Commission Implementing Regulation (EU) 2026/2099 of 21 September 2026 on an interoperable, cross-border identification and authentication mechanism for natural persons, health professionals and healthcare providers for the purposes of the cross-border exchange of personal electronic health data
In force
Version historyWe hold this version only; in force from 2026-09-21.
Data as of 2026-10-15 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
Subject matter
This Regulation lays down the requirements for the interoperable, cross-border identification and authentication mechanism for natural persons, health professionals and healthcare providers for the purposes of cross-border exchange of electronic health data.
Definitions
For the purposes of this Regulation the following shall definitions apply: (1) ‘healthcare attribute’ means an attribute that is used for the identification of a natural person for the purposes of cross-border exchange of electronic health data; (2) the definition of ‘attribute’ laid down in Article 3, point (43), of Regulation (EU) 910/2014; (3) the definition of ‘electronic attestation of attributes’ laid down in Article 3, point (44), of Regulation (EU) 910/2014; (4) the definition of ‘European Digital Identity Wallet’ laid down in Article 3, point (42), of Regulation (EU) 910/2014; (5) the definition of ‘authentication’ laid down in Article 3, point (5), of Regulation (EU) 910/2014.
National sets of healthcare attributes of natural persons
1. Each Member State shall determine a set of healthcare attributes to be used to verify the identity of natural persons in connection with their electronic health records for the purposes of the cross-border exchange of their personal electronic health data. 2. Each Member State shall notify its set of healthcare attributes to the Commission by 26 March 2028. Member States shall notify any subsequent updates of the sets of healthcare attributes to the Commission as soon as possible. The Commission shall publish the Member States’ sets of healthcare attributes. 3. Upon request by a natural person, the competent authority in the Member State of affiliation of that person shall issue the healthcare attributes of that natural person in the form of an electronic attestation of attributes in accordance with the set of healthcare attributes defined pursuant to paragraph 1 to that person’s European Digital Identity Wallet.
Identification and authentication of natural persons for the cross-border exchange of personal electronic health data
1. Before requesting the exchange of personal electronic health data of a natural person through MyHealth@EU, the health professional or healthcare provider shall identify that natural person. For that purpose, the health professional or healthcare provider may collect the healthcare attributes of the natural person. 2. Where a health professional or healthcare provider requests the exchange of personal electronic health data of a natural person through MyHealth@EU following a natural person’s request submitted online, that health professional or healthcare provider shall identify and authenticate that natural person using electronic identification means issued in accordance with Regulation (EU) No 910/2014. The electronic identification means shall comply with the requirements of Regulation (EU) 910/2014 and provide an assurance level that is at least substantial as referred to in Article 8(2), point (b), of Regulation (EU) No 910/2014. From 26 March 2030 the electronic identification means shall provide the assurance level high, referred to in Article 8(2), point (c), of the same Regulation. The electronic identification means shall be notified at the required assurance level to the Commission pursuant to Regulation (EU) No 910/2014, or its assurance level shall be confirmed by a conformity assessment body referred to in Article 2, point (13), of Regulation (EC) No 765/2008 or an equivalent body. 3. Where a natural person has been authorised by another natural person to access their personal electronic health data, or part thereof, on their behalf or acts as the legal representative of another natural person in accordance with Article 4(2) of Regulation (EU) 2025/327, the health professional or healthcare provider shall identify that natural person and verify that the authorised natural person or the legal representative satisfy the necessary requirements to act in that capacity.
Requirements for the cross-border exchange of healthcare attributes of natural persons
1. Where a national contact point for digital health requests the exchange of personal electronic health data of a natural person from or to another national contact point for digital health, the first national contact point shall submit the healthcare attributes of the natural person’s Member State of affiliation to the second national contact point. 2. The health professional or healthcare provider requesting the exchange of personal electronic health data pursuant to Article 4(1), regardless of whether the natural person’s request is made in-person or online, shall accept the healthcare attributes provided in the form of an electronic attestation of attributes using a European Digital Identity Wallet. 3. Where the identification means used do not provide the healthcare attributes in full, the health professional or healthcare provider requesting the exchange of personal electronic health data shall request additional information from the natural person to complete the set of healthcare attributes of the Member State of affiliation of the natural person.
Identification, authentication and authorisation of health professionals and healthcare providers for the cross-border exchange of personal electronic health data
1. Each Member State shall list the entity or entities responsible for identifying, authenticating and authorising the health professional or healthcare provider requesting the cross-border exchange of personal electronic health data. 2. Before requesting the cross-border exchange of personal electronic health data through MyHealth@EU, the entity or entities referred to in paragraph 1 shall identify, authenticate and authorise the health professional or healthcare provider requesting that exchange. 3. The entity or entities referred to in paragraph 1 shall identify and authenticate the health professional using electronic authentication means that provides at least the assurance level substantial referred to in Article 8(2), point (b), of Regulation (EU) No 910/2014. From 26 March 2032, the electronic authentication means of health professionals shall provide the assurance level high referred to in Article 8(2), point (c), of that Regulation. The electronic identification means shall be notified at the required assurance level to the Commission pursuant to Regulation (EU) No 910/2014, or its assurance level shall be confirmed by a conformity assessment body referred to in Article 2, point (13), of Regulation (EC) No 765/2008 or an equivalent body.
Requirements for the exchange of the health professional and healthcare provider identification data
When the health professional or healthcare provider requests the cross-border exchange of personal electronic health data through MyHealth@EU, the national contact point for digital health competent for that health professional or healthcare provider shall communicate to the national contact point for digital health receiving the request the identification data of the health professional or healthcare provider. The identification data shall comply with the technical specifications set out in the Annex.
Mechanism for the exchange of identification data through MyHealth@EU
The mechanism for the exchange of identification data through MyHealth@EU shall support: (a) the notification and the publication of the sets of healthcare attributes referred to in Article 3(2) of this Regulation; (b) the exchange of the healthcare attributes between national contact points for digital health described in Article 5(1); (c) the exchange of the identification data of the health professional or healthcare provider between national contact points for digital health described in Article 7.
Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 26 March 2027. However, Article 3(3) and Article 5(2) shall apply from 26 March 2029.
Technical specifications for health professional and healthcare provider identification data referred to in Article 7
ANNEX Technical specifications for health professional and healthcare provider identification data referred to in Article 7 Table 1 Mandatory data for the health professional Data identifier Definition family_name The surname(s) of the health professional. given_name First name(s), including middle name(s) where applicable, of the health professional. country_code Alpha-2 country code as specified in ISO 3166-1, representing the Member State that issued the health professional identification data. hp_identifier A health professional identifier assigned to the health professional that is unique among all health professional identifiers issued in the Member State where the health professional is registered. issuing_authority_name The name of the agency responsible for issuing the health professional identifier. hp_professional_role The professional role of the health professional. healthcare_provider_identifier An identifier of the healthcare provider organisation or healthcare facility where the health professional is providing treatment. This identifier is unique in the Member State that issued it. Table 2 Mandatory data for the healthcare provider Data identifier Definition healthcare_provider_identifier An identifier of the healthcare provider organisation or healthcare facility where the health professional is providing the treatment. This identifier is unique in the Member State that issued it. issuing_authority_name The name of the agency responsible for issuing the healthcare provider identifier. healthcare_provider_name Name of the healthcare provider. healthcare_provider_address Official registered full address of the healthcare provider.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.