![[Translate to English:] European Health Data Space](/fileadmin/user_upload/European_Health_Data_Space.jpeg "[Translate to English:] European Health Data Space")
Image source: Adobe
The European Health Data Space (EHDS), which is governed by Regulation (EU) 2025/327 on the standardization and controlled use of electronic health data, imposes specific regulatory obligations on medical device manufacturers. The market to date has been characterized by proprietary data models, i.e., manufacturer-specific architectures that are not based on open standards, as well as by isolated data systems and proprietary interfaces. This has led to costs and dependencies.
The EHDS significantly increases the pressure for standardization. Companies that make interoperability, i.e., the ability of different systems to reliably exchange and process data, a core strategy early on reduce regulatory risks and strengthen their market position. At the same time, the regulation is changing staffing requirements: there is a demand for specialists who can integrate technology, regulatory requirements, and clinical processes.
The EHDS has three objectives: First, citizens should be able to use their health data across borders. Second, data should be able to be reused securely for research and health policy. Third, a more unified single market for EHR systems (Electronic Health Records, i.e., systems for managing electronic health records) should be created.
The regulation distinguishes between primary use, i.e., data processing in the direct context of care such as diagnosis, treatment, or prescription, and secondary use, i.e., the use of data outside its original purpose, for example, for research, healthcare analyses, or regulation.
Not every medical device is automatically affected. Manufacturers whose products claim interoperability with EHR systems or interact with harmonized EHR functions are particularly relevant. The regulation entered into force on March 26, 2025. The phased implementation will proceed as follows: Starting in 2029, the requirements will apply to patient summaries and prescriptions; starting in 2031, they will apply to imaging, laboratory data, and discharge summaries. Manufacturers should therefore begin assessing now to what extent their products fall within the scope of the EHDS, as experience has shown that lead times for architectural changes are long.
In hospitals, devices and systems from different manufacturers with varying data models, protocols, terminologies, and security mechanisms typically coexist. Until now, these siloed solutions were often connected via proprietary connectors. The EHDS is changing this: interoperability is shifting from an optional product feature to a regulatory requirement. EHR systems must not hinder authorized access, data exchange, or export through technical restrictions.
A key technical component is HL7 FHIR (Fast Healthcare Interoperability Resources), an open standard for the structured exchange of health data, in conjunction with EEHRxF (European Electronic Health Record Exchange Format), the common EU exchange format for electronic health data. Important: FHIR alone does not guarantee EHDS compliance. The binding European specifications, harmonized standards, and specific implementing acts are decisive. APIs (Application Programming Interfaces, i.e., standardized interfaces for data exchange between systems) must be permanently documented, tested, and operated with version control.
Those who implement interoperability reliably and in a verifiable manner reduce integration and switching costs for hospitals. This is a tangible differentiator in sales.
In our consulting practice, we regularly see that companies underestimate this step. An API that technically transmits data but does not offer reliable identity verification, error handling, and traceability does not meet modern governance standards.
Interoperability requires that data quality be sound. A measurement value without a unit, timestamp, or patient assignment is clinically useless, even if it is transmitted as an FHIR resource. Manufacturers must therefore fully document data flows. Where is a piece of data generated, who is authorized to read, modify, or export it, and how is access logged?
Audit trails, i.e., complete and tamper-proof records of all data access and modifications, are not an optional add-on but a core requirement. Data protection is fully maintained. The EHDS supplements the GDPR (General Data Protection Regulation, the EU regulation on the protection of personal data) but does not replace it. Health data falls under the category of specially protected data.
Secondary use opens up potential for research and evidence generation, but also imposes strict governance requirements. These include purpose limitation, pseudonymization (replacing direct personal identifiers with neutral identifiers so that data cannot be attributed to a specific individual without additional information), access authorization, and terms of use.
In an increasingly interconnected world, “security by design” is becoming increasingly important. “Security by design” refers to the integration of security requirements into product development. This means that these requirements are incorporated into a product’s development from the very beginning, rather than being added later. Encryption, access management, and vulnerability management must be integrated into the product architecture.
The following terms are not legally prescribed job titles, but rather describe functional areas that are typically relevant to EHDS implementation projects:
We are not looking for pure FHIR developers. We are seeking individuals who have a deep understanding of technical standards, regulatory requirements under the EU Medical Device Regulation (MDR) and the General Data Protection Regulation (GDPR), as well as clinical processes. Hybrid profiles are particularly valuable: These include software architects with clinical data expertise, regulatory affairs managers with interoperability experience, and clinical informaticians with practical API skills.
We’ve observed in our industry that the shortage isn’t caused solely by a lack of FHIR knowledge. It is more difficult to find people who are proficient in healthcare processes, interoperability standards, regulatory affairs, and stakeholder management all at once. Companies should therefore define key roles early on and build internal expertise, rather than waiting to recruit until they face acute implementation pressure. For applicants, concrete proof of project experience is more convincing than certificates alone.
The EHDS is not an optional digitization project, but a binding regulatory framework with clear deadlines. Companies should therefore begin analyzing how they are affected, evaluating their product architecture and data flows, and establishing governance and compliance structures now, rather than waiting until shortly before 2029.
With the gradual expansion to include imaging, laboratory data, and secondary use, data quality, metadata, access processes, and secure analysis environments will become increasingly important.
For job candidates, those who combine expertise in FHIR, clinical data models, regulatory affairs, and data protection and can demonstrate practical implementation experience will be well-positioned in this market.
If you are looking for qualified and motivated specialists and executives for your company, we can support you with our specialized network. In particular, for EHDS-related positions at the intersection of health data standards, API architecture, data governance, and regulatory affairs, we connect you with candidates who combine technical and regulatory expertise. For over 15 years, the recruitment consultants at BESTMINDS have been filling vacancies in the medical technology, healthcare, life sciences / pharma, energy / utility, and IT / media sectors with a wealth of expertise and dedication. We find the right candidates for you in a fair, loyal, and discreet manner. Contact us for a no-obligation initial consultation so that we can fill your vacancies quickly and effectively.
