IMMC.COM%282022%29197%20final.ENG.xhtml.1_EN_annexe_proposition_part1

EUROPEAN COMMISSION

Strasbourg, 3.5.2022

COM(2022) 197 final

ANNEXES

to the

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Health Data Space

{SEC(2022) 196 final} - {SWD(2022) 130 final} - {SWD(2022) 131 final} - {SWD(2022) 132 final}

ANNEX I

Main characteristics of electronic health data categories

Electronic health data category	Main characteristics of electronic health data included under the category
1.Patient summary	Electronic health data that includes important clinical facts related to an identified person and that is essential for the provision of safe and efficient healthcare to that person. The following information is part of a patient summary: 1.Personal details 2.Contact information 3.Information on insurance 4.Allergies 5.Medical alerts 6.Vaccination/prophylaxis information, possibly in the form of a vaccination card 7.Current, resolved, closed or inactive problems 8.Textual information related to medical history 9.Medical devices and implants 10.Procedures 11.Functional status 12.Current and relevant past medicines 13.Social history observations related to health 14.Pregnancy history 15.Patient provided data 16.Observation results pertaining to the health condition 17.Plan of care 18.Information on a rare disease such as details about the impact or characteristics of the disease
2.Electronic prescription	Electronic health data constituting a prescription for a medicinal product as defined in Article 3(k) of Directive 2011/24/EU.
3.Electronic dispensation	Information on the supply of a medicinal product to a natural person by a pharmacy based on an electronic prescription.
4.Medical image and image report	Electronic health data related to the use of or produced by technologies that are used to view the human body in order to prevent, diagnose, monitor, or treat medical conditions.
5.Laboratory result	Electronic health data representing results of studies performed notably through in vitro diagnostics such as clinical biochemistry, haematology, transfusion medicine, microbiology, immunology, and others, and including, where relevant, reports supporting the interpretation of the results.
6.Discharge report	Electronic health data related to a healthcare encounter or episode of care and including essential information about admission, treatment and discharge of a natural person.

ANNEX II

Essential requirements for EHR systems and products claiming interoperability with EHR SYSTEMS

The essential requirements laid down in this Annex shall apply mutatis mutandis to products claiming interoperability with EHR systems.

1.General requirements

1.1.An electronic health record system (EHR system) shall achieve the performance intended by its manufacturer and shall be designed and manufactured in such a way that, during normal conditions of use, it is suitable for its intended purpose and its use does not put at risk patient safety.

1.2.An EHR system shall be designed and developed in such a way that it can be supplied and installed, taking into account the instructions and information provided by the manufacturer, without adversely affecting its characteristics and performance during its intended use.

1.3.An EHR system shall be designed and developed in such a way that its interoperability, safety and security features uphold the rights of natural persons, in line with the intended purpose of the EHR system, as set out in Chapter II of this Regulation.

1.4.An EHR system that is intended to be operated together with other products, including medical devices, shall be designed and manufactured in such a way that interoperability and compatibility are reliable and secure, and personal electronic health data can be shared between the device and the EHR system.

2.Requirements for interoperability

2.1.An EHR system shall allow personal electronic health data to be shared between health professionals or other entities from the health system, and between health professionals and patient or health professional portals in a commonly used electronic interoperable format, which includes, inter-alia, dataset content, data structures, formats, vocabularies, taxonomies, exchange formats, standards, specifications, profiles for exchange and code lists, thus enabling system to system communication.

2.2.An EHR system shall be interoperable and compatible with the European infrastructures set out in this Regulation for the cross-border sharing of electronic health data.

2.3.An EHR system that includes a functionality for entering structured personal electronic health data shall enable the entry of data structured in a structured way that supports the data sharing in a structured, commonly used and machine-readable format, enabling system to system communication.

2.4.An EHR system shall not include features that prohibit, restrict or place undue burden on authorised access, personal electronic health data sharing, or use of personal electronic health data for permitted purposes.

2.5.An EHR system shall not include features that prohibit, restrict or place undue burden on authorised exporting of personal electronic health data for the reasons of replacing the EHR system by another product.

