The European Health Data Space, explained: what secondary use will look like

The European Union has spent seven decades building single markets — coal, goods, capital, people. In March 2025 it started building one for health data. Regulation (EU) 2025/327, better known as the European Health Data Space, entered into force on March 26, 2025: the first law anywhere to treat a continent's health records as shared infrastructure, with named gatekeepers, enumerated purposes, and an opt-out written into the text.

It is also widely misread, because it does two very different things under one name.

One regulation, two jobs

The EHDS has two halves, and most confusion about it comes from blending them. The first half is primary use: your health data, used for your own care. Patients get the right to access their electronic health records immediately, free of charge, and to have them follow across borders — a prescription issued in Lisbon dispensed in Helsinki, a patient summary readable by an emergency physician in Prague. EHR systems sold in the EU will have to speak a common exchange format, and a shared infrastructure called MyHealth@EU carries the records between countries.

The second half — the one researchers, public-health agencies, and companies are watching — is secondary use: reusing data that was collected during care to answer questions about populations. New diseases, drug safety, system performance, algorithm training. That is where the genuinely new machinery lives, and it is the subject of the rest of this post.

What secondary use actually means

Secondary use is reuse: data generated while treating you, repurposed to study people like you. The regulation names the categories of electronic health data that holders must make available — electronic health records, disease registries, claims and reimbursement data, genomic data, data from clinical trials, and more — and it names the purposes that qualify: scientific research, public-health surveillance, policymaking, education, and the development of products and services that contribute to health.

Just as deliberately, it names the purposes that never qualify. Health data obtained through the EHDS cannot be used to advertise to patients or clinicians, to raise a person's insurance premiums, to make decisions that work against the individual the data describes, or to build products that damage health. The European Data Protection Board and the European Data Protection Supervisor pushed hard on these boundaries in their joint opinion on the original proposal, and the prohibited-purpose list is part of what came out of that pressure.

This double list — what reuse is for, what it may never be for — is the regulation's spine. Everything else is plumbing to enforce it.

Health data access bodies: the new gatekeepers

Every member state must designate at least one health data access body. These are the institutions that make the EHDS run: a researcher, company, or public agency applies to one with a defined purpose and a justification for the minimum data needed. What a successful application earns is a data permit — scope-limited, time-limited, logged.

Then comes the part that should reshape expectations. Data holders are obliged to supply the data, but the access body delivers it pseudonymized by default — anonymized whenever the question can be answered that way — inside a secure processing environment. The researcher comes to the data. The data does not go to the researcher. Only non-identifying results are allowed out of the room.

For multi-country studies, access bodies connect through a shared infrastructure called HealthData@EU, so a study spanning five member states does not mean five legal regimes fighting each other. If this sounds like federated analytics — the query travels, the records stay — that is because it is the same architectural instinct, written into statute. It is also the EU's structural answer to the question of why health data can't simply cross borders: under the EHDS, most of the time it won't need to.

The opt-out — and why it isn't consent

Secondary use under the EHDS does not run on consent. It runs on law: the regulation itself, resting on the research provisions of the GDPR's Article 9, makes reuse lawful once a permit is granted. What citizens get instead is a right to opt out — member states must provide a way to refuse secondary use, with narrow exceptions for certain public-interest work carried out by public bodies.

The distinction deserves plain words. An opt-out means participation is the default and silence counts as yes. Consent means participation is chosen, person by person, study by study — the path we walk through in what GDPR Article 9 really permits. The EHDS bets that good governance — permits, secure environments, prohibited purposes, penalties — earns enough public trust to justify the default. Whether that bet pays off will depend less on the legal text than on how the first scandal is handled.

Nothing in the regulation, though, stops a platform from running stricter than the baseline — from asking each person, each time. We come back to that.

The dates that matter

The EHDS is in force, but almost none of it applies yet. The staging is intricate and member states will move at different speeds, but the spine looks like this:

Most of the build-out — designating access bodies, connecting HealthData@EU, settling technical formats through the European Commission's implementing acts — happens between now and 2029. For researchers, March 2029 is the real starting gun.

What 'EHDS-ready' has to mean

For a research platform, EHDS-ready cannot mean a compliance binder. The regulation's demands are architectural: data analyzed in controlled environments rather than exported, outputs that identify no one, permits that limit scope and expire, opt-outs that actually halt processing, and logs that can prove all of it after the fact.

Mithras Health was built to that shape because it was designed against the strictest reading of several regimes at once — HIPAA, GDPR, UK GDPR, the EHDS, and Washington's My Health My Data Act. Federated queries run in-region and return aggregates only, which is the same contract a secure processing environment enforces. And where the EHDS baseline is an opt-out, Mithras runs stricter: every study gets its own revocable, scope-limited consent from the patient it concerns, and every grant, query, and refusal lands on an append-only, cryptographically anchored audit trail.

That margin is deliberate. Regulations set floors, and floors move; a platform built exactly to today's floor is one amendment away from rebuilding.

The EHDS will make the reuse of European health data lawful at a scale no one has attempted. Lawful is the floor. The systems that last under it will be the ones that treat the opt-out not as friction but as a design brief — where a patient's no is enforced by the same machinery that runs the researcher's query.