Guideline for data holders on making personal and non-personal electronic health data available for reuse

This TEHDAS2 expert guideline supports the implementation of the European Health Data Space (EHDS).This guideline provides practical, high-level guidance to health data holders (HDHs) on their role in making personal and non-personal electronic health data available for secondary use under the European Health Data Space (EHDS) Regulation. It supports HDHs in understanding and navigating their obligations once a health data access body (HDAB) has issued a data permit (Art. 68) or approved a health data request (Art. 69). HDHs comprise a wide and heterogeneous group of organisations, including healthcare providers, public authorities, research institutions, registries, insurers, and developers of health-related services and devices. Under Article 60 of the EHDS Regulation, HDHs are legally required to: Make relevant electronic health data available to the HDAB in accordance with an issued data permit or an approved health data request, where the data fall within the minimum categories listed in Article 51. Provide the requested data within the prescribed time limits, namely within three months from receipt of the request by the HDAB, with a possible extension of up to three additional months in duly justified cases. Submit and maintain dataset descriptions (metadata) for inclusion in the national dataset catalogue and verify their accuracy at least once per year, in line with Articles 60(3) and 77. Ensure access to non-personal electronic health data through trusted open databases, where applicable, in accordance with Article 60(5). Cooperate with the HDAB for supervisory and enforcement purposes, including providing information necessary to verify compliance (Art. 63). While HDHs are responsible for making data available, other tasks such as assessing access applications, deciding on access, and performing certain data preparation activities are assigned to HDABs or, where applicable, to trusted health data holders (THDH). For regular HDHs, mandatory involvement in the data provision process is primarily limited to extracting and supplying the data in line with the criteria set out in the data permit or request approval and complying with the applicable legal, organisational, and technical safeguards. Further involvement in data preparation may occur in practice, depending on national arrangements. In addition to mandatory duties, this guideline describes recommended practices based on TEHDAS2 expert experience and common implementation patterns across Member States. These practices are not legally binding and do not create additional obligations but may support effective and proportionate implementation of the EHDS. Examples include organising internal workflows to manage timelines, performing basic feasibility and validation checks, maintaining clear communication with the HDAB, and, where appropriate, applying a part of data preparation measures close to the data source in line with national arrangements. By following these recommendations, HDHs may strengthen their preparedness to comply with mandatory EHDS obligations and align with national governance structures, thereby contributing to a harmonised and secure approach to the secondary use of health data across Europe. In summary, this guideline focuses on and explains the mandatory duties of HDHs under the EHDS Regulation and on explaining the minimum process for making data available. It distinguishes clearly between mandatory requirements arising directly from the Regulation and recommended practices that reflect expert experience but are not legally binding. The document is intentionally positioned as an introductory connective guideline within the TEHDAS2 framework. It provides a structured overview of roles, responsibilities, and key process steps, while systematically referring to other TEHDAS2 guidelines for in-depth guidance on topics such as metadata and dataset description, data minimisation and anonymisation, opt-out implementation, application handling, and secure processing environments.