EHDS & Health Data Governance – Enterprise Readiness Framework
Design and governance principles supporting transition toward the European Health Data Space, distinguishing primary use, secondary use, institutional roles and project-specific duties.
Regulatory and governance references
- Regulation (EU) 2025/327 (European Health Data Space)
- Regulation (EU) 2016/679
- Directive 2011/24/EU as amended by the EHDS
- Implementing acts, European specifications and applicable national law as they evolve
References indicate the design framework and must be verified against the current legislation, implementing measures, national law and the parties’ actual roles at implementation time.
1. Regulation (EU) 2025/327 Context
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
EHDS applies on a phased timetable. Substantial secondary-use rules begin to apply from 26 March 2029, with remaining categories including genomic data from 26 March 2031. Dates and obligations must be checked against the law in force and implementing acts when the project is deployed.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
2. Entry into Force and Phased Application
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
3. Primary Use and Secondary Use
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Primary use concerns care for the individual; secondary use concerns additional permitted purposes such as research and innovation under specific procedures and safeguards. The platform does not assume that data collected for care may be reused for research without analysis of legal basis, permits and applicable restrictions.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
4. Genomic Data and the 2031 Timeline
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Health and genetic data are special categories under GDPR Article 9. The controller must identify an Article 6 legal basis and an Article 9 condition, assess applicable health and research law and implement appropriate safeguards; pseudonymisation reduces risk but does not automatically make data anonymous.
FASTQ, BAM/CRAM and large datasets should not pass through ordinary PHP shared-hosting uploads. The platform governs metadata, references, checksums and permissions, while large payloads belong in authorised storage under territorial and contractual conditions compatible with the project.
UESE retains evidence proportionate to function and risk. The customer organisation remains responsible for its authorisations, protocols, legal bases and healthcare or scientific decisions beyond the service scope entrusted to UESE.
5. Roles of the Using Organisation
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
6. Data Cataloguing, Provenance and Quality
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Metadata, provenance, lineage and documented quality are essential to make datasets interpretable and auditable. Cataloguing errors can propagate into analyses; the platform supports traceability, while scientific quality of the source remains with the parties generating and validating the data.
Training and evaluation data must be relevant to the population and use case. Bias, drift, under-representation and annotation quality should be monitored; where evidence is insufficient the limitation must be disclosed and the model must not be extended beyond the validated scope.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
7. Interoperability and Open Standards
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Interoperability must use project-defined profiles and standards with mapping, versioning and conformance testing. FHIR, VCF, APIs and other formats enable exchange but do not guarantee semantic equivalence; terminologies, units, reference genome and identifiers must also be governed.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
8. Data Minimisation and Purpose Limitation
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Each processing operation must respect purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality. Configuration should avoid unnecessary free-text fields, uncontrolled copies and excessive transfers; synthetic or properly anonymised data should be preferred for testing and training where feasible.
RTO and RPO, if offered, must be expressly stated in the SLA and aligned with the architecture. Without executed values they cannot be inferred from public material; disaster recovery and application restoration should be tested periodically where required by the continuity plan.
UESE retains evidence proportionate to function and risk. The customer organisation remains responsible for its authorisations, protocols, legal bases and healthcare or scientific decisions beyond the service scope entrusted to UESE.
9. Secure Processing Environments and Controlled Access
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Where secondary use is subject to EHDS or equivalent rules, access may require secure processing environments, export restrictions and specific controls. UESE Precision Bio AI can provide governance and orchestration, but suitability as a legally recognised secure processing environment must be assessed against applicable requirements.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
10. Rights, Opt-Out and Applicable National Constraints
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
11. Multi-centre Project Governance
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
12. Relationship Between GDPR and EHDS
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
EHDS applies on a phased timetable. Substantial secondary-use rules begin to apply from 26 March 2029, with remaining categories including genomic data from 26 March 2031. Dates and obligations must be checked against the law in force and implementing acts when the project is deployed.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
UESE retains evidence proportionate to function and risk. The customer organisation remains responsible for its authorisations, protocols, legal bases and healthcare or scientific decisions beyond the service scope entrusted to UESE.
13. Transfers, Cross-Border Access and Consortia
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
Any third-country transfer is subject to GDPR Chapter V and must be mapped before activation. In the absence of an adequacy decision, Standard Contractual Clauses, a transfer impact assessment and supplementary measures may be required; remote access from a third country is assessed as part of the same risk.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
For enterprise deployments, the decision should be translated into a RACI matrix, verifiable evidence, acceptance criteria, technical controls and periodic review; exceptions must be approved, reasoned, time-limited and traceable.
14. Readiness Roadmap and Gap Assessment
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
In healthcare or multi-centre projects, the requirement should be linked to the protocol, decision record, DPIA or security file where relevant, avoiding any assumption that a technical configuration replaces legal or scientific assessment.
15. Platform Limits and Implementation Responsibility
Regulation (EU) 2025/327 on the European Health Data Space establishes a phased framework for primary and secondary use of electronic health data. UESE Precision Bio AI is designed to support organisational and technical readiness, but no platform feature, by itself, constitutes EHDS compliance: role, purpose, data category, national law, permits and implementing acts must be assessed for each project.
The organisation must distinguish primary-use requirements from secondary-use requirements and verify the remit of national authorities. Interoperability and cataloguing functions are support tools, not substitutes for EHDS permits or procedures.
Compliance is continuous: changes to purpose, data, suppliers, engines, hosting, integrations or law require impact assessment and, where needed, updates to contracts, controls, instructions and documentation.
For requests concerning data processed within a customer project, UESE may need to direct the data subject to the competent controller. For commercial or technical enquiries, use the dedicated stakeholder form and do not submit patient data.
Request informationWebsite owner and corporate contacts
UESE ITALIA S.p.A. · Piazza Trivulziana 4/A · 20126 Milano (MI) · Italy · P. IVA / C.F. IT04398760274 · REA MI 2679515 · sales@uese.it · +39 02 5656 8416.