The EHDS regulation creates a clear system for accessing EHD for primary use (in healthcare) and secondary use - for research and innovation. The standardized rules on accessing EHD for secondary use paves a way for companies to request different types of health-related data, including disease registries, genomic data, and other factors affecting health, such as substance use, socio-economic status, behavior, and environmental data like pollution. Researchers can use this data to develop new healthcare products and services, such as advanced treatments and personalized medicine. 

​

Each EU Member State will designate one or more health data access bodies (HDAB). These HDABs will act as intermediaries between a holder of EHD and the possible users of such EHD. Once the HDABs are set up, researchers and businesses can approach them to request access to certain EHD available with one or more health data holders. HDABs are tasked with, among others, maintaining data catalogues, assisting in the anonymization/pseudonymization of the requested EHD and carrying out various administrative functions. 

For example, a pharmaceutical company may apply to a HDAB for a data permit to access EHD from one or more hospitals. The HDAB will evaluate the application based on different factors such as the purposes described in the application and will either grant a data permit, or reject the health data access application within three months. Once the data permit is issued, the HDAB will coordinate with the health data holder to collect the EHD, anonymize and pseudonymize it, and provide this pharmaceutical company with access to this EHD in a secure processing environment. The pharmaceutical company will be allowed to use the EHD for the purposes and within limits specified in the permit. 

The process for accessing data for secondary use relies significantly on HDABs. However, to streamline the process, the EHDS regulation has also introduced the concept of a ‘trusted health data holders’. These ‘trusted health data holders’ will be able to review the health data access application or health data request and provide recommendations to HDAB(s), which will make the final decision of data permit. This designation allows heath data holders to have some control over who accesses their EHD. 

The EHDS regulation also provides a mechanism for cross-border participation in the exchange of EHD for secondary use. Additionally, it lays down the requirements for a third-country or an international organization to participate in data sharing for secondary use as long as they are in compliance with the GDPR and the EHDS Regulation. 

​

The standardized rules of EHDS offer businesses and researchers clearer and more reliable access to health data, helping to drive innovation. The implementation of the administrative process by the EU countries should, however, ensure that data access remains efficient, timely, and balanced with necessary safeguards to protect privacy and security.

In addition to the standardized rules on data access for secondary use, the EHDS will provide natural persons (patients) with additional rights in relation to their health data, building on the right to access personal data and right to interoperability of personal data enumerated in the GDPR. Going forward, healthcare providers that process health data using EHR systems are required to incorporate technical and organizational conditions laid down in the EHDS regulation.