From Wegiz to the GIS Act: the Dutch implementation of the EHDS

In February, we published a blog outlining the key aspects of the implementation of the European Health Data Space Regulation (EHDS), which aims to improve the availability of health data. A lot has happened since then and the parliamentary letter of 18 May 2026 outlines the details of previously announced policy choices. In addition, the first draft documents of the accompanying implementing legislation have been made available: the draft Health information system Act (Wet op het gezondheidsinformatiestelsel, or GIS Act) and the accompanying explanatory memorandum.

Following a long period of uncertainty, the legislator is now providing a clearer picture of how the Netherlands will structure the EHDS legally. The implementation will take place in phases, with the first phase, the GIS Act, focusing on the foundations of the system, such as designating the authorities responsible for tasks under the EHDS. The substantive provisions concerning primary use, secondary use and EHR-systems will be addressed in the second phase. In this blog, we explain the current state of affairs and discuss the choices made in the GIS Act.

The GIS Act

The legislator has opted to amend national legislation in phases through multiple laws that will collectively form the Framework Act on data processing in healthcare (Stelselwet gegevensverwerking in de zorg). As the first phase, the GIS Act implements the EHDS provisions that become applicable from 26 March 2027. These provisions relate to the designation of the authorities responsible for implementation tasks and the supervisory and enforcement framework. The GIS Act also proposes an amendment to the electronic health data exchange Act (Wegiz), specifically regarding conformity assessment.

The public consultation for the GIS Act began on 28 May 2026 and closes on 8 July 2026. Whether you are a healthcare provider, patient(organisation), electronic health record (EHR) vendor, researcher, or otherwise involved: don’t miss the opportunity to provide input. You can respond via this website.

The Health Data Authority

Whereas earlier this year the focus was on "preparations for the designation" of the Digital Health Authority (DHA) and the Health Data Access Body (HDAB), the decision has now been made to establish a single new independent administrative body (zbo) to house both entities: the Health Data Authority (HDA, or Gezondheidsdata Autoriteit).

On the one hand, the HDA is responsible for carrying out the DHA's tasks relating to primary data use. This means the authority must ensure that citizens and healthcare providers can exercise their rights and obligations regarding the use of electronic health data in the care provided. Consider, for example, a patient's right to determine which healthcare providers have access to their data, or the right to view and rectify that data.

The HDA is also responsible for the HDAB obligations regarding secondary data use. The HDAB is tasked with assessing applications and granting permits for secondary use, providing access to health data, and supervising compliance. In addition, the HDAB is responsible for ensuring transparency and for cooperates with other supervisory authorities and HDABs. Finally, the national contact point for secondary use will also be housed within the HDA.

The decision to opt for a single joint authority is understandable: primary and secondary data use form a single ecosystem. Consolidation ensures centralised governance and reduces fragmentation in policy and implementation. The Minister's most compelling argument for choosing an independent administrative body is the independence required for the permit granting process. The EHDS requires the HDAB to operate with complete independence when making decisions and the authorities must prevent any conflicts of interest. Nevertheless, we have questions about the actual independence of the HDA.

The Explanatory Memorandum clarifies why the tasks are not assigned to an existing directorate, agency, or zbo. In our view, however, it does not adequately address the chosen structure. After all, as an administrative body without legal personality, the Health Data Authority is organisationally and administratively housed within the Ministry of Health, Welfare and Sport (VWS). The practical dependencies remain unaddressed: the staff fall under VWS, the board members are appointed by the Ministery and administrative support is also provided by the Ministry.

Given that VWS is itself both a data holder and a data user, and the EHDS imposes strict independence requirements, the chosen structure seems to be at odds with the principle that a supervisory body must be able to operate independently of the parties it supervises. This raises the question whether the chosen design guarantees sufficient independence in practice, or whether that independence is primarily of a formal legal nature.

Amendment to the Wegiz

In the Netherlands, the Wegiz allows specific data exchanges to be designated by ministerial decree (AMvB) as having to take place digitally in accordance with certain conditions and specifications. In this context, the Wegiz requires vendors of electronic health record (EHR) systems to engage a third party for certification.

The GIS Act will result in an amendment to the Wegiz regarding (third-party) certification. Under the EHDS, EHR-systems must contain harmonised software components that meet technical requirements. The EHDS stipulates that manufacturers must assess this themselves in a European digital testing environment.

As national requirements may not be stricter than the European regulation, the current Wegiz requirements regarding certification will be replaced (at an early stage) by a self-assessment system. For EHR vendors, this legislative proposal therefore represents a more favourable and cost-effective change.

The new timeline

Both the Wegiz and the EHDS work with prioritised data categories: specific types of health data that must be digitally exchangeable as a priority. For the first time, the parliamentary letter and the Explanatory Memorandum contain a concrete timeline per data category, indicating when the EHDS obligations will apply and how this relates to the existing Wegiz schedule.

Under the Wegiz, the multi-year sgenda includes: Basic Healthcare Data Set (BgZ), Acute Care, Medication Transfer, Image Availability, and Nursing eTransfer. The EHDS uses similar categories: European Patient Summary, ePrescription, eDispensation, Medical Test Results, Medical Imaging and Discharge Reports. Although the EHDS and Wegiz categories largely correspond, they are not entirely identical. National legislation must therefore be amended accordingly.

The parliamentary letter therefore includes a schematic overview of the interrelationship, which can be consulted here (available in Dutch only).

The Minister has decided to bring the Wegiz data exchanges for BgZ, Acute Care and Medication Transfer into effect at the same time as the EHDS requirements in Q1 2029, as a national supplement to the European categories. For Nursing eTransfer and Image Availability, the Netherlands is ahead of the EHDS: Nursing eTransfer will become mandatory in Q1 2028 (three years ahead of the EHDS deadline for Discharge Reports) and Image Availability in Q1 2029 (two years ahead of Medical Imaging).

The bottleneck

Despite all European ambitions, the EHDS will not succeed without a solid national foundation. Under the umbrella of the National Vision and Strategy (NVS), the Ministry of VWS is working together with healthcare and IT stakeholders to build a future-proof health information system in the Netherlands. The foundation of this is the nationwide network (landelijk dekkend netwerk, or LDN). The LDN is an overarching term that encompasses all agreements, functions and infrastructure that enable digital data exchange in healthcare.

This is where the bottleneck lies. The EHDS assumes that Member States have a properly functioning national health information system. To put it bluntly: the Netherlands does not (yet) have one. A properly functioning health information system, and therefore the LDN, is crucial for connection to the EHDS. A separate parliamentary letter was published regarding the progress of the LDN.

Conclusion

With the parliamentary letter of 18 May 2026 and the draft documents for the GIS Act, the Dutch EHDS implementation is taking shape. Whereas earlier letters mainly outlined directions, concrete choices are now available: a framework law to be implemented in phases, a single new supervisory authority combining primary and secondary use (the Health Data Authority), self-assessment rather than third-party certification for EHR-systems and a revised timeline for the prioritised data exchanges.

However, the picture is not complete and critical questions remain. The public consultation on the GIS Act is currently open. Whether you are a healthcare provider, EHR vendor, patient(organisation), researcher, or otherwise involed: this is your opportunity share your views. The foundations for better data availability are being established now.

We will continue to follow the developments closely, so keep an eye on our website. Do you have questions about what the EHDS and the GIS Act mean for your organisation? Please feel free to contact us. We would be happy to help.