EHDS: why EU digital-health teams must prepare now, not in 2028

Summary

If you build digital health in Europe, the European Health Data Space (EHDS) is about to become the rails your product runs on. It is not “just another compliance topic.” It’s a shared operating system for primary care data flows (patient access + cross-border exchange) and secondary use (research, AI, public health) with strict governance.

Quick definition: EHDS is an EU-wide framework of rules, standards, and infrastructure so people can access and share their health data across borders (primary use) and so qualified actors can re-use health data under safeguards (secondary use). Think MyHealth@EU for care delivery and HealthData@EU for trusted re-use.

And yes, it’s real law now: Regulation (EU) 2025/327 was adopted on 11 Feb 2025 and published on 5 Mar 2025; it entered into force on 26 Mar 2025 with phased obligations that bite hard by March 2029 (and further milestones to 2031). (EUR-Lex)

How EHDS will work  -  concrete, day-one scenarios

Source: https://www.european-health-data-space.com/

1. Border-care handoff without the fax era:
   A patient from Dublin breaks an ankle in Madrid. The orthopedic clinic pulls the patient summary and ePrescription history through MyHealth@EU in the local language, prescribes pain relief safely, and updates the record so the GP back home sees it - no duplicate imaging, no errors.

2. Seamless image sharing between hospitals:
   A patient gets a lung scan at a public hospital after an emergency visit. Days later, their regular pulmonologist at another clinic opens the same image via MyHealth@EU — no repeated scans, no delays, just continuous care across systems.

3. AI decision support that actually learns:
   A health-tech startup trains its diagnostic AI by securely accessing thousands of anonymised lab images through HealthData@EU. The model compares new patient scans with prior cases to sharpen accuracy before market approval — all inside a secure processing environment with full audit trails.

4. eRx that actually travels:
   A Berlin traveller fills their ePrescription in Lisbon; the dispensation writes back so medication history stays consistent across providers. Pharmacies integrate once with the national connector; the cross-border rails are EHDS.

5. Signal detection in the real world:
   A MedTech company monitors post-market device performance by querying HealthData@EU datasets for adverse-event patterns, stratified by comorbidity and age - enabling earlier safety notices across the bloc.

Why the urgency?

As Darren Devitt, a FHIR Expert & Advisor from Dublin, bluntly puts it, most boardrooms still ask, “Does this even apply to us?” Then they assume there’s “plenty of time.” Do the math on a large IT change: discovery (≈12 months) + implementation (≈18 months) + buffer (≈6 months) + legal/compliance review (≈3 months) …and you’re out of time if you don’t start now. His point: the clock is already ticking - especially on secondary-use compliance, which is under-discussed and will surprise teams late.

Meanwhile, the standards work is moving: HL7 Europe has active FHIR Implementation Guides for EHDS priority data categories in public review - incomplete but well underway. Translation: the scaffolding exists; vendors and startups need to align their models and APIs. 

If your team is still getting familiar with how FHIR fits into the broader HL7 family, this guide on FHIR vs HL7 can help clarify the terminology and mindset shift.

What EHDS actually changes (in product terms)

Primary use (care delivery):

• Patients get immediate, no-cost digital access to priority data (patient summaries, ePrescriptions/eDispensations first; later images, labs, discharge reports).

• Providers can access a patient’s record across borders via MyHealth@EU - with logging, consent and security baked in.

• EHR systems and “wellness apps” interfacing with EHRs must meet interoperability + logging requirements and participate in cross-border exchange. (Public Health)

Secondary use (research/AI/public health):

• Data access happens through national Health Data Access Bodies into secure processing environments.

• Users receive only pseudonymised/anonymised outputs; re-identification and detrimental uses (e.g., insurance pricing, targeted ads) are prohibited.

• HealthData@EU links those access bodies, enables cross-border studies, and publishes dataset catalogues. (Arnold & Porter)

Timeline highlights you can plan against:

• Mar 2029: first wave mandatory in all Member States - primary use for patient summaries & eRx/eDispense; secondary-use rules apply to most EHR data.

