Changes from adopted text to adopted text

RemovedArticle 9 – paragraph 3: 3. The Commission, in cooperation with Member States, shall implement services required by the interoperable, cross-border identification and authentication mechanism referred to in paragraph 2 of this Article at Union level, as part of the cross-border digital health infrastructure referred to in Article 12(3).

RemovedArticle 9 – paragraph 4: 4. Member States’ competent authorities and the Commission shall implement the cross-border identification and authentication mechanism at Union and Member States’ level, respectively, in accordance with Regulation (EU) No 910/2014.

RemovedArticle 10 – paragraph 2 – introductory part: 2. Each digital health authority shall be entrusted with the following tasks and powers:

RemovedArticle 10 – paragraph 2 – point b: (b) ensure that complete and up to date information about the implementation of rights and obligations provided for in in Chapters II and III is made readily available to natural persons, health professionals and healthcare providers and that appropriate training initiatives are undertaken at the local, regional and national level;

RemovedArticle 10 – paragraph 2 – point h: (h) contribute, at Union level, and, where relevant, in cooperation at local and regional level within the Member States, to the development of the European electronic health record exchange format and to the elaboration of common specifications addressing quality, interoperability, security, safety, ease of use, accessibility, non-discrimination or fundamental right concerns in accordance with Article 23 and of the specifications of the EU database for EHR systems and wellness applications referred to in Article 32;

RemovedArticle 10 – paragraph 2 – point k: (k) offer, in compliance with national legislation, telemedicine services and ensure that such services are easy to use, accessible and equitable to different groups of natural persons and health professionals, including natural persons with disabilities, under the same non-discriminatory conditions and offer the possibility of choosing between in person and digital services;

RemovedArticle 10 – paragraph 2 – point m: (m) cooperate with other relevant entities and bodies at local, regional, national or Union level, to ensure interoperability, data portability and security of electronic health data;

RemovedArticle 10 – paragraph 3: deleted

RemovedArticle 10 – paragraph 3 a (new): 3a. The digital health authorities and the data protection authorities shall consult each other and cooperate in the enforcement of this Regulation, within the remit of their respective competences.

RemovedArticle 10 – paragraph 5: 5. Members of the digital health authority shall avoid any conflicts of interest. Members shall not have financial or other interests in industries or economic activities which could affect their impartiality. They shall undertake to act in the public interest and in an independent manner, and shall make an annual declaration of their financial interests. All indirect interests which could relate to such industries or economic activities shall be entered in a register available to the public, upon request. The Commission may adopt guidance on what is likely to constitute a conflict of interest together with the procedure to be followed in such cases.

RemovedArticle 10 – paragraph 5 a (new): 5a. In the performance of their tasks, the digital health authorities shall actively cooperate and consult with relevant stakeholders’ representatives, including patients’ representatives, health care providers and health professionals’ representatives, including health professional associations, consumer organisations and industry associations. Stakeholders shall declare any conflict of interest.

RemovedArticle 11 – paragraph 1: 1. Without prejudice to any other administrative or judicial remedy, natural and legal persons shall have the right to lodge a complaint, individually or, where relevant, collectively, with the digital health authority, where their rights laid down in this Regulation are affected. Where the complaint concerns the rights of natural persons pursuant to Article 3 of this Regulation or Regulation (EU) 2016/679, the digital health authority shall send a copy of the complaint to and consult with the competent supervisory authority under Regulation (EU) 2016/679 in order to facilitate its assessment and investigation. The decision of the digital health authority shall not prejudice any measures taken by the data protection authorities, which shall be competent to treat the complaint in separate proceedings, pursuant to their tasks and powers under Regulation (EU) 2016/679.

RemovedArticle 11 – paragraph 2: 2. The digital health authority with which the complaint has been lodged shall inform the complainant of the progress of the proceedings and of the decision taken, including, where applicable, that the complaint was referred to the relevant supervisory authority under Regulation (EU) 2016/679, and that the supervisory authority will, from that moment on, be the sole point of contact for the complainant in that matter.

RemovedArticle 11 – paragraph 3 a (new): 3a. Each digital health authority shall facilitate submitting complaints, in particular by providing a complaint submission form which can also be completed electronically, without excluding the possibility of using other means of communication.

RemovedArticle 11 a (new): Article 11a / Right to an effective judicial remedy against a digital health authority / 1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a digital health authority concerning them. / 2. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy where the digital health authority which is competent pursuant to Article 10 does not handle a complaint or does not inform the natural or legal person within three months about the progress or outcome of the complaint lodged pursuant to Article 11. / 3. Proceedings against a digital health authority shall be brought before the courts of the Member States where the digital health authority is established.

