Changes from adopted text to adopted text

RemovedArticle 2 – paragraph 2 – point k: (k) ‘health data recipient’ means a recipient as defined in Article 4, point (9), of Regulation (EU) 2016/679, in the context of the primary use of electronic health data;

RemovedArticle 2 – paragraph 2 – point l: (l) ‘telemedicine’ means the provision of healthcare services, including remote care through the use of information and communication technologies, in situations where the health professional and the patient (or several health professionals) are not in the same location;

RemovedArticle 2 – paragraph 2 – point m: (m) ‘EHR’ (electronic health record) means a collection of electronic health data related to a natural person and collected in the health system, processed for the purpose of the provision of healthcare services;

RemovedArticle 2 – paragraph 2 – point n: (n) ‘EHR system’ (electronic health record system) means any product (hardware or software) primarily intended by the manufacturer to be used for storing, intermediating, importing, exporting, converting, editing or viewing electronic health records between health professionals or that can be reasonably expected by the manufacturer to be used for those purposes;

RemovedArticle 2 – paragraph 2 – point o: deleted

RemovedArticle 2 – paragraph 2 – point q – introductory part: (q) ‘serious incident’ means any malfunction or deterioration in the characteristics or performance of an EHR system made available on the market that directly or indirectly leads, has led or is likely to lead to any of the following:

RemovedArticle 2 – paragraph 2 – point q – point i: (i) the death of a natural person or serious damage to a natural person’s health or rights;

RemovedArticle 2 – paragraph 2 – point y: (y) ‘health data holder’ means any natural or legal person, which is an entity or a body in the health, social security or care sector or in the reimbursement services sector, or performs research in relation to these sectors, as well as Union institutions, bodies, offices and agencies, and which, in accordance with this Regulation, applicable Union law or national legislation implementing Union law: / (i) is a controller as set out in Regulation (EU) 2016/679 and has the right or obligation, in accordance with this Regulation, applicable Union law or national legislation implementing Union law, to process personal electronic health data; or / (ii) has the ability to make available, including to register, provide, restrict access or exchange non-personal electronic health data, through control of the technical design of a product and related services;

RemovedArticle 2 – paragraph 2 – point z: (z) ‘health data user’ means a natural or legal person, as well as a Union institution, body, office or agency, which has been granted lawful access, in accordance with this Regulation, to electronic health data for secondary use pursuant to a data permit or a health data request;

RemovedArticle 2 – paragraph 2 – point z a (new): (za) ‘health data applicant’ means any natural or legal person with a demonstrable professional link to the areas of health care, public health or medical research and that submits an application for health data;

RemovedArticle 2 – paragraph 2 – point aa: (aa) ‘health data permit’ means an administrative decision issued to a data user by a health data access body or data holder to process the electronic health data specified in the data permit for the secondary use purposes specified in the data permit based on conditions laid down in this Regulation;

RemovedArticle 2 – paragraph 2 – point a ea (new): (aea) ‘wellness application’ means any appliance or software intended by the manufacturer to be used by a natural person for processing electronic health data specifically for providing information on, managing, maintaining or improving the health of individual persons, or the delivery of care.

RemovedArticle 3 – paragraph 2: 2. Natural persons shall have the right to receive an electronic copy, in the European electronic health record exchange format referred to in Article 6, of at least their electronic health data, or at the request of the natural person, a printed copy thereof, in accordance with Article 15(3) of Regulation (EU) 2016/679.

RemovedArticle 3 – paragraph 2 a (new): 2a. The rights referred to in paragraphs 1 and 2 shall be deemed complementary to and be without prejudice to the rights and obligations established by Article 15 of Regulation (EU) 2016/679.

RemovedArticle 3 – paragraph 3: 3. In accordance with Article 23(1) , point (i), of Regulation (EU) 2016/679, Member States may restrict the scope of rights referred to in this Article whenever necessary for the protection of the natural person based on patient safety and ethics by delaying their access to their personal electronic health data for a limited period of time until a health professional can properly communicate and explain to the natural person information that can have a significant impact on him or her.

RemovedArticle 3 – paragraph 4: deleted

RemovedArticle 3 – paragraph 5 – subparagraph 1 – point a: (a) establish one or more electronic health data access services at national, regional or local level enabling the exercise of rights referred to in this Article;

RemovedArticle 3 – paragraph 5 – subparagraph 1 – point b: (b) establish one or more proxy services enabling a natural person to legally authorise other natural persons of their choice to access their electronic health data on their behalf for a specified or indeterminate period and if needed, for a specific purpose only, or enabling legal representatives of patients to access electronic health data of the natural persons whose affairs they administer, in accordance with national law.

