EUROPEAN COMMISSION

Strasbourg, 3.5.2022

SWD(2022) 131 final

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT REPORT

Accompanying the document

PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Health Data Space

{COM(2022) 197 final} - {SEC(2022) 196 final} - {SWD(2022) 130 final} - {SWD(2022) 132 final}

Table of contents

Annex 1: Procedural information

1.Lead DG, Decide Planning/CWP references

2.Organisation and timing

3.Consultation of the RSB

4.Evidence, sources and quality

Annex 2: Stakeholder consultation

Annex 3: Who is affected and how?

1.Practical implications of the initiative

2.Summary of costs and benefits

Annex 4: Graphical representation of different elements in the Impact assessment

Annex 5: Methodological approach

1.Sources

2.Discount rate

3.Timeline

4.Baseline scenario

5.Estimation of costs of measures proposed

6.General take-up/participation scenarios

7.Specific assumptions used for measures on primary use of health data

7.1.Governance

7.2.Digital infrastructure

7.3.Data interoperability

7.4.Economic benefits

8.Specific assumptions used for measures on secondary use of health data

8.1.Governance

8.2.Digital infrastructure

8.3.Data interoperability and data quality

8.4.Economic benefits

9.Methodology and assumptions used for the evaluation of the Article 14 of the CBHC Directive (Annex 12)

Annex 6: Coherence with other legislative instruments

Annex 7: List of m-health and telehealth initiatives (legislation, frameworks and certification/labels)

Annex 8: Overview of the GDPR legal basis for processing health data for different purposes

Annex 9: Overview of national bodies dealing with secondary uses of health data

Annex 1: Procedural information

11.    Lead DG, Decide Planning/CWP references

The legislative proposal on the European Health Data Space (EHDS) was prepared under the lead of the Directorate-General for Health and Food Safety. In the DECIDE Planning of the European Commission, the process is referred to under item PLAN/2020/870. The Commission Work Programme for 2021 includes a legislative action for a European Health Data Space.

22.    Organisation and timing

An Inter-Service Steering Group (ISSG) assisted DG Health and Food Safety in the preparation of the Impact Assessment and legal proposal. It included Commission services of Directorate-Generals CNECT, JUST, GROW, JRC, TRADE, EMPL, MOVE, RTD, ECFIN, COMP, REGIO and REFORM, together with the Commission’s Legal Service and Secretariat General.

The ISSG met two times in March 2021 and October 2021. Moreover, the ISSG members have already been consulted regularly via formal written consultations and bilateral discussions. An Inception Impact Assessment was published on 23 December 2020 and was open to feedback from all stakeholders on the Better Regulation Portal for a period of 6 weeks. The public online consultation was launched on 3 May 2021 and closed on 26 July 2021.

The draft Impact Assessment report and all supporting documents were submitted to the Regulatory Scrutiny Board (RSB) on 26 October 2021, in view of a meeting on 24 November 2021. The RSB issued a negative opinion on 26 November 2021. After a re-submission of the Impact Assessment report on 21 December 2021, the RSB issued a positive opinion on 26 January 2022.

33.    Consultation of the RSB

The Impact Assessment report was reviewed by the Regulatory Scrutiny Board. After the first submission, the RSB issued the following findings:

(1)The report is not clear on the coherence with other related initiatives.

(2)The justification of the legal basis is not sufficient and does not reflect the core objectives targeted by the initiative.

(3)The objectives regarding secondary use are not sufficiently specified in their scope. They are not sufficiently clear on the coherence and consistency with the legal principles on the extent of personal data use, set out in related initiatives.

(4)The report is not clear on the issue of data control and consent in the proposed options.

(5)The report does not sufficiently justify the combination of measures in the different options. It does not sufficiently explain the choice of the preferred option.

(6)The report is not clear on how the different groups of stakeholders will be affected by the proposal. Their views are not well reflected throughout the report.

The table below lists the changes in response to the recommendations of the RSB in its first opinion (negative opinion). Besides these modifications, targeted corrections and amendments have been included to address the technical comments provided by the RSB to DG SANTE.

After the second submission, noting that its previous recommendations have been addressed to a large extent, the RSB issued the following finding:

(1)The rationale for having a specific sectoral initiative on health data is not sufficiently explained.

(2)The difference between secondary use and data altruism is not clear and this leads to confusion in the different consent mechanisms.

(3)The report does not sufficiently reflect different stakeholder views.

The table below lists the changes in response to the recommendations of the RSB in its second opinion (positive opinion).

44.    Evidence, sources and quality

This proposal is supported by a number of studies and background documents, in particular:

·A study on the assessment of the EU Member States’ rules on health data in the light of the General Data Protection Regulation 1 ,

·A study on the regulatory gaps to cross-border provision of digital health services and products, including artificial intelligence, and the evaluation of the existing framework for cross-border exchange of health data 2 ;

·A study supporting the impact assessment of policy options for an EU initiative on a European Health Data Space;

·A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space (forthcoming);

·A study on the electronic health record interoperability in the European Union (MonitorEHR) 3 ;

·A study on the use of real-world data (RWD) for research, clinical care, regulatory decision making, health technology assessment, and policy making 4 ;

·A market study on telemedicine 5 ;

·The EDPS preliminary opinion on the EHDS 6 .

Annex 2: Stakeholder consultation

Different stakeholders have been consulted in different phases of the legislative process.

The consultation activities aimed at collecting the views of national public health, digital health and data protection authorities, healthcare providers, healthcare professionals, academic and research institutions, patient associations, economic actors and their professional associations (e.g. health technology industry, digital industry), consumer organisations, NGOs, trade unions and citizens. These stakeholder groups were expected to have important information and insights on:

·the achievements of the provisions on eHealth of the CBHC Directive, any implementation and application problems and their underlying causes and on possible ways forward and their impacts;

·how health data governance mechanisms and structures can best maximise the social and economic benefits of health data usage in the EU, as well as how digital health services and products and AI can deliver greater levels of accessibility, availability, sustainability and affordability of healthcare.

This section provides an overview of the consultation activities carried out as part of the Public Consultation, the Assessment of the EU Member States Rules on health data in light of GDPR, the Study on Health Data, Digital Health and Artificial Intelligence in Healthcare and the Study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space.

1.Public Consultation

The European Commission conducted a Public Consultation (PC) to gather the views of the public on an EU initiative for a EHDS. The purpose of the consultation was to inform the Commission’s work to support the impact assessment on the problems to be tackled, the policy options to be considered and their likely impacts. The consultation was open from 3 May 2021 to 26 July 2021 7 .

382 valid responses to the PC were received and of these respondents, 64 provided additional documentation. EU citizens were the most common type of stakeholders among respondents (26%), followed by non-governmental organisations (NGOs) (21%), academic/research institutions (14%), companies/business organisations (11%), business associations (8%), public authorities (5%), non-EU citizens (2%), trade unions (1%) and consumer organisations (1%). Respondents came from 23 EU Member States and 8 non-EU countries. The most represented country was Belgium 8 (19%), followed by Spain (11%), France (11%), Germany (11%) and Italy (8%).

On the question of fundamental rights, Member States’ positions are rather fragmented, also based on national practices, the status of national debate on the right to privacy and re-use of personal data. Some highlighted the importance of ethics in the re-use of secondary health data and noted that it was too early to determine whether the EHDS would improve privacy. If EHDS would simply be a tool linking already existing datasets, the security of personal data would not be affected. However, if it allowed researchers to access and analyse datasets, personal data security and privacy would be affected, and mechanisms preventing privacy breaches would need to be built into the EHDS’ infrastructure. They further noted that since EHDS2 concerns policy, which can impact the freedom of movement, it is indirectly related to the right of freedom of movement. Other Member States emphasized the need to stick to some key objectives first, with the focus primarily being on delivering trust to European citizens, which implies legislation ensuring data security, as well as a robust infrastructure. Member States expressed specific points with regard to the opt-in vs. opt-out approach to the secondary use of health data, and on the role of National Agencies/Authorities in authorising access. Some Member States advocated for a system where the patient could easily stop the sharing of their data at any time. Although an opt-out system would likely make more data available due to the effort it takes to opt out, it could generate criticism. To avoid unnecessary bureaucracy, no additional ethical clearance should be required when a researcher was already cleared by an ethics committee at his/her institution. A regionalised Member States considered that legislation regarding the authorization to access data should be done at Member State level, as the competences in those matters are currently national. The governance body may therefore have to apply different criteria depending on the Member State where the data come from.

The opinions of Member States on the possible characteristics of the EHDS were different as well. In the view of a federal Member State, it is important that the Member States keep in place their own legislation regarding the privacy of their citizens and that it is respected; legislation should be based on cultural ways of thinking as considers how citizens handle their data. However, EU guidelines or a general framework could be established. In this way, the national and EU legislations could complement each other and address cross-border issues particularly in times of crisis. Other Member States preferred a pluri-disciplinary approach on the main topics, as a wide range of competences will be needed. This involves discussing a clear strategy with all Member States, focusing both on a broad plan of action and technical operations. In Spain’s view, the current model for the governance of the eHealth Network is reasonable since consensus between the Member States is needed in the decision-making process.

Access and use of personal health data for healthcare

The most important objectives that respondents said a European framework on the access and exchange of personal health data should aim included:

·supporting and accelerating research in health (89%), with most support coming from industry (97%), academia (94%) and public authorities (88%)

·promoting citizens’ control over their own health data, including access to health data and transmission of their health data in electronic format (88%), with most support coming from consumer organisations (100%), industry (94%) and EU citizens (85%) and public authorities (93%). The lowest support for this objective is among trade unions (80%) and academic/research institutions (78%).

·facilitating the delivery of healthcare for citizens across borders (83%), with most support coming from consumer organisations (100%), industry (93%) and public authorities (77%)

The most contentious was the objective to promote private initiative. This is supported by industry (88%) and public authorities (63%) but there is less support amongst consumer organisations (67% said not at all) and NGO’s (31% support this objective).

Several rights were deemed important by respondents, including:

·the right to access one's health data in electronic format, including those stored by healthcare providers (public or private) (88%), with most support coming from consumer organisations (100%), NGO’s (94%), EU citizens (91%), companies (86%) trade unions (80%) and public authorities (81%) Lower support was recorded among business associations (74%)

·the right to transmit one's health data in electronic format to another professional/entity of one's choice (84%), with most support coming from consumer organisations (100%), NGO’s (89%) and industry (86%). 85% of EU citizens, 86% of companies and 75% of business associations, 75% of public authorities, 80% of research institutions and trade unions that participated in the public consultation also supported this right.

·the right to request healthcare providers to transmit one's health data in one's electronic health record (83%), with most support coming from consumer organisations (100%), NGO’s (90%) and EU citizens (82%)

·the right to request public healthcare providers to share electronically one's health data with other healthcare providers/entities of one's choice (82%), with most support coming from consumer organisations (100%), NGO’s (87%) and EU citizens (86%)

·60% of trade unions, 73% of companies, 75% of business associations, 71% of public authorities, 54% of EU citizens, 54% of non-EU citizens 61% of NGOs 64% of research institutions and only 25% of consumer organisations participating in the public consultation consider that healthcare professionals should have the right to access to patients’ digital health records and to data pertaining to the patient’s use of digital health products or services.

A more contentious question was regarding whether healthcare providers that fail to provide access to health data in an electronic format and to transmit it to a healthcare provider/entity of their choice are sanctioned or receive a specific fine. There is support for this question from consumer organisations (100%) and EU citizens (69%) but there is less support amongst companies (66%), business associations (46%), and public authorities (31%).

By far, the element that respondents considered the most appropriate for controlling access and sharing one’s health data with healthcare professionals was ensuring the infrastructure or personal digital storage for accessing the data are secure and prevent cyberattacks (90%). The options of accessing one's health data that is exchanged between health professionals or with other entities either:

·via a digital infrastructure (72% support), with most support coming from NGO’s (81%), public authorities (75) and industry (70%), with less support from consumer organisations (25%)

·or via an EU electronic infrastructure (69% support), with most support coming from NGO’s (77%), EU citizens (71%) and industry (70%), with less support from public authorities (43%)

The support for facilitating the cross-border delivery of healthcare should be one of the objectives of a European framework on the access and exchange of personal health data, according to 100% of consumer organisations, 93% of the companies, 84% of business associations, 77% of public authorities, 85% of NGOs, 84% of EU citizens, 82% of research institutions and 40% of trade unions. Most stakeholders found that the EHDS would bring benefits in terms of cross-border access to healthcare, with business associations, companies/business organisations and NGO’s being the most likely to say the impact would be high (76%, 79% and 77% respectively), compared with only 42% of public authorities, and academic/research institutions and EU citizens being the least likely. However, the communication concerning the infrastructure MyHealth@EU should be improved, as only 23% of EU citizens and 43% of non-EU citizens participating in the public consultation were aware about changes concerning data sharing cross border in order to ensure the continuity and access to safe and high-quality healthcare; this was the case for 53% of public authorities, 47% of companies and 50% of consumer organisations.

