The European Health Data Space and Health Data Use in Germany

What is the European Health Data Space?

The European Health Data Space (EHDS) is an EU framework for using electronic health data, established by Regulation (EU) 2025/327. It has two main purposes. The first, called primary use, is to give individuals better access to and control over their own electronic health data and to allow that data to follow them across borders for their care. The second, called secondary use, is to make health data available for research, innovation, policy-making, regulatory activities and other purposes in the public interest, through a system of health data access bodies and data permits.

For businesses, the European Health Data Space matters in three roles. Manufacturers of electronic health record (EHR) systems face product requirements and a self-certification regime. Data holders – hospitals, but also many companies holding health data – may have to make data available for secondary use. And data users – pharmaceutical companies, medtech firms, AI developers and researchers – gain a structured route to access health data across the EU.

Germany is not starting from zero. The Health Data Use Act (Gesundheitsdatennutzungsgesetz, GDNG) of 2024 already created national structures that are expected to evolve into the EHDS system. This article explains the Regulation, its timeline and the German context.

EHDS timeline: when the rules apply

The Regulation was signed on 11 February 2025 and entered into force twenty days after publication in the Official Journal. Most obligations apply later and in stages. Article 105 sets out the timetable:

The staggered timetable gives the industry time, but the preparatory work is significant. Implementing acts on technical specifications, data quality labels and permit procedures will shape compliance, and Member States must designate health data access bodies and digital health authorities.

Primary use and requirements for EHR systems

Under the primary use chapter, individuals have the right to access their priority electronic health data immediately and free of charge in an interoperable format, to add information, to request rectification, to restrict access by health professionals and to have data transmitted to other providers. Healthcare providers must register relevant data in an EHR system.

Manufacturers of EHR systems must ensure that their products comply with harmonised components for interoperability and logging and with essential requirements on security. The Regulation introduces a self-certification scheme with an EU declaration of conformity and CE marking for EHR systems, and an EU database for registration of EHR systems and wellness applications that claim interoperability. Where an EHR system also qualifies as a medical device or a high-risk AI system, the respective regimes apply in parallel, which requires coordinated compliance planning.

For software companies serving hospitals and practices in Germany, the key question is how the EHDS requirements will interact with national interoperability rules and the specifications of gematik, the national agency for digital health applications and infrastructure.

Secondary use: data permits and prohibited purposes

The secondary use rules are the most significant change for industry. Health data holders must make specified categories of electronic health data available, through national health data access bodies, to health data users that have obtained a data permit. The categories are broad and include EHR data, claims data, genetic and other omics data, registry data, data from clinical trials and medical devices, and data from wellness applications. Natural persons and microenterprises are exempt from the obligations on data holders (Article 50).

Users may process the data only within the purposes stated in the permit or an approved data request. Article 54 EHDS lists prohibited uses, including taking decisions detrimental to individuals based on their health data, decisions on job offers or less favourable terms for goods and services, including insurance or credit, advertising and marketing to health professionals or patients, developing products or services harmful to individuals or society, and activities conflicting with ethical provisions of national law.

Data is generally provided in anonymised form, or in pseudonymised form where the purpose requires it, within a secure processing environment. Health data users must publish results within a set period and inform the access body of significant findings relevant to individuals' health.

Germany's Health Data Use Act (GDNG)

Germany adopted the GDNG in 2024 to improve the use of health data for research and the development of the health system. Its purpose is to regulate the use of health data for public-interest research and the data-based development of the health system as a learning system (§ 1 GDNG). Key elements include:

• Central data access and coordination body: established at the Federal Institute for Drugs and Medical Devices (BfArM), it maintains a public metadata catalogue, advises data users on identifying and locating health data and supports access applications (§ 3 GDNG);
• Further processing by healthcare institutions: data-processing healthcare institutions may further process data they lawfully hold for quality assurance and patient safety, medical, rehabilitative and nursing research, and statistical purposes, with mandatory pseudonymisation and anonymisation as soon as possible (§ 6 GDNG);
• Research Data Centre Health: claims data from statutory health insurance are made available through the Research Data Centre at the BfArM under §§ 303a ff. of the Social Code Book V, with the GDNG opening access to applicants on the basis of purpose rather than identity.

