Short answer: primary use is using health data for the care of the person it is about. Secondary use is everything else: research, public health surveillance, policy and planning, quality improvement, training algorithms, developing products. The GDPR allows it under Article 9(2)(j) with the safeguards of Article 89 (pseudonymisation, minimisation, no decisions about individuals), or with explicit consent; national laws add their own routes (Finland's Findata, France's Health Data Hub, Germany's Forschungsdatenzentrum). The EHDS regulation builds a common EU system: health data access bodies in every member state issue data permits for listed purposes, data holders must make listed categories available, analysis happens in secure processing environments on anonymised or pseudonymised data, people can opt out, and uses such as advertising, insurance decisions or employment decisions are prohibited. The technical backbone is common data models (OMOP), federated analysis and robust de-identification.
The two legal routes
Secondary use of health data in the EU rests on two legal routes under the GDPR: explicit consent, including broad consent for research, or the research exception in Article 9(2)(j) with the Article 89 safeguards through national law, alongside public-interest bases. The EHDS data permit, issued by a health data access body, builds on these bases.
| Route | Basis | Typical use | Conditions |
|---|---|---|---|
| Consent | GDPR Art. 6(1)(a) + 9(2)(a); broad consent for research is recognised in Recital 33 | Cohort studies, biobanks, app users contributing data | Explicit, specific or well-defined broad consent; withdrawable; children via guardians |
| Research exception | GDPR Art. 9(2)(j) + Art. 89, through national law | Registry research, record-based studies, public health | Proportionate, pseudonymised, minimised, no decisions about individuals, ethics approval where national law requires |
| Public interest / public health | Art. 9(2)(g), (i) | Surveillance, pharmacovigilance, planning | Based on law with safeguards |
| EHDS data permit | Regulation 2025/327, Chapter IV, relying on the above | Any listed purpose (research, innovation, policy, education, AI training and testing, personalised care) | Permit from a health data access body; secure processing environment; anonymised by default, pseudonymised when justified; opt-out respected; fees; results published |
See GDPR Article 9 for health data for the primary-use side of the same articles.
The EHDS secondary-use system
The EHDS secondary-use system obliges data holders to catalogue and make listed categories available, puts health data access bodies in charge of assessing applications and issuing data permits, lists permitted purposes such as research, policy and AI training, prohibits advertising, insurance and employment decisions, requires secure processing environments, and gives people an opt-out, applying in stages from 2029.
- Data holders (hospitals, insurers, registries, research infrastructures, and under conditions wellness-app providers and device makers) must describe their datasets in a catalogue and make the listed categories available: EHR data, registries, claims, genomic data, public health data, clinical trial data, device data, and more.
- Health data access bodies (HDABs), one or more per member state, receive applications, assess purpose and proportionality, issue permits or data requests (for anonymised statistics), and are the only parties that see identified data when linking datasets.
- Permitted purposes: public health and policy, education, scientific research including development and testing of products and training and evaluating AI, personalised care (for the applicant's own patients), and official statistics.
- Prohibited purposes: decisions detrimental to a person (insurance, credit, employment), advertising and marketing, giving the data to third parties outside the permit, developing products harmful to people or society.
- Secure processing environments: analysis happens inside an environment controlled by the HDAB or the data holder; raw record-level data does not leave; outputs are checked before release.
- Opt-out: people can object to the secondary use of their data, with exceptions member states may define for public interest.
- HealthData@EU: the cross-border infrastructure through which an HDAB in one country can grant access to data in another.
- Timeline: the secondary-use chapter applies in stages from 2029, with some categories (genomic data, among others) later; implementing acts set the detail.
The technical building blocks
The technical building blocks of secondary use are de-identification (pseudonymisation as the realistic standard, anonymisation rarely achievable for rich records), a common data model such as OMOP CDM so one analysis runs across sources, federated analysis where code travels to each site and only aggregates return, synthetic data for development and testing, and provenance with data-quality tooling.
De-identification. Anonymisation (no longer personal data; the GDPR does not apply) is hard for rich health records; pseudonymisation (identifiers replaced, re-identification possible with a key held separately) is the realistic standard, with the data still under the GDPR. See De-identification of health data.
Common data models. Research across sources needs one shape. OMOP CDM (OHDSI) is the most used for observational research; FHIR is the exchange format; mappings between them are published. See OMOP CDM explained.
