.svg){kind=icon}
Government bodies (HDABs) establish a national catalogue where Health Data Holders detail their datasets.
Health Data Users (HDU) find data via this catalogue
Blog
Holding health data in the EU? Here's how to prepare for the EHDS
A roadmap for health data holders navigating the European Health Data Space
Feb 04, 2026
The European Health Data Space (EHDS) is poised to reshape how health data is accessed and reused across the EU. For health data holders (HDHs), from hospitals and pharmaceutical companies to wellness app providers, the regulation introduces new responsibilities, new risks, and new opportunities. This blog outlines what HDHs need to know regarding data reuse and how to prepare for EHDS compliance. For more in-depth exploration of the EHDS, see our White Paper.
The EHDS is not only a regulatory development. It is part of a wider shift in European digital policy towards shared infrastructure, cross-border interoperability, and more routine secondary use of health data for public value. Organisations that invest now in systems and governance to deliver EHDS, rather than focusing only on what is strictly necessary for compliance, will be able to meet requests without compromising trust or day-to-day operations.
The EHDS and the new era of data reuse
The EHDS is the European Union’s flagship initiative to create a unified framework for the secure and ethical use of electronic health data. It is built on two pillars: EHDS1, which governs the primary use of data for direct patient care, and EHDS2, which enables secondary use such as research, innovation, and policymaking. EHDS2 is positioned to fundamentally change what health data will be available and how it can be used for research and innovation.
EHDS2 mandates that organisations controlling personal and non-personal electronic health data – Health Data Holders (HDH) - must share their data upon request from those conducting research, innovation or policymaking. These requests will be processed through a new infrastructure and adjudicated by government bodies (Health Data Access Bodies, or HDABs). Ultimately, the data will be accessed by Health Data Users (HDU) and HDABs in secure processing environments (SPEs) and used only for the permitted purposes.
Under EHDS2, HDHs will be expected to make sensitive data available for reuse. This increases the importance of auditable controls and privacy-preserving technical measures that can travel with the workflow. Overcoming this practical challenge will require processes for sharing data in a way that preserves trust, protects confidentiality, and demonstrates proportionality to regulators, patients, and partners.
Steps involved in the reuse of electronic health data under EHDS
HDU submit a data access application to the HDAB, which states the intended purpose, legal basis, methodology, and data protection measures.
The HDAB assesses the application within three months. If approved, the HDAB issues a legally binding data permit, which outlines some scope of use, conditions, and obligations of the HDU.
The HDAB notifies relevant HDHs who then have three months to provide the specific dataset to the HDAB.
Upon receiving the data, the HDAB has two months to prepare it for the HDU, including standardising, removing opt-outs, (pseudo) anonymization, combining data.
The HDABS will provide a SPE for the HDU to analyse the data according to the agreed permit.
HDABs publish permit summaries and the HDU must publish the results of its data use within 18 months.
Data reuse under the EHDS will come into effect in 2029 but compliance requires action well in advance (see Figure 2). With this shift, the question for HDHs is no longer whether the EHDS will affect them, but how ready they will be when it does. The remainder of this article breaks down the practical steps organisations should take now to make sure they can uphold their EHDS obligations, minimise disruption to their operations, and position themselves to benefit from the new data-sharing ecosystem.
EHDS implementation timeline
Who are health data holders and what is health data?
Under EHDS, a health data holder is any organisation that controls or holds electronic health data. This includes, but is not limited to:
- Hospitals and clinics
- Pharmaceutical and biotech companies
- Public health registries
- Research institutions
- Wellness app providers
- Insurance bodies
The scope of data defined as ‘health data’ is broad. EHDS Article 51 lists 17 categories, including:
- Electronic health records (EHRs)
- Administrative data (e.g. claims, reimbursements)
- Genomic and proteomic data
- Data from wellness apps and medical devices
- Clinical trial data and biobank datasets
- Public health registries and disease-specific databases
A practical, yet underestimated, point is that EHDS compliance is as much about metadata as data. For many holders, the immediate burden will not be extracting records, but describing datasets accurately, consistently, and defensibly. Metadata in this context includes provenance, coding standards, update frequency, data quality indicators, known limitations, and the conditions under which data can be reused. If catalogue descriptions are incomplete or misleading, downstream risks, including inappropriate requests, avoidable delays, and scrutiny over disclosure decisions, will multiply.
Case study: Hospital
A large teaching hospital in southern Europe manages high-volume, high-complexity data across its electronic health records, surgical registries, imaging archives, and administrative billing systems. Under the EHDS, it must catalogue these datasets and make sure the metadata accurately reflects the data inside.
As a Health Data Holder, the hospital is likely to face operational pressures in fulfilling its EHDS2 obligations. For example, EHDS2 will require the hospital to coordinate actions across clinical departments, IT, and legal teams, upgrade legacy systems, and minimise identifiable information before transfer. It must also establish processes to deliver data to HDABs within three months of any authorised request without disrupting its own patient care. Last but not least, a hospital has the possibility to submit a fee to the applicant/HDAB to cover its cost for preparing and sending its selected data.
Case study: Pharmaceutical company
A mid-sized pharmaceutical company holds extensive research assets: clinical trial datasets, biobank samples linked to genomic data, and commercial sales records. As Health Data Holder, it must determine which of these datasets contain protected intellectual property, trade secrets, or proprietary analytical methods, and what protections may be applied when they are shared. Therefore, its primary challenge is navigating the intersection of EHDS obligations and competitive risk. The company must also create clear internal governance rules, develop EHDS-compliant metadata for eligible datasets, and prepare secure pipelines to supply data to HDABs.
