A1: Legislation and national rules enable access to and sharing of electronic health data through EHRs 2 , requiring high standards for data security and privacy

Indicator A1 surveys legal aspects of EHRs with regard to access and sharing of EHR data. Important components of a legal framework are the opportunity to legally store health data electronically, requirements for data security and data confidentiality, a sufficient level of technical security, logging and audit trailing, up-to-date legislation, and the opportunity to have health data shared among all relevant healthcare providing parties. Almost 4 of 5 of countries passed national legislation on EHRs regulating data safety and technical security measures less than five years ago. Logging of health data processing is not mandatory in nine countries.

A1-1: In your country, does legislation exist that enables the electronic storage of patient data?

A1-2: Does this legislation clearly regulate safety and confidentiality of personal health data?

A1-3: Do legislation and national rules exist that are dedicated only to personal health data and that prescribe technical security measures for EHR systems?

A1-4: Does this legislation prescribe logging of any health data processing to enable audit trailing 3 ?

A1-5: Was the latest relevant legislation passed less than five years ago?

A1-6: Does your current legislation inhibit in any way health data exchange via EHRs?

A2: Legislation and national rules guarantee patients' right to access their own electronic health data

Indicator A2 focuses on legal aspects of EHRs with regard to patients’ access to personal health data. Important components of a legal framework are wide-ranging patient rights to be able to electronically access their personal EHR data and to be allowed to decide to whom to provide access to their health data. While 26 countries do provide their citizens with access to their EHR data by law in general, only 20 states record by law that citizen access must be possible independent of place and technology. Lastly, 43% or 12 countries indicate that their citizens are not entitled to decide which healthcare professional or other party can access their EHR. Often general practitioners act as 'data gatekeepers', allowing additional parties to access a patient's EHR, while in other countries the technical readiness of health data systems is not yet advanced enough to realise this option.

A2.7: Do legislation and national rules in general allow and facilitate individuals to access their health- related data when held in an EHR?

A2.8: Do legislation and national rules allow and facilitate individuals to access their health-related data when held in an EHR, independent of place and technology?

A2.9: Do legislation and national rules allow citizens to choose whom to provide access to?

A4: Cross-border sharing of EHR data is legally facilitated

Indicator A4 surveys whether EHR data sharing across national borders is legally facilitated. 18 study countries indicated that data sharing from EHRs across national borders is permitted by law.

A4-13: Do legislation and national rules facilitate the sharing of EHR data cross-border?

A6: eHealth/digital health policies build on and incorporate the results of relevant EU initiatives on facilitating EHR cross-country interoperability

Indicator A6 focuses on the extent to which national digital health policies and government digitization initiatives on EHR cross-country interoperability build on relevant projects undertaken at EU level. Current examples refer to the eHealth Network guidelines on the Patient Summary, ePrescription / eDispensation, and shared good practices for stakeholders developing or implementing EHR systems. In terms of alignment between national and EU-level eHealth efforts and resources, the indicator shows a mixed picture. From 28 study countries, 9 indicate to not refer to EU-level guidelines and documents on the Patient Summary and ePrescription / eDispensation in national policy documents and 19 do not refer to these resources in legislation documents.

A6-18: Has your country incorporated references to eHealth Network guidelines on the Patient Summary 4 or ePrescription 5 /eDispensation 6 into national policy documents?

A6-19: Has your country incorporated references to eHealth Network guidelines on the Patient Summary or ePrescription/ eDispensation into national legislation?

A6-20: Has your country issued practical implementation guidelines and guidelines for sharing good practice for all stakeholders?

A7: A technical and semantic interoperability 7 framework or strategy (or sub-strategy) is in place

Indicator A7 surveys whether a national technical interoperability strategy for EHRs and a semantic interoperability strategy are in place on the national level. The results show that only 7 countries lack a standalone technical interoperability strategy. 17 countries report that an interoperability strategy focusing on semantics is implemented through a national terminology centre.

A7-21: Does your country have a national strategy for technical interoperability, assuming it is not already part of an eHealth/digital health strategy, or that a sub-strategy exists?

A7-22: Has a clinical terminology 8 and semantic interoperability strategy been formulated and realised through a government terminology centre or equivalent national bodies?

B5: National competent authority with clinical/terminology and technical competence is institutionalised

Indicator B5 examines, in addition to B4, whether a competence authority exists that proposes technical and semantic standards, terminologies, publishes stakeholder guidelines and maintains archives of active and past standards (can be the same authority as in B4). 24 countries report that competent authorities aim to facilitate semantic and technical interoperability, but only slightly more than half of all countries also publish guidelines, maintain terminology archives, or perform mapping activities to international standards.

