Skip to content
ZINOS

Source DataIssue 001

Finland's bill shows one way to set up a health data access body

Daren Wilson, Chief Executive Officer, ZINOSPublished Download the PDF

By 26 March 2027, every Member State must tell the European Commission which health data access bodies it has designated. Finland and Germany have already sent bills to parliament in 2026 that set out who would handle access to health data for secondary use under the EHDS.

Get Source Data 001 as a PDF

We use your details as set out in our privacy notice.

Contents

Your country must name its health data access bodies by 26 March 2027, so find out which ones it plans to name1.

FINLANDHE 218/2026GERMANY21/8279YOUR COUNTRYWHICH BODY?26 MAR 2027NAME ACCESS BODIES
FINLAND: HE 218/2026. GERMANY: 21/8279. YOUR COUNTRY: WHICH BODY?.

Each hospital team has one thing to check this autumn

  • Heads of research units: ask your ministry which access body your country will name. Bills in Finland and Germany already propose theirs2,3.
  • Hospital IT: check whether your systems can describe your datasets in the single EU format required from 26 March 20294,5.
  • Data protection officers: check whether one code follows a patient across your research extracts. Italy's regulator ruled that one company's coded patient data were not anonymous6,7.
  • Research nurses: check that you can explain the European Health Data Space (EHDS) to patients. In a survey of 2,014 people living in Finland, only 15 per cent had heard of it8,9.
26 MAR 2027: COUNTRIES NAME ACCESS BODIES. 26 MAR 2029: EU DATASET FORMAT SECONDARY USE.

Hospitals that run research should own the data behind it

Source Data is a briefing from ZINOS for the people who run clinical research in hospitals: investigators, study nurses, research managers, data protection officers, and the IT teams who support them.

An office desk with a dark monitor and archive boxes on shelves at dusk

Clinical research happens in many places, from clinics and doctors' practices to patients' homes. Source Data focuses on the hospital, and we believe a hospital that runs research should own the data it produces. Doing that well takes more than good science. Hospitals have to work within a growing body of regulation and policy, and their systems have to keep pace. That is what lets a hospital run its own investigator-initiated trials and share research data with partner hospitals. It also keeps the hospital ready when a pharmaceutical or biotech sponsor asks it to host a study.

Each issue sets out what has changed and what research teams need to know to keep running trials properly. That covers the rules hospitals must meet, including those on sharing research data, and the practical steps behind them, always with the patient in mind. Every fact links to its source, so you can check it yourself.

This first issue is about the European Health Data Space and what it asks of hospitals that hold health data.

If this is useful to you, register for future issues at zinos.com, where you can also learn more about ZINOS and how we work with hospitals.

“The future of health is data. With AI, the hospital that controls its own data decides what research can do with it, while protecting its patients and working within the General Data Protection Regulation (GDPR).”

Daren Wilson, Chief Executive Officer, ZINOS, daren.wilson@zinos.com

Daren Wilson is Chief Executive Officer of ZINOS and Co-Founder and Senior Partner of HealthSeed AG, a Swiss healthcare venture studio. He leads ZINOS's work with hospitals that want to take ownership of their research data and form multi-site research coalitions.

Finland and Germany have put their health data access bodies into bills before parliament

By Daren Wilson

What does EHDS implementation 2026 mean for hospital research units?

By 26 March 2027, every Member State must tell the European Commission which health data access bodies it has designated1. Finland and Germany have already sent bills to parliament in 2026 that set out who would handle access to health data for secondary use under the EHDS10,11,3. Ask your ministry which body your country will name, and how it will be set up.

What will an access body decide about your hospital's data?

Under the EHDS Regulation, each Member State designates one or more access bodies12. An access body decides on applications to access health data13. It also issues data permits for secondary use13. Secondary use means using electronic health data for a purpose other than the reason they were first collected or produced14. Chapter IV of the Regulation sets out which purposes count14. The Regulation's general start date is 26 March 202715. Most of Chapter IV, the part on secondary use, starts to apply later, on 26 March 202916.

