knowledge 20 January 2026 |

EHDS Regulation: Secondary Use of Electronic Health Data

In 2025, the European Health Data Space Regulation (“EHDS Regulation”) was adopted marking a major development for life sciences organisations (particularly clinical trials sponsors) in optimising the use of electronic health data for secondary use purposes such as research, innovation and policy-making. The EU hopes that the secondary use provisions will drive developments in the form of new medicines and medical devices. Most of the secondary use provisions will become applicable in March 2029, giving organisations just over three years to prepare.

Secondary use purposes

Under the EHDS Regulation, ‘health data holders’ (which include healthcare providers and organisations performing health research) will be required to make extensive categories of electronic health data available for specified secondary use purposes. A third party who wishes to obtain access to such data for a specified secondary use purpose may seek to do so via an application to a ‘health data access body’. If a health data access body is satisfied that the applicant meets the applicable conditions, it will authorise the applicant to use the requested data for secondary use purposes which include:

1. Scientific research related to health or care sectors, which is defined broadly to include product and service development and innovation as well as the training, testing and evaluation of algorithms (including in medical devices, digital health applications and AI systems).
2. Education or teaching activities in health or care sectors.
3. Improving the delivery of care, treatment optimisation and provision of healthcare.
4. In the case of public sector bodies, (i) policy-making and regulatory activities; (ii) statistics; and (iii) public interest for public or occupational health, such as protection against serious cross-border threats, public health surveillance or activities aimed at ensuring high quality and safe healthcare.

Electronic health data cannot be used for prohibited purposes, such as advertising or marketing activities or developing products or services that may harm individuals, public health or society, such as illicit drugs, alcohol, tobacco, nicotine products or addictive products and services.

Categories of electronic health data

Some of the categories of electronic health data to be made available for secondary use include:

• Electronic health data from electronic health records (e.g. medical history, diagnoses and treatments).
• Data on factors that impact health including socioeconomic, environmental and behavioural determinants of health (e.g. impact of vaping).
• Data on pathogens impacting human health. For example, data from the Computerised Infectious Disease Reporting (CIDR) system.
• Healthcare-related administrative data (including data on medicines dispensed, hospital discharge records, reimbursement claims and reimbursement).
• Genetic and genomic data.
• Personal electronic health data automatically generated by medical devices.
• Other health data from medical devices (e.g. pacemaker data).
• Data from wellness Apps.
• Data from medical registries (e.g. data from organ transplant registries) and mortality registries.
• Population-based health data (e.g. data from public health registries such as the National Cancer Registry of Ireland (NCRI)).
• Data from completed clinical trials, investigations and studies.
• Data from research cohorts, questionnaires and surveys.

Most of the data categories are to be available for secondary use by March 2029, with the later date of March 2031 applying to a few of the datasets (e.g. data on factors impacting health).

Accessing electronic health data for secondary use purposes

Access to electronic health data will be carried out under the supervision of a Health Data Access Body (“HDAB”), which each EU Member State is to designate by 26 March 2027. At the time of publication, Ireland has not yet designated its HDAB. However, it has established HealthData@IE, which is Ireland’s national project that is focused on setting up health data access services.

The EHDS Regulation introduces two main pathways for accessing electronic health data, which differ largely in terms of the data access format (i.e. pseudonymised or anonymised format or statistical format) and processing time:

 

	Health Data Access Application	Health Data Request
Access form	A natural or legal person submits a ‘health data access application’ to a HDAB for access to electronic health data in a pseudonymised or anonymised format. Where an application is made for pseudonymised data, the applicant must justify why the processing cannot be carried out using anonymised data and describe how the processing complies with the GDPR.	A health data applicant may submit a ‘health data request’ for access to electronic health data in an anonymised statistical format.
Timeline	3 to 6 months	6 months
Outcome	Data permit may be issued by the HDAB where the requirements are met. Data permit may last for up to 20 years: Permit is issued for the duration needed to fulfil the requested purposes, which shall not exceed 10 years. Permit may be extended for a further period of up to 10 years.	HDAB issues a response confirming if the request has been approved.
Templates	The European Commission will provide templates for the health data access application and data permit. Templates will be set out in implementing acts to be adopted by the European Commission by 26 March 2027.	The European Commission will provide a template for the health data request. The template will be set out in an implementing act to be adopted by the European Commission by 26 March 2027.

In addition to the two pathways above, a simplified procedure that takes 4 months may be available for access to electronic health data that is held by a ‘trusted health data holder’. Member States are permitted to establish a procedure whereby health data holders can apply to be designated as a ‘trusted health data holder’ where they meet certain conditions.

Obligations on Health Data Holders

To facilitate the reuse of electronic health data for secondary use purposes, health data holders will be required to make a wide range of datasets available to the HDAB, following the issuance of a data permit or the approval of a health data request.

Regardless of whether a health data holder is the subject of a data permit or a health data request, it will be required to provide the HDAB with a description of the datasets it holds for inclusion in national and EU data catalogues. The health data holder will also be required to carry out annual checks to verify and ensure that the information in the catalogue is accurate and up to date. This will be a significant task for organisations, and it is recommended that they start data mapping and considering strategies for the protection of trade secrets and intellectual property.

Opt-Out

Individuals will have the right to opt-out from the use of their electronic health data for secondary use purposes. This right will be exercisable at any time, and a patient does not need to have a reason to opt-out. Member States are to provide for an “accessible and easily understandable opt-out mechanism”.

Next Steps

In Ireland, the use of health data for health research purposes has been challenging for many years, as subject to limited exceptions patients’ explicit consent is required by the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (as amended) (“Health Research Regulations”).  This has been considered by many stakeholders to have been a complicating factor regarding the conduct of clinical trials and other health research in Ireland. On 19 November 2025, the Health Information Bill 2024, which is intended to give further effect to the EHDS Regulation in Ireland, moved a step closer in the Irish legislative process to being finalised. While it does not propose amending or repealing the Health Research Regulations, the Department of Health has stated that “The Health Information Bill is the first in a suite of planned legislative measures to give full effect to the EHDS Regulation at a national level”. It remains to be seen what further legislative initiatives will emerge in connection with the EHDS and what impact they will have on the Health Research Regulations.

More generally, the EHDS Regulation will provide those interested in health research with opportunities to access datasets held by other organisations and Member States for use in clinical trials and other secondary use purposes. However, it will impose additional obligations on organisations who are health data holders and, for some organisations, could have a negative commercial impact on their operations. As a result, all organisations within the scope of the EHDS Regulation will need to consider its implications and prepare for its application from March 2029.

For further information, please contact one of the key contacts below.