicinal products for children  ( Regulation (EC) No 1901/2006 , Advanced therapy medicinal products  ( Regulation (EC) No 1394/2007 .

(XCV)

Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 851/2004 establishing a European Centre for disease prevention and control, Proposal for a Regulation of the European Parliament and of the Council on serious cross-border threats to health and repealing Decision No 1082/2013/EU, Proposal for a Regulation of the European Parliament and of the Council on a reinforced role for the European Medicines Agency in crisis preparedness and management for medicinal products and medical devices.

(XCVI)

  https://ec.europa.eu/health/sites/default/files/preparedness_response/docs/hera_2021_propcouncreg_medical-countermeasures_en.pdf

(XCVII)

  https://ec.europa.eu/health/sites/default/files/non_communicable_diseases/docs/eu_cancer-plan_en.pdf  

(XCVIII)

  EU Mission: Cancer | European Commission (europa.eu)

(XCIX)

Deetjen, U (2016). European E-Prescriptions: Benefits and Success Factors. https://www.politics.ox.ac.uk/materials/publications/15224/workingpaperno5ulrikedeetjen.pdf   

(C)

OECD (2019), “Health in the 21st Century: Putting Data to Work for Stronger Health Systems”, OECD Health Policy Studies, Éditions, Paris, https://doi.org/10.1787/e3b23f8e-en (Accessed 06/12/2021).

(CI)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CII)

2.2 Working abroad (europa.eu)

(CIII)

Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CIV)

  Electronic cross-border health services | Public Health (europa.eu)

(CV)

  https://ec.europa.eu/health/sites/default/files/cross_border_care/docs/impl_directive_presciptions_2012_ia_en.pdf

https://ec.europa.eu/health/sites/default/files/cross_border_care/docs/impl_directive_presciptions_2012_ia_summary_en.pdf

(CVI)

 Hansen, J., Wilson, P., Verhoeven, E., Kroneman, M., Kirwan, M., Verheij, R., van Veen, E.-B. (2021). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_en_0.pdf (Annexes available at: https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_annex_en_0.pdf ).

(CVII)

  Recommendation on a European Electronic Health Record exchange format | Shaping Europe’s digital future (europa.eu)

(CVIII)

eHealth Network guidelines to EU Member States and the European Commission on an interoperable eco-system for digital health and investment programmes for a new/updated generation of digital infrastructure in Europe ev_20190611_co922_en.pdf (europa.eu)

(CIX)

Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CX)

Evaluation in Annex 12.

(CXI)

  https://www.hiqa.ie/sites/default/files/2018-05/ePrescribing-An-Intl-Review.pdf  

(CXII)

 Deetjen European E-Prescriptions: Benefits and Success Factors [Online]. Available from https://www.politics.ox.ac.uk/materials/publications/15224/workingpaperno5ulrikedeetjen.pdf    

(CXIII)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CXIV)

Ibid.

(CXV)

Ibid.

(CXVI)

  BfArM - Digital Health Applications (DiGA)

(CXVII)

  Validation pyramid - mHealthBELGIUM

(CXVIII)

 Lupiáñez-Villanueva, F., Gunderson, L., Vitiello, S., Febrer, N., Folkvord, F., Chabanier, L., Filali, N., Hamonic, R., Achard, E., Couret, H., Arredondo, M. T., Cabrera, M. F., García, R., López, L., Merino, B., Fico, G. (2022). Study on Health Data, Digital Health and Artificial Intelligence in Healthcare, Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/179e7382-b564-11ec-b6f4-01aa75ed71a1/language-en

(CXIX)

  Validation pyramid - mHealthBELGIUM

(CXX)

  2013-19020.pdf (govinfo.gov) , Medical-Device-Fact-Sheet-09FEB11.pdf (nist.gov)

(CXXI)

  mHealth label published | Shaping Europe’s digital future (europa.eu)

(CXXII)

  https://www.bfarm.de/EN/Medical-devices/Tasks/Digital-Health-Applications/_node.html (acccessed on 01/12/2021).

(CXXIII)

  https://www.medtecheurope.org/wp-content/uploads/2021/11/2111_v4.8_mte_dht_reimbursement16.11.2021-2.pdf  

(CXXIV)

It is difficult to estimate the size of the European market for mobile health applications, but according to the IQVIA Institute ( Digital Health Trends 2021 - IQVIA ) the volume of health-related mobile applications would have surpassed 350,000 globally in 2021. Assuming a European share that is proportional to the share in the global medical devices market (27.5%), there could be almost 100,000 mobile health applications in the European mobile health applications market.

(CXXV)

 Hansen, J., Wilson, P., Verhoeven, E., Kroneman, M., Kirwan, M., Verheij, R., van Veen, E.-B. (2021). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_en_0.pdf (Annexes available at: https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_annex_en_0.pdf ).

(CXXVI)

  https://tehdas.eu/app/uploads/2021/11/tehdas-citizens-perception-of-and-engagement-with-health-data-secondary-use-and-sharing-in-europe.pdf  

(CXXVII)

Ibid.

(CXXVIII)

https://tehdas.eu/app/uploads/2021/09/tehdas-summary-of-results-case-studies-on-barriers-to-sharing-health-data-2021-09-28.pdf  

(CXXIX)

13 Member States as using some form of centralised data governance organisation (BG, DK, DE, IE, EL, FR, CY, MT, NL, PT, SI, SK and FI). More details, in chapter 7 of the study carried out by Verhoeven, et al. (2021) for the Commission.

(CXXX)

 Hansen, J., Wilson, P., Verhoeven, E., Kroneman, M., Kirwan, M., Verheij, R., van Veen, E.-B. (2021). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_en_0.pdf (Annexes available at: https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_annex_en_0.pdf ).

(CXXXI)

Deloitte (2018), Unlocking R&D productivity, Measuring the return from pharmaceutical innovation 2018, Αvailable at: www2.deloitte.com/content/dam/Deloitte/global/Documents/Life-Sciences-Health

(CXXXII)

Wouters OJ et al, (2020), Estimated R&D investment needed to bring a new medicine to market, 2009-2018. JAMA. 323(9) 844-853.

(CXXXIII)

  https://tehdas.eu/app/uploads/2021/09/tehdas-technical-and-operational-analysis-report-of-existing-data-sharing-initiatives-2021-09-30.pdf  

(CXXXIV)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CXXXV)

Kruse, C. S., Goswamy, R., Raval, Y., & Marawi, S. (2016). Challenges and Opportunities of Big Data in Health Care: A Systematic Review. JMIR medical informatics, 4(4), e38. Available from: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5138448/

(CXXXVI)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CXXXVII)

European Commission (2020). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/sites/health/files/ehealth/docs/ms_rules_health-data_en.pdf (Annexes available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/ms_rules_health-data_annex_en.pdf ).