Finland's Government submitted its bill to Parliament on 1 October 2026, as government proposal HE 218/202610. Under the bill, Finland would have five regional access bodies and one central national body, Findata, the data permit authority2. A person could opt out of secondary use through Omakanta, Finland's national patient portal17. When we checked on 21 October, the bill was still before Parliament18.

The German Federal Government's bill on data and digital innovation in healthcare is dated 30 September 202619. The Bundestag, Germany's parliament, printed it as document 21/827919. The bill would set up an access body at the Federal Institute for Drugs and Medical Devices (BfArM)3. Further access bodies for specific domains would sit alongside it3. The bill's explanatory memorandum names the Forschungsdatenzentrum Gesundheit (FDZ Gesundheit), a central infrastructure at BfArM, for claims data20,21. It names the Zentrum für Medizinregister for register data20. It suggests the Netzwerk Universitätsmedizin for university medicine data20. The Bundestag held the first reading on 8 October11. Its health committee held a public hearing on 14 October11.

FinlandGermany
BillHE 218/2026, submitted 1 October 202610Bundestag document 21/8279, 30 September 202619
StageStill before Parliament on 21 October 202618First reading 8 October, committee hearing 14 October11
Access bodiesFive regional bodies and one central national body, Findata2An access body at BfArM, plus bodies for specific domains such as claims and register data3,20
Patient opt-outThrough Omakanta17Not covered in this issue
30 SEP: GERMANY BILL DATED. 1 OCT: FINLAND BILL SUBMITTED. 8 OCT: GERMANY FIRST READING. 14 OCT: GERMANY PUBLIC HEARING. 21 OCT: FINLAND STILL BEFORE PARLIAMENT.

Hospitals that hold health data will describe their datasets in one EU format from March 2029

Ask whoever runs your registries to map them to the format now.

On 18 September 2026, the Commission adopted a detailed rule under the EHDS, Implementing Regulation (EU) 2026/209822. It sets the minimum details a health data holder must include when describing its datasets to an access body for secondary use23. Under the EHDS Regulation, a hospital is a health data holder if the law allows or requires it to process personal electronic health data24. It must also be the data controller, alone or jointly with others24. Under the General Data Protection Regulation, the data controller is whoever decides why and how personal data are processed25. Holders must write these minimum details in HealthDCAT-AP, the Commission's technical specification for describing health datasets5. The act starts to apply on 26 March 20294.

Two other Commission acts start to apply on 26 March 202726,27. One sets security and technical rules for MyHealth@EU, including the checks needed to join it and stay connected28,29. MyHealth@EU is a centralised platform that makes it easier for systems to work together and to exchange health data across borders30. The other act sets up a way to identify people and health professionals when personal electronic health data are exchanged across borders31. Two provisions of the identification act start later, on 26 March 202927.

26 MAR 2027: MYHEALTH@EU RULES IDENTIFICATION ACT. 26 MAR 2029: DATASET FORMAT HEALTHDCAT-AP TWO IDENTIFICATION ACT PROVISIONS.

Hamburg's university cancer centre merged its registry and biobank consent forms into one

Compare your consent process with Hamburg's, where the forms are already combined32.

The University Cancer Center Hamburg (UCC Hamburg) is the cancer centre at the University Medical Center Hamburg-Eppendorf (UKE)33. On 1 October 2026, it introduced one research consent form for all oncology departments at the UKE33. It brings together the earlier consent forms for the Clinical Cancer Registry and the biobank32. Staff obtain the consent on paper and then record it digitally in the hospital information system34. With this consent, the cancer centre can collect data centrally in its data warehouse and link biosamples across the site35.

The UK medicines regulator added an inspection dossier for trial system suppliers

Ask the suppliers of your trial systems whether they could produce one.

When the UK's Medicines and Healthcare products Regulatory Agency (MHRA) is considering an organisation for inspection, it asks the organisation for information set out in an inspection dossier36. It also asks for a clinical trials spreadsheet36. The organisation must send both within 30 days36.

