Health Data: European Commission Proposes new Rules on Access and Use

In May 2022, the European Commission published a proposal to establish a European Health Data Space (“EHDS”). The Commission’s EHDS proposal aims to improve access by individuals to their health data (primary use) and facilitate the re-use of health data for societal good across the European Union (secondary use). The European Commission’s aim is to adopt the EHDS by the end of its current mandate (October 31, 2024). The European Commission expressed its hope that the provisions of the regulation will enter into force across all EU member states in 2025. Businesses operating in the health and pharma sectors should therefore carefully consider how the EHDS might affect them.

If approved, the EHDS proposal would introduce a new regime for the compulsory licensing of health data to third parties. The EHDS could make organisations that hold valuable health data a target of data access applications and/or data requests from data users. Taken together with the broad definition of health data under the proposal, which might include trade secrets and other data protected by intellectual property rights, businesses will be required to understand what health data they possess and consider what measures they need to implement to protect the intellectual property rights in the data.

The following identifies the three main areas covered by the EHDS proposal:

1. Giving individuals more control over their health data:

The proposal would give patients additional access and control rights over their electronic health records free of charge. The regulation would also require organisations handling electronic health data to comply with mandatory interoperability requirements and implement measures to ensure security for electronic health records. In addition, the European Commission would be asked to establish MyHealth@EU, a platform to facilitate the cross-border exchange of electronic health data across the European Union.

2. New self-certification requirements:

The regulation would require economic operators (including manufacturers, importers and distributors) of electronic health record (“EHR”) systems to ensure that the EHR system complies with the requirements in the regulation and bears CE marking. The regulation would also introduce voluntary labeling of wellness applications interoperable with EHR systems and establish a publicly available database of EHR systems and wellness applications.

3. New framework for secondary use of health data:

The EHDS proposal would establish a framework for academic institutions, businesses, policy makers and regulators to get access to anonymised or pseudonymised electronic health data for secondary use directly from the organisation that holds the health data or from a health data access body (a new body to be established in each EU member state).

Under the framework, data holders would be required to make wide categories of health data available for secondary use for one of the permitted purposes. The proposal lists eight permitted purposes, including scientific research related to health or care sectors; development and innovation activities; training, testing, and evaluating algorithms; and providing personalised healthcare. On the other hand, however, the proposal expressly prohibits five secondary uses. These include, among others, the use to take decisions that may be detrimental to a natural person or the use for advertising or marketing. Crucially, the EHDS proposal makes clear that electronic health data which includes intellectual property and trade secrets from businesses should also be made available for secondary use provided that “all measures necessary to preserve the confidentiality of IP rights and trade secrets shall be taken“. It is currently unclear how this obligation would operate in practice.