SECTION 1 — Rights of natural persons in relation to the primary use of their personal electronic health data, and related provisions
Right of natural persons to access their personal electronic health data
1. Natural persons shall have the right to access at least personal electronic health data relating to them that belong to the priority categories referred to in Article 14 and are processed for the provision of healthcare through the electronic health data access services referred to in Article 4. Access shall be provided immediately after the personal electronic health data have been registered in an EHR system, while respecting the need for technological practicability, and shall be provided free of charge and in an easily readable, consolidated and accessible format.
2. Natural persons, or their representatives referred to in Article 4(2), shall have the right to download free of charge an electronic copy of at least the personal electronic health data in the priority categories referred to in Article 14 related to those natural persons, through the electronic health data access services referred to in Article 4, in the European electronic health record exchange format referred to in Article 15.
3. In accordance with Article 23 of Regulation (EU) 2016/679, Member States may restrict the scope of rights provided for in paragraphs 1 and 2 of this Article, in particular whenever those restrictions are necessary to protect natural persons, on the basis of patient safety and ethical considerations by delaying access to their personal electronic health data for a limited period of time until a health professional is able to properly communicate and explain to the natural persons concerned information that can have a significant impact on their health.
Electronic health data access services for natural persons and their representatives
1. Member States shall ensure that one or more electronic health data access services at national, regional or local level are established, thereby enabling natural persons to access their personal electronic health data and exercise their rights provided for in Articles 3 and 5 to 10. Such electronic health data access services shall be free of charge for the natural persons and their representatives referred to in paragraph 2 of this Article.
2. Member States shall ensure that one or more proxy services are established as a functionality of electronic health data access services which enables:
(a)
natural persons to authorise other natural persons of their choice to access their personal electronic health data, or part thereof, on their behalf for a limited or unlimited period and, if needed, for a specific purpose only, and to manage those authorisations; and
(b)
legal representatives of natural persons to access personal electronic health data of those natural persons whose affairs they administer, in accordance with national law.
Member States shall establish rules regarding the authorisations referred to in point (a) of the first subparagraph and actions of guardians and other legal representatives.
3. The proxy services referred to in paragraph 2 shall provide authorisations in a transparent and easily understandable way, free of charge, and electronically or on paper. Natural persons and their representatives shall be informed about their authorisation rights, including about how to exercise those rights, and about the authorisation process.
The proxy services shall provide an easy complaint mechanism for natural persons.
4. The proxy services referred to in paragraph 2 of this Article shall be interoperable among Member States. The Commission shall, by means of implementing acts, lay down the technical specifications for the interoperability of the proxy services of the Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
5. The electronic health data access services and the proxy services shall be easily accessible for persons with disabilities, vulnerable groups and persons with low digital literacy.
Right of natural persons to insert information in their own EHR
Natural persons, or their representatives referred to in Article 4(2), shall have the right to insert information in the EHR of those natural persons through electronic health data access services or applications linked to those services as referred to in that Article. That information shall be clearly distinguishable as having been inserted by the natural person or by his or her representative. Natural persons, or their representatives referred to in Article 4(2), shall not be able to directly alter the electronic health data and related information inserted by health professionals.
Right of natural persons to rectification
Electronic health data access services referred to in Article 4 shall enable natural persons to easily request online the rectification of their personal electronic health data in accordance with Article 16 of Regulation (EU) 2016/679. Where appropriate, the controller shall verify with a relevant health professional the accuracy of the information provided in the request.
Member States may also enable natural persons to exercise online other rights pursuant to Chapter III of Regulation (EU) 2016/679 through electronic health data access services.
Right to data portability for natural persons
1. Natural persons shall have the right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems used by that healthcare provider.
2. Natural persons shall have the right, where the healthcare providers are located in different Member States, to request the transmission of their personal electronic health data in the European electronic health record exchange format referred to in Article 15 through the cross-border infrastructure referred to in Article 23. The receiving healthcare provider shall accept such data and shall be able to read them.
3. Natural persons shall have the right to request a healthcare provider to transmit a part of their personal electronic health data to a clearly identified recipient in the social security or reimbursement services sector. Such transmission shall be carried out immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems used by that healthcare provider, and shall be one-way only.
