Spain and the European Health Data Space: a vision for healthcare transformation

When we receive medical care outside of our place of residence, we expect the health professional to be able to access our clinical information to provide us with the best possible care. Such data, treated with the right guarantees, can also help to investigate diseases or improve decisions in the health system. 

Digitalisation has multiplied the amount of information generated by healthcare systems. Medical records, diagnostic test results, medication dispensing records, or data from connected health devices make up a volume of data that, when properly managed, can transform healthcare and research. The challenge is to share data in a secure, interoperable and respectful way with patients' rights. 

The European Health Data Space (ESDS) establishes a common framework for moving in this direction. Its development will allow citizens to access their health information more easily and that the data can be used, under authorisation and in protected environments, for purposes of public interest. 

A report has recently been published on the application of the EEDS in Spain and the decisions necessary to adapt the health system to the new European framework. The document reviews the starting point of our country, identifies the main challenges and makes recommendations to move towards a safer and more interoperable use of health data. 

From regulatory framework to implementation: what changes with the EEDS

To understand what this implies in practice, it is first necessary to situate the legal framework that supports it. The construction of the European Health Data Space is part of the European strategy to boost the data economy in key sectors. In the health field, this space seeks to facilitate the exchange and use of health data with guarantees of security and interoperability. Regulation (EU) 2025/327, in force since March 2025, establishes the legal framework that orders its implementation. This standard regulates the use of information during healthcare and its reuse for authorized purposes, and also establishes requirements for electronic medical record systems. 

The Regulation articulates the EEDS around the two main uses of health data: 

• Primary use: is the processing of data to provide health care. It includes rights such as free access to electronic health information, request for rectifications, knowing who has consulted your data and restriction of certain accesses. The exchange of information between countries will be channelled through the European Digital Health Data Infrastructure (MyHealth@EU), designed to facilitate seamless cross-border healthcare.
• Secondary use: is the reuse of health data for research, innovation, or public policy design purposes. Access requires permission from the competent body and must be carried out under controlled conditions, with anonymised or pseudonymised data. Purposes such as marketing and decisions harmful to people are prohibited. 

The obligations provided for in Regulation (EU) 2025/327 will be implemented progressively, following a timetable for Member States and bodies to adapt. The adaptation will reach public and private providers. Centres with fewer resources will need guidance to adapt their systems. The Commission will have to approve the key implementing acts during the two-year implementation period starting in March 2027. In March 2029, the obligations on patients' summary medical records and electronic prescribing and dispensing will begin to apply. Much of the framework will also be applied for secondary use. By 2031, categories such as medical images, laboratory results and hospital discharge reports will be incorporated. 

The implementation of the EEDS in Spain must take into account the different digital skills of the population. The tools and channels that are enabled will need to be easy to use and offer support to those who encounter difficulties. The exercise of the specific rights incorporated in the European Health Data Space Regulation must be supported by clear channels so that citizens can consult their data and request corrections, as well as receive understandable information on the consequences of limiting access to certain categories of data.

Spain before the EEDS: a solid foundation and pending challenges

The primary use: more access and control for citizens

Spain starts from a favourable position in the field of care (primary use). The digital medical record of the National Health System and the interoperable electronic prescription offer a base already deployed. As the report highlights, our country also has experience in European cross-border exchange services, since all the autonomous communities are already connected or are in the process of testing the MyHealth@EU digital services infrastructure. 

Secondary use: secure data for better research and decision-making

Before requesting data, a research team needs to know what sets exist and what their quality is. HealthData@EU will connect the national catalogues and facilitate the processing of applications. The access bodies will evaluate each request and set the conditions of use. 

In Spain, the National Health Data Space works with a federated model. The sources maintain control of the information, which will be made available to anyone who requests it through the access agency within secure processing environments. The National Health Data Space is already a reality as we can see on its communication and access portal, operational since February 2026 and with more than 330 datasets already published in its catalogue.

Five priorities to be prepared for 2029

March 2029 is the first major milestone in the implementation of the Regulation, as we mentioned above. By then, the services corresponding to the first priority categories of primary use must be operational. The system of permissions and secure environments intended for secondary use will also begin to be applied for most categories of data. The report identifies five challenges that Spain will have to address before then. 

• Governance  is in first place. It will be necessary to delimit the functions of the state and regional authorities, in addition to establishing stable channels of coordination. The prior public consultation on the Draft Digital Health Law has already raised the adaptation of the Spanish law to the Regulation. The document also proposed to regulate an interoperable medical record of national scope and incorporate private providers.
• The second priority is the quality of the data. The information must be structured from its origin and accompanied by sufficient metadata. A catalog adds value when it allows you to know the contents of a set before starting a request. The HealthDCAT-AP standard provides a common vocabulary for documenting these resources.
• The third challenge is effective interoperability. The exchange must work between autonomous communities and between public and private health. A common technical standard does not in itself guarantee that all systems interpret information in the same way. Therefore, common standards will need to be validated in real-world situations to ensure that information retains the same meaning when moving from one system to another.
• The fourth priority is to strengthen the capacities of the professionals who will apply the EEDS. This includes health services, research centres and bodies responsible for authorising access to data. Healthcare workers will need to know how to record and query interoperable information. For their part, those responsible for data governance and legal and technological support teams will have to be aware of the access procedures, traceability obligations and conditions of use provided for in the Regulation.
• Finally, sustainability will make the difference between a pilot and a stable service. Multiannual funding and regular evaluation will be required. Citizen trust will depend on knowing who uses the data and for what purpose. The controls applied must also be visible. 

The underlying challenge: turning data into trust and public value

The European Health Data Space will be measured by its ability to improve care and facilitate research without weakening people's rights. Spain has relevant infrastructures and has accumulated experience in digital health. Decisions taken before March 2029 will show whether that basis can be converted into everyday services. 

The next step is to translate the principles of the Regulation into understandable and sustainable procedures. Where rights can be easily exercised and reuse is carried out under verifiable controls, the data space shall be integrated into the normal functioning of the health system. So anyone who needs care outside their community, or country, will find their health information where they need it. And that same information, reused safely and anonymously, will help to research diseases, evaluate treatments and design more effective health policies, a benefit that reverts to the general public.