European Health Data Space (EHDS): What Hospitals Must Know in 2026

The essentials in 30 seconds

Introduction

The European Health Data Space (EHDS) is the most structuring piece of health data legislation Europe has passed since the GDPR. Yet most hospitals still hold their clinical data in fragmented, hard-to-exchange systems. Reports, images and lab results live in silos that rarely talk to each other, let alone to a hospital in another country.

This fragmentation has a daily cost: information re-entered by hand, exams repeated for lack of history, and research projects that stall because the data is not usable. The EHDS was designed to break these silos, for care first and for research second.

Galeon approaches this shift from the field. Our smart EHR, an AI-assisted electronic health record built with caregivers since 2016, is deployed in 19 hospitals including 2 university hospitals, covers more than 3 million patient records and is used by over 10,000 caregivers. Its guiding principle is simple: structure health data at the point of care, with the people who produce it.

This article explains what the EHDS actually changes, its phased timeline, and what it means concretely for a CIO, a hospital director or a health information officer. The goal is to prepare, not to panic.

What is the European Health Data Space, and why does it matter?

The European Health Data Space is a European regulation that sets common rules for accessing, exchanging and reusing electronic health data across the Union. Adopted as Regulation (EU) 2025/327, it entered into force in March 2025 and will apply progressively over the following years.

It rests on two pillars. Primary use covers data used to treat a patient. Secondary use covers data reused, under conditions, for research, innovation, public health and health-system steering. Both pillars share the same foundation: interoperable, structured, portable data.

For a hospital, the EHDS is less a new software to buy than a new quality standard for the data it already produces. The regulation makes structured, exchangeable data a legal expectation rather than a nice-to-have.

What does the EHDS change for cross-border care (primary use)?

Primary use is the reuse of health data to deliver care to the patient it belongs to. The EHDS gives patients the right to access their electronic health data and to have it shared with the professionals treating them, including in another Member State.

Concretely, the regulation prioritises five categories of data: patient summaries, electronic prescriptions and dispensations, medical images and image reports, laboratory results, and discharge reports. These will circulate through MyHealth@EU, the European exchange infrastructure that connects national systems.

To make this possible, health records must speak a common language: the European electronic health record exchange format, which builds on international standards such as HL7 FHIR. A patient summary written in Lyon should be readable in Lisbon without manual re-entry.

What is secondary use, and how is it governed?

Secondary use is the reuse of health data for purposes other than direct care: scientific research, innovation, public health, patient safety, official statistics and policy-making. It is the part of the EHDS with the greatest research potential, and the tightest safeguards.

Access is not open. Each Member State designates one or more Health Data Access Bodies, public authorities that receive requests, check their purpose and issue a time-limited data permit. In France, the Health Data Hub is expected to play a central role in this mission.

The rules are protective by design. Data is made available in secure processing environments, generally in pseudonymised or anonymised form, and researchers analyse it without downloading raw records. Several uses are explicitly banned, including advertising and decisions that could harm individuals, such as raising insurance premiums.

Patients keep control. The regulation requires Member States to offer an opt-out mechanism, so a person can refuse the secondary use of their data. Secondary use widens access to knowledge without turning health data into an open marketplace.

What is the EHDS deployment timeline?

The short answer: gradual. The regulation entered into force in 2025, but its concrete obligations apply in waves rather than all at once, to give Member States and vendors time to adapt.

As a general rule, the core provisions for both primary and secondary use begin to apply around four years after entry into force, so from roughly 2029 for the priority data categories. Other categories, such as medical images or laboratory results, follow later, typically around 2031, and a few specific data types benefit from an even longer runway.

These horizons should be read as a direction of travel, not as fixed calendar dates for every obligation. The prudent reading for a hospital is simple: the deadlines feel distant, but the preparation is not, because data structuring takes years, not months.

What does the EHDS mean for a hospital CIO (DSI)?

For a chief information officer, the EHDS turns interoperability from a project into a permanent requirement. The direct answer: your information system must be able to produce, structure and export the priority data categories in the European format.

Three priorities stand out. First, structure data at source rather than extracting and cleaning it after the fact. Second, align with international standards (HL7 FHIR, LOINC, SNOMED CT) that underpin the European format. Third, keep hosting compliant, in France through HDS certification, the framework that governs the hosting of health data entrusted to a third party, whose current reference is the HDS 2024 standard aligned with ISO 27001:2022.