4. Where natural persons have downloaded an electronic copy of their priority categories of personal electronic health data in accordance with Article 3(2), they shall be able to transmit those data to healthcare providers of their choice in the European electronic health record exchange format referred to in Article 15. The receiving healthcare provider shall accept such data and be able to read them, as applicable.
Right to restrict access
Natural persons shall have the right to restrict the access of health professionals and healthcare providers to all or parts of their personal electronic health data as referred to in Article 3.
When exercising the right referred to in the first paragraph, natural persons shall be made aware that restricting access might impact the provision of healthcare to them.
The fact that a natural person has restricted access under the first paragraph shall not be visible to healthcare providers.
Member States shall establish the rules and specific safeguards regarding such restriction mechanisms.
Right to obtain information on accessing data
1. Natural persons shall have the right to obtain information, including through automatic notifications, on any access to their personal electronic health data through the health professional access service obtained in the context of healthcare, including access provided in accordance with Article 11(5).
2. The information referred to in paragraph 1 shall be provided, free of charge and without delay, through electronic health data access services and shall be available for at least three years from each date of access to the data. That information shall include at least the following:
(a)
information on the healthcare provider or other individuals who accessed the personal electronic health data;
(b)
the date and time of access;
(c)
which personal electronic health data were accessed.
3. Member States may provide for restrictions to the right referred to in paragraph 1 in exceptional circumstances, where there are factual indications that disclosure would endanger the vital interests or rights of the health professional or the care of the natural person.
Right of natural persons to opt out in primary use
1. Member States’ laws may provide that natural persons have the right to opt out from the access to their personal electronic health data registered in an EHR system through the electronic health data access services referred to in Articles 4 and 12. In such cases, Member States shall ensure that the exercise of that right is reversible.
2. If a Member State provides for a right referred to in paragraph 1 of this Article, it shall establish the rules and specific safeguards regarding the opt-out mechanism. In particular, Member States may provide for a healthcare provider or health professional to be able to get access to the personal electronic health data in cases where processing is necessary in order to protect the vital interests of the data subject or of another natural person as referred to in Article 9(2), point (c), of Regulation (EU) 2016/679, even if the patient has exercised the right to opt out in primary use.
Access by health professionals to personal electronic health data
1. Where health professionals process data in an electronic format, they shall have access to the relevant and necessary personal electronic health data of natural persons under their treatment through the health professional access services referred to in Article 12, irrespective of the Member State of affiliation and the Member State of treatment.
2. Where the Member State of affiliation of the natural person under treatment and the Member State of treatment of such natural person differ, cross-border access to the personal electronic health data of the natural person under treatment shall be provided through the cross-border infrastructure referred to in Article 23.
3. The access referred to in paragraphs 1 and 2 of this Article shall include at least the priority categories of personal electronic health data referred to in Article 14.
In line with the principles provided for in Article 5 of Regulation (EU) 2016/679, Member States shall establish rules providing for the categories of personal electronic health data accessible by different categories of health professionals or for different healthcare tasks. Such rules shall take into account the possibility of restrictions imposed under Article 8 of this Regulation.
4. In the case of treatment in a Member State other than the Member State of affiliation, the rules referred to in paragraph 3 shall be those of the Member State of treatment.
5. Where access to personal electronic health data has been restricted by a natural person pursuant to Article 8, the healthcare provider or health professional shall not be informed of the restricted content of those data.
By way of derogation from the first paragraph of Article 8, where necessary in order to protect the vital interests of the data subject, the healthcare provider or health professional may be granted access to the restricted electronic health data. Such cases shall be logged in a clear and understandable format and shall be easily accessible for the data subject.
Member States may provide for additional safeguards.
Health professional access services
For the provision of healthcare, Member States shall ensure that health professionals are able to access free of charge the priority categories of personal electronic health data referred to in Article 14, including for cross-border care, through health professional access services.
The services referred to in the first paragraph of this Article shall be accessible only to health professionals who are in possession of electronic identification means which are recognised pursuant to Article 6 of Regulation (EU) No 910/2014 or other electronic identification means compliant with common specifications referred to in Article 36 of this Regulation.
Personal electronic health data shall be presented in a user-friendly manner in the electronic health records to allow for easy use by health professionals.
