Health-data reuse reshaped
A new Atlantic Council review says the European Health Data Space is steering secondary use of sensitive data toward public or supervised infrastructure rather than open, ad-hoc sharing. That model means researchers and funders will often access data through mediated pipes with provenance, permissioning and governance baked in — and services that connect researchers will need to translate those constraints into clear user journeys. (atlanticcouncil.org)
Europe is building a system where medical data usually does not get emailed around like a spreadsheet anymore. Under the European Health Data Space, a cancer researcher in one country is supposed to request access through a legal and technical channel built for reuse, not through ad hoc deals with hospitals. (health.ec.europa.eu) That shift is already law. Regulation (EU) 2025/327 on the European Health Data Space was adopted on February 11, 2025, published on March 5, 2025, and entered into force on March 26, 2025. (eur-lex.europa.eu) The basic split is simple. “Primary use” means using health data to treat a patient, while “secondary use” means reusing health data for research, innovation, public health, policy-making, statistics, or regulatory work. (health.ec.europa.eu) The new part is not that Europe suddenly discovered research. The new part is that the law routes sensitive reuse through Health Data Access Bodies, which are national authorities that authorize and oversee who gets access and under what conditions. (health.ec.europa.eu, eur-lex.europa.eu) Think of those bodies as air-traffic control for medical data. They are meant to handle authorization, require data minimization, and make researchers work inside secure processing environments instead of taking raw files wherever they want. (health.ec.europa.eu) Europe is also wiring up a shared front door for this. The European Commission says the HealthData@EU Central Platform will let users search an European Union dataset catalogue and submit data-access applications through a federated system. (health.ec.europa.eu) That means the product experience changes for anyone building tools for scientists. A service that used to promise “upload, download, and share” now has to guide users through permits, approved purposes, secure workspaces, and records showing who accessed data and why. (health.ec.europa.eu, eur-lex.europa.eu) The law is also explicit that some uses are off limits. The European Commission’s proposal text says secondary-use data cannot be used for things like commercial advertising, raising insurance premiums, or decisions that harm people or groups. (eur-lex.europa.eu) Patients are not cut out of this system. The Commission says people will be able to see who accessed or used their health data for what purpose, and the secondary-use framework includes an opt-out that is supposed to be simple, reversible, and transparent. (health.ec.europa.eu) So the fight is no longer “share health data” versus “do not share health data.” In Europe, the model now looks more like supervised plumbing: catalogue first, application next, access body review after that, and analysis inside controlled infrastructure rather than open circulation of sensitive files. (health.ec.europa.eu, health.ec.europa.eu, eur-lex.europa.eu)