RemovedArticle 3 – paragraph 5 – subparagraph 2: The proxy services shall provide authorisations in a transparent and easily understandable way, free of charge, electronically or on paper. Natural persons and those acting on their behalf shall be informed about their authorisation rights, how to exercise them, and what they can expect from the authorisation process. / The electronic health data access services as well as the proxy services shall be easily accessible for persons with disabilities, vulnerable groups or persons with low digital literacy. / The proxy services shall enable legal representatives of patients to be authorised, either automatically or upon request, to access electronic health data of the natural persons whose affairs they administer either for a specific purpose and time period or without limitation for the purpose of such administration. Member States may provide that authorisations do not apply whenever necessary for reasons related to the protection of the natural person, and in particular based on patient safety and ethics. The proxy services shall be interoperable among Member States. / The proxy services shall provide an easy complaint mechanism with a contact point designated to inform individuals of a way to seek redress or remedy if they believe that their authorisation rights have been violated.

RemovedArticle 3 – paragraph 5 a (new): 5a. In addition to the electronic services referred to in this Article, Member States shall also establish easily accessible support services for natural persons with adequately trained staff dedicated to assisting them with exercising their rights referred to in this Article.

RemovedArticle 3 – paragraph 6: 6. Natural persons may insert their electronic health data in their own EHR or in that of natural persons whose health information they can access, through electronic health data access services and applications linked to these services. That information shall be marked as inserted by the natural person or by their legal representative and as non-validated. That information shall only be considered as a clinical fact if validated by a health professional. Without prejudice to the right to insert data, health professionals shall not be obliged to validate any inserted data in the EHR.

RemovedArticle 3 – paragraph 6 a (new): 6a. Natural persons shall have the right to download their electronic health data from their own EHR or the data of natural persons whose health information they can access through electronic health data access services and applications linked to these services.

RemovedArticle 3 – paragraph 7: 7. Member States shall ensure that electronic health data services referred to in paragraph 5, point (a), of this Article allow for the possibility for natural persons to easily request rectification of their personal data online as a way to exercise their right to rectification under Article 16 of Regulation (EU) 2016/679. Natural persons shall not have the possibility of directly changing data inserted by health professionals. Such rectifications of clinical facts shall be validated, without undue delay, by a registered healthcare professional with a relevant specialisation who is responsible for the natural person’s treatment. The original data holder shall be responsible for the rectification.

RemovedArticle 3 – paragraph 8 – subparagraph 1: Natural persons shall have the right to request a health data holder from the health or social security sector or reimbursement services, to transmit all or part of their electronic health data to a health data recipient of their choice from the health or social security sector or reimbursement services, immediately, free of charge and without hindrance from the data holder or from the manufacturers of the systems used by that holder. The health data recipient shall be clearly identified by the natural persons to the health data holder and their affiliation to the health or social security sector shall be demonstrated. Health data holders and their processors shall comply with the request and shall transmit the data in the format provided for in Article 5.

RemovedArticle 3 – paragraph 8 – subparagraph 2: Natural persons shall have the right that, where the health data holder and the health data recipient are located in different Member States and such electronic health data belongs to the categories referred to in Article 5, the health data holder shall transmit the data in the European electronic health record exchange format referred to in Article 6 and the health data recipient shall read and accept it.

RemovedArticle 3 – paragraph 8 – subparagraph 3: By way of derogation from Article 9 of Regulation […] [Data Act COM/2022/68 final], the health data recipient shall not be required to compensate the health data holder for making electronic health data available. A health data holder, a health data recipient or a third party shall not directly or indirectly charge data subjects a fee, compensation or costs for sharing data or accessing it.

RemovedArticle 3 – paragraph 9: 9. Without prejudice to Article 6(1), point (d), of Regulation (EU) 2016/679, natural persons shall have the right to restrict access of specific health professionals or categories of health professionals to all or part of their electronic health data. When restricting the information, natural persons shall be made aware that restricting access may impact the provision of healthcare provided to them. Such restrictions shall apply also for cross-border transfers of electronic health data. The fact that a restriction has been made by the natural person shall not be visible to healthcare providers. / Member States shall establish the rules and specific safeguards regarding such restriction mechanisms. Those rules shall include the possibility of modifying restrictions and of restricting access to anyone except the health professional who inserted the electronic health data. Those rules shall also establish the conditions of medical liability as a consequence of applying restrictions to electronic health data. The Commission shall establish guidelines regarding the implementation of this paragraph.