Registration of personal electronic health data
1. Member States shall ensure that, where electronic health data are processed for the provision of healthcare, healthcare providers register the relevant personal electronic health data falling fully or partially under at least the priority categories of personal electronic health data referred to in Article 14 in an electronic format in an EHR system.
2. When processing data in an electronic format, healthcare providers shall ensure that the personal electronic health data of the natural persons under their treatment are updated with information related to the healthcare.
3. Where personal electronic health data are registered in a Member State of treatment that differs from the Member State of affiliation of the natural person concerned, the Member State of treatment shall ensure that the registration is performed under the identification data of the natural person in the Member State of affiliation.
4. By 26 March 2027, the Commission shall, by means of implementing acts, determine data quality requirements, including in relation to semantics, uniformity, consistency, accuracy and completeness, for the registration of personal electronic health data in an EHR system as relevant. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
When personal electronic health data are registered or updated, the electronic health records shall identify the health professional and healthcare provider that carried out such registration or update, and the time at which such registration or update was carried out. Member States may require other aspects of data registration to be recorded.
Priority categories of personal electronic health data for primary use
1. For the purposes of this Chapter, where data are processed in electronic format the priority categories of personal electronic health data shall be the following:
(a)
patient summaries;
(b)
electronic prescriptions;
(c)
electronic dispensations;
(d)
medical imaging studies and related imaging reports;
(e)
medical test results, including laboratory and other diagnostic results and related reports; and
(f)
discharge reports.
The main characteristics of the priority categories of personal electronic health data for primary use shall be as set out in Annex I.
Member States may provide in their national law for additional categories of personal electronic health data to be accessed and exchanged for primary use pursuant to this Chapter.
The Commission may, by means of implementing acts, lay down cross-border specifications for the categories of personal electronic health data referred to in the third subparagraph of this paragraph pursuant to Article 15(3) and Article 23(8). Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
2. The Commission is empowered to adopt delegated acts in accordance with Article 97 to amend this Regulation by amending Annex I through the addition, modification or removal of the main characteristics of the priority categories of personal electronic health data as referred to in paragraph 1, provided that the amendments are aimed at adapting the priority categories of personal electronic health data to technical developments and international standards. Moreover, additions and modifications of those characteristics shall satisfy both of the following criteria:
(a)
the characteristic is relevant for healthcare provided to natural persons;
(b)
the characteristic is used in the majority of Member States according to the most recent information.
European electronic health record exchange format
1. By 26 March 2027, the Commission shall, by means of implementing acts, lay down the technical specifications for the priority categories of personal electronic health data referred to in Article 14(1), setting out the European electronic health record exchange format. Such format shall be commonly used, machine-readable and allow transmission of personal electronic health data between different software applications, devices and healthcare providers. Such format shall support transmission of structured and unstructured health data and shall include the following elements:
(a)
harmonised datasets containing electronic health data and defining structures, such as data fields and data groups for the representation of clinical content and other parts of the electronic health data;
(b)
coding systems and values to be used in datasets containing electronic health data;
(c)
technical interoperability specifications for the exchange of electronic health data, including its content representation, standards and profiles.
The implementing acts referred to in the first subparagraph of this paragraph shall be adopted in accordance with the examination procedure referred to in Article 98(2).
2. The Commission shall, by means of implementing acts, provide regular updates of the European electronic health record exchange format to integrate relevant revisions of the healthcare coding systems and nomenclatures. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
3. The Commission may, by means of implementing acts, lay down technical specifications to extend the European electronic health record exchange format to additional categories of personal electronic health data referred to in Article 14(1), third subparagraph. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
4. Member States shall ensure that the priority categories of personal electronic health data referred to in Article 14 are issued in the European electronic health record exchange format referred to in paragraph 1 of this Article. Where such data are transmitted by automated means for primary use, the receiving provider shall accept the format of the data and be able to read them.
Identification management
1. Where natural persons use electronic health data access services referred to in Article 4, those natural persons shall have the right to identify themselves electronically using any electronic identification means which are recognised pursuant to Article 6 of Regulation (EU) No 910/2014. Member States may provide complementary mechanisms to ensure appropriate identity matching in cross-border situations.
