FAQs
The digital transformation of healthcare in the European Union is greatly aided by the European Health data space (EHDS). The EHDS puts citizens first by granting them complete control over their data, free of charge, so they can benefit from better healthcare delivery throughout the European Union. Additionally, the EHDS aims at providing a consistent and regulated framework for leveraging health data to accelerate health innovations and improve research studies, to ultimately lead to better live-saving medicines, healthcare policies and healthcare outcomes to all EU citizens. The EHDS Regulation was published in March 2025 and will take effect in 2027. For more information please consult: Regulation – EU – 2025/327 – EN – EUR-Lex.
Personal information is handled and protected in compliance with current EU regulations. Regarding the primary use of data, in some countries, sharing of data may be allowed by law or need your signature on a consent form. Regarding the use of health data for research purposes (secondary use), several rules and principles apply for this data to be provided. For example, data needs to be anonymized in most cases. The anonymized data will be only provided for secondary use after a careful evaluation of the purpose motivating the request to use the data (for example, does the purpose has the intention to benefit healthcare services?). If the evaluation yields a positive outcome, the data will be shared in a manner that ensures the privacy of citizens and secure data processing.
The term “secondary use of health data” describes the use of collected health data for research, medical innovation and decision-making, towards improving citizens healthcare and providing a stronger health system.
Some examples of secondary use of health data include:
- Researchers using health data to identify risk factors for diseases before they manifest.
- Researchers using health data to understand factors responsible for making a treatment more effective in specific individuals, towards tailoring medical care accordingly to each individual for better therapeutic outcomes.
- Health professionals using health data to track the spread of diseases or to identify populations at risk for particular health issues.
Secondary use of health data can be a helpful tool for enhancing population health and well-being. Nevertheless, the EU is committed in providing a regulated and safe environment for this data to be used, defending citizen’s privacy, and ensuring that the information is being used properly. The guidelines, processes and frameworks to accomplish this are being discussed, under the scope of the EHDS regulation proposal, available at the Link.
This project aims to set the groundwork necessary to warrant the access and secure use of health data for secondary use. The objective of HealthData@PT is to make data accessible through a national dataset catalogue for secondary use of health data. Access will occur through a management system capable to receive, process and reply to health data access requests in a short timeframe. Such system will be deployed in a way to ensure citizen’s privacy along with heath data with a high-quality for re-use purposes.
Furthermore, this project aims to provide the groundwork necessary to make health data usable in a cross-border setting for secondary use. This is an essential initial phase for preparing Portugal for its participation in HealthData@EU (or EHDS2 – European Health Data Space 2), an European infrastructure for the secondary use of health data, which will be similar to MyHealth@ EU, but aiming at secondary use of health data.
Researchers, innovators, policy makers and regulators that have presented a data assessment request, that was evaluated accordingly to a set of guidelines, and had a positive appreciation.
A Health Data Access Body (HDAB) is a legal and organizational structure responsible for ensuring that the access to and use of health data for secondary use is carried out in an efficient, simplified, rationalised, reliable and secure manner.
In Portugal, the HealthData@PT project is responsible for the technical implementation of the national HDAB. According to the EHDS regulation, the main functions of the HDAB include:
- Provide a public national dataset catalogue
- Evaluate and decide on data requests and data access applications
- Issue permits for accessing health data to approved data users
- Request data to data holders in result of approved requests
- Provide access to health data to data users
- Ensure a secure processing environment
- Facilitate cross-border exchange of health data
Anonymised data is personal data that is irreversibly altered in such a way that a data subject can no longer be identified directly or indirectly, either by the data controller alone or in collaboration with any other party. Anonymised data falls outside the scope of data protection laws such as GDPR (GDPR Recital 26).
Pseudonymised data is personal data can that no longer be attributed to a specific data subject without the use of additional information, provided that such additional information (codes) is kept separately and is subject to technical and organizational measures to ensure non-attribution to an identified or identifiable person. (GDPR Article 4(5)).
A datasets catalogue is an online public repository, containing information (metadata) regarding the available datasets for secondary use and their characteristics. It is a key tool foreseen by the Article 77 of the EHDS, fundamental for data discoverability, allowing potential users to more easily search and find datasets relevant to their work. The national datasets catalogue is a mandatory digital business capability for the secondary use of health data, as is through this catalogue that data can be discovered for secondary use. Furthermore, this national business capability is directly connected to the HealthData@EU European Union Datasets Catalogue, containing the health datasets from all Member States.
A Secure Processing Environment (SPE) is a physical or virtual environment for data processing, with technical and organizational measures that guarantee data integrity, accessibility, security, and confidentiality, in accordance with Regulation (EU) 2016/679. SPEs are mandatory components in the processing of health data, guaranteeing controlled and restricted access (only authorized users), with strong security measures to protect privacy and prevent the direct transmission of electronic health data to users.
Data access application, when approved, gives the user access to anonymised or pseudonymised individual-level electronic health data within a secure processing environment. Applicants should select this path only when individual-level personal data are necessary to achieve the objectives and aggregated statistical results are insufficient to meet the needs. Applicants must explain why the data applied for (anonymised or pseudonymised) are necessary for their purpose and demonstrate compliance with data minimisation principles. The HDAB evaluates applications for both compliance and necessity. All electronic health data can be accessed only within an SPE, ensuring strict data protection and preventing unauthorised re-identification.
Data request gives the user access to anonymised, aggregated (non-individual-level) statistical results. This path is ideal for analyses where detailed individual-level data are not required (e.g. to assess population-level trends or summary statistics) or for querying datasets to obtain further anonymised aggregated details on its contents (e.g. how many individuals with mutation X are present in dataset D) and there is no need for the data user to access the datasets themselves (Article 69).
Some examples of health data categories for secondary use are the Electronic Health Records (EHRs), social data (e.g. health insurance), environmental data (e.g. pollution), genetic data, data from wellness apps, data generated by medical devices. Socio-economic data can also be considered health data categories for secondary use, as well as behavioural and environmental determinants (e.g. living area, social support system, migration background, diet, exercise). You can find more information regarding health data categories in our flyer: here.
The HealthData@PT action is co-funded by the European Union, EU4Health Program 2021-2027 under Grant Agreement Nr 101128332. The views and opinions expressed are those of the author(s) and do not necessarily reflect the position of the European Union or HaDEA. Neither the European Union nor the grant-awarding authority can be held responsible for these opinions.
