Initial reactions to the European Health Data Space proposal

Executive summary

The proposed European Health Data Space (EHDS) is not a mere regulation, it is a vision for the future of health and care for Europe. More effective use of health data is necessary to address diseases impacting often vulnerable communities. We need this vision to urgently become reality through swift implementation of the EHDS framework, empowering doctors, nurses, patients, researchers and innovators in fighting diseases and improving health outcomes. Urgency is further magnified by the expected 1.2 million additional annual cancer patients in Europe by 2040.[1] DIGITALEUROPE is committed to contributing to an EHDS that merits full support and encourages implementation by all Member States.

This paper is an initial reaction to the proposal. Further discussions and analysis will inform our recommendations to finetune this first sectoral data space proposal. Our seven initial reactions are:

• Reduce complexity: Clear delineation and interplay between related pieces of legislation is crucial not only for legal certainty but also to build trust in more effective use of (health) data which will be vital to achieving the EHDS’s objectives. [2] More clarity is needed on the interplay between the General Data Protection Regulation (GDPR) and the EHDS as well as the Data Governance Act and the proposed Data Act and AI Act, but also sectoral legislation such as the Medical Device Regulation and the Clinical Trials Regulation and other health legislation.
• Create clarity for “data holders”: The definition of data holder is currently very broad and could cause confusion about roles and responsibilities. While industry agrees that “all measures necessary” should be taken to preserve intellectual property rights, there is little clarity on what these measures might include.
• Enable useful data analysis: The proposed federated data network for secondary use in Chapter IV is a secure and privacy preserving approach for the analysis of anonymised and, only where properly justified, pseudonymised data. When properly justified, data linkage should be possible without re-identifying the individual, which is key to making prevention and treatment possible, much faster, safer, for instance for rare disease patients – currently affecting 30 million EU citizens. To better understand the impact of access, sharing and use, further articulation of the Secure Processing Environments concept is needed.
• Ensure EHR systems’ certification is proportionate: The proposed supervised certification scheme should clearly delineate the scope of Electronic Health Record (EHR)-systems from medical devices and “high-risk AI”. Duplication and confusion will result in regulatory uncertainty, increased compliance costs and administrative burden.
• Streamline health data sharing and access: The envisaged procedures and fee structures should be fair and require much more clarity. In any case, when a permit is granted, the “single access point” principle should be leading.
• Enable the global endeavour of innovation and R&D: To drive innovations globally, Europe needs aligned standards for interoperability and a clear legal framework for international data flows.
• Make the EHDS and its Board inclusive: The health ecosystem requires a broad range of its key members to be present and engaged. Health communities – including patients and health professionals – innovators, regulators and policymakers all form an essential link in the health data value chain.

Keep the EHDS ambitious

We are great supporters of the ambitions outlined in the Commission’s proposal for a regulation on the European Health Data Space[3] (EHDS). Especially as the health sector is in desperate need of European coordination. The COVID-19 pandemic brought to light unacceptable shortcomings in Europe’s ability to ensure continuation of care and to access and use health data at scale to develop, monitor and to produce medical evidence. Considering the ageing population, increasing cancer incidence, and unmet medical needs of so many patients with rare diseases, complacency is not an option and following through on the proposal’s ambition will be crucial.

Whether Europe will be able to harness its world-class health systems or not, health and care are rapidly digitalising, integrating AI into workflows. Prevention, telemedicine and -monitoring, population health management, personalisation, innovative clinical trials and medical devices, precision medicine, and advanced modelling are key growth areas, and they all require reliable data, legal and regulatory certainty, and trustworthy IT and governance.

Health communities – including patients and health professionals – innovators, regulators and policymakers all form an essential link in the health data value chain. They should all be fully involved. The proposal reflects this holistic vision, and DIGITALEUROPE looks forward to a collaborative approach to finetune, implement and operationalise the EHDS.

Improve common understanding

The proposal cements concepts from the GDPR, the Data Governance Act (DGA), and the proposed Data Act, and introduces new concepts. Altogether, this has formed a complex regulatory landscape to navigate.  All too important, governments, data subjects, controllers and processors need to understand their rights, obligations and responsibilities. This will generate acceptance, harmonise implementation and foster collaboration.

Health data is generated by people and their acceptance of data use is key; it increases with better understanding of the EHDS.

During DIGITALEUROPE’s Summer Summit[4], the attendees were first asked if, given today’s rules and safeguards (i.e., GDPR), they would share data on their health with a physician, researchers or for developing AI used in researching vaccines and in preventing and treating diseases – 75% said YES.

After the panel discussion, participants were asked if they felt the EHDS proposal as drafted will advance medical research in the field of vaccine development, the prevention and treatment of diseases in Europe – 81% said YES.

Crucially, industry too needs more clarity on the proposal to better understand its impact on companies and society. For example, the EHDS builds on the GDPR where the data protection rules have been implemented in a very fragmented way. If anything, the EHDS should improve this situation. In this regard, there are some important questions to answer, such as: who qualifies as “data holder”, and how does this concept relate to the GDPR’s concepts of “data controller” and “data processor”? The same can be said for the interplay with the DGA and the proposed Data Act and AI Act, and sectoral legislation such as the Medical Device Regulation and the Clinical Trials Regulation (and more).

The horizontal framework for data protection remains vital for health data to be used for care or research. It will still require harmonisation of data protection rules across Member States, and more clarity on the concept of “personal data” and “non-personal data”, as well as adequate anonymisation and pseudonymisation methods through guidelines from the European Data Protection Board (EDPB).