Regarding mandatory participation in an EU-level infrastructure MyHealth@EU, Member States have different views. Two Member States consider that waiting for perfect coordination of healthcare systems across the EU may take too long, as the differences are too great. Instead, the number of services delivered could be gradually increased over time as more countries connect and the services improve. The EU should therefore incentivise countries to improve their infrastructure, while making participation in the EHDS mandatory, since the directive’s objectives will otherwise never be met. According to the representative of these two Member States, a continuum of healthcare in the EU is necessary to achieve real mobility, and a clear link can be drawn between the EHDS and the EU Resilience and Recovery plans.

Respondents were also asked how standards and technical requirements (e.g. to support the exchange of data in healthcare or to ensure the interoperability of health data exchanges) should be made applicable at national level and across the EU. Overall, respondents believed appropriate measures would be either an access scheme managed by national bodies (a mandatory prior approval by a national authority; 39%) or a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level; 37%) would be appropriate most.

Digital health services and products

Respondents were asked about how to ensure access to, and sharing of, health data nationally and across borders through digital health services and devices.

85% of the business associations participating in the public consultation and 89% of companies consider that EHDS should promote the use of digital health products and services by healthcare professional and citizens, while this opinion is shared by 74% of EU citizens, 76% of public authorities and only 33% of consumer organisations.

Support for minimum standards for tele-health equipments established at EU level reaches 100% among consumer organizations, 75% for trade unions 72% for NGO, 66% for EU citizen, 65% for public authorities, 64% for companies and 36% for business associations participating in the public consultation. Such support for protocols/rules for tele-health established at EU level reaches 75% among consumer organisations, 50% for trade unions, 70% for EU citizens, 65% for public authorities, 60% for research institutions, 59% among companies and business organisations and only 26% for the business associations participating in the public consultation.

Overall, a majority of respondents said that it would be useful if citizens were able to transmit the data from mHealth and telehealth into their electronic health records (77% overall, with most support coming from industry (97%), NGO’s (82%) and EU citizens (76%), public authorities (70%)), or, to a smaller extent, into the EU health data exchange infrastructure (67% overall, with most support coming from industry (88%), trade unions (80%) and NGO’s (71%)). A majority of respondents also said that it would be useful if healthcare professionals could request transmission of the data from prescribed apps and other digital health services into the electronic health records of the patient (68% overall, with most support coming from industry (81%), academia (72%) and NGO’s (71%), public authorities (70%)), or, to a lesser extent, if healthcare professionals had the right to access patients’ digital health records and data pertaining to the patient’s use of digital health products or services (62% overall, with most support coming from industry (75%), public authorities (71%) and academia (64%)).

Overall, respondents believed a certification scheme granted by third parties (a mandatory independent assessment of the interoperability level) (52% overall, with most support from EU citizens (61%) and trade unions (60%) and less support from public authorities (47%) and industry (39%)) would be most appropriate to foster the uptake of digital health products and services at national and EU level. A smaller proportion of respondents said an authorisation scheme managed by national bodies would be appropriate (43% overall, with most support from trade unions (80%), consumer organisations (75%) and less support from NGO’s (40%) and industry (12%)). The option of using a voluntary labelling scheme was the least popular, with least support from NGO’s (9%) and public authorities (18%).

Respondents believed that the most appropriate measure to support reimbursement decisions by national bodies would be a framework where EU funds support/top up cross-border digital health services that comply with interoperability standards and ensure patient control over their health data (71% overall, with most support coming from industry (80%), consumer organisations (75%) and NGO’s (75%)). EU guidelines for reimbursement of digital health products get a 100% support among consumer organisations, 54% among companies, 46% for EU citizens and only 18% for public authorities. Respondents said that other measures would also be appropriate, such as the use of an EU repository of digital health products and services assessed according to EU guidelines to aid national bodies to make reimbursement decisions, or a framework which facilitates reimbursement of all telehealth services (64% overall, with most support coming from consumer organisations (100%), trade unions (80%) and NGO’s (72%), and a more limited 49% support from public authorities).

Mutual recognition across EU for reimbursement purposes is supported by 100% of consumer organisations, 69% of NGOs63% of EU citizens, 75% of companies, 46% of business assoeciations, 36% of public authorities (a similar percentage of authorities opposing it) participating in the public consultation.

When inquired who would be the best suited to develop these standards and technical requirements at EU level to support exchange of data in healthcare, responses were mixed. 40% of respondents in the public consultation believed 'national digital health bodies cooperating at EU level' are best suited to develop standards and technical requirements at EU level to support the exchange of data in healthcare. More than a third of respondents (125 out of 363, 34%) said that 'an EU body' might instead be best suited to do this. There were some differences across stakeholder types, in particular between public authorities (71% in favour of national digital health bodies, and only 12% in favour of an EU body) and companies/business organisations (only 24% in favour of national digital health bodies, but 59% in favour of an EU body).

A relatively large proportion of respondents thought another type of body would be best suited to develop standards and technical requirements at EU level to support the exchange of data in healthcare (93 out of 363, 26%). Among these, some suggested that there should be a combination of both national digital health bodies and an EU body. Several mentioned they believed 'an EU body' might be best suited to develop standards and technical requirements at EU level to support the exchange of data in healthcare, but that this EU body should meet some requirements. For example, it should involve scientific experts with thorough knowledge of diseases, as well as representatives from patient organisations, Member States' national institutions, private sector consortia and academic institutes.

With regards to the costs of complying with standards, across the stakeholder groups, 62% of academic/research institutions and 53% of public authorities expected this cost impact to be high, compared with only 21% of business associations and 23% of companies/business organisations.

A large majority of respondents said they believed access to EU funds for digitalisation in healthcare by Member States should be conditional upon ensuring interoperability with electronic health records and national healthcare systems (81%). Only 8% disagreed, and the rest said they did not know.

Access and use of personal health data for research and innovation, policy-making and regulatory decision-making

Among Member States that participated in the public consultation, some upheld that legislation on data authorization should remain at country level, although it recognized a need for a European body to coordinate authorization with Member States, such that only one procedure would have to be taken by any research institution looking to access a dataset. Others would welcome the creation of a portal for accessing data at EU level, which would not host any data, but would hold the keys to all the datasets stored elsewhere. With the development of a common health data space, more Member States are also planning to set up a national data permit authority. A big Member State in the process of setting up a data access body agreed that having a clear mandate of EU data access rules would be very beneficial, and the EHDS should contain legislation compelling Member States to grant data to researchers in other EU countries. Moreover, algorithms should be trained across countries to ensure sufficient quantity and diversity of data.

Concerning the participation in the EU infrastructure on secondary use of data, the views of Member States were more heterogenous. Some Member States were in favour of mandatory participation in EHDS infrastructure for secondary use, but pointed out that it could also be optional in use, with a seal of quality reassuring citizens about their data’s use. Others underlined that, while some have made progress regarding the establishment of a health data authority, the situation in other Member States may be different as they may not have the same capacity to join. Therefore, making participation mandatory will not necessarily increase progress, and investments should be made into capacity building to bring all countries’ infrastructure to the same level. A federal Member State mentioned that a discussion should also take place on how to ensure that the right technical and organizational measures to ensure maximum data protection are being used while allowing maximum research.

Support decisions by policy-makers and regulators in health as an objective of a European framework on the access and exchange of personal health data should is supported completed or to a great extent by 82% of academic and research organisations, 80% of trade unions, 81% of companies and business associations, 83% of NGOs, 69% of EU citizens, 57% of non-EU citizens, 65% of public authorities and 50% of consumer organisations participation in the public consultation.

The objective of supporting and accelerating research in health is supported by 100% of consumer organisations and non-EU citizens, 83% of EU citizens, 97% of business associations, 95% of companies, 94% of research institutions, 88% of public authorities, 80% of trade unions and 90% of NGOs.

Promoting private initiatives (e.g. for innovation and commercial use) in digital health has received a more mixed support: 88% from business associations that participated in the open publc consultation, 79% of companies, 60% of trade unions, 29% of non EU citizens and 38% of EU citizens, 63% of public authorities, 47% of research institutions, 31% of NGO that participated in the public consultation. 67% of the consumer organisations that participated in the public consultation are against a European framework on the access and exchange of personal health data that would promote private initiatives (e.g. for innovation and commercial use).

Only a small proportion of respondents said a fee would facilitate the sharing of health data held by private stakeholders (20%), while many highlighted the limitations of using this incentive (e.g. difficult to manage, not stimulating enough to share data etc.) and a few said it would have a negative impact (e.g. potentially endangering patient interest by commercialising health data). A federal Member State also highlighted that no profit should be made from the data, however a fee system should control the amount of permissions to be granted to limit the burden on the system and support the sustainability of the system. Moreover, it would support the establishment of a transparency registry where all granted permissions would be published, and of a website showing how the data was used, to enhance public trust. Many respondents said that other types of incentives would facilitate the sharing of health data held by private stakeholders, such as: legal/mandatory obligations, and greater interoperability between systems, databases and registries or a more transparent system for sharing data.

The mechanism that respondents thought most appropriate to facilitate the access to health data for research, innovation, policy-making and regulatory decision was the mandatory appointment of a national body that authorises access to health data by third parties (55%) (deemed more appropriate than the voluntary appointment of such a body), followed by the use of a public body which collects the consent of individuals to share their health data for specified societal uses (“data altruism”) and manages their health data (47%).

Overall, respondents thought additional rules on conditions for access to health data for research, innovation, policy-making and regulatory decision would be needed at EU level, mainly for research purposes, and for policy and regulatory purposes (when asked about health data categories, format, eligibility and security).

The two options that respondents said were most appropriate in facilitating access to health data held by private stakeholders was to have access to health data granted by a national body (rather than by the data holder), either subject to the agreement of data subjects (most support from industry (57%), least support from public authorities (24%)), or in accordance with national law (most support from public authorities (65%), least support from industry (21%)). Only a small proportion of respondents said a fee would facilitate the sharing of health data held by private stakeholders (20%), while many highlighted the limitations of using this incentive (e.g. difficult to manage, not stimulating enough to share data etc.) and a few said it would have a negative impact (e.g. potentially endangering patient interest by commercialising health data). Many respondents said that other types of incentives would facilitate the sharing of health data held by private stakeholders, such as: legal/mandatory obligations, and greater interoperability between systems, databases and registries or a more transparent system for sharing data.

A large majority of respondents said an EU body could facilitate access to health data for research, innovation, policy making and regulatory decisions if it had a number of functions, the most important ones being: setting standards on interoperability together with national bodies dealing with secondary use of health data (87% overall, most support from consumer organisations (100%), NGO’s (92%) and industry (91%)); bringing together the national bodies dealing with secondary use of health data, for decisions in this area (79% overall, most support coming from consumer organisations (100%), NGO’s (89%) and trade unions (80%)); and facilitating cross-border queries to locate relevant datasets in collaboration with national bodies dealing with secondary use of health data (78% overall, most support coming from consumer organisations (100%), NGO’s (87%) and academia (84%)).

Overall, respondents believed the mandatory use of specific technical requirements and standards would be most useful to address interoperability and data quality issues for facilitating cross-border access to health data for research, innovation, policy-making and regulatory decision (67% overall, with most support coming from consumer organisations (100%), academia (82%) and least support from industry (48%)). A smaller proportion of respondents said using an audit, certification or access before participating in EHDS cross-border infrastructure would be appropriate (59% overall, most support coming from EU citizens (75%), consumer organisations (75%) and least support from industry (33%)).

Artificial Intelligence (AI) in healthcare

To facilitate the sharing and use of data sets for the development and testing of AI in healthcare, respondents recommended allowing access to health data by AI manufacturers for the development and testing of AI systems in a secure way (including compliance with GDPR rules), by bodies established within the EHDS (65% overall, with most support coming from industry (82%), trade unions (80%) and public authorities (70%) with least support from consumer organisations (25%)).

A majority of respondents believed the introduction of AI in healthcare is creating a new relationship between the AI system, the healthcare professional and the patient (69%). While some thought this relationship was positive (bringing positive changes such as acceleration and optimisation of care as well as the fostering of research and discoveries), others said this would have downsides (e.g. worsening the level of trust between physicians and patients, or decreasing patient confidence in the solutions proposed).

To ensure collaboration and education between AI developers and healthcare professionals, a large majority of respondents agreed that healthcare professionals and/or providers should demonstrate understanding of the potentials and limitations in using AI systems, including 66% of business associations, 89% of NGOs and 82% of public authorities

2.Assessment of the EU Member States Rules on health data in light of GDPR

The study 9 examined the rules governing the processing of health data, highlighting differences, identifying elements that might affect the cross border exchange of health data and examining potential for EU action to support health data use and reuse. The study was carried out between the end of 2019 and the beginning of 2021.

During the study, 5 workshops took place with Ministries of Health representatives, experts, stakeholder representatives and experts from national data protection offices 10 . A stakeholder survey was also carried out to cross validate and supplement the topics addressed and identified. In total, 543 persons responded to the online survey19% respondents were health professionals, 1% health insurers, 11% healthcare providers, 11% citizens, 15% patient organisations, 15% public administration, 20% scientific research and 1% others.

