This TEHDAS2 expert guideline supports the implementation of the European Health Data Space (EHDS). The European Health Data Space (EHDS) Regulation establishes a legal framework for the secondary use of electronic health data while safeguarding the rights of individuals whose data are involved. Within this framework, T8.1 of the TEHDAS2 project is dedicated to obligations towards natural persons, and within T8.1., this D8.2 document provides practical guidance for health data access bodies (HDABs) concerning their obligations, when significant health-related findings are identified during the secondary use of identifiable electronic health data. This guideline: serves as an initial guiding tool to help HDABs fulfil their obligations under Articles 58(3) and 61(5) of the EHDS Regulation focuses specifically on the procedures HDABs must implement when receiving information regarding any significant findings related to the health of the natural person whose data are included in a dataset used by data users and forwarding them to the appropriate health data holders clarifies the boundaries of their responsibilities, ensuring alignment with national implementation frameworks. describes the distinct roles of data users, HDABs, and data holders provide guidance and clarification on how the Member States can support data holders in navigating the process of return of significant findings to the natural persons touches on privacy and data protection responsibilities, while noting that issues related to pseudonymisation, anonymisation, and technical safeguards are addressed in other guidelines of the TEHDAS2 project. While the guideline primarily targets HDABs, it may also offer value to data users and data holders, particularly in clarifying how their respective roles interact with HDAB processes. In summary, this guideline is confined to describing the procedural role of HDABs when they receive a report of a significant finding from a data user and outlining how such findings should be forwarded to the relevant data holder in compliance with the EHDS Regulation. All matters related to national disclosure mechanisms, the responsibilities of data users, notification to individuals, privacy protection measures, and the exercise of the right to request not to be informed are explicitly excluded from the scope of this guideline. By clarifying this specific procedural responsibility, the document supports the readiness of HDABs and contributes to a harmonised and rights-respecting implementation of the EHDS across Member States. The operational implementation of these obligations may require additional organisational and infrastructural arrangements at national level, which remain outside the scope of this guideline.
Misek et al. (Tue,) studied this question.