ehds and Free Movement of Patients: What EU Intervention is Needed?

The European Commission issued a proposal for a Regulation on the European Health and Data Space to improve patient mobilit y. This ehds Regulation lays down rules for the exchange of digital health data for primary use (t reatment) and for secondary use (i


Introduction
In 2020, the Commission published a European strategy for data.This agenda is aimed at creating a single market for data.To achieve the goals of this agenda, the Commission is proposing different so-called data spaces in key areas.One of these data spaces mentioned in the 2020 communication of the Commission is the European Health Data Space.Almost two years later, the Commission issued a proposal for the Regulation on the European Health Data Space.1This measure is, according to the Commission, needed in order to stimulate the free movement of patients: EU citizens, when travelling to other Member States for reasons related to, for example, business, study or holiday, encounter problems if they fall ill.2No compulsory mechanisms or rules are in place for exchanging electronic health data between the healthcare authorities of the country of treatment and the healthcare authorities of the country of residence.The Commission points out that the covid-19 pandemic has shown the urgent need of the interoperability of the national systems processing these data.3The exchange of electronic health data is needed in order to facilitate free movement of persons.To that effect, natural persons in the EU must have increased control over these data, while the exchange of these data must be promoted as well.4 Stimulating the free movement of patients is, at least officially, an important driver for the ehds Regulation.It is clear from the outset that, in order to stimulate this free movement, the Commission has proposed to introduce a regime that will have a major impact on the healthcare systems of the Member States, as it will lay down EU requirements for electronic health record systems (ehr systems).These requirements are supposed to determine how the health data are electronically stored and exchanged in the EU member states and will lead, as a consequence, to a major operation.In other words, the Commission proposes to enact EU rules that will interfere greatly with the national policies on digital health data in order to remove some obstacles for the free movement of patients.This gives rise to concerns as to whether the EU oversteps its powers when adopting the ehds Regulation and as to whether introducing EU rules on digital health data would intrude on the national healthcare policies too much.
Consequently, in the present contribution the question will be addressed whether the ehds Regulation should be adopted in order to facilitate the application of the EU rules on the free movement of patients.This question will be explored as follows.At first the impact of the ehds Regulation on the national healthcare systems will be explored by discussing what the main provisions of this EU measure entail and how these provisions must be implemented in the national legal orders of the Member States (Section 2).This analysis will give rise to findings that are needed for addressing the questions related to the legal basis as well as to the subsidiarity and proportionality principles.Thus, the legal basis for the ehds Regulation will be examined, which is a significant matter, as Article 168 (7) tfeu clearly provides that the organization and delivery of healthcare belong to the competences of the Member States (Section 3).Then, the proposed ehds Regulation will be evaluated in light of the principles of subsidiarity and proportionality (Section 4).As the free movement of patients is at the centre of the action undertaken by the Commission, the EU rules dealing with this matter, i.e. the Patient Directive5 and the Social Security Coordination Regulation,6 will be discussed subsequently (Section 5).In which way do these rules contribute to removing the obstacles natural persons are confronted with when undergoing treatment in another Member State?In our view, this is an important question also given the fact that recently the Patient Directive has been reviewed by the Commission.7At the end, some conclusions will be drawn (Section 6).

2
The Proposed ehds Regulation: Its Provisions and Implementation The draft ehds Regulation contains a great number of detailed rules on digital health data.In this section the main aspects of these rules will be analysed.On top of that, as already stated, it will be examined how this Regulation must be implemented in the event it is adopted with no substantial amendments.8

The Main Features of the ehds Regulation and the EU Requirements for Implementation
The aim of the ehds Regulation is to establish the European Health Data Space by laying down rules for both primary and secondary use.Primary use concerns actions undertaken by doctors in order to get access to digital health data or to exchange these data for the purposes of treating patients.For instance, a health professional treating a patient from another Member State may wish to get access to the data of this patient stored by a hospital of the Member State where this patient resides.The endeavour of the proposed Regulation is to facilitate this access (provided that certain safeguards are observed).Secondary use relates to the processing of digital health data for purposes of, for example, scientific research and commercial activity.Scientists could need a lot of data for developing a new treatment for a particular disease, while certain businesses may wish to introduce a new medical device the operation of which is driven by big data.The proposed Regulation sets out under which conditions digital health data may be used for such purposes.It should be noted that the ehds Regulation also contains provisions for reinforcing the position of natural persons with regard to their own digital health data: the control individuals have on their data should thereby be improved.
To a certain extent, the objectives pursued by this Regulation are of a dual nature.On the one hand, the availability of digital health data should be increased in order to improve (cross-border) treatments and to stimulate (data-based) scientific research and the marketing of certain (data-driven) health products and services.On the other hand, the protection of individuals should be improved in relation to their digital health data.
European Journal of Health Law (2024) 1-36 If the ehds Regulation is signed into law, the Member States will be obliged to take action in order to implement this Regulation into their national legal orders.This raises the question how the implementation must take place.In legal doctrine it is outlined, on the basis of settled case law of the cjeu, which steps need to be taken in the process of implementation.9This process entails (1) the transposition of provisions of European law (incorporation of EU norms in national legislation); (2) the operationalization of these provisions (elaboration of the EU norms concerned); (3) application of these provisions (compliance with the EU norm at play in practice); and (4) enforcement of these provisions (taking actions against violations of the applicable EU norms).It is apparent from Article 288 tfeu that regulations have general application, are binding in their entirety and are directly applicable.In Zerbone, the cjeu has drawn a very important consequence from these characteristics: Member States are precluded from transposing a regulation, as the uniform application of this EU instrument may not be jeopardized.10In this contribution this ban on transposing regulations will be referred to as the 'Zerbone doctrine' .While it is required to incorporate EU norms contained in directives in national legislation, such course of action is not permitted for norms laid down in regulations.
It should be noted that the Commission has put forward that the instrument of a regulation was selected for the ehds, as a fully uniform and consistent sectoral legal framework has to be created in order to strengthen the EU's health data economy.11A directive would allow for fragmented implementation in the Member States and would not solve the problem of fragmentation on the market.12It is clear from this reasoning that the introduction of a uniform legal framework applying through-out the EU is at the heart of the ehds policy as proposed by the Commission.In our view, this ties in well with the 'Zerbone doctrine' developed by the cjeu for regulations.
However, it is also clear from the case law of the cjeu that not only directives but also regulations must be operationalized.It should be noted that operationalized entails that the national legislature adopts measures that ensure that the EU norms concerned are put into practice effectively in the national legal order.13In other words, the implementation of a regulation entails that a Member State makes a clear distinction between respecting the direct applicability of the provisions concerned and the need to design a national framework needed for the operationalization of these norms.
As a result, it is of great importance to examine which actions are needed in order to operationalise a regulation.In our view operationalisation consists of four elements.In the first place competent authorities for the application and enforcement of the EU norms concerned must be designated.The Member States are obliged to enable their (public) bodies to apply and enforce these norms.14In the second place, national rules contrary to the EU norms at issue must be adapted.15In the view of the cjeu, it is required that incompatible provisions of national law are amended for reasons of legal certainty.In the third place, some EU norms are of general nature or require action at the national level.Such norms must be elaborated on by the national legislature in order to make them operative in legal practice.16In the fourth place, provisions must be enacted governing the application and enforcement of the EU norms by the national competition authorities.17For instance, national law should set out which sanctions can be imposed in the event the EU norms at issue are violated.18 It should be noted that some regulations contain specific provisions dealing with operationalization matters.19In many cases, however, regulations are silent on this matter but this does not mean that Member States are not required to adopt measures ensuring the putting into practice of the EU norms concerned.On the contrary, it follows from Article 4 (3) teu20 that Member States must adopt all measures necessary on the grounds of the need to guarantee the full effect of Union law.21In other words, even in absence of provisions requiring, for example, the designation of competent authorities or the enactment of sanction provisions, such measures must be taken by the Member States.22Special attention should be paid to the third element of operationalization, which requires that Member States take legislative action with regard to some provisions of a regulation in order to guarantee full operation of these provisions in the national legal order.It may be difficult to make a distinction between this implementation obligation and the ban on not transposing directly applicable provisions of a EU regulation.As will be apparent from the analysis carried out below, this distinction is of great importance, when it comes to the impact of the ehds Regulation on the national healthcare system.Some provisions of this Regulation are drafted in a concrete way and, accordingly, do not need to be elaborated on: they are directly applicable and should not be 'copied and pasted' into national law.Conversely, other provisions of the Regulation cannot be applied and enforced without supplementary measures adopted by the national legislature given their unspecified nature and, therefore, must be worked out in national law in order to be operative.When implementing the ehds Regulation (as the draft stands at the time of the writing of this contribution) the Member States must scrutinize which provisions are directly applicable and which provisions must be further developed in national law.

