EU adopts Regulation (EU) 2025/327 on European Health Data Space

Original title: Regulation (EU) 2025/327 on the European Health Data Space

Regulation (EU) 2025/327 of the European Parliament and of the Council was adopted on 11 February 2025 to establish the European Health Data Space framework, with entry into force on 25 March 2025. The regulation amends the cross-border healthcare directive (Directive 2011/24/EU) and the Cyber Resilience Act (Regulation (EU) 2024/2847) to align health data governance with cybersecurity requirements. This creates a coordinated EU-wide system for health data access and protection, affecting healthcare providers, data controllers, and digital health service operators across member states.

What changed

• Regulation (EU) 2025/327 enters into force on 25 March 2025, with staggered implementation dates on 26 March 2027, 26 March 2029, 26 March 2031, and 26 March 2035 for different provisions
• Directive 2011/24/EU on cross-border healthcare is amended to integrate European Health Data Space requirements
• Regulation (EU) 2024/2847 (Cyber Resilience Act) is amended to address cybersecurity requirements for health data systems and digital health products

Who is affected

EU member states, healthcare providers, health data controllers, digital health service operators, patients, and entities subject to cybersecurity requirements under the Cyber Resilience Act