TEHDAS2 publishes guidance on delivering data for secondary use
TEHDAS2 has released a guideline for health data holders on making electronic health data available for secondary use under the European Health Data Space (EHDS).
The document focuses on what happens after a national health data access body issues a data permit or approves a request. It places the role of health data holders (e.g. healthcare providers, registries, insurers and developers of health-related services and devices) within the wider EHDS framework and explains the main obligations and practical considerations for timely, consistent delivery.
“By clearly distinguishing between legal requirements and recommended practices, this guideline offers a structured, introductory overview of roles, responsibilities and key steps, while guiding readers to other TEHDAS2 guidelines for more detailed support. This supports consistent implementation across Member States,” said lead author Lisa Zhao, Advisor at Nictiz.
Steps required under the EHDS
The guideline sets out the minimum process health data holders should follow, including:
- providing the requested data within the prescribed three-month timeframe;
- supplying only the data necessary for the approved purpose;
- maintaining accurate dataset descriptions in the national catalogue; and
- ensuring access to relevant non‑personal data through trusted open databases where required.
To make these requirements more concrete, the guideline describes what the steps look like in practice. For example, when a data permit defines a specific group of patients and variables, the health data holder must extract only those records and deliver them to the secure processing environment designated by the national authority. If a national opt‑out mechanism applies, data relating to individuals who have opted out must be excluded.
Optional practices to support delivery
Alongside the mandatory steps, the guideline proposes optional practices drawn from expert experience that can help organisations avoid delays and improve internal preparedness. These include:
- verifying early whether the request is feasible within the required timeline;
- clarifying ambiguous instructions with the health data access body;
- conducting basic validation checks before submitting data; and
- organising internal workflows to ensure staff and systems are ready when a request arrives.
Illustrative examples highlight common issues in data extraction, such as unclear selection criteria or overly large file formats, and show how early communication can prevent rework.
This non‑binding guideline forms part of a wider set of TEHDAS2 outputs supporting the early-stage EHDS implementation. Related TEHDAS2 guidance covers other aspects, including data access procedures, metadata and secure processing environments.
Download document: Guideline for health data holders on making personal and non‑personal electronic health data available for reuse
A summary of the comments received during the public consultation and how they were addressed is available in the annex.
View published TEHDAS2 results
Key recommendations stemming from the work
For Member States
- Clearly define and communicate the roles and responsibilities of health data holders under the EHDS and establish a consistent minimum process for handling data access requests and making data available for secondary use.
- Provide early clarity on key national implementation choices, including governance structures, allocation of responsibilities, opt-out implementation, data preparation (e.g. anonymisation) and technical infrastructure and interoperability (DAAMS and the use of secure processing environments).
For the European Commission
- Provide further practical guidance to support consistent implementation across Member States, particularly in complex areas, such as intellectual property rights and trade secrets, data minimisation and anonymisation, assessment of data access applications, opt-out implementation and the use of secure processing environments.
Share away!