2.2
Primary Use: the Rights of Natural Persons Article 3 of the ehds Regulation deals with the right of natural persons in relation to the primary use of their digital health data.Consequently, this provision aims to protect their position, if data are used for reasons of treatment.In clear wording Article 3 of the ehds Regulation sets out that in the context of this use of data, natural persons have the right to access their electronic data.Moreover, pursuant to Article 3 (6) of the Regulation natural persons are entitled to insert their own health data in their Electronic Health Records (ehrs).It should be made clear in this file that the data at issue are added by the natural person concerned.On top of that, Article 3 (8) ehds Regulation entitles natural persons to give access to their ehrs to a recipient from the health and social sectors.Then again, Article 3 (9) ehds empowers these persons to restrict access to ehrs to particular health professionals.Accordingly, when it comes to access to digital health data the ehds Regulation is based on an opt-out system.Health professionals, such as doctors treating patients, have access to digital data, unless a patient has objected to this access.
Given the concrete drafting of the provisions discussed it should be concluded that these provisions are directly applicable.Against the backdrop of the 'Zerbone doctrine' the legislature is precluded from incorporating the rights of Article 3 of the ehds Regulation into its national law.Moreover, national provisions overlapping (entirely or partly) with these rights have to be amended.As a result, once the ehds Regulation is signed into law, Member States must screen their national health laws and remove the provisions dealing with the rights of natural persons regarding digital health data.Member States having an opt-in system for sharing digital health data based on the prior consent given by natural persons, are obliged to abandon this system.The reason for this is that in the ehds Regulation the fundamental decision is taken that the opting-out principle applies to the sharing of these data.In our view, this will have a major impact on the national laws on medical secrecy.In some member states the access to and exchange of health data is subject to specific rules protecting the privacy of the patients.The right of a patient to give prior consent for the use of her or his data plays a significant role in various Member States, as is apparent from a study commissioned by the Commission.23This fundamental right must be changed in order to implement Article 3 of the ehds Regulation.The Member States having already in place an opting-out system are not obliged to change their policy but must check whether their national laws do not overlap with the provisions of the ehds Regulation: it has to be avoided that these provisions are transposed into national legislation.
In this regard, it must be pointed out that the line between the ban on transposition and the elaboration obligation is thin.The reason for this is that on the one hand Article 3 (9) of the Regulation gives to natural persons the right to restrict access to their ehrs but on the other hand imposes on Member States the duty to enact rules and specific safeguards governing these restriction mechanisms.The national legislature of a Member State must adopt national rules without interfering with the right of restriction, which is directly applicable.
One of the challenges is whether the national rules on the 'restriction mechanisms' should be limited to procedural matters (such as time limits and the initiation of a proceeding triggering restriction of access) or could also contain conditions for exercising the right to restrict access (for example limitations to European Journal of Health Law (2024) 1-36 the exercise of this right in exceptional circumstances).It will be challenging to implement this part of Article 3 of the Regulation.

2.3
Primary Use: Access to and Exchange of Electronic Health Data According to Article 4 health professionals must have access to electronic health data of the persons treated by them.This right also comes with an obligation: the professionals have the duty to update the data of the persons under their treatment.This provision is drafted in a very concrete way and, as a result, it must be assumed that it is directly applicable at the moment the ehds Regulation enters into force.Accordingly, all national provisions governing the access of health professionals to electronic health data must be amended in order to avoid overlap or incompatibility with Article 4 ehds.
Article 4 provides that Member States are obliged to implement access to and exchange of health data for primary use, if these data are processed in electronic format.In our view, two conclusions should be drawn from the drafting of this provision.First, the obligation to make access to and exchange of health data possible depends on the availability of these data in electronic format.Consequently, the ehds Regulation does not oblige Member States to process health data electronically.It can be derived from the current drafting of Article 4 of the ehds Regulation that it is left to Member States whether particular health data must be processed digitally.Then again, once health data are available in electronic format, the ehds Regulation requires that access to these data and the exchange thereof is made possible by the Member States.Secondly, Article 4 ehds Regulation specifically imposes on the Member States the duty of implementation.In other words, this provision contains an obligation to elaborate on the EU norms concerned.Accordingly, Member States are required to adopt legislative measures in order to guarantee the access to and exchange of electronic health data.
In their opinion the European Data Protection Board (hereafter: edpb) and the European Data Protection Supervisor (hereafter: epds) have recommended to clarify the relationship between Article 4 ehds and the national laws that are already in place and deal with access to personal electronic health data.24In our view, the drafting of this provision limits the role of national law to implementing the ehds access and exchange obligations.If more freedom for the Member States is needed, Article 4 of the ehds Regulation has to be changed.Another problem identified by the edpb and the epds is that the processing of personal data concerning, inter alia health, is only permitted under Article 9 gdpr, if an exception of the second limb of this provision applies; reference is made by these institutions to the ground mentioned under h, which refers to reasons, such as the need to process the data concerned in order to provide healthcare.25In their view Article 4 ehds should be aligned with Article 9 (2) gdpr.The point is, however, that in recital 15 of the ehds Regulation it is suggested that this Regulation provides conditions and safeguards for the processing of electronic health data in order to comply with the requirements of the gdpr.To our mind, the interplay between the gdpr and the draft ehds Regulation gives rise to debate but it is clear from the outset that Article 4 ehds Regulation will have a great impact on the processing of health data.
It should be noted that the access and exchange obligations only apply to the so-called 'priority categories of personal electronic health data for primary use' (hereafter: 'priority health data').To these categories belong, inter alia, patient summaries, electronic prescriptions and laboratory results.26The Commission has the power to extent the list of priority health data by adopting a delegated act.All in all, it may be assumed that the priority health data encompass a wide range of electronic health data.
Of great importance is Article 6 ehds Regulation.Pursuant to this provision the Commission will adopt a European electronic health record exchange format.This format will deal with the priority health data and will lay down the technical specifications for these data.As a result, EU standards will be in place for the exchange and access of priority health data.This entails that ehrs must be designed in such a way that these records comply with the requirements adopted by the Commission.
Sections 2 and 3 of Article 6 of the ehds Regulation stipulate that the Member States have to ensure that the priority health data are processed in accordance with the European format.These provisions specifically add that the Member States must also guarantee that the data issued in accordance with the European format are read and accepted by data recipients.In our view, this means that Member States are precluded from introducing their own technical specifications for the access to and the exchange of digital health data.Adding a national layer of technical specifications would undermine the uniform legal framework for electronic health data.As was stated above, the introduction of such a framework is envisaged by the ehds Regulation.Accordingly, national laws containing technical specifications for the processing of electronic health data have to be amended.These laws should set out European Journal of Health Law (2024) 1-36 that the technical specifications of the European format apply.A national legislature may adopt legislation that imposes on healthcare providers the duty to process health data electronically but it cannot require that this must be done in accordance with national specifications.The national legislature is obliged to provide that the specifications of the European format apply in this regard.It goes without saying that this limits the national healthcare competences considerably.
On top of this, it is stipulated that a central platform will be established by the Commission in order to make cross-border exchange of electronic data possible.27This platform is referred to as MyHealth@EU and is already in place, as it is introduced by the Directive on patient right cross-border matters.28Member States are obliged to create national contact points for digital health and to connect these points with MyHealth@EU.29The exchange of priority health data through these national contact points must be enabled.30Member States must ensure, moreover, that all healthcare providers are connected to their national contact points.31Furthermore, Member States must enable that electronic subscriptions are exchanged through the electronic network of MyHealth@EU.It is clear from these provisions that the Member States must co-operate with the Commission to set up a European network for exchanging electronic health data.It also derives from the wording of the provisions concerned that the Member States must adopt measures to ensure the operation of the MyHealth@EU electronic network.

