Article 7

Right to data portability for natural persons

In short: Natural persons shall have the right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately.

1. Natural persons shall have the right to give access to, or to request a healthcare provider to transmit, all or part of their personal electronic health data to another healthcare provider of their choice immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems used by that healthcare provider.
2. Natural persons shall have the right, where the healthcare providers are located in different Member States, to request the transmission of their personal electronic health data in the European electronic health record exchange format referred to in Article 15 through the cross-border infrastructure referred to in Article 23. The receiving healthcare provider shall accept such data and shall be able to read them.
3. Natural persons shall have the right to request a healthcare provider to transmit a part of their personal electronic health data to a clearly identified recipient in the social security or reimbursement services sector. Such transmission shall be carried out immediately, free of charge and without hindrance from the healthcare provider or from the manufacturers of the systems used by that healthcare provider, and shall be one-way only.
4. Where natural persons have downloaded an electronic copy of their priority categories of personal electronic health data in accordance with Article 3(2), they shall be able to transmit those data to healthcare providers of their choice in the European electronic health record exchange format referred to in Article 15. The receiving healthcare provider shall accept such data and be able to read them, as applicable.

EHDS Recital 14: Under Regulation (EU) 2016/679 (GDPR), the right to data portability is limited to data processed based on consent or contract and provided by the data subject to a controller. Additionally, under that Regulation, natural persons have the right to have the personal data transmitted directly from one controller to another only where technically feasible. Regulation (EU) 2016/679 (GDPR), however, does not impose an obligation to make that direct transmission technically feasible. The right to data portability should be complemented under this Regulation, thereby empowering natural persons to provide access to, at least, priority categories of their personal electronic health data to the health professionals of their choice, to exchange such health data with such health professionals and to download such health data. In addition, natural persons should have the right to request a healthcare provider to transmit a part of their electronic health data to a clearly identified recipient in the social security or reimbursement services sector. Such a transfer should be one-way only.

EHDS Recital 15: The framework laid down by this Regulation should build on the right to data portability established in Regulation (EU) 2016/679 by ensuring that natural persons as data subjects can transmit their personal electronic health data, including inferred data, in the European electronic health record exchange format, irrespective of the legal basis for processing the electronic health data. Health professionals should refrain from hindering the application of the rights of natural persons, for example by refusing to take into account personal electronic health data originating from another Member State and which are provided through the interoperable and reliable European electronic health record exchange format.

EHDS Recital 20: In order to facilitate the exercise of the complementary access and portability rights established under this Regulation, Member States should establish one or more electronic health data access services. Those services could be provided at national, regional or local level, or by healthcare providers, in the form of an online patient portal, an application for mobile devices or by other means. They should be designed in an accessible way, in particular for persons with disabilities. Providing such a service to enable natural persons to have easy access to their personal electronic health data is a substantial public interest. The processing of personal electronic health data through those services is necessary for the performance of that task assigned by this Regulation in the sense of Article 6(1), point (e), and Article 9(2), point (g), of Regulation (EU) 2016/679 [GDPR]. This Regulation lays down the necessary conditions and safeguards for the processing of electronic health data in electronic health data access services, such as electronic identification of natural persons accessing such services.

Discussion

From the EU FAQ, (March 2025): Article 7 will significantly enhance the portability of personal electronic health data for patients. You will have the right to receive and share your electronic health data in the European electronic health record exchange format This will facilitate seamless data exchange between healthcare providers across the EU. This means healthcare providers must be able to export and import data in this format. However, this does not affect which formats they use internally. This complements the right to data portability under the GDPR, but has important differences:

1. Data portability under the GDPR only applies to data processed based on consent or contract. Portability under Art. 7 EHDS applies regardless of the legal basis of the processing.
2. Data portability under the GDPR only applies to data provided by a data subject to a controller, including observed data, but not inferred data. Portability under Art. 7 EHDS applies regardless of whether data was provided ('patient reports pain in left knee'), observed ('x-ray image of the knee'), or inferred ('the problem with the knee is X').
3. Under the GDPR, the data subject has the right to receive and share data in a commonly used format. There is however no requirement for the controllers from and to whom the data subject ports data to support the same format. The EHDS creates an obligation on both side to support export/import of data in the EEHRxF. To exercise the right for data portability you do not need to transport the data yourself. Instead, your data can be transmitted from its source to the treating health professional. In practice, this works in such a way that the health professional can issue a request for your data, and the data will be provided by the data source (apart from any restricted parts, see question 12 below). Alternatively, you can download your data and transmit it to the healthcare provider of your choice yourself.

---

Feedback

Please e-mail ehds@ringholm.com should the information on this page be incorrect or incomplete; we welcome your suggestions to improve its content.

About Ringholm bv

Ringholm bv is a group of European experts in the field of messaging standards and systems integration in healthcare IT. We provide the industry's most advanced training courses and consulting on healthcare information exchange standards.