Identification and authentication of natural persons for the cross-border exchange of personal electronic health data
Article 4
1. Before requesting the exchange of personal electronic health data of a natural person through MyHealth@EU, the health professional or healthcare provider shall identify that natural person. For that purpose, the health professional or healthcare provider may collect the healthcare attributes of the natural person. 2. Where a health professional or healthcare provider requests the exchange of personal electronic health data of a natural person through MyHealth@EU following a natural person’s request submitted online, that health professional or healthcare provider shall identify and authenticate that natural person using electronic identification means issued in accordance with Regulation (EU) No 910/2014. The electronic identification means shall comply with the requirements of Regulation (EU) 910/2014 and provide an assurance level that is at least substantial as referred to in Article 8(2), point (b), of Regulation (EU) No 910/2014. From 26 March 2030 the electronic identification means shall provide the assurance level high, referred to in Article 8(2), point (c), of the same Regulation. The electronic identification means shall be notified at the required assurance level to the Commission pursuant to Regulation (EU) No 910/2014, or its assurance level shall be confirmed by a conformity assessment body referred to in Article 2, point (13), of Regulation (EC) No 765/2008 or an equivalent body. 3. Where a natural person has been authorised by another natural person to access their personal electronic health data, or part thereof, on their behalf or acts as the legal representative of another natural person in accordance with Article 4(2) of Regulation (EU) 2025/327, the health professional or healthcare provider shall identify that natural person and verify that the authorised natural person or the legal representative satisfy the necessary requirements to act in that capacity.