Changes from adopted text to adopted text

RemovedArticle 30 – paragraph 1 – introductory part: 1. Where a market surveillance authority makes one, inter alia, of the following findings, it shall require the manufacturer of the EHR system concerned, its authorised representative and all other relevant economic operators to bring the EHR system into conformity:

RemovedArticle 30 – paragraph 1 – point a: (a) the EHR system is not in conformity with essential requirements laid down in Annex II and with the common specifications in accordance with Article 23;

RemovedArticle 30 – paragraph 1 – point b: (b) the technical documentation is not available, not complete or not in accordance with Article 24;

RemovedArticle 30 – paragraph 1 – point c: (c) the EU declaration of conformity has not been drawn up or has not been drawn up correctly as referred to in Article 26;

RemovedArticle 30 – paragraph 1 – point d a (new): (da) the registration obligations of Article 32 have not been fulfilled.

RemovedArticle 30 – paragraph 1 a (new): 1a. Where, in the course of the evaluation referred to in the first subparagraph, the market surveillance authorities find that the EHR system does not comply with the requirements laid down in this Regulation, they shall require without delay the relevant economic operator to take all appropriate corrective action to bring the EHR system into compliance with those requirements, to withdraw the EHR system from the market, or to recall it within a reasonable period.

RemovedArticle 30 – paragraph 1 b (new): 1b. Where the relevant economic operator does not take adequate corrective action within the period referred to in Article 29(1), second subparagraph, the market surveillance authorities shall take all appropriate provisional measures to prohibit or restrict the EHR system being made available on their national market, to withdraw the EHR system from that market or to recall it. / The market surveillance authorities shall inform the Commission and the other Member States, without delay, of those measures.

RemovedArticle 30 – paragraph 1 c (new): 1c. The information referred to in paragraph 1b, second subparagraph, shall include all available details, in particular the data necessary for the identification of the noncompliant EHR system, the origin of that EHR system, the nature of the non-compliance alleged and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant economic operator. In particular, the market surveillance authorities shall indicate whether the noncompliance is due to any of the following: / (a) failure of the EHR system to meet the requirements relating to the essential requirements set out in Annex II; / (b) shortcomings in the harmonised standards referred to in Article 23; / (c) shortcomings in the technical specifications referred to in Article 23.

RemovedArticle 30 – paragraph 1 d (new): 1d. Member States other than the Member State initiating the procedure under this Article shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the EHR system concerned, and, in the event of disagreement with the adopted national measure, of their objections.

RemovedArticle 30 – paragraph 1 e (new): 1e. Where, within three months of receipt of the information referred to in paragraph 1b, second subparagraph, no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed justified.

RemovedArticle 30 a (new): Article 30a / Union safeguard procedure / 1. Where, on completion of the procedure set out in Article 29(2) and Article 30(1a), objections are raised against a measure taken by a Member State, or where the Commission considers a national measure to be contrary to Union law, the Commission shall without delay enter into consultation with the Member States and the relevant economic operator or operators and shall evaluate the national measure. On the basis of the results of that evaluation, the Commission shall adopt an implementing act in the form of a decision determining whether the national measure is justified or not. The Commission shall address its decision to all Member States and shall immediately communicate it to them and to the relevant economic operator or operators. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 68(2a). / 2. If the national measure is considered justified, all Member States shall take the necessary measures to ensure that the non-compliant EHR system is withdrawn from their market, and shall inform the Commission accordingly. If the national measure is considered unjustified, the Member State concerned shall withdraw that measure. Where the national measure is considered justified and the non-compliance of the EHR system is attributed to shortcomings in the harmonised standards or technical specifications referred to in this Regulation, the Commission shall apply the procedure provided fo…

RemovedArticle 31 – title: Labelling of wellness applications

RemovedArticle 31 – paragraph 1: 1. Where a manufacturer of a wellness application claims interoperability with an EHR system and therefore compliance with the essential requirements laid down in Annex II and common specifications in Article 23, such wellness application shall be accompanied by a label, clearly indicating its compliance with those requirements. The label shall be issued by the manufacturer of the wellness application and the competent market surveillance authority shall be informed.

RemovedArticle 31 – paragraph 3: 3. The Commission shall, by means of implementing acts, determine the format and content of the label. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

RemovedArticle 31 – paragraph 4: 4. The label shall be drawn-up in one or more official languages of the Union, and in the language of the Member State(s) in which the wellness application is placed on the market.

RemovedArticle 31 – paragraph 6: 6. If the wellness application is an integral part of a device or embedded in a device after its putting into service, the accompanying label shall be shown in the application itself or placed on the device and in the case of software a digital label. 2D barcodes may also be used to display the label.