A number of legal and operational issues need to be addressed to ensure that European healthcare systems can make best possible use of health data. Variations in interpretation of GDPR has led to a fragmented approach which makes cross-border cooperation difficult. Only 52% of respondents consider that it is easy for a patient to access his/her medical records and 42% to obtain a portable copy of their medical record to take to another healthcare provider in the same country (even less, 28% when it comes to sharing with a healthcare provider in another country). 73% of consulted stakeholders believe that having health data in a personal data space or patient portal facilitates the transfer between healthcare providers. There is a high consensus (87%) that lack of data portability drives up costs through repeating testing and examination, slows down time to diagnosis and treatment (84%) and can limit the rights of Europeans to seek care in another EU country (79%). Low interoperability is considered the main cause for preventing data sharing for healthcare provision at national level by 70% of respondents and by 83% between EU countries. 81% of respondents considers that additional measures should be taken at EU level to enforce patients’ control over their own health data and portability of this data, including though legislation (84%).

81% of stakeholders consider that the use of different GDPR legal basis (consent, provision of care, public interest) make it difficult for health related data to be shared for public health purposes between EU countries, 76% agree that such sharing is hampered by differences in datasets and 70% believe that this is also made difficult by datasets scattered over many healthcare providers. 79% believe that epidemiological institutions should have easier and direct access to health data (and 71% for medicine agencies, medical devices and HTA bodies) and 85% consider that EU should support this (80% for medicine agencies, medical devices and HTA bodies). 75% of respondents are convinced that one should facilitate direct reporting of national and regional public health authorities to public health institutions dealing with epidemiological aspects, without going through a reporting cascade. 71% believe that one should set up an EU level system allowing patients to make data available for research without reference to a particular research project (data altruism) and the same percentage believe that such a data altruism system should be also used for pandemics. 71% of respondents believe that the time and interaction costs of gaining access to health data for research are high and 86% plea that EU should support the processing of health data for scientific or historical research or statistical purposes by legislation; 81% suggest that EU should promote the use of the same legal base of sharing health data for research purposes and provide EU level guidance on obtaining the consent from patients for sharing data (86%).

82% of respondents believe that EU should support Member States to put in place structures allowing for secondary use of health data for policy making and research, including by legislation. 79% support a single point of contact for the use of health data for research in all Member States and 80% believe that all single points should be linked at EU level, to support pan-European research. 70% consider that one single point of contact should also be set up at EU level, in addition to national ones. The support for data altruism (make patients data available without reference to a particular research project) is high (72%), for both national and EU level and 78% consider that EU should support Member States to set up structures for managing such systems (78%) or such governance should be set up at EU level (76%). With regards to infrastructure for secondary use of health data, 69% of respondents support a structure linking the one entry points/Health Data Access Bodies of different countries, other research infrastructures and data sources at EU level, slightly ahead of a structure intermediating access to health data (a body where a request for access to existing health data can be put forward and managed) (68%). 58% of respondents consider that such an infrastructure should be set up at the level of an EU agency, followed by an EU committee (43%). Only 4% consider that a common model for health data sharing has no added value.

Action at EU level is supported in several areas: anonymizing/pseudonymising health data (90%); use of open exchange formats (86%), data quality and reliability through the use of standards (90%), health related cybersecurity standards (89%), minimum datasets for data exchange (81%). When it comes to EU action, legislation (67%) is support more than Codes of Conduct put together by representatives of all relevant national authorities (59%) of by a board of stakeholders (59%).

The stakeholder consultations contributed to the identification of future EU level actions in the area of governance, legislation, support for digitalisation, interoperability and digital infrastructures.

3.Study on Health Data, Digital Health and Artificial Intelligence in Healthcare

The study, which was carried out between September 2020 and August 2021, provides evidence needed to enable informed policy making in the areas of digital health products and services, AI, the governance on the use of health data and the evaluation of Article 14 of the CBHC Directive.

The consultation activities included 28 interviews, 9 focus groups and 2 online surveys. Relevant stakeholders identified and contacted were eHealth Network members and coordinators of Joint Actions supporting the eHealth Network and the European Health Data Space; national bodies (Ministries of Health, eHealth agencies, National Medicines Agencies); EU institutions (European Commission, European Medicines Agency, ECDC); patients organisations; healthcare professionals organisations; organisations representing the industry (e.g. medical devices industry) and individual companies (digital industry, pharmaceutical industry, medical devices industry) as well as individual experts (scholars, researcher, etc.).

The stakeholders support measures in a number of areas, ranging from guidance on digital health services and products quality, interoperability, reimbursement, identification and authentication, digital literacy and skills. On primary use, stakeholders support mandating national digital health authorities with tasks to support cross-border provision of digital health and access to health data. In addition, they also support expansion of the services of MyHealth@EU. There is also support for giving patients the right to portability of their electronic health records in an interoperable format.

On secondary use, there is support for the introduction of a legal and governance framework, building on the establishment of Health Data Access Bodies in a number of Member States, with cooperation at EU level through a network or an advisory group. To reduce barriers, there would be support for specifications and standards.

4.Study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space 11

The study, which was carried out between April 2021 and December 2021, aims to present evidence-based insights that will support the impact assessment of options for a European digital health infrastructure. The study identifies, characterises and assesses options for a digital infrastructure, outlines cost-effectiveness, provides data on the expected impacts, both for the primary and the secondary use of health data.

A total of 18 interactive workshops were conducted covering 65 stakeholders who actively engage with health data usage. Their background varies from Ministries of Health, digital health authorities, National Contact Points for eHealth, health data research infrastructures, regulatory agencies, Health Data Access Bodies, healthcare providers, patients and advocacy groups.

In addition, a survey focusing on costs was developed, including questions related to the value, benefits, impact and cost of different options. The objective was to refine the principles and options that were identified during the study. The survey was targeting four stakeholder groups: National Contact Points for eHealth, Digital Health Authorities or Ministries of Health, Health Data Research Infrastructures and EU Health regulatory, surveillance or policy making agencies, and finally national Health Data Access Bodies or access bodies.

The stakeholder consultations were focused on gathered input regarding three key infrastructure options for the infrastructure for primary uses of health data, for secondary uses of health data and for a potential European Health Data Access Body (EHDAB). These options are depicted in the figure below.

Figure 1. Over of infrastructure options.

Option 1 considers extending the current infrastructure for primary uses of health data (MyHealth@EU) with capabilities to support secondary uses of health data. In the figure, the lower plane shows the network of NCPeHs in MyHealth@EU which would also connect Health Data Access Bodies 12 . While this option could facilitate the sustainability of MyHealth@EU, several stakeholders suggested against mixing given the complexity of mixing both networks (primary and secondary), as their functions are inherently different at national level (while NCPeHs act as gateways to synchronously transmit health data across Member States, Health Data Access Bodies have specific functions related to providing access to health data to third parties). Participants indicated that Option 1 is highly complex and possibly unrealistic due to different governance rules, technical requirements/solutions and use cases, and modes of access, privacy and data quality issues and lack of collaboration between NCPeHs and Health Data Access Bodies.

Option 2 considers directly connecting Health Data Access Bodies through a federated (distributed) network at EU level, which would facilitate communication and limit disruption in the existing infrastructure (MyHealth@EU) and would be the preferred option. A total of 45% participants in the consultations stated that Option 2 is the less complex of the three presented options. Specifically, it was considered ‘the most appropriate for public health’, ‘more desirable/preferrable’ and ‘the simpler,’ as it can be established with low deployment costs.

Option 3 would rely on the EHDAB as the central gateway to process multi-country requests and connect national Health Data Access Bodies at EU level. This third option would come at a substantial cost for the EU as it would require the deployment of heavyweight infrastructure centrally. Option 3 was recognised by 29% of participants as the most complex option, although 17% recognised that a European unified framework would reduce local heterogeneity and lead to a more 'harmonised' European digital health data environment with ‘the highest impact for the competitiveness of Europe in the data economy’. In order for this option to function, more regulation, structure and EU governance would be required.

This study also investigated the future development of MyHealth@EU. Regarding this, healthcare professionals attach high importance to services such as patient summaries, ePrescription and critical analysis. For patients, they attach high importance to all services allowing access and sharing of health data. For researchers and policy makers, they attach high importance to services facilitating access to health data for reuse.

Across all participants that took part in the workshops and survey, a total of 24 were asked about the potential implementation challenges they expect in relation to the three presented health infrastructure options. Out of these participants, 16 responded to this question. Overall, the data indicate that the implementation challenges depend on the exact functions and roles associated with each infrastructure option. The biggest challenges identified when attempting to specify a technological infrastructure ecosystem relate to:

·Interoperability: technical, data, and semantic barrier in the use of different classifications, code lists, terminologies and languages.

·Measures and information about quality in the data: data quality and validation are necessary.

·Leveraging existing projects and initiatives: the challenge would be to reuse existing infrastructures, services and structures.

·Legal barriers: variability between EU Member States in the implementation of GDPR, standards on health data sharing, data processing ethical use of data, data transfers.

A number of participants expressed the opinion that anonymised or pseudonymised data could be sufficient to enable health data reuse. However, there are cases where research may need access to identifiable and personal medical data, e.g. where linkages across databases is needed.

Interoperability and the use of common data models and standards are necessary for the reuse of data across datasets. On common data models, users were split between the development of a common data model with refined granularity, lightweight formats and models with clear semantics for data integration or a combined approach.

In relation to when data mapping should occur in the infrastructure, although ‘an upfront exercise would be useful if it is reliably implemented’, it is more realistic to trigger the mapping upon project authorisation or on demand. Mapping all data to the chosen common data model upfront might be complex and time-consuming due to the depth of the mapping and the evolving nature of study needs. Other participants explained that they foresee multiple complementary approaches, such as mapping to a common data model upfront and on-demand mapping as part of the project authorisation. In any case, the common model would need to be agreed upon.

Some participants explained that they expect the data alignment and mapping to be necessary for the research infrastructures working with different national datasets, while others foresee a mixed model with a small, core set of variables being aligned and mapped across Member States and data providers. Other stakeholders see an added value on the data alignment and mapping across Member States for comparability. A few participants expected the EHDS infrastructure to support analytics on identified data to validate/demonstrate the AI model quality. However, ‘ensuring quality would be a major effort’.

In terms of data storage provisions, participants showed preference for a mixed model as ‘the complexity of the data is pushing more towards a federated model where data can stay in place and the code tools can be deployed on co-located infrastructure’. Participants foresee data refreshes, where relevant, and at cases there is a need for both mechanisms but perhaps, as explained, there is no need for active tracking or monitoring for science use-cases.

Actors working on registries or national data access bodies mentioned interoperability as the main challenges, while stakeholders working in the research field and national data access bodies also flagged issues with the measurement and information about data quality. Advocacy groups also mentioned the importance of leveraging existing projects and initiatives, while health data research infrastructures, regulatory, surveillance and policy agencies mentioned legal barriers, such as variations in the implementation of GDPR.

5. Impact Assessment Study

The study, which was carried out between June 2021 and December 2021, aims to present evidence-based insights that will support the impact assessment of options for the EHDS. The study defines and assesses the overall policy options for the EHDS, building upon the evidence gathered in the previous studies.

The study analyses the results of the public consultation (see above), which was open between May and July 2021, and relies on desk research, targeted consultations and qualitative and quantitative analyses of collected data.

Annex 3: Who is affected and how?

51.    Practical implications of the initiative

The planned legislative framework will have a range of practical implications for different stakeholders. In this section, the practical implications for patients, healthcare providers, digital health authorities, researchers and digital health industry are briefly addressed.

There is a wide variety of uses and reuses of health data by different stakeholders that the EHDS could support. Table 1  shows some examples of use cases by different stakeholders.

Table 1. Examples of use cases of use and reuse of health data by different stakeholders.

The initiative will benefit patients, healthcare providers and researchers in a number of ways. Patients will have greater control over their health data, whenever and wherever they want, giving them greater autonomy and freedom to receive care wherever they are. They will be able to grant access to healthcare providers of their choice, giving greater control to patients. Healthcare providers will enjoy enhanced access to health data in an electronic, interoperable format. Healthcare providers will find that they spend less time copying data from different data sources in different formats, saving them a lot of time, thus improving healthcare systems efficiency. Researchers, innovators and policy makers will enjoy enhanced access to health data in a standardised format, with transparency on data quality and with an infrastructure supporting their needs.

Digital health authorities will work towards making their infrastructure and their solutions interoperable across borders. This has practical implications for the design and configuration of their work, which will be impacted by EU-level decision making (binding decision-making through delegated and implementing acts). The digital health authorities will work to expand the services of MyHealth@EU to cover a larger group of end-users. eID requirements will become mandatory and will require digital health authorities to introduce the necessary measures, making it possible to support an ecosystem of trust, where users of digital health solutions can safely grant access to health data.

Member States will be mandated to appoint a national health Data Access Body (DAB), working on the basis of the EHDS mandate and binding decision-making (delegated / implementing acts). Certain categories of health data will be made available through the EHDS legal base, which will make more health data available for re-use for researchers, policy makers, regulators and innovators. The NHDAB will become part of a mandatory federated European infrastructure. Data sources will be required to fulfil a mandatory data quality label and should support algorithm training and validation for certain user groups.