2.4
Primary Use: EU Standards for ehr Systems The ehds Regulation also lays down standards for ehr systems developed by a manufacturer for the primary use of priority health data.Article 15 of this Regulation provides that such systems may only be introduced to the market, if they comply with these standards.The documents accompanying the ehr systems must bear a ce marking.32The approach on which the rules on ehr systems are based takes self-certification as point of departure.The manufacturers have to assess themselves whether their ehr systems are in conformity with the ehds standards.It goes without saying that the ehds Regulation contains enforcement mechanisms for addressing non-compliance with the standards concerned.In section 2.6, which discusses the national authorities that should be designated, this enforcement matter will be discussed further.Article 20 ehds Regulation imposes obligations upon distributors.For instance, these companies are obliged to verify whether the manufacturer has drawn up a EU declaration of conformity and whether a ce marking is attached to the documents accompanying the ehr system concerned.
The provisions of the ehds regulation on ehr systems are drafted in a very concrete way and are, as a result, directly applicable.Accordingly, at the moment that the ehds Regulation enters into force (with no substantial amendments), it will contain the most important standards for ehr systems.As a result, EU law will be decisive for determining which systems may be offered on the market.Consequently, the national laws the Member States have in place must be changed significantly.Overlap and incompatibility with the corresponding provisions of the Regulation should be avoided.This means that a considerable number of provisions of national law must be changed or withdrawn and, on top of that, other national provisions, geared towards facilitating the implementation of the EU approach to ehr systems, have to be adopted.In other words, the ehds Regulation will oblige Member States to introduce a system of self-certification for ehr systems and to support the operation of such a system.National systems that take prior authorization schemes or other mechanisms for approving as point for departure for regulating ehr systems must be abolished, if the draft ehds Regulation as proposed by the Commission will not be amended substantially.The reason for this is that the aim of this draft, as it stands now, is to introduce a uniform legal framework for, inter alia, ehr systems.Such a framework does not allow for national laws adding a national set of standards for ehr systems.

2.5
Rules on Secondary Use: the Obligation to Share Electronic Health Data As already was stated, the ehds Regulation contains provisions for secondary use as well.These provisions govern the processing of health data for purposes that are not related to the treatment of patients but for other reasons, such as scientific research and commercial applications.It goes without saying that this use is very sensitive and may give rise to privacy concerns.33 The core provision for secondary use is Article 33 ehds Regulation in our view.According to this provision data holders are obliged to make available a wide range of health data, if particular conditions are satisfied.Every hospital, every health professional and every organization possessing health data is caught by this obligation.In Article 33 a great number of health data are listed, such as ehrs and human generic, genomic and proteomic data.It is not surprising that the duty of sharing these sensitive data is subject to a number of safeguards.
A key role in the procedure for sharing these data will be played by the so-called health data access bodies, which must be created by the Member States.34Any natural or legal persons wishing to get access to health data has to send a request to such a body.35 This authority must assess whether the application submitted concerns the use of data for the purposes listed in Article 34 (1) of the ehds Regulation.36 In this provision a wide range of purposes are recognized as reasons for which electronic data can be processed for secondary use.Examples are: -activities for reasons of public interest in the area of public and occupational health, -support to public sector bodies or Union institutions, agencies and bodies in the health or care sector, -scientific research in relation to health and care sectors as well as ai systems and digital health applications, which contribute to public health or social security.It should be pointed out that the purposes for processing data for secondary use are drafted in a very expansive way.37 Apart from reviewing the purpose of the secondary use requested, a health data access body must examine whether giving access is necessary and in line with the other relevant requirements laid down in the ehds Regulation.38If so, this body must issue a data permit.
Strikingly, in this procedure the consent of the natural person whose data will be shared does not play any role.Pursuant to Article 33 (5) of the ehds Regulation health data access bodies must rely upon the obligations set out in this Regulation, if consent of natural person is required by national law.The edpb and the eds have put forward that this provision does not clarify the relationship between the ehds rules on secondary use and national law.39In our view, however, the drafting of this provision gives priority to the ehds rules over the provisions of national law, as the health data access bodies must base their decisions on the ehds rules.The suggestion of priority of the ehds rules over national law contained in the Regulation is not surprising against the backdrop of the primacy of EU law.It is settled case law that EU law has priority over national law and, accordingly, national provisions that European Journal of Health Law (2024) 1-36 are incompatible with directly applicable rules of EU law must be set aside.40As Article 46 ehds Regulation does not mention the consent of the patient concerned as a condition for granting a data permit, national laws requiring such permission are not in line with EU law and have to be disapplied, once Article 46 of the ehds Regulation enters into force without being amended substantially.
All in all, the privacy of a person is not protected by means of a system of prior permission under the ehds rules, as proposed by the Commission.When it comes to secondary use, the natural person whose data are shared does not even have the right to object; unlike with primary use there is no right to opt-out for natural persons with regard to secondary use.41On top of that, a health data access body is even not obliged to inform a natural person at her or his request about the use of her or his data.The ehds Regulation does require health data access bodies to publish annual reports with, amongst others, information on the applications for access to digital health data, a summary of the results of the use of the health data and information on audits to determine whether the processing of data by the users is done in compliance with the ehds Regulation.42This reporting obligation does provide natural persons with more information on how their data is being used, even though this information is, for obvious reasons, not traceable to individuals.
At the moment of the writing of this contribution, however, the Council is discussing such an opt-out system for secondary use.Even though, Member States disagree on the need for an opt-out system (or an opt-in system for that matter), the Swedish Presidency did include, inter alia, an 'opt-out solution' for secondary use in a compromise text on the ehds Regulation.43The general initial reaction on the overall compromise text seems to be positive according to the progress report of 26 May 2023,44 although it remains to be seen whether an opt-out system will make it to the final text.
In any event, it should be put forward that in the ehds regulation, as proposed by the Commission, the issue of privacy protection has not remained unaddressed: this proposal contains three safeguards with regard to this issue.Firstly, the data will be given to the applicant in a anonymized or pseudonymized format.The point of departure is to anonymize the data, but if this is not possible the data may be supplied in a pseudonymized format.45Secondly, the supply of data should be limited to the extent that this is necessary for the purpose for which these data will be used.46 In other words, the amount of data made available should be minimized.In this regard, it must be pointed out that according to Article 5 (1) gdpr data minimization is an important principle for data processing: it is a means for protecting the privacy of person whose data are shared.Thirdly, Article 35 of the ehds Regulation specifically stipulates for which purposes electronic health data may not be processed for secondary use.For instance, the secondary use of digital health data is not permitted, if this leads to taking decisions at the detriment of the natural persons concerned.Another important example of prohibited use concerns decisions by which a natural persons or a group of persons are excluded from the benefit of an insurance contract or by which their contributions and insurance premiums are changed.
It is remarkable that the rules for secondary use are drafted in a very concrete and precise way.It must, as a result, be assumed that these rules are directly applicable.Given the Zerbone doctrine no overlap may exist between these rules and provisions of national law on secondary use.It is also clear from the outset that national provisions incompatible with the rules of the ehds Regulation must be amended.Consequently, the core provisions on secondary use will be constituted by the relevant provisions of the ehds Regulation, once this piece of EU legislation is signed into law (with no substantial changes).As already was outlined above, in many Member States the processing of health data is depending on the consent given by the patient.By issuing its draft for the ehds Regulation, the Commission has, in fact, proposed to change this fundamental approach.47In our view, here a huge leap step is taken, as the processing of health data for another purpose than for which it is generated is a very sensitive matter.A very important pillar in the Commission's proposal for securing the privacy of the patients is processing the health data in anonymized or pseudonymized format.In literature, it is, however, argued that at one point in time even such data may be re-identified.48 It cannot be excluded that non-personal data will be turned into personal data after certain period European Journal of Health Law (2024) 1-36 of time.49If this happens, the privacy of the patients concerned cannot be guaranteed anymore.Against this backdrop, it is of great significance that a legislature assesses with great care the risks at issue, when considering a system of secondary used based on the sharing of health data in anonymized or pseudonymized format.It is apparent from the draft ehds Regulation that this assessment is currently being made not at the national but rather at the EU level.

