Minister Kuipers (VWS) sends the House of Representatives the impact analyses on the committee proposal regarding a European Health Data Space.
On June 3, 2022, the Cabinet provided an appreciation on the proposal for a Regulation of the European Parliament and of the Council on the European Health Data Space, also known as the "European Health Data Space", (hereinafter "the EHDS")1 in the BNC fiche2. During the June 15, 2022 Commission debate on the EHDS, I expressed my intention to commission three impact analyses by external parties. These are a legal impact analysis, a financial impact analysis and a technical/organizational-social/ethical (technical & social for short) impact analysis.
The impact analyses were conducted to provide more interpretation on the consequences for the Netherlands. In this letter I will explain these issues based on the results. I emphasize that the results of the impact analyses are based on the current proposal for an EHDS as presented by the European Commission. Discussions in the working groups of the European Council (Council working groups on Employment, Social Policy, Health and Consumer Affairs) are still ongoing. In the process, the EHDS is also still being discussed in the European Parliament. It is plausible that the EHDS will still change on essential points during the negotiations.
Furthermore, I would like to indicate that the legal impact analysis devotes a specific section to the proposal of the Electronic Data Interchange in Healthcare Act (Wegiz), which was recently passed by the House of Representatives and awaits consideration by the Senate. In preparation for the Senate's written question session on the Wegiz, I have already sent the legal impact analysis accompanied by a reflection on the impact on the bill to both Houses on November 21, 2022. Therefore, this topic will not be discussed further in this letter (3).
In the appendices you will find the reports of these impact analyses.
Legal impact analysis
I asked the Radboud University to prepare an analysis of the legal consequences of the EHDS for the Dutch legal order. In doing so, I have requested that it specifically address the question of whether the EHDS complies with the Union law requirements of jurisdiction, subsidiarity and proportionality. Furthermore, I requested the Radboud University to investigate what the EHDS means for existing and upcoming national legislation, especially the Wegiz.
Financial impact analysis
I have asked KPMG to make an analysis of the financial consequences of the EHDS for the Netherlands. In doing so, I requested to specifically address the possible overlap of investments that could be made under Wegiz if the national approach were to consist of implementing the prioritized data exchanges on the multi-year Wegiz agenda, and what additional investments would have to be made under the EHDS in that case. Indeed, if the EHDS includes measures already provided for under the Wegiz, these costs should not be double counted. I have also asked KPMG to investigate what the initial and structural costs would be for the government, the healthcare field and citizens to meet the obligations arising from the EHDS.
Technical & Social Impact Analysis I have asked TNO to conduct a study of the technical and social impact analysis. In doing so, I requested that a specific distinction be made between the consequences regarding the primary use of electronic health data and the secondary use of electronic health data. I also asked TNO to distinguish the identified consequences into actors: healthcare providers, citizens, science and government.
In order to create a coherent and readable letter, I have taken the liberty to only address the outstanding issues in the BNC fiche based on the impact analyses provided. In addition, I am also using this letter to respond to the questions from the November 30, 2022, EU Alert on the EHDS Regulation (hereafter referred to as Parliamentary Questions) from the Committee on Health.
Below I will first discuss the results of the impact analyses on jurisdiction, subsidiarity and proportionality. I will then interpret what the results of the impact analyses mean for the primary use of electronic health data and answer the Parliamentary question about the existence of a standards system in addition to the EHDS. I will then address the Parliamentary question on the issue around third-party certification versus self-assessment. I will then discuss in more detail the outstanding issues in the BNC sheet regarding the secondary use of electronic health data. Finally, the regulatory burden implications will be addressed.
The European Commission can make a proposal only if the European Union has competence for the subject in question. Indeed, without competence, the European Union may not act. The EHDS is based on a dual legal basis, namely Article 16 Treaty on the Functioning of the European Union ("TFEU") and Article 114 TFEU. Article 16(1) TFEU protects the right to the protection of personal data. Article 16(2) TFEU requires the European Parliament and the Council to adopt proposals "relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law." On the basis of Article 16(2) TFEU, the European Parliament and the Council mandate rules on the free movement of personal data. Regarding the use of Article 16 TFEU, the legal impact analysis concludes that this is an appropriate legal basis for provisions in the EHDS aimed at protecting personal data.