Through the services provided by the NHDABs, user groups such as researchers, policy-makers, regulators and innovators will have services at their disposal that will facilitate the development of innovative digital health solutions to better serve the needs of the healthcare systems and patients.

With more health data available for reuse, researchers will be able to better develop improved prevention, diagnosis and treatment services together with healthcare providers and industry. Regulators and policy-makers will have more health data available to build on real-world evidence to improve the functioning of the healthcare system. This will improve the health outcomes for patients and the public at large.

Digital health industry will find that the initiative creates a level playing field through standardisation and the promotion of interoperability across borders, which will promote the uptake of digital health software solutions across borders. The practical implications for industry are that they are able to prove their solutions are interoperable and meet common requirements, which will help make the solutions easier to use for end-users across borders.

62.    Summary of costs and benefits

The figures cited in the tables below illustrate the costs under the preferred option in relation to its specific elements for different types of stakeholders. They are based on the assessment of costs and benefits as part of the study supporting this impact assessment, conducted by a consortium led by ICF. The overall methodology used in the study to estimate the baseline scenario, as well as the impacts of the policy options, are provided in Annex 5.

Table 2. Overview of Benefits for the Preferred Option (above the baseline and over 10 years).

Table 3. Overview of costs for the Preferred Option (above the baseline).

Table 4. Costs, benefits and benefit-cost ratio for the considered policy options (costs and benefits are shown in EUR billion, except for the ratio; costs and benefits for the policy options shown as above the baseline; in order to maximise the possible range of costs-benefit ration, this was calculated by dividing the lower bound benefit by upper bound costs and of higher bound benefit by lower bound costs).

Annex 4: Graphical representation of different elements in the Impact assessment 13

Figure 2. User perspectives on the use and reuse of health data.

Figure 3. Overview of problems.

Figure 4. Preferred option for primary use of health data.

Figure 5. Preferred option for secondary use.

Figure 6. Federated infrastructure architecture for the EHDS for primary uses of health data (MyHealth@EU) (same architecture for all policy options).

Figure 7. Federated infrastructure architecture for the EHDS for secondary uses of health data (Policy Option 2).

Figure 8. Centralised infrastructure architecture for the EHDS for secondary uses of health data (Policy Option 3).

Annex 5: Methodological approach

This section presents the methodological approach used in this impact assessment, including the general approach used in the study supporting this impact assessment. The body of the text of this impact assessment provides complementary information, where necessary, particularly in the footnotes.

71.    Sources 

The assessment of the costs was carried out using multiple sources and triangulating data when possible. The main sources used have been:

Ÿdesk research;

Ÿinterviews with stakeholders from national authorities in four Member States (Belgium, France, Germany, Slovakia);

Ÿinformation from stakeholders’ workshops organised as part of related European Commission activities and initiatives;

Ÿdata from other relevant and still ongoing studies commissioned by DG SANTE; and

Ÿresults of the Public Consultation as relevant.

82.    Discount rate

A 3% social discount rate was applied. Monetary results are expressed in current prices.

93.    Timeline

All figures are provided over 10 years from entry into force, as net present value, unless specified otherwise.

104.    Baseline scenario 

The baseline scenario defines the expected evolution of the primary and secondary uses of health data in the EU (and the problems of concern within it) in the absence of additional EU intervention.

For both primary and secondary data, a baseline scenario was established to understand which Member States already implement measures in line with what is proposed under each measure for primary and secondary data. This analysis allows for the identification of those countries for which the EU proposals will require larger adjustments (e.g. creating structures and policies ex-novo), and of those countries for which the EU proposals will require adjustments of measures already in place.

The following information was mapped for all Member States, as these are considered relevant predictors of the preparedness of Member States to implement the EU proposals:

Ÿparticipation in the eHDSI by 2025;

Ÿdeployment of EHRs and data personal spaces;

Ÿexistence of labelling/certification mechanisms for digital healthcare services and products and the costs for this; and

Ÿexistence of governance and digital infrastructure for regulating secondary access to health data.

This mapping exercise was also used to collect available data on the costs of such national measures, to be used in the estimation of the likely costs of the measures proposed for the different categories of stakeholders concerned.

The baseline scenario also considers that the estimated governance framework, including potentially two joint actions, would cover for the staff costs (for Member States and the Commission) of twice-a-year 1-day general meetings and operational meetings of 1.5 hours, on top of the joint actions. This estimate for the governance framework in the baseline relies on the experience of the eHealth Network. Normally, two physical meetings of the eHealth Network and semantic and technical subgroups would be organised yearly. These are complemented with online meetings (which reached 300 meetings during March 2020 and September 2021, to deal with COVID-19, although the normal activity is expected to be less intensive). Here, the participation was counted involving 30 Member States and online meetings of 1-1.5 hours. The work of the eHealth Network is complemented with joint actions to support specific cooperation activities, and this would be expected to continue in the future.

Based on the information provided by Member States (e.g. regarding their deployment roadmap for cross-border services), the expectation is that, within baseline, by the end of 10 years period, all Member States will have a National Contact Point for eHealth and digital services for the exchange of patient summaries and ePrescriptions. However, based on the same information, the expectation is that only around 20 Member States would allow their patients and healthcare professionals to share or have access to laboratory results, images and image reports, discharge reports within the same 10 year period.

The benefits originating from cross-border ePrescriptions are calculated on the basis of the methodology used for the 2012 impact assessment for the Commission Implementing Directive on the recognition of medical prescriptions issued in another Member State 14 . This methodology allows for capturing the cost of non-dispensation of a cross-border prescription (in the form of a visit to a local General Practitioner), as well as to identify the potential benefit of rolling out cross-border digital health services.

Results from the study supporting the evaluation of the CBHC Directive, which includes a repeat study of the cross-border prescriptions use case, suggest that 7.8 million cross-border prescriptions are presented for dispensation per year in EU, with a non-dispensation rate of 46%, which is down from the estimated 55% non-dispensation rate in 2012. The key problem drivers for non-dispensation include veryfying prescription, veryfying prescribing doctor, language, insufficient information, correct drug/device and alternative drug/device. One important limitation of the calculation of the non-dispensation rate in 2021 (46%) and the reasons for non-prescription is that it originates from a survey with a low response rate of 158 pharmacists across 5 countries, which was extrapolated to the whole of the EU.

The cross-border exchange service of ePrescriptions through MyHealth@EU would solve authentication and language barrier issues. To calculate the cost of non-dispensation, it is assumed that an individual would need to visit a local GP to obtain a local prescription. The cost for visiting a local GP is estimated at EUR 65.77, based on a population-weighted extrapolation of the outpatient/ambulatory activity (2.6 billion consultations per year) and the total general outpatient curative and specialised outpatient curative care cost (EUR 132.5 billion, from Eurostat). The adoption timeline is based on input collected from Member States.

The benefits originating from cross-border interoperability of medical images are calculated as potential savings in the use of medical imaging machinery (Computed Tomography Scanners, Magnetic Resonance Imaging Units, PET scanners). For that purpose, the number of examinations using medical imaging techniques in the EU (97.7 million examinations, based on a population-weighted extrapolation from the total reported in Eurostat) was multiplied by the estimated cost for the UK (GBP 94, GBP 173 and GBP 270, respectively 15 ), and corrected for the proportion of examinations of non-residents across the EU using the proportion of non-residents among all hospital discharges as a proxy (population-weighted average: 0.63%; based on Eurostat data). There is very limited data available on the estimated costs of examinations involving imaging technology in the EU. While the UK is no longer an EU member, the costs available for the UK are considered a useful proxy for the EU.

The amount of duplications/waste is considered between 4% and 16% based on data reported for The Netherlands and Germany, respectively 16 , which was used to calculate the lower and upper bounds. The absence of precise and up-to-date data on waste in health and the potential contribution of interoperability to solving this problem is a source of uncertainty. However, the duplication/waste rates (4% and 16%), although estimated originally in 2007, are thought to be conservative given that several studies published in the last 5 years have estimated overall wasteful spending as 20% of total spending 17 . Moreover, OECD estimates that around a fifth of health care expenditure across the OECD countries (around USD 1.3 trillion annually) is wasteful (such as the unnecessary duplication of diagnostic tests or services, avoidable hospitalisations, inappropriate care, and other inefficiencies within clinical, operational, and administrative activities), i.e. it is not used to generate better health, and sometimes even harms health 18 .

For estimating the investments needed at national level for interoperability of the data domains included in the European Electronic Health Record exchange format (ePrescriptions, patient summaries, medical images, laboratory results and discharge letters), of original clinical documents and for the access of patients to their health data, the digital health service availability at national level was used as gathered by Thiel et al. The estimated average cost to introduce nationally a digital health service for a data domain that is in scope of MyHealth@EU is between EUR 50 and 150 million. This is based on estimates reported by Member States (e.g. a large-sized Member State reported the need for EUR 100-200 million for national deployment of digital health services in the scope of MyHealth@EU), and a mapping of the deployment roadmap by Member States of the MyHealth@EU services. There is little visibility currently of the national investment requirements for the deployment of MyHealth@EU services nationally, and this uncertainty is reflected in the wide range between the estimated lower (EUR 3 billion) and upper bounds (EUR 9 billion).

115.    Estimation of costs of measures proposed

The mapping exercise of Member State preparedness revealed a low availability of detailed information to be used for the estimation of the costs of the measures considered in this impact assessment. Specifics on costs and structures applicable to the estimation exercise were available only for a very limited number of Member States (the most advanced ones).

It was thus decided to use the mapping exercise to build clusters of countries which had similar developments in digital healthcare which could then be used to estimate the likely extent of the costs associated with implementing the different measures proposed. In detail, the following dimensions were used to define the clusters:

ŸHealth expenditure as a share of GDP (dataset from Eurostat 19 ), as a proxy for the size of the heath sector in the country and the existing development of digital health products and services (as it is considered that part of the health expenditure would be for the EHRs, telehealth and m-health).

ŸIndex of development of cross-border public services (from the annual eGovernment benchmark 20 ), as a proxy of the development of the digital infrastructure necessary to implement the measures considered by the impact assessment. It was not possible to use more specific indices, as those measuring the IT infrastructure are not up-to-date (e.g. the ITU index has been under revision since 2018 21 ), and the Digital Health Index recently created by the WHO 22 only covers 22 countries (only one in the EU).

ŸExistence (already operational or under development) of a Health Data Access Body 23 , as a proxy for how advanced countries are in relation to the secondary use of data.

The combination of these indicators allowed for the identification of three clusters. The first cluster (Cluster A) includes countries above the EU average in both indices, and with an existing or soon-to-be created Health Data Access Body. The second cluster (Cluster B) includes countries above the EU average in only one of the indices, and with no (or a soon-to-be created) Health Data Access Body. Finally, the third cluster (Cluster C) includes countries below the EU average in both indices, and with no Health Data Access Body.

The clusters were thus used to provide some granularity to the estimation of costs for national authorities, manufacturers, dataset owners and researchers in the Member States. The clusters were considered to be predictors of the effort and costs necessary for Member States to implement the measures considered by the impact assessment. Countries in Cluster A are more advanced and likely to require less effort, while countries in Cluster B are likely to require more effort (and incur higher costs), and countries in Cluster C even higher effort and costs.

Available information on costs concerned Member States in Cluster A. Such data was then use as a proxy for the basic estimation, to be adjusted for each cluster to account for the level of effort required.

The table below provides an overview of the composition of the clusters and the basis assumptions used to estimate the efforts and costs.

Table 5. Clusters of Member States used for cost estimation

126.    General take-up/participation scenarios

It was also considered that the implementation of the measures analysed in this impact assessment would follow different ‘paths’, depending on their nature (i.e. voluntary vs. mandatory), the interest towards the domain (especially in the case of voluntary measures), the level of investment and time needed to be ready for implementation (the implementation of eHDSI, with the progressive participation of Member States over time, provided an example), the existing level of governance and infrastructure necessary to support the implementation.

Where insufficient information exists for the estimation of adoption and participation, Member States were clustered into 3 groups (Clusters A, B, and C) 24 . While Member States in Cluster A and, to a lesser extent, Cluster B were considered likely to participate in voluntary measures from the beginning or early-on following their introduction, this was considered more difficult for countries in Cluster C.

As a result, the study generated take-up/participation scenarios to account for the number of Member States likely to implement voluntary measures, and the rate at which Member States from different clusters are likely to be ready to deploy the measures (either voluntary or mandatory).

The first scenario (low participation) considers that only up to 20 Member States are likely to implement some voluntary measures proposed over the 10-year period considered, either because the investments necessary are deemed too expensive in relation to the likely benefits, and/or because the measures are considered to interfere with national prerogatives.

The second scenario (medium participation) considers that up to 25 Member States are likely to implement some voluntary measures proposed over the 10-year period considered.

Finally, the third scenario (high participation) considers that all 27 Member States are likely to implement some voluntary measures proposed over the 10-year period considered.

The table below provides an overview of the estimated take-up/participation rate over the 10-year period considered under the three scenarios.

Table 6 – Take-up/participation scenarios used for cost estimation

137.    Specific assumptions used for measures on primary use of health data

147.1.    Governance

Governance costs are to be incurred by the Commission and Member States.