(CXXXVIII)

 Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CXXXIX)

Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897  

(CXL)

I.e. the probability for a foreign prescription not to be dispensed.

(CXLI)

While there is an indication that issues remain in the provision of cross-border prescriptions, it should be noted that this figure relies on a low response rate of 158 pharmacists across 5 countries

(CXLII)

The cost for visiting a local GP is estimated at EUR 65.77, based on a population-weighted extrapolation of the outpatient/ambulatory activity (2.6 billion consultations in 2019, according to Eurostat) and the total general outpatient curative and specialised outpatient curative care cost (EUR 132.5 billion in 2019, according to Eurostat).

(CXLIII)

The cross-border services for the exchange of ePrescriptions through MyHealth@EU relies on common structured formats and coded data fields, allowing pharmacists to access the necessary information in their own language, through a verified system.

(CXLIV)

Evaluation in Annex 12.

(CXLV)

  https://eithealth.eu/wp-content/uploads/2021/11/EHDS_report.pdf  

(CXLVI)

eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. Lot 1 - Interoperability of Electronic Health Rec

(CXLVII)

https://findata.fi/en

(CXLVIII)

i.e. stored in free text or not coded according to an standardised terminology.

(CXLIX)

DG Health and Food Safety (2019), Assessment of the EU Member States’ rules on health data in the light of GDPR.

(CL)

Arlett, Peter (2020) Workshop, DARWIN EU (Data Analytics and Real World Interrogation Network), European Medicines Agency. Available from: https://www.ema.europa.eu/en/documents/presentation/presentation-proposal-darwin-eu-data-analytics-real-world-interrogation-network-parlett-ema_en.pdf

(CLI)

Data protection issues in cross-border interoperability of Electronic Health Record systems within the European Union, Giorgia Bincoletta, March 2020, published by Cambridge University Press

(CLII)

IACOB, N., & SIMONELLI, F. (2020). Towards a European Health Data Ecosystem. European Journal of Risk Regulation, 11(4), 884-893. doi:10.1017/err.2020.88

(CLIII)

Medical deserts are areas (e.g. certain rural and remote areas) with inadequate or limited access to healthcare services, and many times citizens living in such areas need to travel long distances to receive such services.

(CLIV)

For instance, immediate access to health data in electronic form or portability of inferred data, such as tests

(CLV)

 Hansen, J., Wilson, P., Verhoeven, E., Kroneman, M., Kirwan, M., Verheij, R., van Veen, E.-B. (2021). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_en_0.pdf (Annexes available at: https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_annex_en_0.pdf ). 

(CLVI)

The EEHRxF includes five data domains: patient summaries, ePrescriptions/eDispensations, laboratory reports, medical images and reports, and hospital discharge letters.

(CLVII)

Commission Recommendation on a European Electronic Health Record exchange format C(2019)800 of 6 February 2019 available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.039.01.0018.01.ENG  

(CLVIII)

The right to access one’s health data in electronic format, including those stored by healthcare providers (public or private) is supported completely by 100% of the consumer organisations, completely or to a great extent by 100% on non-EU citizens, 91% of EU citizens, 94% of NGOs, 84% of companies 81% of public authorities and 74% of business associations responding to the public consultation

(CLIX)

The right to transmit one’s heath data in electronic format to another professional/entity of one’s choice is considered as important by 100% of consumer organisations, 100% of non-EU citizesn 89% of NGOs, 86% of companies, 85% of EU citizens, 80% of research institutions, 80% of trade unions, 75% of public authorities and 73% of business associations responding to the public consultation. https://ec.europa.eu/info/sites/default/files/state_of_the_union_2020_letter_of_intent_en.pdf

(CLX)

The penetration of smart phones at EU level is high and increasing (over 86% of population subscribed to mobile services in 2020),

(CLXI)

Commission Recommendation on a European Electronic Health Record exchange format C(2019)800 of 6 February 2019 available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.039.01.0018.01.ENG

(CLXII)

mHealth label published | Shaping Europe’s digital future (europa.eu)

(CLXIII)

Thiel, R., Lupiáñez-Villanueva, F., Deimel, L., Gunderson, L. and Sokolyanskaya A. (2021). eHealth, Interoperability of Health Data and Artificial Intelligence for Health and Care in the EU. https://ec.europa.eu/newsroom/dae/redirection/document/79897

(CLXIV)

For example, the Health Data Hub acts as a single point of contact in France for health data discovery and access request handling and for submission to the French Data Protection Authority (CNIL). However, other entities, such as research hospitals, are also empowered to handle such requests and for submission to the CNIL.

(CLXV)

The detailed overview for the calculations is shown in Annex 5, including the general methodological approach used in the study supporting this impact assessment.

(CLXVI)

This figure relies on the estimated yearly costs for the Commission and Member States for the current cooperation framework in the eHealth Network.

(CLXVII)

See the conclusions of the evaluation of Article 14 in CBHC Directive in Annex 12.

(CLXVIII)

This estimate is calculated on the basis of costs for services (between EUR 0.3-2.5 million per service) under the Connecting Europe Facility Programme and based on input from Member States authorities. More details in Annex 5.

(CLXIX)

https://www.oecd.org/health/health-systems/Empowering-Health-Workforce-Digital-Revolution.pdf

(CLXX)

Calculated as 10% average of duplicated tests for a total of EUR 14 billion per year for examinations requiring Computed Tomography, Magnetic Resonance Imaging and PET scans (Eurostat).

(CLXXI)

Assuming a 4 FTE team per Member State as a lower bound, and a combination of organisational arrangements across the EU (ranging between 4-FTE and 50-FTE entities) for the upper bound.

(CLXXII)

 Lupiáñez-Villanueva, F., Gunderson, L., Vitiello, S., Febrer, N., Folkvord, F., Chabanier, L., Filali, N., Hamonic, R., Achard, E., Couret, H., Arredondo, M. T., Cabrera, M. F., García, R., López, L., Merino, B., Fico, G. (2022). Study on Health Data, Digital Health and Artificial Intelligence in Healthcare, Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/179e7382-b564-11ec-b6f4-01aa75ed71a1/language-en   

(CLXXIII)

Considers, as per the Data Governance Act, a set up cost of EUR 10.6 million and a maintenance costs of EUR 0.6 million yearly.

(CLXXIV)

Arlett, P., Kjær, J., Broich, K., & Cooke, E. (2021). Real-World Evidence in EU Medicines Regulation: Enabling Use and Establishing Value. Clinical Pharmacology & Therapeutics. https://doi.org/10.1002/cpt.2479

(CLXXV)

Data Analysis and Real World Interrogation Network (DARWIN EU) | European Medicines Agency (europa.eu)

(CLXXVI)

European Commission (2018). Market study on telemedicine. Available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/2018_provision_marketstudy_telemedicine_en.pdf  

(CLXXVII)

It assumes that 17 Member States will participate in the network for secondary uses, as cooperation will be on voluntary basis

(CLXXVIII)

Trasys for the European Commission (forthcoming study). A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space.

