Final spurt for the European Health Data Space (EHDS): How are patients’ rights safeguarded?

The final trilogue negotiation for the planned EU Regulation on the European Health Data Space (EHDS) is scheduled for Thursday, 7 March 2024. Here, representatives of the three legislative institutions of the EU (Commission, Parliament, and Council) will ultimately try to find a compromise on the content of the regulation.

Main point of conflict: patients opt-out rights

The scope of the rights with which patients can control the transfer and processing of data concerning them is still controversial. This may include rights to opt out of the creation of a cross-institutional Electronic Health Record (EHR), against the filling of this record with personal health data by practitioners (“registration”), against the retrieval of such data from the record by other practitioners (“access”) and/or against the so-called secondary use of health data for purposes other than treatment (“further processing”), in particular for medical research, but also for the (commercial) development of drugs or medical devices.

The following chart provides an overview of patients opt-out rights under the laws recently passed in Germany (DigiG, GDNG) and the various positions of the Commission, Council and Parliament on future EU regulation:

Tight schedule due to the upcoming European elections in June

Time is pressing: A political agreement should be reached in the trilogue by mid-March (possibly also in night or additional shifts, as is also known from other trilogue negotiations such as the AI Regulation). Otherwise, the text of the regulation is unlikely to be consolidated in time for the European Parliament to adopt it before the European elections in its last plenary session from 23 to 25 April 2024.

And with a new Parliament, new trilogue negotiations would have to start. This would not be the end of the world, as the Commission's draft and the positions adopted by Parliament and the Council would remain the basis for negotiations. But it would mean a significant delay, which should be avoided if possible - if viable compromises can be reached now.

Careful consideration required

Nevertheless, careful consideration of the opportunities and risks as well as the legal interests involved is still required in the negotiations. In addition to the undeniable opportunities for better treatment or for progress in research and development through better availability of health data, risks for patients must also be taken into account.

More centralised data collections are often a more worthwhile target for hackers than decentralised data storage at individual treatment facilities. Patients should also consider carefully whether they should disclose the first doctor's diagnosis and treatment recommendation to the second doctor in advance for an unbiased second opinion or whether it is better to only disclose objective findings such as X-ray images.

And in advance, the representatives of the Peoples of the European Union must consider which rights they want to grant patients to (co-)control the processing of their health data or must grant them against the background of fundamental rights.

Basics of the European Health Data Space (EHDS)

The declared aim of the European Commission's draft regulation is to improve the access of natural persons (patients) to their personal electronic health data and their control over this data in the context of healthcare (primary use) and for other purposes of social benefit such as research, innovation (including product development), policymaking, patient safety, official statistics or regulatory activities (secondary use). In addition, the functioning of the internal market is to be improved by establishing a harmonised legal framework, in particular for the development, marketing and use of electronic health record systems in line with the values of the Union (see recital 1 of the Commission's draft EHDS Regulation).

The central element for the functioning of the EHDS will therefore be the cross-institutional Electronic Health Records (EHR) in the Member States as data sources for the primary and secondary use of patient data. These are not institutional electronic patient records that are kept by a healthcare institution (such as a hospital) solely to document the treatment it provides itself, but (supplementary) record systems in which the health data from different treating institutions are brought together for each patient. Each Member State should establish at least one such cross-institutional EHR systems. These EHR systems must be made interoperable at both a legal and technical level, i.e. they must be able to be exchanged across national borders for both primary and secondary use.

The following diagram provides a rough overview of the different stages of processing data in or from an EHR:

An overview of the various players within the EHDS and in particular the secondary use of health data in this context can be found in the following graph:

Criticism of the draft regulation

The draft regulation has been criticised by civil society and legal scholars, in particular due to the lack of consent (opt in) requirements and objection (opt out) options as well as the planned central consolidation of patient data at one access point (body) per Member State. In addition, healthcare professionals are to be obliged to register electronic health data in an EHR system. This obligation to provide data is also criticised.

As already mentioned, patients opt out rights are also highly controversial between the institutions directly involved in legislation at EU level.

Opinion: comprehensive and graduated opt out right necessary

If the requirement for the consent (opt in) of the patients as data subjects, which has been largely established in Germany to date, is abandoned for the cross-organisational use of highly personal health data, then in my opinion there must at least be a far-reaching and differentiated opt out right for those affected.

Germany has taken this path with two federal laws recently passed in February 2024: The Act to Accelerate the Digitalisation of the Healthcare System (Digitalisierungsgesetz – DigiG) and the Health Data Usage Act (Gesundheitsdatennutzungsgesetz – GDNG). These give the patients concerned the right to object (opt out) to the creation of an electronic health record, but also (if an electronic health record is created at all) in a differentiated manner to the storage (registration) of certain data or its retrieval (access) by healthcare providers and to secondary use for purposes other than treatment (further processing).

