The European Health Data Space: a timeline for private practices.

The European Health Data Space (EHDS) regulation, Regulation (EU) 2025/327, entered into force on 26 March 2025. It sets up two things at once: a framework for patients to access and share their own electronic health data across the EU (‘primary use’), and a framework for reusing health data for research, innovation and policy (‘secondary use’). For a private practice, almost nothing changes tomorrow. Quite a lot changes over the next six years.

The timeline

• 26 March 2025 — the regulation enters into force; the transition period begins.
• 26 March 2027 — the deadline for the key implementing acts that fill in the operational detail.
• 26 March 2029 — exchange of the first priority categories of health data begins: patient summaries and ePrescriptions/eDispensations. Most secondary-use rules apply.
• 26 March 2031 — the second group follows: medical images, laboratory results and hospital discharge reports.
• 26 March 2035 — third countries and international organisations may apply to join the cross-border infrastructure for secondary use.

What patients gain

According to the European Commission, patients get fast and free access to their electronic health data in a common European format, the ability to restrict access to parts of their record or to specific persons, to add their own information, to request corrections, and to see who has accessed their data. For secondary use, they can opt out in a simple and reversible manner, with limited exceptions for important public-interest purposes.

What it means for practice software

The EHDS introduces specific requirements for placing electronic health record (EHR) systems on the market, with strict security and interoperability criteria and a compliance framework for manufacturers. In practice, the system a private practice uses to keep records — the practice management or ambulatory software — will increasingly have to prove that it can exchange data in the European format and log access properly. That is the vendor’s obligation, but it becomes the practice’s problem if the vendor does not keep up.

Three things a practice can do now

• Ask your software vendor about its EHDS roadmap. Before you renew or replace practice software, ask how it will support the European exchange format and the patient-access requirements by 2029.
• Keep health data in certified systems. Website contact forms, spreadsheets and ad-hoc tools are the wrong place for clinical information. Data minimisation on the website is not only GDPR hygiene; it is how a practice avoids building a second, unregulated record.
• Use the website to guide, not to collect. As patient-access services roll out nationally, the practice website is the natural place to explain how patients can reach their own data — and where they cannot do it through the website itself.

This article is a summary, not legal advice. National implementation and the implementing acts due by 2027 will settle much of the operational detail.

How FIB Consulting approaches it

We build what does not touch sensitive data — websites, self-service updates, data-minimal forms — and integrate booking and practice systems from proven providers, so patient data stays with its operator and with you. See our medical IT work or get in touch.

Sources

Regulation (EU) 2025/327 on the European Health Data Space · European Commission, “European Health Data Space Regulation (EHDS)”, health.ec.europa.eu · Kennedys, “The European Health Data Space is in force”, 2026.