European Health Data Space (EHDS)

Purpose: The EHDS establishes clear rules on the secure exchange, use and reuse of health data to improve healthcare, research, innovation and policymaking. Its key objectives include:

• increasing digital access to and control over electronic personal health data, at both the national level and EU level, by introducing MyHealth@EU, a cross-border health data infrastructure for individuals in the EU (primary use of data)
• fostering a single market for electronic health record systems (EHR systems), relevant medical devices and high-risk AI systems
• providing a consistent and efficient system for using health data in research, innovation and regulatory activities (secondary use of data)

By establishing uniform standards among European countries, the Regulation simplifies data sharing between healthcare providers, significantly benefiting cross-border healthcare services.

Impact on Norway: Norway and Norwegian businesses must comply with the EHDS once the regulation is incorporated into the EEA Agreement and implemented in national law. With the Regulation, Norway is required to implement a digital health authority that enforces and supervises the provisions of the Regulation.

The EHDS is expected to drive innovation and development in medical research and digital health solutions, by providing Norwegian companies with access to a wider range of health data.

To align with the Regulation, the Norwegian health legislation will require amendments, such as in the Patient Records Act (Pasientjournalloven).

Scope: The Regulation applies to companies that manufacture and supply EHR systems and other software that processes electronic health data. It is also highly relevant for pharmaceutical companies and other health sector innovators.

The rights and obligations established by the EHDS extend to regulators and policymakers in the EU and EEA, as well as individuals across Europe, and it facilitates access to relevant health data in registries, apps and electronic medical devices, and health records.

Core obligations:

The EHDS establishes requirements for regulatory bodies, healthcare professionals and companies in the health care sector. Key obligations include:

• Compliance with the European EHR exchange format – all EHR systems must adhere to this format to enable seamless cross-border health data exchange, including integration with MyHealth@EU
• Ensuring the necessary CE marking on EHR systems
• Transparency in technical documentation – Companies must disclose limitations in interoperability and security of EHR systems
• Information obligations – Healthcare providers must
  • Provide free and immediate access to priority categories of health data and provide access logs information for at least three years
  • Include details on the healthcare provider who accessed the data, the date and time of access and which personal health data was accessed
• Market oversight and enforcement – Non-compliance with EHDS may result in administrative fines and liability for damages