B5-40: Does a national competent authority propose technical standards with the aim to facilitate organisational interoperability and communication?

B5-41: Does a national competent authority propose clinical terminologies (like SNOMED CT, LOINC, WHO terminologies, etc.) with the aim to facilitate semantic interoperability and data exchange?

B5-42: Does the national competent authority in your country assist medical and clinical stakeholders with terminological guidelines 9  on how to use terminologies, build clinical information models, etc.?

B5-43: Does the terminology centre maintain an archive with all versions and also with legacy
terminologies, guaranteeing to trace back terminologies during the life-cycle of an EHR?

B5-44: Do adjustment measures and mapping activities to international standards exist to enable communication between digital health systems in other countries?

C1: Supervision of trusted electronic service 10 providers is in place

Indicator C1 surveys whether Member States have implemented a framework with technical and cybersecurity-related requirements for health professional identification and authentication in EHR systems. Czechia, Malta, and Portugal report having no such rules in place.

C1-54: Are there specific national rules for the identification and authentication of health professionals, as well as who exactly can create and access EHRs?

C4: Patient data in EHRs is linked to a unique patient identifier

Indicator C4 surveys the use of unique identifiers for patients, physicians and other healthcare professionals to which patient data is linked and unequivocal authentication is guaranteed. The only country without any unique identifiers, a key element for the successful implementation of an EHR infrastructure, is Czechia. While Bulgaria, Cyprus and Poland are lacking unique patient identifiers, Spain and Malta do not have such identifiers for healthcare staff.

C4-62: Does your country employ a citizen/patient electronic identifier 11 for health purposes?

C4-63: Does your country employ a national unique health services professional ID for physicians?

C4-64: Does your country employ a national unique health services professional ID for other healthcare professionals (nurses, specialists, etc.)?

C5: EHR systems are properly protected against cybersecurity risks

Indicator C5 examines the preparedness of EHR systems against cybersecurity risks. Questions include the use of security-by-design approaches, awareness management of cybersecurity risks among healthcare professionals and the application of penetration tests to ensure proper functioning of EHR systems and identification of security risks. More than two-third of countries employ consistent encryption and a security-by-design approach to prevent cyber-attacks. However, only one-third of countries report training healthcare personnel in the area of cybersecurity risks. Penetration test are a common practice among study countries. Poland, Czechia and Bulgaria do not perform well in this indicator.

C5-65: Are consistent encrypting algorithms used to protect patient ID’s in EHR systems?

C5-66: Are EHR systems developed to anticipate malicious cyber-attacks through a security-by-design approach?

C5-67: Are healthcare personnel working with national EHR systems sufficiently trained and aware of the risks of cyber-security?

C5-68: Does your country have tests in place to verify whether the EHR product or service performs as it is expected (like penetration tests)?

D3: National developments regarding semantic interoperability incorporate international standards
and terminologies

Indicator D3 examines which international standards and terminologies are used nationally. Examples include SNOMED CT, LOINC, ATC and ISO IDMP, HL7 and WHO classifications ICD-10 and ICD-11. While only around one-third of countries implemented SNOMED CT or LOINC, Czechia, Ireland, Malta, Poland and Slovenia have not implemented either of those terminologies mentioned, whereas Germany is in the process of implementation. The UK is the only country which does not use WHO classifications.

D3-77: Is SNOMED CT nationally implemented as “backbone” ontology/terminology?

D3-78: Is LOINC nationally implemented as central terminology?

D3-79: Are ATC, EDQM Standard Terms, or ISO IDMP referentials nationally implemented as central terminologies?

D3-80: Are resource driven information models (such as Health Level Seven Fast Healthcare Interoperability Resources (HL7 FHIR)) nationally implemented?

D3-81: Are WHO classifications (ICD-10, ICF, ATC) nationally implemented as central terminologies?

D3-82: Are there plans to nationally implement ICD-11 and ICHI?

Yes

No

Is SNOMED CT nationally implemented as “backbone” ontology/terminology?

36%

64%

Is LOINC nationally implemented as central terminology?

39%

61%

Are ATC, EDQM Standard Terms, or ISO IDMP referentials nationally implemented as central terminologies?

64%

36%

Are resource driven information models (such as Health Level Seven Fast Healthcare Interoperability Resources (HL7 FHIR)) nationally implemented?