(CLXXIX)

Monitoring of estimates of effectiveness and whether these are in line with initial authorisation and estimates used for defining value for reimbursement may allow renegotiating prices with considerable savings. Borge FC et al. Monitoring real-life utilization of pembrolizumab in advanced melanoma using the Portuguese National Cancer Registry. Pharmacoepidemiol Drug Saf. 2021;30:342–349. DOI: 10.1002/pds.5163

(CLXXX)

See further and a thorough analysis on these points by Anu Bradford, The Brussels Effect, OUP 2020

(CLXXXI)

Trasys for the European Commission (forthcoming study). A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space.

(CLXXXII)

Voinescu, R. and Moisoiu, C., 2015. Competitiveness, theoretical and policy approaches. Towards a more competitive EU. Procedia Economics and Finance, 22, pp.512-521.

(CLXXXIII)

The digital infrastructure ecosystem architecture for Policy Option 2 is shown in Annex 4.

EUROPEAN COMMISSION

Strasbourg, 3.5.2022

SWD(2022) 131 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT REPORT

Accompanying the document

PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Health Data Space

{COM(2022) 197 final} - {SEC(2022) 196 final} - {SWD(2022) 130 final} - {SWD(2022) 132 final}

Table of contents

Annex 1: Procedural information

1.Lead DG, Decide Planning/CWP references

2.Organisation and timing

3.Consultation of the RSB

4.Evidence, sources and quality

Annex 2: Stakeholder consultation

Annex 3: Who is affected and how?

1.Practical implications of the initiative

2.Summary of costs and benefits

Annex 4: Graphical representation of different elements in the Impact assessment

Annex 5: Methodological approach

1.Sources

2.Discount rate

3.Timeline

4.Baseline scenario

5.Estimation of costs of measures proposed

6.General take-up/participation scenarios

7.Specific assumptions used for measures on primary use of health data

7.1.Governance

7.2.Digital infrastructure

7.3.Data interoperability

7.4.Economic benefits

8.Specific assumptions used for measures on secondary use of health data

8.1.Governance

8.2.Digital infrastructure

8.3.Data interoperability and data quality

8.4.Economic benefits

9.Methodology and assumptions used for the evaluation of the Article 14 of the CBHC Directive (Annex 12)

Annex 6: Coherence with other legislative instruments

Annex 7: List of m-health and telehealth initiatives (legislation, frameworks and certification/labels)

Annex 8: Overview of the GDPR legal basis for processing health data for different purposes

Annex 9: Overview of national bodies dealing with secondary uses of health data

Annex 1: Procedural information

11.    Lead DG, Decide Planning/CWP references

The legislative proposal on the European Health Data Space (EHDS) was prepared under the lead of the Directorate-General for Health and Food Safety. In the DECIDE Planning of the European Commission, the process is referred to under item PLAN/2020/870. The Commission Work Programme for 2021 includes a legislative action for a European Health Data Space.

22.    Organisation and timing

An Inter-Service Steering Group (ISSG) assisted DG Health and Food Safety in the preparation of the Impact Assessment and legal proposal. It included Commission services of Directorate-Generals CNECT, JUST, GROW, JRC, TRADE, EMPL, MOVE, RTD, ECFIN, COMP, REGIO and REFORM, together with the Commission’s Legal Service and Secretariat General.

The ISSG met two times in March 2021 and October 2021. Moreover, the ISSG members have already been consulted regularly via formal written consultations and bilateral discussions. An Inception Impact Assessment was published on 23 December 2020 and was open to feedback from all stakeholders on the Better Regulation Portal for a period of 6 weeks. The public online consultation was launched on 3 May 2021 and closed on 26 July 2021.

The draft Impact Assessment report and all supporting documents were submitted to the Regulatory Scrutiny Board (RSB) on 26 October 2021, in view of a meeting on 24 November 2021. The RSB issued a negative opinion on 26 November 2021. After a re-submission of the Impact Assessment report on 21 December 2021, the RSB issued a positive opinion on 26 January 2022.

33.    Consultation of the RSB

The Impact Assessment report was reviewed by the Regulatory Scrutiny Board. After the first submission, the RSB issued the following findings:

(1)The report is not clear on the coherence with other related initiatives.

(2)The justification of the legal basis is not sufficient and does not reflect the core objectives targeted by the initiative.

(3)The objectives regarding secondary use are not sufficiently specified in their scope. They are not sufficiently clear on the coherence and consistency with the legal principles on the extent of personal data use, set out in related initiatives.

(4)The report is not clear on the issue of data control and consent in the proposed options.

(5)The report does not sufficiently justify the combination of measures in the different options. It does not sufficiently explain the choice of the preferred option.

(6)The report is not clear on how the different groups of stakeholders will be affected by the proposal. Their views are not well reflected throughout the report.

The table below lists the changes in response to the recommendations of the RSB in its first opinion (negative opinion). Besides these modifications, targeted corrections and amendments have been included to address the technical comments provided by the RSB to DG SANTE.

After the second submission, noting that its previous recommendations have been addressed to a large extent, the RSB issued the following finding:

(1)The rationale for having a specific sectoral initiative on health data is not sufficiently explained.

(2)The difference between secondary use and data altruism is not clear and this leads to confusion in the different consent mechanisms.

(3)The report does not sufficiently reflect different stakeholder views.

The table below lists the changes in response to the recommendations of the RSB in its second opinion (positive opinion).

44.    Evidence, sources and quality

This proposal is supported by a number of studies and background documents, in particular:

·A study on the assessment of the EU Member States’ rules on health data in the light of the General Data Protection Regulation 1 ,

·A study on the regulatory gaps to cross-border provision of digital health services and products, including artificial intelligence, and the evaluation of the existing framework for cross-border exchange of health data 2 ;

·A study supporting the impact assessment of policy options for an EU initiative on a European Health Data Space;

·A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space (forthcoming);

·A study on the electronic health record interoperability in the European Union (MonitorEHR) 3 ;

·A study on the use of real-world data (RWD) for research, clinical care, regulatory decision making, health technology assessment, and policy making 4 ;

·A market study on telemedicine 5 ;

·The EDPS preliminary opinion on the EHDS 6 .

Annex 2: Stakeholder consultation

Different stakeholders have been consulted in different phases of the legislative process.

The consultation activities aimed at collecting the views of national public health, digital health and data protection authorities, healthcare providers, healthcare professionals, academic and research institutions, patient associations, economic actors and their professional associations (e.g. health technology industry, digital industry), consumer organisations, NGOs, trade unions and citizens. These stakeholder groups were expected to have important information and insights on:

·the achievements of the provisions on eHealth of the CBHC Directive, any implementation and application problems and their underlying causes and on possible ways forward and their impacts;

·how health data governance mechanisms and structures can best maximise the social and economic benefits of health data usage in the EU, as well as how digital health services and products and AI can deliver greater levels of accessibility, availability, sustainability and affordability of healthcare.

