The European Health Data Space (EHDS): what hospitals must know

The European Health Data Space (EHDS) is the first European regulation that sets fixed deadlines for how patients' health data move between hospitals, pharmacies and countries, and for how those data may be reused for research and public policy. Regulation (EU) 2025/327 entered into force on 26 March 2025 and applies in stages between 2027 and 2035. This article explains the text, where Romania and Moldova stand, and what a hospital should prepare, with a source for every statement.

What the EHDS is and where it comes from

The EHDS is Regulation (EU) 2025/327 of the European Parliament and of the Council, signed in Strasbourg on 11 February 2025 after the Parliament's position of 24 April 2024 and the Council's decision of 21 January 2025. According to the European Commission's EHDS page, the text was published in the Official Journal on 5 March 2025 and entered into force on 26 March 2025. Besides its own rules, it amends Directive 2011/24/EU on cross-border healthcare and Regulation (EU) 2024/2847 (the Cyber Resilience Act).

The Regulation has two distinct halves that work on the same data under different rules:

• Primary use: data are used to care for the patient who generated them, including by a doctor in another European Union (EU) country.
• Secondary use: data already collected are reused, through dedicated access bodies, for research, innovation, statistics, policymaking and regulatory work.

As a regulation, the text applies directly in all Member States without transposition; Member States designate the authorities and access bodies.

The application timeline, stage by stage

Article 105 of the Regulation sets a staggered calendar. The general rule is application from 26 March 2027, but patients' rights and the obligations for electronic health record (EHR) systems apply according to the category of data.

Date	What applies	Basis in the Regulation
26 March 2025	Entry into force	Art. 105
26 March 2027	General application; Member States designate digital health authorities and inform the Commission; the Commission adopts common specifications for EHR systems and the European exchange format; first rules for access bodies	Art. 105, Art. 19, Art. 36, Art. 15
26 March 2029	Patients' rights (Arts. 3-15) and EHR system requirements for patient summaries, electronic prescriptions and electronic dispensations; the secondary-use chapter starts	Art. 105, Art. 14(a)-(c)
26 March 2031	The same rules for medical imaging and related reports, laboratory and other test results, discharge reports; the EHR chapter also applies to systems manufactured and used in-house by health institutions; additional secondary-use categories	Art. 105, Art. 14(d)-(f), Art. 26(2)
26 March 2035	Participation of third countries and international organisations in the secondary-use infrastructure	Art. 105, Art. 75(5)

Primary use: patients' rights and MyHealth@EU

Chapter II of the Regulation defines six priority categories of personal electronic health data (Art. 14): patient summaries, electronic prescriptions, electronic dispensations, medical imaging studies and related reports, medical test results (including laboratory results) and discharge reports. Patients' rights are built around these categories:

• Access (Art. 3): patients have the right to access their data in the priority categories immediately after they are registered in the EHR system, free of charge and in an easily readable format, and to download a copy in the European Electronic Health Record Exchange Format (EEHRxF) (Art. 15).
• Access services (Art. 4): each Member State provides free electronic access services, including for representatives.
• Restriction (Art. 8): patients may restrict health professionals' access to all or part of their data, after being made aware that this may affect their care.
• Information on access (Art. 9): patients have the right to learn, including through automatic notifications, who accessed their data; the information is kept for at least three years from each access.

For providers, Article 13 matters most: where they process data electronically, they must register the data in the priority categories in an EHR system, and Article 12 requires that health professionals can access those categories free of charge, including for cross-border care, through dedicated services with recognised electronic identification means.

Cross-border exchange runs through MyHealth@EU (Art. 23): a central interoperability platform operated by the Commission, to which each Member State connects a single national contact point for digital health. According to Bruthans and Jiráková (2023), six national contact points were operational in the fourth quarter of 2019 and ten in the second quarter of 2022; most transactions came from Estonia and Finland, with Estonia alone recording 5,035 ePrescriptions and 2,524 eDispensations by that time. According to the European Commission's March 2026 presentation, 17 Member States are live (plus Norway) with two services in operation, patient summary and ePrescription, while Romania is listed among the ongoing projects. The Danish Health Data Authority confirms 17 countries in routine operations at the beginning of January 2026.