On 22 September 2026, the MHRA added a new inspection dossier to its guidance on good clinical practice inspections37. Good clinical practice is an international ethical and scientific quality standard for designing, recording, and reporting trials that involve human participants38. The new dossier is for organisations that provide computer systems in support of clinical trials37. Under the guidance, organisations that develop and maintain trial-specific computer systems are among those that have to comply with good clinical practice39. The dossier comes with a template, a clinical trials spreadsheet, and a checklist40.

If a supplier's system holds your trial data, ask the supplier in writing whether it could produce this dossier, and keep its reply on file.

Italy's data protection authority found a company's coded patient data were not anonymous

The ruling concerned a patient database built by one company, which belongs to a multinational group active in health data analysis and clinical research6,41. The authority, known as the Garante, fined that company €7 million6. Before calling a research extract anonymous, test whether one code follows a patient across records.

The Garante's decision is dated 23 September 2026, and it was announced on 2 October6. The database held health information on one million patients of 800 general practitioners41. The Garante found that the code linked to each patient allowed that patient to be followed over time7. Together with the other details in the database, the code let someone pick out a single patient and, with reasonable means, find out who they were7. The Garante also found that the company had processed health data without a suitable legal basis and without adequately informing patients42.

If a code does follow your patients, also ask whether the other details would let someone pick out one patient.

Settle these four questions, the first by 13 November 2026

Take these to your ministry and your own teams.

1. Will you comment on the Commission's draft templates for access applications and data permits?

The Commission accepts feedback until 13 November 202643.

2. Which body will decide on access to your data, and is your country's plan closer to Finland's or Germany's?

Finland's bill proposes five regional bodies and one central body, Findata2. Germany's bill proposes a coordinating access body at BfArM, plus further bodies for particular kinds of data3.

3. Which of your datasets would you describe, and can your systems write those descriptions in HealthDCAT-AP?

The Commission's act on dataset descriptions lists the minimum details in Part B of its Annex5. Holders must express each one using the definitions and fixed lists of permitted terms that HealthDCAT-AP sets out5.

4. How will a patient's opt-out reach your research data?

Under Finland's bill, a person could opt out through Omakanta17. At UKE, the single research consent is recorded in the hospital information system34.

Six dates between now and March 2027 affect trials and research data

Put each in your diary. Letters of intent for one funding call are due by 31 December 2026, and pre-proposals for another by 14 January 202744,45.

DateEntry
27 Oct 2026ERA4Health is scheduled to publish its IICS4all 2027 call46. ERA4Health is a European partnership that funds joint research across countries in priority areas of European public health47. IICS4all 2027 is its ninth joint transnational call48. IICS stands for investigator-initiated clinical studies48. The call will fund multinational studies of this kind that include underrepresented populations48. It will support interventional studies in cardiovascular, metabolic, autoimmune, and non-communicable respiratory diseases46
13 Nov 2026Feedback closes on the Commission's draft templates for access applications and data permits43
27 Nov 2026European Medicines Agency online workshop on the role of multiplicity in regulatory decision-making for two-arm and platform trial designs, 09:00–15:00 Amsterdam time49,50
31 Dec 2026Letters of intent due by 17:00 Central European Time (CET) for the Paediatric Clinical Research Infrastructure Service Model (PRISM) call, covering paediatric studies outside oncology and rare diseases44,51
14 Jan 2027ERA4Health IICS4all pre-proposals due, 12:00 CET45
26 Mar 2027Deadline for Member States to name their access bodies to the Commission, and the general start date of the EHDS Regulation1,15

Only 15 per cent of people in Finland had heard of the EHDS

Expect to explain it when you ask patients for consent or record an opt-out.

A Findata survey collected answers from 2,014 people living in Finland in November 20259. Of those, 15 per cent had heard of the EHDS8. In the same survey, 86 per cent supported the use of health data in research52. Asked separately, 86 per cent said people should have the right to decide for themselves who may use their health data53.