This section provides an overview of the consultation activities carried out as part of the Public Consultation, the Assessment of the EU Member States Rules on health data in light of GDPR, the Study on Health Data, Digital Health and Artificial Intelligence in Healthcare and the Study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space.

1.Public Consultation

The European Commission conducted a Public Consultation (PC) to gather the views of the public on an EU initiative for a EHDS. The purpose of the consultation was to inform the Commission’s work to support the impact assessment on the problems to be tackled, the policy options to be considered and their likely impacts. The consultation was open from 3 May 2021 to 26 July 2021 7 .

382 valid responses to the PC were received and of these respondents, 64 provided additional documentation. EU citizens were the most common type of stakeholders among respondents (26%), followed by non-governmental organisations (NGOs) (21%), academic/research institutions (14%), companies/business organisations (11%), business associations (8%), public authorities (5%), non-EU citizens (2%), trade unions (1%) and consumer organisations (1%). Respondents came from 23 EU Member States and 8 non-EU countries. The most represented country was Belgium 8 (19%), followed by Spain (11%), France (11%), Germany (11%) and Italy (8%).

On the question of fundamental rights, Member States’ positions are rather fragmented, also based on national practices, the status of national debate on the right to privacy and re-use of personal data. Some highlighted the importance of ethics in the re-use of secondary health data and noted that it was too early to determine whether the EHDS would improve privacy. If EHDS would simply be a tool linking already existing datasets, the security of personal data would not be affected. However, if it allowed researchers to access and analyse datasets, personal data security and privacy would be affected, and mechanisms preventing privacy breaches would need to be built into the EHDS’ infrastructure. They further noted that since EHDS2 concerns policy, which can impact the freedom of movement, it is indirectly related to the right of freedom of movement. Other Member States emphasized the need to stick to some key objectives first, with the focus primarily being on delivering trust to European citizens, which implies legislation ensuring data security, as well as a robust infrastructure. Member States expressed specific points with regard to the opt-in vs. opt-out approach to the secondary use of health data, and on the role of National Agencies/Authorities in authorising access. Some Member States advocated for a system where the patient could easily stop the sharing of their data at any time. Although an opt-out system would likely make more data available due to the effort it takes to opt out, it could generate criticism. To avoid unnecessary bureaucracy, no additional ethical clearance should be required when a researcher was already cleared by an ethics committee at his/her institution. A regionalised Member States considered that legislation regarding the authorization to access data should be done at Member State level, as the competences in those matters are currently national. The governance body may therefore have to apply different criteria depending on the Member State where the data come from.

The opinions of Member States on the possible characteristics of the EHDS were different as well. In the view of a federal Member State, it is important that the Member States keep in place their own legislation regarding the privacy of their citizens and that it is respected; legislation should be based on cultural ways of thinking as considers how citizens handle their data. However, EU guidelines or a general framework could be established. In this way, the national and EU legislations could complement each other and address cross-border issues particularly in times of crisis. Other Member States preferred a pluri-disciplinary approach on the main topics, as a wide range of competences will be needed. This involves discussing a clear strategy with all Member States, focusing both on a broad plan of action and technical operations. In Spain’s view, the current model for the governance of the eHealth Network is reasonable since consensus between the Member States is needed in the decision-making process.

Access and use of personal health data for healthcare

The most important objectives that respondents said a European framework on the access and exchange of personal health data should aim included:

·supporting and accelerating research in health (89%), with most support coming from industry (97%), academia (94%) and public authorities (88%)

·promoting citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format (88%), with most support coming from consumer organisations (100%), industry (94%) and EU citizens (85%) and public authorities (93%). The lowest support for this objective is among trade unions (80%) and academic/research institutions (78%).

·facilitating the delivery of healthcare for citizens across borders (83%), with most support coming from consumer organisations (100%), industry (93%) and public authorities (77%)

The most contentious was the objective to promote private initiative. This is supported by industry (88%) and public authorities (63%) but there is less support amongst consumer organisations (67% said not at all) and NGO’s (31% support this objective).

Several rights were deemed important by respondents, including:

·the right to access one's health data in electronic format, including those stored by healthcare providers (public or private) (88%), with most support coming from consumer organisations (100%), NGO’s (94%), EU citizens (91%), companies (86%) trade unions (80%) and public authorities (81%) Lower support was recorded among business associations (74%)

·the right to transmit one's health data in electronic format to another professional/entity of one's choice (84%), with most support coming from consumer organisations (100%), NGO’s (89%) and industry (86%). 85% of EU citizens, 86% of companies and 75% of business associations, 75% of public authorities, 80% of research institutions and trade unions that participated in the public consultation also supported this right.

·the right to request healthcare providers to transmit one's health data in one's electronic health record (83%), with most support coming from consumer organisations (100%), NGO’s (90%) and EU citizens (82%)

·the right to request public healthcare providers to share electronically one's health data with other healthcare providers/entities of one's choice (82%), with most support coming from consumer organisations (100%), NGO’s (87%) and EU citizens (86%)

·60% of trade unions, 73% of companies, 75% of business associations, 71% of public authorities, 54% of EU citizens, 54% of non-EU citizens 61% of NGOs 64% of research institutions and only 25% of consumer organisations participating in the public consultation consider that healthcare professionals should have the right to access to patients’ digital health records and to data pertaining to the patient’s use of digital health products or services.

A more contentious question was regarding whether healthcare providers that fail to provide access to health data in an electronic format and to transmit it to a healthcare provider/entity of their choice are sanctioned or receive a specific fine. There is support for this question from consumer organisations (100%) and EU citizens (69%) but there is less support amongst companies (66%), business associations (46%), and public authorities (31%).

By far, the element that respondents considered the most appropriate for controlling access and sharing one’s health data with healthcare professionals was ensuring the infrastructure or personal digital storage for accessing the data are secure and prevent cyberattacks (90%). The options of accessing one's health data that is exchanged between health professionals or with other entities either:

·via a digital infrastructure (72% support), with most support coming from NGO’s (81%), public authorities (75) and industry (70%), with less support from consumer organisations (25%)

·or via an EU electronic infrastructure (69% support), with most support coming from NGO’s (77%), EU citizens (71%) and industry (70%), with less support from public authorities (43%)

The support for facilitating the cross-border delivery of healthcare should be one of the objectives of a European framework on the access and exchange of personal health data, according to 100% of consumer organisations, 93% of the companies, 84% of business associations, 77% of public authorities, 85% of NGOs, 84% of EU citizens, 82% of research institutions and 40% of trade unions. Most stakeholders found that the EHDS would bring benefits in terms of cross-border access to healthcare, with business associations, companies/business organisations and NGO’s being the most likely to say the impact would be high (76%, 79% and 77% respectively), compared with only 42% of public authorities, and academic/research institutions and EU citizens being the least likely. However, the communication concerning the infrastructure MyHealth@EU should be improved, as only 23% of EU citizens and 43% of non-EU citizens participating in the public consultation were aware about changes concerning data sharing cross border in order to ensure the continuity and access to safe and high-quality healthcare; this was the case for 53% of public authorities, 47% of companies and 50% of consumer organisations.

