European Health Data Space – a game-changer in European healthcare
The European Health Data Space (EHDS) represents a major step forward in how health data can be accessed, shared, and (re)used across member states of the European Union. Today the European Health Data Space regulation was celebrated with a launch event by the European Commission in Brussels, starting a new era for health data sharing across the European Union. Luxembourg is on top of these developments and has chartered the relevant organisations to start the preparations towards the implementation of this regulation.
The need of a European-wide data sharing was highlighted and initiated by the challenges of the COVID-19 pandemic. Citizens moving across borders during this time, posed a need for cross-border data sharing. The first step towards the establishment of the European Health Data Space (EHDS), came last year, with the approval of the provisional agreement of the EHDS, EU Parliament. The EHDS Regulation (EU 2025/327) was officially published on 5 March 2025, and will come into force on the 25 March 2025. This new regulation aims to harmonise electronic health data both internally and across the different member states, improving data access across borders for citizens, and enabling improved possibilities for research and innovation.
Member States are now preparing to implement a harmonised framework that facilitates secure and ethical data sharing while upholding strong privacy protections. In this article we address implications of the implementation of the EHDS, notably focussing on the reuse of health data for research and innovation.
Better Healthcare, More Innovation, and Stronger Patient Rights Across Europe
One of the main driving forces of the EHDS is to allow citizens a free movement of their own health data across borders of the EU. Thanks to this new European legislation, citizens will soon be able to use healthcare services across the EU and can rely on their data being accessible by their doctors securely and whenever needed.
Another important goal of the EHDS is to make health research and innovation easier, and to allow countries to learn from each other for better policymaking in the health system. By enabling the secure and responsible use of health data, it is possible to improve healthcare and hence benefit the citizens and society. In a nutshell, this game-changer for healthcare in Europe makes health data secure, useful, and patient-centred — helping everyone, from individual patients to entire healthcare systems.
EHDS – unlocking the potential of health data
With the implementation of the EHDS comes numerous opportunities for data reuse. Notably, the EHDS has the potential to unlock previously unavailable data and therefore strengthen access to data for research and innovation, public health monitoring, and evidence-based policymaking. Data will be made available through structured and secure access procedures, with strict privacy protections.
For researchers, innovators and industry representatives, the EHDS will allow access to large-scale health data from all Member States, to drive scientific breakthroughs, medical innovation and applied research. EHDS promises to provide research-ready health data more efficiently and more affordably. With better research possibilities, comes the potential for more innovation and higher societal impact, such as accelerating medical innovation, improving disease prevention strategies. For businesses, standardised digital health records make it easier to launch new products into more EU countries.
For policymakers, the EHDS brings the opportunity for easier and more cost-effective access to health data for public health improvements. With data-driven insights it is possible to improve health policies, healthcare system efficiency and patient safety.
Preparations for reuse of data
To manage the reuse, or secondary use, of data under EHDS effectively, each Member State of the EU will establish or designate one or more Health Data Access Body/-ies (HDAB) by March 2027. The role of the Health Data Access Body is to make the suitable data available in a health data catalogue, and accessible through an HDAB managed platform. The HDAB will oversee requests and applications for data access, ensure compliance with ethical and legal frameworks, and maintain transparency in how health data is used. The HDAB will also act as a bridge between data holders and researchers, ensuring that health data is made available in a structured, secure, and high-quality format. If a member state opts for several HDABs, a coordinating HDAB will be assigned to control and collate the activities. The coordinating HDAB will notably monitor cross-border data sharing and exchange metadata, requests and application process with the central service at the EU level. Luxembourg intends to align these processes as much as possible with the general law proposal on the reuse of data (projet de loi 8395) and the assignment of the HDAB(s) remains to be decided at a later stage.
Ensuring compliance, transparency and privacy in data reuse
When data is used for research, innovation or policy making purposes, utmost measures are taken to ensure confidentiality of the health data. Measures to protect the privacy of patient data include de-identification, using secure computing environments and formal data access procedures. The first step to reusing the data is de-identification, namely removing all direct identifiers from the dataset and hence converting the data to a privacy protected format. This process is also known as pseudonymisation of data, and ensures that the data user cannot identify the origin of the data. Furthermore, the data user needs to follow a formal application procedure, which is reviewed by a national authority (i.e. the HDAB or one of the HDABs) for legitimacy and privacy protection before an access to the data (data permit) is granted. And finally, once access is granted, the data user can only analyse the data in a secure computing environment, also known as secure processing environment. This means that data users can only analyse the data under supervision in the designated secure environment, and no personal data can be taken out.
Preparations for implementation of the EHDS for secondary use
The preparations for implementing the EHDS have already started. To support the process, the European Commission has provided funding as Direct Grant to Member States to prepare and develop the services for future HDABs. Luxembourg National Data Service (LNDS) was nominated by the Ministry of Health and Social Security to apply and coordinate this Direct Grant project from the European Commission. This funded four-year project (HDAB-LU) aims to prepare and lay the technical foundations for the future HDABs in Luxembourg. Kicked-off in January 2024, the project will develop the digital business capacities for the future HDABs, including Data Access Application Systems, Health Datasets Metadata Cataloguing, Secure Processing Environments, and Cross-Border Gateways.
A lot of collaboration takes place between the HDAB communities of the Member States. In January 2024, the EU adopted working arrangements and formed Health Data Access Bodies Community of Practice (HDAB-CoP) to facilitate the adoption and implementation of the EHDS for secondary use between the different EU member states. LNDS has been representing the Direct Grant project of Luxembourg in this community.
The HDAB-CoP consists of six subgroups. LNDS chaired two of these subgroups: Subgroup 1 (Data Access Application systems) and Subgroup 2 (Health Datasets Metadata Catalogue and Data Quality and Utility) in the first year and was elected as the rapporteurs of Subgroup 2 and Subgroup 3 (Secure Processing Environments) in the new general assembly. In addition to the HDAB-CoP, Luxembourg – represented by LNDS – has participated in the European wide joint action called TEHDAS2. This “Second Joint Action Towards the European Health Data Space – TEHDAS2“ defines essential guidance towards HDAB implementation, and is a precursor for the essential EHDS implementing acts.
To support the implementation of the EHDS, the European Commission has assembled a document on Frequently Asked Questions on the European Health Data Space.
EHDS implementation and timeline
As with all new large-scale regulations, the EHDS will be rolled out in phases. Member States are responsible for implementing the regulation according to a set of deadlines between two and six years from now. Within the next four years, the government and all organisations affected by the EHDS regulation will prepare the necessary steps, to make health data more accessible, secure, and useful across Europe, for all of us.
For secondary use of data the following key information is to be considered:
– HDABs shall be designated within two years (26.3.2027), and go live within four years (26.3.2029).
– Data exchange shall happen through Secure Processing Environments (SPEs) provided by the HDABs within four to six years from entry into force of the EHDS (26.3.2029-26.3.2031).
Further resources:
Press Release by the Luxembourg Government (in French)
Frequently Asked Questions on the European Health Data Space
Official Journal publication: Regulation – EU – 2025/327