HAD HEARD OF THE EHDS15%
SUPPORT THE USE OF HEALTH DATA IN RESEARCH86%
SAY PEOPLE SHOULD DECIDE WHO MAY USE THEIR HEALTH DATA86%
FINDATA SURVEY, 2,014 PEOPLE IN FINLAND, NOVEMBER 2025

Book a call about what March 2027 means for your unit

Book a call at zinos.com/contact, or write to me at daren.wilson@zinos.com. You can also read our white paper Health data holder.

Order drawn from fragmentation.

We checked every primary source in this issue on 21 or 22 October 2026. The three Commission acts in this issue were published in the Official Journal of the European Union28,22,31. Our search of the Official Journal did not cover 23 September to 10 October 2026, so an act published in that period may be missing from this issue.

Get Source Data 001 as a PDF

We use your details as set out in our privacy notice.

References

  1. 1 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 55(6): Member States must inform the Commission of the identity of their designated health data access bodies by 26 March 2027, and the Commission and Member States make that information public.
    https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng Checked 22 October 2026
  2. 2 Finlex (Ministry of Justice, Finland). Published 1 October 2026.
    Under HE 218/2026, Finland would have five regional health data access bodies and one central national body, the data permit authority (Tietolupaviranomainen, also called Findata), which would also act as the coordinating body: six in total.
    https://www.finlex.fi/en/government-proposals/2026/218 Checked 21 October 2026
  3. 3 Deutscher Bundestag. Published 30 September 2026.
    Germany's government bill would distribute the roles and tasks in the EHDS data access procedure under Chapter IV of Regulation (EU) 2025/327 across a decentralised system, with a coordinating health data access body at the Federal Institute for Drugs and Medical Devices (BfArM) and further domain-specific access bodies.
    https://dip.bundestag.de/drucksache/entwurf-eines-gesetzes-f%C3%BCr-daten-und-digitale-innovation-im-gesundheitswesen/291261 Checked 22 October 2026
  4. 4 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Implementing Regulation (EU) 2026/2098 enters into force on the twentieth day following its publication in the Official Journal and applies from 26 March 2029.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2098/oj Checked 21 October 2026
  5. 5 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Implementing Regulation (EU) 2026/2098 uses HealthDCAT-AP, a technical specification developed and maintained by the Commission for describing health datasets for secondary use, as the metadata framework, and requires holders to express the minimum elements using its definitions, structure, cardinalities and controlled vocabularies.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2098/oj Checked 21 October 2026
  6. 6 Garante per la protezione dei dati personali (Italian data protection authority). Published 2 October 2026 (press release); provision n. 710 dated 23 September 2026.
    Garante press release of 2 October 2026 and provision no. 710 of 23 September 2026
    https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10302141 Checked 22 October 2026
  7. 7 Garante per la protezione dei dati personali (Italian data protection authority). Published 2 October 2026.
    Garante press release of 2 October 2026 and provision no. 710 of 23 September 2026
    https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10302141 Checked 21 October 2026
  8. 8 Findata (with the Ministry of Social Affairs and Health). Published 30 September 2026.
    The Findata survey found that only 15 per cent of people in Finland had heard of the EHDS.
    https://findata.fi/en/press-releases/survey-finns-support-the-use-of-health-data-in-research-most-want-to-decide-on-its-use-themselves/ Checked 21 October 2026
  9. 9 Findata (with the Ministry of Social Affairs and Health). Published 30 September 2026.
    The survey was answered by 2,014 people living in Finland, with responses collected in November 2025.
    https://findata.fi/en/press-releases/survey-finns-support-the-use-of-health-data-in-research-most-want-to-decide-on-its-use-themselves/ Checked 21 October 2026
  10. 10 Finlex (Ministry of Justice, Finland). Published 1 October 2026.
    Finland's Government submitted proposal HE 218/2026 to Parliament on 1 October 2026, to supplement the EHDS rules on secondary use of health data and sanctions.