Regarding mandatory participation in an EU-level infrastructure MyHealth@EU, Member States have different views. Two Member States consider that waiting for perfect coordination of healthcare systems across the EU may take too long, as the differences are too great. Instead, the number of services delivered could be gradually increased over time as more countries connect and the services improve. The EU should therefore incentivise countries to improve their infrastructure, while making participation in the EHDS mandatory, since the directive’s objectives will otherwise never be met. According to the representative of these two Member States, a continuum of healthcare in the EU is necessary to achieve real mobility, and a clear link can be drawn between the EHDS and the EU Resilience and Recovery plans.

Respondents were also asked how standards and technical requirements (e.g. to support the exchange of data in healthcare or to ensure the interoperability of health data exchanges) should be made applicable at national level and across the EU. Overall, respondents believed appropriate measures would be either an access scheme managed by national bodies (a mandatory prior approval by a national authority; 39%) or a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level; 37%) would be appropriate most.

Digital health services and products

Respondents were asked about how to ensure access to, and sharing of, health data nationally and across borders through digital health services and devices.

85% of the business associations participating in the public consultation and 89% of companies consider that EHDS should promote the use of digital health products and services by healthcare professional and citizens, while this opinion is shared by 74% of EU citizens, 76% of public authorities and only 33% of consumer organisations.

Support for minimum standards for tele-health equipments established at EU level reaches 100% among consumer organizations, 75% for trade unions 72% for NGO, 66% for EU citizen, 65% for public authorities, 64% for companies and 36% for business associations participating in the public consultation. Such support for protocols/rules for tele-health established at EU level reaches 75% among consumer organisations, 50% for trade unions, 70% for EU citizens, 65% for public authorities, 60% for research institutions, 59% among companies and business organisations and only 26% for the business associations participating in the public consultation.

Overall, a majority of respondents said that it would be useful if citizens were able to transmit the data from mHealth and telehealth into their electronic health records (77% overall, with most support coming from industry (97%), NGO’s (82%) and EU citizens (76%), public authorities (70%)), or, to a smaller extent, into the EU health data exchange infrastructure (67% overall, with most support coming from industry (88%), trade unions (80%) and NGO’s (71%)). A majority of respondents also said that it would be useful if healthcare professionals could request transmission of the data from prescribed apps and other digital health services into the electronic health records of the patient (68% overall, with most support coming from industry (81%), academia (72%) and NGO’s (71%), public authorities (70%)), or, to a lesser extent, if healthcare professionals had the right to access patients’ digital health records and data pertaining to the patient’s use of digital health products or services (62% overall, with most support coming from industry (75%), public authorities (71%) and academia (64%)).

Overall, respondents believed a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level) (52% overall, with most support from EU citizens (61%) and trade unions (60%) and less support from public authorities (47%) and industry (39%)) would be most appropriate to foster the uptake of digital health products and services at national and EU level. A smaller proportion of respondents said an authorisation scheme managed by national bodies would be appropriate (43% overall, with most support from trade unions (80%), consumer organisations (75%) and less support from NGO’s (40%) and industry (12%)). The option of using a voluntary labelling scheme was the least popular, with least support from NGO’s (9%) and public authorities (18%).

Respondents believed that the most appropriate measure to support reimbursement decisions by national bodies would be a framework where EU funds support/top up cross-border digital health services that comply with interoperability standards and ensure patient control over their health data (71% overall, with most support coming from industry (80%), consumer organisations (75%) and NGO’s (75%)). EU guidelines for reimbursement of digital health products get a 100% support among consumer organisations, 54% among companies, 46% for EU citizens and only 18% for public authorities. Respondents said that other measures would also be appropriate, such as the use of an EU repository of digital health products and services assessed according to EU guidelines to aid national bodies to make reimbursement decisions, or a framework which facilitates reimbursement of all telehealth services (64% overall, with most support coming from consumer organisations (100%), trade unions (80%) and NGO’s (72%), and a more limited 49% support from public authorities).

Mutual recognition across EU for reimbursement purposes is supported by 100% of consumer organisations, 69% of NGOs63% of EU citizens, 75% of companies, 46% of business assoeciations, 36% of public authorities (a similar percentage of authorities opposing it) participating in the public consultation.

When inquired who would be the best suited to develop these standards and technical requirements at EU level to support exchange of data in healthcare, responses were mixed. 40% of respondents in the public consultation believed 'national digital health bodies cooperating at EU level' are best suited to develop standards and technical requirements at EU level to support the exchange of data in healthcare. More than a third of respondents (125 out of 363, 34%) said that 'an EU body' might instead be best suited to do this. There were some differences across stakeholder types, in particular between public authorities (71% in favour of national digital health bodies, and only 12% in favour of an EU body) and companies/business organisations (only 24% in favour of national digital health bodies, but 59% in favour of an EU body).

A relatively large proportion of respondents thought another type of body would be best suited to develop standards and technical requirements at EU level to support the exchange of data in healthcare (93 out of 363, 26%). Among these, some suggested that there should be a combination of both national digital health bodies and an EU body. Several mentioned they believed 'an EU body' might be best suited to develop standards and technical requirements at EU level to support the exchange of data in healthcare, but that this EU body should meet some requirements. For example, it should involve scientific experts with thorough knowledge of diseases, as well as representatives from patient organisations, Member States' national institutions, private sector consortia and academic institutes.

With regards to the costs of complying with standards, across the stakeholder groups, 62% of academic/research institutions and 53% of public authorities expected this cost impact to be high, compared with only 21% of business associations and 23% of companies/business organisations.

A large majority of respondents said they believed access to EU funds for digitalisation in healthcare by Member States should be conditional upon ensuring interoperability with electronic health records and national healthcare systems (81%). Only 8% disagreed, and the rest said they did not know.

Access and use of personal health data for research and innovation, policy-making and regulatory decision-making

Among Member States that participated in the public consultation, some upheld that legislation on data authorization should remain at country level, although it recognized a need for a European body to coordinate authorization with Member States, such that only one procedure would have to be taken by any research institution looking to access a dataset. Others would welcome the creation of a portal for accessing data at EU level, which would not host any data, but would hold the keys to all the datasets stored elsewhere. With the development of a common health data space, more Member States are also planning to set up a national data permit authority. A big Member State in the process of setting up a data access body agreed that having a clear mandate of EU data access rules would be very beneficial, and the EHDS should contain legislation compelling Member States to grant data to researchers in other EU countries. Moreover, algorithms should be trained across countries to ensure sufficient quantity and diversity of data.