2.6
The Designation of Competent Authorities The ehds Regulation will introduce an extensive and complicated set of rules for electronic health data.It goes without saying that guaranteeing compliance with these rules will be a daunting task.It is, therefore, not surprising that the ehds Regulation provides for a governance structure geared towards compliance.It requires that the Member States ensure that six authorities will be tasked with the application and enforcement of the ehds rules.The national authority that is competent for implementing the gdpr (hereafter the national gdpr authority) will play a role.On top of that, five new authorities must be created by the Member States.
The national gdpr authority, which is already experienced in handling data protection cases, will automatically have the power to monitor compliance with the rules of Article 3 ehds, which protects the rights of natural persons in relation to the primary use of their digital health data.This derives from Article 3 (11) of the Regulation, which states that the national gdpr authority concerned will be responsible for monitoring compliance with these rules.It also has the power to impose administrative fines.
In order to enforce the rules on the primary use of digital health data the Member States must create a digital health authority.50Although it is in the hands of the Member States to designate these authorities, Article 10 (2) ehds Regulation sets out in great detail their tasks.Consequently, EU law prescribes the tasks which are to be executed by these authorities.The Member States must confine themselves to adopting measuring facilitating the achievement of ehds goals.
As already stated above, the Member States are obliged to set up national contact points for digital health.51These bodies must ensure the connection to all other national contact points and to the central platform established by the Commission (MyHealth@EU).52The network of national contact points and the central platform is supposed to make possible the exchange of priority health data for primary use.According to Article 52 ehds Regulation Member States must also create national contact points for secondary use.These contact points will become part of the cross-border electronic infrastructure for secondary use.
Also ehr systems market surveillance authorities should be created, as is apparent from Article 28 ehds Regulation.The main task of these authorities is to ensure that the rules for ehr systems are observed.Pursuant to Article 29 (1) of the ehds Regulation a market surveillance authority must take action if it finds that a ehr system poses a risk to the health or safety of natural persons or to other aspects of the public interest.If it detects non-compliance with the relevant ehr standards, it is obliged to order the economic operator concerned to put an end to this non-compliance.If this non-compliance does not end, the Member State concerned must take the appropriate measures in order to ensure that the ehr system at issue is not marketed anymore.53It is clear from the drafting of this provision that the room for manoeuvre for the national authorities is limited, as every issue with regard to an ehs systems should lead to an enforcement response.
As already was discussed above, health data access bodies must be created by the Member States.54As was apparent from the analysis of the rules on secondary use, these authorities must decide on the applications for data permits.Article 37 ehds Regulation, however, also lists a great number of other tasks.Many of these tasks concern cooperation with other competent authorities.The health data access bodies are also tasked with monitoring compliance with the rules on secondary use.To that effect, they must have the power to revoke a data permit previously granted to a party.Moreover, they should be able to stop the processing of data that is found to be incompatible with the ehds rules.According to Article 43 of the ehds Regulation the Commission will have the power to issue guidelines on the penalties to be imposed by the health data access bodies.As a result, the Commission will be able to exercise control over the enforcement policies of the health data access bodies.
To conclude, Article 69 provides that the Member States must enact rules dealing with the penalties due in the event of violations of the ehds provisions.It should be ensured that these penalties also will be implemented.It is set out that the sanctions must be effective, proportionate and dissuasive.In  our view this provision codifies the case law of the cjeu on the principle of Union loyalty, enshrined in Article 4 (3) teu.In cases, such as Greek Maize,55 the cjeu has already formulated similar requirements for the national penalties to be imposed if EU law is infringed upon.

3
The Legal Basis for the ehds Regulation From the foregoing it is apparent that the draft ehds Regulation will have a major impact on the national healthcare systems of the Member States.It has to be pointed out that the EU must respect the responsibility of the Member States to define their health policies as well as to organise and to deliver health services.This begs the question to what extent the EU is competent to intervene in the national digital health data systems.The Commission has proposed for the ehds Regulation to be based on both Article 16 tfeu and Article 114 tfeu.Article 16 tfeu provides for a legal basis to adopt measures to protect personal data and to ensure the free movement of such data.This provision is thus a logical legal basis for the provisions in the ehds Regulation, which deal with the protection of personal data.Article 16 tfeu is, according to the Court, appropriate to use when the protection of personal data is an essential aim of an act.56For example, as already discussed, Article 3 (1) of the ehds Regulation grants a right to natural person to 'access their personal electronic health data [which is] processed in the context of primary use of electronic health data, immediately, free of charge and in an easy readable, consolidated and accessible form' .This provision is therefore a clear-cut example of a provision which relates to the protection of personal data.In our view, the Commission has opted for an appropriate legal basis, when it comes to Article 16 tfeu.
Nevertheless, most of the provisions in the ehds Regulation deal with other aspects than specifically the right to protection of personal data and are therefore based on Article 114 tfeu, the so-called internal market clause.The use of this legal basis for the ehds Regulation is, in our view, more problematic.The internal market clause is a residual legal basis and can only be used, if no more specific provision is available.57With regard to the ehds Regulation, the ques- tion raises whether Article 168 tfeu, which is the legal basis for EU healthcare action, should have been used instead of Article 114 tfeu.

