EHDS readiness for research hospitals

What the regulation asks of a hospital

The European Health Data Space Regulation, Regulation (EU) 2025/327, entered into force in March 2025.Source Most attention has gone to its first half: patients' access to their own records across borders. The second half matters more to a research hospital. It creates a system for the secondary use of health data, meaning its use for research, innovation, policy, and regulation, and it gives hospitals a defined role in it.

That role is health data holder. A hospital that processes personal electronic health data as a controller is one. Individual researchers and microenterprises are exempt unless a Member State extends the duties to them.Source Almost every hospital that runs clinical research is in scope.

Data holders do not decide on their own who receives data. Requests go to a national health data access body, which assesses each application and issues a data permit where the purpose is allowed.Source The access body then asks the data holders to supply what the permit covers.

The dates

The dates are fixed in the regulation. The practical work of describing and supplying data takes longer to build than the time left.

The duties, one by one

1. Describe your datasets. Each data holder describes the datasets it holds in the covered categories, and those descriptions feed a public catalogue that researchers search before they apply. The hospital checks them at least once a year.Source Much of the groundwork uses HealthDCAT-AP, a health metadata profile developed in the Commission-funded HealthData@EU pilot.

2. Supply requested data within three months. When an access body issues a permit and asks for data, the holder makes it available within three months. The access body can extend that by up to three months.Source For a hospital whose records sit in six systems, each request becomes a cross-system extraction project with a deadline.

3. Document data quality. Datasets collected with public funding carry a data quality and utility label. The label covers documentation, technical quality, quality management, coverage, access, and changes to the data. For other datasets it is optional.Source Researchers will prefer datasets that carry one.

4. Deliver into secure processing environments. Approved users do not receive patient-level files. They work inside a secure processing environment under the access body's control, on anonymised data by default and pseudonymised data only where the purpose needs it, and they take out only non-personal results.Source The hospital's job is to prepare the extract correctly and hand it over through the defined channel.

5. Respect opt-outs. Individuals may opt out of the secondary use of their data at any time, without giving a reason. Member States provide the opt-out mechanism.Source Holders must be able to exclude those records from what they supply.

6. Expect cost recovery, not revenue. Access bodies may charge fees proportionate to the cost of making data available, and those fees can include compensation for the data holder's costs.Source They recover effort; they are not a revenue line.

Why it matters beyond compliance

The same regulation that creates the duties also opens doors. Scientific research as a secondary use includes training, testing, and evaluating AI algorithms used in health or care.Source European research networks increasingly work the same way: data stays at the institution, is described in a common format, and is analysed where it sits.

A hospital that can describe and supply its data well is ready for more than the access body. It is ready to join research collaborations as a partner that holds its own data, and to build or validate AI on its own records without handing them to anyone else.

What readiness takes inside the hospital

Ten capabilities separate a hospital that can answer a permit in three months from one that cannot.

1. An inventory of every system that holds research-relevant data, and who owns each one.
2. One governed layer where records from those systems sit together, under one permission model and one audit trail.
3. Coding at capture to international classifications (ICD-10, ICD-O-3, Orpha codes, and others), so datasets can be described and combined without recoding.
4. A dataset catalogue that can generate descriptions in the standard format and keep them current.
5. Provenance: where each record came from, when, and how it has changed.
6. Quality documentation that can support the data quality and utility label.
7. Anonymisation, pseudonymisation, and extraction that can prepare a permit-scoped extract repeatably, not by hand each time.
8. An opt-out register applied automatically at extraction.
9. A permit and release log: every request, every approval, every release, on the record.
10. Clear ownership: the research office, the data protection officer, and IT agree who does what before the first request arrives.

A readiness plan

Where to start

Start with governance, not software. Bring the research office, the data protection officer, and IT into one room. Agree the inventory, the pilot dataset, and who owns the catalogue.

Then pick the pilot that teaches the most. A registry or biobank with a clear owner, a defined population, and existing coding is usually the fastest route to a first dataset description you can defend.

How ZINOS fits

The ZINOS Scientific and Research Data Hub is EHDS-aligned. It brings a hospital's research records, from health records and laboratory results to imaging, digital pathology, genomics, and biobank samples, under one governed layer inside the hospital. It keeps them coded to international classifications at capture, releases anonymised extracts on the hospital's terms, and logs every release in one audit trail. See how the data hub works, or read the health data holder example.

Sources

1. Regulation (EU) 2025/327 on the European Health Data Space, Official Journal of the European Union, 5 March 2025.
2. European Commission, Frequently asked questions on the European Health Data Space.
3. TEHDAS2, guideline for data holders on describing health datasets with HealthDCAT-AP, 27 October 2025.
4. Bird & Bird, Health data holders' obligations under the EHDS: what, when, and how will we know.
5. Covington, Inside Privacy, The European Health Data Space from the health data holder's perspective.