The European health data space: Too big to succeed?

Highlights

• •In the current Proposal, the EHDS will not achieve its stated aims.
• •The EHDS will entail diminished safeguards for patients and citizens.
• •Health professionals are assigned unsustainable administrative burdens, detracting from patient care.
• •Health data sharing will not result in increased value for the public.
• •The proposal should be amended towards strengthening individual control and promoting collective good.

Abstract

In May 2022, the European Commission issued the Proposal for a Regulation on the European Health Data Space (EHDS), with the aims of granting citizens increased access to and control of their (electronic) health data across the EU, and facilitating health data re-use for research, innovation, and policymaking. As the first in a series of European domain-specific “data spaces”, the EHDS is a high-stakes development that will transform health data governance in the EU region.

As an international consortium of experts from health policy, law, ethics and the social sciences, we are concerned that the EHDS Proposal will detract from, rather than lead to the achievement of, its stated aims. We are in no doubt on the benefits of using health data for secondary purposes, and we appreciate attempts to facilitate such uses across borders in a carefully curated manner. Based on the current draft Regulation, however, the EHDS risks undermining rather than enhancing patient control over data; hindering rather than facilitating the work of health professionals and researchers; and eroding rather than increasing the public value generated through health data sharing. Therefore, significant adjustments are needed if the EHDS is to realize its promised benefits.

Besides analyzing the implications for key groups and European societies at large who will be affected by the implementation of the EHDS, this contribution advances targeted policy recommendations to address the identified shortcomings of the EHDS Proposal.

The European Union (EU) is trying to get its (data) act together. Its strategy for data comprises a series of regulations and proposals which together seek to create and govern a single European market for data [1]. One of the draft legislations currently up for discussion is the Proposal for a Regulation on the European Health Data Space (EHDS), published in May 2022 [2]. The EHDS Proposal states two ambitious aims: (i) to grant citizens increased access to and control of their (electronic) health data across the EU, and (ii) to facilitate health data re-use for research, innovation, and policymaking. As the first in a series of European domain-specific “data spaces”, the EHDS is a high-stakes development that will transform health data governance in the EU region and will likely set a novel standard for the rest of the world.

To date, expert scrutiny on the EHDS Proposal has predominantly focused on the significant legal and regulatory challenges it faces, since, in its current draft, the EHDS conspicuously fails to coordinate with key European regulations, such as the EU's cornerstone General Data Protection Regulation (GDPR) or Regulation (EU) 1025/2012 on standard setting [3,4]. The challenges, however, go well beyond the purely legal dimension. In practice, the EHDS will shape how healthcare delivery, and research and innovation activities across the EU are implemented. Its impact will be transformative.

Improving health data sharing practices, while harnessing the insights provided by real world data, is perceived as a pressing priority in the health domain, acquiring increased salience in the wake of the Covid-19 pandemic [5]. Initiatives such as OpenSAFELY in the UK or the Danish COVID-19 cohort, for instance, support a wealth of studies using electronic health record data to address research questions during the pandemic.

And yet, as an international consortium of experts from health policy, law, ethics and the social sciences, we raise concerns that an EHDS based on the current Proposal is bound to detract from, rather than achieve, its ambitious stated aims of enhancing primary and secondary health data uses, and generating public value through health data sharing. As it stands, the Proposal runs in fact the substantial risk of (i) undermining rather than enhancing patient control over data as well as the exercise of individual data protection rights; (ii) hindering rather than facilitating health data use and re-use by health professionals and researchers; and (iii) eroding rather than increasing the public value generated through health data sharing. Therefore, significant adjustments are needed if the EHDS is to realize its promised benefits.

1. Impacts on patients

One of the central objectives of the EHDS is to enhance patient control (and that of citizens more broadly) over health data. However, by lowering standards related to information provision to individuals as well as consent, the Proposal might end up diminishing the possibility of patients to exert such control, notably with respect to secondary health data uses. In turn, the reduced individual control is not adequately compensated for by the establishment of well-defined governance and oversight mechanisms, which are needed to safeguard patients and ensure legitimacy and accountability of data sharing.

