1.Can the Union act? What is the legal basis and competence of the Unions’ intended action?

1.1 Which article(s) of the Treaty are used to support the legislative proposal or policy initiative?

The proposal is based on Article 16 and 114 of the Treaty on the Functioning of the European Union (TFEU). Art. 16 grants competence to the Union to adopt rules concerning the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Art. 114 grants competence to the EU to adopt measures which have as their object the establishment and functioning of the internal market.

1.2 Is the Union competence represented by this Treaty article exclusive, shared or supporting in nature?

The Union shares competence with the Member States in the area of the internal market (Article 114 TFEU) and for data protection (Article 16 TFEU).

Subsidiarity does not apply for policy areas where the Union has exclusive competence as defined in Article 3 TFEU 1 . It is the specific legal basis which determines whether the proposal falls under the subsidiarity control mechanism. Article 4 TFEU 2 sets out the areas where competence is shared between the Union and the Member States. Article 6 TFEU 3 sets out the areas for which the Unions has competence only to support the actions of the Member States.

2.Subsidiarity Principle: Why should the EU act?

2.1Does the proposal fulfil the procedural requirements of Protocol No. 2 4 :

-Has there been a wide consultation before proposing the act?

-Is there a detailed statement with qualitative and, where possible, quantitative indicators allowing an appraisal of whether the action can best be achieved at Union level?

A study on Health Data, Digital Health and Artificial Intelligence in Healthcare, which was carried out between September 2020 and August 2021, provides evidence needed to enable informed policy making in the areas of digital health products and services, artificial intelligence, the governance on the use of health data and the evaluation of Article 14 of the Directive 2011/24/EU. The consultation activities included 28 interviews, 9 focus groups and 2 online surveys. The stakeholders support measures in a number of areas, ranging from guidance on digital health services and products quality, interoperability, reimbursement, identification and authentication, digital literacy and skills. On primary use, stakeholders support mandating national digital health authorities with tasks to support cross-border provision of digital health and access to personal health data. In addition, they also support enlargement of the services of MyHealth@EU. On secondary use, there is support for the introduction of a legal and governance framework and structure, building on the establishment of Health Data Access Bodies in a number of Member States, with cooperation at EU level through a network or an advisory group. To reduce barriers, there would be support for specifications and standards.

Moreover, the overall evaluation of the digital health aspects of the Directive 2011/24/EU, which is attached as an Annex to the EHDS Staff Working Document (SWD), finds that the impact of the Directive has been rather limited in terms of interoperability, and especially secondary use of health data, especially due to the voluntary nature of the eHealth Network actions and limited competences on secondary use. However, the COVID-19 pandemic and EU Digital COVID Certificates 5 shows that a strong legal basis and a common EU approach to use of health data for specific purposes, as well as EU efforts to ensure legal, semantic and technical interoperability, can significantly support the free movement of people and can transform the EU into a global standard setter. A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space, which was carried out between April 2021 and December 2021, aims to present evidence-based insights that will support the impact assessment of options for a European digital health infrastructure. The study identifies, characterises and assesses options for a digital infrastructure, outlines cost-effectiveness, provides data on the expected impacts, both for the primary and the secondary use of health data. A total of 18 interactive workshops were conducted covering 65 stakeholders who actively engage with health data usage. In addition, a survey focusing on costs was developed, including questions related to the value, benefits, impact and cost of different options.

Finally, the Impact Assessment Study, which was carried out between June 2021 and December 2021, aims to present evidence-based insights that will support the impact assessment of options for the EHDS. The study defines and assesses the overall policy options for the EHDS, building upon the evidence gathered in the previous studies. The “public consultation on overcoming cross-border obstacles” also illustrates that individuals face related obstacles in cross-border regions context. More details of these studies are provided in the Annex in the SWD.

The explanatory memorandum of the proposal and the impact assessment contain sections on the principle of subsidiarity that include qualitative indicators allowing an appraisal demonstrating that the action can best be achieved at Union level.