Concerning the participation in the EU infrastructure on secondary use of data, the views of Member States were more heterogenous. Some Member States were in favour of mandatory participation in EHDS infrastructure for secondary use, but pointed out that it could also be optional in use, with a seal of quality reassuring citizens about their data’s use. Others underlined that, while some have made progress regarding the establishment of a health data authority, the situation in other Member States may be different as they may not have the same capacity to join. Therefore, making participation mandatory will not necessarily increase progress, and investments should be made into capacity building to bring all countries’ infrastructure to the same level. A federal Member State mentioned that a discussion should also take place on how to ensure that the right technical and organizational measures to ensure maximum data protection are being used while allowing maximum research.

Support decisions by policy-makers and regulators in health as an objective of a European framework on the access and exchange of personal health data should is supported completed or to a great extent by 82% of academic and research organisations, 80% of trade unions, 81% of companies and business associations, 83% of NGOs, 69% of EU citizens, 57% of non-EU citizens, 65% of public authorities and 50% of consumer organisations participation in the public consultation.

The objective of supporting and accelerating research in health is supported by 100% of consumer organisations and non-EU citizens, 83% of EU citizens, 97% of business associations, 95% of companies, 94% of research institutions, 88% of public authorities, 80% of trade unions and 90% of NGOs.

Promoting private initiatives (e.g. for innovation and commercial use) in digital health has received a more mixed support: 88% from business associations that participated in the open publc consultation, 79% of companies, 60% of trade unions, 29% of non EU citizens and 38% of EU citizens, 63% of public authorities, 47% of research institutions, 31% of NGO that participated in the public consultation. 67% of the consumer organisations that participated in the public consultation are against a European framework on the access and exchange of personal health data that would promote private initiatives (e.g. for innovation and commercial use).

Only a small proportion of respondents said a fee would facilitate the sharing of health data held by private stakeholders (20%), while many highlighted the limitations of using this incentive (e.g. difficult to manage, not stimulating enough to share data etc.) and a few said it would have a negative impact (e.g. potentially endangering patient interest by commercialising health data). A federal Member State also highlighted that no profit should be made from the data, however a fee system should control the amount of permissions to be granted to limit the burden on the system and support the sustainability of the system. Moreover, it would support the establishment of a transparency registry where all granted permissions would be published, and of a website showing how the data was used, to enhance public trust. Many respondents said that other types of incentives would facilitate the sharing of health data held by private stakeholders, such as: legal/mandatory obligations, and greater interoperability between systems, databases and registries or a more transparent system for sharing data.

The mechanism that respondents thought most appropriate to facilitate the access to health data for research, innovation, policy-making and regulatory decision was the mandatory appointment of a national body that authorises access to health data by third parties (55%) (deemed more appropriate than the voluntary appointment of such a body), followed by the use of a public body which collects the consent of individuals to share their health data for specified societal uses (“data altruism”) and manages their health data (47%).

Overall, respondents thought additional rules on conditions for access to health data for research, innovation, policy-making and regulatory decision would be needed at EU level, mainly for research purposes, and for policy and regulatory purposes (when asked about health data categories, format, eligibility and security).

The two options that respondents said were most appropriate in facilitating access to health data held by private stakeholders was to have access to health data granted by a national body (rather than by the data holder), either subject to the agreement of data subjects (most support from industry (57%), least support from public authorities (24%)), or in accordance with national law (most support from public authorities (65%), least support from industry (21%)). Only a small proportion of respondents said a fee would facilitate the sharing of health data held by private stakeholders (20%), while many highlighted the limitations of using this incentive (e.g. difficult to manage, not stimulating enough to share data etc.) and a few said it would have a negative impact (e.g. potentially endangering patient interest by commercialising health data). Many respondents said that other types of incentives would facilitate the sharing of health data held by private stakeholders, such as: legal/mandatory obligations, and greater interoperability between systems, databases and registries or a more transparent system for sharing data.

A large majority of respondents said an EU body could facilitate access to health data for research, innovation, policy making and regulatory decisions if it had a number of functions, the most important ones being: setting standards on interoperability together with national bodies dealing with secondary use of health data (87% overall, most support from consumer organisations (100%), NGO’s (92%) and industry (91%)); bringing together the national bodies dealing with secondary use of health data, for decisions in this area (79% overall, most support coming from consumer organisations (100%), NGO’s (89%) and trade unions (80%)); and facilitating cross-border queries to locate relevant datasets in collaboration with national bodies dealing with secondary use of health data (78% overall, most support coming from consumer organisations (100%), NGO’s (87%) and academia (84%)).

Overall, respondents believed the mandatory use of specific technical requirements and standards would be most useful to address interoperability and data quality issues for facilitating cross-border access to health data for research, innovation, policy-making and regulatory decision (67% overall, with most support coming from consumer organisations (100%), academia (82%) and least support from industry (48%)). A smaller proportion of respondents said using an audit, certification or access before participating in EHDS cross-border infrastructure would be appropriate (59% overall, most support coming from EU citizens (75%), consumer organisations (75%) and least support from industry (33%)).

Artificial Intelligence (AI) in healthcare

To facilitate the sharing and use of data sets for the development and testing of AI in healthcare, respondents recommended allowing access to health data by AI manufacturers for the development and testing of AI systems in a secure way (including compliance with GDPR rules), by bodies established within the EHDS (65% overall, with most support coming from industry (82%), trade unions (80%) and public authorities (70%) with least support from consumer organisations (25%)).

A majority of respondents believed the introduction of AI in healthcare is creating a new relationship between the AI system, the healthcare professional and the patient (69%). While some thought this relationship was positive (bringing positive changes such as acceleration and optimisation of care as well as the fostering of research and discoveries), others said this would have downsides (e.g. worsening the level of trust between physicians and patients, or decreasing patient confidence in the solutions proposed).

To ensure collaboration and education between AI developers and healthcare professionals, a large majority of respondents agreed that healthcare professionals and/or providers should demonstrate understanding of the potentials and limitations in using AI systems, including 66% of business associations, 89% of NGOs and 82% of public authorities

2.Assessment of the EU Member States Rules on health data in light of GDPR

The study 9 examined the rules governing the processing of health data, highlighting differences, identifying elements that might affect the cross border exchange of health data and examining potential for EU action to support health data use and reuse. The study was carried out between the end of 2019 and the beginning of 2021.

