AIHealth
On-premise clinical platform with local LLMs, RAG on FHIR/DICOM data, diagnostic support, remote follow-up. Architecture designed for the MDR pathway.
Discover AIHealth →
Digital Health
Medical software development compliant with CE and MDR regulatory standards. Clinical decision support systems, AI integration in clinical workflows.
Discover →One year after the Regulation
Regulation (EU) 2025/327 on the European Health Data Space entered into force on 26 March 2025. Twelve months later, implementation work is in full swing across all Member States. System-wide deadlines are approaching:
- 26 March 2027 — application of most primary use provisions (Chapters II and III): patient rights, provider obligations for patient summary, ePrescription and priority documents, MyHealth@EU as mandatory infrastructure
- 26 March 2028 — application of EHR system requirements (clinical record system conformity assessment)
- 26 March 2029 — application of Chapter IV on secondary use: operational Health Data Access Bodies, HealthData@EU in operation, data permit procedures available
2027 is the first real test of the design. 2029 is the more transformative deadline: for the first time a structured access model to healthcare data for research, innovation and policy will be operational in a harmonised way across Europe.
Commission work: implementing acts
The Regulation provides for a broad set of implementing acts and delegated acts of the Commission to specify the technical aspects that the Regulation itself does not set. In the first twelve months the Commission has launched public consultations and preparatory work on:
- Harmonised data formats for patient summary, ePrescription, laboratory results, imaging reports, discharge reports — referencing FHIR R4/R5 profiles conformant with IPS and European extensions
- Essential requirements for EHR systems and conformity assessment procedures, including interoperability tests
- Technical specifications for MyHealth@EU as mandatory infrastructure, with SLAs, federated identity mechanisms (eIDAS), semantic matching
- HDAB operational procedures, including data permit templates, fees, audit
- HealthData@EU architecture, common interface towards national HDABs
The EHDS Board (established by Article 87 of the Regulation) — with Member State representatives, observers including EMA, ECDC, the European peers of AgID, EDPB — is the main forum in which these acts are discussed. Implementing acts on primary use have already seen the first consultations close in the second half of 2025; publication is expected in a cascade through 2026.
National HDABs
The heaviest institutional task is the construction of the Health Data Access Body in each Member State. Article 55 of the Regulation requires each State to designate one or more public authorities with:
- Functional independence in issuing data permits
- Adequate resources (staff, skills, infrastructure)
- Coordination with the national data protection supervisor (Garante in Italy) and with other competent authorities (AIFA, Agenas, ISS for Italy)
The HDAB receives data access requests for secondary use, assesses purposes and legitimacy, grants or denies the data permit, provides data in a secure processing environment, monitors use and collects fees.
Member States have chosen different organisational models:
- Single national HDAB — option chosen by many States with centralised health systems (Denmark, Netherlands, Finland have existing models that map to this design)
- Federated HDAB — with national coordination and regional or thematic articulations; a natural option for States with regional health systems like Italy and Spain
- HDAB integrated with existing authorities — entrusted to a body already active in research or data (e.g. statistical institutes, biomedical research agencies)
For Italy, HDAB design is under discussion among the Ministry of Health, Ministry of University and Research, AgID, Agenas, ISS, AIFA and the Regions. The most likely scenario is a national governance structure at a national public body, with regional articulations operating on their respective Health Data Ecosystems. Formal designation decisions are expected by mid-2026.
Data permit: how it will work
The data permit is the central secondary use procedure. The requester — which may be a university, research body, pharmaceutical company, public authority, healthcare technology provider — submits to the HDAB:
- Description of the purpose (admitted among those of Article 53) and the expected public benefit
- Requested data with detailed granularity (categories, population, time interval, variables)
- Technical and organisational measures planned to protect the data
- Qualified and documented work team
- Output model (scientific publication, regulatory decision, commercial product)
The HDAB assesses the request, possibly consults oversight bodies (Garante, Ethics Committees for clinical research purposes), and issues the data permit with reasons. The requester accesses the data in a secure environment controlled by the HDAB — no individual data extraction is allowed, only aggregates. The Regulation provides for proportionate fees based on cost, with favourable regimes for public and non-profit research.
Pilots conducted in the early months of 2026 — on a voluntary basis in some Member States — are helping refine procedures, templates, response times and operating costs. Standard estimated times for a data permit decision stand at 60 to 120 days from submission of a complete request.
HealthData@EU and the relationship with DARWIN EU
HealthData@EU is the European federated infrastructure connecting national HDABs for multi-country requests. A researcher wanting to study a pathology with data from several Member States submits the request to one HDAB only (the one of its country or the one designated by the coordination node), which routes the request towards the other competent HDABs. Data remain at each HDAB; the requester runs federated analyses through a single access point.
