Report on the assessment of the EU Member States’ rules on health data in the light of GDPR

In the context of the Single Framework Contract Chafea/2018/Health/03 between the EUHealthSupport Consortium and the Consumers, Health and Food Executive Agency (Chafea), a study was conducted with the objective to examine and present the EU Member States’ rules governing the processing of health data in light of the GDPR, with the objective of highlighting possible differences and identifying elements that might affect the cross-border exchange of health data in the EU, and examining the potential for EU level action to support health data use and re-use.

The study distinguishes between using health data for primary purposes (for treatment of the patient) and secondary purposes (for research, registries and management of the

healthcare system).

It also provides an evidence-based comparison of the state of play regarding health data governance within the EU. This will help to assess in what areas EU intervention might be needed and if so, through which types of measures, be it measures such as a Code of Conduct for data processing in the health area, which could be supported by an EU level implementing act or more direct legislative action, taking into account the particularities of the health systems in the Member States.

The study uses a mixed-methods approach, consisting of the following elements:

• Literature review to provide an overview of best practices, bottlenecks, policy

options and possible solutions already identified in the literature.

• Mapping legal and technical aspects of health data usage at national level

to provide an overview of the differences among countries in legislation,

regulation and governance models regarding processing health data.

• In-depth case studies of national governance models for health data sharing.

• Workshops held with MoH representatives, experts, stakeholder representatives

and experts from national data protection offices.

• Stakeholder Survey to cross validate and supplement the topics addressed and

identified in the Member State legal and technical aspects mapping.