What changed between the plenary report and the adopted text

Article 30 – paragraph 1 – point d a (new): (da) the registration obligations of Article 32 have not been fulfilled.

Article 30 – paragraph 1 a (new): 1a. Where, in the course of the evaluation referred to in the first subparagraph, the market surveillance authorities find that the EHR system does not comply with the requirements laid down in this Regulation, they shall require without delay the relevant economic operator to take all appropriate corrective action to bring the EHR system into compliance with those requirements, to withdraw the EHR system from the market, or to recall it within a reasonable period.

Article 30 – paragraph 1 b (new): 1b. Where the relevant economic operator does not take adequate corrective action within the period referred to in Article 29(1), second subparagraph, the market surveillance authorities shall take all appropriate provisional measures to prohibit or restrict the EHR system being made available on their national market, to withdraw the EHR system from that market or to recall it. / The market surveillance authorities shall inform the Commission and the other Member States, without delay, of those measures.

Article 30 – paragraph 1 c (new): 1c. The information referred to in paragraph 1b, second subparagraph, shall include all available details, in particular the data necessary for the identification of the noncompliant EHR system, the origin of that EHR system, the nature of the non-compliance alleged and the risk involved, the nature and duration of the national measures taken and the arguments put forward by the relevant economic operator. In particular, the market surveillance authorities shall indicate whether the noncompliance is due to any of the following: / (a) failure of the EHR system to meet the requirements relating to the essential requirements set out in Annex II; / (b) shortcomings in the harmonised standards referred to in Article 23; / (c) shortcomings in the technical specifications referred to in Article 23.

Article 30 – paragraph 1 d (new): 1d. Member States other than the Member State initiating the procedure under this Article shall without delay inform the Commission and the other Member States of any measures adopted and of any additional information at their disposal relating to the non-compliance of the EHR system concerned, and, in the event of disagreement with the adopted national measure, of their objections.

Article 30 – paragraph 1 e (new): 1e. Where, within three months of receipt of the information referred to in paragraph 1b, second subparagraph, no objection has been raised by either a Member State or the Commission in respect of a provisional measure taken by a Member State, that measure shall be deemed justified.

Article 30 a (new): Article 30a / Union safeguard procedure / 1. Where, on completion of the procedure set out in Article 29(2) and Article 30(1a), objections are raised against a measure taken by a Member State, or where the Commission considers a national measure to be contrary to Union law, the Commission shall without delay enter into consultation with the Member States and the relevant economic operator or operators and shall evaluate the national measure. On the basis of the results of that evaluation, the Commission shall adopt an implementing act in the form of a decision determining whether the national measure is justified or not. The Commission shall address its decision to all Member States and shall immediately communicate it to them and to the relevant economic operator or operators. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 68(2a). / 2. If the national measure is considered justified, all Member States shall take the necessary measures to ensure that the non-compliant EHR system is withdrawn from their market, and shall inform the Commission accordingly. If the national measure is considered unjustified, the Member State concerned shall withdraw that measure. Where the national measure is considered justified and the non-compliance of the EHR system is attributed to shortcomings in the harmonised standards or technical specifications referred to in this Regulation, the Commission shall apply the procedure provided fo…

Article 31 – title: Labelling of wellness applications

Article 31 – paragraph 1: 1. Where a manufacturer of a wellness application claims interoperability with an EHR system and therefore compliance with the essential requirements laid down in Annex II and common specifications in Article 23, such wellness application shall be accompanied by a label, clearly indicating its compliance with those requirements. The label shall be issued by the manufacturer of the wellness application and the competent market surveillance authority shall be informed.

Article 31 – paragraph 3: 3. The Commission shall, by means of implementing acts, determine the format and content of the label. Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 68(2).

Article 31 – paragraph 4: 4. The label shall be drawn-up in one or more official languages of the Union, and in the language of the Member State(s) in which the wellness application is placed on the market.

Article 31 – paragraph 6: 6. If the wellness application is an integral part of a device or embedded in a device after its putting into service, the accompanying label shall be shown in the application itself or placed on the device and in the case of software a digital label. 2D barcodes may also be used to display the label.

Article 31 – paragraph 9: 9. Each distributor of a wellness application for which a label has been issued shall make the label available to customers at the point of sale in electronic form.

Article 31 – paragraph 10: deleted

Article 31 a (new): Article 31a / Interoperability of wellness applications with EHR systems / 1. Manufacturers of wellness applications may claim interoperability with an EHR system, after relevant conditions are met. When this is the case, the users of such wellness applications shall be duly informed about such interoperability and its effects. / 2. The interoperability of wellness applications with EHR systems shall not mean automatic sharing or transmission of all or part of the health data from the wellness application with the EHR system. The sharing or transmission of such data shall only be possible following the consent of the natural person and in accordance with Article 3(6) of this Regulation and interoperability shall be limited exclusively to this end. The manufacturers of wellness applications claiming interoperability with an EHR system shall ensure that the user is able to choose which categories of health data from the wellness application they want to insert in the EHR system and the circumstance for that sharing or transmission. / 3. Wellness applications shall not be permitted to access the information in EHRs or extract or process information from it.

