Final EHDS Regulation Adopted: Legal Insights for Cross-Border Health Data Management
Emil Kjeldahl Bjerregaard Bjerrum and Egil Husum from Bech-Bruun provide an in-depth analysis of the newly adopted Regulation (EU) 2025/327 on the European Health Data Space (EHDS). They explore the significant legal implications for life sciences companies, focusing on cross-border health data access, patient rights, and compliance challenges, while highlighting the opportunities and risks for stakeholders.
Emil Kjeldahl Bjerregaard Bjerrum
View firm profile
Egil Husum
View firm profileThe European Health Data Space (EHDS) Regulation, now formally adopted as Regulation (EU) 2025/327, was published in the Official Journal on 5 March 2025 and will enter into force on 26 March 2025. This marks the beginning of a transition period, during which organisations must prepare for compliance before the regulation becomes fully applicable in March 2029 for most data categories. This Regulation introduces significant legal implications for life sciences companies, particularly in the areas of cross-border health data access, patient rights and compliance challenges, presenting both opportunities and risks for stakeholders.
Background
On 5 March 2025, the Council of the European Union officially published Regulation (EU) 2025/327 on the European Health Data Space (EHDS). This regulatory framework forms a cornerstone of the EU’s broader Data Strategy, aimed at enhancing the accessibility and utility of electronic health data (EHD) while ensuring robust legal protection of patient rights.
Key Implementation Timelines
- In March 2025, the EHDS Regulation enters into force, marking the beginning of the transition period.
- March 2027 is the deadline for the European Commission to adopt key implementing acts, which will define operational details for the EHDS framework.
- In March 2029, key provisions, including new health data rights and rules on secondary use, become applicable for most data categories.
- In March 2031, additional provisions on primary use, such as the mandatory exchange of medical images, lab results, and hospital discharge reports, become operational across all EU member states. Rules on secondary use will also start applying to remaining data categories (eg, genomic data).
Key Changes Made to the Final EHDS Text
Compared to the European Commission’s proposal, the final text of Regulation (EU) 2025/327 introduces several key modifications, including:
- Defined Process for IP and Trade Secret Protection: Data holders must identify which parts of their data sets qualify for protection and justify the need to the Health Data Access Body (HDAB). The HDAB will determine the appropriate legal, organisational, or technical measures and has the authority to refuse EHD access requests.
- Expansion of Secondary Use Categories: The list of minimum categories for secondary use has been broadened, covering aggregate healthcare data, healthcare financing, reimbursement claims, medical device-generated health data, and clinical study data.
- Stronger Regulatory Enforcement: Market authorities in member states are granted increased powers to evaluate Electronic Health Record (EHR) systems, enforce compliance, and take remedial actions, including market restrictions where necessary.
- Enhanced Patient Rights: The Regulation strengthens patients’ ability to access and control their EHD, with mandatory transparency measures.
- Opt-Out Mechanism: Member states retain discretion to implement an opt-out process for EHD use, subject to safeguards ensuring reversibility and public health considerations.
- Stricter Compliance for EHR Systems: The Regulation expands conformity requirements for EHR Systems, mandating self-certification via digital testing environments, optional national requirements and post-marketing obligations – eg, reporting and complaints handling.
- Data Localisation Rules: EHD must be stored within the EU or in third countries that have received adequacy certification, such as the United States or the United Kingdom.
Legal Implications for Life Sciences Companies
The EHDS Regulation introduces comprehensive legal requirements for life sciences companies, particularly those involved in clinical trials, biotechnology and digital health. Key legal considerations include:
- Mandatory Data Sharing: Companies classified as health data holders must share EHD for secondary use, ensuring the protection of intellectual property (IP) and trade secrets.
- Contractual Revision: Agreements involving third-party EHD handling must comply with EHDS standards.
- Severe Penalties for Non-Compliance: Non-compliance may result in fines comparable to GDPR penalties, from EUR10 million or 2% of total worldwide turnover to EUR20 million or 4% of total worldwide turnover for severe breaches.
- Cross-Border Compliance Challenges: Companies must navigate EHD localisation requirements while ensuring conformity across jurisdictions.
Next Steps for Legal and Regulatory Compliance
The key next steps for legal and regulatory compliance include:
- conducting a legal GAP analysis/audit to align data management practices with Regulation (EU) 2025/327, while considering related regulations such as GDPR, NIS2, the Data Act and the Cyber Security Act;
- developing a compliance roadmap addressing technical, legal and operational changes within the implementation timeline (2025-2031);
- engaging in stakeholder consultations to understand the impact of new EHD-sharing obligations;
- establishing internal protocols for managing data requests and IP protection in secondary use applications; and
- staying informed of regulatory developments and conducting internal training sessions to maintain compliance.
Conclusion
Regulation (EU) 2025/327 on the European Health Data Space represents a paradigm shift in the management of EHD in the EU, bringing far-reaching legal consequences for life sciences companies. By implementing proactive compliance measures and strategic planning, companies can mitigate risks while capitalising on the opportunities offered by the Regulation.
Bech-Bruun’s team of legal experts is available to guide you through these complexities, ensuring full compliance with the Regulation (EU) 2025/327 while maximising the potential benefits of the new EHDS framework.
Bech-Bruun
13 ranked departments and 37 ranked lawyers
Learn more about the firm's ranking in Chambers Europe
View firm profile