2. The Commission shall, by means of implementing acts, determine the requirements for the interoperable, cross-border identification and authentication mechanism for natural persons and health professionals, in accordance with Regulation (EU) No 910/2014. That mechanism shall facilitate the transferability of personal electronic health data in a cross-border context. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
3. The Commission, in cooperation with Member States, shall implement services required by the interoperable, cross-border identification and authentication mechanism referred to in paragraph 2 of this Article at Union level, as part of the cross-border infrastructure referred to in Article 23.
4. The Member States’ competent authorities and the Commission shall implement the interoperable, cross-border identification and authentication mechanism at Member State and Union level, respectively.
Requirements for technical implementation
The Commission shall, by means of implementing acts, determine the requirements for the technical implementation of the rights set out in this Section.
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
Compensation for making personal electronic health data available
Providers receiving data under this Chapter shall not be required to compensate the healthcare provider for making personal electronic health data available. A healthcare provider or a third party shall not directly or indirectly charge data subjects a fee or costs, or require compensation, for sharing or accessing data.
SECTION 2 — Governance for primary use
Digital health authorities
1. Each Member State shall designate one or more digital health authorities responsible for the implementation and enforcement of this Chapter at national level. The Member States shall inform the Commission of the identity of the digital health authorities by 26 March 2027. Where a Member State designates more than one digital health authority or where the digital health authority consists of multiple organisations, the Member State concerned shall communicate to the Commission a description of the distribution of tasks between those various authorities or organisations. Where a Member State designates several digital health authorities, it shall designate one digital health authority to act as coordinator. The Commission shall make that information publicly available.
2. Each digital health authority shall be entrusted with the following tasks and powers:
(a)
ensuring the implementation of the rights and obligations provided for in this Chapter and Chapter III by adopting necessary national, regional or local technical solutions and by establishing relevant rules and mechanisms;
(b)
ensuring that complete and up-to-date information about the implementation of rights and obligations provided for in this Chapter and Chapter III is made readily available to natural persons, health professionals and healthcare providers;
(c)
in the implementation of technical solutions referred to in point (a) of this paragraph, ensuring that such technical solutions comply with this Chapter, Chapter III and Annex II;
(d)
contributing at Union level to the development of technical solutions enabling natural persons and health professionals to exercise their rights and comply with their obligations set out in this Chapter;
(e)
facilitating persons with disabilities to exercise their rights under this Chapter in accordance with Directive (EU) 2019/882 of the European Parliament and of the Council ( 31 ) ;
(f)
supervising the national contact points for digital health and cooperating with other digital health authorities and the Commission on further development of MyHealth@EU;
(g)
ensuring the implementation at national level of the European electronic health record exchange format, in cooperation with national authorities and stakeholders;
(h)
contributing at Union level to the development of the European electronic health record exchange format, to the elaboration of common specifications, in accordance with Article 36, which address quality, interoperability, security, safety, ease of use, accessibility, non-discrimination or fundamental right concerns, and to the elaboration of the specifications of the EU database for registration of EHR systems and wellness applications referred to in Article 49;
(i)
where applicable, performing market surveillance activities in accordance with Article 43, while ensuring that any conflicts of interest are avoided;
(j)
building national capacity for implementing requirements concerning interoperability and security of electronic health data for primary use and participating in information exchanges and capacity building activities at Union level;
(k)
cooperating with market surveillance authorities, participating in the activities related to handling of risks posed by EHR systems and of serious incidents and supervising the implementation of corrective action in accordance with Article 44;
(l)
cooperating with other relevant entities and bodies at local, regional, national or Union level, to ensure interoperability, portability and security of electronic health data;
(m)
cooperating with supervisory authorities in accordance with Regulations (EU) No 910/2014 and (EU) 2016/679 and Directive (EU) 2022/2555 of the European Parliament and of the Council ( 32 ) and with other relevant authorities, including those competent for cybersecurity and electronic identification.
3. Each Member State shall ensure that each digital health authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers.
4. In the performance of its tasks, each digital health authority shall avoid any conflicts of interest. Each member of staff of the digital health authority shall act in the public interest and in an independent manner.
5. In the performance of their tasks, the relevant digital health authorities shall actively cooperate and consult with relevant stakeholders’ representatives, including patients’ representatives, healthcare providers and health professionals’ representatives, including health professional associations, as well as consumer organisations and industry associations.
