EHTEL is part of a large multi-stakeholder group that represents the entire spectrum of the healthcare ecosystem.
The group consists of 36 European organisations that include patient organisations, medical associations, health research infrastructures, and health industry associations. The group has issued a joint statement to raise alarm bells about the significant legislative shortcomings and uncertainties in the proposed Regulation for a European Health Data Space (EHDS).
In support of the significant legislative work and as follow-up to the stakeholder coalition’s first and second joint statements on the subject, this new statement provides reflections and recommendations to facilitate the resolution of five key challenges that will define the impact of the EHDS and its ability to reach the intended policy goals.
The EHDS must set forth clear and coherent definitions
To ensure legal certainty, the EHDS should clarify certain key definitions and their scope:
- The definition of ‘personal electronic health data’ should be in line with corresponding definitions under the General Data Protection Regulation (GDPR), as well as relevant authoritative interpretations.
- The definition of ‘electronic health data’ should clearly delineate what data falls under its scope, in addition to ‘personal electronic health data’. As the text of the EHDS currently stands, there is legal uncertainty about the definitions of ‘non-personal’ / ‘anonymous electronic health data’.
- The definition of ‘data holder’ should allow clear identification of who falls under its scope and ensure legislative consistency with other EU legal acts.
The EHDS should clarify its interaction with other legal frameworks
The EHDS leaves considerable room for interpretation about its interaction with other legal frameworks (such as the European Union horizontal and sectoral legislation, international legal instruments, or voluntary contractual arrangements). To ensure legal certainty and consistency under EU law, it is important to address critical points in the interaction of the EHDS with the GDPR, Data Governance Act, Data Act, Database Directive, AI Act, Cyber Resilience Act, Medical Devices Regulation, In Vitro Diagnostic Medical Devices Regulation, Clinical Trials Regulation, and other relevant legal acts and legislative proposals.
The EHDS should specify the scope of electronic health data categories for secondary use
The scaling up of the secondary use of electronic health data under a harmonised data governance framework could bring wide-ranging benefits to healthcare-related activities and research in the EU, if the associated risks are eliminated or sufficiently mitigated. In this regard, it is also important to ensure consistency in the use of terminology, as it would lead to uncertainty if the various data categories (Article 33 of the EHDS) were to apply to ‘data’, ‘aggregated data’, ‘electronic data’, ‘health data’, ‘healthcare-related data’, ‘determinants of health’ or ‘electronic health data’, without there being any clear indication about what some of these data categories would entail. It would also cause uncertainty if certain data types were to fall into multiple data categories, but specific provisions would add particular conditions (e.g. aggregated form, opt-out mechanism) to make them available for secondary use. When making available electronic health data from research for secondary use purposes, it is important that those data are scientifically validated, and that it is made clear how this requirement would interact with existing legal safeguards aimed at protecting the scientific or technological potential or interests of researchers and innovators.
The EHDS should avoid excessive data localisation and international health data transfer requirements
It is important to consider the potential consequences of imposing a data localisation requirement in the EHDS, for instance, in terms of its effects on life-saving international health Research & Innovation (R&I) collaborations, pan-European medical registries, conduct of clinical trials or ubiquitous digital health services. In the event that the legislators intend to introduce a data storage requirement for personal electronic health data, then the EHDS must specify the technical conditions for satisfying the requirement, and that the requirement should be without prejudice to the possibility to transfer personal electronic health data in compliance with Chapter V of the GDPR.
The legal avenues provided by Chapter V of the GDPR set the legal bases for international transfers of personal data. If the EHDS were to allow Member States to maintain or introduce further conditions, including limitations for international transfers and access of personal electronic health data, then this would have certain implications. Such implications would contradict the objective of the EHDS ‘to harmonise data flows to support natural persons in benefiting from protection and free movement of electronic health data’, both internally in the EU as well as with trusted third countries, and may even contradict the GDPR. It is essential to avoid an inconsistent and fragmented approach to data transfer throughout the EU that would lead to different degrees of protection of data subjects (paragraph 110 of the 12 July 2022 Joint Opinion of the European Data Protection Board and Supervisor).
Keep stakeholders involved in the EHDS governance
The active engagement of a broad range of stakeholders would facilitate responsible, trustworthy and impactful implementation of the EHDS. The co-legislative procedure has highlighted the complexity of creating the EHDS. Therefore, it is useful to leverage the expertise of stakeholders from across the healthcare ecosystem in the implementation of the EHDS at both EU and national level. The functioning of the EHDS Board could be based on a combination of top-down and multi-stakeholder governance approaches. The EHDS Board could offer a forum to facilitate cooperation and exchange of information among Member States and the Commission, while also involving the European Data Protection Board and health technology assessment bodies. The performance of its tasks could be supported by steering subgroups, established by the EHDS, with specific expertise, involving representatives of patients, citizens, health professionals, health researchers and health industrial actors.