Costs for the Commission are estimated using the available information on existing related to similar initiatives as a proxy. In more details:

·In the case of measure Policy Option 1 (strengthened eHealth Network), cost estimations are based on the current EU funding of the eHealth Network, increased to reflect the mandatory participation of all Member States and the broadened scope of their work.

·In case of measure Policy Option 2 (Expert Group on Digital Health), costs estimations are based on costs information available on other expert groups organised and coordinated by DG SANTE, and used by ICF in other recent impact assessments for DG SANTE. On this basis, up to 4 FTE were considered to be needed for the participation in the Expert Group on Digital Health.

·In case of measure Policy Option 3 (new task given to an existing EU Body), costs estimations are based on the size of the team working on digital health at DG SANTE (10-12 FTE). On this basis, the costs are assumed to be equal to 12 FTE over 10 years.

·In case of measure Policy Option 3+ (new EU Body), cost estimations are based on information available on the budget for European Labour Authority, a recently created agency assisting national authorities to help ensure that EU rules on labour mobility and social security coordination are enforced consistently, which is used as a proxy 25 .

Costs for Member States are estimated using the same approach, i.e. using available information on the governance costs for similar initiatives as a proxy. In more details:

·In the case of measure Policy Option 1 (strengthened eHealth Network), cost estimations are based on the current EU funding of the eHealth network, increased to reflect the mandatory participation of all Member States and the broadened scope of their work.

·In case of measure Policy Option 2 (Expert Group on Digital Health) and Policy Option 3 (new task given to an existing EU Body), costs estimations are based on costs information available on other expert groups organised and coordinated by DG SANTE, and the related activities and costs of participating Member States (e.g. preparatory work for meetings, participation to technical groups, etc.);

·In case of measure Policy Option 3+ (new EU Body), costs estimations are based on information available on the costs for Member States in the case of supporting the work of an EU body such as the EDPB, used as a proxy.

157.2.    Digital infrastructure 

The costs for MyHealth@EU are estimated taking in consideration the experience of the deployment of National Contact Points for eHealth (NCPeH) and additional cross-border digital health services (for patient summaries and ePrescriptions) for the first 6 years (2016-2021) of deployment and operation of this infrastructure. The services portfolio for MyHealth@EU includes the exchange of patient summaries ajd ePrescriptions currently and, in the future, medical images, discharge letters and reports and laboratory results, and original clinical documents (plus patients’ access to health data in Policy Options 1, 2 and 3).

The total costs include the initial investment phase (set-up) and maintenance phase (operation). These estimates are based on expected timelines for the deployment of new NCPeHs in Member States, as reported by the relevant experts, and new digital health services in MyHealth@EU, according to each policy option, e.g. while in Policy Option 1 the assumptions is that all Member States would have a NCPeH established but not all services deployed within 10 years, Policy Option 3 imposes a requirement for all Member States to have all MyHealth@EU services in operation by Year 3. Policy Option 2 sets out a faster adoption scenario than in Policy Option 1, with patient summaries and ePrescriptions becoming mandatory in Year 3, and the rest of data domains by Year 6. While these adoption scenarios are based on the best available information, one key limitation is that these adoption scenarios are dependent on future political decisions and, therefore, there is limited certainty.

The cost estimation per service is an extrapolation of costs incurred by Member States in the deployment and maintenance of existing services gathered through a survey with Member State experts and validated internally. These costs entail: the expenditure for central services, calculated based on the incurred costs by the Commission (between EUR 4-7 million/year); costs for Member States, based on previous financing from Connecting Europe Facility (CEF) and inputs of Member States. On average, the costs are: EUR 1 million for the implementation of each service (Patient Summary, ePrescription, images, laboratory results, discharge reports and access of patients to their health data in a foreign language) and between EUR 0.3-1 million/NCPeH/year for maintaining the services and to upgrade the existing services to the new requirements. In absence of detailed information on associated costs, costs related to audits of new NCPeHs, project management, etc. are added as 10% of maintenance and implementation costs.

The detailed implementation costs for each service are estimated as follows:

-Implementation of initial services (including the deployment of the NCPeH and Patient Summaries and ePrescriptions): EUR 0.8 million to EUR 2.5 million;

-Implementation of Original Clinical Documents: EUR 0.8 million to EUR 2.5 million;

-Implementation of Structured Laboratory reports: EUR 0.3 million to EUR 1.0 million;

-Implementation of the Structured Hospital Discharge Letters: EUR 0.5 million to EUR 1.5 million;

-Implementation of the Structured Medical Images and Reports: EUR 0.3 million to EUR 1.0 million;

The above described reference values were used as assumptions to estimate the necessary investment in digital infrastructures and adjusted according to the intensity of the different policy options.

The total cost over 10 years for MyHealth@EU varies according to the intensity of the policy options. For Option 1, costs are distributed along the 10 year period, with Member States gradually adopting more services. For Options 2 and 3, due to the mandatory nature of the interventions, costs tend to accumulate in the first 5 years of these intervention. In particular in Option 3 where all the services become available in all countries by the Year 3. Hence, the costs peak in the first years of the initiative while the remaining years are dedicated to maintenance.

For estimating the total cost of rolling out the necessary digital infrastructure, the digital health service availability nationally gathered by Thiel et al. (2021) was used as a reference.

167.3.    Data interoperability

Measures for data interoperability in the case of primary use of health data include provisions on cross-border exchanges falling within EEHRxF, quality labels for digital health products and services and framework for assessment of wellness mobile applications.

The costs for the Commission and Member States are estimated to account for their role in the design and definition of implementation of policies and implementing measures for the provisions listed above. Measures for data interoperability are expected to generate costs for manufacturers of digital health products and services. Some key assumptions include:

-The estimated costs for self-declared labels for EHR sytems, digital health products (Policy Option 1 and 2) are EUR 9,000-32,000 (EUR 1,500-3,000 for wellness applications). The overall amount is derived from the costs of the German DiGA system. One important limitation is that these costs do not include any cost of adaptation of the product to the requirements of the label, but rather the preparatory work by the manufacturer for the self-declaration.

-The estimated costs for third-party certification for EHR sytems, digital health products and wellness applications (Policy Option 3) are EUR 20,000-50,000. Similarly, the same limitation applies: these costs do not include any cost of adaptation of the product to the requirements of the certification.

The table below shows the modelling assumptions for the calculation of costs for labelling and certification for each option. In the cases where labelling/certification is voluntary, a base year (Year 1) volume is estimated on the number of products labelled/certified within the French and German systems (DiGA). In the cases where labelling/certification is mandatory, a linear growth is assumed until full market coverage is reached in Year 5, which could mark the end of a possible transition period.

Table 7. Modelling assumptions for the calculation of costs for labelling and certification for each option.

The implementation costs for the label and assessment schemes are estimated using the information available on the fees charged by national authorities in the application of the DiGA system in Germany 26 . In particular, the fees charged by authorities are used as a proxy for the costs necessary for the labelling/certification body to process the documentation submitted. Manufacturers are estimated to incur into similar internal costs to prepare for the labelling/certification scheme, which is confirmed by the quantification of labelling/certification costs used recently in the Impact Assessment for the Digital Governance Act 27 .

For estimating the cost of developing and maintaining a product database at EU level, the yearly costs of EUDAMED were taken as a reference, as it is a similar product database under the MDR. On this basis, the development costs where estimated at EUR 15-20 million for development and EUR 2 million for maintenance when in regular operations.

A key limitation of these calculations is the lack of reliable data on the market sizes and growth rates for different product categories. Therefore, proxies and ranges are used to overcome this uncertainty. Although the high uncertainty around the sizes of the targeted markets, the assumptions rely on the best available information, and are expected to capture the differences between mandatory and voluntary and self-declared and third-party schemes across the considered options.

In the case of EHR systems, the volume of digital systems certified under the Finnish system was used as basis for extrapolation to the whole of the EU. Finland has enlisted around 400 electronic health record systems and other digital health products processing electronic health data in its current database of certifiable products. The system has been operated for more than 10 years. Out of these products, around 80 are connected to the national system (Kanta). By extrapolation, and considering that some of the products are either provided by manufacturers supplying several national markets concurrently, the estimate is that the market of EHR systems could have a size of 4,000-5,000 products within the scope of certification/labelling. Assuming that re-certification would be required every 5 years, the number of certifications during the period of 10 years could be estimated as 8,000-10,000.

In the case of digital health products that are medical devices, the volume of software products on medical devices databases were used as a reference. The volume of products falling within the scope of certification/labelling was estimated to be 5,000-20,000.

In the case of wellness applications, according to the IQVIA Institute, the volume of health-related mobile applications would have surpassed 350,000 globally in 2021 28 . According to industry analysts, sales in health and fitness apps in Europe accounted for 30% of global spending in the category, up from a 27% share in 2019. Therefore, the European market for wellness applications is estimated to comprise approximately 100,000 products. It is uncertain how many of these wellness applications could eventually fall within the scope of mandatory third-party certification, and the eventual costs will vary dependent on this scope. However, for the purpose of the calculations, an assumption was made that 20% (20,000) could fall under the scope for certification. This volume is sufficiently large to illustrate the effect that mandatory third-party certification would have on market operators.

177.4.    Economic benefits

The estimation of the economic benefit for primary use of health data is based mostly on the potential saving for European citizens from access and use of telemedicine in place of traditional medicine services, as the former is cheaper.

Telemedicine is not only less expensive to EU patients compared to traditional medicine, but it also requires less time taken for patients at health care. Both effects bring about potential savings in terms of the monetary cost of health care for patients and time taken which is monetised by taking the EU gross average salary as a measure of the value of time.

Formulas applied:

The estimation is based on the following evidence and assumptions:

Ÿ[Evidence] The annual cost of traditional medicine per EU citizen/patient is EUR 68.9 compared to EUR 10 of telemedicine according to a market study on telemedicine 29 .

Ÿ[Evidence] Traditional medicine demands more consultation time per year (0.014 days) compared to telemedicine (0.03 days) according to the same market study on telemedicine. This means more time taken for patients at their health care centre.

Ÿ[Evidence] EU-27 population is assumed to grow at an 0.19% according to Eurostat population projections (TPS00002).

Ÿ[Evidence-based assumption] The percentage of the population demanding heavily health care is about 30% based on Eurostat self-perceived health statistics (HS1 variable in the European Health interview survey) 30

Ÿ[Evidence-based assumption] The proportion of potential savings is adjusted by a rate of digital readiness of users and is assumed at an average of 44% based on Eurostat (eGovernment use) 31 .

Ÿ[Evidence-based assumption] The daily wage of EU-27 population on average is EUR 172 based on Eurostat (LC_LCI_LEV 32 ).

ŸA total demand for healthcare is assumed fixed and patients are able to substitute traditional medicine by telemedicine which is cheaper for patients in terms of monetary costs and time taken by the service.

ŸThe total EU population demands healthcare according to their needs. Based on EU survey on self-reported health, the coefficient adjusting the total population is 35%.

The uptake of telemedicine is given by the digital readiness of the EU population, hence, the effective demand for health is further adjusted by 44%, based on the index of digital readiness in Europe. The baseline uptake of telemedicine equals 5%, corresponding to the share telemedicine would substitute traditional medicine. The benefits by options are assumed as 6%, 20% and 20% for Policy Option 1, 2 and 3, respectively. This means 1%, 15% and 15% above the baseline, respectively.

One key limitation of this approach is the absence of a data-driven approach to attribute the potential for increasing efficiency (i.e. producing savings in the health sector) of each of the options. However, it is understood that voluntary measures are close to the baseline, and therefore their potential for producing benefits above the baseline is limited (hence, only a small improvement of 1% is attributed to Option 1), while options establishing obligations on manufacturers and Member States to ensure interoperability are expected to produce higher benefits (15% above the baseline).

The benefits (explained above for baseline), stemming from the use of ePrescriptions and avoiding repeated costs, are maintained in subsequent policy options.

188.    Specific assumptions used for measures on secondary use of health data

198.1.    Governance

The assessment of the governance costs for secondary use of health data followed the same approach as for governance in the context of primary use of data. Measures in Policy Option 2 and 3 require Member States to designate a Health Data Access Body, which would require either the creation of such authority (if it does not exist already), or to assign such role to an existing national authority/body.

Based on the available information on the annual costs of existing national Health Data Access Bodies (e.g. in France and Finland), it is estimated that their staff includes at least 10 FTEs, and their costs varies between EUR 2 million and EUR 5 million per year.

Under both measures, it is assumed that only a very limited number of Member States will create such authorities (larger Member States, from Cluster B – two in Policy Option 2 and four in Policy Option 3), while all the remaining ones will attribute this role to existing bodies. The new role will require an extra budget and staff for those national authorities, which is estimated in 3 to 5 FTEs (as most of the remaining Member States are smaller ones and/or from Cluster C), with annual running costs of approximately EUR 200,000- 250,000 per year.

208.2.    Digital infrastructure

Costs and revenues for the infrastructure for secondary use of health data are estimated taking as reference 2 of the existing Health Data Access Bodies (Findata and French Health Data Hub).

