The European Health Data Space Act (EHDS) aims to improve healthcare in Europe through data availability, using a cross-border infrastructure. It is a regulation designed to enhance care while also stimulating innovation and research. A golden opportunity for the healthcare sector.
After considerable debate on its substance, the EHDS entered into force in March last year. Its obligations will be introduced gradually between 2027 and 2031. Implementation should ensure that the Netherlands is fully ready for the EHDS to become operational by 26 March 2031 at the latest. But how do we get there? At the end of January, Minister Bruijn (Ministry of Health, Welfare and Sport) finally provided another update on implementation. In this blog, we highlight the key points from the parliamentary letter.
1. The rights of citizens
The first notable change is the expansion of citizens’ rights under the EHDS (patients). This includes the right of access to electronic health data relating to them. To enable this, Member States must put in place online access services. In the Netherlands, a wide range of personal health environments and patient portals already exist. Minister Bruijn is currently examining what is needed to shape these access services, including the extent to which existing portals such as MijnGezondheidsoverzicht can be used. He expects to provide answers to these questions after the summer.
In addition, the Netherlands will introduce an opt-out right for the primary use of health data. This means that patients will no longer need to give prior consent for the use of their relevant data for healthcare provision, but must actively prohibit such use through an opt-out arrangement. The patient must therefore take action. The opt-out right for primary use is optional for Member States. The Netherlands’ decision to introduce this right was therefore not unexpected, particularly in light of earlier concerns about the interaction between national medical confidentiality obligations and the EHDS.
Work is still ongoing on how best to embed patients’ restriction rights, such as the right to limit access, within the national system.
2. Supervision
Under the EHDS, several authorities must be designated. Preparations for the designation and establishment of the Digital Health Authority (Autoriteit Digitale Gezondheid, ADG) and the Health Data Access Body (HDAB) are well underway. The ADG will be responsible, among other things, for supervising compliance with patients’ rights, while the HDAB will oversee compliance with the rules on secondary use.
Technical preparations for the HDAB have also begun, so that it can be operational by 2029. This concerns the infrastructure and processes needed to facilitate the secure, responsible and efficient re-use of electronic health data in the Netherlands. To this end, the Ministry of Health, Welfare and Sport has set up the HDAB-NL programme, which focuses on developing the necessary technical requirements. The Netherlands is receiving a European subsidy for this work. Within the programme, the Ministry works together with the RIVM, CBS, ICTU en Health-RI. Over the coming years, HDAB-NL will focus on developing several technical operational functions, such as a secure processing environment.
3. EHDS versus Wegiz
We have written about this before: how does the EHDS relate to the national Act on ''Wet elektronische gegevensuitwisseling in de zorg (Wegiz), which covers almost exactly the same subject matter? That question still does not appear to be fully resolved. There are, after all, relevant differences between the Wegiz and the EHDS. Because the EHDS is a European regulation with direct effect in the national legal order, the Wegiz will need to be aligned with it. The impact assessment on this issue is still ongoing.
One initial finding emerging from the impact assessment concerns prioritised data exchanges. Both the EHDS and the Wegiz provide for prioritised data exchanges, but these are not identical. Until the EHDS prioritised data exchanges apply in 2029, the Wegiz will remain in force. According to Minister Bruijn, care will be taken to ensure substantive alignment with the forthcoming EHDS requirements. Let us hope so, to avoid the sector having to start again in 2029.
Another difference is that the Wegiz is based on a system of third-party certification to assess whether an EHR system complies with the rules. Under the EHDS, self-assessment is permitted. It would be unworkable for suppliers to face two different systems. It has therefore been announced that the EHDS self-assessment system will replace third-party certification under the Wegiz. That is a welcome simplification.
4. Implementation of the EHDS in the national legal framework
Alongside policy-related activities, preparations are also underway to implement the EHDS in national legislation and regulations. Work is currently ongoing on a legislative proposal, with the intention that it will be opened for public consultation in the first half of 2026. The House of Representatives is then expected to receive the proposal in the first quarter of 2027.
And the loose ends?
Despite the EHDS having already entered into force, negotiations on its technical elaboration are still ongoing. This includes, for example, the specific exchange formats for electronic health data. Many of the technical requirements referred to in the EHDS will be laid down in so-called implementing acts. In other words, it is not yet entirely clear what suppliers will ultimately be required to comply with.
These implementing acts are currently being developed in a committee in which all Member States are represented. The committee has recently started its work and aims to adopt the majority of the technical requirements in implementing acts by 26 March 2027. One more year of patience, then.
With our EHDS cheatsheet, you can prepare your organisation for the EHDS. It provides a clear overview of the key obligations under this regulation.