Reporting by digital health authorities
Digital health authorities designated pursuant to Article 19 shall publish an activity report every two years, which shall contain a comprehensive overview of their activities. If a Member State designates more than one digital health authority, one of them shall be responsible for the drawing up of the report and, in doing so, it shall request the necessary information from the other digital health authorities. That activity report shall follow a structure agreed at Union level within the European Health Data Space Board (the ‘EHDS Board’) referred to in Article 92. That activity report shall contain at least information concerning:
(a)
the measures taken to implement this Regulation;
(b)
the percentage of natural persons having access to the various data categories of their electronic health records;
(c)
the handling of requests from natural persons regarding the exercise of their rights pursuant to this Regulation;
(d)
the number of healthcare providers of different types, including pharmacies, hospitals and other points of care, connected to MyHealth@EU calculated:
(i)
in absolute terms;
(ii)
as a share of all healthcare providers of the same type; and
(iii)
as a share of natural persons that are able to use the services;
(e)
the volumes of electronic health data of different categories shared across borders through MyHealth@EU;
(f)
the number of cases of non-compliance with mandatory requirements.
Right to lodge a complaint with a digital health authority
1. Without prejudice to any other administrative or judicial remedy, natural and legal persons shall have the right to lodge a complaint in relation to the provisions laid down in this Chapter, individually or, where relevant, collectively, with the competent digital health authority, provided that their rights or interests are negatively affected.
2. Where the complaint concerns the rights of natural persons pursuant to Articles 3 and 5 to 10 of this Regulation, the digital health authority shall transmit the complaint to the competent supervisory authorities under Regulation (EU) 2016/679. The digital health authority shall provide the necessary information at its disposal to the competent supervisory authority under Regulation (EU) 2016/679 in order to facilitate the assessment and investigation of the complaint.
3. The competent digital health authority with which the complaint has been lodged shall inform, in accordance with national law, the complainant of the progress made in dealing with the complaint, of the decision taken on the complaint, of any referral of the complaint to the competent supervisory authority under Regulation (EU) 2016/679 and, in cases of such a referral, that that supervisory authority is, from that moment on, to be the sole point of contact for the complainant in that matter.
4. Digital health authorities in the Member States concerned shall cooperate to handle and resolve complaints related to cross-border exchange of and access to personal electronic health data, including by exchanging all relevant information by electronic means, without undue delay.
5. Digital health authorities shall facilitate the submission of complaints and provide easily accessible tools for the submission of complaints.
Relationship with supervisory authorities under Regulation (EU) 2016/679
The supervisory authority or supervisory authorities responsible for monitoring and enforcing the application of Regulation (EU) 2016/679 shall also be competent for monitoring and enforcing the application of Articles 3 and 5 to 10 of this Regulation. The relevant provisions of Regulation (EU) 2016/679 shall apply mutatis mutandis . Supervisory authorities shall be empowered to impose administrative fines up to the amount referred to in Article 83(5) of Regulation (EU) 2016/679.
The supervisory authorities referred to in the first paragraph of this Article and digital health authorities referred to in Article 19 shall, where relevant, cooperate in the enforcement of this Regulation, within the remit of their respective competences.
SECTION 3 — Cross-border infrastructure for primary use of personal electronic health data
MyHealth@EU
1. The Commission shall establish a central interoperability platform for digital health (‘MyHealth@EU’) to provide services to support and facilitate the exchange of personal electronic health data between the national contact points for digital health of the Member States.
2. Each Member State shall designate one national contact point for digital health, as an organisational and technical gateway for the provision of services linked to the cross-border exchange of personal electronic health data in the context of primary use. Each national contact point for digital health shall be connected to all other national contact points for digital health in other Member States and to the central interoperability platform for digital health in the cross-border infrastructure MyHealth@EU. Where a national contact point for digital health is an entity consisting of multiple organisations responsible for implementing different services, the Member State concerned shall communicate to the Commission a description of the distribution of tasks between the organisations. Each Member State shall inform the Commission of the identity of its national contact point for digital health by 26 March 2027. The national contact point for digital health may be designated within the digital health authority referred to in Article 19. Member States shall inform the Commission of any subsequent modification of the identity of those national contact points for digital health. The Commission and the Member States shall make that information publicly available.
3. Each national contact point for digital health shall enable the exchange of the personal electronic health data referred to in Article 14(1) with national contact points for digital health in other Member States through MyHealth@EU. That exchange shall be based on the European electronic health record exchange format.