The GDNG is designed to fit with the European Health Data Space. The data access and coordination body is a natural candidate to become, or work with, Germany's health data access body under the Regulation. Companies that use the German routes now will build experience that transfers to the EU system.

Data protection and the GDPR

The European Health Data Space does not replace the GDPR. Health data is special category data under Article 9 GDPR, and processing requires both a legal basis under Article 6 and an exception under Article 9(2). The EHDS provides specific legal bases for making data available and for processing under a data permit, but controllers and processors remain subject to the GDPR's principles, security requirements and data subject rights.

Individuals have a right to opt out of secondary use under the Regulation, subject to limited exceptions that Member States may introduce for public-interest purposes. In Germany, the electronic patient record for all insured persons operates on an opt-out basis, and patients can object to the use of their data for research. How these national opt-outs will be aligned with the EHDS opt-out is one of the implementation questions to watch.

Companies should also consider that anonymisation is a high standard under the GDPR. Pseudonymised data remain personal data, and secure processing environments do not change that analysis; they reduce risk.

AI development and health data

Training and validating AI models is one of the purposes for which health data users can seek access under the Regulation, which lists the development and innovation of products or services contributing to public health, including the training, testing and evaluation of algorithms in medical devices and AI systems. For AI developers, this could become one of the most important sources of high-quality, representative training data in Europe.

The AI Act adds its own requirements. High-risk AI systems, which include many AI-based medical devices, must be trained on data sets that meet quality criteria for relevance, representativeness and freedom from errors, and providers must document data governance. Access to EHDS data under a permit can help meet those requirements, but the permit's conditions – secure processing environments, restrictions on downloading personal data and publication duties – must be compatible with the development workflow. Developers should plan how models trained inside a secure environment can be exported and how results are documented.

Under the Digital Omnibus on AI, the AI Act's obligations for high-risk AI embedded in regulated products such as medical devices now apply from 2 August 2028, which aligns reasonably well with the EHDS secondary use timetable.

Contracts for health data collaborations

Even with the EHDS framework in place, most health data projects will continue to rely on contracts: research collaborations between hospitals and industry, data licences, joint controller arrangements and data processing agreements. These contracts should specify the legal basis for each processing step, the roles of the parties, data security and access controls, publication rights, ownership of results and the handling of incidental findings.

Where data comes from several Member States, the parties also need to address differences in national law, because the GDPR leaves Member States room for specific rules on health and genetic data. A central contract with country-specific annexes is often the most workable structure. The European Health Data Space will reduce some of this fragmentation, but national opt-outs, ethics requirements and access body practices are likely to differ for some time.

Preparing for the European Health Data Space

1. Inventory: map health data sets held and used, and classify them against the EHDS categories.
2. Role analysis: determine whether you are an EHR manufacturer, a data holder, a data user or several of these.
3. Product planning: for EHR systems and wellness apps, plan for interoperability, logging and security requirements and their interaction with medical device and AI rules.
4. Protect IP: identify trade secrets and IP-protected content in data sets and prepare documentation.
5. Use national routes now: engage with the GDNG and the Research Data Centre to build processes and experience.
6. Monitor implementing acts: technical specifications will determine much of the compliance effort.

How TRW & Co helps

We advise pharmaceutical, medtech and digital health companies, hospitals and research organisations on health data. We analyse roles and obligations under the European Health Data Space Regulation and the GDNG, structure data access applications and research collaborations, draft data sharing and licence agreements, and assess GDPR compliance for secondary use, including anonymisation and pseudonymisation concepts. For EHR and app manufacturers, we coordinate EHDS, medical device and AI Act requirements. Our work connects with our life sciences and healthcare and GDPR and data protection practices and with our articles on data sharing contracts and high-risk AI systems. Please contact us. This article is general information and not legal advice.