Initial views from industry

DIGITALEUROPE represents bigger and smaller players in the health ecosystem, both tech and more traditional health companies. On 20 June, our Executive Council for Health convened to discuss the proposal in light of its two recent reports covering the building blocks for a trustworthy EHDS with case studies and potential and needs for health innovation to be driven in Europe. These reports focus heavily on the potential benefits of data access, sharing and use. Contributing to the realisation of such benefits for patients and healthcare systems, we would like to highlight the following:

Create clarity for “data holders”: Reference is made to the “data holder” in the Chapters covering both primary and secondary use (II and IV). As for the data sharing obligation, our current reading of the text shows a wide scope of data sharing relationships, such as to patients, between public bodies and private companies, and even between competing companies. This, among other new definitions, requires further consideration. In any case, clarity is needed on the provisions on Intellectual Property (IP) and trade secret protection. While industry agrees that “all measures necessary” should be taken to preserve intellectual property rights, there is little clarity on what these measures might include. See for reference Art. 33(4), 34(4), and 37(1)(f).

Enable useful data analysis: The proposed federated data network in Chapter IV is a secure and privacy preserving approach for the analysis of anonymised and, only where properly justified, pseudonymised data (re-identification by data users is not permitted: see Art. 44(3)). Linkable data plays an important role in research as the goal of research is to understand disease development and treatment which is a long-term – sometimes lifelong – process. Linkable data is also key to make prevention and treatment possible, much faster, safer, especially for rare disease patients – currently affecting 30 million EU citizens. [5] To better understand the impact of access, sharing and use, further articulation of the Secure Processing Environments concept is needed (see Art. 50).

Ensure EHR systems’ certification is proportionate: By 2030, all Europeans should be able to manage their health data in their EHRs at home or across borders. Here, interoperability, useability, and security will be key and to achieve that, the proposed supervised certification scheme should clearly delineate the scope of EHR-systems from medical devices and “high-risk AI”. Duplication and confusion will result in regulatory uncertainty, increased compliance costs and administrative burden. See for reference Chapter III.

Streamline health data sharing and access: For secondary use, in Chapter IV, the procedures and fee structures should be fair and require much more clarity. When a permit is granted, the “single access point” principle should be leading for access and use by researchers and innovators.

Enable the global endeavour of innovation and R&D: If, on the one hand, interoperability standards diverge from international developments and, on the other hand, data transfers and access to third countries are further complicated, even for non-personal data, Europe’s ambition to competitively drive health innovation globally will be impeded. It is concerning that reference to harmonised standards is fully absent, and that the proposal opens the door to legal confusion. The EHDS can further complicate an already increasingly labyrinthian legal framework for international transfers and access of both personal and non-personal data.[6] See for reference Art. 61-63. This is also important because European and international companies are deeply intertwined with the research and SME communities in Europe. Through their cooperation, these communities have the needed resources (funding, expertise, partnerships with public research and people), the capabilities and the global reach.

Make the EHDS and its Board inclusive: The Proposal covers a broad range of actors in the health ecosystem. Health communities – including patients and professionals – innovators, regulators and policymakers all form an essential link in the health data value chain. It is important to have a body for cooperation between governing bodies, contributing to the consistent application throughout the EU. When setting up the EHDS Board (see Art. 64-65), it will be vital that all stakeholders take part, from patient associations to research and industry. This would only be fitting seeing as the Data Innovation Board, the expert group implementing the horizontal framework of the Data Governance Act, will also include relevant stakeholders. The different European advisory and governing bodies concerning data should be harmonised and consistent.

Building a collaborative ecosystem

Rolling-out the EHDS across Europe will not happen overnight. There will be need for further discussions, especially on how to realise a true “single market for digital health services and products” and to “unleash the power of the health data economy” (particularly given the many Implementing and Delegated Acts). This will in turn trigger the advent of important life-saving innovations and improvements to the health care system to benefit European citizens. But to achieve this, the final framework should strike a balance between achieving the benefits from data use for patients and health systems and incentivising data curation and use.

Yet, the success of the EHDS will not only depend on a robust legal/regulatory framework but also on adequate investment, skills, education and trust. Healthcare providers and industry should collaborate in reaching out to each of these groups, tell the story, listen to feedback and, in doing so, increase mutual trust. This positive and collaborative cycle will ensure that, going forward, e-health infrastructure in each Member State can truly meet everyone’s needs.

In the European Commission’s Impact Assessment, €11 billion in benefits for society are expected in the next 10 years from using and re-using health data through the EHDS.^[7] While the benefits are difficult to quantify in monetary terms, we believe this estimation is modest if the EHDS achieves its 5 objectives. Value creation is sustainable when benefits outweigh the costs for both the data holders and users, as well as the health systems. We believe the legal framework can be improved to achieve support, uptake and eventually massive improvements in equity, quality of life and the business environment.

We look forward to actively and constructively engaging with the co-legislators and the Commission on the EHDS, its implementation and the putting-to-use of the framework, facilitating stakeholder discussions and contributing with expertise and industry-insights.

References

[1] GCO IARC (2018) Cancer Tomorrow: Data for WHO Europe Region.

[2] Some of these concerns are reflected in the 12 July Joint Opinion of the EDPB-EDPS on the EHDS.

[3] European Commission: proposal for a regulation on the European Health Data Space (COM(2022) 197/2).

[4] Summer Summit 2022 #2: Panel – The European Health Data Space: bridging the health data divide.

[5] Eurordis: About Rare Diseases.

[6] We have described this in great detail in our report on Transfers in the data strategy: Understanding myth and reality.

[7] European Commission (2022) Impact Assessment on the European Health Data Space (p 69).