European Health Data Space (EHDS): A practical guide for public–private health partnerships

Preparing for the European Health Data Space requires more than understanding the regulation itself and depends on the setting. Organisations also need to consider governance, stakeholder alignment, legal frameworks, interoperability and sustainable collaboration models.

Lygature supports organisations throughout this transition by combining expertise in Data Infrastructure & AI with partnership management, legal and ethical expertise, governance design and public–private collaboration. We help organisations navigate complex health data initiatives and build the partnerships and governance structures needed to maximise the societal value of health data.

Whether you are establishing a new consortium, preparing existing data infrastructures for the EHDS or exploring opportunities for cross-border collaboration, Lygature can help translate regulatory developments into practical implementation. 

The EHDS provides a new, standardised way to access electronic health data for secondary use across Europe. This primarily affects Data Holders and creates new opportunities for Data Users.

The EHDS requires each country to establish a new public organisation, the Health Data Access Body (HDAB), to oversee the secondary use of health data, in particular the ethics assessment and data protection aspects. Furthermore, the EHDS does not prescribe specific data interoperability standards but provides specific technical components, such as:

• Metadata catalogue describing the available datasets using a specific interoperable standard (i.e. HealthDCAT-AP) 
• Data Access Application Management Systems (DAAMS) to facilitate national and cross-border data access requests across Europe in a harmonised way 
• Secure Processing Environment (SPE) that provides researchers with a data analysis environment while ensuring compliance with data protection requirements
• Opt-out registry that manages citizens’ decisions to opt out of  the secondary use of their data under the EHDS 
• Transparency portal that publishes information on granted data access and the results of data reuse 

Data Holders are not limited to hospitals and biobanks for example but include any public or private organisation that controls electronic health data falling within any of the categories mentioned in the figure above.

What are my obligations under the EHDS when making data available for reuse? 

• Register a description of your datasets in the national metadata catalogue managed by your national HDAB 
• Provide data when a data request has been approved or a data permit has been issued
• Ensure access to non-personal data through trusted open databases

How will I be supported to meet the obligations of the EHDS? 

• The data access application process is handled by the HDAB 
• When data access is granted through the EHDS, there is no need to negotiate separate legal agreements with the Data User 

Yes, but the HDAB considers IP rights, including regulatory data protection, confidentiality agreements, database rights and trade secret protection, where they have been indicated for the respective dataset. During the assessment of data access applications, the HDAB may require additional data security measures for such datasets and/or separate agreements. 

Data Users can be public or private organisations that wish to reuse health data for research, innovation or policy making. 

What are my obligations when using the EHDS for data access? 

• Publish the results of the secondary use of data 
• Pay the fee covering the costs involved in making the data available to you

Can I use the EHDS to access data to develop a product or service? 

Yes, if the product or service aims to benefit end-users, such as patients or healthcare professionals, and will not harm individuals, public health or society at large. This applies regardless of whether the Data User is a public or private organisation. 

• The regulations operate in parallel and in specific cases complement each other. For example, the EHDS could provide a legal basis for data processing under the GDPR 
• The EHDS will not replace or hinder existing mechanisms for data (re)use, such as consent 

Consortia consists of partners that may individually act as a Data Holder and/or Data User to achieve the goals of the project. There is no obligation to use the EHDS; dedicated data governance agreements within a consortium may still be used but these cannot override the EHDS. 

How is data generated or collected within a consortium affected? 

If electronic health data generated or collected within the consortium falls within the categories covered by the EHDS, then external parties may use the EHDS to request access to this data. From a sustainability perspective, this can be beneficial, as there is no need to establish dedicated data governance arrangements for post-project data access. 

Should data infrastructure developed by the consortium interact with the EHDS? 

No, this is not necessary. Depending on the type and aim of the data infrastructure, however, it may be advisable to ensure interoperability with the specific technical components of the EHDS mentioned above.