3.1
Why is Article 114 tfeu Used in the Draft ehds Regulation?From a practical perspective the use of Article 114 tfeu seems an understandable choice, since Article 168 (5) tfeu explicitly excludes harmonization measures regarding the protection and improvement of human health.The MyHealth@EU platform, whereby the EU encouraged Member States to enable the exchange of health data between healthcare providers in different Member States on a voluntary basis, seems to be unsuccessful.As the Commission mentions, the voluntary nature of Article 14 of the Patient Directive, and thus of the MyHealth@EU system (introduced by this system), 'partly explains why this aspect of the Directive has shown limited effectiveness in supporting natural persons' control over their electronic health data at national and cross-border level and very low effectiveness on secondary uses of electronic health data' .58Furthermore, the evaluation of digital aspects of the Patient Directive showed, according to the Commission, 'that legal provisions supporting harmonisation and a common EU approach to use of electronic health data for specific purposes (as opposed to voluntary actions only), and EU efforts to ensure legal, semantic and technical interoperability, can deliver benefits' .59 In the 'Study on health data, digital health and artificial intelligence in healthcare' , which the Commission used to substantiate the need for the ehds Regulation, the voluntary nature of the MyHealth@EU platform is also presented as a problem.60This platform was not very effective to encourage the exchange of patient data, due to the lack of priority by Member States.61 The voluntary nature of the current initiatives to enhance the interoperability and portability of digital health data is thus, according to the Commission, to the detriment of a digital single market for the health sector.In its impact assessment, the Commission also emphasises the 'more limited scope for Union intervention [under Article 168 tfeu] which would not allow to tackle the problems that have been identified in the problem definition, such as supporting control of patients over their health data by improving interoperability, allowing the digital health products and services to circulate freely within European Journal of Health Law (2024) 1-36 the EU and re-using health data' .62All these statements seem to point towards the conclusion that the Commission uses Article 114 tfeu to circumvent the harmonisation prohibition of Article 168 (5) tfeu.
As previously mentioned, from a pragmatic point of view, and after the experience with the voluntary MyHealth@EU platform, it is understandable to make use of the internal market clause.The Union legislature would then be able to take a further step towards the European Health Union.These pragmatic reasons could nevertheless, from a legal perspective, be questionable, since this may lead to an improper use of Article 114 tfeu and could encroach upon the competences of the Member States relating to their healthcare policies.63 The Court has made clear in, for example, Tobacco Advertising I, that Article 114 tfeu may not be used to circumvent the harmonisation prohibition of Article 168(5) tfeu.64This does not mean though, that Article 168 (5) prevents the Union legislature of making use of another legal basis to adopt harmonisation measures which may have an impact on the protection of human health.65Ultimately, this begs the question whether the use of Article 114 tfeu in relation to electronic health data is warranted in order to create the ehds.Consequently, it should be determined what the main goal of the ehds Regulation is and, accordingly, whether Article 114 tfeu may actually be used as a legal basis for this piece of EU legislation.

Is Article 114 tfeu the Correct Legal Basis for the ehds Regulation?
In our view, it cannot be denied that the ehds Regulation is capable of contributing to the protection of public health.A proper exchange of digital health data will be beneficial when a patient needs treatment (primary use of health data) or, for example, for research into new treatments (one of the secondary uses of health data).Article 114 (3) does oblige the Commission to take a high level of health into account when creating legislation on the basis of this provision.This means that the Union legislature is not prevented from creating measures on the basis of the internal market clause in order to protect public European Journal of Health Law (2024) 1-36 health as long as the requirements of Article 114 tfeu are met.66In its proposal and accompanying documents the Commission, however, gives some mixed signals with regard to the main goal pursued by the ehds Regulation.Whereas in general, the reasoning of the Commission focuses on the problems for the internal market caused by the absence of effective means for exchanging digital patient data,67 there are also statements which seem to raise the protection of public health from a goal of subordinate nature to a more predominant goal of the ehds Regulation.68Moreover, the study supporting the impact assessment also seem to point towards public health as a more predominant goal.69 As mentioned, the main focus of the reasoning by the Commission for the ehds Regulation relates to the problems for the internal market caused by a lack of the exchange of digital patient data.The Commission, for example, refers to the fragmentation of the internal market when Member States introduce different certification systems for ehr systems, and the commercialisation of digital health data throughout the EU.70The effect on healthcare is, according to the Commission in its impact assessment, merely secondary to the internal market aim of the ehds Regulation.71In our view, however, a strong case can also be made that the protection of health is the main goal of this Regulation for the following reasons.The evaluation of Article 14 of the Patients Directive shows that in 'many Member States, there are substantial national, regional and local challenges to interoperability and data portability, hampering continuity of care and efficient healthcare systems' .72The fragmentation in the internal market on this aspect is thus problematic from a healthcare perspective.Furthermore, the European Data Protection Board and the European Data Protection Supervisor seem to be of the opinion that the Union legislature cannot use Article 114 tfeu to regulate all the aspects in the ehds Regulation, as the fragmentation issue is framed by these bodies a matter of healthcare falling within the scope of Article 168 tfeu.73In legal literature, it has also been pointed out that the covid-19 pandemic showed a need for exchange of electronic health data.The lack of proper mechanisms to exchange such data did hamper scientific research during the pandemic.74Obviously, this barrier for scientific research is detrimental to public health.Admittedly, as previously mentioned, the Union legislature is allowed to adopt measures on the basis of Article 114 tfeu, even when the measure pursues other aims as well, when it is established that the conditions of Article 114 tfeu are met.The measure should be intended to either eliminate likely obstacles to the exercise of the fundamental freedoms, or to remove appreciable distortions to competition resulting from diverging national rules.75It is thus necessary to determine whether the different provisions in the ehds Regulation predominantly pursue an internal market goal or a healthcare goal.Therefore, we will discuss in subsequent order in general the provisions relating to the exchange of digital health data for primary use, the rules relating to the exchange of such data for secondary use and the rules relating to ehr systems, in relation to the goals which those provisions pursue.
First, when it comes to the primary use of health data, an important reason presented for the claim that the ehds Regulation has an internal market dimension is that it stimulates the free movement of patients.However, the arguments raised by the Commission are, in our view, not convincing.These arguments concern cases where a person moves to another Member State for reasons, such as business, leisure or study.76The issue is that a person would not necessarily be refrained from moving to another Member State (either to European Journal of Health Law (2024) 1-36 live there, to work there, or to visit it as a tourist), because she or he might fall ill, would need treatment and this treatment could then be hampered or postponed by the lack of an exchange of electronic patient data.Such a reasoning is, in our opinion, based upon a 'future and hypothetical event' ,77 and could, in light of the Court's case law, be regarded as too remotely related to the exercise of the four fundamental freedoms.This may be different if a person wishing to move to another Member State with the specific purpose to receive care there.Such a person may be discouraged from doing so, if the doctors of the Member State of treatment may have difficulties with accessing the health data of the person concerned stored in the Member State of residence.It is very striking that the draft ehds Regulation and documents accompanying this draft virtually pay no attention to these cases.In essence, the Commission proposes to harmonise the primary use of digital health data in an extensive manner in order to support persons who, after having crossed a border, are unexpectedly confronted with health issues.Against this backdrop, it could be argued that the effect on the free movement of persons may be too indirect and uncertain.78 Second, with regard to the secondary use of data, it could also be argued that the harmonisation of exchange of patient data for some uses is just remotely intended to protect the internal market.The internal market goal is not at play for Member States which need data when adopting policy measure for the protection of public health.79It is clear from the outset that such measures serve healthcare purposes and are not inspired by the wish to improve the proper functioning of the internal market.By contrast, the problems companies, wishing to introduce data driven products and services but not being able to access the relevant electronic healthcare data, do relate to the internal market objective.In such circumstances the freedom to provide services or the free movement of goods could be hampered when new treatments or products cannot be created due to a lack of data.Moreover, a similar reasoning might be used when scientific research cannot be conducted, or not that easily, since that, ultimately, might lead to less products or treatments on the market.However, the advancement of scientific research in the healthcare domain will also lead to improvements for public health.The question would then be whether the main goal of scientific research is the advancement of public health or the European Journal of Health Law (2024) 1-36 creation of new products and services which may then be brought upon the market.Overall though, rules relating to the exchange of healthcare data for secondary use are partly aimed at the protection of public health and partly at removing barriers to trade.
Third, it has to be noted that the Commission has attempted to prove the internal market dimension of the ehds Regulation by referring to problems for producers of ehr systems and to the problems for the commercialisation of digital health data.Rules on ehr systems80 and problems for the commercialisation patient data are indeed problems which might be tackled under Article 114 tfeu, since they pose problems for companies active in these areas.However, the provisions dealing with interoperability requirements and certifications for ehr systems, do seem to be ancillary to the main goal of ensuring a proper exchange of digital health data for primary and secondary use.The argument would then be that the exchange of data could become more difficult without some form of standardisation for ehr systems.This argument can be seen in different documents which the Commission used to assess and to motivate the need for the ehds Regulation.81If the Commission's endeavour had been to merely standardise requirements for ehr systems, a more suitable course of action would have been to create standards for such systems through technical harmonisation.Currently, the rationale of the interoperability and certification requirements for ehr systems laid down in the proposal, seems to contribute to the attainment of the main goal of improving the exchange of digital health data for primary and secondary use.As has been shown above, it is questionable whether Article 114 is the correct legal basis for the rules relating to the exchange of digital health data for both primary and secondary use.As a result, similar doubts can be raised with respect to the rules on the ehr systems, since these rules are meant to facilitate the exchange of digital health data for primary and secondary use.