RemovedArticle 31 – paragraph 9: 9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.

RemovedArticle 31 – paragraph 10: deleted

RemovedArticle 31 a (new): Article 31a / Interoperability of wellness applications with EHR systems / 1. Manufacturers of wellness applications may claim interoperability with an EHR system, after relevant conditions are met. When this is the case, the users of such wellness applications shall be duly informed about such interoperability and its effects. / 2. The interoperability of wellness applications with EHR systems shall not mean automatic sharing or transmission of all or part of the health data from the wellness application with the EHR system. The sharing or transmission of such data shall only be possible following the consent of the natural person and in accordance with Article 3(6) of this Regulation and interoperability shall be limited exclusively to this end. The manufacturers of wellness applications claiming interoperability with an EHR system shall ensure that the user is able to choose which categories of health data from the wellness application they want to insert in the EHR system and the circumstance for that sharing or transmission. / 3. Wellness applications shall not be permitted to access the information in EHRs or extract or process information from it.

RemovedArticle 32 – paragraph 1: 1. The Commission shall establish and maintain a publicly available database with information on EHR systems for which an EU declaration of conformity has been issued pursuant to Article 26 wellness applications for which a label has been issued pursuant to Article 34.

RemovedArticle 32 – paragraph 3: 3. Medical devices or high-risk AI systems referred to in paragraphs 3 and 4 of Article 14 of this Regulation shall also be registered in the database established pursuant to Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], as applicable.

RemovedArticle 33 – title: Categories of electronic health data for secondary use

RemovedArticle 33 – paragraph 1 – introductory part: 1. This Chapter shall apply to the following categories of electronic health data available for secondary use:

RemovedArticle 33 – paragraph 1 – point a: (a) electronic health data from EHRs;

RemovedArticle 33 – paragraph 1 – point b: (b) data on factors impacting on health, including socio-economic, environmental and behavioural determinants of health;

RemovedArticle 33 – paragraph 1 – point c: (c) relevant pathogen data, impacting on human health;

RemovedArticle 33 – paragraph 1 – point d: (d) healthcare-related administrative data, including claims and reimbursement data;

RemovedArticle 33 – paragraph 1 – point e: (e) extracts from human genetic, genomic and proteomic data, such as genetic markers;

RemovedArticle 33 – paragraph 1 – point f: (f) automatically generated electronic health data, via medical devices;

RemovedArticle 33 – paragraph 1 – point f a (new): (fa) data from wellness applications;

RemovedArticle 33 – paragraph 1 – point g: (g) identification data related to healthcare providers and categories of health professionals involved in the treatment of a natural person or in research;

RemovedArticle 33 – paragraph 1 – point j: (j) electronic health data from clinical trials subject to transparency provisions under Union law;

RemovedArticle 33 – paragraph 1 – point l: (l) data from research cohorts, questionnaires and surveys related to health;

RemovedArticle 33 – paragraph 1 – point n: deleted

RemovedArticle 33 – paragraph 2: 2. The Commission, after consulting the EDPB, EDPS and the Member States, shall adopt guidelines on measures to protect the personal data of health professionals involved in the treatment of natural persons. / (deleted)

RemovedArticle 33 – paragraph 4: deleted

RemovedArticle 33 – paragraph 5: 5. Natural persons shall have the right to opt-out of the processing of their electronic health data for secondary use. Member States shall provide for an accessible and easily understandable opt-out mechanism, whereby natural persons shall be offered the possibility to explicitly express their wish not to have all or part of their personal electronic health data processed for some or all secondary use purposes. The exercise of this right to opt-out shall not affect the lawfulness of the processing that took place under Chapter IV before the individual opted-out.

RemovedArticle 33 – paragraph 5 a (new): 5a. Without prejudice to paragraph 5, electronic health data referred to under paragraph 1, points (e), (fa) and (m), shall only be made available for secondary use after obtaining the consent of the natural person. Such an opt-in mechanism shall be easily understandable and accessible and provided in a user-friendly format whereby data subjects are made aware of the sensitive nature of the data.

