The European Union’s detailed operating rules for MyHealth@EU have taken legal effect, establishing the security, governance and compliance structure for the cross-border exchange of electronic health records.
The implementing regulation governs the network that will connect national contact points for digital health. It covers technical and semantic interoperability, service management, incident reporting and the conditions that a participant must satisfy before joining or remaining connected.
The rules turn a broad framework in the European Health Data Space Regulation into an operating model. National contact points will act as joint controllers of personal data moving through the system. The European Commission will act as their processor while providing the central platform, a secure communications network, shared terminology services and configuration tools.
Participants must complete technical tests and compliance checks. They are also responsible for handling requests by people exercising data-protection rights, maintaining safeguards and notifying supervisory authorities and affected individuals when a personal-data breach meets the thresholds in EU law.
Taking effect does not mean every category of health record must now move through the network. The underlying legislation uses a staged timetable. The compulsory exchange of patient summaries, electronic prescriptions and electronic dispensations begins on March 26, 2029. Medical images, test results and discharge reports follow on March 26, 2031.
The regulation nevertheless matters now because it supplies the specifications around which national systems must be built and tested. It also fixes responsibility before mandatory exchange begins, reducing ambiguity over who controls the data, who processes it and how security failures must be handled.
The measure was adopted on September 18 and published in the Official Journal on September 21. Its legal effect began on October 11, twenty days after publication.
Read the regulation on EUR-Lex.