3.3
How to Address the Legal Basis Issues?It is apparent from the foregoing that the Commission seems to use Article 114 tfeu as a more general legislative power to harmonise the exchange of patient data for primary use and for different kinds of secondary use as well as ehr systems.The Union legislature should therefore do well to reason more extensively why the lack of exchange of electronic patient data leads to (potential) obstacles to free movement or to (potential) distortions of competition.Currently, the proposal lacks, in our opinion, a sound reasoning with regard to the use of Article 114 tfeu, at least where the Regulation intends to harmonise the primary use of digital health data and for some secondary uses of such data.A better line of reasoning would make the use of legal Article 114 tfeu as legal basis more convincing.
Another option for the Commission could have been to change Article 14 of the Patient Directive to oblige Member States to create systems for the exchange of electronic patient data for cases where persons cross the border with the intention receive healthcare in another Member State.This would, however, lead to a substantial weaking of the initial proposal of the Commission and would, in turn, not lead to a digital internal market for health data.
A final option might be to adopt the measure on the basis of Article 168 tfeu, although that would mean that many provisions have to be adapted in order to comply with the harmonisation prohibition of Article 168 (5) tfeu.The Union legislature could still oblige Member States to cooperate and to improve the exchange of electronic health data, although the harmonisation prohibition would prevent the legislature from laying down EU standards for subjects, such as the primary and secondary use of health data.This would entail relying more extensively on Member States to come up with solutions.

The Principles of Subsidiarity and Proportionality
Since the ehds Regulation is not based on an exclusive competence of the Union, the legislature should keep in mind the requirements set by the principle of subsidiarity when exercising its competences.82The exercise of the Union's competence is, moreover, limited by the principle of proportionality.83 Once the Union has the competence to act, it should respect these two principles in the exercise of the competences granted to it by the Treaties.

4.1
The Principle of Subsidiarity The Union should, in light of the subsidiarity principle, '[only act] if and in so far as the objectives of the proposed action cannot be sufficiently achieved by the Member States, either at central level or at regional and local level, but can rather, by reason of the scale or effects of the proposed action, be better achieved at Union level' .84This principle thus consists of a two-folded test.This test requires a political assessment by the Union legislature and national parliaments.The role of the national parliaments has been arranged for in Protocol no 2, but the impact of their task is obviously dependent on the willingness of national parliaments to engage in this process.85 With regard to the ehds Regulation, up till now, only the Portuguese Parliament and the Czech Chamber of Deputies and Senate have issued opinions on this legislative act.According to a progress report of the Council of 26 May 2023, the Portuguese Parliament stated that the proposal complied with the principles of subsidiarity and proportionality, whilst the Czech Chamber of Deputies and the Senate raised some issues with regard to the subsidiarity requirement.86Not only political actors play a role in the assessment of the compliance with the principle of subsidiarity.A legislative measure may be challenged by Member States, but also by other parties, before the Union Courts on the basis this principle.A Member State may start a procedure, on instigation of a national parliament, even when the competent minister of that Member State has voted in favour of the act in a Council meeting.87 The Commission explains in different documents why the ehds Regulation complies with the principle of subsidiarity.88In the impact assessment the Commission emphasises that the current voluntary approach under Article 14 of the Patient Directive 'consisting of low intensity/soft instruments, such as guidelines and recommendations aimed to support interoperability, have not produced the desired results.Moreover, national approaches in addressing the problems have only limited scope and do not fully address the EU-wide issue.'89There are diverging approaches with regard to data exchange in dif-European Journal of Health Law (2024) 1-36 ferent Member States.90Obviously, the subsidiarity test might be more easily met when there are diverging approaches at domestic level.91 The lack of the effectiveness of the voluntary MyHealth@EU system and the diverging approaches at domestic level with regard to electronic patient data led the Commission to propose the ehds Regulation.The Commission substantiates the compliance with the subsidiarity principle quite extensively in the impact assessment, the study supporting the impact assessment and the proposal itself.
The Union Courts will not quickly annul an act on the basis of the subsidiarity principle.There are multiple cases where the Union Courts leave a lot of discretion to the Union legislature to assess the subsidiarity of a measure,92 although there are also cases where the Union Courts more substantively discussed compliance with the subsidiarity principle.93Ultimately, the Union Courts will not quickly intervene as long as the Union legislature 'has concluded on the basis of detailed evidence and without committing any error of assessment that the general interests of the European Union could be better served by action at that level' .94A proper motivation on the reasons why an act complies with the subsidiarity principle will thus make it more robust and will make it less likely for the Union Courts to annul the act on the basis of the subsidiarity principle.The Union legislature will also have discretion with regard to the form of legislation95 and the level of intervention necessary.96In legal literature it has mentioned in this regard that the Union can make use of different levels of intervention, ranging from a more general act where European Journal of Health Law (2024) 1-36 the provisions leave more room for Member States to an act containing only specific provisions.97For the ehds Regulation, the Commission has chosen to intervene in a far-reaching manner.98This is not necessarily problematic in light of the subsidiarity principle.There are different areas of EU law, where a general level of intervention at EU level has led to regulatory failure, which in turn created a need for a far-reaching form of intervention.99From a subsidiarity point of view, it is understandable that the Commission proposes quite a far-reaching legislative act, since the ehds proposal stems from some form of regulatory failure due to the less intrusive possibilities to coordinate the exchange of electronic healthcare data on the basis of Article 14 of the Patient Directive.In our opinion, it seems unlikely that the Union Courts might annul the ehds Regulation due to non-compliance with the subsidiarity principle.