In France, this work overlaps heavily with the Ségur du numérique en santé programme and the interoperability roadmap led by the Agence du Numérique en Santé. A hospital that has already invested in Ségur has done part of the EHDS groundwork.

What should hospital executives (DG) and health information officers (DIM) anticipate?

For a general director, the EHDS is a strategic and reputational matter as much as a technical one. Hospitals that structure their data well will be able to join research consortia, benchmark their activity and value their data ethically, while laggards will face costly catch-up.

For the health information department (DIM), the regulation reinforces a familiar mission: coding quality, completeness and consistency. The DIM sits at the junction of medical meaning and data structure, which makes it a natural pilot for EHDS readiness.

Caregivers are not spectators either. The quality of structured data depends on what is captured during the consultation, which is why tools that structure information without adding clerical burden matter. Good data governance starts at the bedside, not in the data warehouse.

Traditional EHR vs Galeon: who is ready for the EHDS?

The gap between systems is not about intentions but about where the data work happens. The table below compares a common traditional setup with Galeon's approach, without pretending either extreme describes every product on the market.

Limits and challenges to be aware of

The EHDS is an opportunity, but an honest reading means naming its difficulties.

• A long and evolving timeline: the phased application dates will be refined through implementing acts, so the exact obligations per data category are not all fully settled yet.
• A real structuring effort: moving from free text to standardised, coded data is demanding and cannot be improvised in the final months before a deadline.
• Governance complexity: the roles of Health Data Access Bodies, digital health authorities and existing national actors will take time to stabilise in each country.
• Investment and skills: interoperability, security and data quality require budget and expertise that not every hospital has readily available.
• No single magic tool: no EHR, Galeon included, makes a hospital instantly compliant; readiness is a continuous process, not a switch to flip.

FAQ

Is the EHDS the same as the GDPR?
No. The GDPR sets the general rules for processing personal data, while the EHDS builds on it with specific rules for exchanging and reusing health data. The EHDS complements the GDPR, it does not replace it.

Does the EHDS force hospitals to share patient data openly?
No. Primary use serves the patient's own care, and secondary use is tightly controlled through data permits, secure environments and an opt-out for patients. There is no open, unrestricted access to raw records.

When will the EHDS really apply to my hospital?
Progressively. Core obligations are expected to start applying around 2029 for priority data categories, with others following in the early 2030s. The exact dates depend on forthcoming implementing acts.

What is the difference between primary and secondary use?
Primary use is data used to treat the patient it concerns, including across borders. Secondary use is the controlled reuse of data for research, innovation and public health.

What should we prioritise now?
Data structuring and interoperability. Adopting standards such as HL7 FHIR, improving coding quality and keeping HDS-certified hosting are the investments that pay off whatever the final calendar.

Does Galeon make us EHDS-compliant?
Galeon does not sell instant compliance. It structures caregiver-validated data at source, which reduces the work needed to meet EHDS interoperability and secondary-use expectations.

In summary

The European Health Data Space is a structural shift, not a passing regulation. It organises health data around two uses, care and research, on a shared base of interoperable, structured and portable data. Its timeline is gradual, mostly from around 2029, which leaves room to prepare but no reason to wait, because data quality is built over years. For a hospital, the real project is not buying compliance but raising the quality and structure of the data produced every day. This is exactly where Galeon has worked since 2016: a smart EHR that structures caregiver-validated data at the point of care, deployed across 19 hospitals, and designed so that clinical data is usable for care today and research tomorrow. Hospitals that treat data quality as a clinical priority now will meet the EHDS as a formality, not a scramble.

To go further: GDPR and health data, what every hospital CIO needs to know in 2026

Sources

• European Commission — The European Health Data Space
• EUR-Lex — Regulation (EU) 2025/327 on the European Health Data Space
• Agence du Numérique en Santé — interoperability and the Ségur programme
• CNIL — health data protection
• Health Data Hub — secondary use of health data in France
• Galeon — HDS certification in 2026
• Galeon — Smart EHR vs traditional EHR
• Galeon — AI and health data, what every hospital must master in 2026

‍