Copenhagen: The Union’s ambition to let medical records follow patients across borders has moved from legislation toward machinery, with the first concrete building block of the European Health Data Space now in place. The Commission adopted an implementing act this spring establishing the governing board for the new system, a modest-sounding step that nonetheless marks the start of the long construction phase. After years of debate about how Europeans’ health information should flow, the question has shifted from whether the framework exists to whether it can actually be built.
The European Health Data Space, agreed last year and in force since early 2025, has two broad aims. The first, known as primary use, is to let patients and their clinicians access and share core health records, such as patient summaries and electronic prescriptions, wherever they happen to be in the Union. The second, secondary use, would allow tightly governed access to anonymised or pseudonymised data for research, public health and policymaking. Together they promise fewer repeated tests, safer cross-border care and a richer evidence base for medicine, provided the safeguards hold.
The timeline is deliberately gradual, and long. The Commission faces a deadline of March 2027 to adopt the battery of detailed implementing acts that will turn the regulation’s principles into workable technical rules. Only in March 2029 are the first obligations due to bite, when patient summaries and electronic prescriptions are meant to flow between all member states and much of the secondary-use regime comes online. A further tranche, covering medical images, laboratory results and hospital discharge reports, is not scheduled to be operational until 2031. By the standards of digital policy, this is a marathon laid out in advance.
That pace reflects how uneven the starting line is. A handful of member states have run sophisticated national e-health systems for years and will adapt with relative ease. Others are still digitising paper records and standing up the national digital health authorities the regulation requires. Bridging that gap is as much a question of money and administrative capacity as of software, and the worry among supporters is that a system only moves at the speed of its least-prepared participant. A framework that works brilliantly in one capital and barely functions in another would fall short of its borderless promise.
Privacy remains the most sensitive nerve. Patient advocates and data-protection experts have pressed hard on the secondary-use rules, wary of how broadly health information might be reused even under strong governance, and the regulation leans on technical safeguards and oversight bodies to keep that trust intact. The credibility of the whole project rests on citizens believing their most intimate data is handled carefully, a belief that is easier to lose than to earn.




