European Health Data Space: What clinics need to know

The European Health Data Space (EHDS), which entered into force on 26 March 2025 as Regulation EU 2025/327, introduces binding obligations around data standards, patient rights, and system interoperability for every healthcare provider operating within the EU. The preparation window is already open.

What is the European Health Data Space?

The EHDS is an EU regulatory framework designed to give citizens greater control over their health data and enable the secure, cross-border sharing of that data for care delivery, medical research, and public health policy. As described by the European Commission, it forms a cornerstone of the European Health Union, a broader effort to build resilience and coordination across member states' health systems.

This is a regulation, not a voluntary initiative. It applies directly and uniformly across all EU member states without requiring separate national legislation, and it's built around three core strands: the primary use of health data (giving patients access to and control over their own records), the secondary use of health data (enabling anonymised data to be used for research and policy), and the certification of medical record systems.

Why the EU created the EHDS

Health data across Europe is fragmented, inconsistently formatted, and largely unable to move between systems or across borders. Research published in the European Journal of Public Health confirms what most clinicians already know: EU member states face significant challenges in using health data for secondary purposes, stemming from inconsistent digital health systems and limited capacity for cross-border sharing.

The consequences are concrete. Patients travelling or relocating within the EU can't easily share their medical history with a new provider. Researchers can't access the large, standardised datasets needed to study rare diseases or evaluate treatments at scale. Policymakers lack the data infrastructure to respond effectively to cross-border health threats.

The regulation entered into force in March 2025, but its general application date is 26 March 2027, with phased implementation running through to 2031. A review published in BMC Medical Ethics found that it represents a significant step toward responsible and standardised health data use, while noting that implementation challenges around AI and ethics remain unresolved. No clinic-level obligations apply yet, but starting early will make a real difference to how smoothly clinics navigate the years ahead.

Who the EHDS applies to, and what data it covers

The EHDS applies to all healthcare providers established and operating within the EU. As Skadden's legal briefing confirms, this includes general practices, specialist outpatient clinics, hospitals, private care providers, and independent practitioners. Healthcare providers of all sizes are generally in scope for primary-use obligations, though secondary-use data-holder duties carve out an exemption for micro-enterprises. The key question is simply whether the organisation handles patient health data within the EU.

The data categories in scope, drawn from the official regulation text and supporting legal analyses, include:

• Medical record summaries and patient summaries

• ePrescriptions and medication records

• Medical imaging data and associated reports

• Laboratory test results

• Discharge summaries

• Genomic data (in the context of secondary use)

• Data from medical devices and wellness applications (under certain conditions)

Most clinics will already hold data across several of these categories. Mapping your clinical documentation practices against this list is a good starting point for working out where your obligations lie.

Primary and secondary use: the two pillars of the EHDS

Primary use refers to the use of health data in the direct delivery of care. Under the EHDS, patients gain strengthened rights to access their own health records, share that data with other providers, and carry it across borders. For clinics, this means ensuring patient data is held in formats that can be accessed and transferred in line with the regulation's standards.

Secondary use refers to the controlled use of health data, in anonymised or pseudonymised form, for purposes beyond individual care: medical research, clinical trials, public health surveillance, and policy development. This is governed through a new EU-wide infrastructure called HealthData@EU, supported by national Health Data Access Bodies in each member state. As Stibbe's analysis notes, the secondary use framework opens up real possibilities for data-driven research, but it requires robust governance to ensure data is handled appropriately.

Interoperability requirements and what they mean in practice

One of the most operationally significant aspects of the EHDS is its requirement for common data standards. The regulation mandates the use of the European Electronic Health Record Exchange Format (EEHRxF), which is expected to be built on HL7 FHIR (Fast Healthcare Interoperability Resources), a technical standard for exchanging health data between systems. The exact technical specification is still being finalised through implementing acts due by March 2027.

For clinic administrators, this has practical implications. Your current medical record system may need to be assessed for FHIR compatibility. Medical record systems used within the EU will need to meet certification requirements under the EHDS. And clinics procuring new systems should check that vendors are building toward EHDS-compliant standards.

Don't assume that national-level infrastructure will simply be ready by default. Italy's national health data ecosystem, one of the better-resourced examples in Europe, illustrates the scale of the challenge: even well-funded national systems face significant technical and organisational barriers to EHDS compliance. Research examining EU-funded eHealth interoperability projects preceding the EHDS found that over €200 million in public investment has gone into cross-border interoperability efforts over the past two decades, with mixed results. Drawing lessons from those projects will be essential as member states move toward compliance.