    https://www.finlex.fi/en/government-proposals/2026/218 Checked 21 October 2026
  11. 11 Deutscher Bundestag. Published October 2026.
    Germany's Bundestag debated the Federal Government's bill for a Law on Data and Digital Innovation in Healthcare (Drucksache 21/8279) in first reading on 8 October 2026 and referred it to the health committee, which held a public hearing on 14 October 2026.
    https://www.bundestag.de/dokumente/textarchiv/2026/kw42-pa-gesundheit-1223392 Checked 22 October 2026
  12. 12 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 55(1): each Member State designates one or more health data access bodies.
    https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng Checked 22 October 2026
  13. 13 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 57(1)(a): health data access bodies decide on health data access applications, authorise and issue data permits for secondary use, and decide on health data requests.
    https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng Checked 22 October 2026
  14. 14 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 2(2)(e): 'secondary use' means processing electronic health data for the purposes set out in Chapter IV, other than the initial purposes for which they were collected or produced.
    https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng Checked 22 October 2026
  15. 15 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 105: the Regulation applies generally from 26 March 2027.
    https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng Checked 22 October 2026
  16. 16 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 105: Chapter IV (secondary use) applies from 26 March 2029, with exceptions.
    https://eur-lex.europa.eu/eli/reg/2025/327/oj Checked 22 October 2026
  17. 17 Finlex (Ministry of Justice, Finland). Published 1 October 2026.
    Under HE 218/2026 a person could set the EHDS Article 71 opt-out from secondary use through Omakanta, the national patient portal.
    https://www.finlex.fi/en/government-proposals/2026/218 Checked 21 October 2026
  18. 18 Finlex (Ministry of Justice, Finland). Published 21 October 2026.
    The Finnish Government proposal HE 218/2026 was listed as pending in Parliament (vireillä) on Finlex on 21 October 2026.
    https://www.finlex.fi/en/government-proposals/2026/218 Checked 21 October 2026
  19. 19 Deutscher Bundestag. Published 30 September 2026.
    The bill's official title is 'Entwurf eines Gesetzes für Daten und digitale Innovation im Gesundheitswesen', a Federal Government bill printed as Bundestag Drucksache 21/8279, dated 30 September 2026.
    https://dip.bundestag.de/drucksache/entwurf-eines-gesetzes-f%C3%BCr-daten-und-digitale-innovation-im-gesundheitswesen/291261 Checked 22 October 2026
  20. 20 Deutscher Bundestag, Drucksache 21/8279 (Gesetzentwurf der Bundesregierung, Entwurf eines Gesetzes für Daten und digitale Innovation im Gesundheitswesen), Begründung zu § 9 Absatz 1, p. 202. Published 30 September 2026.
    In the explanatory memorandum to section 9 of the German government bill on data and digital innovation in healthcare, the domains named for domain-specific health data access bodies are claims data and register data (the FDZ Gesundheit and the Zentrum für Medizinregister) and, as a suggestion, university medicine data (the Netzwerk Universitätsmedizin).
    https://dserver.bundestag.de/btd/21/082/2108279.pdf Checked 22 October 2026
  21. 21 Bundesministerium für Gesundheit (Federal Ministry of Health), FAQ Forschungsdatenzentrum (FDZ) Gesundheit. Undated page.
    FDZ Gesundheit is short for Forschungsdatenzentrum Gesundheit; the Federal Ministry of Health describes it as a central infrastructure at the Federal Institute for Drugs and Medical Devices (BfArM).
    https://www.bundesgesundheitsministerium.de/themen/gesundheitswesen/forschungsdatenzentrum-fdz-gesundheit-fragen-und-antworten Checked 22 October 2026
  22. 22 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Commission Implementing Regulation (EU) 2026/2098, laying down the minimum metadata elements for dataset descriptions for the secondary use of electronic health data under Article 77(4) of the EHDS Regulation, was adopted on 18 September 2026 and published in the Official Journal L series on 21 September 2026.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2098/oj Checked 21 October 2026
