The European Health Data Space (EHDS) is an EU regulation that aims to improve citizens’ access to their own electronic health data, promote the secure use of data for purposes such as research and decision-making, and strengthen the interoperability of electronic patient record systems within the EU.
This page offers key information about the EHDS for researchers, data holders, and citizens.
Time left until implementation:
What is the EHDS?
The EHDS harmonises the practices for the secondary use of health data within the EU and enables the secure use of data in research and decision-making.
The European Health Data Space (EHDS) is a regulation of the European Union that establishes a common framework for the use and exchange of health data in EU countries. The aim of the regulation is to strengthen citizens’ rights to their own electronic health data and to enable the secure cross-border secondary use of health data.
The regulation, which entered into force in March 2025, is a key part of the EU’s data strategy and health union. The regulation will not be applied immediately but will be implemented gradually over the coming years. The parts concerning secondary use will begin to apply in March 2029.
Read the EHDS regulation (eur-lex.europa.eu)
Chapter IV addresses secondary use.
Recitals 52–105 provide background information on the parts of the regulation concerning secondary use.
EHDS implementation timeline
EHDS regulation enters into force
The regulation on the European Health Data Space enters into force on 26 March 2025 and the transition period begins. The Commission starts preparing implementing acts.
Issuance of implementing acts
The Commission issues key implementing acts that define how the regulation will be applied in practice. Countries designate authorising bodies (Health Data Access Body).
Application of key provisions on secondary Use
Provisions on secondary use begin to apply to most data categories (e.g. data obtained from electronic health record systems).
Application of all provisions on secondary use
Provisions on secondary use are extended to the remaining data categories (e.g. genomic data).
Accession of non-EU countries
Non-EU countries and international organisations may apply to join the HealthData@EU infrastructure for the secondary use of data.
How does the EHDS differ from the Finnish Secondary Use Act?
The EHDS regulation is similar to the current Finnish Secondary Use Act, but it also introduces changes. The regulation includes partly different purposes of use, some of which are reserved only for public or EU entities. In addition, new operating models will be introduced for processing data requests and permit applications.
Significant differences include, among others:
- Broader data categories, such as biobank materials and data produced by wellness technology.
- Accelerated permit processing for public and EU entities with a statutory task.
- Cross-border applications and integration into the EU’s common HealthData@EU system.
- Transparency requirements for the permit authority, such as the obligation to publish information on applications, decisions, and outcomes.
- The permit authority has the right to impose sanctions if permit holders or data controllers fail to comply with their obligations.
- A quality and utility label, which is required for all materials produced with public funding.
Information for researchers
With the regulation, the secondary use of health data will be regulated more uniformly across the EU, making cross-border research and data integration easier.
The EHDS regulation harmonises the regulation of the secondary use of health data across the EU. This harmonisation will eventually facilitate cross-border research and enable the use of broader, harmonised datasets.
The alignment of rules and practices supports international comparative research and may speed up permit processes. Research data will continue to be used in secure environments, but now regulated at the EU level.
Key considerations for researchers
- The implementing acts are still under preparation and will affect, for example, the execution of cross-border research and the technical requirements of the operating environments.
- No decisions have yet been made regarding national implementation. In Finland, the closest equivalent to the EHDS Health Data Access Body is currently Findata.
- National regulation does not yet include all the requirements set by EHDS. Existing legislation, such as the Secondary Use Act, is undergoing changes.
- The new requirements may introduce more detailed practices regarding data protection and permit processes as national and EU-level regulations are aligned.
Information for data controllers
The European Health Data Space introduces new requirements and opportunities for data controllers, such as wellbeing services counties. In Finland, implementation is still in its early stages, but the impacts are already beginning to take shape.
EHDS increases administrative responsibility, as data controllers must ensure that data processing and disclosure are carried out in accordance with the regulation. This requires updates to systems and processes, as well as investments in interoperability.
Key considerations for data controllers
- Data controllers must prepare for new obligations regarding data management, protection, and disclosure in line with EHDS.
- The regulation requires Member States to develop interoperable information systems and standardised data structures, which may demand significant investments.
- THL (Finnish Institute for Health and Welfare) guides national social and healthcare data management and participates in international cooperation, including cross-border data exchange and the development of standards.
- Reporting obligations will become stricter, and data controllers must be able to monitor and report the secondary use of data more precisely. This has already proven challenging under the national Secondary Use Act.
Information for citizens
The European Health Data Space (EHDS) improves citizens’ ability to manage their own health data and ensures that data can be used securely across the EU, both in healthcare and in research.
In Finland, the secondary use of health data is already regulated by the Secondary Use Act, but EHDS introduces EU-wide, harmonised rules. Together with the General Data Protection Regulation (GDPR) and other EU regulations, EHDS ensures that the secondary use of data is safe, controlled, and respectful of citizens’ privacy.
EHDS brings tangible benefits to citizens across the EU. When health data can be used more smoothly and securely across borders, the efficiency of healthcare and treatment outcomes improve. EHDS supports research, innovation, and evidence-based decision-making, accelerating the development of new treatments and services.
According to estimates, improved access to data could generate savings of up to 11 billion euros over the next decade. At the same time, the digital health market could grow by up to 30 percent, benefiting both patients and the development of the entire healthcare sector.
What purposes does the EHDS cover?
Primary use, meaning the use of a person’s own health data in healthcare.
Secondary use, meaning the use of health data for example in research, statistics, or innovation and development activities.