Federated analysis. Instead of pooling data, the analysis travels to each site and only aggregate results return (the OHDSI network studies, the EMA's DARWIN EU, the European Health Data and Evidence Network). Federation reduces transfer risk; it does not remove the need for de-identification at each site.
Synthetic data. Generated data with the statistical properties of a real dataset, for development, education and testing of pipelines; validated for utility and for privacy leakage. See Synthetic patient data.
Provenance and data quality. Research needs to know where each value came from and how complete the record is; provenance in the primary record (FHIR Provenance) and data-quality dashboards (ACHILLES, Data Quality Dashboard in OHDSI) are the tools.
Real-world data and evidence
Real-world data (RWD) is the health data that routine care produces: records, claims, registries, devices and apps. Real-world evidence (RWE) is what analysing that data yields, used by regulators such as the EMA and FDA, payers and researchers alongside clinical trials. Registries are curated real-world data with defined inclusion and follow-up; OMOP and FHIR are its main standards.
Real-world data (RWD) is what routine care produces: records, claims, registries, devices, apps. Real-world evidence (RWE) is what analysing it yields, used by regulators (the EMA and FDA frameworks), payers and researchers alongside trials. Registries (disease, device, drug) are curated RWD with defined inclusion and follow-up. Standards for trials (CDISC) and for RWD (OMOP, FHIR) are converging slowly; the HL7 Vulcan accelerator works on the bridge.
Consent models
The consent models for secondary use of health data are specific consent per study, broad consent for a research domain with governance and withdrawal, dynamic consent where people change preferences in an app over time, opt-out as the EHDS default for permits, and data altruism under the Data Governance Act, where people donate data to recognised organisations.
Specific consent per study; broad consent for a research domain with governance and the right to withdraw; dynamic consent, where people set and change preferences in an app over time; opt-out as the EHDS default for permits; data altruism under the Data Governance Act, where people donate data to recognised organisations. A patient-controlled record is the natural place to express these choices, with the same consent engine used for care access. See Patient consent platform.
In Anpheros
Anpheros is a primary-use record under the person's control. Population signals such as adverse effects and symptom patterns by area are computed only as aggregates over groups of at least 20 people, with separate opt-in consent per purpose, no individual-level data leaving the record, and revocation at any time; pseudonymised FHIR extracts for research follow the person's choice.
Anpheros is a primary-use record under the person's control. Population signals (adverse effects, symptom patterns by area) are computed only as aggregates over groups of at least 20 people, with separate opt-in consent per purpose and no individual-level data leaving the record; the person can revoke at any time. For research under permits, the record can produce pseudonymised FHIR extracts in the formats researchers need, with the person's choice respected. See Health transparency.
This page explains regulation for product and engineering teams. It is not legal advice; the texts linked under Sources are the authority. Last reviewed: October 2026.
Related pages
- OMOP CDM explained
- De-identification of health data
- GDPR Article 9 for health data
- Your medical data in the EU: GDPR, EHDS and your rights
- Patient consent platform
- AI on medical data: the map
- Synthetic patient data (developer site)
Sources
- Regulation (EU) 2025/327 (EHDS), Chapter IV, EUR-Lex
- European Commission: European Health Data Space
- GDPR Article 89, EUR-Lex
- Findata (Finland): Act on the Secondary Use of Health and Social Data
- Health Data Hub (France)
- EMA: DARWIN EU
- OHDSI
- Regulation (EU) 2022/868 (Data Governance Act, data altruism), EUR-Lex
Frequently asked questions
Do researchers need my consent to use my hospital data?
Not always. Under GDPR Article 9(2)(j) and national law, research can proceed on pseudonymised data with safeguards and often ethics approval; under the EHDS, access goes through a permit from a health data access body, and you can opt out.
Can companies get EHDS data?
Yes, for permitted purposes such as research, innovation and training AI, under a permit, inside a secure environment, on anonymised or pseudonymised data, with fees and publication of results. Not for advertising, insurance or employment decisions.
What is a secure processing environment?
A controlled computing environment where permitted users analyse data without being able to download record-level data; outputs are reviewed before release. The EHDS requires HDABs to provide them.
Is pseudonymised data still personal data?
Yes. As long as someone holds the key or re-identification is reasonably possible, the GDPR applies. Only truly anonymous data, which is rare for rich health records, falls outside it.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