43%

57%

Are there plans to nationally implement ICD-11 and ICHI?

57%

43%

E1: Exchange of Patient Summaries 12 via the eHealth Digital Service Infrastructure 13 is enabled

Indicator E1 surveys whether patient summaries exist on a national level, which modes of access patient have and whether the development of patient summary systems was informed by eHealth Network guidelines on the electronic exchange of health data for patient summaries. The indicator also inquires on the possibility to send and/or receive patient summaries across national borders. Patient summaries exist in two-thirds of all study countries and are most frequently accessed via an online portal, but only Czechia, Lithuania, Latvia, Poland, and Slovakia can send or receive patient summaries across borders.

E1-89: Do Patient Summaries exist on a national level and are respective IHE profiles 14 used?

E1-90: Which modes of access do patients have?

E1-91: Is the Patient Summary structured according to the provisions in the “GUIDELINE on the electronic exchange of health data under Cross-Border Directive 2011/24/EU Release 2 – Patient Summary for unscheduled care” adopted by the eHealth Network on 21 November 2016?

E1-92: Is it possible to receive and/or send a Patient Summary cross-borders transferred via the EHR system only within given regions in both countries?

E2: ePrescription 15 /eDispensation 16

Indicator E2 surveys whether ePrescription and eDispensation systems exist on a national level, which modes of access patient have and whether the development of such systems was informed by eHealth Network guidelines on the electronic exchange of health data for ePrescriptions/eDispensations. The indicator also inquires on the possibility to send and/or receive ePrescription/eDispensation reports across national borders. ePrescription services exist in two-thirds of all study countries and are most frequently accessed via an online portal. However, 11 countries still use paper printouts. Czechia, Poland, and Slovakia are the only Member States which are capable of sending or receiving ePrescriptions across borders.

E2-93: Do ePrescriptions/eDispensations and respective IHE profiles exist on a national level?

E2-94: Which modes of access to patients have?

E2-95: Are ePrescriptions/eDispensations structured according to the provisions in the “GUIDELINE on the electronic exchange of health data under Cross-Border Directive 2011/24/EU Release 2 – ePrescriptions /eDispensations” adopted by the eHealth Network on 21 November 2016?

E2-96: Is it possible to receive and/or send an ePrescription cross-borders transferred via the EHR system only within given regions in both countries?

E4: EHR system offers broad access to a variety of services and organisations

Indicator E4 examines to which healthcare organisations the national EHR system is connected and whether they routinely use EHRs. Organisations include, among others, general practitioners, specialists, hospitals, labs, pharmacies, care homes and insurance companies. The majority of GPs in 20 countries are connected to EHR systems and routinely use the offered services, followed by pharmacies in 19 countries. Labs, hospitals and specialist practices are connected to EHR systems in over 20 countries, but the routine use is recorded in only 15 countries.

E4-100: To which of the following organisations or persons is your national EHR system connected electronically? Are the connections to the organisations used routinely 17 ?

E5: Level of EHR exchange data use, interoperable solutions and services

Indicator E5 surveys the types of patient data that are recorded in national and in (if applicable) regional EHR systems and whether these data types are routinely used, i.e. filled-out in the context of routine care. Additional focus is given on the kind of digital services the national and (if applicable) regional EHR systems offers and whether these are used routinely.

E5-101: Does your national EHR system allow you to record and store the following types of patient data electronically? Are these types of data recorded and stored routinely using the national EHR system?

E5-103: Does your national EHR system allow you to transfer/share/access patient data electronically, permitting you to engage in any of the following? Are these functions used routinely?

E5-104: Does your regional EHR system allow you to transfer/share/enable/access patient data electronically, permitting you to engage in any of the following? Are these functions used routinely?

F1: Actual use of national EHR system by type of institution is high

Indicator F1 surveys the usage of EHR systems in different care sectors, such as primary, secondary, and tertiary care as well as pharmacies and home care. Bulgaria, Czechia, Germany (roll-out from 2021), and Ireland to not currently have a fully functioning EHR system and only few advanced countries have the home care sector connected to a national EHR system. Denmark, Estonia, and Finland have the overall highest level of EHR use in all categories.

