This extension provides concepts to support implementations of the upcoming EU Health Data Space (EHDS) regulation by providing concepts and methods for implementing the regulation, as well as to support its alignment with other regulations such as GDPR, DGA, and AI Act.

NOTE: This is a draft vocabulary, which will be updated as EHDS is published and formally recognised as a regulation. The DPVCG welcomes participation and contributions for this work.

Introduction

The European Health Data Space (EHDS) is an upcoming regulation that establishes a data space for the sharing and reuse of 'health data'. The regulation is expected to be published in 2025, and will outline the specific framework and obligations for implementing the health data space(s). The document establishing an agreed text between the EU's law-making bodies can be found in the associated press release (direct link to PDF). While the final text will contain revisions, the intent and implementing aspects of the regulation can be expected to be the same.

The implementation of the EHDS is of great interest due to its potential for unlocking and expanding the use of data currently stored in various health institutions, and to use this for progressive scientific research that will enhance healthcare and benefit society. For this, the HealthData@EU Pilot is a pilot project that is building the infrastructure for implementing the EHDS. It is creating the HealthDCAT-AP specification, which expands the well-adopted DCAT-AP specification for specifying metadata and catalogues of health datasets, which can then be accessed and reused via a common portal.

The HealthDCAT-AP's specification reuses [[DPV]] concepts and properties to represent information about personal data, legal bases, purpose, and jurisdiction. See the note on DPVCG mailing list for more details. The aim of this extension is thus to support implementations like HealthDCAT-AP by providing a specific vocabulary that extends [[DPV]] concepts to represent the categories of personal data, legal bases, purposes, technical and organisational measures, and other processes and artefacts that are necessary to implement and support the EHDS. In this, we seek to work closely with efforts such as the HealthData@EU to avoid duplication of efforts and to develop a consistent and useful solution for stakeholders.

The rest of the document describes a draft vocabulary that was developed based on the initial documents of the EHDS, and which shows how the concepts from the regulation can be modelled within the framework of [[DPV]] specifications to enable implementing the requirements of the EHDS. As the state of the EHDS regulation progresses towards a formal publication and then real-world implementation, the DPVCG will be updating this vocabulary with more concepts and guidance to support use-cases.

Data

This section contains concepts representing the categories of data described in the EHDS. In future iterations, the DPVCG is interested in further refining this vocabulary by aligning the concepts with those from [[DPV]] - in particular to establish personal data that are sensitive, and personal data that are classified as special category for use with the [[EU-GDPR]] extension. The DPVCG is also interested to align and enhance the categories of personal data with the [[PD]] extension, and the [[SECTOR-HEALTH]] sectorial extension which models generic healthcare concepts.

Entities

This section contains concepts representing the categories and roles of entities described in the EHDS. In future iterations, the DPVCG is interested in further refining this vocabulary by aligning the concepts with those from [[DPV]] - in particular to establish entities that are non-commercial or non-profit in nature, or are research organisations, as well as to represent commonly occurring entity categories such as hospitals, clinics, and other relevant concepts in alignment with the [[SECTOR-HEALTH]] sectorial extension which models generic healthcare concepts.

Purposes

This section contains concepts representing the categories of purposes described in the EHDS. In future iterations, the DPVCG is interested in further refining this vocabulary by aligning the concepts with those from [[DPV]] - in particular to establish purposes that can be considered as relevant to the provision of healthcare, or for public benefit, or are necessary for medical research. The DPVCG is also interested to align and enhance the categories of purposes with the [[SECTOR-HEALTH]] sectorial extension which models generic healthcare concepts.

Processes

This section contains miscellaneous concepts that can be considered as processes under the EHDS. These will be changed in future versions of the extension. The current concepts of 'data request' and 'data permit' represent the mechanisms through which data is to be requested and through which it will be permitted to be used. The DPVCG is interested in modelling these in terms of specific activities - including how to request, how to express information in a request, lifecycle of a request (e.g. request made, being considered, accepted, or refused), and the accompanying assessments (request validity, risk/impact assessment), and documentation (request log, request report). Likewise, the use of data will also require specific concepts that model such specific processes and artefacts. Further, the DPVCG is interested in establishing specific legal bases and mechanisms that are crucial for the implementation of the EHDS, including its alignment with other extensions implementing regulations such as [[EU-GDPR]] and [[EU-DGA]].

Vocabulary Index