For one thing, in contrast with the GDPR and national data protection legislation, the Proposal significantly reduces transparency requirements, as it introduces waivers related to provision of individual-level information to data subjects (Art. 38.2), while also disfavoring consent as a legal basis for sharing electronic health data (Art. 33.5). In practice, this means patients will only be able to determine in general terms, or on request, by whom and for what purposes their data is processed, and consequently will be hindered in their informational self-determination. In addition, while the EHDS does contain a number of safeguards to guard against harm and re-identification of data subjects, the build-up of large datasets and their extensive use for secondary purposes still increases the risk of re-identification. Yet, patients will have diminished opportunities for becoming informed about such heightened risks and exerting control on such uses. Furthermore, both the reduced information requirements and the consent waiver render unclear whether and how patients can effectively object to participating in particular types of research (e.g. opt-out on moral grounds), which stands in contrast with established ethical standards in this domain.

As a central data governance mechanism, the Proposal establishes national health data access bodies (HDABs) (Art. 36) with the crucial task of overseeing and sanctioning data access and transfers. Yet, these bodies are going to lack meaningful decisional agency, since the secondary use of patient data for very broadly defined ‘research’ and ‘innovation’ purposes (Art. 34) is allowed almost by default (Art. 46). Also, it remains unclear how HDBAs’ functions will align with those of existing oversight bodies, such as ethics review boards (ERBs) or data protection authorities (DPAs), or how forum-shopping can be avoided [3]. Not only will these issues create significant governance challenges, but they will also potentially entail diminished safeguards for patients and citizens.

Ultimately, if adjustments to the current Proposal are not implemented, European citizens and patients are poised to become “an object to achieve the EU's public health and market aspirations” [6]. This stands in stark contrast to the stated aim of enhancing individual control over health data. Furthermore, granted what we know from studies of public opinions about health data reuse [7,8], the aim of stimulating the European economy by granting free access to citizens’ health data can backfire and have detrimental effects on public trust in and support for medical research.

We acknowledge that, in the context of the re-use of data for research purposes, the requirement of specific individual consent may, among other things, limit the representativeness of datasets. This, in turn, can introduce or increase selection bias and potentially compromise study outcomes. Refraining from the requirement of specific individual consent can be acceptable in cases where the re-purposing of data is highly likely to create great public benefits without posing high risks to individuals or groups [9,10], and where harm mitigation mechanisms are in place [11]. However, the vast scope of the intended data sharing in the context of the EHDS is unlikely to meet these criteria.

2. Impact on health professionals

The EHDS assigns important responsibilities and possibly unsustainable administrative burdens on health professionals, which will come at the expense of patients' time for treatment and care.

First, the Proposal's currently foreseen obligation to share patient data (Arts. 33) may trigger violations of duties of professional secrecy and confidentiality, creating legal uncertainty and misalignments with existing EU and national legal frameworks and established principles of medical ethics. The EHDS Proposal provides no clarity or support on how health professionals should navigate these issues. Similarly, the Proposal does not clearly attribute responsibilities: when data is transferred across nations and when patients are given the right to upload data to their electronic health record, it is not clear how health professional should take responsibility for this data, given that health professionals cannot control the data they receive, its language, or format.

Second, data spaces are premised on the idea that shared standards can apply to different national healthcare systems, with different disease classification systems in place, and differing levels of specialization and medical specialties. Even if all EU countries should begin using ICD-11, the same diagnostic codes will be used differently and signify different stages of disease in healthcare systems with different remuneration systems, varying access to healthcare, and diverse registration traditions. Arriving at agreements on semantics and data management procedures among many different stakeholders is a monumental challenge. Indeed, implementation of new EHR systems is very time-consuming, costly, and largely beyond healthcare professionals’ remit and scope of action. It is also very challenging, even within a limited (disease or national) area, let alone the entire Union. Although the EHDS Proposal attempts to ensure coherence in relation to future standards and specifications for EHR systems and products claiming interoperability, we see no concrete roadmap to achieve this by 2025.