  23. 23 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Implementing Regulation (EU) 2026/2098 sets the minimum metadata elements, and their characteristics, that health data holders must provide to health data access bodies to describe datasets for secondary use of electronic health data, and sets the metadata framework to be used.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2098/oj Checked 21 October 2026
  24. 24 Publications Office of the European Union (EUR-Lex, Official Journal). Published 5 March 2025.
    EHDS Regulation (EU) 2025/327, Article 2(2)(t): a 'health data holder' is any natural or legal person, public authority, agency or other body in the healthcare or care sectors that has the right or obligation, under applicable Union or national law and in its capacity as a controller or joint controller, to process personal electronic health data (for healthcare or care, public health, reimbursement, research, innovation, policymaking, official statistics, patient safety or regulatory purposes).
    https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng Checked 22 October 2026
  25. 25 Official Journal of the European Union (EUR-Lex), Regulation (EU) 2016/679, Article 4(7). Published 4 May 2016.
    Under the General Data Protection Regulation, a controller is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
    https://eur-lex.europa.eu/eli/reg/2016/679/oj Checked 22 October 2026
  26. 26 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Implementing Regulation (EU) 2026/2083 enters into force on the twentieth day following its publication in the Official Journal and applies from 26 March 2027.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2083/oj Checked 21 October 2026
  27. 27 Publications Office of the European Union (Official Journal of the European Union, L series). Published 22 September 2026.
    Implementing Regulation (EU) 2026/2099 enters into force on the twentieth day following its publication in the Official Journal and applies from 26 March 2027, except Article 3(3) and Article 5(2), which apply from 26 March 2029.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2099/oj Checked 21 October 2026
  28. 28 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Commission Implementing Regulation (EU) 2026/2083 on MyHealth@EU was adopted by the Commission on 18 September 2026 and published in the Official Journal L series on 21 September 2026.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2083/oj Checked 21 October 2026
  29. 29 Publications Office of the European Union (Official Journal of the European Union, L series). Published 21 September 2026.
    Implementing Regulation (EU) 2026/2083 lays down rules on cybersecurity, technical and semantic interoperability, operations and service management for MyHealth@EU, covering the Commission's role as processor, and the conditions for compliance checks needed to join and stay connected to MyHealth@EU.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2083/oj Checked 21 October 2026
  30. 30 European Commission, Directorate-General for Health and Food Safety. Undated (no publication date on the page).
    MyHealth@EU is a centralised platform to make interoperability easier and to exchange health data across borders; citizens can view the services already active under it.
    https://health.ec.europa.eu/ehealth-digital-health-and-care/digital-health-and-care_en Checked 22 October 2026
  31. 31 Publications Office of the European Union (Official Journal of the European Union, L series). Published 22 September 2026.
    Commission Implementing Regulation (EU) 2026/2099, on an interoperable cross-border identification and authentication mechanism for natural persons, health professionals and healthcare providers for cross-border exchange of personal electronic health data, was adopted on 21 September 2026 and published in the Official Journal L series on 22 September 2026.
    https://eur-lex.europa.eu/eli/reg_impl/2026/2099/oj Checked 21 October 2026
  32. 32 University Medical Center Hamburg-Eppendorf (UKE), UCC Hamburg. Undated page; text states 1 October 2026 as introduction date.
    The new UKE consent form consolidates the previous consent forms for the Clinical Cancer Registry and the UCC Hamburg Biobank.
    https://www.uke.de/english/departments-institutes/centers/ucc-hamburg/physicians/research-data-management/index.html Checked 21 October 2026