F1-105: Please indicate the use of the national EHR system by the following types of institutions:

F2: Actual use of national EHR system by type of data is high

Indicator F2 focuses on the use of different documents within an EHR system such as patient summaries, ePrescriptions, lab results, imaging reports and discharge reports. Cyprus, Germany, Ireland, Luxembourg, Poland, and Romania show an overall low level of use over all data types, while Denmark, Estonia, Finland and Norway have the highest overall level of use. Imaging reports are predominantly exchanged non-electronically.

F2-106: What is the approximate percentage of Patient Summaries that are filled with patient health data (as of the total number of all Patient Summaries existing) and are being consulted by a health professional in another medical institution in your country in the last year (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F2-107: What is the approximate percentage of ePrescriptions (as of the total number of all prescriptions) dispensed in your country in the last year (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F2-108: What is the approximate percentage of electronic laboratory results (as of the total number of all lab results) sent from the lab to the national EHR system in the last year (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F2-109: What is the approximate percentage of Imaging reports (as of the total number of all Imaging reports) sent to the national EHR system in the last year (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F2-110: What is the approximate percentage of Hospital discharge reports (as of the total number of all discharge reports) sent to the national EHR system in the last year in the last year (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F2-111: What is the approximate percentage of Hospital discharge reports (as of the total number of all discharge reports) sent to another healthcare provider organisation in the last year in the last year (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F3: Type and characteristics of exchanged health data: Pharmacies

Indicator F3 surveys the proportion of pharmacies exchanging ePrescriptions/eDispensation service-related information and non-ePrescription data (e.g., vaccination data). The pharmacy sector in Europe is almost completely connected to national EHR systems in over 50% of study countries and exchanging service-related information. Countries like France, Germany (pilots on-going), Austria, Ireland, or Luxembourg do not have such an ePrescription system in place.

F3-112: What proportion of pharmacies is connected to a national health information exchange network (e. g. national EHR system), exchanging ePrescriptions/eDispensation service-related information?

F3-113: What proportion of pharmacies is connected to a national health information exchange network (e. g. national EHR system), exchanging other data than ePrescriptions/eDispensation service-related information (e.g., vaccination data)?

F4: Electronic data sharing among health professionals is high

Indicator F4 surveys the uptake of EHR data exchange among different subsets of healthcare professionals such as GP-to-GP, GP-to-Hospital and GP-to-Specialist. In general, the more advanced countries show a similarly high level of use among health professionals. Countries with a higher level of use in one category typically also show a higher level of use in the remaining two categories. Exceptions are Italy and France whose systems focus on the primary care sector.

F4-114: What proportion of General Practitioners exchange EHR patient data with each other?

F4-115: What proportion of General Practitioners exchange EHR patient data with hospitals?

F4-116: What proportion of General Practitioners exchange EHR patient data with specialists?

F5: Level of structured and coded content of patient data is high

Indicator F5 surveys the level of structured and coded data by querying the proportion of structured data entries in EHR systems, whether healthcare providers perform data usability evaluations and whether data quality audits are being conducted. The amount of clearly structured electronic health data in the EU is low in most countries. Only Slovenia, Latvia, Denmark and Bulgaria show higher level of structured content, but do, with the exception Latvia, not maintain any programmes to train healthcare staff or to audit data quality.

F5-117: What is the approximate proportion of data entries (as of the total number of all data entries) by healthcare professionals on a national level that are structured and coded data based on clinical terminology standards (2019 or last year for which data are available; otherwise use your best subjective estimate)?

F5-118: Does your country maintain programmes such as healthcare provider training to perform data usability evaluations with the aim to improve data quality?

F5-119: Does your country audit the clinical content of Electronic Health Records for quality?

G1: EHR standardisation for public health reporting of infectious diseases

Indicator G1 examines whether public health reporting for standardised diseases is standardised, focusing on national systems to collect epidemiological surveillance data directly from Labs and from clinical reports using HL7 standard messaging and whether a nationwide electronic surveillance software is mandatory. While most countries except for Czechia, Latvia, and Slovenia have created a system to collect epidemiological surveillance data, slightly more than half the countries receive this data in standardised fashion. Advanced countries like Denmark, Sweden and the UK have no standardised messaging service and mandatory electronic surveillance software.

G1-120: Do you have a national system to collect epidemiological surveillance data directly from Labs on diseases classified as under compulsory notification (e.g. tuberculosis, HIV, etc)?

G1-121: Do you have a national system to collect clinical reports of diseases classified as under compulsory notification (e.g. tuberculosis, HIV, etc)?

G1-122: Does your national system exchange/receive clinical reports/clinical data directly using HL7 or other standard messaging?

