EHDS Is Law: What the European Health Data Space Means for Businesses
4 min Read Time
The European Health Data Space (EHDS) became law in March 2025. By 2029, patient summaries and electronic prescriptions must be interoperable across the EU. For healthcare IT providers, pharmaceutical suppliers, and MedTech companies, this represents both an opportunity – and a legal obligation. Companies that proactively build data access infrastructure now will position themselves at the forefront of Europe’s largest digital transformation in healthcare.
The Key Takeaways
- EHDS entered into force on 26 March 2025: The regulation was published in the Official Journal of the European Union on 5 March 2025 and applies directly in all Member States.
- Primary use by 2029: Patient summaries and e-prescriptions must be cross-border accessible by March 2029. Imaging data and discharge letters follow by 2031.
- Secondary use for research and industry: Pharma, MedTech, and research institutions gain regulated access to pseudonymised health data via newly established national data access bodies.
- Germany establishes DACO: The Federal Institute for Drugs and Medical Devices (BfArM) will serve as the national Data Access and Coordination Office (DACO), mediating access to health data for research and development.
- Citizens retain a right to object: Individuals may opt out of secondary use – but not primary use. Cross-border data exchange between treating physicians is mandatory.
What the EHDS Is – and What It Changes
Definition
The European Health Data Space (EHDS) is an EU regulation governing the cross-border exchange of electronic health data. It defines which data must be shared among healthcare providers (primary use) and how research and industry can obtain regulated access to anonymised or pseudonymised health data (secondary use).
For the first time, the EHDS creates a legal framework enabling a patient from Munich who falls ill while on holiday in Lisbon to grant local clinicians immediate access to her electronic patient summary. Likewise, a French pharmaceutical company can legally use pseudonymised clinical data from German hospitals for drug development – without negotiating bilateral contracts with every individual data holder.
The regulation was published in the Official Journal of the European Union on 5 March 2025 and entered into force on 26 March 2025. It applies directly across all EU Member States – no national transposition, as required for directives, is necessary. However, Member States must still establish the required structures: national data access bodies, interoperability standards, and technical infrastructure.
Primary Use: Mandatory Data Exchange Starting in 2029
Chapter III of the regulation governs primary use – the exchange of health data among care providers for the purpose of patient treatment. The timeline is ambitious:
By March 2027: The European Commission will adopt implementing acts specifying technical standards and data formats. By then, Member States must designate their national digital health authorities.
By March 2029: Patient summaries and electronic prescriptions must be cross-border accessible. This includes diagnoses, allergies, current medications, vaccination status, and laboratory results.
By 2031: Imaging data and discharge letters will be added. Once fully implemented, a patient’s complete treatment history will be viewable across the EU – provided the technical infrastructure is in place.
For Germany – with its existing electronic patient record (ePA) infrastructure – this means the national ePA system must achieve full interoperability with systems in all other EU countries by 2029. Given that only 40% of German hospitals have so far joined the ePA pilot programme, this is a demanding schedule.
Secondary Use: Data for Research and Industry
Chapter IV holds particular interest for businesses. Secondary use enables pharmaceutical companies, MedTech manufacturers, and research institutions to obtain regulated access to pseudonymised or anonymised health data. Permitted purposes are clearly defined: research, innovation, public health, policymaking, and education.
Each Member State must set up a national data access body. In Germany, this function will reside with the Federal Institute for Drugs and Medical Devices (BfArM), operating as the Data Access and Coordination Office (DACO). The DACO reviews applications, provides data within secure processing environments, and monitors compliance with usage conditions.
For a pharmaceutical company that previously spent months negotiating access to clinical data from a single university hospital, the logic shifts fundamentally: instead of bilateral negotiations, there is a standardised application process via the DACO; instead of raw data, there are pseudonymised datasets in protected environments; and instead of national boundaries, there is EU-wide data availability.
“We must harness all these opportunities much more intensively – as support tools. Ultimately, medical decisions will always be made by people.” – Federal Minister of Health Nina Warken on the 2026 Digitalisation Strategy (BMG press release)
What Businesses Must Prepare Now
The EHDS affects far more than hospitals and physician practices. Every company that processes, stores, or uses health data for research must adapt – including healthcare IT vendors, EHR developers, pharmaceutical suppliers, and MedTech firms offering data-driven products.
