Table of Contents
The European Health Data Space (EHDS) is one of the EU’s most ambitious digital health initiatives. It aims to make health data easier to access, share and reuse across Europe, while giving individuals more control over their own information.
Now that the Regulation has been adopted, attention is shifting from policy to practice. To support that transition, the European Commission has launched a public consultation on a draft implementing act under Article 70 EHDS. The proposal introduces three standard templates that will be used across the EU when organisations request access to health data for secondary-use purposes.
While these documents may appear to be little more than administrative forms, they are set to become important building blocks of the EHDS framework. They will help shape how researchers, public authorities, hospitals, pharmaceutical companies, and AI developers can access, use and provide health data in practice.
From legal framework to operational reality.
The consultation may seem technical, but it marks an important milestone for the EHDS.
While the Regulation establishes the legal framework for health data sharing and reuse across Europe, many of the practical details still need to be defined. That is where implementing acts come in. They translate legal principles into operational processes that organisations can follow.
Think of the Regulation as defining the destination, while implementing acts are providing the roadmap.
The draft consultation under Article 70 does exactly that. Rather than changing the rules of the EHDS, it focuses on the practicalities of requesting and granting access to health data for secondary-use purposes. For organisations that expect to rely on health data for research, innovation, public health or AI development, these operational details may prove just as important as the Regulation itself.
A quick recap: the road to EHDS.
The EHDS may be in force, but it's rolling out in stages. Here's how the timeline looks:
March 2025
The EHDS enters into force.
The rulebook takes shape.
March 2027
NEXT UPGeneral application.
The Commission must adopt key implementing acts, including the access templates covered in this blog. Member States must also designate their Health Data Access Bodies.
March 2029
Secondary use goes live.
The rules for reusing health data start to apply to most data categories, such as electronic health records. For primary use, patient summaries and ePrescriptions become exchangeable across all Member States.
March 2031
The scope widens.
Secondary use extends to the remaining categories, such as genomic data, clinical trials and research. In a second wave for primary use, medical images, lab results and discharge reports join cross-border exchange.
March 2035
Europe opens the door.
Third countries and international organisations can apply to join HealthData@EU.
2029 may sound far away, but setting up governance takes time. Organisations that hold and use health data should start preparing now.
Beyond patient care: what is secondary use?
The three templates currently under consultation all relate to what the EHDS calls the secondary use of health data.
The EHDS distinguishes between primary use and secondary use of electronic health data. Primary use refers to the use of health data for the care of an individual patient, such as a physician consulting a medical record, a pharmacist retrieving an e-prescription, or hospitals exchanging information to support ongoing care.
Secondary use is different. Here, the data is used for purposes beyond treating an individual patient, such as scientific research, public health monitoring, healthcare planning, innovation, regulatory oversight, education or the development of AI systems.
Health data can do a lot of good beyond the doctor’s office, from better research to smarter public health policy. But that value only holds if people can trust how their data is being used. That’s why the EHDS focuses on transparency and pairs reuse with firm safeguards for privacy, security and accountability.
Reusing health data rarely involves just one organisation or a handful of records. It usually means large datasets passing between multiple stakeholders. To keep that under control, the EHDS sets up a dedicated governance framework that decides who can access health data, for what purpose and under which conditions. Additionally, Health Data Access Bodies are responsible for providing and managing a Secure Processing Environment (SPE). This is a strictly controlled workspace that allows authorized stakeholders to access health data without downloading, copying or exporting the raw personal data.
The draft implementing act focuses on one practical aspect of that framework: the process organisations will follow when requesting access to health data for secondary-use purposes.
Three templates, one harmonised process.
To support these secondary-use activities, the Commission is proposing three standardised templates covering the different stages of the access process.
Health Data Access Application (Article 67).
The first template is the Health Data Access Application.
This is the form organisations will use when seeking access to health data under the EHDS. Researchers, universities, pharmaceutical companies, public authorities, and other eligible applicants will use it to explain what data they need, why they need it, how it will be used, and which safeguards will be put in place.
In short, this is where the access process begins.
Data Permit (Article 68).
Once an application has been assessed and approved, the next step is the Data Permit.
Issued by a Health Data Access Body, the permit formally authorises the use of health data and sets out the conditions attached to that access. It specifies what data may be used, for which purpose, under which conditions, and for how long.
Rather than being a simple approval letter, the permit creates a clear framework for accountability. It ensures that access remains linked to a defined purpose and that appropriate safeguards remain in place throughout the lifecycle of the project.
Health Data Request Application (Article 69).
Not every use case requires direct access to health datasets.
For situations where an organisation only needs aggregated statistics, analyses or other derived outputs, the EHDS introduces a Health Data Request Application. This provides a more streamlined route without granting access to the underlying datasets.
The principle is straightforward: if a project can achieve its objective without direct access to the raw data, the process should reflect that lower level of risk.
More than just administrative paperwork: why these forms are important.
At first glance, these templates might look like standard forms, but in reality, they are a key part of how the EHDS will function in real life.
One of the EHDS’s central ambitions is to create a more harmonised approach to health data access across Europe. Without common procedures, organisations operating across borders could be confronted with different rules and application processes in every Member State.
By introducing standard templates and common terminology, the Commission aims to create a more predictable and consistent process for applicants, data holders and Health Data Access Bodies alike.
For organisations active in healthcare, life sciences, research, or AI, these templates may ultimately become the gateway to accessing health data under the EHDS.
What this means for privacy professionals.
For privacy and compliance professionals, the consultation offers an early glimpse of what EHDS governance may look like in practice.
Importantly, the EHDS does not replace the GDPR. Instead, the GDPR is the foundation and the EHDS builds on the existing data protection framework by introducing on an operational level sector-specific rules for sharing and reusing health data. In this regard the EHDS for example creates more rights for patients regarding the use of their health data. Organisations will therefore need to consider both frameworks when designing their governance and compliance processes.
The proposed templates also provide useful insight into the information applicants may be expected to document, including project objectives, data requirements, security measures and accountability mechanisms.
In that sense, the consultation is about more than forms. It provides an early indication of how access requests may be assessed and how secondary-use activities may be governed across the EU.
Final diagnosis.
The EHDS is entering a new phase. While the Regulation established the foundations for health data sharing and reuse across Europe, the Commission’s draft implementing act starts to reveal what that framework could look like when put into practice.
The proposed Health Data Access Application, Data Permit, and Health Data Request Application may sound procedural, but they are likely to become essential building blocks of the future EHDS ecosystem.
For organisations involved in healthcare, research, life sciences, digital health, and AI, this consultation offers a chance to look beyond the legislation itself and consider how the new framework will operate in day-to-day practice.
Getting ready for the EHDS?
Whether you provide care or develop treatments, the EHDS will change how you access and share health data. Our experts can help you prepare your governance, your GDPR compliance and your future access requests.
