EHDS: the European Health Data Space has entered into force — why to start preparing in 2026

In force since March 26, 2025, Regulation (EU) 2025/327 establishing the European Health Data Space (EHDS) is the most structuring text of the decade for digital health: it will organize patients’ access to their data across the Union, the interoperability of records through a European exchange format, and a harmonized framework for reusing data for research and health-system management.

A phased rollout — and one still in flux

Application is staggered: the main primary-use obligations (data sharing for care, exchange format, patient access) ramp up from 2029, with reuse (secondary use) following its own timeline. The implementing acts specifying formats and practical arrangements arrive in waves: our regulatory watch tracks every development.

This apparent lead time is deceptive: the workstreams the EHDS requires — data quality and structuring, system interoperability, access governance — are counted in years, not months.

Who is concerned, in very practical terms

Healthcare facilities will have to make their records interoperable and manage the specific rights created by the EHDS. Vendors of electronic health record systems (EHR and specialty software) will see their products subject to dedicated self-certification and marking requirements. Research players will access data through dedicated access bodies, under harmonized rules.

The link with your GDPR compliance today

The EHDS does not replace the GDPR: it sits on top of it. A solid record of processing activities, a mapping of data flows and clear governance of access rights are exactly the foundation the EHDS will build on. Organizations whose GDPR compliance is robust will absorb the EHDS; the others will face two projects in one.

This is, moreover, one of our academic research areas — legal and regulatory interoperability — which we put to work for our clients: preparing organizations today for tomorrow’s frameworks.

The new patient rights

The EHDS creates rights that will add to those of the GDPR: immediate, free access to one’s electronic health data in a readable, shareable format; the ability to have one’s data forwarded from one professional to another, including in another Member State via the MyHealth@EU infrastructure; the insertion of information into one’s own record; information about the accesses the record has been subject to; and, for data reuse (secondary use), an opt-out mechanism that each Member State must organize.

For facilities and software vendors, each of these rights translates into a functional requirement: identity management, access logging that can be presented to the patient, export in the European exchange format. All workstreams to put on product and IT roadmaps now.

Secondary use: what becomes possible — and what remains prohibited

The “secondary use” chapter harmonizes the reuse of health data for research, innovation, public health and health-system management purposes: applications reviewed by health data access bodies (in France, the Health Data Hub is set to play a central role), processing in secure environments, and pseudonymized or anonymized data depending on the case.

The Regulation also sets explicit prohibitions: no reuse for advertising, for assessing an individual to the detriment of their insurance coverage, or for any decision harmful to the person. A clear signal: health data will be opened up within a framework of trust, not a wild west.

Where to start in 2026

Three no-regret workstreams, whatever the final timeline: map your electronic health data precisely (where it is, in what formats, under which authorizations); converge on the interoperability standards promoted in France by the Agence du Numérique en Santé, which prefigure the European format; and structure access governance — authorizations, logging, procedures for responding to requests. This foundation serves today’s GDPR compliance and tomorrow’s EHDS.