G1-123: Do you have legislation or national rules mandating nationwide electronic surveillance software usage?

G2: Usage of EHR data during the COVID-19 pandemic

Indicator G2 surveys how EHRs can be used to detect, prevent, respond to, and recover from epidemiological crises such as COVID 19 through generating information from ERH data for real-time surveillance. Automatically generating this information requires a high level of technical advancements, which Belgium, Denmark, Estonia, Spain, Finland, Hungary, Netherlands, Sweden, Slovenia and the UK are capable of.

G2-124: Can you generate information from the national EHR to detect, prevent, respond to, and recover from epidemiological crises such as COVID‑19?

G2-125: Can you extract routine data from your country’s national EHR system for real-time surveillance to detect, prevent, respond to, and recover from epidemiological crises such as COVID‑19?

Dimension/

measure

Comparison of options and impacts

Preferred option

Primary uses of health data

Scope of data domains (SO1, SO2)

All options broaden the scope of data domains with respect to the baseline to cover other digital health domains beyond the EEHRxF (e.g. genomics, mobile-specific data domains). However, only Options 2 and 3 cover cybersecurity, beyond interoperability. These two are fundamental dimensions for enabling reliable and secure data sharing in healthcare. This makes the scope of Options 2 and 3 the most effective to achieve the goals of the EHDS and most coherent with the expectations of stakeholders.

Option 2

Individuals’ and health professionals’ access and control over health data (SO1)

Option 1 provides only a marginal added-value over the baseline as the legal framework for ensuring citizens’ access and control remains unchanged. Options 2 and 3 provide new health-specific means for citizens’ to execute their rights for control over their health data. Therefore, Option 2 and 3 have the most positive effect on fundamental rights and freedoms.

Option 2

Quality and interoperability requirements

(SO2, SO3)

Option 1 expands the scope of EU cooperation on interoperability to other digital health domains, but remains subject to voluntary implementation and provides only a voluntary mechanism transparency with consumers and procurers. Option 2 establishes mandatory requirements and transparency obligations for manufacturers and service providers of EHR systems, digital health products and services through a mandatory self-declared quality label, while keeping the label voluntary for wellness applications. Option 3 establishes minimum mandatory requirements for these products as well as wellness applications to enter the market, implemented through a certification scheme. Option 2 does not effectively ensure that interoperability is achieved in ther markets of the respective products and therefore it is not expected to provide the optimal cost/benefit balance. Option 3 provides a more effective mechanism to regulate the market of EHR systems and digital health products. For mobile wellness applications, which are the majority of applications in mobile applications markets and mostly provided by SMEs, Options 3 is not proportional given their stringency on products that do not pursue a medical use. Therefore, Option 2+, which establishes a third-party certification scheme for EHR systems and digital health products and services while keeping the quality label voluntary for wellness applications, is considered the option that strikes the right balance between proportionality and cost-efficiency.

Option 2+

Cross-border health data sharing (SO1, SO2)

Option 1 does not provide any improvement over the baseline. Options 2 and 3 foresee a mandatory deployment of MyHealth@EU services to support the rights and freedoms of individuals regarding control, but Option 3 includes a more ambitious timeline and the possibility of extending to other data domains. The mandatory requirement for deployment in Options 2 and 3 is more effective in achieving the full rollout of MyHealth@EU and avoid accentuating a digital divide between citizens with and without access. This is also reflected in that Options 2 and 3 provide a better benefit/cost (2.1-4.4 and 2.2-4.4, respectively) than Option 1 (1.1-2.3). The possibility for extending services beyond the EEHRxF in Option 3 is expected to be more future-proof, as it would ensure flexibility to adapt the framework to future needs, and therefore more effective. However, the shorter timeline in Option 3 is understood not be coherent with the maturity of digital healthcare services across Member States.

Option 2

Governance and EU cooperation (SO1, SO2)

The expected potential of Option 1 in fulfilling the goals of the EHDS more effectively than the baseline is marginal, because it relies on a voluntary cooperation framework, as in the baseline, but only covering a broader scope of data domains and including a voluntary labelling framework. Option 2 is expected to be more effective and value-adding as it provides a mechanism for binding decision-making and enforcement in digital health. This would support a unified approach to tackle divergences in interoperability and quality requirements across Member States. Option 3 relies on the designation of national digital health authorities for the implementation/ enforcement of rights and requirements and an EU body tasked with the definition of requirements (European Digital Health Body). Given strong national competences in the area of health, the legal and political feasibility of such an approach are expected to be low. Moreover, there is currently no health-related EU agency that could suitably take such mandate. The creation of a new body for such mandate (Option 3+) would add significant costs (around EUR 300 million over 10 years) and would reduce the cost-effectiveness of the intervention.

