European UnionEuropean Health Data Space Regulation, Rights of Natural Persons in the Primary Use of Electronic Health Data (Articles 3 to 10)
Regulation (EU) 2025/327, Arts. 3-10
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- This duty takes effect on for the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), which are patient summaries, electronic prescriptions and electronic dispensations, and on for points (d), (e) and (f), which are medical imaging studies and related imaging reports, medical test results, and discharge reports, in each case together with the EHR systems intended by the manufacturer to process those categories of data (Article 105).
- Give a natural person access, through the electronic health data access services, to at least the personal electronic health data relating to them that belong to the priority categories of Article 14 and are processed for the provision of healthcare, immediately after the data have been registered in an EHR system, free of charge and in an easily readable, consolidated and accessible format (Article 3(1)).
- Let a natural person, or their representative under Article 4(2), download free of charge an electronic copy of at least their personal electronic health data in the priority categories of Article 14, through the electronic health data access services, in the European electronic health record exchange format of Article 15 (Article 3(2)).
- Let a natural person, or their representative, insert information in their own EHR through the electronic health data access services or applications linked to them, keep that information clearly distinguishable as inserted by the natural person or the representative, and do not let them directly alter electronic health data and related information inserted by health professionals (Article 5).
- Enable a natural person to easily request online, through the electronic health data access services, the rectification of their personal electronic health data in accordance with Article 16 of Regulation (EU) 2016/679, and where appropriate verify the accuracy of the information with a relevant health professional (Article 6).
- Honor a natural person's right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems the healthcare provider uses (Article 7(1)).
- Where the healthcare providers are in different Member States, transmit a natural person's personal electronic health data on their request in the European electronic health record exchange format through the cross-border infrastructure of Article 23, and as the receiving healthcare provider accept such data and be able to read them (Article 7(2)).
- On a natural person's request, transmit a part of their personal electronic health data to a clearly identified recipient in the social security or reimbursement services sector immediately, free of charge, without hindrance and one-way only (Article 7(3)); as a receiving healthcare provider, accept and be able to read data a natural person downloaded under Article 3(2) and transmits to you in the European electronic health record exchange format (Article 7(4)).
- Honor a natural person's right to restrict the access of health professionals and healthcare providers to all or parts of their personal electronic health data as referred to in Article 3: make the natural person aware that restricting access might impact the provision of healthcare to them, and do not make the restriction visible to healthcare providers (Article 8).
- Give a natural person information, including through automatic notifications, on any access to their personal electronic health data through the health professional access service obtained in the context of healthcare, including access provided in accordance with Article 11(5), free of charge and without delay through the electronic health data access services, available for at least three years from each date of access and stating at least the healthcare provider or other individuals who accessed the data, the date and time of access and which data were accessed (Article 9(1) and (2)).
If you get it wrong
Private right of actionYes
Penalty structure
Article 22 of Regulation (EU) 2025/327 makes the supervisory authorities responsible for Regulation (EU) 2016/679 competent for Articles 3 and 5 to 10 and empowers them to impose administrative fines up to the amount referred to in Article 83(5) of that Regulation, which is EUR 20,000,000 or, for an undertaking, 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. The Regulation does not print the amount, so the pin sits on Article 83(5) of Regulation (EU) 2016/679. The fine is coded for Articles 3 and 5 to 10 only; Article 22 does not name Article 4, and Article 99 leaves other penalties to the Member States.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The supervisory authorities responsible for monitoring and enforcing Regulation (EU) 2016/679, which are also competent for monitoring and enforcing Articles 3 and 5 to 10 of the Regulation (Article 22); the digital health authorities designated under Article 19 receive complaints about Chapter II and transmit a complaint about the rights of natural persons under Articles 3 and 5 to 10 to those supervisory authorities (Article 21(2)).
What this law does
Article 1(2), point (a), states that the Regulation specifies and complements the rights laid down in Regulation (EU) 2016/679 of natural persons in relation to the primary use and secondary use of their personal electronic health data.