2.2Does the explanatory memorandum (and any impact assessment) accompanying the Commission’s proposal contain an adequate justification regarding the conformity with the principle of subsidiarity?

The current proposal aims to harmonise the data flows in order to support data subjects to benefit from protection and free movement of health data, especially personal data. The proposal does not aim to regulate how the healthcare is being provided nor the digital health services that are being provided by the Member States.

According to the evaluation of the digital aspects of the Directive 2011/24/EU, the current situation of fragmentation, differences and barriers to access and use of personal health data shows that action by Member States alone is not sufficient and may hamper the rapid development and deployment of digital health products and services including AI based ones.

According to the above mentioned study on Regulation (EU) 2016/679 implementation in health sector, despite the fact that the Regulation (EU) 2016/679 provides extensive rights concerning individuals’ access to and transmission of their data, including health data, their practical implementation is frustrated by low interoperability in the healthcare sector, which has been addressed so far mainly through soft law instruments. Such differences in local, regional and national standards and specifications can also prevent producers of digital health services and products to enter new markets, where they need to adapt to new standards. This legislative proposal is thus designed to complement the rights and safeguards provided in the Regulation (EU) 2016/679 in order to achieve in practice its goals.

The same study shows that the extensive use of national derogations under the article 9(4) of the Regulation (EU) 2016/679 created fragmentation and difficulties for accessing data, both at national level and between Member States, impacting on the possibility of researchers, innovators, policy makers and regulators to carry out their tasks at an EU level or to carry out research or innovation, with negative effects on the European economy.

As shown in the impact assessment, the evaluation of Article 14 of the Directive 2011/24/EU shows, the approaches taken so far, consisting of low intensity/soft instruments, such as guidelines and recommendations aimed to support interoperability, have not produced the desired results. Access by individuals to and control of their electronic health data is still limited, and there are significant deficiencies in the interoperability of information systems used in the health domain. Moreover, national approaches in addressing the problems have only limited scope and do not fully address the EU-wide issue: the cross-border exchange of health data is currently still very limited, which is partly explained by the significant diversity in standards applied to health data in different Member States. In many Member States, there are substantial national, regional and local challenges to interoperability and data portability, hampering continuity of care and efficient healthcare systems. Even if health data is available in electronic format, it does not commonly follow the individual when they use services of a different healthcare provider. The EHDS proposal will address these challenges at EU level, providing mechanisms for improving interoperability solutions used at national, regional and local levels and reinforcing the rights of individuals.

Therefore, EU-wide action in the content and form indicated is required to promote cross-border flow of personal health data, foster a genuine internal market for personal health data and digital health products and services.

In addition, evidence from the public consultation shows, there is support for being able to transmit data from mHealth into the EHR systems (77%) and for the introduction of a certification scheme to assess interoperability of digital health products and services (52%). The COVID-19 pandemic and EU Digital COVID Certificates shows that a strong legal basis and a common EU approach.

The current situation of fragmentation, differences and barriers to access and use health data, shows that action by Member States alone is not sufficient and may hamper the rapid development and deployment of digital health products and services and of AI. Furthermore, the analysis on the impacts of different policy options, including economic, social and environmental, international impacts as well as impacts on fundamental rights, single market, competitiveness and SMEs show in both qualitative and quantitative terms that the Union objectives in question can be better achieved at Union level.

2.3Based on the answers to the questions below, can the objectives of the proposed action be achieved sufficiently by the Member States acting alone (necessity for EU action)?

The fragmentation of standards, specifications for electronic health records hampers manufacturers to enter other markets and impact on the free flow of data.

The extensive use of facultative specification clauses under the GDPR at national level created fragmentation and difficulties for accessing data, both at national level and between Member States, impacting on the possibility of researchers, policy makers and regulators to carry out their tasks or to do research or innovation, with negative effects on the European economy.