These comprehensive and differentiated opt out rights for patients should also be imposed at European level for the EHDS, which may even be mandatory against the background of European fundamental rights. At the very least, there should be a corresponding opening clause for the Member States, possibly also due to the limited competences of the EU to regulate the healthcare systems of these states. Such an opening clause would also enable Germany to maintain the differentiated system it has created with national laws (DigiG and GDNG).

However, none of the legislative drafts or positions of the Commission, Council and Parliament at European level so far provide for such far-reaching opt out rights. To illustrate this, I would like to repeat the chart shown above:

The Parliament's proposals on opt out rights are the most far-reaching, while the Council's are the most differentiated. The Commission's draft, which is extremely restrictive in this respect, was not wrongly accused of violating fundamental European rights. If the breadth of the Parliament's amendments is combined with the depth of the Council's formulations, a solution could still be found in the trilogue that provides for a differentiated opt out right (relating to individual or at least related health data) for the stages of filling the EPR with data, retrieval for treatment purposes and access for secondary purposes (e.g. for research).

There would then still be no right to opt out of the mere creation of an Electronic Health Record. However, if the patient is given the right to opt out for all subsequent steps, there would only be a medically empty EHR. Certain data identifying the patient would then still be stored, but not necessarily health data. This would significantly reduce the interference with patients' fundamental rights, but of course also the medical benefits. The negotiating partners in the trilogue would therefore lose practically nothing if they subsequently accept an opt out for the creation of the electronic health record or at least create a corresponding opening clause.

No fundamental opposition

To clarify: I have long been in favour of a cross-institutional EHR. However, I would have preferred an even more secure and patient-controlled (consent-based) implementation (which in principle already exists in Germany but is unfortunately not so well advertised and accepted).

However, even the currently planned opt out model without genuine end-to-end encryption is not necessarily the devil's work. Much depends on the specific design and implementation.

And I consider in any case the aforementioned opt out rights for (at least adult) patients to be indispensable. This does not mean that I would recommend that all patients make full use of them. But patients know their personal situation and, in some cases, the respective context of data processing (especially in the case of primary use) best and, in my view, should be able to make their own opt out decision based on their own assessment of the opportunities and risks if they so wish.

Opt-in for the processing of genetic data?

The discussion about retaining a requirement for consent (opt in) for the processing of genomic data (according to the Parliament's position, probably also for other so-called omics data such as protenomics on proteins) is a separate issue.

I understand the Parliament's position, at least as far as the secondary use of genetic data is concerned. This is because such data is particularly worthy of protection, as it accompanies a patient throughout his or her entire life (does not heal, fade away or similar) - and their own descendants and other blood relatives possibly beyond that. Moreover, comprehensive genetic (sequencing) data (WGS, WES) is very meaningful and almost impossible to anonymise.

This can be different when it comes to pure tumour genome without influence on the germline. Unfortunately, there are problems in distinguishing between purely somatic DNA variants, which only occur in the tumour, and constitutional variants, which are also present in other body cells and ultimately in the germline.

Nevertheless, a solution here could follow the demarcation between primary use (opt out) and secondary use (opt in) for constitutional genetic data and a general opt out for proven purely somatic genetic data.

Materials on the EHDS legislative process

For those who want to know exactly, overviews of the legislative materials on the EHDS can be found here:

• "Legislative Train Schedule" for the EHDS: https://www.europarl.europa.eu/legislative-train/theme-promoting-our-european-way-of-life/file-european-health-data-space

• "Legislative Observatory" on the EHDS: https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2022/0140(COD)

The following three documents are of particular interest:

• European Commission draft of the EHDS Regulation of 3 May 2022: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52022PC0197

• Negotiating mandate of the Council of the European Union (with representatives of the EU Member States) of 7 December 2023: https://data.consilium.europa.eu/doc/document/ST-16048-2023-REV-1/en/pdf

• Position of the European Parliament with amendments of 13 December 2023: https://www.europarl.europa.eu/doceo/document/TA-9-2023-0462_EN.html

If you want to compare the latter documents with each other and have an additional column for compromise proposals, then you can help yourself to this ‘beautiful’ 1,532-page document:

• "Proposal for a Regulation on the European Health Data Space - 4-column table" of the General Secretariat of the Council of the EU of 12 January 2024: https://data.consilium.europa.eu/doc/document/ST-5368-2024-INIT/en/pdf

Concluding remarks

In view of the complexity and sensitivity of the matter, one can only wish the representatives of the three legislative EU institutions, especially in the final spurt of the trilogue, a lot of perseverance, a good overview and an eye for the right balance between opportunities and risks as well as the appropriate balance between different legal positions and interests.