During the study, 5 workshops took place with Ministries of Health representatives, experts, stakeholder representatives and experts from national data protection offices 10 . A stakeholder survey was also carried out to cross validate and supplement the topics addressed and identified. In total, 543 persons responded to the online survey19% respondents were health professionals, 1% health insurers, 11% healthcare providers, 11% citizens, 15% patient organisations, 15% public administration, 20% scientific research and 1% others.

A number of legal and operational issues need to be addressed to ensure that European healthcare systems can make best possible use of health data. Variations in interpretation of GDPR has led to a fragmented approach which makes cross-border cooperation difficult. Only 52% of respondents consider that it is easy for a patient to access his/her medical records and 42% to obtain a portable copy of their medical record to take to another healthcare provider in the same country (even less, 28% when it comes to sharing with a healthcare provider in another country). 73% of consulted stakeholders believe that having health data in a personal data space or patient portal facilitates the transfer between healthcare providers. There is a high consensus (87%) that lack of data portability drives up costs through repeating testing and examination, slows down time to diagnosis and treatment (84%) and can limit the rights of Europeans to seek care in another EU country (79%). Low interoperability is considered the main cause for preventing data sharing for healthcare provision at national level by 70% of respondents and by 83% between EU countries. 81% of respondents considers that additional measures should be taken at EU level to enforce patients’ control over their own health data and portability of this data, including though legislation (84%).

81% of stakeholders consider that the use of different GDPR legal basis (consent, provision of care, public interest) make it difficult for health related data to be shared for public health purposes between EU countries, 76% agree that such sharing is hampered by differences in datasets and 70% believe that this is also made difficult by datasets scattered over many healthcare providers. 79% believe that epidemiological institutions should have easier and direct access to health data (and 71% for medicine agencies, medical devices and HTA bodies) and 85% consider that EU should support this (80% for medicine agencies, medical devices and HTA bodies). 75% of respondents are convinced that one should facilitate direct reporting of national and regional public health authorities to public health institutions dealing with epidemiological aspects, without going through a reporting cascade. 71% believe that one should set up an EU level system allowing patients to make data available for research without reference to a particular research project (data altruism) and the same percentage believe that such a data altruism system should be also used for pandemics. 71% of respondents believe that the time and interaction costs of gaining access to health data for research are high and 86% plea that EU should support the processing of health data for scientific or historical research or statistical purposes by legislation; 81% suggest that EU should promote the use of the same legal base of sharing health data for research purposes and provide EU level guidance on obtaining the consent from patients for sharing data (86%).

82% of respondents believe that EU should support Member States to put in place structures allowing for secondary use of health data for policy making and research, including by legislation. 79% support a single point of contact for the use of health data for research in all Member States and 80% believe that all single points should be linked at EU level, to support pan-European research. 70% consider that one single point of contact should also be set up at EU level, in addition to national ones. The support for data altruism (make patients data available without reference to a particular research project) is high (72%), for both national and EU level and 78% consider that EU should support Member States to set up structures for managing such systems (78%) or such governance should be set up at EU level (76%). With regards to infrastructure for secondary use of health data, 69% of respondents support a structure linking the one entry points/Health Data Access Bodies of different countries, other research infrastructures and data sources at EU level, slightly ahead of a structure intermediating access to health data (a body where a request for access to existing health data can be put forward and managed) (68%). 58% of respondents consider that such an infrastructure should be set up at the level of an EU agency, followed by an EU committee (43%). Only 4% consider that a common model for health data sharing has no added value.

Action at EU level is supported in several areas: anonymizing/pseudonymising health data (90%); use of open exchange formats (86%), data quality and reliability through the use of standards (90%), health related cybersecurity standards (89%), minimum datasets for data exchange (81%). When it comes to EU action, legislation (67%) is support more than Codes of Conduct put together by representatives of all relevant national authorities (59%) of by a board of stakeholders (59%).

The stakeholder consultations contributed to the identification of future EU level actions in the area of governance, legislation, support for digitalisation, interoperability and digital infrastructures.

3.Study on Health Data, Digital Health and Artificial Intelligence in Healthcare

The study, which was carried out between September 2020 and August 2021, provides evidence needed to enable informed policy making in the areas of digital health products and services, AI, the governance on the use of health data and the evaluation of Article 14 of the CBHC Directive.

The consultation activities included 28 interviews, 9 focus groups and 2 online surveys. Relevant stakeholders identified and contacted were eHealth Network members and coordinators of Joint Actions supporting the eHealth Network and the European Health Data Space; national bodies (Ministries of Health, eHealth agencies, National Medicines Agencies); EU institutions (European Commission, European Medicines Agency, ECDC); patients organisations; healthcare professionals organisations; organisations representing the industry (e.g. medical devices industry) and individual companies (digital industry, pharmaceutical industry, medical devices industry) as well as individual experts (scholars, researcher, etc.).

The stakeholders support measures in a number of areas, ranging from guidance on digital health services and products quality, interoperability, reimbursement, identification and authentication, digital literacy and skills. On primary use, stakeholders support mandating national digital health authorities with tasks to support cross-border provision of digital health and access to health data. In addition, they also support expansion of the services of MyHealth@EU. There is also support for giving patients the right to portability of their electronic health records in an interoperable format.

On secondary use, there is support for the introduction of a legal and governance framework, building on the establishment of Health Data Access Bodies in a number of Member States, with cooperation at EU level through a network or an advisory group. To reduce barriers, there would be support for specifications and standards.

4.Study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space 11

The study, which was carried out between April 2021 and December 2021, aims to present evidence-based insights that will support the impact assessment of options for a European digital health infrastructure. The study identifies, characterises and assesses options for a digital infrastructure, outlines cost-effectiveness, provides data on the expected impacts, both for the primary and the secondary use of health data.

A total of 18 interactive workshops were conducted covering 65 stakeholders who actively engage with health data usage. Their background varies from Ministries of Health, digital health authorities, National Contact Points for eHealth, health data research infrastructures, regulatory agencies, Health Data Access Bodies, healthcare providers, patients and advocacy groups.

In addition, a survey focusing on costs was developed, including questions related to the value, benefits, impact and cost of different options. The objective was to refine the principles and options that were identified during the study. The survey was targeting four stakeholder groups: National Contact Points for eHealth, Digital Health Authorities or Ministries of Health, Health Data Research Infrastructures and EU Health regulatory, surveillance or policy making agencies, and finally national Health Data Access Bodies or access bodies.

The stakeholder consultations were focused on gathered input regarding three key infrastructure options for the infrastructure for primary uses of health data, for secondary uses of health data and for a potential European Health Data Access Body (EHDAB). These options are depicted in the figure below.

Figure 1. Over of infrastructure options.