Article 114 TFEU is the general legal basis for the internal market, which may only be used if no other more specific legal basis in the EU Treaties is available. Article 114 TFEU can, in the absence of a more specific legal basis, be used to counter trade restrictions or distortions of competition. In response to Question 1 of the Parliamentary Questions on the appropriateness of the legal basis used for the EHDS, it can be stated that Radboud University has indicated that Article 114 TFEU is a justified legal basis. However, it has been observed that on a number of aspects the substantiation needs to be tightened up. It was indicated that the European Commission should more explicitly include the intended positive goals it is pursuing with the measures around primary use and secondary use of health data in the explanation of the use of Article 114 TFEU.
I take to heart the recommendations of the Radboud University regarding the use of Article 114 TFEU. In the Council working groups on Employment, Social Policy, Health and Consumer Affairs, in which the EHDS is discussed, clarification of the substantiation on this point will be proposed from the Netherlands.
Subsidiarity and proportionality
In the BNC fiche, I indicated that I am positive about subsidiarity on the EHDS. The legal impact analysis indicated, among other things, that from a European law perspective, the European Commission has provided sufficient substantiation on the subsidiarity component. It is therefore expected that any annulment procedure on substantive grounds will not be successful in the European Court of Justice. At the same time, it has been indicated that in addition to the substantive grounds, the judgment on subsidiarity may also be politically motivated. With regard to proportionality, the legal impact analysis extensively discussed the Commission's choice to opt for a regulation. This is to avoid divergent implementation and a fragmented market that could in turn affect the protection and free movement of personal data in the health sector.
In addition, also to create a clear regulatory framework that accommodates citizens' rights. Radboud University indicates that it is a logical rationale of the Commission. At the same time, in answer to question 2 of the Parliamentary questions, it is important to note here that the EHDS with the European format does not regulate the registration of health data at the national level. The registration of health data remains a national responsibility. However, given the obligation in the EHDS, countries must organize this registration in such a way that the data fields in the European format can be filled with national health data. For this reason, the Wegiz remains important for national data exchange but also to comply with the EHDS in the long run.
The EHDS has several provisions aimed at the primary use of personal electronic health data. These provisions in relation to the BNC sheet are discussed below.
Citizens' rights and data availability One of the most important provisions that has as its object the primary use of personal electronic health data is Article 3 of the EHDS. This provision develops the additional rights and mechanisms intended to complement data subjects' rights under the General Data Protection Regulation ("GDPR") with respect to electronic health data. The BNC fiche expressed a positive opinion regarding these additional rights to citizens regarding their personal electronic health data. In doing so, however, I indicated that the impact of these rights on the national situation must be examined, in what way this can be shaped by the Netherlands, and whether there is an opt-out system.
Article 3 of the EHDS grants citizens the right to have immediate and free access to their personal electronic health data. In addition, Article 3(8) of the EHDS provides that citizens have the right to request a data holder from the health sector, for example, to transfer their personal electronic health data immediately and without hindrance from the data holder or manufacturers to a recipient of the data of their choice from the health sector. Moreover, Article 3(9) of the EHDS provides that citizens have the right to limit health professionals' access to all or part of their electronic health data. Member States have latitude to establish their own rules and specific safeguards regarding such restriction mechanisms.
Overall, it can be concluded that personal electronic health data must be made available at all times but that its access/consultation can be restricted by the citizen himself. This system differs from how the Dutch system handles the exchange of personal electronic health data. In the current system, explicit permission must be given in advance for personal electronic health data to be made available. In the absence of this consent, the data are therefore not available and cannot be accessed by a healthcare provider.
With regard to the availability of health data, current Dutch legislation supporting the existing system works as an obstacle. This has led me to work both on a bill to improve electronic data exchange in acute care but also to look at whether and how the foundations for data exchange in the healthcare sector could be revised in the Recalibrating Foundations project. Based on these insights, I am positive about this part of the EHDS, especially when it comes to electronic data exchange within national borders.