Additionally, lack of EU action would hamper the free movement of data and consequently hamper citizens’ right under the Treaty and GDPR on data portability. Member States have the ability to structure their systems according their needs. This proposal aims is to ensure that citizens could carry their data and this data can be easily accessible for research. Data organization and governance could vary sometimes depending on the Member State (e.g. federal states may have different structures in place). This proposal will not dismantle these structures.

There are several funds that would be provided to aid the implementation of the planned measures. There was a detailed analysis in the impact assessment of the different possible options in pursuing the Union objectives indicate the content and form of Union action. The options were chosen are the ones that are necessary and proportionate to achiever the set goals.

(a)Are there significant/appreciable transnational/cross-border aspects to the problems being tackled? Have these been quantified?

Different interoperability standards for electronic health record systems impact on free movement of such goods and of healthcare services.

The extensive use of facultative specification clauses under the GDPR at national level created fragmentation and difficulties for accessing data, both at national level and between Member States, impacting on the possibility of researchers, policy makers and regulators to carry out their tasks or to do research or innovation, with negative effects on the European economy. Lack of EU actions would detrimentally impact the free flow of health data, free movement of goods, and hamper cross-healthcare services.

(b)Would national action or the absence of the EU level action conflict with core objectives of the Treaty 6 or significantly damage the interests of other Member States?

National actions erect obstacles to trade that this legislative proposal aims to eliminate hence for example the requirements on harmonization of the rules on electronic health records. Additionally, lack of EU action would hamper the free movement of data and consequently hamper citizens’ right under the Treaty and GDRP on data portability. Moreover, use of data for secondary use (e.g. development of products including AI) are hampered by diversity of national rules.

(c)To what extent do Member States have the ability or possibility to enact appropriate measures?

Member States have the ability to structure their systems according their needs.

(d)How does the problem and its causes (e.g. negative externalities, spill-over effects) vary across the national, regional and local levels of the EU?

Data organization and governance could vary sometimes depending on the Member State (e.g. federal states may have different structures in place).

In addition, manufacturers of digital health services and products face barriers and additional costs such as variable standards or obligations when entering the markets of other Member States, hampering their competitiveness.

-Researchers, innovators, policy-makers and regulators face barriers impeding access to health data with different rules and obligations applicable to the reuse of health data. Also, there are divergent rules and frameworks preventing data holders from easily releasing health data for reuse.

Finally, the wide variety of GDPR legal bases applied by different data holders in different Member States has made cross-country studies very challenging, as data re-users must comply with different requirements in each jurisdiction.

(e)Is the problem widespread across the EU or limited to a few Member States?

The problem of access to health data exists across the whole of the EU.

Available evidence show that when available, electronic health records are often only accessible locally, or at the regional level. Fox example, although electronic health records exist in two-thirds of Member States, by the end of 2020 only 7 Member States offered services (Patient Summary and/or ePrescriptions) on the MyHealth@EU platform. Two thirds of countries detail measures for technical interoperability and exchange measures in their legislative framework and 18 study countries indicate that data sharing of EHRs across national borders is permitted by law. But, only 4 Member States have rules to provide digital access to a copy of the medical record/s for patients affiliated to their healthcare system seeking cross-border healthcare in another Member State.

(f)Are Member States overstretched in achieving the objectives of the planned measure?

There are several funds that would be provided to aid the implementation of the planned measures. The proposal has strong ties with several other actions of the Union in the areas of health and social care, digitisation, research, innovation and fundamental rights. Some obligations will be funded directly from the EU4Health programme and supported further from the Digital Europe Programme. In addition, the Member States can also use other EU funding programmes that will complement EU4Health such as Recovery and Resilience Facility (RRF) and the European Regional Development Fund (ERDF) that will be able to support the connection of Member States to the European infrastructures. Additionally, where physical connectivity is lacking in the health sector, Connecting Europe Facility will also contribute to the development of projects of common interest including in health. The implementation of the objectives and provisions of this Regulation will be complemented by other actions under Digital Europe Programme and Horizon Europe.

(g)How do the views/preferred courses of action of national, regional and local authorities differ across the EU?