Additionally, quality control and standardization issues are likely to affect the undertakings of health professionals and researchers seeking to re-use health data. New standards created and implemented in the context of the EHDS involve dissociating data further from their original context. Yet, to be able to make use of data, it is important to understand where they come from and how they were produced [12]. Furthermore, shared data standards in themselves do not solve problems raised by using the same standards in different ways at the time of data collection and clinical practice. This can result in frequent misinterpretations, possibly leading to faulty analyses [13].

In short, the EHDS necessitates the establishment of a widespread, technically complex, and massively costly digital infrastructure. However, previous experiences (such as the long-delayed implementation of the EU Clinical Trials Regulation) should raise caution about the risk of investing in a technological infrastructure that, for many years, could possibly face hindrances in functionality (e.g. slow uptake, limited compliance, poor connectivity, insufficient IT professionals to set up and manage the system), ultimately resulting in erosion of trust and cooperation by stakeholders.

3. Broader impact on European societies

While the notion of generating public value through health data sharing lies at the heart of the EHDS, key concepts and provisions that should support and help realize this aim are still vague and underdeveloped, and it is insufficiently explained how society at large is poised to benefit from it. Specifically, we foresee two major risks: i) easy access by Big Tech to the EHDS with insufficient instruments in place to realize returns on public investment, ii) reinforcement of digital divides and social inequalities.

The Proposal aims to facilitate reuse of data by researchers as well as industry. In the current ecosystem of digital health, this means not only traditional biomedical industry actors such as pharma companies, but also large digital technology corporations, whose interest in health has peaked in recent years [14]. The Proposal provides two criteria which could limit corporate access for pernicious reasons, namely compliance with data protection legislation, and access for research “that contributes to the general interest of society” (recital 41). Yet, recent initiatives of tech corporations in health research tend to conform to data protection law. In addition, these corporate initiatives are geared to promote societally relevant research in a number of disease areas, and thus can easily align with rather ill-defined notions of “general interest” [15], such as the one we currently find in the Proposal. In other words, tech corporations are poised to have unobstructed access to the EHDS.

This is worrisome, as the EHDS – a blueprint for other sectoral European data spaces – may become an experimental site for Big Tech expansionism into new sectors. This can have detrimental effects on public sectors, such as involvement of tech corporations in research agenda setting and growing dependencies on privately owned computational infrastructures for the provision of public goods, such as health [16].

It also raises pressing questions about how value generation from the EHDS will flow back to the public sector [17]. Currently, corporations are interested in accessing domain-specific datasets in order to train proprietary algorithms, which will eventually be sold back to the public sector. An example of this played out during the Covid-19 pandemic, when the National Health Service (NHS) in the UK made agreements with Google, Amazon, Microsoft, Palantir and Faculty (a British AI start-up) to create a “data store” collating data from across the NHS to support pandemic decision-making. The companies were granted intellectual property rights and allowed to train their models and profit from access to NHS data, raising concerns about whether the public was getting “fair value for [their] NHS data assets.”[18]

As it stands, the Proposal does not sufficiently ensure that any profits, services or intellectual property generated through non-public institutions by access to the EHDS are translated back to EU citizens.

Finally, the EHDS runs the significant risk of exacerbating already existent digital divides in Europe, reinforcing discrepancies in digital access across Member States [19]. Notably, this could be detrimental to most vulnerable populations, including older people, those from disadvantaged socioeconomic backgrounds, those carrying chronic conditions, and ethnic minority communities, who may lack the digital literacy or resources to fully partake in, and benefit from, the EHDS. In turn, this would lead to the unfortunate outcome of excluding those who could benefit most from the envisaged benefits of the EHDS.

