Janneke van Oirschot & Hannah van Kolfschooten

Give patients real control over their data within the EHDS

The aims of the European Commission’s European Health Data Space (EHDS) are twofold: to improve people’s access to, and control over their personal electronic health data in the context of healthcare (primary use) and to better use health data for other purposes that would benefit society, such as research, policy-making and innovation (secondary use). Unfortunately, the attainment of these goals is under threat. Instead, there is a risk that patients will lose control over their health data, that their data are exploited and that people, especially those in vulnerable situations, will be negatively impacted. However, the EHDS legislation does provide an opportunity for Member States to introduce stronger protections of patients’ rights. We recommend concrete measures to ensure that patients are truly in control of their data. 

Why this matters: Impact scenario’sThroughout this brief, call out boxes are included with scenarios which demonstrate the consequences of specific policy choices on patients, their rights and their health.

National governments should follow four routes to achieve this:

Limit the use of opt-out exceptions

While legislation within the EHDS allows for an opt-out for secondary use of data, it also contains provisions that allow member states to make exceptions. This means that even if a patient opted out, their data can still be used for policy-making, statistics or research deemed to be in the public interest. We are concerned that these exceptions undermine the value of the opt-out. We should be very wary for this sets a new standard in which the choice of patients has little or no meaning, as their data is still processed through broadly phrased exceptions. It is crucial that an opt-out actually means exactly that and that an individual’s data will not be included in the EHDS infrastructure.

Marco’s health record includes a history of cocaine dependency. He does not want this information, even if anonymised, to leave the doctor’s office. Therefore, he opted out of allowing his data to be used for secondary purposes within the EHDS. However, the Ministry of Health is conducting a national study to assess the trends of substance dependence. Due to exceptions made for public interest research, Marco’s opt-out is overridden, and his data is used for the study. Marco is not informed and has no possibilities to fight this action. Therefore, Marco loses control over his health data.

Make opt-out processes accessible and involve patient groups in its development

Given the adoption of the law, despite the above concern about the design of the opt-out, the opt-out must of itself be accessible and understandable. This includes clear procedures for explanation and clarification, wide access to opt-out information, and a flexible opt-out option that applies to different types of data and data uses. The needs of people in vulnerable situations such as poverty and low (digital) literacy need to be taken in to special consideration, and efforts around EHDS information provision must put their needs first. It is also essential that representatives of various patient groups and civil society organisations have a say in the development of this opt-out and the awareness campaigns about it. This is the only way in which a system can be developed which actually meets the wishes and needs of patients, and is consequently widely supported in society.

It’s 2027, and the EHDS is now fully in effect. However, Sofia is unaware that she has the option to opt out of her data being used for secondary purposes. Meanwhile, Ivan struggles to navigate the system to successfully opt-out, and the information provided on how data is used is too vague for Ali to make an informed decision aligned with his values. Therefore, Sofia, Ivan, and Ali are all unable to exercise their right to opt out due to flaws in the system’s design and communication.

Create an opt-in mechanism for genetic data

During the negotiations on the EHDS, some Member States rightly pushed for strong protection of genomic data. Given the special nature of this data (it is impossible to anonymise and affects not only the patient, but also family members and future generations) it is crucial to introduce an opt-in mechanism for genomic data and other types of genetic data for which the EHDS allows extra safeguards. Indeed, there is a serious risk of privacy breaches with genetic data, and an opt-in would better give patients control over the most sensitive information they possess.

The government decided not to create an opt-in mechanism for genetic data. Therefore, everyone who did not make the conscious decision to opt-out of secondary use, has their information shared within the EHDS infrastructure. Lidya is one of the people who never actively made a choice as she was not aware of this option. She is a political refugee with a rare genetic condition called Schwannomatosis. She fears exposure of her data would impact her safety and that of family members who still live in Eritrea. Therefore, had there been an opt-in procedure, she would not have chosen to have her genetic data included in the EHDS.

Guarantee that the EHDS serves the public interest

The EHDS infrastructure will require major public investment. It is vital that this investment translates into health gains for patients, and not mere commercial gains for companies. Unfortunately, it is not a given that wider availability of health data for secondary use will automatically lead to better healthcare or health outcomes. When it does add value, there is the risk that only a few people benefit, while others are left behind because they can’t access the improved healthcare service, new technology or other innovation. Therefore, there must be strong safeguards that ensure that the EHDS primarily serves the public interest. Research and new technologies developed which have relied upon the availability of EHDS data must actually add value for patient outcomes and be widely accessible through strong data permit conditions.

Eczema is one of the most common skin conditions across Europe, affecting over 5% of the population[1]. A MedTech company developed a highly effective medical device to treat eczema using data from thousands of Europeans under the EHDS. Now the product is on the market, but it’s incredibly expensive and can only be accessed in specialised hospitals. The company is not transparent about the price composition of their product, making it impossible to assess the legitimacy of its price. Many people with eczema are unable to access the treatment.

A big tech company uses EHDS data to tailor the design of their wellness app – which they claim provides wellbeing services in the public interest – to their target population. Although it was not stated as a purpose in the EHDS data request, the new product design increases their market share by 20%. While it’s clear that EHDS data has boosted their sales, it’s unclear whether people’s health outcomes have actually improved.

Only if Member States thoroughly implement the above action points, can we ensure that the EHDS is of value to patients and that they gain real control over their health data.

---

^[1] MA Richard et al. Prevalence of most common skin diseases in Europe: a population-based study. (2022) https://pubmed.ncbi.nlm.nih.gov/35274366/

This policy brief has been published on the website of Health Action International, click here.