From 26 March 2029, the patient summary and the electronic prescription must be accessible to the patient and the doctor in the European format in any Member State. For imaging, laboratory results and discharge reports, the date is 26 March 2031.

Secondary use: research, policy and access bodies

Chapter IV applies from 26 March 2029 and organises the reuse of data. Three elements matter for a hospital.

Data holders and categories. Article 51 lists the minimum categories that health data holders must make available for secondary use: data from EHRs, administrative data (including dispensations and reimbursement claims), genetic and genomic data, and others. For some categories, including genomic data, other omics data and clinical trial data, the obligation applies only from 26 March 2031 (Art. 105). Article 50 exempts natural persons and microenterprises from data holders' obligations, with the option for Member States to extend them by national law.

Access bodies. Each Member State designates one or more health data access bodies (HDABs) (Art. 55). Only they grant access, and only for the purposes in Article 53: public health, policymaking and regulation, official statistics, education, scientific research and others. The data holder puts the data at the access body's disposal within three months of the request, extendable by a further three months in justified cases, and describes its datasets in a national catalogue that it checks at least annually (Art. 60). Datasets collected with public funding carry a Union data quality and utility label (Art. 78).

The right to opt out. Article 71 gives every person the right to opt out, at any time and without giving a reason, from the processing of their data for secondary use; the opt-out is reversible, and Member States must provide an accessible and easily understandable mechanism.

Obligations of EHR system manufacturers

Chapter III treats EHR systems as regulated products: essential requirements, technical documentation, a declaration of conformity and CE marking. Article 25 requires every EHR system to include two harmonised software components: a European interoperability software component and a European logging software component.

The manufacturer's obligations under Article 30 include: conformity of the harmonised components with the essential requirements in Annex II and with the common specifications the Commission adopts by 26 March 2027 (Art. 36); technical documentation (Art. 37); the EU declaration of conformity (Art. 39); CE marking affixed to the accompanying documents (Art. 41); and keeping the documentation and the declaration for 10 years after placing the system on the market. Article 27 covers the case where an EHR system is also a medical device or a high-risk artificial intelligence system.

One detail matters for large hospitals: Article 26(2) extends the chapter to EHR systems manufactured and used within health institutions in the Union and to systems offered as a service. For those, under Article 105, Chapter III applies from 26 March 2031. A hospital that develops its own electronic record becomes, for this chapter, a manufacturer.

Where Romania and Moldova stand

Public figures show the gap between technical access and real use. According to the European Commission's Digital Decade 2025: eHealth Indicator Study (published 16 June 2025), the EU-27 composite score for citizens' technical access to their electronic health records reached 83% in 2024, up from 79% in 2023, against a 100% target for 2030; Romania gained 17 points year on year. Eurostat measures actual use instead. According to dataset isoc_ci_ac_i, in 2024 online access to health records was reported by 27.7% of Europeans aged 16-74, 9.9% of Romanians, 73.6% of Finns and 5.1% of Germans.

Romania is a Member State and has the same deadlines as the rest of the Union: 2027, 2029, 2031. In MyHealth@EU, Romania appears in the Commission's March 2026 presentation as an ongoing project, not among the 17 live states. According to Eurostat's December 2022 release, Romania then had the second-lowest rate in the EU (8%), after Germany (2%).