At the same time, I am aware that this will require adjustments to the Dutch system around foundations. However, adjustments to the Dutch system must be made carefully. It therefore seems opportune to me that this issue be further investigated within the Realignment Foundations project. I aim to inform your Chamber in the spring of 2023 about the integral policy vision on foundations and I will also include possible follow-up steps to this issue.
Standards under the Wegiz and obligations from the EHDS
In my letter of November 21, 2022, I have already indicated why I believe Track 2 can continue to exist under the Wegiz alongside the EHDS. To answer question 7 of the Parliamentary questions, I would like to indicate that I am aware that Europe too will eventually come up with prioritized data exchanges. In case there is an overlap between the nationally prioritized data exchanges and the European ones, it is important that the standards set under track 2 are fully in line with the technical specifications for those data exchanges set at the European level. In short, the standards system itself does not conflict with the EHDS, but individual standards may need to be aligned with the requirements under the EHDS in due course. However, in addition to the current basis in which interoperability is achieved through standardization, a separate basis may need to be included in the Wegiz for data exchanges for which no NEN standard exists. For data exchanges that Europe does not prioritize, track 2 under the Wegiz can be used without adjustments.
Cross-border infrastructure for primary use of electronic health data
Another important provision that has the primary use of electronic health data as its object is Article 12 of the EHDS. This provision concerns cross-border infrastructure for primary use of electronic health data. To enable the cross-border exchange of electronic health data, the EHDS proposes an infrastructure connecting national health information systems. To this end, each member state should set up a national contact point for digital care (formerly national contact point for eHealth). This national contact point is connected to national healthcare providers.
It follows from Article 12(1) of the EHDS that the European Commission is establishing a central digital health platform that will facilitate the exchange of electronic health data between national contact points. This platform is known as MyHealth@EU. Article 12(2) of the EHDS requires each Member State to designate a national digital health focal point. The BNC fiche states that the Netherlands can already fulfill the obligation to establish a national contact point for digital health, namely through the National Contact Point for eHealth (NCPeH). After all, the NCPeH has gone live with its services in the Netherlands since February 2022. The NCPeH currently supports receiving patient summaries. Under Article 12.3 of the EHDS, the NCPeH should eventually enable the exchange of priority electronic health data based on the European exchange format. The BNC fiche indicates that the impact of this requirement will be further examined.
In the financial impact analysis by KPMG, interpretation was given to the costs of the NCPeH for the support and management of the European prioritized data exchanges. Since the NCPeH has already been set up in the Netherlands, there is no need to include the costs of setting it up and setting it up, as these have already been incurred. Most of the additional costs resulting from the EHDS proposal will be mainly on preparing the NCPeH for the new European prioritized data exchanges and its management. At the same time, the cost forecast assumes that the implementation of the new European prioritized data exchanges can make use of existing infrastructures and human resources. This makes it possible to achieve economies of scale. The total costs for both preparing the NCPeH for the European prioritized data exchanges and managing it over a 5-year period are estimated between (rounded) EUR 28.75 - 36.25 million. Of these, one-time investment costs are estimated at EUR 17.5 million and structural management costs at EUR 11.26 - 18.75 million.
Digital health authority
Regarding the implementation and enforcement of the provisions on the primary use of personal electronic health data, each Member State must designate a digital health authority. Article 10 of the EHDS sets out what duties such an authority should perform. The EHDS indicates that there is an authority to ensure that personal data are processed and exchanged in accordance with the AVG, while the digital health authority must ensure that the technical conditions as set forth in the EHDS are in place. According to Article 11 of the EHDS, the Digital Health Authority is also a complaint body to which citizens and legal entities can file complaints individually or collectively. Furthermore, the EHDS indicates that the digital health authority should have sufficient human, technical and financial resources to carry out its mandatory tasks. The BNC fiche indicates that the impact of this obligation will be further examined.