The baseline considered the costs under Data Governance Act for setting up (EUR 10.6 mil) and maintenance (EUR 0.6 mil/year) of the secure processing environments 33 .

Costs are organised by initial investment phase (set-up) and maintenance phase (operation). While, in average a set-up phase from a Health Data Access Body can range from EUR 0.5 million to EUR 8.5 million (depending on the size and complexity of a Member State) the maintenance costs range from EUR 0.2 million to EUR 4.0 million per year, per country.

To connect the National Health Data Access Body to the EU-wide infrastructures, the initial investment costs vary between EUR 0.8 million to EUR 2.5 million per year, per country, while maintenance costs of this connection are estimated to be between EUR 0.2 million to EUR 0.8 million. The cost for central services is estimated EUR 7 million yearly.

Besides the digital infrastructure deployed in the Member States, it is also important to consider the costs associated with supporting services (also known as central or core services) provided by the Commission. These central services would require an initial overall investment of EUR 25 million across a period of 4 years and yearly maintenance costs of around EUR 4-7 million.

For the calculation of costs of national health data access bodies, EUR 75,000 is used as a reference for each FTE, for comparability, as this is used as a reference in the impact assessment for the DGA. The average overall costs over 10 years for individual Health Data Access Bodies (HDABs) are expected to range between EUR 3.3 million (4 FTE) and 41.3 million (50 FTE), depending on the size of the organisational arrangement. The lower bound (4 FTE) is meant to reflect the choice of a Member State to establish the HDAB within an existing body, while the upper bound (50 FTE) is meant to reflect the choice of a Member State to establish a separate independent body for the HDAB (as done in France with the French Health Data Hub).

The upper bound is calculated on the basis of a balanced mix of sizes: 11 4-FTE HDABs; 10 15-FTE HDABs; 6 25-FTE HDABs; and 1 50-FTE HDAB. Given that many countries have not adopted yet HDABs, it should be noted that the calculation of the upper bound is highly uncertain, but it is aligned with the various approach taken so far by Member States.

Total costs vary according to the intensity of the policy options. For Policy Option 1, costs are distributed along the 10-year period and the costs related with EU connection are calculated as an additional cost in the infrastructure for primary use of health data (MyHealth@EU). For Options 2 and 3, costs increase in particular in the first 5 years of the intervention, as this is the period when Member States would most likely make investments to meet their obligaions. Regarding Option 3, costs increase for the central services due to the centralised architecture that requires that a bigger number of digital services by the central entity, namely to EUR 32 million across a period of 3 years and yearly maintenance costs of around EUR 4 million. It should be noted thath the estimated costs for the central infrastructure are highly uncertain, as the actual system requirements will not be defined until the implementation phase begins, but they build upon the information that is currently available from similar initiatives (e.g. EU DARWIN).

The above-described reference values were used as assumptions to estimate the necessary investment in digital infrastructures and adjusted according to the intensity of the different policy options.

218.3.    Data interoperability and data quality

Measures for data interoperability for secondary use of health data include requirements for Member States to ensure secure, reliable and interoperable discovery, access, sharing and processing of health data (up to certification in Policy Option 3) and procedures for handling multi-country data requests.

Measures for data quality include quality labels (and certification in measure Policy Option 3) datasets to evaluate, according to a common assessment scheme, their quality.

The cost of label/certification for data quality (carried out by public authorities) was estimated using the same costs calculated by the Impact Assessment for the Data Governance Act (EUR 20,000-50,000, of which half represent internal costs for manufacturers and half certification fees, which are considered as a proxy of the costs for authority to process the application) as a basis. The following additional assumptions were used:

·Policy Option 1: costs for self-assessment estimated to represent about half of the certification costs, to be borne by datasets owners only;

·Policy Option 2: costs for self-assessed label estimated to represent about 70% of the certification costs, to be borne by datasets owners only;

·Policy Option 3: costs for public certification scheme estimated in line with the IA for the Data Governance Act, to be borne by public authorities managing the certification process and by datasets owners (in equals share);

·Number of datasets likely to be labelled/certified: extrapolated from the number of datasets currently available in national systems (15, of average), and used as a proxy for Cluster A countries. Member States in Clusters B and C are estimated to have fewer datasets (8 and 6 respectively). Availability of datasets is expected to grow between 5% and 10% per year over the 10-year period considered.

228.4.    Economic benefits

The total benefit of secondary use of health data is the sum of the economic value of health data, the savings of more efficient access to data and cost savings thanks to information transparency.

The economic value of health data is measured using the economic value of data in general estimated by the IDC study and used by the study supporting the Data Governance Act IA. Then, the value of data sharing is adjusted by the R&D expenditure in health as proportion of GDP in Europe. This adjustment allows to obtain an approximate magnitude of the corresponding value attributable to health. The estimation is based on the following evidence and key assumptions:

Ÿ[Evidence] According to the WHO, Europe allocates about 0.03% to R&D in health as proportion of the EU GDP 34 .

ŸTo measure how much of the overall value corresponds to health, it was used the 8.3% as adjusting factor, which is the average expenditure on health across EU-27 countries.

[Evidence] The value of data sharing is obtained from the IDC market study on data economy that was used in the study to support the Data Governance Act 35 . A conservative estimate increase of 0.5%, 1.0% and 1.2%, respectively for each policy option, is applied to the economic value of health data based on the econometric analysis performed as part of the impact assessment of the Data Governance Act.

For the benefits from information transparency for policy-makers and regulators thanks to direct access to health data through EHDS infrastructure, input gathered from experts in the pharmaceutical regulatory process was that if a 10% reduction in drug development cost of phase III trials can be delivered through use of real-world evidence (in situations where this is appropriate, e.g. repurposing medicines), it is estimated that, for 100 medicines annually, this could produce a possible saving of EUR 184 million. The cost of a single phase I clinical trial was estimated as 2.9 million EUR, 7.4 million EUR for phase II and 18.4 million EUR for a phase III trial 36 . Additionally, in a medium-sized EU country, a 5% saving in drug cost in oncology, diabetes, cardiovascular, respiratory/neurology thanks to information transparency regarding their effectiveness could result in an annual saving of EUR 50 million. With increasing prices of new medicines, this saving is expected to increase in the future. Over 10 years and extrapolating to the whole of the EU, these savings could yield a benefit of EUR 1.6 billion. Given that existing initiatives will contribute to capturing this benefit, EUR 0.8 billion (half) were attributed to the baseline, while other EUR 0.8 billion were attributed to Policy Options 2 and 3 for providing enhanced access to health data for policy-makers and regulators.

There will also be saving stemming from efficiency gains (replacing the collection of consent by fees paid to data access bodies). The internal costs for national health data access bodies are estimated around EUR 2,100-2,600 per request. The costs for data owners are not possible to estimate, as this depends on standards established. The costs for data reusers include assembly of data requested and costs for obtaining individuals’ consent in most Member States (used parameters: 100 requests per country, 30 min for obtaining each consent). However, the usual cohorts are much bigger (they can vary between 10 persons for rare disease to 500,000 data subjects for countries like Finland. There are also cases where the cohort could include the whole population of a country, in which case obtaining consent is very difficult and biased, as one cannot have random samples). The costs for the fees of data access bodies comprise for an average request including a EUR 1,000 data request, 115 EUR/data processing hour (an average of 10-20 processing hours/request) and between 3 and 12 months of remote access. However, it should be noted that pricing models differ across existing health data access bodies and national policy choices. For example, the Danish body charges approximately EUR 300 per data processing hour and estimates self-sustainability in the medium run, with the current evolution of the number of requests. French Data Hub does not charge the public sector and the overall fees may be lower. The average of requests per year took into account Finnish and Danish experience (400-500 requests per year), but French Data Hub recorded so far over 1600 projects, which indicates that the number also depends on the size of the country.

The provisions for handling multi-country data requests were estimated using the following key data points:

·Number of requests: extrapolated from the (expected) number of requests (600) from the Finnish system for secondary use of health data (Findata), using the R&D expenditure of EU Member States from Eurostat 37 as an indicator for the volume of request. This value was used as proxy for Cluster A countries. Member States in Clusters B and C are estimated to have fewer requests per year (245 and 241 respectively). The number of requests is expected to grow between 5% and 10% per year over the 10-year period considered, as an effect of increased availability of datasets and of increasing interest in health-related fields of research.

·Costs for authorities to process the requests: estimated using the information on the data request fee in the Finnish case as a proxy (corresponding to about 3 person-days), and considered to decrease as an effect of the coordination mechanisms implemented (to 2.5 person-days under measure Policy Option 2 and to 2 person-days under measure Policy Option 3). Variable costs for the extraction and treatment of data requested were not included, as there was not sufficient information to build a robust example. Costs for the EC to process the request were estimated for measure Policy Option 3, and assessed at 0.5 person-days per request.

·Costs for data users (researchers) to prepare the data request: assumed to be of approximately 15 person-days (not including waiting times in between steps of the process) for multi-country requests to be filed separately to each national data access body, up to 20 days.

An illustrative example was elaborated to describe the procedures and costs under the different measures, considering a 3-country data request.

239.    Methodology and assumptions used for the evaluation of the Article 14 of the CBHC Directive (Annex 12)

A consortium led Open Evidence carried out a specific study for the Commission to inform and support the evaluation of Article 14 of Directive 2011/24/EU. Lot 4 of that study examines the effectiveness, efficiency, coherence, relevance, and EU added value of Article 14 of the Directive 2011/24/EU and other related articles. The study was launched in September 2020 and the final report was provided in August 2021 38 . 

An extensive desk review was conducted between September and October 2020 to get the most updated and comprehensive literature and policy documents to answer the research questions guiding this study. This was complemented by targeted consultations activities (eHealth Network members and coordinators of Joint Actions; national bodies (Ministries of Health, eHealth agencies, National Medicines Agencies); EU institutions (European Commission, European Medicines Agency, ECDC); patients organisations; healthcare Professionals organisations; organisations representing the industry (medical devices industry); individual companies (digital industry, pharmaceutical industry, medical devices industry). Stakeholders were consulted via in-depth interviews 39 , focus groups 40 and online surveys 41 .

The study supporting the evaluation is based on the available evidence drawn from the triangulation of a diverse and appropriate range of methods and sources. Where secondary sources were not available to answer the research questions guiding this study, primary data and evidence was collected. A complementary desk research exercise was conducted to ensure the completeness and validity of the results obtained.

The principal limitation that this type of methodology is an intrinsic limitation coming from literature that may not cover all the information available. Another limitation was accurately quantifying costs and benefits of the access and exchange of health data by stakeholders. The nature of quantifying this process is complex due to the uniqueness per case and hard-to-measure realisation of outputs. For instance, in the case of MyHealth@EU, since the exchanges on the platform for the early adopters only started in 2019 (and 7 Member States were live at the end of 2020 and 9 mid-2021), the full potential of the platform has not been observed yet. Furthermore, the results suggest that most exchanges happen across neighbouring countries. Of the early adopters, only Finland and Estonia are neighbouring countries, limiting even more the exchanges on the platform. As more Member States and more neighbours will join the platform, one can expect that over time there will be more information to assess the results and impacts in this area.

Furthermore, quantitative data on the costs of implementing the infrastructure were limited as the Member States that did implement the infrastructure were not able to quantify the costs in terms of man-days and budget allocated to it. Often, eHealth Network members did not keep appropriate accounting of the effort invested in carrying out eHealth Network activities and did not split this work from the one conducted for their national institutions. As a result, in the area of efficiency, the information is mostly qualitative and resulting from expert’s opinions.

Annex 6: Coherence with other legislative instruments

Figure 9. Interplay of the proposal for a regulation on the EHDS with other horizontal and health-specific legislative frameworks.

1.Relevant fundamental rights legislation

The Union is founded on the values of human dignity and respect of human rights that are further specified in the EU Charter of Fundamental Rights (the Charter). Articles 7 and 8 of the Charter guarantee the fundamental rights of individuals to privacy and to data protection, while Article 35 ensures that a high level of human health protection shall be integrated in the definition and implementation of all the Union's policies and activities. Some fundamental rights obligations are further provided for in EU secondary legislation, in particular in the field of data protection.

In particular, the General Data Protection Regulation 42 and the EU Data Protection Regulation 43 aim to protect the fundamental rights and freedoms of natural persons, and in particular their right to the protection of personal data including personal health data, whenever their personal data are processed. The sharing by data controllers of personal data with third parties and their further processing are subject to a number of data processing principles such as lawfulness, transparency, fairness, accuracy, data minimisation, purpose and storage limitation, confidentiality and accountability. Additionally, natural persons, whose personal data are processed, have a number of rights, for instance, the right to access, correct, or port their personal data under certain conditions. Stricter conditions also apply for the processing of sensitive data, including health data, genetic data and biometric data used for identification purposes, while processing that poses high risk to natural persons’ rights and freedoms requires a data protection impact assessment. The legislative framework for the EHDS would ensure compliance with the rules of the existing legislation on the protection of personal data and would provide further harmonised specifications on the processing of health data in line with Articles 6(1)(3) and 9(2)(h), (i) and (j) of the GDPR. The legislative initiative also aims at strengthening the application of individuals’ rights granted under EU data protection legislation as regards the processing of their health data and provides more control over their access and use. It would also provide the EU legal basis for the re-use of health data, based on public interest, scientific, historical research and statistical purposes (as per Article 9(2), (i) and (j)).