Article 32 – paragraph 1: 1. The Commission shall establish and maintain a publicly available database with information on EHR systems for which an EU declaration of conformity has been issued pursuant to Article 26 wellness applications for which a label has been issued pursuant to Article 34.

Article 32 – paragraph 3: 3. Medical devices or high-risk AI systems referred to in paragraphs 3 and 4 of Article 14 of this Regulation shall also be registered in the database established pursuant to Regulations (EU) 2017/745 or […] [AI Act COM/2021/206 final], as applicable.

Article 33 – title: Categories of electronic health data for secondary use

Article 33 – paragraph 1 – point a: (a) electronic health data from EHRs;

Article 33 – paragraph 1 – point b: (b) data on factors impacting on health, including socio-economic, environmental and behavioural determinants of health;

Article 33 – paragraph 1 – point c: (c) relevant pathogen data, impacting on human health;

Article 33 – paragraph 1 – point d: (d) healthcare-related administrative data, including claims and reimbursement data;

Article 33 – paragraph 1 – point e: (e) extracts from human genetic, genomic and proteomic data, such as genetic markers;

Article 33 – paragraph 1 – point f: (f) automatically generated electronic health data, via medical devices;

Article 33 – paragraph 1 – point f a (new): (fa) data from wellness applications;

Article 33 – paragraph 1 – point g: (g) identification data related to healthcare providers and categories of health professionals involved in the treatment of a natural person or in research;

Article 33 – paragraph 1 – point j: (j) electronic health data from clinical trials subject to transparency provisions under Union law;

Article 33 – paragraph 1 – point l: (l) data from research cohorts, questionnaires and surveys related to health;

Article 33 – paragraph 1 – point n: deleted

Article 33 – paragraph 2: 2. The Commission, after consulting the EDPB, EDPS and the Member States, shall adopt guidelines on measures to protect the personal data of health professionals involved in the treatment of natural persons. / (deleted)

Article 33 – paragraph 4: deleted

Article 33 – paragraph 5: 5. Natural persons shall have the right to opt-out of the processing of their electronic health data for secondary use. Member States shall provide for an accessible and easily understandable opt-out mechanism, whereby natural persons shall be offered the possibility to explicitly express their wish not to have all or part of their personal electronic health data processed for some or all secondary use purposes. The exercise of this right to opt-out shall not affect the lawfulness of the processing that took place under Chapter IV before the individual opted-out.

Article 33 – paragraph 5 a (new): 5a. Without prejudice to paragraph 5, electronic health data referred to under paragraph 1, points (e), (fa) and (m), shall only be made available for secondary use after obtaining the consent of the natural person. Such an opt-in mechanism shall be easily understandable and accessible and provided in a user-friendly format whereby data subjects are made aware of the sensitive nature of the data.

Article 33 – paragraph 7: deleted

Article 33 – paragraph 8: deleted

Article 33 a (new): Article 33a / IP rights and trade secrets in secondary use / Electronic health data entailing content protected by intellectual property rights, trade secrets or data covered by regulatory data protection shall be made available for secondary use. In those cases, the following procedure shall apply: / (a) health data access bodies shall take measures necessary to preserve the confidentiality of such data and to ensure such rights are not infringed; / (b) the Commission shall, after consultation with the EHDS Board, issue guidelines on the identification of commercially confidential information. The guidelines shall outline procedural steps and measures the health data access bodies may undertake to identify and preserve the confidentiality of such information before providing data access to the health data users. The guidance shall be made publicly available; / (c) health data holders may, when requested to make available to health data access bodies relevant electronic health data pursuant to Article 41(1) which it considers to contain content protected by intellectual property rights, trade secrets or data covered by regulatory data protection, inform the data access body that this is the case and indicate which parts of the datasets are concerned. The determination of which data contains intellectual property, trade secrets or data covered by regulatory data protection shall nevertheless rest with the health data access body; / (d) health data holders and the health data u…

Article 34 – paragraph 1 – introductory part: 1. Health data access bodies shall only provide access to electronic health data referred to in Article 33 to a health data user where the processing of the data by the data user is necessary for one of the following purposes, and in accordance with Article 6(1), point (c), and Article 9(2), points (g) to (j), of Regulation (EU) 2016/679:

Article 34 – paragraph 1 – point a: (a) activities for reasons of public interest in the area of public health, such as protection against serious cross-border threats to health, public health surveillance or ensuring high levels of quality and safety of healthcare and of medicinal products or medical devices;

Article 34 – paragraph 1 – point b: (b) to support public sector bodies and Union institutions, agencies and bodies, in the health or care sector to carry out their tasks defined in their mandates where processing is necessary for reasons of substantial public interest in the area of public health;

Article 34 – paragraph 1 – point c: (c) to produce national, multi-national and Union level official statistics defined in Regulation (EU) No 223/20091a related to health or care sectors; / 1a Regulation (EC) No 223/2009 of the European Parliament and of the Council of 11 March 2009 on European statistics and repealing Regulation (EC, Euratom) No 1101/2008 of the European Parliament and of the Council on the transmission of data subject to statistical confidentiality to the Statistical Office of the European Communities, Council Regulation (EC) No 322/97 on Community Statistics, and Council Decision 89/382/EEC, Euratom establishing a Committee on the Statistical Programmes of the European Communities (OJ L 87, 31.3.2009, p. 164).