RemovedArticle 3 – paragraph 10: 10. Natural persons shall have the right to obtain information, including through automatic notifications, on the healthcare providers and health professionals that have accessed their electronic health data, including access provided in accordance with Article 4(4), and on the substance of the accessed data. Natural persons shall have the possibility of disabling those notifications. In order to demonstrate compliance with this right, all relevant entities shall maintain a system of automated recording for at least three years showing who and when has accessed electronic health data. The information shall be provided immediately and free of charge through electronic health data access services. Member States may provide for restrictions to this right in exceptional circumstances, where there are factual indications that disclosure would endanger the vital interests or rights of the health professional or the care of the natural person.

RemovedArticle 3 – paragraph 11: 11. The supervisory authority or authorities responsible for monitoring the application of Regulation (EU) 2016/679 shall also be responsible for monitoring the application of this Article, in accordance with the relevant provisions in Chapters VI, VII and VIII of Regulation (EU) 2016/679.

RemovedArticle 3 – paragraph 12: 12. The Commission shall, by means of implementing acts, determine the requirements concerning the technical implementation of the rights set out in this Article, including technical and organisational measures to ensure the process of authentication of the authorised person referred to in paragraph 5, point (b), of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2a).

RemovedArticle 3 – paragraph 12 a (new): 12a. Member States, including regional and local authorities, shall provide easily understandable information to natural persons in relation to the use of the electronic health records and primary use of their personal electronic health data laid down in this Article. Such guidance shall take into account different user groups, including persons with disabilities and vulnerable groups, without compromising the quality and the scope of the information.

RemovedArticle 4 – paragraph -1 (new): -1. Access to EHR for primary use shall be strictly limited to healthcare providers.

RemovedArticle 4 – paragraph 1 – point a: (a) have access, based on the data minimisation and purpose limitation principles, to the electronic health data of natural persons under their treatment and exclusively for the purpose of that treatment, including relevant administration, irrespective of the Member State of affiliation and the Member State of treatment, in accordance with Article 9(2), point (h), of Regulation 2016/679;

RemovedArticle 4 – paragraph 2: 2. In line with the data minimisation and purpose limitation principles provided for in Regulation (EU) 2016/679, Member States shall establish rules providing for the categories of personal electronic health data required by different categories of health professions or different healthcare tasks. Such rules shall not be based on the source of electronic health data.

RemovedArticle 4 – paragraph 2 a (new): 2a. In the case of treatment in a Member State other than the Member State of affiliation, the rules referred to in paragraphs 1a and 2 of the Member States of treatment shall apply.

RemovedArticle 4 – paragraph 2 b (new): 2b. The Commission shall issue guidelines for the implementation of paragraphs 1, 2 and 2a, including time limitations for the access by health professionals to electronic health data of natural persons.

RemovedArticle 4 – paragraph 3: 3. Member States and, where appropriate, local or regional authorities shall ensure that access to at least the priority categories of electronic health data referred to in Article 5 is made available to health professionals, including for cross-border care, through health professional access services, where the processing of health data is necessary and for the purposes of Article 9(2), point (h), of Regulation 2016/679. Health professionals who are in possession of recognised electronic identification means shall have the right to use those health professional access services, free of charge. / The electronic health data in the electronic health records shall be structured in a user-friendly manner to allow for easy use by health professionals.

RemovedArticle 4 – paragraph 3 a (new): 3a. Member States shall establish policies aimed at providing health professionals with the digital skills, competences, infrastructures and tools required to fulfil the obligations set out in paragraph 1.

RemovedArticle 4 – paragraph 4: 4. Where access to electronic health data has been restricted by the natural person, the healthcare provider or health professionals shall not be informed of the restricted content of the electronic health data without prior explicit consent pursuant to Article 9(2), point (a), of Regulation (EU) 2016/679 by the natural person. In cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person, the healthcare provider or health professional may get access to the restricted electronic health data. Following such access, the healthcare provider or health professional shall inform the data holder and the natural person concerned or his/her guardians that access to electronic health data had been granted. Member States’ law may add additional safeguards.

RemovedArticle 5 – paragraph 1 – subparagraph 1 – introductory part: 1. Where data is processed in electronic format, Member States shall implement access to and exchange of personal electronic health data for primary use fully or partially falling under the following categories making use of the International Classification of Diseases (ICD) codes, where applicable:

RemovedArticle 5 – paragraph 1 – subparagraph 1 – point e: (e) laboratory results, medical test results and other complementary and diagnostic results;

RemovedArticle 5 – paragraph 1 – subparagraph 1 – point f: (f) patient discharge reports;

RemovedArticle 5 – paragraph 1 – subparagraph 1 – point f a (new): (fa) medical directives of the natural persons and information about consent for substances of human origin and organ donations.