RemovedArticle 12 – paragraph 4: 4. The Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of electronic health data and the conditions and compliance checks necessary to join and remain connected to MyHealth@EU and conditions for temporary or definitive exclusion from MyHealth@EU. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 68(2a). The implementing act shall include the target implementation dates, including for cross border health data interoperability, in consultation with the EHDS board. The European Union Agency for Cyber Security (ENISA) shall be consulted and closely involved in all steps of the examination procedure. Any measures adopted shall meet the highest technical standards in terms of security, confidentiality and protection of electronic health data.

RemovedArticle 12 – paragraph 6: 6. Member States shall ensure that pharmacies operating on their territories, including online pharmacies, are enabled to dispense electronic prescriptions issued by other Member States, under the conditions laid down in Article 11 of Directive 2011/24/EU. The pharmacies shall access and accept electronic prescriptions transmitted to them from other Member States through MyHealth@EU, provided that the requirements in Article 11 of Directive 2011/24/EU are fulfilled. Following dispensation of medicinal products based on an electronic prescription from another Member State, pharmacies shall report the dispensation to the Member State that issued the prescription, through MyHealth@EU.

RemovedArticle 12 – paragraph 8: 8. The Commission shall, by means of implementing acts, allocate responsibilities among controllers and as regards the processor referred to in paragraph 7 of this Article, in accordance with Chapter IV of Regulations (EU) 2016/679 and 2018/1725. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

RemovedArticle 13 – paragraph 3: deleted / (deleted) / (deleted)

RemovedArticle 14 – paragraph 2: 2. This Chapter shall not apply to general software used in a healthcare environment that it is not interoperable with EHR systems.

RemovedArticle 14 – paragraph 4: 4. Notwithstanding the obligations laid down in Regulation [AI act COM/2021/206 final], providers of high-risk AI systems as defined in Article 6 of Regulation […] [AI act COM/2021/206 final], which do not fall within the scope of Regulation (EU) 2017/745, that claim interoperability of those AI systems with EHR systems will need to prove compliance with the essential requirements on interoperability laid down in Section 2 of Annex II of this Regulation. Article 23 of this Chapter shall be applicable to those high-risk AI systems.

RemovedArticle 15 – paragraph 1: 1. EHR systems may be placed on the market or put into service only if they comply with the provisions laid down in Section 3 of this Chapter and in Annex II.

RemovedArticle 16 – paragraph 1 – introductory part: In the information sheet, instructions for use or other information accompanying EHR systems, and in the advertising of EHR systems, it shall be prohibited to use text, names, trademarks, pictures and figurative or other signs that may mislead the professional user as defined under Regulation (EU) 2018/1807 with regard to its intended purpose, interoperability and security by:

RemovedArticle 16 – paragraph 1 – point b: (b) failing to inform the professional user of likely limitations related to interoperability or security features of the EHR system in relation to its intended purpose;

RemovedArticle 17 – paragraph 1 – point a: (a) obtain for their EHR systems a certificate of compliance from an independent third-party body to attest their conformity with the essential requirements laid down in Annex II and with the common specifications in accordance with Article 23;

RemovedArticle 17 – paragraph 1 – point b: (b) draw up the technical documentation of their EHR systems in accordance with Article 24 before placing their systems on the market, and subsequently keep them up to date;

RemovedArticle 17 – paragraph 1 – point c: (c) ensure that their EHR systems are accompanied, free of charge for the user, by the information sheet provided for in Article 25 and clear and complete instructions for use including in accessible formats for vulnerable groups and persons with disabilities;

RemovedArticle 17 – paragraph 1 – point d: (d) carry out the relevant conformity assessment procedures as referred to in Article 27a and Annex IVa;

RemovedArticle 17 – paragraph 1 – point d a (new): (da) draw up the EU declaration of conformity in accordance with Article 26;

RemovedArticle 17 – paragraph 1 – point e: (e) affix the CE marking in accordance with Article 27 after the conformity assessment procedure has been completed;

RemovedArticle 17 – paragraph 1 – point e a (new): (ea) indicate the name, registered trade name or registered trade mark, and the postal address and website, e-mail address or other digital contact at which they can be contacted, on the front office of the EHR system; the address shall indicate a single point at which the manufacturer can be contacted and. the contact details shall be in a language that is easily understood by users and market surveillance authorities;

RemovedArticle 17 – paragraph 1 – point g: (g) take any necessary corrective action in respect of their EHR systems immediately, where manufacturers consider or have reasons to believe that such systems are not or no longer in conformity with the essential requirements laid down in Annex II, or recall or withdraw such systems; the manufacturers shall then inform the national authorities of the Member States in which they made their EHR systems available or put them into service of the non-conformity and of any corrective action taken;

