Handles health records, in the European Union

Regulation (EU) No 910/2014, Article 5f(2) · Read the law's page

• This duty reaches you if you provide services as a private relying party other than a microenterprise or small enterprise, and Union or national law, or a contractual obligation, requires you to use strong user authentication for online identification, in any area (Art. 5f(2) names transport, energy, banking, financial services, social security, health, drinking water, postal services, digital infrastructure, education and telecommunications as examples and the list is open); it applies no later than 24 December 2027, 36 months after the implementing acts under Article 5a(23) and Article 5c(6) entered into force on 24 December 2024.
• Accept European Digital Identity Wallets that are provided in accordance with the Regulation, only upon the voluntary request of the user (Art. 5f(2)).

Regulation (EU) 2025/327, Art. 71 · Read the law's page

• This duty takes effect on 26 March 2029, the date from which Chapter IV applies, except that Article 51(1), points (b), (f), (g), (m) and (p), which name categories of the electronic health data that can be made available for secondary use, apply from 26 March 2031 (Article 105).
• Honor a natural person's right to opt out at any time, and without providing any reason, from the processing of personal electronic health data relating to them for secondary use under the Regulation, and keep the exercise of that right reversible (Article 71(1)).
• Once a natural person has exercised the right to opt out, and where personal electronic health data relating to them can be identified in a dataset, do not make those data available or otherwise process them pursuant to data permits issued under Article 68 or health data requests under Article 69 approved after the person exercised the right; this does not affect processing under data permits or health data requests issued or approved before (Article 71(3)).
• Where the purposes of your processing of personal electronic health data as a health data holder do not or no longer require the identification of a data subject by the controller, you are not obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the right to opt out (Article 71(8)).

Regulation (EU) 2025/327, Article 27(2) · Read the law's page

• This duty takes effect on 26 March 2029 for the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and for EHR systems intended by the manufacturer to process them, and on 26 March 2031 for the categories in points (d), (e) and (f) (Article 105).
• If you are a provider of an AI system considered high-risk under Article 6 of Regulation (EU) 2024/1689, outside the scope of Regulation (EU) 2017/745 or (EU) 2017/746, and you claim interoperability of the system with the harmonised software components of EHR systems, prove compliance with the essential requirements on the European interoperability software component and the European logging software component in Section 2 of Annex II (Article 27(2)).

Regulation (EU) 2025/327, Arts. 3-10 · Read the law's page

• This duty takes effect on 26 March 2029 for the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), which are patient summaries, electronic prescriptions and electronic dispensations, and on 26 March 2031 for points (d), (e) and (f), which are medical imaging studies and related imaging reports, medical test results, and discharge reports, in each case together with the EHR systems intended by the manufacturer to process those categories of data (Article 105).
• Give a natural person access, through the electronic health data access services, to at least the personal electronic health data relating to them that belong to the priority categories of Article 14 and are processed for the provision of healthcare, immediately after the data have been registered in an EHR system, free of charge and in an easily readable, consolidated and accessible format (Article 3(1)).
• Let a natural person, or their representative under Article 4(2), download free of charge an electronic copy of at least their personal electronic health data in the priority categories of Article 14, through the electronic health data access services, in the European electronic health record exchange format of Article 15 (Article 3(2)).
• Let a natural person, or their representative, insert information in their own EHR through the electronic health data access services or applications linked to them, keep that information clearly distinguishable as inserted by the natural person or the representative, and do not let them directly alter electronic health data and related information inserted by health professionals (Article 5).
• Enable a natural person to easily request online, through the electronic health data access services, the rectification of their personal electronic health data in accordance with Article 16 of Regulation (EU) 2016/679, and where appropriate verify the accuracy of the information with a relevant health professional (Article 6).
• Honor a natural person's right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems the healthcare provider uses (Article 7(1)).
• Where the healthcare providers are in different Member States, transmit a natural person's personal electronic health data on their request in the European electronic health record exchange format through the cross-border infrastructure of Article 23, and as the receiving healthcare provider accept such data and be able to read them (Article 7(2)).
• On a natural person's request, transmit a part of their personal electronic health data to a clearly identified recipient in the social security or reimbursement services sector immediately, free of charge, without hindrance and one-way only (Article 7(3)); as a receiving healthcare provider, accept and be able to read data a natural person downloaded under Article 3(2) and transmits to you in the European electronic health record exchange format (Article 7(4)).
• Honor a natural person's right to restrict the access of health professionals and healthcare providers to all or parts of their personal electronic health data as referred to in Article 3: make the natural person aware that restricting access might impact the provision of healthcare to them, and do not make the restriction visible to healthcare providers (Article 8).
• Give a natural person information, including through automatic notifications, on any access to their personal electronic health data through the health professional access service obtained in the context of healthcare, including access provided in accordance with Article 11(5), free of charge and without delay through the electronic health data access services, available for at least three years from each date of access and stating at least the healthcare provider or other individuals who accessed the data, the date and time of access and which data were accessed (Article 9(1) and (2)).