Article 34 – paragraph 1 – point d: deleted

Article 34 – paragraph 1 – point e: (e) scientific research related to health or care sectors, contributing to public health or health technology assessment, or ensuring high levels of quality and safety of health care, of medicinal products or of medical devices, with the aim of benefitting the end-users, such as patients, health professionals and health administrators, including: / (i) development and innovation activities for products or services; / (ii) training, testing and evaluating of algorithms, including in medical devices, in-vitro diagnostic medical devices, AI systems and digital health applications; / (iii) university and post-university teaching activities related to scientific research.

Article 34 – paragraph 1 – point f: deleted

Article 34 – paragraph 1 – point g: deleted

Article 34 – paragraph 1 – point h: (h) improving delivery of care, treatment optimisation and providing personalised healthcare.

Article 34 – paragraph 2: 2. The purposes referred to in points (a) to (c) of paragraph 1 shall be reserved for public sector bodies and Union institutions, bodies, offices and agencies exercising their tasks conferred to them by Union or national law, including where processing of data for carrying out these tasks is done by a third party on behalf of that public sector body or of Union institutions, agencies and bodies.

Article 34 – paragraph 4: deleted

Article 35 – paragraph -1 (new): -1. Secondary use of electronic health data that is not covered by the data permit pursuant to Article 46 or data requests pursuant to Article 47 shall be prohibited.

Article 35 – paragraph -1 a (new): -1a. Any secondary use of electronic health data for purposes other than those referred to in Article 34 shall be prohibited.

Article 35 – paragraph 1 – introductory part: 1. Seeking access to and processing electronic health data obtained via a data permit issued pursuant to Article 46 or a data request granted pursuant to Article 47 for the following purposes shall be prohibited:

Article 35 – paragraph 1 – point a: (a) taking decisions detrimental to a natural person or group of natural persons based on their electronic health data; in order to qualify as “decisions”, they must produce legal, economic or social effects or similarly significantly affect those natural persons;

Article 35 – paragraph 1 – point b: (b) taking decisions in relation to a natural person or groups of natural persons in relation to job offers or offering less favourable terms in the provision of goods or services, including to exclude them from the benefit of an insurance or credit contract or to modify their contributions and insurance premiums or conditions of loans, or taking any other decisions in relation to a natural person or groups of natural persons having the effect of discriminating on the basis of the health data obtained;

Article 35 – paragraph 1 – point c: (c) advertising or marketing activities;

Article 35 – paragraph 1 – point e: (e) developing products or services that may harm individuals, public health or societies at large, including, but not limited to illicit drugs, alcoholic beverages, tobacco and nicotine products, weaponry or products or services which are designed or modified in such a way that they create addiction or that they contravene public order or morality;

Article 35 – paragraph 1 – point e a (new): (ea) automated individual decision-making, including profiling, in accordance with Article 22 of the Regulation (EU) 2016/679, whether solely on the basis of the datasets shared under this Regulation or in combination with other data.

Article 36 – paragraph 1: 1. Member States shall designate one or more health data access bodies responsible for the tasks and obligations referred to in Articles 37, 38 and 39 of this Regulation. Member States may either establish one or more new public sector bodies or rely on existing public sector bodies or on internal services of public sector bodies that fulfil the conditions set out in this Article. / Where a Member State designates several health data access bodies, it shall designate one health data access body to act as coordinator, with responsibility for coordinating data access applications and requests with the other health data access bodies. / Each health data access body shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the health data access bodies shall cooperate with each other and with the Commission, and, for concerns regarding data protection, with the supervisory authorities under Regulation (EU) 2016/679 as well as with the EDPB and the EDPS.

Article 36 – paragraph 2: 2. Member States shall ensure that each health data access body is provided with the human and financial resources, including necessary expertise, and ethics bodies, to support their tasks as provided for in Article 37(1), points (a) and (aa), and shall guarantee that all rights of natural persons under this Chapter are respected. / Member States shall also ensure technical resources, premises and infrastructure necessary for the effective performance of its tasks and the exercise of its powers, in a timely manner.

Article 36 – paragraph 2 a (new): 2a. Member States shall ensure that designated separate structures are set up within health data access bodies for the authorisation of the data permit, on the one hand, and for the reception and preparation of the data set, including anonymisation, pseudonymisation of the electronic health data and possible re-identification of natural persons for the purposes of Article 33(5) and 38(3), on the other hand.

Article 36 – paragraph 3: 3. In the performance of their tasks, health data access bodies shall actively cooperate with relevant stakeholders’ representatives, especially with representatives of patients, consumers, data holders and data users.