Since it is still too premature to investigate which organization(s) could act as a digital health authority in the Netherlands, I have left this question out of the scope of the impact analyses. It is especially important to first see which tasks will arise from the EHDS. On this I still expect the necessary discussions in the European Parliament and the Council. Only when it becomes clear what a compromise text will look like in terms of these substantive aspects, can it be considered to which existing organizations the tasks will fit best and how the Netherlands can fulfill the obligation to designate a digital health authority. I do intend to commission a study in 2023 into which existing organization(s) can be designated as a digital health authority. To get an idea of the financial impact of appointing a digital health authority, I have asked KPMG to make an estimate. It has been assumed that the executive and supervisory tasks will be assigned separately to existing organizations, but that one organization will assume a coordinating role.
For the supervisory tasks, it is estimated that additional capacity of three to ten FTE is necessary. For the executive tasks, this is estimated at five to fifteen additional FTEs. In calculating the costs, EUR 100,000 per FTE is assumed. Over a period of 5 years, the estimated structural costs for a digital health authority are EUR 5 - 15 million. The initial costs for e.g. recruitment and selection, education and training of staff are estimated to be one-time costs of EUR 0.6 - 1.8 million.
In the EHDS, there are measures to regulate the market authorization of secure and interoperable EHR systems and wellness apps in the European market. Below I will elaborate on your Parliamentary Questions 4 and 5 of November 30, 2022 regarding the system of self-assessment under the EHDS and third-party certification under the Wegiz.
Third-party certification versus self-assessment
In my letter of November 21, 2022, I have already provided my reflections on the issue of third-party certification versus self-assessment. During the Commission debate of November 30, 2022, I indicated that in the negotiations in the RWG on the EHDS I will advocate for third-party certification of EHR systems. This is to ensure effective interoperability in practice. However, in Question 4 of the November 30, 2022 Parliamentary Questions, you request to indicate to what extent this position will be successful in the negotiations. As already indicated, several member states in the RWG have raised questions about the extent to which self-assessment provides sufficient guarantees of interoperability in practice. I see this as an opening to lead the discussion on this at the European level and from the Netherlands. However, this is no guarantee that the Dutch position on this will actually be adopted.
Market surveillance authority under the Wegiz and the EHDS
In Question 5 of the Parliamentary Questions, you correctly state that I did not address the difference between the Wegiz and the EHDS with respect to the market surveillance authority. You specifically ask whether the chosen market oversight authority under the Wegiz does not conflict with the requirement in the EHDS that it be vested in an independent party. The choice of how to carry out the supervision of the EHDS lies with the member states who have the latitude to appoint their own market supervision authority. It is important that the obligations of the market surveillance authority are carried out in an independent, impartial and unbiased manner. The IGJ is an independent supervisor in the Dutch health care system. The Health Act and the Youth Act regulate the position and tasks of the inspectorate, including supervision and investigation. The Decree on the Performance of IGJ's Duties regulates that the IGJ arrives at its findings, judgments and enforcement in an independent manner. Thus, no directions may be given that relate to the IGJ's findings, judgments and advice. For this reason, I support my choice of the IGJ as the market supervisor under the Wegiz and am also convinced that they are capable of carrying out their powers and obligations in such a manner.
Secondary use of health data
Chapter IV of the EHDS contains numerous provisions for the secondary use of electronic health data. Article 33 of the EHDS requires data holders to make certain electronic data available for secondary use. This obligation does not apply to micro enterprises (enterprises with up to 250 employees). Electronic health data protected by intellectual property rights and trade secrets should also be provided; however, appropriate measures must be taken at the time of provision to ensure the confidentiality of the IP rights and trade secrets. Furthermore, Article 33(5) of the EHDS emphasizes the primacy of EU law. This means that if a request for data for secondary use fulfills the purposes set forth in the EHDS, then the absence of the citizen's consent cannot change that.