Regulation (EU) 2025/327, Arts. 53-54 · Read the law's page

• If you are a health data user, process electronic health data for secondary use only on the basis of and in accordance with the purposes contained in a data permit issued under Article 68, a health data request approved under Article 69 or, in situations referred to in Article 67(3), an access approval from the relevant authorised participant in HealthData@EU referred to in Article 75 (Article 54).
• Seek access only for a purpose listed in Article 53(1), because a health data access body grants access only where your processing is necessary for one of them: the public interest in the areas of public or occupational health; policymaking and regulatory activities to support public sector bodies or Union institutions, bodies, offices or agencies in the health or care sector; statistics related to health or care sectors; education or teaching activities in health or care sectors at vocational or higher education level; scientific research related to health or care sectors that contributes to public health or health technology assessments, or ensures high levels of quality and safety of healthcare, of medicinal products or of medical devices, including development and innovation activities for products or services and the training, testing and evaluation of algorithms, including in medical devices, in vitro diagnostic medical devices, AI systems and digital health applications; and improvement of the delivery of care, the optimisation of treatment and the provision of healthcare, based on the electronic health data of other natural persons (Articles 53(1) and 68(1), point (a)).
• Seek access for the purposes in Article 53(1), points (a), (b) and (c), only if you are a public sector body or a Union institution, body, office or agency exercising the tasks conferred on you by Union or national law, or process the data on behalf of one (Article 53(2)).
• Do not seek access to or process electronic health data obtained via a data permit or an approved health data request to take decisions detrimental to a natural person or a group of natural persons based on their electronic health data, where the decisions produce legal, social or economic effects or similarly significantly affect them (Article 54, point (a)).
• Do not seek access to or process such data to take decisions in relation to job offers, to offer less favourable terms in the provision of goods or services, including the exclusion of persons or groups from the benefit of an insurance or credit contract, the modification of their contributions and insurance premiums or the conditions of loans, or to take any other decisions that result in discriminating against them on the basis of the health data obtained (Article 54, point (b)).
• Do not seek access to or process such data to carry out advertising or marketing activities (Article 54, point (c)).
• Do not seek access to or process such data to develop products or services that may harm individuals, public health or society at large, such as illicit drugs, alcoholic beverages, tobacco and nicotine products, weaponry or products or services which are designed or modified in such a way that they create addiction, contravene public order or cause a risk for human health (Article 54, point (d)).
• Do not seek access to or process such data to carry out activities in conflict with ethical provisions laid down in national law (Article 54, point (e)).
• This duty takes effect on 26 March 2029, the date from which Chapter IV applies, except that Article 51(1), points (b), (f), (g), (m) and (p), which name categories of the electronic health data these Articles reach, apply from 26 March 2031 (Article 105).

Regulation (EU) 2025/327, Arts. 61, 66, 73 · Read the law's page

• If you are a health data user, do not re-identify or attempt to re-identify the natural persons to whom electronic health data obtained on the basis of a data permit, a health data request or an access approval relate (Article 61(3)).
• If you are a health data user processing electronic health data within a secure processing environment, do not provide access to the data, or make it available, to third parties not mentioned in the data permit (Article 61(2)).
• If you are a health data user, make public the results or output of secondary use within 18 months of completing the processing in the secure processing environment or of receiving the response to your health data request, a period the health data access body may extend in justified cases, and let those results or that output contain only anonymous data (Article 61(4)).
• If you are a health data access body, provide electronic health data in an anonymised format where the health data user's purpose can be achieved with such data, and provide it in pseudonymised format only where the user has sufficiently demonstrated that anonymised data cannot achieve the purpose, keeping the information needed to reverse the pseudonymisation with the access body or a trusted third party acting under national law (Article 66(2) and (3)).
• If you are a health data access body, give access to electronic health data under a data permit only through a secure processing environment that restricts access to the persons listed in the data permit, gives each user a unique identity and a confidential access mode, limits input, inspection, modification and deletion to a limited number of authorised identifiable individuals, minimises the risk of unauthorised reading, copying, modification or removal, keeps identifiable logs of access and activities for the period needed to verify and audit processing, with logs of access kept for at least one year, and monitors compliance with those measures (Article 73(1), points (a) to (f)).
• If you are a health data access body, review each download request so that health data users can download only non-personal electronic health data, including data in an anonymised statistical format, and have the secure processing environments audited on a regular basis, including by third parties, correcting the shortcomings, risks or vulnerabilities the audits identify (Article 73(2) and (3)).