  33. 33 University Medical Center Hamburg-Eppendorf (UKE), UCC Hamburg. Page footer: last update 01/10/2026; text states 1 October 2026 as introduction date.
    On 1 October 2026, UCC Hamburg (the University Cancer Center Hamburg, the cancer centre at the University Medical Center Hamburg-Eppendorf, UKE) introduced the UCC Hamburg Broad Consent, a standardised research consent form that applies to all oncology departments at the UKE.
    https://www.uke.de/english/departments-institutes/centers/ucc-hamburg/physicians/research-data-management/index.html Checked 22 October 2026
  34. 34 University Medical Center Hamburg-Eppendorf (UKE), UCC Hamburg. Undated page; text states 1 October 2026 as introduction date.
    At UKE, staff obtain the new research consent on paper and it is then recorded digitally in the hospital information system, where it is visible and accessible.
    https://www.uke.de/english/departments-institutes/centers/ucc-hamburg/physicians/research-data-management/index.html Checked 21 October 2026
  35. 35 University Medical Center Hamburg-Eppendorf (UKE), UCC Hamburg. Undated page; text states 1 October 2026 as introduction date.
    The UKE consent form enables centralised data collection and retrieval through the UCCH data warehouse, and site-wide linking of biosamples.
    https://www.uke.de/english/departments-institutes/centers/ucc-hamburg/physicians/research-data-management/index.html Checked 21 October 2026
  36. 36 Medicines and Healthcare products Regulatory Agency (MHRA), GOV.UK. Published 22 September 2026 (page last updated; page first published 18 December 2014).
    When the MHRA notifies an organisation that it is being considered for GCP inspection, the notification includes a request for a GCP inspection dossier and a clinical trials spreadsheet, which must be provided within 30 days.
    https://www.gov.uk/guidance/clinical-trials-for-medicines-good-clinical-practice-inspections Checked 21 October 2026
  37. 37 Medicines and Healthcare products Regulatory Agency (MHRA), GOV.UK. Published 22 September 2026 (page last updated; page first published 18 December 2014).
    On 22 September 2026 the MHRA, the UK medicines regulator, added to its GCP inspection guidance a specific inspection dossier for organisations that provide computerised systems in support of clinical trials.
    https://www.gov.uk/guidance/clinical-trials-for-medicines-good-clinical-practice-inspections Checked 21 October 2026
  38. 38 European Medicines Agency (EMA). Undated (no publication date on the page).
    Good clinical practice (GCP) is an international ethical and scientific quality standard for designing, recording and reporting trials that involve the participation of human subjects.
    https://www.ema.europa.eu/en/human-regulatory-overview/research-development/compliance-research-development/good-clinical-practice Checked 22 October 2026
  39. 39 Medicines and Healthcare products Regulatory Agency (MHRA), GOV.UK. Published 22 September 2026 (page last updated; page first published 18 December 2014).
    MHRA guidance lists organisations that develop and maintain trial specific computerised systems among the organisations that have to comply with GCP.
    https://www.gov.uk/guidance/clinical-trials-for-medicines-good-clinical-practice-inspections Checked 21 October 2026
  40. 40 Medicines and Healthcare products Regulatory Agency (MHRA), GOV.UK. Published 22 September 2026 (page last updated; page first published 18 December 2014).
    The MHRA page lists a template, a clinical trial spreadsheet, and a checklist for the Computerised Systems dossier, alongside the standard GCP dossier documents.
    https://www.gov.uk/guidance/clinical-trials-for-medicines-good-clinical-practice-inspections Checked 21 October 2026
  41. 41 Garante per la protezione dei dati personali (Italian data protection authority). Published 2 October 2026.
    Garante press release of 2 October 2026 and provision no. 710 of 23 September 2026
    https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10302141 Checked 21 October 2026
  42. 42 Garante per la protezione dei dati personali (Italian data protection authority). Published 2 October 2026.
    Garante press release of 2 October 2026 and provision no. 710 of 23 September 2026
    https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10302141 Checked 21 October 2026
  43. 43 European Commission, Have your say. Published 16 October 2026.