There was a detailed analysis in the impact assessment of the different possible options in pursuing the Union objectives indicate the content and form of Union action. The options were chosen are the ones that are necessary and proportionate to achiever the set goals.

2.4Based on the answer to the questions below, can the objectives of the proposed action be better achieved at Union level by reason of scale or effects of that action (EU added value)?

(a)Are there clear benefits from EU level action?

Without EU action, the activities in the area of interoperability will remain voluntary and fragmented, impeding national and cross-border sharing of patients' data. Moreover, the access and portability of data will remain limited and their implementation impeded by technical challenges. On the secondary use of data, the approach will remain fragmented, impacting on the activities of public sector bodies, but also of researchers and industries, as well as on the capacity to carry out cross-border research.

(b)Are there economies of scale? Can the objectives be met more efficiently at EU level (larger benefits per unit cost)? Will the functioning of the internal market be improved?

Digital health services and products are advancing rapidly. The internal market is transforming in the light of new technologies including AI in health. The divergence in rules and standards prevents providers from building economies of scale to offer efficient digital health and care solutions and to support cross-border use of health services. This slows down the provision of digital health services and makes their implementation more costly. Additionally, there are obstacles to free movement of products (electronic health records) due to the varied rules in different Member States. Free movement of data would boost up the internal market and allowed new technologies to be developed and deployed.

(c)What are the benefits in replacing different national policies and rules with a more homogenous policy approach?

National rules governing health data, digital health, services and products is impeding the free movement of goods and services in healthcare. Homogenous rules would ensure that these products and services as well as data would freely move within EU and providing concrete benefits to citizens and stakeholders in these sectors. The citizens will benefit from easier access and sharing of their health data while preserving the security and confidentiality of such data. Health care providers would benefit from easier and timely access to relevant health data from their patients that would save time dedicated to treating them instead of collecting the necessary data to do their work. For reusers of health data, an homogenous framework across the EU in the reuse of health data will promote the inclusion of diverse datasets from numerous countries and will increase the accuracy and the representability of the results reflecting the diversity of the EU population.

(d)Do the benefits of EU-level action outweigh the loss of competence of the Member States and the local and regional authorities (beyond the costs and benefits of acting at national, regional and local levels)?

The loss of competence of Member States is outweighed by the benefits for patients, health care providers and economic operators.

This law would ensure that health data could move freely within the EU for healthcare including telemedicine and other medical services (primary use) as well as for research and development of products (secondary use). In addition, common rules on digital health would eliminate obstacles to trade. These provisions would allow EU citizens to reap the benefits of the advancements of new technologies including AI, new ways of providing healthcare services and would be beneficial to economic operators in these sectors.

(e)Will there be improved legal clarity for those having to implement the legislation?

The proposed law provides a legal framework and these would be followed by delegated, and implementing acts, as well as possibly other specifications under the governance frameworks that is established and possible issuing of common standard on how these requirements could be technically fulfilled. Consequently, there will be legal clarity and a governance structure to further discuss policies.

3. Proportionality: How the EU should act

3.1 Does the explanatory memorandum (and any impact assessment) accompanying the Commission’s proposal contain an adequate justification regarding the proportionality of the proposal and a statement allowing appraisal of the compliance of the proposal with the principle of proportionality?

The initiative seeks to put in place measures that are necessary to achieve the main objectives. The proposal creates an enabling framework that does not go beyond what is necessary to achieve the objectives. It addresses existing barriers to foster the realisation of the potential value of electronic health data. It sets a framework that reduces fragmentation and legal uncertainty. The initiative involves and relies on the work of the national authorities and seeks a strong involvement of relevant stakeholders.

The proposed Regulation will give rise to financial and administrative costs, which are to be borne through the allocation of resources at both Member States and EU level. The impact assessment demonstrates that the preferred policy option brings the best benefits at the least cost. The preferred policy option does not exceed what is necessary to achieve the objectives of the Treaties.