RemovedArticle 5 – paragraph 1 – subparagraph 2: The main characteristics of the categories of electronic health data in the first subparagraph shall be as set out in Annex I and limited to those categories.

RemovedArticle 5 – paragraph 1 – subparagraph 3: Member States may provide for access to and exchange of electronic health data for primary use for other categories of personal electronic health data available in the EHR of natural persons.

RemovedArticle 5 – paragraph 2: 2. The Commission is empowered to adopt delegated acts in accordance with Article 67 to amend Annex I by adding, modifying or removing the main characteristics of the priority categories of electronic health data, as laid down in paragraph 1. / (deleted) / (deleted) / (deleted)

RemovedArticle 6 – paragraph 1 – introductory part: 1. The Commission shall, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data referred to in Article 5, setting out the European electronic health record exchange format, taking into account its Recommendation (EU) 2019/243. The format shall include the following elements:

RemovedArticle 6 – paragraph 1 – point a: (a) harmonised datasets containing electronic health data and defining structures, such as minimum data fields and data groups for the content representation of clinical content and other parts of the electronic health data, which can be enlarged to include disease-specific data;

RemovedArticle 6 – paragraph 1 – point c: (c) technical interoperability specifications for the exchange of electronic health data, including its content representation, standards and profiles, and for the translation of electronic health data.

RemovedArticle 6 – paragraph 1 – subparagraph 1 (new): The Commission shall ensure that those implementing acts contain the latest versions of healthcare coding systems and nomenclatures and that they are updated regularly in order to keep up with the revisions of the healthcare coding systems and nomenclatures.

RemovedArticle 6 – paragraph 2: 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2a).

RemovedArticle 6 – paragraph 3: 3. Member States shall ensure that the priority categories of personal electronic health data referred to in Article 5 are issued in the format referred to in paragraph 1 across the continuum of care and such data shall be read and accepted by the data recipient.

RemovedArticle 7 – paragraph 1: 1. Member States shall ensure that, where health data is processed, health professionals register the relevant health data falling under at least the priority categories referred to in Article 5 concerning the health services provided by them to natural persons, in the electronic format in an EHR system.

RemovedArticle 7 – paragraph 1 a (new): 1a. Member States may provide for natural persons to have the right to object to the registration of their personal health data in an EHR system. / If a Member State provides for such a right, it shall establish the rules and specific safeguards regarding such objection mechanisms.

RemovedArticle 7 – paragraph 3 – subparagraph 1: 3. The Commission shall adopt delegated acts in accordance with Article 67 to supplement this Regulation by determining the data quality requirements for the electronic registration of health data by healthcare providers and natural persons, as relevant. / (deleted) / (deleted) / (deleted)

RemovedArticle 7 – paragraph 3 – subparagraph 2: When health data are registered or updated, electronic health records shall identify the health professional, time and health care provider that carried out the registration or the update. Member States may provide for other aspects of data registration to be recorded.

RemovedArticle 7 – paragraph 3 a (new): 3a. Where the personal health data have not been registered electronically prior to the application of this Regulation, Member States may require that such data be made available in electronic format pursuant to this Article. This shall not affect the obligation to make personal electronic health data, registered after the application of this Regulation, available in electronic format, pursuant to this Article.

RemovedArticle 8 – paragraph 1: Where a Member State accepts the provision of telemedicine services, it shall, under the same conditions and in a non-discriminatory manner, accept the provision of the services of the same type by healthcare providers located in other Member States, without prejudice to the same rights and obligations to access and register electronic health data.

RemovedArticle 9 – paragraph 1: 1. Where a natural person or a health professional uses, telemedicine services or personal health data access services referred to in Article 3(5), point (a), Article 4(3) and where applicable, Article 8 that natural person or health professional shall have the right to identify electronically using any electronic identification means which is recognised pursuant to Article 6 of Regulation (EU) No 910/2014, including eID schemes where such systems are offered.

RemovedArticle 9 – paragraph 2: 2. The Commission shall adopt delegated acts in accordance with Article 67 to supplement this Regulation by determining the requirements for the interoperable, cross-border identification and authentication mechanism for natural persons and health professionals, in accordance with Regulation (EU) No 910/2014. The mechanism shall facilitate the transferability of electronic health data in a cross-border context.