RemovedArticle 17 – paragraph 1 – point h: (h) immediately inform the distributors of their EHR systems and, where applicable, the authorised representative and importers of the non-conformity and of any corrective action, recall or withdrawal of that system;

RemovedArticle 17 – paragraph 1 – point i: deleted

RemovedArticle 17 – paragraph 1 – point j: (j) upon request provide market surveillance authorities in the Member States with all the information and documentation in paper or digital format, necessary to demonstrate the conformity of the EHR system which they have placed on the market or put into service with the essential requirements laid down in Annex II and Article 27a in the official language of the Member State.

RemovedArticle 17 – paragraph 1 – point k: (k) cooperate with market surveillance authorities, at their request, on any action taken to bring their EHR systems which they have placed on the market or put into service in conformity with the essential requirements laid down in Annex II and Article 27a in the official language of the Member State.

RemovedArticle 17 – paragraph 1 – point k a (new): (ka) establish channels of complaint and keep a register of complaints, of non-conforming EHR systems, and keep distributors informed of any such monitoring.

RemovedArticle 17 – paragraph 2: 2. Manufacturers of EHR systems shall ensure that procedures are in place to ensure that the design, development and deployment of an EHR system continues to comply with the essential requirements laid down in Annex II and the common specifications referred to in Article 23 for EHR systems to remain in conformity with this Regulation. Changes in EHR system design or characteristics and changes in the technical standards and the technical specifications referred to in Annex II and III by reference to which the conformity of the EHR system is declared shall be adequately taken into account and reflected in the technical documentation. / Manufacturers shall establish reporting channels and ensure their accessibility to allow users to submit complaints, and shall keep a register of complaints, of non-conforming EHR systems and EHR system recalls.

RemovedArticle 17 – paragraph 3: 3. Manufacturers of EHR systems shall keep the technical documentation and the EU declaration of conformity at the disposal of the market surveillance authorities for at least 10 years after the last EHR system covered by the EU declaration of conformity has been placed on the market. The source code or the programming logic included in the technical documentation shall, upon a reasoned request, be made available to the competent national authorities, if that source code or programming logic is necessary in order for them to be able to check compliance with the essential requirements set out in Annex II. The personnel of competent national authorities shall observe professional secrecy with regard to all information obtained in carrying out the conformity assessment activities in accordance with Annexes IVa, except in relation to the competent authorities of the Member State in which their activities are carried out. Proprietary rights, intellectual property rights and trade secrets shall be protected. Manufacturers shall establish reporting channels and ensure their accessibility to allow users to submit complaints, keep a register of complaints, of non-conforming EHR systems and EHR systems recalls.

RemovedArticle 17 – paragraph 3 a (new): 3a. A manufacturer of EHR systems established outside the Union shall ensure that its authorised representative has the necessary documentation readily available in order to fulfil the tasks referred to in Article 18(2).

RemovedArticle 17 – paragraph 3 b (new): 3b. Manufacturers shall, further to a reasoned request from a market surveillance authority, provide it with all the information and documentation, in paper or electronic form, necessary to demonstrate the conformity of the EHR system with the essential requirements set out in Annex II and the common specifications referred to in Article 23, in a language which can be easily understood by that authority. They shall cooperate with that authority, at its request, on any measures taken to eliminate the risks posed by the EHR system, which they have placed on the market or put into service.

RemovedArticle 17 – paragraph 3 c (new): 3c. Liability rules under Directive 85/374/EEC, shall apply to manufacturers of EHR systems without prejudice to more protective measures under national law.

RemovedArticle 18 – paragraph 2 – introductory part: 2. An authorised representative shall perform the tasks specified in the mandate agreed with the manufacturer. The mandate shall allow the authorised representative to do at least the following:

RemovedArticle 18 – paragraph 2 – point a: (a) keep the EU declaration of conformity and the technical documentation at the disposal of the Member State market surveillance authorities for the period referred to in Article 17(3);

RemovedArticle 18 – paragraph 2 – point b: (b) further to a reasoned request from a market surveillance provide authorities of the Member States concerned a copy of the mandate with all the information and documentation necessary to demonstrate the conformity of an EHR system with the essential requirements laid down in Annex II;

RemovedArticle 18 – paragraph 2 – point b a (new): (ba) immediately inform the manufacturer if the authorised representative has a reason to believe that an EHR system is no longer in conformity with the essential requirements laid down in Annex II;

RemovedArticle 18 – paragraph 2 – point b b (new): (bb) immediately inform the manufacturer about complaints received by consumers and professional users;

RemovedArticle 18 – paragraph 2 – point c: (c) cooperate with the market surveillance authorities in the Member State, at their request, on any corrective action taken in relation to the EHR systems covered by their mandate.