Article 3(1) gives natural persons the right to access at least the personal electronic health data relating to them that belong to the priority categories referred to in Article 14 and are processed for the provision of healthcare through the electronic health data access services referred to in Article 4.
Article 3(1) adds that access is provided immediately after the personal electronic health data have been registered in an EHR system, while respecting the need for technological practicability, free of charge and in an easily readable, consolidated and accessible format.
Article 3(2) gives natural persons, or their representatives, the right to download free of charge an electronic copy of at least the personal electronic health data in the priority categories of Article 14 related to them, in the European electronic health record exchange format referred to in Article 15.
Article 3(3) permits Member States, in accordance with Article 23 of Regulation (EU) 2016/679, to restrict the scope of the rights in Article 3(1) and (2), in particular by delaying access for a limited period until a health professional is able to properly communicate and explain information that can have a significant impact on a person's health.
Article 4(1) requires Member States to ensure that one or more electronic health data access services are established at national, regional or local level, enabling natural persons to access their personal electronic health data and exercise their rights provided for in Articles 3 and 5 to 10, free of charge for the natural persons and their representatives.
Article 5 gives natural persons, or their representatives, the right to insert information in their own EHR through electronic health data access services or applications linked to those services, and provides that they shall not be able to directly alter the electronic health data and related information inserted by health professionals.
Article 6 requires electronic health data access services to enable natural persons to easily request online the rectification of their personal electronic health data in accordance with Article 16 of Regulation (EU) 2016/679.
Article 7(1) gives natural persons the right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems used by that healthcare provider.
Article 7(2) gives natural persons, where the healthcare providers are located in different Member States, the right to request the transmission of their personal electronic health data in the European electronic health record exchange format through the cross-border infrastructure referred to in Article 23, and requires the receiving healthcare provider to accept such data and to be able to read them.
Article 7(3) gives natural persons the right to request a healthcare provider to transmit a part of their personal electronic health data to a clearly identified recipient in the social security or reimbursement services sector, immediately, free of charge, without hindrance and one-way only.
Article 8 gives natural persons the right to restrict the access of health professionals and healthcare providers to all or parts of their personal electronic health data as referred to in Article 3, and provides that the fact that a natural person has restricted access shall not be visible to healthcare providers.
Article 9(1) gives natural persons the right to obtain information, including through automatic notifications, on any access to their personal electronic health data through the health professional access service obtained in the context of healthcare.
Article 9(2) requires that information to be provided free of charge and without delay through the electronic health data access services, to be available for at least three years from each date of access, and to include at least who accessed the data, the date and time of access and which data were accessed.
Article 10(1) provides that Member States' laws may give natural persons the right to opt out from the access to their personal electronic health data registered in an EHR system through the electronic health data access services, and that in such cases Member States shall ensure that the exercise of that right is reversible.
Article 14(1) lists the priority categories of personal electronic health data for primary use as patient summaries, electronic prescriptions, electronic dispensations, medical imaging studies and related imaging reports, medical test results, and discharge reports.
Article 105 applies Articles 3 to 15 from to the priority categories of personal electronic health data in Article 14(1), points (a), (b) and (c), and to EHR systems intended by the manufacturer to process such categories of data, and from to the categories in points (d), (e) and (f), and to EHR systems intended by the manufacturer to process them.
Article 22 makes the supervisory authorities responsible for monitoring and enforcing Regulation (EU) 2016/679 also competent for monitoring and enforcing Articles 3 and 5 to 10 of the Regulation. Article 22 empowers those supervisory authorities to impose administrative fines up to the amount referred to in Article 83(5) of Regulation (EU) 2016/679.
Article 99 requires Member States to lay down the rules on penalties applicable to infringements of the Regulation, in particular for infringements which are not subject to administrative fines pursuant to Articles 63 and 64. Article 100 gives any natural or legal person that has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation in accordance with Union and national law.
When LexLint raises it
When your app profile says your app handles health records.