    The Commission opened feedback on a draft implementing regulation on templates for secondary-use access applications, data permits and health data requests, from 16 October to 13 November 2026.
    https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16712 Checked 21 October 2026
  44. 44 Paediatric Clinical Research Infrastructure Service Model (PRISM). Page undated; call opened 30 September 2026.
    Letters of intent for the first PRISM call for investigator-initiated paediatric studies are due by 31 December 2026, 17:00 CET, with full applications due by 30 June 2027, 17:00 CEST.
    https://www.prismeu.org/calls.html Checked 22 October 2026
  45. 45 ERA4Health Partnership. Published 28 September 2026.
    The pre-proposal deadline for the ERA4Health IICS4all 2027 call is 14 January 2027, at 12:00 CET. The call-at-a-glance table lists the funding decision as End of October 2027 and project duration as up to 48 months; the page states no budget.
    https://era4health.eu/news/blogdetail.php?id=136 Checked 22 October 2026
  46. 46 ERA4Health Partnership. Published 28 September 2026.
    ERA4Health's pre-announcement for its IICS4all 2027 call (JTC9) says the call will support multinational interventional investigator-initiated clinical studies addressing cardiovascular, metabolic, autoimmune and non-communicable respiratory diseases, through pragmatic, phase III, multinational interventional studies.
    https://era4health.eu/news/blogdetail.php?id=136 Checked 22 October 2026
  47. 47 ERA4Health Partnership (coordinator: Instituto de Salud Carlos III). Undated (no publication date on the page).
    ERA4Health is a European partnership that increases transnational collaborative research funding by creating a funding body for joint programming in priority areas addressing European public health needs.
    https://era4health.eu/partnership/ataglance.php Checked 22 October 2026
  48. 48 ERA4Health Partnership (Joint Call Secretariat: DLR Projektträger). Undated (pre-announcement page).
    ERA4Health has pre-announced IICS4all 2027, its 9th Joint Transnational Call, which will fund multi-national investigator-initiated clinical studies that include underrepresented populations.
    https://era4health.eu/calls/pre_iics4all2027.php Checked 22 October 2026
  49. 49 European Medicines Agency (ACT EU). Published 25 September 2026.
    EMA's ACT EU holds an online workshop on multiplicity in two-arm and platform trials on Friday 27 November 2026, 09:00 to 15:00 Amsterdam time.
    https://www.ema.europa.eu/en/events/act-eu-workshop-multiplicity-confirmatory-clinical-trials-two-arm-platform-trials Checked 21 October 2026
  50. 50 European Medicines Agency (ACT EU). Published 25 September 2026.
    The workshop aims to address the role of multiplicity in regulatory decision-making for two-arm and platform trial designs.
    https://www.ema.europa.eu/en/events/act-eu-workshop-multiplicity-confirmatory-clinical-trials-two-arm-platform-trials Checked 21 October 2026
  51. 51 Paediatric Clinical Research Infrastructure Service Model (PRISM). Page undated; call opened 30 September 2026.
    The PRISM call covers participants from birth to 18 years and any paediatric disease area except oncology and rare diseases.
    https://www.prismeu.org/calls.html Checked 22 October 2026
  52. 52 Findata (with the Ministry of Social Affairs and Health). Published 30 September 2026.
    A Findata survey reported that 86 per cent of respondents in Finland support the use of health data in research.
    https://findata.fi/en/press-releases/survey-finns-support-the-use-of-health-data-in-research-most-want-to-decide-on-its-use-themselves/ Checked 21 October 2026
  53. 53 Findata (with the Ministry of Social Affairs and Health). Published 30 September 2026.
    The same Findata survey reported that 86 per cent of respondents believe people should have the right to decide for themselves who may use their health data.
    https://findata.fi/en/press-releases/survey-finns-support-the-use-of-health-data-in-research-most-want-to-decide-on-its-use-themselves/ Checked 21 October 2026

About ZINOS

ZINOS is a business of HealthSeed AG (Switzerland), developed in joint venture with MIA Solutions s.r.o. (Slovakia).

zinos.com/contact · daren.wilson@zinos.com · zinos.com/about · White paper: Health data holder

See how ZINOS fits your hospital.

Book a demoRequest the documentation
Book a demo