Healthcare IT providers: Developers of electronic patient records, practice management systems, or hospital information systems must align their products with EHDS interoperability standards by 2029. This covers data formats (HL7 FHIR becomes the mandatory standard), interfaces, and access management.
Pharma and MedTech: Secondary use opens new avenues for real-world evidence studies, post-market surveillance, and AI model training. Companies that begin early to master the DACO application process – and reorient their R&D pipelines toward pseudonymised EU-wide data – will gain a strategic advantage.
All data-processing companies: The EHDS complements, but does not replace, the GDPR. Balancing data access for research against patient privacy remains complex. Businesses need staff fluent in both regulatory frameworks.
Citizens retain a right to object to secondary use. Those who do not wish their health data used for research may exercise this right. No such opt-out exists for primary use – that is, data exchange among treating physicians. Under the EHDS, sharing data between care providers is mandatory – not optional.
What Makes Germany’s Implementation Especially Challenging
Germany’s federal structure complicates EHDS implementation more than in centralised countries. Sixteen federal states with divergent hospital laws, 130 statutory health insurers maintaining isolated data silos, and an ePA system still in its infancy – this is the starting point from which EU-wide interoperability must be built by 2029.
Compounding the challenge is Germany’s dependence on imported active pharmaceutical ingredients: 80% originate from just five countries, with China alone supplying 45%. The EHDS aims to strengthen Europe’s research autonomy. If European researchers gain broad, regulated access to a unified data pool, dependency on third-country data for drug development will decline.
For German healthcare IT providers, interoperability poses the greatest hurdle. HL7 FHIR becomes the binding standard – but many existing hospital information systems (KIS) and practice management systems (PVS) still rely on proprietary formats. Migrating to FHIR-based interfaces is technically feasible but labor-intensive: data mapping, test runs, certification. Vendors beginning now have sufficient time until 2029. Those delaying will face tight deadlines and higher costs.
Countries like Estonia, Finland, and Denmark – which already operate highly interoperable national eHealth systems – will meet EHDS requirements with comparatively modest effort. Germany starts further behind. The ePA is a first step – but the EHDS demands a second: cross-border connectivity, standardised data formats, and a national coordination office that functions effectively – not merely exists on paper.
The next three years will reveal whether Germany leverages the EHDS as a catalyst for long-overdue digital transformation in healthcare – or whether the regulation becomes yet another Brussels decree implemented only hesitantly in Berlin. The opportunities are tangible: an EU-wide data market for research, more efficient patient care during travel abroad, and strengthened European pharmaceutical sovereignty. But unseized opportunities remain just that – paper promises.
Frequently Asked Questions
What is the EHDS – and when did it enter into force?
The European Health Data Space (EHDS) is an EU regulation governing cross-border health data exchange. It was published in the Official Journal of the European Union on 5 March 2025 and entered into force on 26 March 2025. The regulation applies directly in all EU Member States.
Which data will be interoperable across the EU by 2029?
By March 2029, patient summaries and electronic prescriptions must be cross-border accessible. This includes diagnoses, allergies, current medications, vaccination status, and laboratory results. Imaging data and discharge letters will be added by 2031.
Can citizens object to the use of their health data?
Yes – for secondary use (research, industry), individuals retain a right to object. For primary use (data exchange among treating physicians), no opt-out exists – the exchange is mandatory for patient care.
What is the DACO – and what role does the BfArM play?
The DACO (Data Access and Coordination Office) will be established at the BfArM (Federal Institute for Drugs and Medical Devices) in Germany. It reviews applications for secondary use of health data, delivers datasets within secure processing environments, and oversees compliance with usage conditions.
How do pharmaceutical and MedTech companies benefit from the EHDS?
Secondary use enables regulated access to pseudonymised health data for research, real-world evidence studies, post-market surveillance, and AI training. Instead of negotiating bilaterally with individual hospitals, companies apply through a standardised process via the national data access body.
Editor’s Reading Recommendations
Header Image Source: Pexels / Pixabay (px:669615)
