Preparing health data for secondary use
Health data holders play an important role in enabling research, innovation, public health, and evidence-based policymaking through the secure and lawful use of health data.
The EHDS establishes a framework that supports access to health data for approved secondary-use purposes while protecting privacy, confidentiality, intellectual property, and commercially sensitive information.
Who is a Health Data Holder?
In general, a health data holder is a public or private organisation that controls health data and falls within the categories established by the EHDS.
Examples may include:
-
Hospitals and clinics
-
Healthcare providers
-
Laboratories
-
Health registries
-
Biobanks
-
Universities and research institutions
-
Public authorities
-
Health insurers
-
Other organisations managing health data
What do health data holders need to do?
1. Identify relevant datasets
Create an inventory of datasets held by your organisation and document:
-
Dataset purpose and scope
-
Population covered
-
Time period covered
-
Data categories and formats
-
Collection methods and standards
-
Known limitations
-
Governance and legal considerations
-
Estimated preparation requirements
2. Create dataset descriptions
A clear dataset description helps potential users understand what information exists without exposing personal data.
Dataset descriptions should include:
-
Dataset name and summary
-
Responsible organisation
-
Contact information
-
Population coverage
-
Data standards and terminology used
-
Access conditions
-
Available documentation
-
Data quality information
3. Assess data quality
Health data holders should document and maintain information about:
-
Completeness
-
Accuracy
-
Consistency
-
Timeliness
-
Validity
-
Population representativeness
-
Quality management procedures
Understanding dataset quality helps support trustworthy and meaningful secondary use.
4. Maintain metadata
Health data holders should maintain accurate and up-to-date metadata describing their datasets.
This may include:
-
Metadata preparation
-
Quality and completeness checks
-
Regular review and updates
-
Publication of approved dataset descriptions where applicable
Accurate metadata improves dataset discoverability and supports efficient access procedures.
5. Support secure and lawful access
Health data should only be made available through authorised processes and appropriate safeguards.
Health data holders are expected to:
-
Cooperate with the Health Data Access Body (HDAB)
-
Support lawful access procedures
-
Apply appropriate protection measures
-
Ensure confidentiality is maintained
-
Support compliance with GDPR and applicable legislation
Responsibilities of health data holders
Health data holders are expected to:
-
Maintain accurate dataset descriptions and metadata
-
Ensure data quality and integrity
-
Apply appropriate technical and organisational security measures
-
Protect confidentiality
-
Support GDPR compliance
-
Cooperate with the HDAB
-
Facilitate secure and lawful access procedures
Protection of intellectual property and trade secrets
The EHDS includes safeguards to protect:
-
Intellectual property rights
-
Commercially sensitive information
-
Trade secrets
Where datasets contain protected information, additional safeguards may be applied before access is granted.
Data holder checklist
Before participating in secondary-use activities, consider whether:
-
A dataset inventory exists
-
Responsible contacts have been identified
-
Dataset descriptions have been prepared
-
Metadata has been documented
-
Data quality has been assessed
-
Governance arrangements are in place
-
Security measures are implemented
-
Dataset documentation is regularly reviewed and updated
Frequently asked questions
Will patient-level data be published?
No. Dataset catalogues and metadata describe datasets; they do not publish personal health data.
Does publishing metadata mean data must be shared?
No. Dataset discovery and data access are separate processes. Requests for access remain subject to assessment and authorisation.
Who is responsible for data quality?
Health data holders remain responsible for understanding, documenting, and maintaining information about the quality of their datasets.
What should organisations do now?
Organisations should begin identifying relevant datasets, assigning responsible contacts, preparing dataset descriptions, and documenting metadata and data quality information.
Disclaimer: This page provides introductory information for awareness and educational purposes. Detailed procedures, templates, and operational requirements will be published by the relevant competent authorities as implementation progress.