Life Sciences A to Z - N is for Navigating the EU Health Data Space

Future outlook

The European Health Data Space (EHDS) is poised to revolutionize the way health data is accessed, shared, and utilized across the European Union. It represents a transformative vision for health data in Europe, with the aspiration of creating a robust and secure health data ecosystem with the potential to transform patient care, research, and innovation and ensure health data is leveraged to its fullest potential. However, its successful implementation hinges on addressing various legal challenges and ensuring harmonization with national laws. It is also not clear how organisations from non-European countries will interact with the EHDS. The hope is that by leveraging best practices and fostering a data-driven culture, the full potential of the EHDS will be unlocked to deliver better health outcomes for all European citizens, which will translate into overall global benefit.

The provisional agreement on the EHDS regulation reached by the Council and European Parliament in March 2024 marks a significant milestone, but further work is needed to refine and implement the framework effectively. Continuous dialogue between policymakers, and stakeholders will be essential to ensure that the EHDS remains adaptable and responsive to the dynamic landscape of health data and technology.

Understanding the EHDS regulation and its objectives

The EHDS regulation, proposed by the European Commission in May 2022, seeks to create a unified health data ecosystem across the EU. The EHDS will provide a common framework for the sharing and exchange of quality health data across the EU Member States. Its primary objectives are to empower individuals with greater control over their electronic personal health data, facilitate the free movement of this data across Member States and thus increase cross-border healthcare, foster a genuine single market for electronic health record systems and increase the use of health data for research and development, innovation and policy-making purposes. The European Commission cites the COVID-19 pandemic as a justification for its move towards centralised management and sharing of health data, stressing the importance of life-saving innovative solutions. The idea is that it will allow the EU and its Member States to make full use of the potential offered by safe and secure exchange, use and reuse of health data. The opportunities include more informed policymaking tailored to real public health needs, better identification of individuals for prevention and screening measures, more effective patient monitoring and earlier diagnosis of health incidents and diseases, improved access to clinical trials for patients treated outside of research centres, better and safer pharmaceuticals developed using real-world data and increased access to personalised medicine.

The EHDS will be a horizontal framework that sets out specific rules that apply to the health sector and will build on the requirements under existing EU legislation such as the General Data Protection Regulation (GDPR), the Data Governance Act, the Data Act and the Network and Information Systems Directive. In terms of governance, the EHDS envisages that health data access bodies will be established in each Member State to oversee data sharing and ensure compliance with the regulation. The regulation will distinguish between primary use of data i.e. for direct patient care and secondary use of data i.e. for research, policy-making, and innovation, and sets out specific rules for the sharing and exchange of each usage type. It also includes opt-out rules for each usage type, though it remains to be seen how this would be managed/implemented in practice.

The regulation is expected to be published by the end of this year, following which the implementation and establishment of the EHDS will formally start.

What are the obstacles?

1. Harmonizing national laws, governance and data protection

One of the significant challenges in implementing the EHDS, perhaps even more so than usual with EU regulations, is the need to harmonize national laws with the new framework. Currently, the conditions and processes for accessing health data for secondary use vary significantly between Member States. Some countries have advanced legal frameworks alongside digital health infrastructures, while others lag behind. Key governance issues include ensuring robust data protection and privacy, managing intellectual property rights, and achieving seamless data interoperability. There is a need for clear legal definitions, harmonized guidelines, and collaborative initiatives to align national laws with the EHDS framework. Involving all stakeholders—patients, healthcare professionals, and regional authorities—is critical to building trust and promoting a culture of data sharing. Additionally, the EHDS must align closely with the GDPR to ensure data protection and privacy. Due to the GDPR's allowance for national interpretations of GDPR provisions, such as anonymization and pseudonymization requirements, there is legal variability and inconsistent terminology across Member States. This is already a hurdle faced by industry stakeholders when conducting cross-border research projects, but this variability could also undermine the establishment of a unified governance model and negatively impact the user experience with the EHDS. Additionally, the GDPR's broad categorization of data handlers (i.e. controllers or processors) and failure to differentiate between types of health data impose outdated constraints on research, making harmonized data protection across the EU a significant challenge for EHDS implementation.

2. Honouring the "opt-out"

One of the biggest challenges to the EHDS is going to be ensuring that individual data subjects can appropriately exercise their right to opt-out, while balancing the burden of administering the opt out mechanism from a practical perspective and avoiding losing one of the key benefits that will come from such a huge data set. The European Federation of Pharmaceutical Industries and Associations (EFPIA) has recently published its Position on the opt-out in the EHDS Regulation. EFPIA warns that varying opt-out systems could create significant challenges for both patients and data holders, leading to increased complexity and potential data bias, particularly if large demographic groups opt out. The organization advocates for limiting the opt-out to personal data, excluding pseudonymised and anonymised data, to avoid undue burdens on stakeholders, especially within the healthcare systems. EFPIA strongly recommends a centralized system managed by Health Data Access Bodies (HDABs) to streamline the opt-out process, making it flexible, easy to use, and reversible. A decentralized approach, they argue, would complicate matters by requiring multiple opt-outs across different data holders and datasets, increasing the administrative load and risking conflicts over time. EFPIA also highlights the potential operational challenges, particularly in clinical trials, where reconciling opt-out requests with pseudonymised data could impose significant burdens on healthcare professionals and systems. It is therefore critical to ensure that there is a pragmatic implementation of the EHDS opt-out, balancing individual privacy rights with the needs of the research community.

3. Intellectual property and data ownership

For various stakeholders in this industry, the protection of IP rights in the data that they store and manage is a fundamental concern, and if required to share commercially sensitive data with potential competitors under EHDS there would be significant market distortions within the European Market and potential devaluing of important pipelines for the industry players. There may need to be an agreed interval of time when data is protected, during which key stakeholders (e.g. academic institutions or clinical trial sponsors) retain exclusive access to the data that they have collected, processed or generated which aligns with the existing regulations around regulatory data protection and transparency requirements. EHDS will also need to clearly define the types of datasets that must be shared, who is required to share them and who is eligible to access them.

4. Data quality and interoperability

The quality of electronic health data varies significantly across national health systems, with secondary-use data registries being more standardized than primary-use data. Many countries face challenges with data silos and lack of interoperability. The high cost of generating and processing data to meet the necessary quality standards is a significant barrier, particularly given the decades' worth of legacy data that needs to be standardized. The responsibility and financial burden of data curation often fall disproportionately on data holders, who primarily focus on primary use. Additionally, there are concerns about data equity, as vulnerable groups and older citizens are often underrepresented in datasets, which can lead to biased research outcomes. Empowering patients to collect and share their own data and adopting a phased approach to data quality improvement, starting with self-assessments and progressing to external audits, are suggested solutions as well as implementing EU-wide standards for data collection and interoperability, in consultation with industry and research actors.