As in Finland’s Secondary Use Act, the EHDS regulation ensures the security and protection of health data in several ways:
- Limiting purpose of use – data may only be used for purposes permitted by the regulation, such as research or statistics.
- Controlled access – permission to use the data is granted by an authorising body.
- Data minimisation – use is limited to only the data that is strictly necessary.
- Anonymisation and pseudonymisation – data protection is strengthened through technical methods to prevent the identification of individuals.
- Secure data environments – data is processed in technically protected and monitored environments from which personal data cannot be downloaded.
Findata and EHDS
Do you want to join the FinHITS project or keep updated on latest developments? Subscribe to the FinHITS newsletter!
Key focus areas of FinHITS
- Increasing the capabilities of our data access applications management system
- Improving the National dataset catalogue for health data
- Strengthening our secure processing environment for health data
- Building a cross-border gateway to connect with the HealthData@EU infrastructure
- Elevating the quality of health data
Through FinHITS, we are strengthening Finland’s data infrastructure to ensure secure and efficient secondary use of health data. As a result, Finland is ready to integrate seamlessly into the EHDS.
Findata contributes to the TEHDAS2 initiative led by Sitra
The TEHDAS2 project, funded by the European Union and its Member States, is creating concrete guidelines and technical definitions for the cross-border use of health data. The project involves experts from 29 countries and supports the harmonised implementation of EHDS.
TEHDAS2 continues the work of the TEHDAS project carried out between 2021 and 2023, whose recommendations were used by the European Commission in the EHDS regulation proposal in 2022. Sitra coordinates the project, appointed by the Ministry of Social Affairs and Health, and is responsible for the overall project, communication, and reporting.
TEHDAS2 key objectives:
- To develop concrete guidelines and technical definitions for the use of health data.
- To create operational models and harmonised methods for describing data in information systems.
- To define technical requirements for secure processing environments.
- To prepare guidelines and cooperation models related to fees for data use and permits.
Health Data Access Bodies – Community of Practice (HDABs-CoP)
Findata is actively involved in the Community of Practice, a collaborative network of authorities from EU and EEA countries that supports the secondary use of health data as part of EHDS implementation. It was established in January 2024 to promote information exchange, the development of common practices, and the efficient use of resources.
The community serves as a temporary cooperation platform until the official EHDS governance structure is in place. The European Commission supports and participates in its coordination.
Key roles:
- General Assembly: Defines the strategic vision, mission, and objectives, approves the annual plan and documents produced by the HDABs-CoP.
- Steering Board: Coordinates the work of subgroups, monitors progress, ensures the quality of outputs, and reports to the General Assembly.
Subgroups:
- Data Access Application Systems – Design and development of national application systems.
- Health Datasets Metadata Catalogue and Data Quality and Utility – Metadata, quality, and usefulness of datasets.
- Secure Processing Environments – Development of secure processing environments.
- Cross-border Gateways – Design of cross-border connections.
- Deployment and Operations – Coordination of deployment and operational activities.
- Stakeholders’ Fora – Stakeholder engagement, communication, and interaction.
Frequently asked questions
Browse through frequently asked questions to learn more about the EHDS.
Can you opt-out from secondary use under the EHDS?
Yes. The EHDS regulation includes the right to opt out from secondary use, meaning your data will no longer be used for new permits or requests thereafter.
Can the right to opt-out be restricted in the EHDS?
Yes, in exceptional cases (e.g. important public interest), Member States may allow the use of data even if the individual has objected to it.
Is there a link between the opt-outs in primary and secondary use under the EHDS?
No, they are independent of each other. It is possible for to use one opt-out, but not the other.
Who is a data holder under the EHDS?
Data holder is an organisation that has the right or obligation to process health data, such as hospitals, research institutions, and public authorities.
Who can use data for research under the EHDS?
Under the EHDS regulation, both for-profit and non-profit entities may use health data for research purposes. Research may also include the training of artificial intelligence.
What is HealthData@EU?
The HealthData@EU is an EU-wide infrastructure that enables applications to be submitted to multiple countries using a single form, and through which datasets from different countries can be browsed and accessed.
Is there a limit to how many HDABs a Member State can set up?
There is no limit to the number. A Member State may designate multiple HDABs, for example, based on region or specific tasks. However, each country may have only one coordinating HDAB through which cross-border data use is managed. It is also important to note that HDABs are assigned a wide range of tasks and responsibilities under the regulation.
What are the secondary use purposes under the EHDS regulation?
Under the EHDS, health data can be reused for research, decision-making, innovation, and regulation. To support this, national authorising bodies will be established (Health Data Access Body, or HDAB).
What is the EHDS?
The European Health Data Space (EHDS) is a regulation of the European Union that establishes a common framework for the use and exchange of health data in EU countries. The aim of the regulation is to strengthen citizens’ rights to their own electronic health data and to enable the secure cross-border secondary use of health data.
The EHDS regulation is similar to the current Finnish Secondary Use Act, but it also introduces changes. The regulation includes partly different purposes of use, some of which are reserved only for public or EU entities. In addition, new operating models will be introduced for processing data requests and permit applications.
The regulation entered into force in March 2025 and will be implemented gradually over the coming years. The parts concerning secondary use will begin to apply in March 2029.
You can find more Q&As on the European Commission’s website: Frequently Asked Questions on the European Health Data Space (health.ec.europa.eu)
Co-funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Health and Digital Executive Agency. Neither the European Union nor the granting authority can be held responsible for them.