2.Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare and other legislation relevant for digital health services and products

The current relevant applicable EU legal framework for the cross-border exchange of health data is laid down in Directive 2011/24/EU on the application of patients’ rights in cross-border healthcare 44 . The Directive provides rules for facilitating the access to safe and high-quality cross-border healthcare, ensures patient mobility in accordance with the principles established by the Court of Justice, and promotes cooperation on healthcare between Member States, in full respect of national competencies in organising and delivering healthcare. The Directive applies to individual patients who decide to seek healthcare in a Member State other than the Member State of affiliation.

However that legislation does not address access to health data for reuse. Furthermore, the proposal for a Data Governance Act, currently being examined by the co-legislators, lays down a horizontal framework across sectors with common governance mechanisms and rules to enhance access to data for reuse, which will apply also in the health sector. The initiative aims at further complementing these EU legislative frameworks with the necessary rules to further enhance health data sharing and reuse in full respect of individuals’ fundamental rights.

In addition, the current legislative initiative would strengthen Article 14 of Directive 2011/24/EU by facilitating a better uptake of digital health products and services for the provision of health care (including telemedicine, telehealth, and mHealth) across the EU.

Article 14 of Directive 2011/24/EU requires the Union to support and facilitate cooperation and the exchange of information among Member States working within a voluntary network connecting national authorities responsible for eHealth in the Member States (the ‘eHealth Network’). The objective of the eHealth Network is to “work towards delivering sustainable economic and social benefits of European eHealth systems and services and interoperable applications, with a view to achieving a high level of trust and security, enhancing continuity of care and ensuring access to safe and high-quality healthcare.” (Art. 14(2)(a)). The eHealth Network – and the eHealth Digital Service Infrastructure (eHDSI), later renamed “MyHealth@EU” – has improved the cross-border exchange of health data for healthcare (primary use of data), such as patient summaries and e-prescriptions. So far 7 Member States exchange health data via this infrastructure. The current legislative initiative aims at expanding and strengthening the cross-border exchange of health data to support continuity of care for citizens travelling within the EU, by amending relevant provisions of Directive 2011/24/EU, in particular its Article 14.

3.Cybersecurity regulatory framework

The Directive on Security of Network and Information Systems ('NIS Directive' / 2016/1148/EU) represents the first EU-wide rules on cybersecurity. The objective of the Directive is to achieve a high common level of security of network and information systems within the EU and covers operators working in the healthcare sector. The Cybersecurity regulatory framework also includes the cybersecurity Regulation (2019/881/EU) and the Regulation on electronic identification and trust services for electronic transactions in the internal market (eIDAS Regulation) which help business, citizens and public authorities carry out secure and seamless electronic interactions using electronic identification schemes (eIDs) to access public services available online in other EU countries.

By promoting the use of compulsory common security standards and of the integration of electronic identification (eID) for healthcare professionals and patients, the EHDS initiative reinforce and complement the principles and security measures set out in the aforementioned cybersecurity regulatory framework. It is designed to enhance the security and trust in the technical framework designed to facilitate the exchange of health data both for primary and secondary use.

The NIS Directive is being revised (the ‘NIS2 proposal 45 ) and is currently undergoing negotiations with the co-legislators. It aims to raise the EU common level of ambition of the cybersecurity regulatory framework, through a wider scope, clearer rules and stronger supervision tools. The Commission proposal addresses these issues across three pillars: (1) Member State capabilities; (2) risk management; (3) cooperation and information exchange. Operators in the healthcare system remain under the scope.

A proposal for a Cyber Resilience Act is also planned for adoption by the Commission in 2022, with the aim to set out horizontal cybersecurity requirements for digital products and ancillary services. The envisaged set of essential cybersecurity requirements to be laid down by the Cyber Resilience Act will be applied to all sectors and categories of digital products whose producers and vendors shall comply with, before placing the products on the market or, as applicable, when putting them into service and also through the entire product lifecycle. These requirements will be of general nature and technology neutral. The security requirements set out in the EHDS, notably as regards EHR systems, will provide more specific requirements in certain areas, such as access control.

4.eID framework

The initiative would build on the new framework for eID, including the Digital eID Wallet. This would allow the online identification of patients. A pilot project has been launched in 2021 and aims to support the access of patients to their data, including in the context of MyHealth@EU.

5.Medical device and pharmaceutical regulatory framework

The medical device regulatory framework is composed of the medical devices Regulation (2017/745/EU) and the in vitro diagnostic medical devices Regulation (2017/746/EU). These regulations include provisions related to the assessment and marketing authorisation of medical devices in the Union.

The EU legal framework for human medicines sets standards to ensure a high level of public health protection and the quality, safety and efficacy of authorised medicines. The requirements and procedures for marketing authorisation, as well as the rules for monitoring authorised products, are primarily laid down in Directive 2001/83/EC  and in Regulation (EC) No 726/2004 . They also include harmonised provisions for the manufacture, wholesale or advertising of medicinal products for human use.

Additionally, EU legislation provides for common rules for the conduct of clinical trials  in the EU. Various rules have also been adopted to address the particularities of certain types of medicinal products and promote research in specific areas 46 .

The EHDS initiative complements the aims and scopes of the aforementioned Regulations and Directives by providing access to a wide range of health data that could be useful for regulatory purposes and enhance and streamline the collection of the necessary health data required to assess and supervise the introduction and surveillance of pharmaceutical products and devices in the Union.

6.Relationship with other initiatives

On 25 November 2020, the Commission adopted a proposal for a Regulation on European Data Governance (“Data Governance Act”). The proposal sets out an overarching framework encompassing horizontal measures for all common European data spaces, and leaves room for sector-specific rules, governance mechanisms and standards where relevant. The proposal complements the Directive on open data and the reuse of public sector information (Open Data Directive) 47 . EHDS would use the DGA framework for data altruism and competent bodies supporting access to data (Article 7 DGA) through a secure processing environment. For data altruism, such activities could be carried out by Data Access Bodies or DABs, in collaboration with DGA bodies, which could request specific aspects from other entities caring out data altruism activities. With regards to competent bodies to support access to health data, the National Health Data Access bodies could be built around Article 7 DGA bodies and their secure environment, with additional tasks related to providing authorisations to data.

Figure 10. Comparison between the Data Governance Act and the European Health Data Space.

Further EU legislative action on issues that affect relations between actors in the data-agile economy in order to provide incentives for horizontal data sharing across sectors (complementing data sharing within sectors) could be taken forward in the Data Act.

The EHDS initiative will build upon the horizontal framework on data to complement it and provide more specific rules for the health sector. For instance, it is important for the trustworthiness of the system that decisions concerning access to and further processing of health data, applicable rules and policies are taken by health (data) authorities and health policy makers within the appropriate framework. Similarly, the relevant health authorities should be involved in the selection of standards in the health area and in the notification of data intermediaries in the health sector to take into account the specific requirements, standards and specifications for the processing of health data. As the sensitivity of health data demands a high level of trust for citizens to voluntarily provide their health data for altruistic purposes; competent sectoral bodies should be in involved in such data altruism schemes when they relate to health data.

It would also build on upcoming Data Act, especially on its provisions of portability and access of data from private sector.

In April 2021, the Commission published a proposal for a regulation laying down harmonised rules on artificial intelligence (artificial intelligence act). This proposal constitutes a central part of the EU digital single market strategy. The primary objective of this proposal is to ensure the proper functioning of the internal market. The proposal sets out common mandatory rules concerning the placing on the market, putting into service and use of AI systems. Additionally, it contains certain specific rules on the protection of individuals with regard to the processing of personal data. It follows a risk-based approach, differentiating between (i) unacceptable risks (ii) high risks and (iii) low or minimal risks. The proposal identifies two main categories of high-risk AI systems: (i) AI systems intended to be used as safety components of products that are subject to third party ex-ante conformity assessment and (ii) other stand-alone AI with mainly fundamental rights implications expressly listed in Annex III. There are legal requirements that are set out for high-risk AI systems concerning data and data governance, documentation and record keeping, transparency and provision of information to users, human oversight, robustness, accuracy and security. The precise technical solutions to achieve compliance with those requirements may be provided by standards or by other technical specifications or otherwise be developed according to general engineering or scientific knowledge at the discretion of the provider of the AI system.

Health data play a key role in the training, validation, testing and post-market monitoring of AI in healthcare. The aim of establishing the EHDS is to also aid providers and users of AI as well as notified bodies and market surveillance authorities to carry out their tasks and effectively and efficiently fulfil their legal obligations under the AIA. The possibility to access diverse and a large amount of organized data within the EHDS infrastructure that provide transparency and information concerning the characteristics of these data would lead to the speedy development, upscale and uptake of trustworthy AI in healthcare. For instance, health data within the EHDS could share common standards and/or follow common rules and guidelines on issues like annotation, labelling, prevention of bias and avoidance of errors. Additionally, information might be provided on the characteristics of data within the EHDS infrastructure that would enable the developer of AI systems to use appropriate data to train, test and validate algorithms that reflect the geographical, behavioural or functional setting within which the AI system is intended to be used. In this regard, Health Data Access Bodies and/or national bodies might be involved to develop and oversee common rules.

The set-up of the EHDS wouldbe an integral part of building a European Health Union, a process launched by the adoption of a first set of proposals to reinforce preparedness and response during health crisis 48 , which pave the way for the participation of the European Medicines Agency (EMA) and the European Centre for Disease Prevention and Control (ECDC) in the future EHDS infrastructure, along with research institutes, public health bodies, and Health Data Access Bodies in the Member States.

European Health Emergency preparedness and Response Authority (HERA) 49 is a central element for strengthening the European Health Union with better EU preparedness and response to serious cross-border health threats, by enabling rapid availability, access and distribution of needed countermeasures. The proposal provides synergies with the Union’s Digital Single Market agenda and EHDS, by encouraging research and innovation, facilitating the access and sharing of data and information and data, and supporting the monitoring medical countermeasures.

On 25 November 2020, the European Commission adopted a Pharmaceutical Strategy 50 for Europe with the stated aim at creating a future proof regulatory framework and at supporting industry in promoting research and technologies. It will ensure that patients have access to innovative and affordable medicines, and will support the competitiveness, innovative capacity and sustainability of the EU’s pharmaceutical industry. One of the EHDS aims is to establish interoperable data access infrastructure, which will improve exchange, federated access and cross-border analysis of health data in the EU, while ensuring the necessary safeguards and citizens’ control over their own health data. The Commission will propose to revise the pharmaceutical legislation to consider how to make best use of digital transformation. This includes new methods of evidence generation and assessment, such as analysis of big and real-world data to support the development, authorisation and use of medicines 51 . EMA will be a node in the EHDS infrastrucrure for secondary use of health data.

The European Commission’s “Europe’s Beating Cancer Plan” 52  and the recently launched Horizon Europe Mission on Cancer 53  also emphasise the need for better collecting and using health data in order to tackle inequalities, survivorship, advance research. The smart combination of health data and new technologies caters for the exponential development of personalised medicine, which becomes a powerful tool to address cancer through tailor-made prevention and treatment strategies so patients receive the therapies that work best for them, and no money is wasted on trial and error treatments. 54 It is important to make the most of the potential of health digitalisation, through EHDS to improve cancer treatment, healthcare delivery and quality of life outcomes.

Annex 7: List of m-health and telehealth initiatives (legislation, frameworks and certification/labels)

Examples of legislative frameworks for the telemedicine in MS

Source: Bensemmane et al. 2019 55

Examples of European cross-border telemedicine projects

Source: Author’s elaborations in Lupiáñez-Villanueva, et al. (2022).

Examples of m-health/tele-health assessment frameworks and certification/labels

DiGA 58

mHealth Belgium 59

ANS eHealth Label

HAS mHealth

MAST CIMT

Source: Author’s elaborations in Lupiáñez-Villanueva, et al. (2022).

Quality criteria: standards ISO/CEN 82304-2

Source: Author’s elaborations in Lupiáñez-Villanueva, et al. (2022).

Annex 8: Overview of the GDPR legal basis for processing health data for different purposes 60

Please indicate the legal basis under GDPR Articles 6 (1) and derogation basis under Article 9(2) used for processing health data for normal healthcare provision purposes within the context of a patient - healthcare professional relationship. Please note this is for regular data processing, not data processing in an emergency situation, where the vital interest basis may be used.

GDPR Article 15 stipulates that data subjects (including patients) have a right to access data concerning them. Please indicate the way in which this right may be exercised in your Member State. Note: this question does not relate to research data.

Article 17 of the GDPR provides that in certain cases a data subject can ask for data to be erased or have ‘the right to be forgotten’. However, Article 17(3) of the GDPR provides that the right shall not apply to the extent that processing is necessary for reasons of public interest in the area of public health in accordance with Article 9(2)( h) and (i) of the GDPR. If not based on article 17 a limitation to the right to be forgotten in healthcare could also be based on article 23. Please indicate if a patient may have medical records deleted in your Member State.