• Mar 2031: imaging, labs, discharge reports operational for primary use; remaining secondary-use categories (e.g., genomics) kick in. (European Health Data Space)

Why it matters for startups and scale-ups

1. Distribution & trust: Products that plug into EHDS flows (and prove logging/interop) will face fewer procurement blockers and expand cross-border faster.

2. Data-network advantage: Secondary-use access via HealthData@EU makes high-quality, multi-country datasets attainable legally and repeatably - a moat for AI/ML. If you plan to combine EHDS data with research datasets, understanding how FHIR relates to OMOP and openEHR can be crucial - this primer on FHIR, OMOP, and openEHR can help you choose the right data model strategy.

3. Regulatory risk reduction: Building to EHDS/FHIR now lowers future remediation costs (and the “stop-ship” moments when audits start).

4. User-level value: Cross-border continuity of care isn’t a brochure line - it’s reduced repeats, safer prescribing, and better UX patients actually notice. (Public Health)

Common objections (and why they’ll age badly)

“We’ll handle this in 2028”

By then you’ll be competing with teams who already integrated MyHealth@EU flows and have secondary-use pipelines in production.

• “We’re not the controller.” You may still be an EHR-adjacent processor or a wellness app interfacing with EHRs - EHDS names you via the interop/logging components you must implement according to Public Health.

• “It’s not our data.” That’s the point: EHDS sets how you touch it - formats, consent, logging, security - not just who “owns” it.

• “Standards aren’t final.” True - and FHIR IGs are maturing now. Early alignment saves major refactors later. (Hat tip to Darren Devitt for calling out this trap.)

• “We’ll handle this in 2028.” By then you’ll be competing with teams who already integrated MyHealth@EU flows and have secondary-use pipelines in production.

What to start this quarter

1. Run a focused EHDS gap review (4–6 weeks).
   Map where you touch patient data today: formats, terminologies, APIs, consent, audit trails, cross-border scenarios. Tag gaps against EHDS primary vs. secondary use.

2. Align your data model to evolving FHIR IGs.
   Adopt FHIR resources for patient summary, meds, labs, imaging; capture provenance and logging fields early. You can speed this step up by using automated tools - for example, this open-source FHIR Converter can quickly transform legacy formats into FHIR-compliant resources for testing and prototyping.
   And if you need any help with adopting FHIR you may find a partner for FHIR integration in advance.

3. Design for MyHealth@EU connectivity.
   Even if your first market is national, architect a connector layer (token exchange, consent, logging, translation) so adding cross-border routes isn’t a rewrite. (Public Health)

4. Prepare for secondary-use governance.
   Draft SOPs for dataset requests/permits, DPIAs, anonymisation/pseudonymisation pipelines, and publication of study results per permit obligations. Identify which use cases you’ll pursue first (e.g., model validation, outcomes research). (Arnold & Porter)

5. Build the compliance “trio.”
   Product + Legal/Privacy + Security meet bi-weekly to own the EHDS backlog (log retention, access reporting, incident playbooks, third-party contract updates). Reference the EU “rights over my health data” guidance to keep UX and consent humane. (Public Health)

The payoff

• For patients: safer, portable care without repetition and delay.

• For companies: clean interop, auditable flows, and lawful data access that compounds into better products and faster market access.

• For research and AI: ethically-sourced, multi-country data that unlocks true generalisation rather than narrow, single-site models.

The regulation is set; the windows are dated. Start now, when architectural choices are still cheap to change.

Wrapping it up

The European Health Data Space is no longer a distant policy idea — it’s becoming the foundation of how healthcare data will move, be governed, and be reused across Europe. For digital-health companies and startups, EHDS is both a compliance obligation and a strategic opportunity: a chance to build products on standardised rails, tap into trusted multi-country datasets, and win the confidence of patients, providers, and regulators.

Those who start early will navigate the transition with clarity, while those who wait risk refactoring under audit pressure — or watching faster competitors set the new norms.

The path is clear: understand the requirements, align your architecture with emerging FHIR standards, build your governance muscles, and treat secondary use as a core product capability from day one.

EHDS will reshape the European digital health market. The question is simply whether you’ll be ready in time to lead it.