EEDS: data alignment and governance for clinics

The Regulation (EU) 2025/327, which establishes the European Health Data Space (EHDS), sets a common framework for access to and control of electronic health data and for its reuse under regulated conditions. The European Commission frames it as a rule to facilitate primary use (care) and secondary use (research, innovation and policy) of health data, including data from the private sector. In Spain, the Ministry of Health is already circulating implementation materials and the autonomous communities are beginning to incorporate the EHDS into their “data governance” structures, according to documentation from the Ministry itself and Andalusia’s Decree 189/2026.

For a clinic or private practice, the impact is not limited to “interoperability”: it affects how the electronic clinical record is managed, access controls and traceability, data preparation for exchange and governance when participating in (or receiving a request from) data reuse schemes. Part of the rollout depends on further development and operational coordination, according to information published by European institutions and the Ministry.

What the EHDS means for a private clinic

The official summary of Regulation (EU) 2025/327 on EUR-Lex places the objective on improving people’s access to and control of their personal electronic health data while enabling research and innovation through controlled secondary use. The Ministry of Health, in its outreach materials on the EHDS, presents the framework as a “paradigm shift” focused on continuity of care and mobility, with direct implications for how clinical data are structured and exchanged.

In the day-to-day of a private clinic, this generally translates into three review areas:

• Data that are structured and interoperable: what is recorded, the quality of the recording and how it can be shared, following the “digital health” approach described by the Ministry of Health.
• Governance and traceability: who accesses the data, on what legal basis and how access is audited — an axis that also appears linked to the EHDS in sector forums on confidentiality and unauthorised access.
• Secondary use: how to handle potential requests or participation in data ecosystems, with anonymisation or pseudonymisation in regulated environments, as the Ministry explains.

Access, confidentiality and “who gets into” the clinical record

Debates on unauthorised access, confidentiality and cyber‑risks related to the EHDS are already on the sector agenda. The General Council of Medical Associations (OMC), via its Médicos y Pacientes portal, notes that the EHDS will be one of the key topics at the National Congress of Health Law alongside protection of clinical information and unauthorised access to the clinical record.

For the manager of a private clinic, the actionable organisational point is to review roles and permissions, internal procedures for access control and evidence of traceability. Although the Regulation is framed at EU level, its practical application in private centres will depend on how exchange is arranged and on the technical and organisational requirements that are specified in guidance, developments and connected systems. At present, and pending a full operational rollout, the prudent recommendation is to treat it as a cross‑cutting compliance project: management, systems, quality and, if present, the data protection officer or external advisor.

Secondary use: private‑sector data also available under controlled conditions

The Ministry of Health states that the EHDS will also give the research and innovation community and policy makers access to certain types of health data from both the public and private sectors under controlled and secure conditions, with anonymised or pseudonymised data. This approach requires clinics to make a clear distinction between:

• Care data (primary use) and care pathways.
• Data for reuse (secondary use), which require specific controls, minimisation and strengthened governance, as described by the Ministry.

For clinics active in research, with agreements with third parties or participation in projects, the relevant change is in documentation and technical preparedness: data inventory, legal basis and contracts, and the capacity to respond to requests as the channels and competent authorities are defined in the rollout.

Data governance and regional coordination: the example of Andalusia

Decree 189/2026 of Andalusia includes, among the functions of its administrative structure, the design, monitoring and evaluation of health data governance policy and the implementation of the EHDS in coordination with relevant actors. These kinds of regional references anticipate that part of the implementation for private centres will be organised through regional initiatives and coordination with public systems.

For a clinic with sites across different autonomous communities or with interoperability with regional services, this reinforces the need to map regional dependencies (exchange circuits, platforms, integration requirements) and to keep internal procedures up to date so they align with each territorial framework where applicable.

AI in health: evaluation, data and metrics in projects

The BOE (Spain’s official gazette) published Disposición 19997 in BOE no. 238 of 2026, which describes the promotion of a common evaluation framework for AI projects in health through SEDISA’s AI Observatory, incorporating metrics on suitability, traceability and data governance, among other aspects. Although the text concerns the evaluation framework, it connects with a key element of the EHDS: without traceability and data governance, adoption of AI in clinical environments is exposed to compliance and internal control risks.

For the private clinic, the practical implication is to review, in any AI initiative (whether developed in‑house or by a supplier):

• Which data are used and the access and activity‑logging rules that apply.
• How the project’s data traceability and governance are justified, in line with elements set out in the BOE provision.
• What evidence is retained for internal audit and to respond to external requests.

What to review now in daily management (without waiting for projects)

The Ministry of Health’s outreach on the EHDS emphasises continuity of care, patient safety and mobility, but for a private clinic the immediate task is to turn that into an operational checklist:

• Inventory of systems and repositories: where clinical and administrative data reside and how they are exchanged, following the “data space” approach described by the Ministry.
• Data quality and structuring: critical fields, codifications and consistency, because the EHDS relies on reusable and interoperable data according to Ministry documents.
• Access and traceability policy: roles, logs, periodic reviews; unauthorised access and confidentiality are focal points in sector debate according to the OMC.
• Third‑party relationships: suppliers and projects (including AI), given their dependence on data governance, as the BOE notes in the AI evaluation framework.
• Regulatory monitoring: part of the rollout requires technical specification and coordination; it is advisable to monitor publications and guidance from the EU, the Ministry and, where relevant, the autonomous community.

Sector context: the EHDS is on the legal and professional agenda

The EHDS is consolidating as a cross‑cutting topic at health law gatherings. Médicos y Pacientes (OMC) places it alongside protection of clinical information and cyber‑risks, and Diario Enfermero reports sessions focused on “the practical application” of the European Health Data Space. For decision makers in private clinics, this presence indicates that adoption will not be treated as a purely technical project but as a change with compliance, organisational and accountability implications.

References and links

• Reglamento (UE) 2025/327 del EEDS (EUR-Lex).
• Materiales del Ministerio de Sanidad sobre EEDS y documento EEDS_WEB.
• BOE: Disposición 19997 (BOE núm. 238 de 2026) on the common evaluation framework for AI in health (SEDISA).
• Andalucía: Decreto 189/2026 and its reference to data governance and the EHDS.
• Sector agenda: OMC – Médicos y Pacientes (health law congress and the EHDS) and Diario Enfermero (practical application of the EHDS).

This article summarises publicly available sector information. It is not legal or fiscal advice.