4. Conclusions

The EHDS Proposal is currently up for review with the Council of the EU and the European Parliament, as part of the ordinary legislative procedure of the EU. As argued, the Proposal will trigger transformative changes in the health domain, bringing with it major challenges that should be preemptively addressed. This article is intended to provide a contribution towards this aim. Accordingly, building on the arguments above, we conclude by providing targeted recommendations for policy improvement (see Table 1), which could steer the EHDS to realize its envisioned benefits for patients/citizens, health professionals and researchers, and society at large.

Table 1.

Policy recommendations.

Policy recommendations
1	The EHDS Proposal should be revised to ensure better alignment with EU and national legislation, and avoid legal uncertainty and confusion that would come to the detriment of health research and care.
2	It is of crucial importance to preserve public trust in health research. Accordingly, uphold data subjects’ rights as enshrined in the GDPR. Reserve informed consent exemptions with regard to secondary use to limited, clearly defined, uses (e.g. cross-border public health threats), or to uses which are already considered ‘public interest’ in national legislations. In parallel, reinforce the decision-making prerogatives of national health data access bodies, and clarify their relation with ERBs and DPAs.
3	Clarify the obligations and rights of health professionals in relation to data and avoid situations where they are held liable for data that they do not control.
4	The EHDS needs to be cut to size to make it workable. Digital integration in healthcare is a great opportunity, but only if we learn from the experiences of the past and work with manageable aims, incremental steps, and clear governance of data use and reuse. This should include starting with sharp focus areas instead of an all-encompassing behemoth, and with significantly limited quantities and types of data in proportion to the necessity of sharing such data, while taking carefully into account the actual quality and usefulness of the data for the intended uses.
5	The EHDS or accompanying legislation should include specific provisions to ensure that the public value of health data re-use is assessed and audited and that commercial profits obtained with people's data are shared with the people and communities that have made these profits possible in the first place. Benefit sharing agreements and licensing requirements are relevant options in this regard.
6	Notwithstanding the point made in recommendation n° 7, efforts to strengthen digital capacities across society (i.e. internet access, cloud storage, digital equipment and digital literacy), including for health professionals and vulnerable populations, should be regarded as a necessary prerequisite before the EHDS is implemented.
7	Resources devoted to the EHDS must not detract from the provision of high-quality healthcare, and the implementation of other effective low-tech interventions (e.g. hiring clinicians, sustaining screening programs, reducing waiting lists) benefiting all social groups and European societies at large.

Author contributions

Conceptualization: L.M., M.St., T.Sh., I.V.H.

Analysis: L.M., M.St., T.Sh., I.V.H., M.B., I.C., A.D.M., S.E.S., K.H., R.V.K., D.K.Z., M.M., S.R., B.P., I.S., M.Sh., T.So.

Writing – original draft: L.M., M.St., T.Sh., I.V.H.

Writing – review & editing: M.B., I.C., A.D.M., S.E.S., K.H., R.V.K., D.K.Z., M.M., S.R., B.P., I.S., M.Sh., T.So.

Funding

European Union's Horizon 2020 research and innovation Programme, grant agreement 945263 (IMMERSE) (L.M., I.V.H.).

The Research Foundation – Flanders (FWO) WOG Grant 3H190080 (I.V.H., L.M.)

European Research Council (ERC), Grant Number 804985 (T.Sh., M.St.)

Cariplo Foundation (Social Science Research Grant), grant 2020-1314 (L.M.).

European Union's Horizon 2020 research and innovation Programme, grant agreement 874662 (HEAP) (M.B.).

European Research Council (ERC), grant agreement number 101096999 (K.H.).

European Union's Horizon Europe Programme, grant agreement 101057775 (NeuroCOV) (I.V.H., L.M.).

National Science Center, Poland Grant No. 2016/23/D/HS5/00411 (D.K.Z.).

Privasa project funded by Business Finland (TSo)

Declaration of Competing Interest

Authors declare that they have no competing interests.