knowledge 24 July 2026 |

European Health Data Space Regulation: Primary Use Provisions

The EHDS Regulation is a major EU initiative for optimising the use of electronic health data. It aims to empower patients to have greater access to and control over their electronic health data for healthcare provision, while also giving them new patient rights. Critically for health data holders, the EHDS Regulation also imposes new obligations on those who hold or process personal electronic health data in the specified priority categories.  It will apply from 26 March 2027, but certain elements will only become applicable at later dates.

WHO IS A HEALTH DATA HOLDER?

Under the EHDS Regulation, a ‘health data holder’ is broadly defined to include any entity that has the legal right, obligation, or practical ability to make available electronic health data. This includes public and private healthcare and care bodies; entities developing health, care or wellness products or services; and certain research actors. The definition is significant because the primary use obligations attach to organisations that hold or process personal electronic health data falling within the priority categories set out below.

For some organisations, it is obvious that they are health data holders. For others, this may come as an unwelcome surprise.

PRIMARY USE OF ELECTRONIC HEALTH DATA

The EHDS Regulation aims to empower patients to take control of their personal electronic health data through better digital access. Patients will be able to access and share specific categories of their electronic health data for healthcare provision (referred to as ‘primary use’).

Patients will be able to exercise their rights through ‘electronic health data access services’ established by Member States. These are online services like a portal or an app. Patients can exercise this access right immediately after their personal electronic health data has been recorded in an Electronic Health Record (EHR) System (subject to certain exceptions). For health data holders, this means that relevant priority-category data must be made available through these national electronic health data access services in the European electronic health record exchange format.

Access is to be given to the following ‘priority categories’ of data, which will apply in two phases:

First phase (26 March 2029):

• Patient summaries.
• Electronic prescriptions.
• Electronic dispensations (i.e. information that a prescription has been dispensed).

Second phase (26 March 2031):

• Medical imaging studies and related imaging reports.
• Medical test results (including laboratory and other diagnostic results).
• Discharge reports.

In addition to this access right, patients will also have rights similar to those afforded to data subjects in relation to their personal data under the GDPR. For example, patients will have download, rectification, portability and restriction rights. 

For health data holders, each of these patient rights gives rise to corresponding obligations. Health data holders must structure, register, and be able to transmit electronic health data in ways that enable the Member State’s electronic health data access services to deliver access, download, portability, correction, restriction, logging, and opt-out functionality to patients.

In addition to patient access, healthcare professionals may access the priority categories of personal electronic health data for patients under their treatment, including across borders via the MyHealth@EU cross-border digital infrastructure, to support safe, high-quality and continuous care. Health data holders must therefore also facilitate access by treating healthcare professionals through the relevant national services.

IMPLEMENTATION IN IRELAND

To facilitate patients in exercising these new rights, Ireland is required to establish one or more ‘electronic health data access services’ at a national, regional or local level. On 30 April 2026, a central component of Ireland’s legislation for EHDS, the Health Information Act 2026, was signed (but has not yet been commenced).

The Act provides that the Health Service Executive will create and assign a national electronic health record to each patient and the contents of the record will reflect the priority categories of data provided for in the EHDS Regulation. Minister for Health, Jennifer Carroll MacNeill, described this as “a key strategic enabler of ‘Digital for Care: A Digital Health Framework for Ireland 2024-2030’ as well as the first in a suite of legislative measures to give full effect to the European Health Data Space (EHDS) Regulation. Today brings us one step closer to ensuring that Ireland has a fit-for-purpose health information system that, first and foremost, enhances patient care and treatment”.

OBLIGATIONS FOR HEALTH DATA HOLDERS: EHR SYSTEMS AND INTEROPERABILITY

The EHDS Regulation creates a single market framework for EHR Systems, including requirements for their development, marketing and use. While the direct conformity and certification obligations fall primarily on manufacturers and other economic operators, health data holders that deploy or rely on EHR Systems will need to ensure that those systems are capable of supporting the EHDS requirements for access, exchange, logging, restriction, and interoperability. In practice, this means that legacy systems must be aligned with the European electronic health record exchange format and the national electronic health data access services, particularly for the priority data categories.

ENFORCEMENT

Member States are required to establish enforcement structures and penalties for infringements of the EHDS Regulation. Those penalties must be effective, proportionate, and dissuasive. For health data holders, non-compliance risk is therefore primarily a matter of national enforcement under Member State penalty regimes implementing the EHDS, alongside any applicable enforcement under the GDPR where the conduct also involves a breach of personal data protection obligations.

KEY COMPLIANCE MILESTONES

Health data holders should note the following phased compliance milestones under the EHDS Regulation:

• 26 March 2027: General application date of the EHDS Regulation.
• 26 March 2029: First operational wave for priority categories: patient summaries, electronic prescriptions, and electronic dispensations.
• 26 March 2031: Second operational wave: medical imaging studies and related imaging reports, medical test results, and discharge reports.

CONCLUSION

Greater access to electronic health data will improve healthcare delivery and treatment, but it requires health data holders to take proactive steps to ensure compliance. Health data holders should begin identifying whether they hold priority-category electronic health data, assessing the readiness of their EHR Systems for EHDS interoperability, and planning for connectivity with national electronic health data access services. At a national level, the EHDS Regulation is one of the key factors driving forward Ireland’s digitalisation of healthcare, which will also present opportunities in other areas such as the reuse of electronic health data for secondary use purposes including research. Please see our previous briefing on the secondary use provisions: EHDS Regulation: Secondary Use of Electronic Health Data.

Please contact one of the key contacts below for further information.