The model conceptually inherits from DARWIN EU — EMA’s federated regulatory drug assessment network, operational since 2022 on OMOP CDM — and generalises its design beyond regulatory drug assessment. Existing OMOP data partners (EHDEN legacy + DARWIN EU) are natural candidates to become data suppliers for HDABs, with OMOP conversion as a privileged channel for longitudinal analytics.
Other access channels — FHIR bulk export, structured registry exports, genomic datasets — are foreseen by Article 56 of the Regulation in addition to OMOP. The European dataset catalogue of HealthData@EU — under construction in these months — lists available sources with standardised descriptors, allowing researchers to assess feasibility of a request in advance.
Primary use: what happens on 26 March 2027
A year out, the main issues for the 2027 deadline:
- European patient summary — all Member States must expose their citizens’ patient summaries through MyHealth@EU; IPS FHIR becomes mandatory
- ePrescription — automatic recognition of a patient’s prescription by pharmacies in the host Member State; requires full interoperability of national prescription systems
- Patient access to their data — obligation to make healthcare data available to the citizen electronically, free of charge, with portability to other Member States
- Provider obligation to populate national systems with priority contents
Italy’s FSE 2.0 has a structural advantage: the FSE Gateway, regional EDSs, and FHIR IT profiles are largely consistent with what EHDS requires by 2027. Residual work areas concern:
- Completing population (some sectors — private specialist outpatient care, general practice — remain below target)
- Alignment of FHIR IT profiles with harmonised European specifications (Commission implementing acts)
- Staff training on new population obligations without consent
- Citizen portal with full access, masking, access log, portability features
Secondary use: 2029 is built now
2029 seems far away but is the horizon on which the more substantive part of EHDS plays out. To be ready one needs:
- Designated and operational HDAB with trained staff and defined procedures
- Secure processing environments built and tested
- National data holder catalogue with structured inventories of available datasets
- OMOP CDM conversions of main public healthcare databases — the work on which EHDEN laid foundations in recent years
- Consent/opt-out procedures conformant with national options allowed by Article 33 of the Regulation
- Integration with cross-cutting authorities: Garante, Ethics Committees, AIFA, Agenas, ISS
- Sustainable economic model for the HDAB — data permit fees, public funds, European funding
Italy at the crossroads
For Italy, 2027-2029 coincides with the immediate closing of PNRR Mission 6 (2026 deadline) and the opening of the FSE 2.0 operational phase. The natural transition is:
- 2024-2026: FSE 2.0 construction with PNRR funds
- 2026-2027: full FSE 2.0 operations, EHDS primary-use compliance
- 2027-2029: preparation of the Italian HDAB, conversion of healthcare databases to OMOP, data permit pilots
- 2029 and beyond: EHDS fully operational, Italy active as European data provider
The critical areas under heaviest debate:
- SNOMED CT — Italy is not yet a member of SNOMED International; uptake of the standard is structurally limited. The EHDS Regulation does not require membership but recommends it to maximise interoperability; an Italian decision is expected in 2026-2027
- Private data holders — private healthcare providers, insurers, pharmaceutical companies with databases in Italy will be subject to EHDS obligations. The exact perimeter and fees for their contribution are the subject of national legislative work
- Clinical research and biobanks — integration with the Ethics Committee system, reuse of consents collected in clinical trials, relationship with Regulation (EU) 536/2014 on clinical trials
- Territorial equity — ensuring all Regions have comparable capacity to participate in EHDS studies, avoiding that the mechanism structurally rewards more advanced Regions
What this means for organisations
For an Italian healthcare entity operating today, actions to start to be ready for 2027 and 2029:
- Data inventory — structured mapping of owned healthcare databases, with quality and completeness descriptors
- Data quality assessment — analysis of standard adherence, population gaps, metadata coverage
- Conversion plan — roadmap of mapping to OMOP CDM (with the support of EHDEN-legacy certified SMEs) for analytical datasets, and to FHIR IT for clinical contents
- Consent governance — update of information notices and collection processes for secondary use
- Training — DPOs, clinical data managers, ICT staff must understand the EHDS frame at the operational level
The work of 2026 determines, for many Italian organisations, whether 2029 will be an opportunity or a burden. The tools — OMOP, FHIR, EHDEN/OHDSI community, FHIR IT profiles, FSE 2.0 infrastructure — are mature. The determining factor is organisational and cultural investment.
References: Regulation (EU) 2025/327 on the European Health Data Space, in force 26 March 2025. EHDS Board, European Commission. MyHealth@EU. HealthData@EU. OHDSI — OMOP CDM. IMI EHDEN legacy. DARWIN EU, EMA. Italian Decree of 7 September 2023 on FSE 2.0.