EU sets MyHealth@EU and health data catalogue rules under European Health Data Space

The European Commission has adopted two implementing regulations under the European Health Data Space, setting requirements for MyHealth@EU and the description of health datasets made available for secondary use.

The Baseline

• The European Commission has adopted two implementing regulations under the European Health Data Space.
• New rules set requirements for cross-border health data exchange through MyHealth@EU, including cybersecurity, interoperability, and compliance checks.
• Separate requirements standardize how datasets available for secondary use are described to support their discovery across the European Union.

The European Commission has published new rules covering the cross-border exchange and secondary use of electronic health data under the European Health Data Space (EHDS). The implementing regulations set out how the MyHealth@EU infrastructure will operate and establish common metadata requirements for describing datasets in health data catalogues, providing further detail on the requirements that will apply across Member States.

Commission Implementing Regulation (EU) 2026/2083 sets out the operation of MyHealth@EU, the infrastructure for exchanging personal electronic health data across borders. It builds on the eHealth Digital Service Infrastructure, which allowed Member States to exchange information such as patient summaries and electronic prescriptions on a voluntary basis.

Under the new rules, cross-border exchange through MyHealth@EU will be supported by common requirements for cybersecurity, data protection, and interoperability, alongside processes for operating the infrastructure and managing incidents. Responsibility will be divided between the Commission and Member States: the Commission will provide the secure communication network and shared services needed to support exchange, while Member States will manage their national infrastructures and maintain the translations and mappings needed for different coding systems to work across borders.

National contact points for digital health will be subject to technical testing and compliance checks before beginning data exchange and every five years after the latest compliance check. The Commission can require additional checks where it identifies a critical risk to the security, confidentiality, or protection of personal electronic health data, while significant incidents must be reported within 24 hours of becoming known.

The regulation will apply from March 26, 2027, with requirements for exchanging different categories of health information introduced in stages. Patient summaries, electronic prescriptions, and electronic dispensations will be covered from March  26, 2029, followed by medical imaging studies and related imaging reports, medical test results, including laboratory and other diagnostic results and related reports, and discharge reports from March 26, 2031.

The second regulation, Commission Implementing Regulation (EU) 2026/2098, addresses how datasets made available for secondary use are described. Health data holders will be required to provide health data access bodies with a standard set of metadata for both personal and non-personal electronic health data, using the Commission’s HealthDCAT-AP framework.

These descriptions are intended to provide information about what a dataset contains, where it comes from, and how it can be accessed. Alongside its title and description, metadata will cover areas including the types of health data available, geographical, and temporal coverage, provenance, coding systems, access conditions, and the number of records. Where applicable, descriptions will also indicate the estimated number of unique individuals represented and provide information on the variables available.

Under the wider EHDS Regulation, health data holders must verify at least annually that these descriptions remain accurate and up to date. Using a standardized, machine-readable format is intended to make datasets easier to identify across national catalogues and support their connection with the EU dataset catalogue. The metadata regulation will apply from March 26, 2029.

Commenting on the publication of the acts, Fulvia Raffaelli, DG SANTE, welcomed the additional guidance, stating:

“These acts help turn the EHDS from a legal framework into a practical system that works across Europe and deliver for our citizens and our researchers.”