GDPR Article 20 stipulates that if the data collection was based on consent or on the basis of the creation or execution of a contract, the data subject (patient) has a right to obtain a portable copy of the data. Please indicate which of the following apply in your Member State Note: this question does not relate to research data, see question 34. (Q33).

If you have selected the last option above, please describe why Article 20 does not pertain to patient

data

Please indicate if any specific legislation has been adopted in your Member State that addresses the processing of health data that was originally collected for the purpose of providing care to allow it to be used for planning, management, administration and improvement of the health and care systems entities such as health authorities.

If yes, please indicate which combination of legal bases the legislation relies upon when data are used for planning, management, administration and improvement of the health and care systems: (more than one answer may be applicable as different types of organisation might process data for such purposes).

Please indicate if any specific legislation has been adopted in your Member State that addresses the processing of health data that was originally collected for the purpose of providing care to allow it to be used for market approval of medicines and devices, such as medicines agencies, EMA, HTA and Notified Bodies.

If yes, please indicate which combination of legal bases the legislation relies upon when data are used for market approval of medicines and devices. (More than one answer may be applicable as different types of organisation might process data for such purposes)

Please indicate if any specific legislation has been adopted in your Member State that addresses the processing of health data that was originally collected for the purpose of providing care to allow it to be used for monitoring of medical device safety and/or pharmacovigilance.

If yes, please indicate which combination of legal bases are relied upon when data are used for monitoring of medical device safety and/or pharmacovigilance.

Please indicate if any specific legislation has been adopted in your Member State that addresses the processing of health data that was originally collected for the purpose of providing care to allow it to be used for protecting against serious cross-border threats to health. (Q20).

NOTE: some threats are classified as reportable in WHO’s International Health Regulations, and therefore intentional law may also apply to this issue (see question 22 below).

All EU Member States are required to report diagnosis and outcome of the diseases covered by the WHO International Health Regulation, which now also includes COVID-19. Has your Member State enacted any national level specific legislation about other cross-border health threats, such as food borne diseases, sexually transmitted diseases, which are not covered by the IHR?

If yes, please indicate which combination of legal bases are relied upon when data are used for protecting against such potentially serious cross-border threats to health.

Please state if any specific legislation has been adopted that addresses the processing of health data that was originally collected for the purpose of providing care, by third-party public-sector researchers, i.e. by a different controller than that where the treating healthcare professionals were based. If yes, please indicate which legal base in Article 9(2) is relied upon when data are used for research by third-party public-sector researchers.

Please state if any specific legislation has been adopted that addresses the processing of health data that was originally collected for the purpose of providing care, by third party researchers not in the public sector – i.e. researchers based in not for profit organisations, researchers based in industrial or commercial research organisations and researchers based in other privately funded research organisations. If yes, please indicate which legal base in Article 9(2) is relied upon by such third-party researchers not in the public sector.

Annex 9: Overview of national bodies dealing with secondary uses of health data 61

Data altruism in place or desirable to set up at national or EU level

* To illustrate the responses, EE answered both yes and no, with the clarification that the answer in the current settings would be ‘no’, and to be changed to ‘yes’ if first clear regulations with responsibilities were set in place.

* Sources of information: findata.fi, legal technical survey by national country correspondent, and correspondence with relevant experts.

* Sources of information: health-data-hub.fr, legal technical survey by national country correspondent, and correspondence with relevant experts.

* Sources of information: legal technical survey by national country consultant, legal texts as mentioned in the box and correspondence with relevant experts.

* Sources of information: cbs.nl, legal technical survey, knowledge of the authors

* Sources of information: correspondence with relevant experts.

* Sources of information: legal technical survey by national country correspondent, correspondence with relevant experts, van der Wel et al. (2019), respective organisation websites. More details on centralized bodies, in chapter 7 of the study: European Commission (2020). Assessment of the EU Member States rules on health data in the light of GDPR. (Annexes available at: ).

(1)  Hansen, J., Wilson, P., Verhoeven, E., Kroneman, M., Kirwan, M., Verheij, R., van Veen, E.-B. (2021). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_en_0.pdf (Annexes available at: https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_annex_en_0.pdf ).

(2)  Lupiáñez-Villanueva, F., Gunderson, L., Vitiello, S., Febrer, N., Folkvord, F., Chabanier, L., Filali, N., Hamonic, R., Achard, E., Couret, H., Arredondo, M. T., Cabrera, M. F., García, R., López, L., Merino, B., Fico, G. (2022). Study on Health Data, Digital Health and Artificial Intelligence in Healthcare, Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/179e7382-b564-11ec-b6f4-01aa75ed71a1/language-en

(3) The study covered all 27 Member States, the United Kingdom and Norway. https://ec.europa.eu/newsroom/dae/redirection/document/79897

(4)   https://op.europa.eu/en/publication-detail/-/publication/6f758166-2198-11ec-bd8e-01aa75ed71a1/language-en/format-PDF/source-232403056

(5)   https://ec.europa.eu/health/sites/default/files/ehealth/docs/2018_provision_marketstudy_telemedicine_en.pdf  

(6) https://edps.europa.eu/sites/default/files/publication/20-11-17_preliminary_opinion_european_health_data_space_en.pdf  

(7) https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12663-Digital-health-data-and-services-the-European-health-data-space_en

(8) Some of the respondents were international and pan-European organisations based in Belgium.

(9)  Hansen, J., Wilson, P., Verhoeven, E., Kroneman, M., Kirwan, M., Verheij, R., van Veen, E.-B. (2021). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_en_0.pdf (Annexes available at: https://ec.europa.eu/health/system/files/2021-02/ms_rules_health-data_annex_en_0.pdf ).

(10) More details in Hansen et al. (2021).

(11)  European Commission (forthcoming study). A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space, Trasys.

(12) In the figure, Health Data Access Bodies are indicated as “DPerA”s for “Data Permit Authority” instead of “Data Access Body”.

(13)  European Commission (forthcoming study). A study on an infrastructure and data ecosystem supporting the impact assessment of the European Health Data Space, Trasys.

(14)   https://ec.europa.eu/health/sites/default/files/cross_border_care/docs/impl_directive_presciptions_2012_ia_en.pdf  

(15)   https://digital.nhs.uk/services/national-casemix-office/downloads-groupers-and-tools/local-payment-grouper-2019-20  

(16)   Addressing Overutilization in Medical Imaging | Radiology (rsna.org)

(17) OECD/EU (2018), Health at a Glance: Europe 2018: State of Health in the EU Cycle, OECD Publishing, Paris. https://doi.org/10.1787/health_glance_eur-2018-en  

(18) https://www.oecd.org/health/health-systems/Empowering-Health-Workforce-Digital-Revolution.pdf

(19) See: https://ec.europa.eu/eurostat/web/products-eurostat-news/-/ddn-20201202-1  

(20) See: https://www.capgemini.com/wp-content/uploads/2020/09/eGovernment-Benchmark-2020-Insight-Report.pdf  

(21) See: https://www.itu.int/en/ITU-D/Statistics/Documents/events/egti2020/IDI2020_BackgroundDocument_20200903.pdf  

(22) See: https://www.who.int/health-topics/digital-health#tab=tab_1  

(23) European Commission (2020). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/sites/health/files/ehealth/docs/ms_rules_health-data_en.pdf (Annexes available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/ms_rules_health-data_annex_en.pdf ).

(24)  For example, for the adoption of MyHealth@EU over time more detailed information was collected by DG SANTE and other supporting studies, which was used to model specific adoption timelines for the baseline and each policy option.

(25) See: https://www.ela.europa.eu/sites/default/files/2021-01/Draft-SPD-2022-2024_0.pdf  

(26) See: https://www.bfarm.de/EN/Medical-devices/Tasks/Digital-Health-Applications/_node.html  

(27) See: https://digital-strategy.ec.europa.eu/en/library/impact-assessment-report-and-support-study-accompanying-proposal-regulation-data-governance  

(28)   Digital Health Trends 2021 - IQVIA

(29) European Commission (2018). Market study on telemedicine. Available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/2018_provision_marketstudy_telemedicine_en.pdf

(30) See: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Self-perceived_health_statistics&oldid=509628  

(31) See: https://ec.europa.eu/eurostat/web/products-eurostat-news/-/EDN-20200307-1  

(32)   Eurostat - Data Explorer (europa.eu)

(33)   https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71225  

(34)   https://www.who.int/observatories/global-observatory-on-health-research-and-development/indicators/gross-domestic-r-d-expenditure-on-health-as-a-percent-of-gross-domestic-product

(35)   https://digital-strategy.ec.europa.eu/en/library/impact-assessment-report-and-support-study-accompanying-proposal-regulation-data-governance  

(36)  Martin L et al. How much do clinical trials cost? Nat Rev Drug Discov. 2017 Jun;16(6):381-382. doi: 10.1038/nrd.2017.70. Epub 2017 May 19.

(37) See: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=R_%26_D_expenditure&oldid=503835  

(38)  Lupiáñez-Villanueva, F., Gunderson, L., Vitiello, S., Febrer, N., Folkvord, F., Chabanier, L., Filali, N., Hamonic, R., Achard, E., Couret, H., Arredondo, M. T., Cabrera, M. F., García, R., López, L., Merino, B., Fico, G. (2022). Study on Health Data, Digital Health and Artificial Intelligence in Healthcare, Publications Office of the European Union. https://op.europa.eu/en/publication-detail/-/publication/179e7382-b564-11ec-b6f4-01aa75ed71a1/language-en

(39) Interviews with targeted representatives of the industry and of patients, as well as co-coordinators of current and past Joint Actions supporting the eHealth Network and the European Health Data Space (TEHDaS).

(40)

Three focus groups/workshops were carried out in. The first workshop was organised with the eHealth Network and focused on the evaluation of the activities carried out. The second workshop was organised with a broad range of experts and focused on future needs. A third workshop was carried out on the secondary use of health data with the participation of members of the Joint Action TEHDaS.

(41) A survey was sent out to all eHealth Network members to gather information on the evaluation of the activities carried out by the eHealth Network covering both the cross-border provision of digital healthcare across the EU and access to health data for secondary use. A total of 19 Member States and Norway responded to this survey.

(42)   Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(43)      Regulation (EU) 2018/1725

(44) EUR-Lex - 32011L0024 - EN - EUR-Lex (europa.eu)  

(45)      Proposal for a Directive of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148, COM(2020) 823 final

(46)   Medicinal products for rare diseases (‘Orphan medicines’)  ( Regulation (EC) No 141/2000 , Medicinal products for children  ( Regulation (EC) No 1901/2006 , Advanced therapy medicinal products  ( Regulation (EC) No 1394/2007 .

(47) OJ L 172, 26.6.2019, p. 56–83.

(48) Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 851/2004 establishing a European Centre for disease prevention and control, Proposal for a Regulation of the European Parliament and of the Council on serious cross-border threats to health and repealing Decision No 1082/2013/EU, Proposal for a Regulation of the European Parliament and of the Council on a reinforced role for the European Medicines Agency in crisis preparedness and management for medicinal products and medical devices.

(49)   https://ec.europa.eu/health/sites/default/files/preparedness_response/docs/hera_2021_propcouncreg_medical-countermeasures_en.pdf

(50)   https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0761&rid=3  

(51)   https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020DC0761&rid=3  

(52)   https://ec.europa.eu/health/sites/default/files/non_communicable_diseases/docs/eu_cancer-plan_en.pdf  

(53)   EU Mission: Cancer | European Commission (europa.eu)

(54)   https://ec.europa.eu/health/sites/default/files/non_communicable_diseases/docs/eu_cancer-plan_en.pdf  

(55)

 Bensemmane, S. and Baeten, R. (2019), Cross-border telemedicine: practices and challenges. OSE Working Paper Series, Research Paper No.44 Brussels: European Social Observatory, October, 63p.

(56)   https://ec.europa.eu/regional_policy/en/projects/germany/telemedicine-pomerania-improves-healthcare-in-sparsely-populated-regions  

(57)   https://www.telemedecine-360.com/wp-content/uploads/2019/03/2018-ESO-Recommendations-on-telestroke-in-Europe.pdf  

(58) https://www.bfarm.de/EN/MedicalDevices/DiGA/_node.html

(59) https://mhealthbelgium.be/validation-pyramid

(60) European Commission (2020). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/sites/health/files/ehealth/docs/ms_rules_health-data_en.pdf (Annexes available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/ms_rules_health-data_annex_en.pdf ).

(61) European Commission (2020). Assessment of the EU Member States rules on health data in the light of GDPR. https://ec.europa.eu/health/sites/health/files/ehealth/docs/ms_rules_health-data_en.pdf (Annexes available at: https://ec.europa.eu/health/sites/default/files/ehealth/docs/ms_rules_health-data_annex_en.pdf ).

(62) The price related to the thesis is applied if the application concerns a research project that produces one thesis. If the application concerns a project that produces more than one thesis or a project that produces one or more theses and other outputs, a normal data request decision or data permit fee (EUR 1,000.00) will be charged.

(63) https://www.bundesgesundheitsministerium.de/patientendaten-schutz-gesetz.html