The European Health Data Space, explained for health IT and software teams

The short answer

The European Health Data Space (EHDS) Regulation, Regulation (EU) 2025/327, was published on 5 March 2025 and entered into force on 26 March 2025.¹ It does two things. For primary use (care), it gives patients free online services to view their health data, see who has accessed it, restrict access and report errors, and makes key data exchangeable across the EU from 2029 and 2031.²¹ For secondary use (research, policy), it lets approved users access data under permits from health data access bodies.¹ EHR system makers must build in two harmonised components: one for interoperability and one for logging.²

This post summarises the Commission’s own pages and FAQ. It isn’t legal advice.

The timeline

The long lead times reflect how much has to be built: national services, a European exchange format, testing environments and implementing acts.

Primary use: what patients get

The Commission’s FAQ describes free health data access services with a dashboard where patients can view their data, see who has accessed it, report inaccuracies, restrict access and manage proxies.²

Restriction. Patients can limit who sees all or parts of their priority-category data. Restricted data isn’t visible to health professionals through EHDS services, and there’s a break-the-glass exception for critical situations, such as an unconscious patient in an emergency room.²

Opt-out. Member States may, by national law, let patients opt out of the EHDS primary-use exchanges altogether. Opting out doesn’t change what the treating provider records; a hospital keeps its own documentation but can’t share it through EHDS services.²

Digital health authorities in each Member State organise primary-use implementation, including the technical solutions for these patient rights.²

EHR systems: two harmonised components

For EHR system manufacturers, the FAQ lists the steps before placing a system on the EU market:²

1. Provide the capabilities of the two harmonised components: the European interoperability software component and the European logging software component.
2. Pass tests in the European digital testing environment.
3. Draw up technical documentation and an information sheet.
4. Draw up the EU declaration of conformity.
5. Affix the CE marking.
6. Register the system in the EU database.

The logging component is what makes “see who has accessed my data” possible. A dashboard can only show access that the EHR system recorded.

Secondary use

Secondary use covers research, innovation, policy-making and similar purposes. Access is based on a permit issued by a health data access body.¹ Rules start applying to most data categories in 2029 and to the rest in 2031.¹ Patients have a right to opt out of secondary use in many cases, with exceptions the regulation sets out.

For health IT teams, secondary use means data holders must be able to provide datasets when a permit is granted. That’s a data engineering and governance job, separate from the primary-use logging work.

What the logging requirement means in practice

The regulation makes access logs patient-facing. That changes their quality bar. An internal audit log can be cryptic and incomplete without anyone outside IT noticing. A log that patients read through a national dashboard can’t.

Existing standards give a head start. ISO 27789 asks each audit record to identify at least the user, the subject of care, the function performed and the date and time.⁴ FHIR R4 AuditEvent records type, time, agents and source, and servers generally don’t allow it to be updated or deleted.³

Three practical questions to work through now:

• Who is “the user” when software accessed the data? If an AI tool or interface engine reads a record, the log should name it, and the person or service it acted for. A dashboard showing a clinician’s name for an automated read is misleading.
• What counts as access? Reads, searches and exports, not just edits.
• Can the log be trusted? Patient-facing logs will be questioned. Make tampering detectable.

Our audit record fields post lists what to capture for software actors.

A checklist for vendors and hospitals

EHR vendors

• Track the implementing acts for the interoperability and logging components.²
• Make sure every access, including by integrations and AI tools, is logged with a distinct identity.
• Plan for testing in the European digital testing environment before market placement.²

Hospitals

• Inventory which systems hold priority-category data for 2029 (patient summaries, prescriptions) and 2031 (images, labs, discharge reports).¹
• Check that clinical systems can honour patient restrictions and record break-the-glass use.²
• Prepare for patients asking why a given person or system accessed their record.

Questions people ask

When does the EHDS start to apply?

It entered into force on 26 March 2025; key primary-use obligations start in March 2029 and March 2031, with digital health authorities due by 26 March 2027.¹²

Can patients see who accessed their health data under the EHDS?

Yes. The access services include a dashboard showing who has accessed the patient’s data.²

What must EHR systems include?

The European interoperability software component and the European logging software component, tested before market placement.²

For how records of automated actions can be signed and checked by anyone, see the provenance spec and our healthcare overview. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.