Responsibilities under EHDS: what HDHs must do
The EHDS regulation is not optional. By 2029, HDHs must:
- Register datasets in national catalogues, with annual updates.
- Provide data on request within three months.
- Flag sensitive data subject to these requests, including IP-protected datasets or those protected by trade secrets.
Some health data holders may seek designation as “Trusted Health Data Holders”. This should be treated as a strategic decision, not a badge. Trusted status may bring reputational benefits and smoother engagement with Health Data Access Bodies, health data applicants and HDUs, but it also increases expectations around governance maturity, responsiveness, and demonstrable safeguards. In practice, it raises the bar on how quickly an organisation can triage requests, evidence proportionality, and show that privacy protections are not merely documented but embedded in working processes.
For organisations considering Trusted status, a sensible priority is to build an auditable, repeatable decision framework for disclosure and risk controls, supported by technical measures that can be evidenced to regulators and stakeholders. Furthermore, as the Trusted HDH will take on some HDAB tasks, it requires resource availability and planning to process data requests and support permits adequately and in time.
The challenges ahead
For many HDHs, especially smaller hospitals or digital health startups, EHDS compliance will be difficult. The regulation introduces financial, operational, and ethical challenges:
Legacy systems
Many HDHs operate fragmented or limited IT systems, making data mapping and metadata maintenance a manual, error-prone task.
Uncertain demand vs resource allocation
HDHs must prepare to respond to data requests, but the frequency and scope of these requests remain unclear.
Cross-functional coordination
Supplying data often requires collaboration across business functions - legal, IT, clinical, and compliance - each with different priorities.
Ethical implications
Newly surfaced data insights may reveal risks or disparities that HDHs are ethically obliged to address.
Governance
The three-month response window is both an operational challenge and a privacy risk. Time pressure is a driver for organisations to default to manual workarounds, inconsistent minimisation decisions, or over-sharing simply to avoid non-compliance. A core readiness goal should therefore be to systematise the privacy and governance steps that sit between request approval and data delivery, so that meeting timeliness does not come at the expense of confidentiality, proportionality, or accountability.
Case study: Hospital
The hospital’s IT team struggles to keep metadata current as clinical systems, coding standards, and device integrations change on a near-continuous basis. Cross-department coordination is slow, with surgical, oncology, and administrative units each maintaining separate workflows. The compliance team remains uncertain about how to apply data-minimisation principles consistently, particularly when datasets span both clinical care and research functions. These gaps create a risk that the hospital may be unable to meet the three-month response window for data requests. Leadership is now exploring whether to appoint a dedicated EHDS programme manager to unify governance and technical workstreams.
Case study: Pharmaceutical company
The pharmaceutical company faces a different set of pressures: its research teams must distinguish which clinical trial variables are shareable and which contain proprietary methodologies or biomarkers. Commercial and RWE teams worry that releasing certain datasets even in SPEs could expose competitive insights or partner-specific strategies. Internally, the legal department is grappling with how to renegotiate legacy contracts so future data collection aligns with EHDS requirements. The company must also harmonise data formats across global studies, many of which were designed before EHDS standards existed. As a result, the organisation is considering a centralised data stewardship function to accelerate compliance while protecting intellectual property.
A roadmap to readiness: short- and long-term actions
Preparing for EHDS requires a phased approach, starting now.
A useful way to structure early preparation is to separate three questions that are often conflated:
- First, what data is in scope, and how can its metadata be described?
- Second, what requests are likely to be made repeatedly, and who owns them?
- Third, what technical controls will allow those decisions to be applied consistently, at pace, and with auditability?
Organisations that can answer these questions early typically reduce cost and risk later, particularly as demand patterns from users and access bodies become clearer.
Begin discussions: Gather the relevant people to understand the EHDS2 and its impacts. As appropriate, this could include cross-functional groups with legal, IT, and data governance expertise.
Forecast capacity and costs: Estimate the resources needed to respond to requests and maintain catalogues. HDHs can charge fees for these costs.
Consider the opportunities: Rationalizing data governance and future access to new health data.
Engage with HDABs: Understand national catalogue requirements and timelines.
Begin data mapping: Identify all data in scope and collect metadata.
Flag protected data: Identify data with IP, trade secrets, or regulatory protections.
Build internal processes: Establish workflows for metadata updates, data provision and opt-out compliance.
Final thoughts
The EHDS is more than a regulatory hurdle. For HDHs, the regulation introduces both responsibilities and possibilities. It is a strategic opportunity to modernise organisation’s data governance and offers access to a vast universe of health data.
How IQVIA can help
IQVIA offers a suite of solutions to support HDHs:
- Data mapping and metadata support: Identify and catalogue datasets, assess quality, and prepare metadata.
- Privacy-enhancing technologies (PET): Privacy-enhancing technologies and assurance frameworks can support PET-enabled architectures that embed privacy controls into the workflow, not only the documentation. This can include privacy-preserving record linkage and pseudonymisation services, federated analysis patterns, and auditable disclosure controls aligned to proportionate risk management. The objective is to help health data holders move from ad hoc, manual processing towards automated, scalable, defensible delivery under EHDS timelines and strengthen trust with regulators, patients, and partners.
- Regulatory guidance: Navigate EHDS requirements, from IP protection to data minimisation.
- Stakeholder engagement: Train staff, manage change, and build trust with regulators and users.
To learn more, contact ehds@iqvia.com