3.Requirements for security

3.1.An EHR system shall be designed and developed in such a way that it ensures safe and secure processing of electronic health data, and that it prevents unauthorised access to such data.

3.2.An EHR system designed to be used by health professionals shall provide reliable mechanisms for the identification and authentication of health professionals, including checks on professional rights and qualifications.

3.3.An EHR system designed to be used by health professionals shall support the use of information on professional rights and qualifications as part of the access control mechanisms, such as role-based access control.

3.4.An EHR system designed to enable access by health professionals or other individuals to personal electronic health data shall provide sufficient logging mechanisms that record, at least the following information on every access event or group of events:

(a)identification of the health professional or other individual having accessed electronic health data;

(b)identification of the individual;

(c)categories of data accessed;

(d)time and date of access;

(e)origin(s) of data.

3.5.An EHR system shall include tools and mechanism to allow natural persons to restrict health professionals’ access to their personal electronic health data. It shall also include mechanisms that allow access to personal electronic health data in emergency situations, and ensure that access is strictly logged.

3.6.An EHR system shall include tools or mechanisms to review and analyse the log data, or it shall support the connection and use of external software for the same purposes.

3.7.An EHR system designed to be used by health professionals shall support digital signatures or similar non-repudiation mechanisms.

3.8.An EHR system designed for the storage of electronic health data shall support different retention periods and access rights that take into account the origins and categories of electronic health data.

3.9.An EHR system designed to be used by natural persons shall enable their identification using any recognised electronic identification means as defined in Regulation (EU) No 910/2014, regardless of the Member State that has issued it. If the service supports other electronic identification means, they shall be of assurance levels ‘substantial’ or ‘high’.

ANNEX III

Technical documentation

The technical documentation referred to in Article 24 shall contain at least the following information, as applicable to the relevant EHR system:

1.A detailed description of the EHR system including:

(a)its intended purpose, the date and the version of the EHR system;

(b)the categories of electronic health data that the EHR system has been designed to process;

(c)how the EHR system interacts or can be used to interact with hardware or software that is not part of the EHR system itself;

(d)the versions of relevant software or firmware and any requirement related to version update;

(e)the description of all forms in which the EHR system is placed on the market or put into service;

(f)the description of hardware on which the EHR system is intended to run;

(g)a description of the system architecture explaining how software components build on or feed into each other and integrate into the overall processing, including where appropriate, labelled pictorial representations (e.g. diagrams and drawings), clearly indicating key parts/components and including sufficient explanation to understand the drawings and diagrams;

(h)the technical specifications, such as features, dimensions and performance attributes, of the EHR system and any variants/configurations and accessories that would typically appear in the product specification made available to the user, for example in brochures, catalogues and similar publications, including a detailed description of the data structures, storage and input/output of data;

(i)a description of any change made to the system throughout its lifecycle;

(j)the instructions of use for the user and, where applicable, installation instructions.

2.A detailed description of the system in place to evaluate the EHR system performance, where applicable.

3.The references to any common specification used in accordance with Article 23 and in relation to which conformity is declared.

4.The results and critical analyses of all verifications and validation tests undertaken to demonstrate conformity of the EHR system with the requirements laid down in Chapter III of this Regulation, in particular the applicable essential requirements;

5.A copy of the information sheet referred to in Article 25.

6.A copy of the EU declaration of conformity.

ANNEX IV

EU declaration of conformity

The EU declaration of conformity shall contain all of the following information:

1.The name of the EHR system, version and any additional unambiguous reference allowing identification of the EHR system.

2.Name and address of the manufacturer or, where applicable, their authorised representative.

3.A statement that the EU declaration of conformity is issued under the sole responsibility of the manufacturer.

4.A statement that the EHR system in question is in conformity with the provisions laid down in Chapter III of this Regulation and, if applicable, with any other relevant EU legislation that provides for the issuing of an EU declaration of conformity.

5.References to any relevant harmonized standards used and in relation to which conformity is declared.

6.References to any common specifications used and in relation to which conformity is declared.

7.Place and date of issue of the declaration, signature plus name and function of the person who signed, and, if applicable, an indication of the person on whose behalf it was signed.

8.Where applicable, additional information.