For the provision of access to electronic health data for secondary use, the EHDS provides that Member States shall designate one or more Health Data Access Bodies (HDAB). If multiple bodies are designated, one body should be charged with coordination. The health data access bodies decide on applications for health data. If, in their judgment, the application may be granted, they issue a data authorization in accordance with the rules in the EHDS. Member States are obliged to provide the HDAB with sufficient human, technical and financial resources to enable them to perform the tasks set forth in the EHDS. The BNC sheet indicates that the impact of this obligation will be further examined. The financial impact analysis estimated that the total cost of setting up and designating an HDAB amounts to EUR 3.1 - 9.2 million per participating agency over a 5-year period. This estimate consists of one-time initial costs for setting up an HDAB of EUR 0.6 and 1.7
million and structural management costs of EUR 2.5 - 7.5 million per year per body. This means that the final estimated initial and structural management costs depend on the number of parties designated as HDAB. The way in which the Netherlands shapes the HDAB still needs to be further examined.
In addition to imposing obligations on the government, the EHDS includes measures that have a direct impact on business. This impact translates into the financial consequences for business to comply with the measures of the EHDS. The BNC fact sheet indicated that I will also have the financial consequences for business examined. The financial impact analysis estimated that the one-time initial costs for business total between (rounded) EUR 588 - 1,209 million over a period of 5 years. The structural costs for business are estimated at a total of EUR 1,620 - 3,014 million over a period of 5 years. There are a number of important caveats to these figures, namely that the estimated costs include all measures from the EHDS with which industry must comply. In addition, it is important to distinguish in the estimated costs between costs concerning the measures for the primary use of health data and obligations around EHR systems, and the secondary use of health data.
When it comes to the estimated costs for the primary use of health data and obligations around EHR systems, it is essential to note that this estimate includes costs that may overlap with the national approach to promote data sharing in healthcare. As I indicated earlier, the EHDS has potential overlap with the national approach on the primary use of personal health data and obligations around EHR systems. As a result, the costs to be incurred under the national approach need not be incurred again to comply with the EHDS, provided, of course, that the two are properly aligned. For this reason, it is important that, in advance of the possible future entry into force of the EHDS, wherever possible our national pathways already take into account the obligations that may arise from it. This should always include consideration of the right moment to make this connection.
In my letter of November 21, 2022 on the legal impact analysis Wegiz - EHDS, I have already explained to your Chamber how I see this in relation to the Wegiz. If, nevertheless, costs arise from the EHDS that exceed the available resources of the data sharing approach, budgetary coverage will have to be found for this. I therefore intend to carefully weigh the national implications of the EHDS. In case of the estimated costs for the secondary use of health data, no overlap with existing national laws/tracks is yet seen. The cost estimates included in the financial impact analysis regarding secondary use will therefore, for the time being, be entirely focused on the EHDS. Nevertheless, the measures in the EHDS around secondary use of health data can offer starting points for national policy on this. To this end I am developing a vision on the secondary use of health data about which I will inform your chamber in the first quarter of 2023. Again, budgetary coverage will have to be found for additional costs under the EHDS. Furthermore, the financial impact analysis shows that no costs should be incurred by citizens to comply with the EHDS. Rather, the EHDS is designed to give citizens more rights. For example, exercising the right to access personal electronic health records should even be free of charge according to the EHDS.
I am of course aware that the EHDS will have substantial financial implications for both government and industry. The financial impact analysis points out that some of these investments may overlap with national measures and trajectories, especially in the context of the primary use of health data. I am currently working on a national vision for the health information system about which I will inform your Chamber in spring 2023. This vision will help me get a better picture of the extent to which the EHDS will lead to additional financial consequences. In addition, budgetary coverage will need to be found for these impacts. In order to minimize any disinvestment, it is important that I seek a constant link in national activities with developments in Brussels so that the two are well aligned. In doing so, however, it is worth noting that the EHDS is still in a state of flux. With the above conclusion, I will in the coming period continue the line I have outlined in the BNC fiche in my discussions in Brussels. In doing so, I will of course observe the agreements made in the Commission debate of November 30, 2022, in which I undertook to provide the Chamber with a report on progress in the RWG when preparing for the EHDS in the first quarter of 2023, and will include a stocktaking of the force field. In doing so, I will also address questions 3 and 6 of the November 30, 2022 Parliamentary Questions that the Committee on Health is requesting feedback on. In addition, I intend to inform your Chamber in more detail about the latest state of affairs regarding the EHDS in the second quarter of 2023, also based on an up-to-date picture of the expected additional financial impact.
