The European Health Data Space after HIMSS Europe 2026, and what Hal Wolf asks it to protect

HIMSS Europe 2026 closed in Copenhagen in May, after three days of sessions on artificial intelligence, women's health, digital mental health and the European Health Data Space. Days later, Hal Wolf, president and CEO of HIMSS since 2017, summed up for Tech Anatomy what he had heard there. HIMSS is a non-profit focused on health information and technology, known among hospitals for its digital maturity models.

His overall reading was that the conversation had moved, in a year, from "experimentation" to "the beginning of deployment in earnest". The European Health Data Space, or EHDS, was where he was most specific about what could go wrong.

What the regulation sets out, and on which timetable

The EHDS is a regulation, Regulation (EU) 2025/327, which means it applies directly in every member state without being transposed into national law. It was signed on 11 February 2025, published in the Official Journal on 5 March and entered into force on 26 March 2025. Most obligations apply later, in stages.

It has two halves. Primary use covers people's access to their own health data and its exchange between professionals, including across borders, for care. Secondary use covers the reuse of health data for research, innovation, policy-making and regulation. For secondary use, each member state designates one or more health data access bodies, public authorities that decide whether to grant a permit for a given project. Data stays in secure processing environments, is anonymised unless pseudonymised data is strictly needed, may not be re-identified, and people can opt out.

According to the European Commission, the Commission must adopt the main implementing acts, the detailed technical rules, by March 2027. In March 2029, the first category of data, patient summaries and electronic prescriptions, has to be exchangeable in all member states, and secondary use rules start for most data categories, such as data from electronic health records. Medical images, laboratory results and hospital discharge reports follow in March 2031, along with secondary use of the remaining categories such as genomic data. From March 2035, third countries and international organisations can apply to join HealthData@EU, the infrastructure for secondary use.

How Wolf reads the purpose of the data space

Wolf did not start with patients. His first caution was "never toss the baby out with the bathwater", and the baby, in his account, is population-level data: "the aggregation of de-identified data in a secure way is a critical, critical path for understanding population health."

He traces the urgency to 2020. Europe then had "hardened silos country to country", and when COVID spread, "the ability to exchange data on a patient who crosses borders by car to go to work, you know, suddenly couldn't be kept up with." In his reading, the EHDS is part of the answer to that experience, and the risk he sees is a reversal under future pressure: "there's always a chance that things are going to go backwards again and start to create silos." What the regulation provides, he says, is a legal method for exchanging data across borders, and the task is to keep those pipelines open, because "we need the free flow of protected data."

He ties this to trust, which he describes as needed "on behalf of every individual, every government about how the data is going to be utilized", and which he sees as common to the EHDS and the AI Act.

Two readings of the same regulation

The first reading follows Wolf. The EHDS is infrastructure, and its value depends on whether the data actually flows. On this view, the main risks are political: member states that delay the technical work or rebuild barriers when a crisis makes sharing feel risky.

The second reading puts the weight on the safeguards. The regulation grew out of the Commission's 2020 data strategy, published in February of that year, which already planned sector-specific data spaces, with health as one of them, and the legislative proposal followed in May 2022. Its text spends as much effort on permits, secure environments and opt-outs as on exchange. From this angle, the question is less whether data will flow than whether citizens and clinicians will accept the conditions under which it does, and whether the opt-out remains marginal or grows large enough to weaken research datasets.

The two readings are not exclusive, and Wolf himself puts trust at the centre. They differ on where the likeliest failure lies.

Europe's regulatory pace, and the workforce argument behind it

Asked about challenges specific to Europe, Wolf named two. The first is where each country sits on the technology curve. Several are only now rolling out electronic medical records. He cited Italy, whose national recovery plan, funded through the EU's post-pandemic Recovery and Resilience Facility, includes investment in the national electronic health record and hospital digitalisation, and Germany, where a federal hospital funding programme came with a national digital maturity assessment run by a consortium led by HIMSS. He sees late adoption as partly an advantage, since newcomers can learn from earlier rollouts.

The second is regulation. Europe, in his words, builds "a regulatory environment that's designed for some levels of protection that the rest of the world will probably adopt at some point or another, or fall to the side." He does not frame this as a handicap: "I wouldn't say they have a disadvantage or an advantage, it's where they are on the curve." The timetable has moved since the interview. In June 2026, the EU gave final approval to a revision of the AI Act that postpones obligations for high-risk AI systems embedded in regulated products, which covers medical devices, to 2 August 2028.

Behind all of this is the workforce. Wolf argues that the visit-based model of care "just can't mathematically fulfill that need." In the interview he put the current shortage at around 10 million clinicians and said estimates for 2030 double or triple it. The World Health Organization's published figure is lower: a projected shortfall of 11 million health workers by 2030, mostly in low- and lower-middle-income countries.

What the interview does not establish

This was a short conversation, recorded days after the conference, with the head of an organisation whose work includes rating hospitals' digital maturity and advocacy on European digital health policy. HIMSS submitted recommendations to the European Commission when the EHDS was still a proposal. Wolf's account of a shift from pilots to deployment is an impression from the conference floor, not a measurement. He did not discuss what the EHDS changes concretely for an individual patient, or how health data access bodies are being set up country by country, and those are the parts patients and researchers will actually encounter.

What to watch

Wolf expects 2027 to be about "measuring impact". For the EHDS, the first markers are concrete: whether the Commission adopts its implementing acts on time by March 2027, how many health data access bodies are operational and issuing permits, and whether patient summaries and e-prescriptions actually cross borders in every member state by March 2029. The opt-out rate, once countries publish it, will show how much of the trust Wolf describes has been earned. His concern about silos returning under pressure can only be tested by the next crisis.

Listen to the episode

The European Health Data Space - Hal Wolf, HIMSS

Listen · 16 min