Where Member States provide for additional categories of personal electronic health data under Article 14(1), third subparagraph, the national contact point for digital health shall enable the exchange of the additional categories of personal electronic health data referred to in Article 14(1), third subparagraph, insofar as the Member State concerned has provided for those additional categories of personal electronic health data to be accessed and exchanged in accordance with Article 14(1), third subparagraph.
4. By 26 March 2027, the Commission shall, by means of implementing acts, adopt the necessary measures for the technical development of MyHealth@EU, detailed rules concerning the security, confidentiality and protection of personal electronic health data and the conditions for compliance checks necessary to join and remain connected to MyHealth@EU. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
5. Member States shall ensure the connection of all healthcare providers to their national contact points for digital health. Member States shall ensure that connected healthcare providers are able to perform two-way exchanges of electronic health data with the national contact point for digital health.
6. Member States shall ensure that pharmacies operating on their territories, including online pharmacies, are able to dispense electronic prescriptions issued in other Member States, under the conditions laid down in Article 11 of Directive 2011/24/EU.
Pharmacies shall access and accept electronic prescriptions transmitted to them from other Member States through MyHealth@EU, provided that the conditions laid down in Article 11 of Directive 2011/24/EU are fulfilled.
Following the dispensation of medicinal products based on an electronic prescription from another Member State, the pharmacy concerned shall report through MyHealth@EU such dispensation to the national contact point for digital health of the Member State in which that prescription was issued.
7. The national contact points for digital health shall act as joint controllers of the personal electronic health data communicated through MyHealth@EU for the processing operations in which they are involved. The Commission shall act as processor.
8. The Commission shall, by means of implementing acts, lay down the rules regarding the requirements of cybersecurity, technical interoperability, semantic interoperability, operations and service management in relation to the processing by the processor referred to in paragraph 7 of this Article and its responsibilities towards the controllers, in accordance with Chapter IV of Regulation (EU) 2016/679. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
9. The national contact points for digital health shall fulfil the conditions to join and to remain connected to MyHealth@EU as laid down in the implementing acts referred to in paragraph 4. The compliance of the national contact points for digital health with those conditions shall be verified by the Commission through compliance checks.
Supplementary cross-border digital health services and infrastructures
1. Member States may provide through MyHealth@EU supplementary services that facilitate telemedicine, mobile health, access by natural persons to existing translations of their health data, exchange or verification of health-related certificates, including vaccination card services supporting public health and public health monitoring or digital health systems, services and interoperable applications, with a view to achieving a high level of trust and security, enhancing continuity of care and ensuring access to safe and high-quality healthcare. The Commission shall, by means of implementing acts, set out the technical aspects of such supplementary services. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
2. The Commission and Member States may facilitate the exchange of personal electronic health data with other infrastructures, such as the Clinical Patient Management System or other services or infrastructures in the health, care or social security fields which may become authorised participants in MyHealth@EU. The Commission shall, by means of implementing acts, set out the technical aspects of such exchanges. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
The connection and disconnection of another infrastructure to or from the central platform for digital health shall be subject to a decision of the Commission adopted by means of an implementing act, based on the result of compliance checks of the technical aspects of exchanges as referred to in the first subparagraph of this paragraph. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 98(2).
3. A national contact point for digital health of a third country or a system established at international level by an international organisation may become an authorised participant in MyHealth@EU, provided that it fulfils the requirements of MyHealth@EU for the purposes of the personal electronic health data exchange as referred to in Article 23, that the transfer stemming from the connection to MyHealth@EU complies with the rules in Chapter V of Regulation (EU) 2016/679, and that the requirements concerning legal, organisational, operational, semantic, technical and cybersecurity measures are equivalent to those applicable to Member States in the operation of MyHealth@EU services. Those requirements shall be verified by the Commission through compliance checks.
Based on the outcome of the compliance checks referred to in the first subparagraph of this paragraph, the Commission may, by means of implementing acts, decide to connect or disconnect the national contact point for digital health of the third country or the system established at international level by an international organisation, as applicable, to or from MyHealth@EU. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 98(2).
The Commission shall establish and maintain a list of national contact points for digital health of third countries or of systems established at international level by international organisations which are connected to MyHealth@EU pursuant to this paragraph and shall make that list publicly available.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