4.2
The Principle of Proportionality The principle of proportionality provides, as mentioned, the second boundary to the exercise of the Union's competences.The Union Courts generally speaking seem to use a manifest error test to determine whether Union legislation might infringe the proportionality principle, when the Union legislature has to make political, economic and social choices.100In areas where there is a wide discretionary power for Union institutions, the Courts will assess whether the measure is manifestly disproportionate.101This does not mean, however, that the Union Courts do not assess the proportionality of a measure in such instances in an in-depth manner, nor that measures of the Union institutions are immune to annulment.102It will be necessary for the Union legislature to explain why an act (or specific provisions in an act) complies with the proportionality principle.In the Philip Morris case, the Court of Justice, for example, referred to the motivation in the impact assessment to conclude that the Union legislature 'weighed up' all different consequences and aspects of the act.Therefore, the act was not manifestly disproportionate.103 European Journal of Health Law (2024) 1-36 The Commission elaborates in the explanatory memorandum attached to the draft ehds Regulation on the proportionality of the act.This includes an explanation of the choice for the instrument of regulation.In general, directives are less intrusive for Member States and are, therefore, more easily regarded as proportionate in comparison to regulations.The ehds Regulation is aimed at removing barriers for the free movement of patient data.104As mentioned before, Article 14 of the Patients Directive did not lead to the desired result.Furthermore, the current fragmentation of the internal market due to intervention at Member State level hampers innovation105 and affects multiple actors, such as healthcare providers, patients and researchers.106 In order to substantiate why the ehds Regulation is proportionate to its goals, the Commission examined different policy options and choose the one which ensures 'the best balance between effectiveness and efficiency in reaching the objectives' .107A cost/benefit-analysis can indeed, as the Commission explains, in some circumstances be regarded as an expression of the proportionality principle.108 The substantiation of the Commission in light of the principle of proportionality and the room for manoeuvre granted by the Union Courts will make it unlikely, in our opinion, that the ehds Regulation will be regarded as infringing the principle of proportionality.Obviously, the different provisions in the act should also be examined in light of the principle of proportionality.
The choice for a regulation is also logical in our opinion.Member States have some flexibility when transposing directives, whereas regulations may not be transposed in national law.A regulation is, according to the Commission, the most suitable instrument, 'given the need for a regulatory framework that directly addresses the rights of natural persons and reduces fragmentation in the digital single market' .109The Commission did not choose for a directive, since the room available for Member States to implement such an instrument could still lead to fragmentation.110In our view, it is understandable that the instrument selected is the regulation, since this would allow for less fragmentation and would therefore allow for a better exchange of digital patient data for both primary and secondary uses.