Moldova is not a Member State, so the Regulation does not apply to it directly. The connection exists, however, along three documented paths:

1. The EU4Health programme. According to the European Commission, the association agreement of Moldova to EU4Health was signed in February 2023 and applies retroactively from 1 January 2023; it opens access to the programme's funding, on condition that national systems comply with the GDPR where personal data are processed.
2. The National Programme for Digitalisation and Innovation in Health 2025-2030, approved by Government Decision No. 556 of 3 September 2025. The programme refers explicitly to Regulation (EU) 2025/327: an interoperable national electronic health record (DES), operational for 90% of patients by 2030, in "full compliance with the requirements of the European Health Data Space"; a national entity of the Health Data Access Body type; cross-border interoperability. The total estimated cost is 831.9 million lei, of which 259.8 million lei for the DES.
3. Third countries in the EHDS. Article 75(5), applicable from 26 March 2035, opens the secondary-use infrastructure to participants from third countries and international organisations under the Regulation's conditions.

For a hospital in Moldova, the practical conclusion is that the national DES is heading towards the European standards, so systems procured now will be judged by the same criteria.

What this means for a hospital in Romania or Moldova

The date that matters for most hospitals is 26 March 2029 (patient summary, electronic prescription, electronic dispensation), followed by 26 March 2031 (imaging, laboratory results, discharge reports). The steps below follow from the articles cited; costs and durations depend on existing systems, and the Regulation does not estimate them.

Checklist

1. Data inventory (Art. 13, Art. 14): identify where the six priority categories are produced today and whether they are recorded in structured form in an EHR system, not only as PDFs or free text.
2. Data quality and coding (Art. 15, Art. 78): the European exchange format will require structured fields and common terminologies; check the completeness of the patient summary and what share of laboratory results are coded values.
3. Patient access (Art. 3, Art. 4, Art. 8): decide how patients reach their data (the national access service or a connected hospital portal) and how you apply requested restrictions.
4. Access logging (Art. 9, Art. 25): every access by a professional must be recorded and available to the patient for at least three years; the EHR system will need to include the European logging component.
5. Electronic identification (Art. 12, Art. 16): professionals' access requires recognised electronic identification means.
6. Secondary use (Art. 51, Art. 60, Art. 71): prepare the dataset descriptions for the national catalogue, an internal workflow that can deliver data to the access body within three months, and a way to honour patients' opt-outs.
7. In-house systems (Art. 26(2)): if the hospital maintains its own EHR, plan for manufacturer conformity by 26 March 2031.

Questions to ask an EHR vendor

• How do you implement the two harmonised components of Article 25, and when will you issue the EU declaration of conformity and the CE marking (Art. 39, Art. 41)?
• Will you export the patient summary, the prescription and the discharge report in the European exchange format as the Commission publishes the specifications (Art. 15)?
• How are access logs kept and made available to the patient for at least three years (Art. 9)?
• What mechanisms do you have for patient-requested restrictions (Art. 8) and for flagging an opt-out from secondary use (Art. 71)?
• Can you deliver a de-identified dataset to the access body, with the description required by the national catalogue (Art. 60, Art. 77)?

Consdinamic builds software and artificial intelligence to order, with its deepest work in healthcare: its own products run daily in the Gral Medical private medical network in Romania, across 29 locations, and the collaboration with Aiforia (Finland) on de-identified digital pathology datasets has made us familiar with exactly the kind of data flows the EHDS regulates for secondary use. Our EU sister company, Softmed Labs SRL (Romania), lets us work with hospitals in both countries to the same standards.

Conclusion

The EHDS is not a recommendation but a regulation with deadlines: 26 March 2027 for authorities and specifications, 26 March 2029 for the patient summary and the electronic prescription, 26 March 2031 for imaging, laboratory results and discharge reports, 26 March 2035 for third countries. For a hospital, preparation starts with an inventory of the six priority categories, continues with access logging and patient access, and ends with an EHR system whose manufacturer can show the path to a declaration of conformity. Romania has the deadlines directly applicable and is still at the project stage in MyHealth@EU; Moldova has aligned its national programme for 2025-2030 with the same Regulation. In both countries, the useful question is not whether the EHDS concerns the hospital, but what it will be able to prove, with structured data and logs, in March 2029.