RemovedArticle 18 – paragraph 2 a (new): 2a. In the event of a change of the authorised representative, the detailed arrangements for the change shall address at least the following aspects: / (a) the date of termination of the mandate of the outgoing authorised representative and the date of the beginning of the mandate of the incoming authorised representative; / (b) the transfer of documents, including confidentiality aspects and property rights.

RemovedArticle 19 – paragraph 2 – point a: (a) the manufacturer has obtained a certificate of compliance from an independent third body to attest to the relevant conformity assessment procedure referred to in Article 27a and drawn up the EU declaration of conformity in accordance with Article 26; and drawn up the technical documentation, in accordance with Article 24, before placing their system on the market;

RemovedArticle 19 – paragraph 2 – point a a (new): (aa) the manufacturer is identified and an authorised representative in accordance with Article 18 has been appointed;

RemovedArticle 19 – paragraph 2 – point b: (b) the EHR system bears the CE marking of conformity referred to in Article 27 after the conformity assessment procedure has been completed;

RemovedArticle 19 – paragraph 2 – point c: (c) the EHR system is accompanied by the information sheet referred to in Article 25 with clear and complete instructions for use including in accessible formats.

RemovedArticle 19 – paragraph 3: 3. Importers shall indicate their name, registered trade name or registered trade mark and the postal address and website, e-mail address or other digital contact at which they can be contacted in a document accompanying the EHR system. The address shall indicate a single point at which the manufacturer can be contacted. The contact details shall be in a language easily understood by users and the market surveillance authorities. They shall ensure that any additional label does not obscure any information on the label provided by the manufacturer.

RemovedArticle 19 – paragraph 4: 4. Importers shall ensure that, while an EHR system is under their responsibility, the EHR system is not altered in such a way that its conformity with the essential requirements laid down in Annex II and Article 27a is jeopardised.

RemovedArticle 19 – paragraph 5: 5. Where an importer considers or has reason to believe that an EHR system is not or no longer in conformity with the essential requirements in Annex II and Article 27a, it shall not make that system available on the market, or shall recall it or withdraw it if was already available on the market, until that system has been brought into conformity. The importer shall inform immediately the manufacturer of such EHR system and the market surveillance authorities of the Member State in which it made the EHR system available, to that effect, giving details, in particular, of the non-conformity and of any corrective measures, recall or withdrawal of that system taken. Where an importer considers or has reason to believe that an EHR system presents a risk to the health or safety of natural persons, it shall immediately inform the market surveillance authority of the Member State in which the importer is established, as well as the manufacturer and where applicable, the authorised representative.

RemovedArticle 19 – paragraph 7: 7. Importers shall, further to a reasoned request from a market surveillance authorities of Member States concerned provide it with all the information and documentation in paper or digital format necessary to demonstrate the conformity of an EHR system. They shall cooperate with that authority, at its request, and with the manufacturer and, where applicable, with the manufacturer’s authorised representative on any action taken to bring their EHR systems in conformity with the essential requirements laid down in Annex II, and Article 27a, or to ensure that their EHR systems are withdrawn or recalled.

RemovedArticle 19 – paragraph 7 a (new): 7a. Manufacturers shall establish reporting channels and ensure their accessibility to allow users to submit complaints, keep a register of complaints, of non-conforming EHR systems and EHR systems recalls. Importers shall verify whether the established channels of complaint referred to in Article 17(2) are publicly available allowing them to submit complaints and communicate any risk related to their health and safety or to other aspects of public interest protection and of any serious incident involving an EHR system. If such channels are not available, the importer shall provide for them, taking into account the accessibility needs of vulnerable groups and persons with disabilities.

RemovedArticle 19 – paragraph 7 b (new): 7b. Importers shall investigate complaints and information on incidents involving an EHR system they made available on the market and file those complaints, as well as of system recalls and any corrective measures taken to bring the EHR system into conformity, in the register referred to in Article 17(3d) or in their own internal register. Importers shall keep the manufacturer, distributors and, where relevant, authorised representatives informed in a timely manner of the investigation performed and of the results of the investigation.

RemovedArticle 20 – paragraph 1 – point a: (a) the manufacturer has obtained a certificate of compliance from an independent third body to attest to the relevant conformity assessment procedure referred to in Article 27a and has drawn up the EU declaration of conformity, in accordance with Article 26, and the technical documentation, in accordance with Article 24, before placing their system on the market;