5
The Current EU Legal Framework for the Free Movement of Patients As was outlined at the beginning of this contribution, the ehds Regulation aims at improving the free movement of patients.This goal is an important argument for the Commission to base the draft ehds on Article 114 tfeu.In our view, it is, therefore, relevant to examine the current EU rules on this matter.Remarkably, two sets of EU measures apply to cross-border healthcare: the Patient Directive111 and the Social Security Coordination Regulation.112 The Patient Directive is based on the case law of the cjeu on free movement113 and aims at harmonizing the rights of patients in cross-border matters.114 The core provision is constituted by Article 7. According to this provision, a patient seeking treatment in another Member State is entitled to reimbursement of the costs of this treatment provided that the care provided belongs to the benefits to which she or he is entitled to on the basis of the relevant laws of the Member State of affiliation.These expenses will be reimbursed up and to the level of the tariffs of the Member State of affiliation.115If the costs of the treatment in the other Member States exceed the tariffs of the Member State of affiliation, the latter may decide to pay for the full costs.116 The Directive does not oblige the Member State of affiliation to bridge the gap between the costs of cross-border treatment and its tariffs.
All in all, Article 7 confers a very generous right to cross-border healthcare.This is in line with the case law of the cjeu preceding the adoption of the Patient Directive.117In this case law, however, the cjeu accepted that cross-border healthcare could be restricted if this was necessary with a view to the interest of public health and, more in particular, the need to plan the European Journal of Health Law (2024) 1-36 health services at issue.118In the same vein, Article 8 of the Patient Directive contains an exception for the obligation of the Member States to reimburse cross-border healthcare costs.This exception is centred around the instrument of prior authorization.In our view, this can be explained on the ground that in the cases preceding the Patient Directive the cjeu had assessed national prior authorizations schemes under the free movement rules too.119According to Article 8 (2) of the Patient Directive, the reimbursement of cross-border healthcare costs may be made subject to prior authorization if (1) the care concerned has to be planned to ensure access for all, while the treatment at issue involves overnight hospital accommodation or involves highly specialized and cost-intensive medical infrastructure or equipment; (2) the treatment concerned presents a particular risk for the patient or population; or (3) the healthcare provider concerned could give rise to serious and specific concerns with regard to the quality or safety.In our view, the most important exception is the justification ground based on the need to plan particular categories healthcare.It is apparent from this case law of the cjeu that the cases revolve around this issue.120It can also be derived from these judgments of the cjeu that the need to plan care is mostly connected with treatments offered in hospitals.Furthermore, it should be noted that, if a prior authorization scheme is in place, the competent authorities of a Member State must grant permission to a patient for receiving healthcare in another Member State in the event that treatment cannot be given on time in the Member State of affiliation.121 It is clear from the drafting of Articles 7 and 8 of the Patient Directive that the main rule is that cross-border healthcare costs are reimbursed, whereas the instrument of the prior authorization scheme should be considered as an exception to this rule.This instrument can mainly be deployed by the Member States for healthcare that needs to be planned.The argument of planning is mostly at play with regard to hospital care.
However, as already pointed out, the Social Security Coordination Regulation also lays down rules on cross-border healthcare.Strikingly, this piece of EU legislation is based on principles other than those of Articles 7 and 8 of the Patient Directive.To start with, the cjeu has contended that the Regulation does not amount to harmonization (as the Patient Directive does) but to European Journal of Health Law (2024) 1-36 coordination.122Its aim is to stimulate free movement of persons rather than harmonizing some aspects of the social security systems of the Member States.Moreover, this Regulation distinguishes between care a natural person did not anticipate when travelling to another Member State and care this person anticipated to receive when going to another Member State.In the event of non-anticipated care -the person concerned went to another Member States for purposes of, for example, business, leisure or study -she or he (unexpectedly) falls ill and needs immediately medical help.According to Article 19 (1) of the Regulation this person will be treated by the authorities of the Member State of stay at the expenses of the Member State of residence (affiliation).The costs will be covered on the basis of the tariffs of the Member State of stay/treatment.If, however, a person seeks treatment in another Member State and wishes to go to this Member State for that purpose, she or he needs prior authorization.According to Article 20 (1) of the Social Security Coordination Regulation the authorities of the Member State of residence (affiliation) decide on this matter.Authorization must be given, if the patient concerned cannot be treated without undue delay within the Member State of residence, while authorization may be refused if this is not the case.123It goes without saying that the treatment must be part of the benefits the patients is entitled to according to relevant laws of the Member State of residence.124The tariffs of the Member State of treatment apply.125 It follows from the foregoing that the matter of cross-border anticipated healthcare is centred around the instrument of prior authorization.While in the Patient Directive this instrument features as an exception, applying for prior permission is the only means for receiving reimbursement for anticipated care under the Social Security Coordination Regulation.Consequently, these two pieces of EU legislation are based on contradictory principles.
It would not have been a surprise if the cjeu had decided that these two sets of rules were at conflict with each other.Strikingly, the cjeu has solved this issue by developing an approach that was aimed at reconciling the two EU measures.In Inizan,126 it has framed the obligation to apply for prior authorization laid down in the Regulation as an administrative mechanism geared at facilitating the reimbursement of the costs of cross-border anticipated care.Patients are free to make use of the mechanism of Article 20 of the Social European Journal of Health Law (2024) 1-36 Security Coordination Regulation in order to benefit from a smooth proceeding leading to treatment abroad and reimbursement of the corresponding costs.In this case she or he will not be confronted with obligations of upfront payment.127Conversely, the patient could also base his plans for cross-border treatment on the Patient Directive.The big advantage of this is that authorization is not needed for care that does not need to be planned (or do not give rise to the two other concerns mentioned in Article 8 of the Directive).However, when making use of the Directive a patient may be confronted with the need of upfront payment: she or he could be forced to finance the treatment abroad out of her / his own pocket first and to then claim back these costs from the authorities of the state of affiliation.128It goes without saying that this routing of the healthcare bills would not be a nice experience for the patient concerned.In this light, it is not a surprise that even the Patient Directive itself provides that the Social Security Coordination Regulation applies unless the patient has opted for this Directive.129 Notwithstanding the fact that it is up to the patient to make use of the Regulation, this EU measure is the default option under the EU rules on cross-border healthcare.
The subtle and complex interplay between the rules of the Directive and the Regulation does not encourage patients to seek treatment in another Member States.130What choice should a patient make?Should she or he go for the Patient Directive, as no authorization scheme will be required for some categories of treatment?Or should she or he decide to make use of the smooth mechanisms of the Regulation?Then again, it depends on the level of tariffs of the countries of residence and of treatment whether this would be a good course of action.The Directive takes the tariffs of the country of residence as benchmark, which would be favourable if these tariffs are higher than those of the country of treatment.Conversely, it would be better to rely on the Regulation in the event that the tariffs in the country of treatment are higher.Another consideration is that in Vanbraekel,131 the cjeu has held that, when the administrative mechanism of the Social Security Coordination Regulation is relied upon, the Treaty provisions on the free movement obliges the Member States of residence to cover the costs of copayment made by a patient in the country European Journal of Health Law (2024) 1-36 of treatment if such payment would not have been required in the case that the treatment concerned would have been given in the country of residence.In sum, the relationship between the Directive and Regulation is complex and the Commission has acknowledged that this relationship is difficult to understand for the general public.132 Even the cjeu struggles with the complex dual applicability of the Patient Directive and the Social Security Coordination Regulation.In Veselibas ministrija133 the cjeu was called upon to shed its light on a national decision not to reimburse particular cross-border healthcare costs.As it could not be settled on the basis of the files submitted to the cjeu whether the Directive or the Regulation applied to the facts of the case under review, it based its ruling on both EU measures.The cjeu ruled that the decision would be in line with the Regulation if this piece of EU legislation was the relevant framework for review.If the decision had to be reviewed under the Patient Directive, this decision would have been incompatible with the relevant EU rules, unless it could have been justified on the ground that the care at issue needed to be planned.All in all, opting for the most favourable set of rules for cross-border healthcare has a lot in common with playing roulette.

Conclusions: The Need for a Patient Regulation
The European Union is slowly working towards a strong European Health Union.The ehds Regulation is supposed to form one of the building blocks of this project.The MyHealth@EU platform, based on Article 14 of the Patients Directive, is not effective in ensuring that digital health data are easily exchanged between Member States.This might lead to all kinds of problems and more in particular it discourages patients from seeking treatment in another Member State.However, to solve these problems, it is in our view not necessary to adopt a Regulation laying down rules governing all aspects concerning the use of digital health data.The current ehds Regulation covers many matters that are (virtually) not related to the free movement of patients but are connected with public healthcare goals mainly.It is, therefore, questionable whether the Union has the competence to create such a far-reaching and extensive Regulation on the basis of Article 114 tfeu.The proposal does encroach upon the healthcare competences of the Member States.As we 52

1
Proposal for a Regulation of the European Parliament and of the Council on the European Health Data Space, COM/2022/197 final.Another example is the European tourism data space.The Commission issued a communication with the 'building blocks' for this data space in July 2023.For more information see https://ec.europa.eu/commission/presscorner/detail/en/ip_23_3942 (accessed 4 September 2023). 2 See para.5 of the draft ehds Regulation. 3 See Section 1 of the explanatory memorandum of the Commission to the proposal for the ehds regulation, com (2022) 197 final.4 Ibid.
continue to experience disruption to continuity of care and healthcare providers will continue to struggle with accessing medical information timely in the provision of care, causing inefficiencies and ineffective healthcare and avoidable medical errors.'Moreover,'[t]he limited reuse of health data for research, innovation, policy-making and regulatory purposes would hamper the introduction of more efficient and effective healthcare and public health policy.'69See,e.g., the Study supporting the Impact Assessment of policy options for an EU initiative on a European Health Data Space, April 2022, p. iv, where the Commission mentions that 'health is not an exclusive competence of the Union but a shared competence' instead of focusing on the internal market as a shared competence.See also p. 46 of the same report where the competence to take action to protect health is also emphasised, 66 Case C-380/03, Germany v European Parliament and Council, 12 December 2006, ecli: EU:C:2005:772, paras 39 and 92; Case C-358/14, Poland v European Parliament and Council, 4 May 2016 ecli:EU:C:2016:323, para.34; and Case C-547/14, Philip Morris, 4 May 2016, ecli:EU:C:2016:325, para.60. 67 As the Commission mentions in the explanatory memorandum to the ehds Regulation, p. 6: 'Article 114 tfeu is the appropriate legal basis since the majority of provisions of this Regulation aim to improve the functioning of the internal market and the free movement of goods and services.'68 See, e.g., Impact Assessment to the ehds Regulation, supra note 61, p. 27, where the Commission mentions, amongst others, that without Union intervention: 'patients will although the Commission also refers to '[o]ther shared competences [such as] 'internal market' and "economic, social and territorial cohesion"' .70 Explanatory memorandum to the ehds Regulation, p. 6. 71 Impact Assessment to the ehds Regulation, supra note 61 p. 28.Downloaded from Brill.com 05/13/2024 09:48:29AM via Open Access.This is an open access article distributed under the terms of the CC BY 4.0 license.https://creativecommons.org/licenses/by/4.0/European Journal of Health Law (2024) 1-36