3.2Based on the answers to the questions below and information available from any impact assessment, the explanatory memorandum or other sources, is the proposed action an appropriate way to achieve the intended objectives?

The proposal takes the form of a new Regulation which is considered the most suitable instrument, given the need for a regulatory framework that directly addresses the rights of natural persons and reduces fragmentation in the digital single market. In the preparing the proposal, different national legal contexts that built upon the GDPR by providing national legislation for the primary and the secondary use of health data were carefully analysed. But the conclusions of the impact assessment has shown that there is a need to go beyond the national legislation. In order to prevent major disruption, but also inconsistent future developments, the proposal aims to put forward an initiative that takes into account the main common elements of different frameworks while proposing a coherent and homogenous EU level framework.

(a)Is the initiative limited to those aspects that Member States cannot achieve satisfactorily on their own, and where the Union can do better?

The abundance of data, digitization and advancements in digital health has created diversities among many Member States as Member States adopted varied regulatory measures or lack of measures in ensuring citizen’s rights and free movement. Lack of EU actions would detrimentally impact the free flow of health data, free movement of goods, and hamper cross-healthcare services.

Member States will continue to structure their digital health services according their needs. What this proposal aims is to ensure that citizens could carry their data, data can be easily accessible for research and that electronic health records could be transferred within the EU without any obstacles to trade. The options that were chosen are the ones that allow leeway to the Member States and regions organized their systems on data and digital health services and products and at the same achieve some common rules that would ensure free movement, data portability, access to data in order to allow citizens to reap concrete benefits of this evolution and economic operators have clear rules on their rights and obligations.

(b)Is the form of Union action (choice of instrument) justified, as simple as possible, and coherent with the satisfactory achievement of, and ensuring compliance with the objectives pursued (e.g. choice between regulation, (framework) directive, recommendation, or alternative regulatory methods such as co-legislation, etc.)?

This proposal would provide a legal framework in the form of Regulation imposing necessary and proportionate obligations in ensuring free movement of data, data portability for healthcare, access and use of data for research and development of products, free movement of digital health as the voluntary measures, which is the current regulatory framework has shown a limited effectiveness in supporting patients’ control over their health data at national and cross-border level and very low effectiveness on secondary uses of health data. In addition, the COVID-19 crisis has revealed the need and the high potential for interoperability and harmonisation, building upon existing technical expertise at national level.

(c)Does the Union action leave as much scope for national decision as possible while achieving satisfactorily the objectives set? (e.g. is it possible to limit the European action to minimum standards or use a less stringent policy instrument of approach?)

The proposed Regulation still allows Member States to organize their systems as regards digital health services, data and digital health. For the primary use of health data, each MS will be required to designate a national digital health body. For the secondary use of health data, each MS would be required to ensure that there is a national body entrusted with decision-making powers and tasks in relation to health data access by third parties for secondary use. Ms will still be responsible for the organisation of their healthcare systems (including for instance the reimbursement of healthcare which will still be a national competence, etc)

(d)Does the initiative create financial or administrative cost for the Union, national governments, regional or local authorities, economic operators or citizens? Are these costs commensurate with the objective to be achieved?

The proposed Regulation will give rise to financial and administrative costs. There are important costs for Member States to set up the system but funds will be available to support this transition. These costs are necessary to achieve the objectives of the proposal. The Impact Assessment demonstrates that the preferred Policy Option brings the best benefits at the least cost. The preferred policy option does not exceed what is necessary to achieve the objectives of the Treaties.

(e)While respecting the Union law, have special circumstances applying in individual Member States been taken into account?

Already some Member States have existing governance bodies and infrastructure in collecting, sharing and using data (e.g. in Finland and France). The proposed legal framework build on those existing infrastructures. It creates interoperable structures to allow them to provide even more benefits to research and development of products than they currently provide. Similarly, regarding primary use of data and digital health services the proposed Regulation builds upon existing infrastructure MyHealth@EU and would simplify current complex burdens faced by individuals, provide simple ways for data transfers, building on existing infrastructures and systems.