Patient rights under the EHDS, and what that means for your practice

The EHDS significantly expands patients' rights in relation to their health data. Under the regulation, patients have the right to:

• Access a digital copy of their health data, including records held by their clinic

• Share their health data with other providers, including across EU borders, through the MyHealth@EU infrastructure

• Restrict certain secondary uses of their data

• Receive clear information about how their data is being used

For clinic administrators, these rights translate into operational requirements: processes to respond to patient data access requests promptly and compliantly, and staff who understand what data can be shared, with whom, and under what conditions. As research published in Frontiers in Medicine notes, the regulation aims to give citizens meaningful access to their records and a genuine say in how that data is governed, though the European Association of Urology has pointed out that questions about enforcement and practical implementation at the clinic level remain open.

How the EHDS relates to GDPR and other EU regulations

The EHDS adds health-data-specific obligations on top of the existing GDPR framework rather than replacing it. Kennedys Law explains this layering clearly: GDPR compliance remains a baseline requirement, with the EHDS introducing additional requirements around interoperability, patient access, and secondary use governance. Clinics with strong GDPR foundations have a head start, but there's more to do. The EHDS also intersects with the AI Act, the Medical Device Regulation (MDR), and NIS2, the EU's network and information security directive.

There is a genuine tension worth naming here. The Healthy Europe policy analysis highlights that the EHDS's secondary use provisions need to be carefully balanced against GDPR's principles of data minimisation and purpose limitation. Those principles require organisations to collect only the data they need and use it only for the purpose it was collected. This tension isn't fully resolved in the regulation itself, and will likely be worked out through national implementation guidance and decisions by supervisory authorities over time. Clinics should track that space closely rather than assuming the final picture is settled.

Implementation timeline: when clinics need to be ready

The EHDS operates on a phased implementation schedule. Based on the European Commission's official timeline and analysis from EY, the key milestones are:

• 2025: Regulation in force; member states begin establishing Health Data Access Bodies; medical record system certification frameworks begin development

• 2027: General application date and deadline for the Commission to adopt key implementing acts, including the data exchange format

• 2029: Primary-use provisions begin for the first priority categories (patient summaries, ePrescriptions/eDispensations), with patients able to access this data through national MyHealth@EU-connected infrastructure

• 2031: Primary-use scope expands to further categories such as medical images and lab results; secondary-use infrastructure (HealthData@EU) and full implementation expected across all member states

Timelines may vary by member state, and national authorities will issue their own guidance. Covington & Burling advise that organisations should start preparing now, rather than waiting for full regulatory clarity.

What clinic administrators should do now

Full EHDS compliance isn't required immediately across all provisions, but the groundwork needs to start now. The following steps are a practical starting point:

• Audit your current data holdings. Identify what categories of electronic health data your clinic generates, stores, and transmits, and map these against the EHDS data categories in scope.

• Assess your medical record systems. Find out whether your current systems support HL7 FHIR or are on a roadmap toward EHDS-compliant interoperability standards. Ask your vendors directly.

• Review your existing data protection policies, consent processes, and data subject rights procedures to make sure they are current and well-documented.

• Engage your IT and legal teams early. The EHDS has both technical and legal dimensions, and external legal advice may be warranted for complex cases.

• Prepare for patient rights requests. Build or review processes for responding to patient requests for data access and data portability, including cross-border scenarios.

• Monitor national implementation guidance from your health ministry and data protection authority, and sign up for relevant updates.

• Assess staff training needs. Clinical and administrative staff will need to understand the new patient rights framework and how to handle data requests appropriately.

How AI and clinical documentation tools fit into the EHDS landscape

Clinical AI tools, including AI medical assistants that generate or process clinical documentation, intersect with the EHDS in several important ways. These tools handle sensitive health data in real time, and the EHDS's requirements around data standards and security apply to how that data is processed and stored. Data residency is specifically addressed only for secondary-use (research) processing environments. For everyday care-delivery tools, GDPR's rules on transferring data outside the EU apply instead.

The potential upside is real. The European Data Portal's analysis highlights that AI-powered clinical decision support systems trained on anonymised datasets accessed through the EHDS could help clinicians identify rare diseases and personalise treatment. The more pressing concern for most clinics right now is whether the tools they're already using will hold up under the regulation's vendor requirements. The systematic review in BMC Medical Ethics is right to flag that the ethical and practical challenges of integrating AI into the EHDS framework are far from fully resolved, particularly around accountability, transparency, and the risk of algorithmic bias.

