Earlier this month a draft of the proposal for the European Health Data Space Regulation was released. The EHDS is one of nine European data spaces identified in the European Commission's 2020 European Strategy for Data, and very much a priority for the commission. It builds on the Data Governance Act and the recently released proposal for the Data Act. Those acts are horizontal in nature; the EHDS Regulation would provide more specific sectoral measures in the area of health.
The draft proposal sets out a comprehensive set of rules for the processing of electronic health data both in primary use (for providing health care services to individuals) and in secondary use (for research, innovation, policymaking, statistics and protecting against cross-border threats to health). For the processing of personal electronic health data, the regulation would have the same territorial application as the EU General Data Protection Regulation (i.e., Article 3 of the GDPR) For non-personal electronic health data, the regulation would apply to data holders and data users in the European Union, irrespective of where the processing takes place.
In the sections devoted to the processing of electronic health data for primary use, the draft proposal lists the rights and obligations of the main actors in this area: individuals/patients, health care professionals/pharmacies, Member States and providers of Electronic Health Care systems which are defined as "solutions or software intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing and/or viewing electronic health records."
For individuals/patients, the proposal focusses on the rights of access, rectification and data portability, including the right to restrict access. These concepts are familiar from the corresponding provisions in the GDPR. Access would be made available, free of charge, through the use of a personal electronic health data access service. Health care professionals must have a corresponding right of access to the data of individuals under their treatment, including where the Member State of residence of the individual is different from the Member State of treatment. Health care professionals and pharmacies using an EHC system are subject to a series of obligations, such as the establishment of a risk management and security plan.
Member States have an important role to play in this area, especially given the fragmentation of the current rules and the lack of consistency throughout the EU. Under the draft proposal, Member States, with assistance from the commission, are expected to appoint a national contact point and put in place a common infrastructure for cross border sharing of personal electronic health data and products, MyHealth@EU, thereby making it possible to ensure continuity of care, for instance when an individual moves to another Member State. The draft proposal indicates that the national contact points would act as joint controllers for the processing carried out in MyHealth@EU and the commission would be their processor. The draft empowers the commission to issue a series of implementing acts on various aspects of MyHealth@EU.
The proposal has a specific chapter devoted to EHC systems that have been intended by the manufacturer to be used for processing personal electronic health data. These systems need to meet certain criteria before being placed on the market and among others, undergo conformity assessment procedures resulting in certificates of conformity and Confomite Europeenne markings. The proposal also lists a series of obligations on manufacturers, importers and distributors of such systems.
A substantial part of the draft proposal is devoted to the secondary use of electronic health data, i.e., the use for research, innovation, policymaking, regulatory decisions and personalized medicine. This secondary use, cross-border, is part of the commission's overall ambition to "unlock the power of data in the EU." The proposal foresees a system of permits issued by a designated government body in each of the Member States. This can be an existing body or a newly created body. The permit is issued based on an application which needs to provide details on a number of items such as a description of the requested data, the reasons for seeking access, the intended uses, the safeguards, the duration and whether the data should be made available in an anonymized or aggregated format. The proposal specifies that the data will be released in a pseudonymized format where the purposes of further processing can be fulfilled in that manner. In such case it is prohibited to reidentify the data and violations may lead to criminal sanctions.
The proposal specifies the purposes for which access may be granted but also which secondary uses are prohibited. These prohibited uses include taking decisions against an individual to exclude them from the benefit of an insurance contract or modify their premiums, commercial advertising, selling the data to third parties or automated individual decision-making, including profiling.
There is a special section in the proposal on intra-community cross-border access to electronic health data, and Member States and the commission commit to facilitate such access, among others by closely cooperating, setting up an appropriate infrastructure and appointing a single national point of contact in each of the Member States.
There is a specific provision on the transfer of non-personal electronic health data to countries outside of the EU. This transfer needs to be done in accordance with the provisions of the Data Governance Act for highly sensitive data. These provisions, currently captured in Section 5(11) of the latest available version of the Data Governance Act, empower the commission, through delegated acts, to subject such transfers to specific conditions and restrictions. There does not appear to be any specific provision on transfers of personal electronic health data to a recipient outside of the EU. These transfers therefore are covered by the general international transfer rules of the GDPR, as interpreted by the courts and relevant data protection authorities.
The official release of the commission proposal is scheduled for April. There could be some changes between the released draft summarized above and the official proposal, but the key concepts are unlikely to change at this point in time. Once the proposal is officially released, it goes to the European Parliament and the council for further handling. The stakes are high, the tasks formidable so one should expect fierce debate in both the Parliament and the Member States through the council.
Photo by Jair Lázaro on Unsplash
