The European Union has spent the last decade reshaping the digital regulatory landscape through landmark legislation such as the General Data Protection Regulation (GDPR) and the AI Act. The European Health Data Space (EHDS) Regulation is the next significant step in that evolution. While often described as a healthcare initiative, the EHDS is at its core a data governance framework designed to unlock the value of electronic health data while safeguarding fundamental rights and promoting innovation.
Its ambition is considerable. EHDS creates a harmonised framework for the secure exchange and secondary use of electronic health data across Member States, in order to improve patient care, accelerate scientific research, support evidence-based policymaking and foster the development of innovative digital health technologies. The Regulation establishes rules for the 1) primary use of electronic health data, enabling healthcare professionals to access relevant patient information across borders where appropriate and the 2) secondary use of data for purposes such as scientific research, innovation, public health, regulatory activities and policymaking. Health Data Access Bodies will play a central role in overseeing access to data, acting as independent gatekeepers between data holders and authorised users.
Beyond Data Protection
The EHDS builds on the GDPR. While the GDPR governs the lawful processing of personal data, including health data as a special category, the EHDS introduces a governance framework for how electronic health data can be accessed, shared and reused within a trusted European ecosystem. For organisations, this means that compliance can no longer be considered through a single regulatory lens. Core GDPR principles such as lawfulness, transparency, purpose limitation, and accountability remain fully applicable. The EHDS complements these obligations by introducing governance mechanisms intended to facilitate responsible data sharing while maintaining appropriate safeguards. This reflects an important shift in regulatory thinking. Health data has always required enhanced legal protection, but the EHDS recognises that data which remains fragmented or inaccessible cannot effectively support modern healthcare or scientific progress. Instead of asking whether health data should be shared, the Regulation focuses on how it can be shared responsibly.
The framework for secondary use of data illustrates this balance. Access to electronic health data for research, innovation and other public interest purposes will be subject to strict governance requirements, oversight and technical safeguards. Individuals are granted the right to opt out from primary and/or secondary use, thus extending an individual’s decision-making power to some degree. The objective is to maximise the societal value of health data without compromising individual rights.
Balancing Interoperability and Cybersecurity
Greater interoperability is one of the EHDS’s greatest strengths, but it also creates new risks. Connecting healthcare providers, researchers, regulators and digital health platforms inevitably increases the potential attack surface for cyber threats. As access to electronic health data expands across Europe, organisations must ensure that security evolves at the same pace as connectivity. Consequently, the EHDS cannot be viewed in isolation. Its implementation sits alongside broader EU cybersecurity legislation which reinforces expectations around cybersecurity governance, risk management and resilience. Organisations should adopt an integrated governance approach that combines legal compliance with effective information security and enterprise risk management. The consequences of failing to do so extend well beyond regulatory enforcement. A cyber incident involving health data may lead to GDPR investigations, contractual disputes, civil liability, insurance implications and significant reputational damage. As more organisations participate in the European health data ecosystem, questions of accountability following a data breach are also likely to become increasingly complex.
Commercial Access and Public Trust
One of the EHDS’s more nuanced features is its approach to the secondary use of health data by private organisations. Medical innovation depends on collaboration between public institutions and industry. Nevertheless, commercial access inevitably raises broader questions about legitimacy and public confidence. Patients may be supportive of their data being used to advance scientific research but may be more cautious where commercial interests are involved, even where those activities ultimately contribute to better healthcare outcomes. Despite the fact that the EHDS places clear limits on certain uses of health data such as prohibiting their use for marketing or malicious purposes, legal compliance alone may not be enough to secure public confidence. Trust will therefore become a strategic asset. Organisations that demonstrate transparency, robust governance and responsible stewardship of health data are likely to enjoy greater public confidence than those that focus solely on regulatory compliance.
Artificial Intelligence
The rapid development of artificial intelligence has inevitably shaped discussions surrounding the EHDS. The Regulation itself is not an AI law. Instead of regulating AI systems, the EHDS governs the data ecosystem upon which those systems depend. High-quality, interoperable and representative electronic health data is essential for developing reliable clinical decision-support systems, predictive analytics, personalised medicine and future generations of foundation models and large language models used in healthcare. In this sense, the EHDS regulates the data that powers AI, rather than the technology itself. When responsibly governed, these datasets have the potential to improve diagnosis, personalise treatment, enhance operational efficiency and strengthen public health responses. Equally, poor quality or poorly governed data may perpetuate bias, reduce the reliability of AI systems and undermine public trust in AI-assisted healthcare. Therefore, the relationship between the EHDS, the AI Act and GDPR highlights a broader governance challenge. Compliance should not end once organisations have lawfully accessed data. Equal attention must be given to how that data is managed throughout its lifecycle, including its use in developing, deploying and monitoring AI systems.
The road ahead
Implementation will be phased in gradually, beginning in March 2029. Organisations should move beyond asking whether they are merely compliant with EU Regulations and begin asking whether they are prepared. For instance, stakeholders should ensure that their data governance framework is aligned with digital regulations (e.g. EHDS, GDPR, privacy, cybersecurity, etc), they have appropriate risk management strategies in place, and their vendor and/or partner contracts are amended and/or updated.
For Member States such as Cyprus, the EHDS presents both opportunity and responsibility. Continued investment in digital health infrastructure, interoperability, cybersecurity capability and institutional governance will be essential to realise the Regulation’s full potential. Initiatives such as the planned myHealth@CY platform, which aims to provide citizens with secure access to their health information, digital health services and emergency response capabilities, illustrate the country’s commitment to digital transformation. The long-term success of the e-health framework will depend not only on technological innovation but also on maintaining robust governance and public trust. The EHDS should not be viewed simply as another regulatory obligation; it is a reflection of a broader shift in how Europe understands 1) data in general and 2) health data in particular, i.e. as a strategic resource capable of improving healthcare, advancing research and driving innovation when governed responsibly.
Ultimately, the organisations that will derive the greatest value from the EHDS will be those that r treat responsible data governance, cybersecurity and transparency not merely as compliance obligations, but as strategic assets in an increasingly interconnected European ecosystem.
*By Athina Evagorou, Association, Elias Neocleous & Co LLC