For clinic administrators evaluating current or future clinical technology vendors, the EHDS creates a clear due diligence requirement across four areas:

• Data residency: Where is patient data processed and stored? EU data residency is increasingly relevant under both GDPR and the EHDS.

• Interoperability: Can the tool output structured data in EHDS-compatible formats, or does it create isolated data silos that can't connect with other systems?

• Security standards: Does the vendor hold recognised certifications such as ISO 27001? Do their data security and privacy practices meet the encryption and access control requirements set out under the EHDS?

• Medical device status: If the tool qualifies as a medical device under the MDR, separate regulatory obligations apply alongside the EHDS.

As Kennedys Law notes, the EHDS sits alongside the AI Act, MDR, and NIS2 in a layered regulatory environment. Clinics adopting AI-powered documentation tools should make sure their vendors are building with this full regulatory landscape in mind, rather than treating GDPR compliance as the finish line.

Frequently asked questions

▶ What is the European Health Data Space and when does it apply?

Regulation EU 2025/327 entered into force on 26 March 2025 and applies directly across all EU member states without requiring separate national legislation. The general application date is 26 March 2027, with phased obligations running through to 2031. No clinic-level compliance deadlines have passed yet, but preparation time is already running.

▶ Which healthcare providers does the EHDS apply to?

Any organisation that handles patients' electronic health data within the EU is in scope, from a single-GP practice to a large hospital network. Micro-enterprises are carved out of secondary-use data-holder duties, but primary-use obligations apply regardless of size. If you are unsure whether your organisation qualifies as a micro-enterprise, take legal advice before assuming the exemption applies.

▶ What types of health data does the EHDS cover?

Patient summaries, ePrescriptions, medication records, medical imaging data and reports, laboratory results, discharge summaries, genomic data in secondary-use contexts, and data from medical devices and wellness applications under certain conditions. Mapping what your clinic already holds against this list is the most direct way to identify where your obligations start.

▶ What is the difference between primary and secondary use of health data under the EHDS?

Primary use covers data used in direct care delivery. Secondary use covers anonymised or pseudonymised data used for research, clinical trials, public health surveillance, and policy. The practical difference for clinics is that secondary-use obligations include data-holder duties governed through HealthData@EU and national Health Data Access Bodies, which carry their own governance requirements separate from your day-to-day care workflows.

▶ Does the EHDS replace GDPR?

No. GDPR remains the baseline, and the EHDS adds health-data-specific obligations on top of it. One tension worth watching: the EHDS's secondary-use provisions sit uneasily alongside GDPR's data minimisation and purpose-limitation principles, and that tension is not fully resolved in the regulation text. National supervisory authorities will likely work it out through guidance over time, so clinics should track that space.

▶ What are the key interoperability requirements clinics need to know about?

The EHDS mandates the European Electronic Health Record Exchange Format, expected to be built on HL7 FHIR, with the exact technical specification due through implementing acts by March 2027. Ask your medical record system vendor now whether they support FHIR or have it on their roadmap, and factor EHDS certification requirements into any procurement decisions before that deadline arrives.

▶ What new rights do patients have under the EHDS?

Patients gain the right to access a digital copy of their records, share data with providers across EU borders through MyHealth@EU, restrict certain secondary uses, and receive clear information about how their data is used. The European Association of Urology has flagged that enforcement and clinic-level implementation details remain open questions, so watch for national guidance on how these rights will work in practice.

▶ What are the key implementation deadlines for clinics?

2025: regulation in force, Health Data Access Bodies being established. 2027: general application date, key implementing acts due. 2029: primary-use provisions begin for patient summaries and ePrescriptions. 2031: scope expands to medical images and lab results, full secondary-use infrastructure expected. Member states may move at different speeds, so national health ministry communications matter as much as EU-level milestones.

▶ What should clinic administrators be doing now to prepare for the EHDS?

Audit your data holdings against the EHDS categories, ask your medical record system vendor about FHIR compatibility, review your GDPR compliance baseline, and build processes for patient data access and portability requests. Engage IT and legal teams early. Covington and Burling advise starting now rather than waiting for full regulatory clarity, and the phased timeline means early groundwork will compound.

▶ How does the EHDS affect clinics using AI clinical documentation tools?

Tools that generate or process clinical documentation handle sensitive health data in real time, so vendor due diligence now has a clear regulatory basis. Check where patient data is processed and stored, whether outputs can be structured in EHDS-compatible formats, whether the vendor holds ISO 27001 certification, and whether the tool qualifies as a medical device under the Medical Device Regulation. Each of these carries distinct obligations under the layered EU regulatory environment.