European health data regulation: how it relates to the provisions governing shared medical records in French law

By Nathalie Boudet-Gizardin,  Marine Vanhoucke, associates and Louise Buffet.

The European regulation creating theEuropean Health Data Space (known as EHDS) was adopted on April 24, 2024 after Parliament and Council reached a political agreement on the commission's proposal.

This regulation, which will come into force over the next two to six years, aims to:

• Promote the cross-border exchange of health data in order to facilitate the treatment of patients outside their country of residence, through the implementation of the electronic medical record (EMR). It's'primary use of data;
• Facilitate the reuse of previously anonymized or pseudonymized health data for research, innovation, policy development and patient safety. It's'secondary use of data.

Thus, a health data exchange tool (the MyHealth@EU infrastructure) will be created for the primary use of this data, and a health data catalog (the HealthData@EU infrastructure) for the use secondary of these[1].

According to the press release from the Digital Health Delegation of April 25, 2024, this regulation strengthens and harmonizes, in addition to the General Data Protection Regulation (GDPR), the rights of data subjects in matters of health data: right direct access to medical records, right to object to the processing of health data, configuration of access to this data, etc.

However, as we had already mentioned in a previous article[2], French law already knows a form of digital medical record, the shared medical record[3], which followed the failure of the personal medical file[4].

Questioned by MPs within the European Affairs Committee on the connection between this French shared medical file (DMP) and the European EMR, MP Laurence CRISTOL[5] simply indicated that France had been cited during discussions around the European text as an example, being a pioneer in the field. It should probably be understood that the DMP already meets the definition of the EMR and that future changes will consist of “connecting” this DMP to medical files created in other European countries in order to achieve the goal of interoperability.

As for patients' control over the information contained in this DMP, they already have the right to consult and rectify or even delete their data:

• In application of articles R.1111-40 et seq. of the Public Health Code, any person has access to their DMP electronically from their digital health space (ENS) and can object to its creation.

• Article R.1111-51 of the Public Health Code also establishes the right of access and rectification of the DMP by its holder, and specifies that the holder cannot, however, delete the information it contains except for legitimate reasons. .

• The GDPR also provides a right of access (article 15), rectification (article 16) and a right to erasure (article 17) of data, under certain conditions[6]. Remember that health data is personal data considered sensitive and therefore benefits from special protection by the GDPR and the Data Protection Act.

Furthermore, the new regulation makes participation in the centralized common European infrastructure MyHealth@EU compulsory. However, France has already joined this infrastructure by launching the Sesali service (European Online Health Service) which allows French health professionals to access the medical summary of a European patient's file in a secure, structured and in French.

The contribution of this new regulation therefore appears limited for French law.

However, MP Laurence CRISTOL clarified that if there already existed, prior to the adoption of this regulation, a sharing of health data between countries in the European area and non-European countries, this sharing was not still specifically regulated.

Indeed, as the regulation specifies in article 1, 2. (a), it specified et complements the rights of individuals established by the GDPRin the specific field primary and secondary use of their electronic health data.

Thus, this new regulation, the publication of which in French is still awaited, provides in its article 5 the priority categories of personal health data, for primary use purposes, including in particular prescriptions and results of various analyses. The exhaustive list of these priority categories will be established by implementing acts of the Commission, to which the regulation delegates this power.

Health professionals will therefore have access to electronic health data relevant and necessary patients they care for regardless of the Member State of origin of these patients and the Member State in which they receive care, these data must include at least the priority categories referred to in Article 5 (Article 7a).

However, a large number of details are awaited on the concrete implementation of this regulation, which will involve the adoption by the Commission of implementing acts and delegated acts upon authorization of the regulation.

Patience will therefore be required to determine whether this regulation achieves its objective of strengthening the protection of patient data.

However, if different actors such as the Senate European Affairs Committee[7], the CNIL and the European Protection Committee have pleaded for data hosting within the European Union by a European company, the recent decision of the CNIL[8] of December 21, 2023 to authorize the hosting of a data warehouse from the National Health Data System (SNDS) at Microsoft for 3 years, until a French or European Cloud operator is operational, demonstrates that the The European Union still has a way to go in this area…

[1] These two infrastructures are not databases bringing together all the data of European citizens.

[2] “Everything you need to know about access to shared medical records in 2022”, January 20, 2022, GMPV cabinet website.

[3] Created by law n°2016-41 of January 26, 2016.

[4] Created by law n°2004-810 of August 13, 2004.

[5] “The European health data space” Communication from Ms. Laurence CRISTOL, MP, Wednesday November 23, 2022, p. 7

[6] See “The patient's right to rectification or erasure of their data”, October 5, 2021, GMPV cabinet website.

[7] Senate, Information report no. 848 by Ms. Pascale GRUNY and Ms. Laurence HARRIBEY, p. 8

[8] CNIL, deliberation no. 2023-146 of December 21, 2023; Concerns patient data provided by 4 large hospitals and health insurance data, to advance pharmaco-epidemiological research on the long-term effects of medical treatments.