Option 1 considers extending the current infrastructure for primary uses of health data (MyHealth@EU) with capabilities to support secondary uses of health data. In the figure, the lower plane shows the network of NCPeHs in MyHealth@EU which would also connect Health Data Access Bodies 12 . While this option could facilitate the sustainability of MyHealth@EU, several stakeholders suggested against mixing given the complexity of mixing both networks (primary and secondary), as their functions are inherently different at national level (while NCPeHs act as gateways to synchronously transmit health data across Member States, Health Data Access Bodies have specific functions related to providing access to health data to third parties). Participants indicated that Option 1 is highly complex and possibly unrealistic due to different governance rules, technical requirements/solutions and use cases, and modes of access, privacy and data quality issues and lack of collaboration between NCPeHs and Health Data Access Bodies.

Option 2 considers directly connecting Health Data Access Bodies through a federated (distributed) network at EU level, which would facilitate communication and limit disruption in the existing infrastructure (MyHealth@EU) and would be the preferred option. A total of 45% participants in the consultations stated that Option 2 is the less complex of the three presented options. Specifically, it was considered ‘the most appropriate for public health’, ‘more desirable/preferrable’ and ‘the simpler,’ as it can be established with low deployment costs.

Option 3 would rely on the EHDAB as the central gateway to process multi-country requests and connect national Health Data Access Bodies at EU level. This third option would come at a substantial cost for the EU as it would require the deployment of heavyweight infrastructure centrally. Option 3 was recognised by 29% of participants as the most complex option, although 17% recognised that a European unified framework would reduce local heterogeneity and lead to a more 'harmonised' European digital health data environment with ‘the highest impact for the competitiveness of Europe in the data economy’. In order for this option to function, more regulation, structure and EU governance would be required.

This study also investigated the future development of MyHealth@EU. Regarding this, healthcare professionals attach high importance to services such as patient summaries, ePrescription and critical analysis. For patients, they attach high importance to all services allowing access and sharing of health data. For researchers and policy makers, they attach high importance to services facilitating access to health data for reuse.

Across all participants that took part in the workshops and survey, a total of 24 were asked about the potential implementation challenges they expect in relation to the three presented health infrastructure options. Out of these participants, 16 responded to this question. Overall, the data indicate that the implementation challenges depend on the exact functions and roles associated with each infrastructure option. The biggest challenges identified when attempting to specify a technological infrastructure ecosystem relate to:

·Interoperability: technical, data, and semantic barrier in the use of different classifications, code lists, terminologies and languages.

·Measures and information about quality in the data: data quality and validation are necessary.

·Leveraging existing projects and initiatives: the challenge would be to reuse existing infrastructures, services and structures.

·Legal barriers: variability between EU Member States in the implementation of GDPR, standards on health data sharing, data processing ethical use of data, data transfers.

A number of participants expressed the opinion that anonymised or pseudonymised data could be sufficient to enable health data reuse. However, there are cases where research may need access to identifiable and personal medical data, e.g. where linkages across databases is needed.

Interoperability and the use of common data models and standards are necessary for the reuse of data across datasets. On common data models, users were split between the development of a common data model with refined granularity, lightweight formats and models with clear semantics for data integration or a combined approach.

In relation to when data mapping should occur in the infrastructure, although ‘an upfront exercise would be useful if it is reliably implemented’, it is more realistic to trigger the mapping upon project authorisation or on demand. Mapping all data to the chosen common data model upfront might be complex and time-consuming due to the depth of the mapping and the evolving nature of study needs. Other participants explained that they foresee multiple complementary approaches, such as mapping to a common data model upfront and on-demand mapping as part of the project authorisation. In any case, the common model would need to be agreed upon.

Some participants explained that they expect the data alignment and mapping to be necessary for the research infrastructures working with different national datasets, while others foresee a mixed model with a small, core set of variables being aligned and mapped across Member States and data providers. Other stakeholders see an added value on the data alignment and mapping across Member States for comparability. A few participants expected the EHDS infrastructure to support analytics on identified data to validate/demonstrate the AI model quality. However, ‘ensuring quality would be a major effort’.

In terms of data storage provisions, participants showed preference for a mixed model as ‘the complexity of the data is pushing more towards a federated model where data can stay in place and the code tools can be deployed on co-located infrastructure’. Participants foresee data refreshes, where relevant, and at cases there is a need for both mechanisms but perhaps, as explained, there is no need for active tracking or monitoring for science use-cases.

Actors working on registries or national data access bodies mentioned interoperability as the main challenges, while stakeholders working in the research field and national data access bodies also flagged issues with the measurement and information about data quality. Advocacy groups also mentioned the importance of leveraging existing projects and initiatives, while health data research infrastructures, regulatory, surveillance and policy agencies mentioned legal barriers, such as variations in the implementation of GDPR.

5. Impact Assessment Study

The study, which was carried out between June 2021 and December 2021, aims to present evidence-based insights that will support the impact assessment of options for the EHDS. The study defines and assesses the overall policy options for the EHDS, building upon the evidence gathered in the previous studies.

The study analyses the results of the public consultation (see above), which was open between May and July 2021, and relies on desk research, targeted consultations and qualitative and quantitative analyses of collected data.

Annex 3: Who is affected and how?

51.    Practical implications of the initiative

The planned legislative framework will have a range of practical implications for different stakeholders. In this section, the practical implications for patients, healthcare providers, digital health authorities, researchers and digital health industry are briefly addressed.

There is a wide variety of uses and reuses of health data by different stakeholders that the EHDS could support. Table 1  shows some examples of use cases by different stakeholders.

Table 1. Examples of use cases of use and reuse of health data by different stakeholders.

The initiative will benefit patients, healthcare providers and researchers in a number of ways. Patients will have greater control over their health data, whenever and wherever they want, giving them greater autonomy and freedom to receive care wherever they are. They will be able to grant access to healthcare providers of their choice, giving greater control to patients. Healthcare providers will enjoy enhanced access to health data in an electronic, interoperable format. Healthcare providers will find that they spend less time copying data from different data sources in different formats, saving them a lot of time, thus improving healthcare systems efficiency. Researchers, innovators and policy makers will enjoy enhanced access to health data in a standardised format, with transparency on data quality and with an infrastructure supporting their needs.

Digital health authorities will work towards making their infrastructure and their solutions interoperable across borders. This has practical implications for the design and configuration of their work, which will be impacted by EU-level decision making (binding decision-making through delegated and implementing acts). The digital health authorities will work to expand the services of MyHealth@EU to cover a larger group of end-users. eID requirements will become mandatory and will require digital health authorities to introduce the necessary measures, making it possible to support an ecosystem of trust, where users of digital health solutions can safely grant access to health data.

Member States will be mandated to appoint a national health Data Access Body (DAB), working on the basis of the EHDS mandate and binding decision-making (delegated / implementing acts). Certain categories of health data will be made available through the EHDS legal base, which will make more health data available for re-use for researchers, policy makers, regulators and innovators. The NHDAB will become part of a mandatory federated European infrastructure. Data sources will be required to fulfil a mandatory data quality label and should support algorithm training and validation for certain user groups.