EHDS on the Horizon

The Regulation on the European Health Data Space (EHDS) establishes a common framework across the European Union to facilitate secure access to, and the exchange and use of, electronic health data. It aims to enable citizens to better access their own health data and keep control over it, while strengthening the interoperability of health data and health systems across Europe. It also creates a secure framework for putting this data at the service of research, innovation and the improvement of health systems.

A new era for health data in the European Union

The EHDS aims to facilitate access to health data and its secure exchange across the European Union. By strengthening the interoperability of health data and health systems, it will make it easier for health data to follow citizens throughout their care pathway, through shared care records accessible to the relevant health professionals. This continuity will also be ensured when a citizen receives care in another EU country, for a smoother, better coordinated and safer experience. 

Empowering individuals

Thanks to the EHDS, citizens will be able to access their health data more quickly and easily. They will have greater control over their data and how it is shared, enabling them to play an active role in managing their health.

Enabling the secure and trustworthy re-use of health data

The EHDS also establishes a framework for the secure and responsible re-use of existing health data for purposes such as research, innovation, public health, education, and policymaking. This data will thus help advance knowledge, develop new treatments and improve health services and systems, while respecting citizens’ rights and the protection of their data.     

Learn more about the EHDS:

• Visit the European Commission’s website
• Read the European Commission's FAQ on the EHDS (health.ec.europa.eu)
• Read the European Commission introductory presentation (Pdf, 1.30 Mb) on secondary use

When will EHDS be implemented?

The EHDS was adopted in March 2025 and constitutes a key component of the European strategy for data and the European Health Union. Its implementation will be gradual: most provisions governing the re-use of health data will apply from March 2029.

Key considerations:

• Several implementing acts on key elements of the EHDS, such as on cross-border cooperation and the technical requirements for the secure processing environments, have been and will be adopted. Luxembourg is contributing to this work. For more information on the implementing acts, visit EUR-Lex.
• In parallel, the review of the national legislation needed to implement the EHDS is under way in Luxembourg.

The timeline:

LETZDATA – Luxembourg Data Factory is actively contributing to the DigiSanté programme led by the Ministry of Health and Social Security, which oversees the implementation of the EHDS in Luxembourg. In this context, the Luxembourg Data Factory is laying the groundwork for the reuse of health data in line with this new European framework, notably through the designation of a national body responsible for access to health data (HDAB).

Luxembourg's Health Data Access Body (HDAB)

Building on its role as the competent authority responsible for granting authorisations for re-use of public sector data under the Data Governance Act (DGA), the Luxembourg Government has designated the Government Commission for Data Sovereignty (CGSD) as the sole HDAB for Luxembourg.
 

By designating the CGSD, the Luxembourg Government is continuing to implement its Data Strategy (Pdf) and has opted for a single, central authority responsible for issuing the permits required for the re-use of data by public and private sector actors. The choice of a single authority also aims to ensure a consistent approach between the public sector data access procedures provided for by the DGA and those applicable to health data under the EHDS, while limiting fragmentation and complexity for the actors concerned.

Read Luxembourg’s Data Strategy here (Pdf). 

Why re-use health data?

Re-use of health data can serve several objectives

The possibilities are vast. Researchers, public bodies and innovators can rely on real-world, evidence-based data to advance knowledge, develop health solutions and improve the functioning of healthcare systems.

What does the re-use of health data make possible?

The potential of health data goes well beyond the care of individual patients. When re-used in a secure and responsible manner, it becomes a catalyst for scientific research and innovation and can help inform health policies and strengthen public health systems.
 

A framework for the re-use of health data thus contributes to the development of care better adapted to patients’ needs, improved diagnoses and more efficient healthcare and care systems. 

Who can access the data?

Access to health data may, amongst others, be requested by:

• public administrations and other public sector bodies
• researchers and research organisations
• companies and other innovation stakeholders

However, access is neither automatic nor unlimited: it takes place within a strict framework, designed to guarantee the protection of individuals and ensure use in line with the authorised purposes.

The data catalogue

To help re-users find relevant information, a health data catalogue describing the datasets, their sources and their conditions for re-use will be made available online.
 

In addition, the European Commission will maintain a central EU-level health data catalogue that will connect all national catalogues, acting as a single search point for discovering health data across the Union.
 

In Luxembourg, a catalogue published on LetzData will list the public sector data as well as the data within the scope of the EHDS that are available for re-use.

Secure re-use of data

Health data will always be pseudonymised, anonymised and/or aggregated in accordance with the CGSD’s decision before being made available to re-users.
 

For example, individual-level pseudonymised data can only be made available for re-use after a data permit has been issued by the CGSD. Once the permit has been granted, health data holders will transmit the data covered by the permit to the CGSD, which will prepare it (for example by pseudonymising, anonymising or aggregating it). The prepared data will then be made available to re-users in a secure processing environment (SPE). 

*General overview (non-exhaustive)

Learn more:

• Accessing public sector health data before 2029 (Pdf, 199 Kb)
• About the secure processing environment for the re-use of public sector data

Who does what?

Making health data available is a responsibility shared between the different actors.

• The HDAB ensures compliance with the regulatory framework and examines applications and requests. It is responsible for the processing it carries out in the course of its tasks.
• The health data holder is responsible for transferring the data to the HDAB, in accordance with the applicable framework.
• The re-user is responsible for using the data in compliance with the regulatory requirements and the conditions set out in the data permit.

A common principle: protecting individuals

Whatever their role, all actors must comply with the fundamental principles of data protection, namely data minimisation, security, lawfulness, transparency and compliance with the authorised purposes.
 

The re-use of health data relies on pseudonymised or anonymised data, in order to prevent the direct identification of the data subjects concerned.
 

The objective is clear: to strike the right balance between making the most of health data and protecting individuals’ rights and freedoms.

The EHDS defines health data holders broadly, encompassing a wide range of actors operating in the healthcare and care sectors. These may include:

• healthcare providers, such as hospitals and clinics,
• public authorities, agencies and other bodies operating in the health or care sectors, including in the area of reimbursement, as well as mortality registries,
• research organisations and infrastructures carrying out research activities relating to the health or care sectors,
• private sector companies developing products or services intended for the health, healthcare or care sectors.

The EHDS requires health data holders to make a wide range of personal and non-personal electronic health data that they control available for re-use (e.g. electronic health data from electronic health records (EHRs), healthcare-related administrative data, research data and data from fitness trackers). 

Learn more:

• Am I a Health Data Holder? (Pdf, 217 Kb)
• Obligations for Health Data Holders (Pdf, 103 Kb)