This extension provides concepts to support implementations of the EU Health Data Space ([[EHDS]]) regulation by providing concepts and methods for implementing the regulation, as well as to support its alignment with other regulations such as GDPR, DGA, and AI Act.

NOTE: This is a draft vocabulary, which is being updated as the EHDS text is published and formally recognised as a regulation. Currently, for the next release we are working on concepts related to entities, e.g., manufacturers of EHR systems and digital health authorities, data categories, e.g., electronic health data, purposes, e.g., healthcare service provision, technologies, e.g., EHR systems or wellness applications, rights, e.g., of natural persons, and organisational measures, e.g., data requests and activity reports. The DPVCG welcomes participation and contributions for this work.

Introduction

The [[EHDS]] is an upcoming regulation that establishes a data space for the sharing and reuse of 'health data'. The regulation is expected to be published in 2025, and will outline the specific framework and obligations for implementing the health data space(s). The document establishing an agreed text between the EU's law-making bodies can be found in the associated press release (direct link to PDF). While the final text will contain revisions, the intent and implementing aspects of the regulation can be expected to be the same.

The implementation of the [[EHDS]] is of great interest due to its potential for unlocking and expanding the use of data currently stored in various health institutions, and to use this for progressive scientific research that will enhance healthcare and benefit society. For this, the HealthData@EU Pilot is a pilot project that is building the infrastructure for implementing the [[EHDS]]. It is creating the [[[HealthDCAT-AP]]] specification, which expands the well-adopted DCAT-AP specification for specifying metadata and catalogues of health datasets, which can then be accessed and reused via a common portal.

The [[HealthDCAT-AP]]'s specification reuses [[DPV]] concepts and properties to represent information about personal data, legal bases, purpose, and jurisdiction. See the note on DPVCG mailing list for more details. The aim of this extension is thus to support implementations like [[HealthDCAT-AP]] by providing a specific vocabulary that extends [[DPV]] concepts to represent the categories of personal data, legal bases, purposes, technical and organisational measures, and other processes and artefacts that are necessary to implement and support the [[EHDS]]. In this, we seek to work closely with efforts such as the HealthData@EU to avoid duplication of efforts and to develop a consistent and useful solution for stakeholders.

The rest of the document describes a draft vocabulary that was developed based on the initial documents of the [[EHDS]], and which shows how the concepts from the regulation can be modelled within the framework of [[DPV]] specifications to enable implementing the requirements of the [[EHDS]]. As the state of the [[EHDS]] regulation progresses towards a formal publication and then real-world implementation, the DPVCG will be updating this vocabulary with more concepts and guidance to support use-cases.

Data

This section contains concepts representing the categories of data described in the EHDS. The EHDS defines 'electronic health data', which encompasses both personal and non-personal electronic health data. Furthermore, Article 14 defines priority categories of personal electronic health data for primary use, and Article 51 establishes the minimum categories of electronic health data for secondary use. In the next iteration of this extension, the categories of Article 14 and 51 will be aligned with the [[EHDS]] concepts of personal and non-personal electronic health data.

In future iterations, the DPVCG is interested in further refining this vocabulary by aligning the concepts with those from [[DPV]] - in particular to establish personal data that are sensitive, and personal data that are classified as special category for use with the [[EU-GDPR]] extension. The DPVCG is also interested to align and enhance the categories of personal data with the [[PD]] extension, and the [[SECTOR-HEALTH]] sectorial extension which models generic healthcare concepts.

Entities

This section contains concepts representing the categories and roles of legal entities described in the EHDS. In future iterations, the DPVCG is interested in further refining this vocabulary by aligning the concepts with those from [[DPV]] - in particular to establish entities that are non-commercial or non-profit in nature, or are research organisations, as well as to represent commonly occurring entity categories such as hospitals, clinics, and other relevant concepts in alignment with the [[SECTOR-HEALTH]] sectorial extension which models generic healthcare concepts.

Purposes

This section contains concepts representing the categories of purposes described in the EHDS. Article 2.2(d) defines purposes for the processing of electronic health data for primary use, while Article 53 establishes the purposes for which electronic health data can be processed for secondary use. The DPVCG is interested in providing guidance on how to use these concepts to express primary and secondary use scenarios.

In future iterations, the DPVCG is interested in further refining this vocabulary by aligning the concepts with those from [[DPV]] - in particular to establish purposes that can be considered as relevant to the provision of healthcare, or for public benefit, or are necessary for medical research. The DPVCG is also interested to align and enhance the categories of purposes with the [[SECTOR-HEALTH]] sectorial extension which models generic healthcare concepts.

Processes

This section contains miscellaneous concepts that can be considered as processes under the EHDS. These will be changed in future versions of the extension. The current concepts of 'health data request' and 'data permit' represent the mechanisms through which data is to be requested and through which it will be permitted to be used. The DPVCG is interested in modelling these in terms of specific activities - including how to request, how to express information in a request, lifecycle of a request (e.g., request made, being considered, accepted, or refused), and the accompanying assessments (request validity, risk/impact assessment), and documentation (request log, request report). Likewise, the use of data will also require specific concepts that model such specific processes and artefacts. Further, the DPVCG is interested in establishing specific legal bases and mechanisms that are crucial for the implementation of the EHDS, including its alignment with other extensions implementing regulations such as [[EU-GDPR]] and [[EU-DGA]].

Technologies

This section contains concepts regarding the technologies mentioned in the EHDS regulation, namely related to EHR systems, wellness applications, and data access services. These will be changed in future versions of the extension. Concepts related to technologies are also provided in [[TECH]] (generic) and [[SECTOR-HEALTH]] (health-specific).

Rights

This section provides concepts representing several rights to natural and legal persons whose applicability depends on the context and nature of processing taking place. In addition to these concepts, the DPVCG is interested in providing additional concepts, e.g., impacts on rights and justifications, and documentation related to the exercising and management of these rights. Furthermore, the DPVCG is interested in the alignment of these rights with rights from other extensions implementing regulations such as the [[EU-GDPR]] and [[EU-DGA]].

Tech/Org Measures

This section contains concepts regarding the technical and organisational measures mentioned in the EHDS regulation. These will be changed in future versions of the extension. Concepts are also provided in [[DPV]] (generic) and [[SECTOR-HEALTH]] (health-specific). In this context, the DPVCG is interested in providing guidelines on how to express information related to activities reported by a digital health authority, documentation of EHR systems or databases of EHR systems and wellness applications.

Vocabulary Index