RemovedArticle 33 – paragraph 7: deleted

RemovedArticle 33 – paragraph 8: deleted

RemovedArticle 33 a (new): Article 33a / IP rights and trade secrets in secondary use / Electronic health data entailing content protected by intellectual property rights, trade secrets or data covered by regulatory data protection shall be made available for secondary use. In those cases, the following procedure shall apply: / (a) health data access bodies shall take measures necessary to preserve the confidentiality of such data and to ensure such rights are not infringed; / (b) the Commission shall, after consultation with the EHDS Board, issue guidelines on the identification of commercially confidential information. The guidelines shall outline procedural steps and measures the health data access bodies may undertake to identify and preserve the confidentiality of such information before providing data access to the health data users. The guidance shall be made publicly available; / (c) health data holders may, when requested to make available to health data access bodies relevant electronic health data pursuant to Article 41(1) which it considers to contain content protected by intellectual property rights, trade secrets or data covered by regulatory data protection, inform the data access body that this is the case and indicate which parts of the datasets are concerned. The determination of which data contains intellectual property, trade secrets or data covered by regulatory data protection shall nevertheless rest with the health data access body; / (d) health data holders and the health data u…

RemovedArticle 34 – paragraph 1 – introductory part: 1. Health data access bodies shall only provide access to electronic health data referred to in Article 33 to a health data user where the processing of the data by the data user is necessary for one of the following purposes, and in accordance with Article 6(1), point (c), and Article 9(2), points (g) to (j), of Regulation (EU) 2016/679:

RemovedArticle 34 – paragraph 1 – point a: (a) activities for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality and safety of healthcare and of medicinal products or medical devices;

RemovedArticle 34 – paragraph 1 – point b: (b) to support public sector bodies and Union institutions, agencies and bodies, in the health or care sector to carry out their tasks defined in their mandates where processing is necessary for reasons of substantial public interest in the area of public health;

RemovedArticle 34 – paragraph 1 – point c: (c) to produce national, multi-national and Union level official statistics defined in Regulation (EU) No 223/20091a related to health or care sectors; / 1a Regulation (EC) No 223/2009 of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities, Council Regulation (EC) No 322/97 on Community Statistics, and Council Decision 89/382/EEC, Euratom establishing a Committee on the Statistical Programmes of the European Communities (OJ L 87, 31.3.2009, p. 164).

RemovedArticle 34 – paragraph 1 – point d: deleted

RemovedArticle 34 – paragraph 1 – point e: (e) scientific research related to health or care sectors, contributing to public health or health technology assessment, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices, with the aim of benefitting the end-users, such as patients, health professionals and health administrators, including: / (i) development and innovation activities for products or services; / (ii) training, testing and evaluating of algorithms, including in medical devices, in-vitro diagnostic medical devices, AI systems and digital health applications; / (iii) university and post-university teaching activities related to scientific research.

RemovedArticle 34 – paragraph 1 – point f: deleted

RemovedArticle 34 – paragraph 1 – point g: deleted

RemovedArticle 34 – paragraph 1 – point h: (h) improving delivery of care, treatment optimisation and providing personalised healthcare.

RemovedArticle 34 – paragraph 2: 2. The purposes referred to in points (a) to (c) of paragraph 1 shall be reserved for public sector bodies and Union institutions, bodies, offices and agencies exercising their tasks conferred to them by Union or national law, including where processing of data for carrying out these tasks is done by a third party on behalf of that public sector body or of Union institutions, agencies and bodies.

RemovedArticle 34 – paragraph 4: deleted

RemovedArticle 35 – paragraph -1 (new): -1. Secondary use of electronic health data that is not covered by the data permit pursuant to Article 46 or data requests pursuant to Article 47 shall be prohibited.

RemovedArticle 35 – paragraph -1 a (new): -1a. Any secondary use of electronic health data for purposes other than those referred to in Article 34 shall be prohibited.

RemovedArticle 35 – paragraph 1 – introductory part: 1. Seeking access to and processing electronic health data obtained via a data permit issued pursuant to Article 46 or a data request granted pursuant to Article 47 for the following purposes shall be prohibited:

RemovedArticle 35 – paragraph 1 – point a: (a) taking decisions detrimental to a natural person or group of natural persons based on their electronic health data; in order to qualify as “decisions”, they must produce legal, economic or social effects or similarly significantly affect those natural persons;

RemovedArticle 35 – paragraph 1 – point b: (b) taking decisions in relation to a natural person or groups of natural persons in relation to job offers or offering less favourable terms in the provision of goods or services, including to exclude them from the benefit of an insurance or credit contract or to modify their contributions and insurance premiums or conditions of loans, or taking any other decisions in relation to a natural person or groups of natural persons having the effect of discriminating on the basis of the health data obtained;

RemovedArticle 35 – paragraph 1 – point c: (c) advertising or marketing activities;

RemovedArticle 35 – paragraph 1 – point e: (e) developing products or services that may harm individuals, public health or societies at large, including, but not limited to illicit drugs, alcoholic beverages, tobacco and nicotine products, weaponry or products or services which are designed or modified in such a way that they create addiction or that they contravene public order or morality;

RemovedArticle 35 – paragraph 1 – point e a (new): (ea) automated individual decision-making, including profiling, in accordance with Article 22 of the Regulation (EU) 2016/679, whether solely on the basis of the datasets shared under this Regulation or in combination with other data.