Option 2

Secondary uses of health data

Reusers’ access to health data (including researchers, innovators, policy-makers and regulators) (SO3)

Option 1 would only provide marginal improvement over the baseline. It would not be sufficient to tackle divergences across Member State frameworks as it would expand EU cooperation to the areas of secondary uses of health data only with a specific mandate to issue guidelines. Option 2 would be more effective in tackling fragmentation issues as it would set a common legal basis for reuse of health data on grounds of public/general interest, statistics and scientific research and complementing the GDPR.

Option 2

Types of data in scope for reuse (SO3)

Option 1 would not be effective in addressing fragmentation, due to the voluntary nature of guidelines would not ensure uptake. Option 2 and 3 defines an explicit list of health data domains for reuse that should be in scope of the common legal basis (see above). Therefore, they would raise potential for pooling data at EU level and would effectively address the divergence in scope across Member States.

Option 2

Data altruism (SO3)

Option 1 would rely on the provisions set out in the DGA. Therefore, it would not address the specificities of the health sector (e.g. sensitivity of health data, specific data formats and standards). Option 2 and 3 would ensure that data altruism practices are supervised by health-specific entities, such as Health Data Access Bodies in cooperation bodies established under the DGA. Therefore, the latter options provide the most effective grounds to address data altruism in health.

Option 2

Digital infrastructure

for secondary uses (SO3)

Option 1 extends the current service for cross-border sharing of patients’ data (MyHealth@EU) to secondary uses of health data. However, the necessary changes in MyHealth@EU to accommodate the use cases and data exchange patterns for secondary use cases would require significant transformations in the existing infrastructure. Additionally, the Digital Health Bodies and Health Data Access Bodies play significant distinct functions at national level and combining them under one single infrastructure would limit the efficiency on how these fucntions are performed.

Option 2 builds on the mandatory participation in a new decentralised EU-wide infrastructure (i.e. peer-to-peer network) for secondary uses connecting Health Data Access Bodies. Option 3, proposes a different architecture (i.e. centralised network) where European Health Data Access Body (EHDAB) act as an orchestrator, intermediating the communications between participants.

While both Option 2 and 3 propose a feasible technical solution for the specific requiremens forsecondary use of health data, Option 2 presents a federated approach (i.e. peer-to-peer network topology) that is more coherent with the distribution of competences in health and the data protection principles whereby data should stay where it was collected and the queries travel to the data.

Option 2

Data quality (SO3)

Opion 1 builds on voluntary label for data quality, while Option 2 relies on mandatory label and Option 3 proposes mandatory requirements to be checked through certification. The voluntary nature of Option 1 will insufficiently address the need for transparency of data consumers and therefore it could undermine the trust on the data ecosystem. Option 3 could be too stringent due to the associated costs to pass a certification. This burden could lead to fewer data products to be made available for secondary use. Therefore, Option 2 is expected to be the most cost-efficient option.

Option 2

Support for AI development and verification (SO3)

Option 1 is a soft law measure relying on the promotion of codes of conduct in line with Article 69 of AIA. Options 2 and 3 would assign specific tasks to Health Data Access Bodies to support the development and verification of AI and work on data standardisation. The latter measures are considered necessary to effectively support AI in health.

Option 2

Governance and EU cooperation

Option 1 proposes that no specific sectoral governance mechanism established at national level other than what is indicated in the DGA. In Option 2, Member States are required to apoint a national body entrusted with decision-making powers on health data access for secondary use. Option 3, proposes an EU regulatory body tasked to act as a European Data Access Body (EHDAB) granting access to health data held in transnational databases and registries. While Option 1 risks to not address the specificities of health data sensitiveness, Option 3 would require an existing or a new EU body to be tasked with such function. However, existing EU health-related bodies (ECDC and EMA) have specific mandates in subdomains in health that do not match the transversal nature of the EHDAB function, and creating a new body would require a large investment (over EUR 300 million over 10 years) making this option cost-inefficient. Option 2 is aligned with the trend of creating national Health Data Access Bodies, and is proportional with respect to the responsibilities and functions performed by national authorities and cost-efficient, as it provides flexibility for Member States to choose the most appropriate organisational arrangement.

Option 2